Reporting

HELP US KEEP OUR COMMUNITIES SAFE

Preventing terrorist or other criminal activities and emergencies is much easier and more effective than reacting to the aftermath. And it saves lives.

That's why the NCRIC encourages you to contact your local law enforcement agency with tips on wanted individuals, unsolved crimes, or potential threats.

For urgent threats and incidents, Dial 911 or the FBI -JTTF at (415) 553-7400. For non-urgent tips or leads, call 415-233-9276 (24/7) or email: dutyofficer@ncric.ca.gov

Learn more about the Nationwide SAR Initiative

Effective April 2024, NCRIC has transitioned to a new intake system for reporting. Partners with an active account should use the "Forgot Password" link to set a new password for the new platform.

fm=f_akGkEBo (1189×882)

HELP US KEEP OUR COMMUNITIES SAFE

Preventing terrorist or other criminal activities and emergencies is much easier and more effective than reacting to the aftermath. And it saves lives.

That's why the NCRIC encourages you to contact your local law enforcement agency with tips on wanted individuals, unsolved crimes, or potential threats.

For urgent threats and incidents, Dial 911 or the FBI -JTTF at (415) 553-7400. For non-urgent tips or leads, call 1-415-233-9276 (24/7) or Email: dutyofficer@ncric.ca.gov
Learn more about the Nationwide SAR Initiative

Effective April 2024, NCRIC has transitioned to a new intake system for reporting. Partners with an active account should use the "Forgot Password" link to set a new password for the new platform.

fm=f_akGkEBo (1189×882)

SUSPICIOUS ACTIVITY REPORTING (SAR) CRITERIA GUIDE DEFINED CRIMINAL ACTIVITY AND POTENTIAL TERRORISM

 

Breach/Attempted Intrusion

 

Unauthorized personnel attempting to enter or actually entering a restricted area, secured protected site, or nonpublic area. Impersonation of authorized personnel (e.g., police/security officers, janitor, or other personnel).

 

Misrepresentation

 

Presenting false information or misusing insignia, documents, and/or identification to misrepresent one’s affiliation as a means of concealing possible illegal activity.

 

Theft/Loss/Diversion

 

Stealing or diverting something associated with a facility/infrastructure or secured protected site (e.g., badges, uniforms, identification, emergency vehicles, technology, or documents {classified or unclassified}), which are proprietary to the facility/infrastructure or secured protected site.

 

Sabotage/Tampering/
Vandalism

 

Damaging, manipulating, defacing, or destroying part of a facility/infrastructure or secured protected site.

 

Cyber Attack

 

Compromising, or attempting to compromise or disrupt an organization's information technology infrastructure.

 

Expressed or Implied Threat

 

Communicating a spoken or written threat to commit a crime that will result in death or bodily injury to another person or persons or to damage or compromise a facility/infrastructure or secured protected site.

 

Aviation Activity

 

Learning to operate, or operating an aircraft, or interfering with the operation of an aircraft in a manner that poses a threat of harm to people or property and that would arouse suspicion of terrorism or other criminality in a reasonable person.  Such activity may or may not be a violation of Federal Aviation Regulations.

 

POTENTIAL CRIMINAL OR NON-CRIMINAL ACTIVITY REQUIRING ADDITIONAL INFORMATION DURING VETTING *

Eliciting Information

 

Questioning individuals or otherwise soliciting information at a level beyond mere curiosity about a public or private event or particular facets of a facility’s or building’s purpose, operations, security procedures, etc., in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

 

Testing or Probing of Security

 

Deliberate interactions with, or challenges to, installations, personnel, or systems that reveal physical, personnel, or cybersecurity capabilities in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

 

Recruiting/Financing

 

Providing direct financial support to operations teams and contacts or building operations teams and contacts; compiling personnel data, banking data, or travel data in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person

 

Photography

 

Taking pictures or video of persons, facilities, buildings, or infrastructure in an unusual or surreptitious manner that would arouse suspicion of terrorism or other criminality in a reasonable person. Examples include taking pictures or video of infrequently used access points, the superstructure of a bridge, personnel performing security functions (e.g., patrols, badge/vehicle checking), security-related equipment (e.g., perimeter fencing, security cameras), etc.

 

Observation/Surveillance

 

Demonstrating unusual or prolonged interest in facilities, buildings, or infrastructure beyond mere casual (e.g., tourists) or professional (e.g., engineers) interest and in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.  Examples include observation through binoculars, taking notes, attempting to mark off or measure distances, etc. 

 

Materials Acquisition/Storage

 

Acquisition and/or storage of unusual quantities of materials such as cell phones, pagers, radio control toy servos or controllers; fuel, chemicals, or toxic materials; and timers or other triggering devices, in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

 

Acquisition of Expertise

 

Attempts to obtain or conduct training or otherwise obtain knowledge or skills in security concepts, military weapons or tactics, or other unusual capabilities in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

 

Weapons Collection/ Discovery

 

Collection or discovery of unusual amounts or types of weapons, including explosives, chemicals, and other destructive materials, or evidence, detonations or other residue, wounds, or chemical burns, that would arouse suspicion of terrorism or other criminality in a reasonable person.

