Security Threat Awareness Flashcards

While observing passengers at divestiture, a TSO notices an individual who is avoiding eye contact with staff, sweating profusely despite the cool temperature, and repeatedly glancing at all uniformed personnel. This cluster of behaviors is most indicative of:

Answer: A potential high-stress state that warrants additional, non-confrontational observation and reporting.

The combination of multiple stress indicators (sweating, gaze aversion, hyper-vigilance towards authority) should be treated as a potential security concern. While it could be travel anxiety, a TSO's training requires them to recognize that this cluster could also indicate malicious intent. The correct procedure is to note the behavior and report it for further assessment, not to dismiss it or make a premature diagnosis.

Which of the following correctly lists the four essential components of an Improvised Explosive Device (IED), commonly remembered by the acronym PIES?

Answer: Power source, Initiator, Explosive, Switch

The acronym PIES is a standard security training tool used to remember the four fundamental components required for an IED to function: a Power source (like a battery), an Initiator (like a blasting cap), the main Explosive charge, and a Switch (the triggering mechanism). Understanding these components is critical for threat identification.

An individual without a boarding pass is observed for an extended period near the security checkpoint, taking notes and appearing to time how long various screening procedures take. This activity is a primary indicator of what type of threat-related activity?

Answer: Hostile surveillance

Hostile surveillance is the act of observing and gathering information about a target to identify vulnerabilities and plan a future attack. Timing security procedures, mapping camera locations, and observing staff routines are classic indicators of this activity. It is a critical pre-operational step for adversaries.

The concept of 'layered security' in an airport environment means that:

Answer: Multiple, overlapping security measures are in place, so that if one layer is bypassed, another is likely to detect the threat.

Layered security is a core principle where security is not dependent on a single measure. It combines various elements—such as intelligence, passenger vetting, law enforcement presence, access controls, and checkpoint screening—to create a multi-faceted defense. A failure at one point can be caught by another, increasing overall security effectiveness.

A TSO observes a uniformed airline employee use their security badge to allow another individual, who is not in uniform and has no visible ID, through a secure door leading to the airfield. This scenario is a classic example of what potential threat?

Answer: An insider threat and 'piggybacking'.

This is a prime example of an insider threat, where a trusted individual uses their credentials to compromise security. The act of allowing an unauthorized person to follow through a secured entry point is known as 'piggybacking.' This bypasses critical access controls and creates a significant security breach.

What is the primary function of a Security Directive (SD) or Emergency Amendment (EA) issued by the TSA?

Answer: To mandate specific, legally-binding security measures in response to credible intelligence or an evolving threat.

Security Directives (SDs) and Emergency Amendments (EAs) are formal, compulsory regulations issued by the TSA to airports, aircraft operators, and other stakeholders. They are not optional. They are implemented to counter specific, often time-sensitive, security threats based on the latest intelligence.