“Intuition is always right in at least two important ways;
It is always in response to something.
it always has your best interest at heart”
-Gavin De Becker. 

Quite a few years ago, I was working at a very prominent Jewish facility in the San Francisco Bay Area when I spotted a suspicious-looking man on the opposite side of the street, about half a block down from the entrance I was securing. The man was sitting on a street planter, looking very nervous as he kept watching the entrance. I had shown him that he was detected, and I nodded my head at him to show him that his presence had been acknowledged by security, and yet, the man just kept on sitting there, nervously smoking cigarettes and glaring at the entrance. Since this facility also ran its own preschool, at a certain point, parents began showing up to pick their children up. At that point, the man got up, and still looking at the entrance appeared to get ready to make his move. It looked to me like this might be a last-minute surveillance before an attack. I was working solo and couldn’t leave my post but simply had to do something. 

Some years later, I was part of a large protective team at the same site during the Jewish High Holidays. Our team had three magnetometer gates set up to screen the thousands of members and guests into the facility. With two security operators on each magnetometer gate, an additional six operators positioned on the Outer Circle and inside the venue and a 10-B, uniformed SFPD officer outside the main entrance, security was at an adequate level. 

As usual, I positioned myself outside to help support the Outer Circle. That’s when I spotted a very large white male approach the entrance. His head was shaved and he had an old-school handlebar mustache. His attire consisted of Carhartt work pants, a T-shirt and steel-toe boots, and he seemed genuinely nervous and displeased about something. Needless to say, he stuck out in a crowd of formally dressed Jewish congregants. His behavior was also suspicious in that he seemed interested in entering yet kept hanging back; approaching the entrance and then going back again, smoking a cigarette, spitting, nervously checking his old flip-phone.

He was first approached by me and gave a grunting reply to my asking him how he’s doing (keep in mind that he was still on public property at that point). The SFPD officer who then approached him at my request also received the same type of reply before the man crossed to the opposite side of the street to keep nervously smoking and checking his phone. To say that he perfectly fit the bill of a classic White Supremacist who’s acting nervously before attacking a Jewish facility would be an understatement. Both me and the SFPD officer kept a close watch as the man started making his way back towards the entrance.

I’ll get back to these two stories later on but first, I want to discuss a subject that’s mostly neglected in security training—false-positive detections.

I’ll cut right to the case: In most locations and in most cases, most detections of suspicious appearance and behavior turn out to have non-hostile explanations.

The field of surveillance detection, oftentimes even more than physical protection, gets its fair share of false-positive detections. I can tell you from experience that the specialized training you receive, and the hyper-awareness you develop, can really play with your mind. I’ve seen operators getting themselves worked up to the point of paranoia, reporting positive detections of everything from multiple hostile surveillants to other mysterious SD units all around them. And no, I don’t pretend to be immune to this myself. 

It’s a classic form of Confirmation Bias (the reason why ghost hunters keep “finding” ghosts). When you’re in the possession of a shiny new hammer, everything starts looking like a nail. Thankfully, when it comes to SD there’s a good method for winnowing things down (check out this article for more information on that).

Now, in case you think I’m somehow complaining about the prevalence of false-positive detections, let me assure you that the opposite is the case. As long as we’re not frantically drowning in a sea of white noise, we always want to have a surplus of false-positive detections. There’s never a guarantee that we’ll detect, prevent or catch every indicator of hostile activity but a surplus of false-positive detections is one of the best ways to ensure that we won’t miss a positive detection, and to reduce the likelihood of a false-negative detection—which can be very dangerous. 

So, if false-positive detections are so important, why does it sound like I’m complaining about them? Well, I’m not complaining about false-positive detections, I’m just pointing out that this subject doesn’t get discussed enough. Most of the trainings and writings on the subject only seem to cover the “Trust your instincts” part, while neglecting the important part about most instinctual detections being false-positives. And this can create an unhealthy imbalance in many security operators (I’ve encountered quite of few of them over the years). 

The point here is to properly describe and prepare people for the reality in the field. If you only prepare people for worst case scenarios and tell them that their instincts will always point to the bad-guys, they’ll either go way overboard in the field (and probably get into a lot of trouble) or they’ll get so bored and disillusioned that they’ll fall into jaded complacency, or quit. You have to equip people with the knowledge about how things really are.

We have to teach people how to stay razor-sharp though most suspicious detections are of non-hostile people; how to stay balanced, knowing that horrible things can still happen at any moment but that by and large, the world is not as dangerous as most alarmists keep screaming it is. This is a very important yet difficult thing to balance, and therefore deserves to be discussed more often.

So, what ended up happening with the two incidents from the beginning of the article?

The suspicious-looking man on the corner who I was worried might be in his last-minute Surveillance step received a full-on incident exposure. This consisted of my dramatically moving, staring and pointing at him while talking into my radio. Of course, from his vantage point, he had no way of knowing I didn’t really have any backup, that I wasn’t calling the authorities on him, nor indeed that I wasn’t even pressing down on the radio’s PTT button. But that didn’t matter because the visual message I sent him was alarming enough for him to quickly scurry away. 

But who was he, you ask? It turned out he was a friend of one of the maintenance workers at the facility I was protecting. He was waiting to pick his friend up for some appointment they were late for, which is why he kept nervously looking at the main entrance. I apologized to his friend later on.

What about the man who looked suspiciously like a White Supremacist during High Holidays? He received so much scrutiny and questioning from me and another security officer at the metal detection gate that he ended up barking a few obscenities at us before trudging away. As he turned the corner I walked after him to see if he was actually leaving the area (rather than looking for another way in). And that’s when he aggressively confronted me on the sidewalk. Since this was on public property, and since the man must have been 6’3” with at least 250 pounds on him (and with forearms about as thick as my calves), I was very glad to have the SFPD officer there to step in and settle him down. 

Wait, but who the hell was he? And why was he there? Well, he turned out to be the boyfriend of one of the administrators at the facility who invited him to come see one of the speakers. He showed up with a bad attitude after a full day on the construction site, and things progressed “happily” enough from there…

I raise these two cases (out of countless others), not only to emphasize just how suspicious a completely non-hostile individual can seem, but because they also show you that no matter how knowledgeable and experienced you may be, you can’t always make an omelet without breaking any eggs. When you’ve only got a limited amount of information and time to operate under, and the stakes are high enough, you sometimes simply need to act now and apologize for it later. 

In my article about Inductive Observation, I explained that if you pay enough attention to people’s appearance and behavior, and spend enough time honing this Sherlock Holmes-type skill, you’ll gradually get better at understanding people and their motivations. Instincts aren’t magical things. They’re perceptions you can understand and improve with practice and experience. 

And yet, even with all that, it still remains a very inexact social science that doesn’t always produce elegant outcomes. Training and experience can definitely reduce the number of messy situations, but they’ll never eliminate them.

False-positive detections will, or rather should, always outnumber positive detections, let alone false-negative ones. Don’t try to reduce false-positive detections by paying less attention to people. You should instead pay more attention, get more proficient at it and keep in mind that false-positive detections (even the occasional messy ones) are an important part of security work. 

Learn more about this subject—and many others—in my master class on Hostile Activity Prevention. 
Utilizing Israeli know-how and delivered by me, Ami Toben, this online course teaches actionable, time-tested methods of prevention, detection and disruption of hostile attacks.