Since the terrorist attacks of September 11, 2001, there have been repeated calls to find better ways to “connect the dots” by identifying and assembling small bits of information that collectively could spotlight a potential terrorist plot in progress. In recent years, the federal government has encouraged state and local law enforcement agencies to establish fusion centers to integrate data from different sources to create actionable knowledge. Yet while substantial direction has been provided on how to establish, organize, and manage a fusion center, little guidance has been offered on how to conduct data fusion for counterterrorism purposes.¹

Past experiences have shown that both international and domestic terrorist organizations use surveillance-based activities as part of their site selection and operational planning phases. In 2006, for example, two men were charged with taking surveillance video of the U.S. Capitol building, the World Bank, a Masonic temple, and a fuel depot in Washington, D.C., to send to overseas terrorist groups.² One approach to detecting terrorist activity is to identify instances of preplanning behaviors, including surveillance and probing of potential targets. Preplanning behaviors can include videotaping, photographing, or writing notes or drawing sketches of a building’s structural components or security defenses. Other activities include trespassing in secure areas, asking detailed questions about a target’s occupants or defenses, or leaving suspicious packages or making bomb threats to study emergency response operations.