Royal Canadian Mounted Police
Symbol of the Government of Canada

Common menu bar links

Awareness guide - indicators

Metro station

This section outlines some of the early warnings of radicalization leading to violence and signs of terrorist planning activities.

If it’s suspicious, report it!

National Security Information Line: 1-800-420-5805

Changes in behaviour are often open to interpretation. For that reason, it is important to look for a "cluster" or pattern of changes. The presence of any of the indicators identified in this document on its own does not necessarily indicate criminal activity; however, the likelihood increases as more indicators are present. All signs must be considered in context. If you have any doubts or would like to report a suspicious incident, please contact the resources available in your area (see Assistance and Reporting section).

hands holding a coffee mug

"My son was polite, bright and curious. He liked helping people. He was my oldest son. It all happened so fast… He changed environment and friends. I had small doubts, but I never would have thought that he could leave everything, leave us… Since then, our life has changed completely and we still don’t understand what happened."

Father of a boy who left to join the fight in Syria

Recognizing the signs

Although their ideologies, motivations, political convictions and religious beliefs may differ, terrorists share one thing in common — they always go through phases of radicalization and planning of their violent actions. Throughout this process, indicators can be observed by friends, relatives or various stakeholders.

Threats to national security can come in any form and early identification is possible. Timely and appropriate reporting of threats can make a difference and ensure safety and security for all of us. To this end, it is necessary to raise public awareness (families, educators, friends, various stakeholders, etc.) about prevention.

The early signs of radicalization to violence and of planning an act of violent extremism and terrorism are outlined in this section and can be detected based on:

  • Knowledge of the environment
  • Experience
  • Intelligence on the situation
  • Assessment of what could happen

Two sets of indicators

Changes in behaviour can be observed when a person becomes radicalized to violence or prepares to commit an act of terrorism. In the case of lone actors, indicators are more often difficult to detect.

While they can be related, the indicators associated with both processes are the following:

  • A/ Indicators of radicalization to violence
  • B/ Indicators of terrorist planning activities - early signs

A/Indicators of radicalization to violence

Observable changes

Person typing on a computer

In general, indicators of the radicalization to violence process are characterized by changes related to:

  • Behaviour
  • Appearance
  • Habits
  • Relationships
  • Identity
  • Ideology

Icons: Types of changes related to behaviour, appearance, habits, relationships, identity and ideology

Possible indicators include
  • Significant changes of interests;
  • Breaking relational ties, social isolation, change in peer groups and activities (family, friends, sports, school, etc.);
  • Change in the way of thinking and interacting with others;
  • Rejection of the State (politics and social values);
  • Participating in radical activities or demonstrations and using extremist language;
  • Attending private meetings (ideological);
  • Overconsumption of hate and violent propaganda images and videos on the Internet;
  • Possession of propaganda material promoting violence (pamphlets, books, videos, DVDs, music, Internet websites, etc.);
  • Segregation and antagonism ("Us against Them");
  • Adhering to hatred and violence;
  • Glorification of violence or sacrifice;
  • Perpetration of minor crimes motivated by the rejection of governments and society;
  • Change in appearance and dress style;
  • Use of new names or pseudonyms in social media and personal environment;
  • Wearing tattoos (often hidden), signs and symbols.

About the Internet

The use of the Internet in the radicalization to violence process is outlined in the Radicalization section. However, note that particular attention should be paid to the amount of time young people spend on the Internet, to the sites they visit and to their communications on social media. The Internet knows no border or limit and is accessible to all.

Symbols and emblematic signs as indicators

Symbols in the form of emblematic signs such as logos, tattoos, flags, etc. can bear different meanings such as an indication of an individual’s affiliation or allegiance to a gang, criminal organization, extremist group or terrorist group.

Intention to leave the country to travel to a conflict area – high-risk travellers

Man with suitcaseWhether it is to participate in humanitarian aid or to visit family members, travelling to a conflict area is dangerous. Making an informed decision is paramount. The Government of Canada advises Canadians against all travel in these areas. Outbreaks of violence can occur with little or no notice and travellers risk being at the wrong place at the wrong time.

A person who becomes radicalized to violence may intend to leave the country to join a terrorist organization abroad. The Government of Canada prohibits travelling to a conflict area in order to join a terrorist group. In fact, under section 83.181 of the Criminal Code of Canada, everyone who leaves or attempts to leave Canada for the purpose of committing an act outside of Canada that, if committed in Canada, would be considered as participating in an activity of a terrorist group, is guilty of an indictable offence and liable to imprisonment for a term of up to 10 years.

