"The threat you dismiss is the threat that finds you unprepared."
Threat Recognition and Indicators of Radicalisation
Professor Sele: The most valuable CT intervention happens before the attack is planned — when the potential attacker is still in the radicalisation process and detection is possible. This module teaches you to recognise the indicators that should trigger a report.
Section 1 — Behavioural Indicators of Radicalisation
The following are recognised indicators that an individual may be on a pathway to radicalisation. No single indicator is conclusive — patterns and combinations matter: sudden withdrawal from normal social relationships and activities; expression of extreme grievance against a government, ethnic group, or religion; consumption and sharing of extremist content online; expressing admiration for extremist groups or their activities; expressing willingness or desire to commit violent acts for a cause; changes in appearance or behaviour associated with adopting an extremist identity; contact with known or suspected extremist individuals or networks; travel to or from conflict areas without credible explanation.
Section 2 — Workplace Indicators
In a security workplace context, additional indicators include: colleagues reporting concerns about an individual's expressed views; unusual access requests or interest in restricted areas or information; expression of grievance against the employer, client, or specific ethnic or religious groups; unexplained changes in financial status (possible recruitment payment); receiving instructions or communications that the individual conceals.
Section 3 — Pre-Attack Indicators
When a threat actor moves from radicalisation to active planning, pre-attack indicators emerge: conducting reconnaissance of potential targets (photography, observation, pattern-of-life mapping); acquiring materials that could be used in an attack (weapons, chemicals, vehicles); testing security responses (false alarms, probing access controls); changes in communication patterns (switching to encrypted apps, reducing contact); will-making behaviour or statements suggesting the individual does not expect to survive.
Section 4 — How to Handle an Indicator
When an indicator is observed: Document — record exactly what was observed, when, where, and by whom, factually and without interpretation. Do not confront — confronting the individual can accelerate the threat, destroy intelligence value, and create physical danger. Report — report immediately to the SafeHaven Operations Commander and, through appropriate channels, to the LNP NSB (National Security Branch). Maintain discretion — do not discuss the report with colleagues; operational security protects the investigation.
- •Behavioural indicators: social withdrawal, grievance expression, extremist content consumption, contact with extremist networks
- •Pre-attack indicators: reconnaissance, material acquisition, security testing, communication changes
- •Do not confront — document and report through appropriate channels
- •No single indicator is conclusive — patterns and combinations matter
- •Discretion after reporting protects the investigation
"A guard came to me privately about a colleague who had been making comments that concerned him — nothing overtly threatening, but a pattern over weeks. I documented what he told me, submitted it through the appropriate channel, and took the guard off that shift without explanation to either party. Three weeks later, national security confirmed the colleague had been in contact with a network of interest. The guard's instinct, and his decision to report rather than confront, protected everyone. Trust your instincts. Report. Let the professionals investigate."
Which of the following is a recognised behavioural indicator of potential radicalisation?