 

Sector-Specific Incident

 

Actions associated with a characteristic of unique concern to specific sectors (e.g., the public health sector), with regard to their personnel, facilities, systems, or functions in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

 

* These activities are not inherently criminal behaviors and may include constitutionally protected activities that must not be documented in an ISE-SAR that contains PII unless there are articulable facts or circumstances that clearly support the determination that the behavior observed is not innocent, but rather reasonably indicative of pre-operational planning associated with terrorism. Race, ethnicity, gender, national origin, religion, sexual orientation, or gender identity must not be considered as factors creating suspicion (but attributes may be documented in specific suspect descriptions for identification purposes). The activities listed as “Potential Criminal or Non-Criminal Activity” are not inherently criminal behaviors and are potentially constitutionally protected; thus, additional facts or circumstances must be articulated in the incident.

SUSPICIOUS ACTIVITY REPORTING (SAR) CRITERIA GUIDE DEFINED CRIMINAL ACTIVITY AND POTENTIAL TERRORISM

Breach/Attempted Intrusion

Unauthorized personnel attempting to enter or actually entering a restricted area, secured protected site, or nonpublic area. Impersonation of authorized personnel (e.g., police/security officers, janitor, or other personnel).

Misrepresentation

Presenting false information or misusing insignia, documents, and/or identification to misrepresent one’s affiliation as a means of concealing possible illegal activity.

Theft/Loss/Diversion

Stealing or diverting something associated with a facility/infrastructure or secured protected site (e.g., badges, uniforms, identification, emergency vehicles, technology, or documents {classified or unclassified}), which are proprietary to the facility/infrastructure or secured protected site.

Sabotage/Tampering/Vandalism

Damaging, manipulating, defacing, or destroying part of a facility/infrastructure or secured protected site.

Cyber Attack

Compromising, or attempting to compromise or disrupt an organization's information technology infrastructure.

Expressed or Implied Threat

Communicating a spoken or written threat to commit a crime that will result in death or bodily injury to another person or persons or to damage or compromise a facility/infrastructure or secured protected site.

Aviation Activity

Learning to operate, or operating an aircraft, or interfering with the operation of an aircraft in a manner that poses a threat of harm to people or property and that would arouse suspicion of terrorism or other criminality in a reasonable person.  Such activity may or may not be a violation of Federal Aviation Regulations.

POTENTIAL CRIMINAL OR NON-CRIMINAL ACTIVITY REQUIRING ADDITIONAL INFORMATION DURING VETTING *

Eliciting Information

Questioning individuals or otherwise soliciting information at a level beyond mere curiosity about a public or private event or particular facets of a facility’s or building’s purpose, operations, security procedures, etc., in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

Testing or Probing of Security

Deliberate interactions with, or challenges to, installations, personnel, or systems that reveal physical, personnel, or cybersecurity capabilities in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

Recruiting/Financing

Providing direct financial support to operations teams and contacts or building operations teams and contacts; compiling personnel data, banking data, or travel data in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person

Photography

Taking pictures or video of persons, facilities, buildings, or infrastructure in an unusual or surreptitious manner that would arouse suspicion of terrorism or other criminality in a reasonable person. Examples include taking pictures or video of infrequently used access points, the superstructure of a bridge, personnel performing security functions (e.g., patrols, badge/vehicle checking), security-related equipment (e.g., perimeter fencing, security cameras), etc.

Observation/Surveillance

Demonstrating unusual or prolonged interest in facilities, buildings, or infrastructure beyond mere casual (e.g., tourists) or professional (e.g., engineers) interest and in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.  Examples include observation through binoculars, taking notes, attempting to mark off or measure distances, etc. 

Materials Acquisition/Storage

Acquisition and/or storage of unusual quantities of materials such as cell phones, pagers, radio control toy servos or controllers; fuel, chemicals, or toxic materials; and timers or other triggering devices, in  a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

Acquisition of Expertise

Attempts to obtain or conduct training or otherwise obtain knowledge or skills in security concepts, military weapons or tactics, or other unusual capabilities in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

Weapons Collection/ Discovery

Collection or discovery of unusual amounts or types of weapons, including explosives, chemicals, and other destructive materials, or evidence, detonations or other residue, wounds, or chemical burns, that would arouse suspicion of terrorism or other criminality in a reasonable person.

Sector-Specific Incident

Actions associated with a characteristic of unique concern to specific sectors (e.g., the public health sector), with regard to their personnel, facilities, systems, or functions in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person.

* These activities are not inherently criminal behaviors and may include constitutionally protected activities that must not be documented in an ISE-SAR that contains PII unless there are articulable facts or circumstances that clearly support the determination that the behavior observed is not innocent, but rather reasonably indicative of pre-operational planning associated with terrorism. Race, ethnicity, gender, national origin, religion, sexual orientation, or gender identity must not be considered as factors creating suspicion (but attributes may be documented in specific suspect descriptions for identification purposes). The activities listed as “Potential Criminal or Non-Criminal Activity” are not inherently criminal behaviors and are potentially constitutionally protected; thus, additional facts or circumstances must be articulated in the incident.