As a family member or stakeholder, you could observe a number of indicators that suggest the person is planning to leave.

Possible indicators include
  • Talking about humanitarian aid;
  • Having skills that could help in a humanitarian crisis;
  • Talking about religion, sacrifice, defending oppressed peoples, the Holy Land;
  • Expressing a desire to travel;
  • Asking for information about passports (possibility of using multiple passports);
  • Acquiring a plane ticket;
  • Withdrawing large sums of money, emptying account;
  • Obtaining or soliciting donations from friends and parents;
  • Changes in financial habits;
  • Selling or disposing of personal belongings;
  • Communicating on social media with individuals who have already gone or who are in a conflict zone;
  • Sometimes talking about his/her intentions on social media;
  • Expressing the intention to leave the country for a conflict zone;
  • Talking about conspiracy theories.

The Government of Canada takes the safety and security of Canadians abroad very seriously and recommends avoiding all conflict areas. For more information, visit: Government of Canada, Travel Advice and Advisories

B/Indicators of terrorist planning activities - early signs

Lock on fenceThe planning of any act of terrorism exposes indicators that can become apparent in the days, weeks or months prior to an attack. The discovery of one or more indicators, when considered in a broader context, could help prevent an attack or threat.

"Safe house" indicators

A "safe house" can take many forms: it can be used to store chemicals, material and weapons or it can serve as a meeting place, an observation site, etc. There are suspicious indicators that can help detect terrorist activities, such as terrorist literature and propaganda, timing devices or chemicals for bomb-making.

Indicators of a "safe house" could include:
  • Increased security (counter surveillance);
  • Covered windows;
  • Denial of access to landlord or cleaning personnel;
  • Large numbers of people coming and going from the location;
  • Unusual or pungent odours;
  • Unusual noise at odd hours;
  • Presence of unusual material;
  • Frequent moves by the occupants (from one "safe house" to another).

Indicators of explosives on the premises

Gas tank
Acquisition and/or possession of material (storage)
  • Unusual or pungent odours;
  • Dead plants in or around the site;
  • Peeling or discoloured interior paint;
  • Unusual corrosion in sinks or toilets;
  • Various material (ice baths, thermometers, lab glassware, eye droppers, filters, scales, etc.);
  • Refrigeration equipment such as commercial freezers;
  • Windows open regardless of temperature;
  • Watches, cell phones, wiring, detonators and circuitry;
  • Photos, mapping and charting plans, road maps, plans of potential targets;
  • Surveillance material: night vision goggles, binoculars, cameras;
  • Rental of a self-storage space (for storing and/or handling chemicals);
  • Theft or purchase of detonators, fuses, chemical precursors, fertilizers, etc.;
  • Unusual deliveries of chemicals, including fertilizers, directly from the manufacturer to a self-storage facility or a residential or rural address;
  • Repeated or large purchases of fertilizers;
  • Material for making explosives: hydrogen peroxide, fertilizers, ammonia, batteries, literature and websites, pressure cookers, nails, bolts, gas bottles, etc.;
  • Evidence of unexplained chemical fire;
  • Literature or notes on bomb-making;
  • Small test explosions in rural areas;
  • Websites explaining how to make or use explosives;
  • Acquisition of related knowledge.
Physical evidence or characteristics of bomb-making activity
  • Chemical burns on skin or acid holes in clothing;
  • Suspicious wounds, scars or missing body parts;
  • Chronic headaches or sore throat caused by chemicals;
  • Change of hair colour (use of hydrogen peroxide to make bombs can result in hair becoming lighter).
Observable indicatorsman spying with binoculars
  • Close monitoring of security personnel;
  • Taking notes, photos or recordings of potential targets;
  • Surveillance and reconnaissance of targeted locations and their security systems;
  • Fraudulent identification, such as a false uniform or a stolen access pass;
  • Testing security to determine how security personnel react to incidents (e.g.: triggering a false alarm);
  • Attempting to access restricted areas;
  • Attempting to obtain access cards for restricted areas;
  • Writing a note or recording a video to claim responsibility or to justify actions;
  • Nervousness or anxiety;
  • Attempting to elicit information (unusual questions);
  • Acquiring expertise/training (pilot training, paramilitary training, weapons training, using drones, paintball, etc.);
  • Fundraising activities (foundations, fraud, etc.);
  • Visiting unusual Web pages, research on potential targets.