by Douglas J. Hagmann, Director

20 May 2005: A "sudden surge" of individuals possessing
and attempting to use false credentials, badges and in some cases,
uniforms to probe key areas within the infrastructure and emergency
services of the United States is being reported by federal law
enforcement officials. A significant increase in potential terrorist probes is being reported concurrently on three levels as detailed below:

"Sensitive" reports compiled this week by the Department of Homeland
Security are showing a consistent, nationwide increase in attempts to
breach security at key locations within the U.S. by individuals using
subterfuge and false credentials, according to the report labeled
�restricted dissemination.� The report cites a sharp rise in incidents
of individuals using fictitious identification who have attempted to
gain entry into restricted areas of hospitals, medical facilities, fire
stations, and ambulance and rescue stations. In some cases, there have
been reports of thefts of various equipment, including biohazard suits
and protective clothing.

Also cited in this report is a significant rise in "suspicious
activity," further described as "the surveillance and photography" of
key elements of our infrastructure, including nuclear and conventional
power plants, water treatment plants, chemical storage facilities, gas
refineries and storage facilities, bridge structures, train and subway
stations, and large office buildings. In some instances, ventilation
systems appeared to be the focus of attention.

In situations involving hospitals and key medical support facilities, security has thwarted all �known
fraudulent attempts� to gain access to restricted areas or information,
according to the report. [Emphasis added]. A number of cases were cited
where individuals using fake credentials, once questioned further by
internal security, fled upon more detailed questioning. Some imposters
have been identified and investigations are in progress.

Regarding reports of active surveillance and photography or
videotaping of critical infrastructure, the report states that the
�number of incidents of suspicious activity reported to police agencies
has risen dramatically since April.� Details regarding these activities
were less specific in terms of their disposition.

Attempts to gain access to confidential, proprietary and
information described as �sensitive� via computer have also risen
sharply. According to specific reports, attempts included both those of
�intrusion� as well as those involving individuals conducting pretexts
via e-mail. The report describes the latter form of these attempts as
�creative� and seeking to exploit human vulnerabilities.

In situations involving individuals engaged in the above
activities witnessed by law enforcement, security personnel and others,
suspects have been described primarily as well groomed Arab men
appearing to be in the 25-40 year-old age group, although men appearing
to be of Hispanic origin also accounted for 10-15 percent of the
incidents described. Further, a number of suspects were identified as
Caucasians within the same general age range.

Everyone in the emergency sector as well as those involved in
the security of our critical infrastructure are advised to be on a
heightened state of alert for the activities described above.