Culture Is Not a Clue: What Every Officer Must Know About Counterterrorism

7 min read

Local police have become the front line of counterterrorism in the United States. Officers in patrol cars, neighborhood commands, and detective squads are the ones who see the street-level clues long before an intelligence report ever hits a briefing room. That makes their judgment critical. It is not enough to “see something.” We need officers who can separate actual pre-attack behaviors from simple cultural differences, and who understand how confirmation bias can quietly push them toward the wrong conclusions.

Why Local Work Matters So Much

Most plots do not start with a dramatic tip or a high-level briefing. They start with small things that seem slightly off: a car that keeps circling a critical location, the same person showing up around infrastructure sites with no clear reason, or repeated questions about security procedures that feel a little too curious. Local agencies are uniquely positioned to notice and connect these dots because they know their communities, their landmarks, and their normal routines.

After 9/11, the expectations on local departments changed. They are not just expected to respond after an attack. They are expected to prevent one. That responsibility runs through everything: patrol, community policing, special operations, and investigative work. It also raises the cost of bad judgment. If we misread the signs and miss a genuine threat, people can die. If we misread innocuous behavior as terrorism-related, we undermine trust and damage the relationship between the police and the community.

Understanding the Pre-Attack Cycle

Most terrorist operations follow some version of the same basic cycle: idea, target selection, surveillance, planning, rehearsal, final preparation, and attack. For local practitioners, the key phases to understand are surveillance and planning, because those are the stages where behavior is visible on the street.

Pre-attack surveillance can include:

Repeated visits to a target with no clear legitimate purpose.
Focused attention on security features like cameras, access points, and guard routines.
Detailed note-taking, sketches, or photos that center on vulnerabilities rather than tourist attractions.

Planning behaviors can include efforts to collect floor plans, study shift changes, identify choke points and escape routes, or test response times. In some cases, offenders conduct dry runs: walking the route they would use, timing movements, or testing how close they can get before being stopped or challenged.

These are behaviors that serve a clear operational purpose. They are not just “different” or “unusual.” They are linked to learning how to defeat security or carry out an attack. That distinction matters.

Confirmation Bias: The Silent Threat in the Officer’s Mind

Confirmation bias is a simple idea with serious consequences. Once we form an initial belief about a person, a group, or a situation, we naturally start looking for information that supports that belief and ignoring information that does not. In criminal investigations, this can turn into tunnel vision. In counterterrorism, it can turn into dangerous mistakes.

An officer might see someone who looks unfamiliar or “out of place” near a sensitive location and instantly label them as suspicious. Once that label is in place, every ambiguous action can be interpreted as proof: a photo is “surveillance,” a question is “probing,” a map is “planning.” At the same time, facts that might point away from a threat, like a student ID, a tourist map, or a clear innocent reason for being there, do not get the same weight.

This bias is not a sign of bad character; it is a human tendency. But in the counterterrorism context, it can cause two critical errors:

Elevating harmless people to the status of potential terrorists because they fit an officer’s mental picture.
Overlooking genuine threats because they do not match that mental picture.

Culture Is Not an Indicator

One of the most important skills for modern practitioners is the ability to separate cultural difference from operational behavior. Clothing, language, religious practice, or mannerisms that do not match an officer’s personal experience are not, by themselves, indicators of a threat. When officers lean on those cues, they are not doing counterterrorism; they are doing guesswork.

Consider two scenarios:

A family visiting from another country takes photos in and around a stadium, including some shots of entrances and cameras. They are excited, unfamiliar with the space, and documenting their experience. Their focus is broad and casual.
Over the course of several days, a single individual repeatedly returns to the stadium, takes photos only of entrances, exits, cameras, and access control points, and appears to be timing guard movements. They do not attend events or show interest in anything else.

In the first scenario, the behavior aligns with tourism. In the second, it aligns with targeted surveillance. The key difference is not clothing, accent, or appearance. The key difference is purpose.

The same holds for documents and information gathering. A student with building plans might be working on a class project. A facilities contractor might legitimately need access to systems maps. But a person with no clear role who is quietly accumulating floor plans, camera locations, and security details while testing access or response is stepping into the realm of operational planning.

When we confuse cultural inconsistency with threat, we widen the net around innocent people while allowing genuinely operational behaviors to blend into daily noise. Over time, that makes community members less likely to share tips or concerns, because they do not trust how those concerns will be handled.

Practical Habits to Fight Bias and Spot Real Planning

If confirmation bias is inevitable, the answer is not to pretend we do not have it, but to build habits that keep it in check. Practitioners can do this in several ways:

Anchor on behavior, not identity. Start by asking, “What exactly is this person doing?” before asking, “Who is this person?” Focus on repeated, purposeful acts that serve an obvious operational goal.
Force yourself to list alternative explanations. Before you decide that someone is engaged in pre-attack surveillance, write down at least two other plausible reasons for what you are seeing, tourism, study, work, or activism, and then look for evidence that would support or disprove each option.
Separate observation from interpretation. In reports and discussions, clearly distinguish what you saw or heard from what you think it means. “Subject photographed three loading docks and two cameras” is a fact. “Subject is planning an attack” is a hypothesis.
Invite challenge. Encourage partners, supervisors, and analysts to poke holes in your theory. A colleague with a different background or perspective may spot your blind spots faster than you can.
Build real cultural literacy. The more officers understand the languages, customs, and daily rhythms of the communities they serve, the easier it is to recognize what actually stands out from the norm.

When these habits are reinforced in training, supervision, and briefings, they move from theory to muscle memory. Officers learn to slow down their thinking just enough to check their assumptions, connect behavior to the attack cycle, and avoid letting bias do the thinking for them.

The Professional Standard Going Forward

Local counterterrorism will always depend on the human judgment of practitioners who work close to the ground. That judgment is most powerful when it is paired with discipline: a clear understanding of how plots actually develop, an ability to separate culture from threat, and a commitment to checking one’s own biases.

In that environment, “see something, say something” becomes more than a slogan. It becomes a professional standard: see clearly, think critically, and act only when behavior, not bias, warrants it.