Normal Things That Are Actually FBI Warning Signs
Tactical Positioning
When walking into a restaurant, most people grab the nearest
open seat, but some scan the room
and sit in the corner with their back to the wall and eyes on the door.
To most, this seems like an antisocial quirk,
but the FBI calls it tactical positioning.
It is one of the first things looked for when profiling trained operatives.
The technical term is situational awareness.
It goes beyond picking a seat—people with this habit count exits,
notice who is paying attention,
and clock what everyone near them is wearing.
The FBI flags this as a marker of a military special operations
background, intelligence training, or serious criminal experience.
All three groups share the same motivation
to never let anyone sneak up behind them.
Buying Cold Medicine
Buying cold medicine containing pseudoephedrine places
your name, ID, and purchase amount into a real-time federal
tracking system called the National Precursor Log Exchange (NPLX).
The legal limit is 3.6 grams per day and 9 grams per month,
allowing roughly seven boxes a month
before the system flags the buyer.
Attempting to buy from multiple pharmacies to bypass limits
does not work, as the system communicates
with pharmacies in real time.
Because pseudoephedrine is a key ingredient
in manufacturing methamphetamine,
this log monitors allergy sufferers making routine purchases.
Controlled Calm
Airport security is naturally chaotic,
with people rushing and fumbling.
However, a person moving through security with complete,
unbothered calm is specifically watched by TSA and FBI agents.
Under the Screening of Passengers by
Observation Techniques (SPOT) program,
behavioral experts look for pattern breaks.
Controlled calm differs from being relaxed;
a relaxed person still reacts to surroundings,
whereas a person exhibiting controlled calm
is intensely focused inward.
Appearing completely unbothered in an environment designed
to be stressful stands out as a major pattern break.
The Go Bag
While an emergency kit contains survival basics like water
and first aid for natural disasters, a flight bag
or go bag contains cash, multiple forms of ID,
a burner phone, and zero trackable electronics.
Law enforcement views a bag containing no electronics
as a potential flight bag meant for evading law enforcement
rather than preparing for a natural disaster.
The level of organization also serves as an indicator:
a messy bag signals an unprepared civilian,
whereas a perfectly organized bag with laminated documents
and vacuum-sealed clothing suggests a rehearsed departure.
The Lockpicking Hobby
Lockpicking is a legal hobby with dedicated competitions
and online communities,
but from a surveillance standpoint,
it represents a dual-use skill that mimics breaking and entering.
When hobbyists document defeating high-security
locks—such as the Medeco M3 used in government buildings
and banks—on public forums,
they publicly document their ability to bypass bank-grade security.
The hobby’s ranking system, which progresses from white belt
to black belt, also tracks advancing proficiency.
Photographing Infrastructure
Photographing bridges, dams, and power plants ranks high
on the list of pre-attack surveillance behaviors,
as attackers study entry points, cameras,
and structural weak spots prior to an event.
Through the Nationwide Suspicious Activity Reporting Initiative,
citizens report individuals focused on infrastructure.
For instance, a photographer taking detailed photos
of an electrical substation in Ohio was reported
and visited by the FBI within 48 hours
due to the risk of regional power disruptions.
Knowing a Secret Detail
In criminal investigations, key details are intentionally
withheld from the public so that only the perpetrator
would know them.
When a suspect accidentally reveals one of these
unreleased details, investigators refer to it as “leakage.”
Leakage occurs when a suspect talks excessively
or forgets what information has been made public.
In one case, a suspect repeatedly referred to
a missing person in the past tense before police had confirmed
her death, revealing information only the perpetrator could know.
Your Family’s Search History
Algorithms look beyond individual searches to analyze
search patterns across all devices connected to a single
household IP address, a technique known as link analysis.
In one instance following the Boston Marathon bombing,
a family received a visit from federal agents after the husband
searched for pressure cookers,
the wife searched for backpacks,
and the son read news about the bombing.
While innocent individually, the combined pattern
across the household triggered suspicion.
Withdrawing Your Own Money
Banks automatically report cash transactions exceeding $10,000
to the government.
Withdrawing amounts slightly below this threshold—such as
$9,900—specifically to avoid the reporting requirement
is a federal crime known as structuring or “smurfing.”
Automated software utilized by the FBI
and IRS flags these frequent sub-threshold transactions.
The IRS can seize bank accounts under structuring suspicions
without criminal charges, requiring the owner to prove the
transactions were non-deliberate to recover the funds.
The Flight School Student
Enrolling in flight training while refusing or declining instruction
on how to land is a primary indicator of suspicious activity.
Prior to September 11,
co-conspirator Zacarias Moussaoui raised suspicion
at a Minnesota flight school by explicitly requesting to learn
only how to take off and steer, leading an instructor
to contact the FBI.
Following 9/11, suspicious activity reporting systems
were overhauled, making explicit refusal of landing instruction
a standard checklist flag for flight instructors.
