Recent suspicious activity reporting raises concerns regarding the DC Metro. The redacted reports below discuss three different occurrences of suspicious activity at NCR Metro stations.
1) On 30 Nov 10, at Rosslyn Metro, a Middle Eastern Male (PERS1) was observed leaving a black leather duffel bag next to the exit fare machine. He was then advised that he left his bag. PERS1 returned and picked up his bag left the building and commented to the person "You are lucky" (NFI). PERS1 is described as a male in his 50's, 5'6", 210 lbs with black hair, wearing a black sport coat with black pants. A second Middle Eastern Male (PERS2) who may have been in PERS1's company is described as being in his 50's, 5'10", 190 lbs with black and white hair, wearing a light colored jacket with beige pants. PERS1 boarded the 5A bus to Dulles Airport.
2) On 24 Nov 10, a suspected Black Male (PERS1) around the escalator pretended to drop an item, PERS1 used a tape measure to measure the base of the escalator. Once PERS1 became aware of being observed, PERS1 retracted the tape measure and entered the Metro Center Station.
3) On 04 Nov 10, an identified Middle Eastern Male (PERS1) was observed conducting active surveillance of the lower level platforms of the Metro Station. PERS1 missed several trains while remaining on the platform.
Any one of these events raise concern. Such concerns are elevated, however, based on the three events occurring within a one month timeframe. These events could be those 'dots' we read about in post-attack reports--you know, the ones that intelligence analysts, law enforcement, and security professionals are accused of not connecting.
Please share this information with your facility ATOs and POCs. Many of our facility tenants and DoD personnel use Metro either for work or in off time and should be aware of such potential pre-operational activity. Our facility tenants serve as invaluable sources of information and force multipliers regarding suspicious activity reporting. Such reporting could identify the 'dots' and facilitate the connections that prevent an attack.