Which of the following are indicators that someone may be casing a facility?

• A. Repeated observation, taking notes about security, and asking unusual questions about operations
• B. Attending routine training sessions
• C. Publicly sharing security plans
• D. Following posted procedures

Answer: (A)

When evaluating potential casing, focus on behaviors that show someone is gathering information about the facility and its security rather than participating in normal operations. Repeated observation of an area over time, especially when they’re watching guard rotations, entry points, or camera locations, points to someone mapping security weaknesses. Taking notes about security procedures suggests they’re collecting details that could be used to exploit vulnerabilities. Asking unusual questions about operations—beyond what a typical visitor or employee would ask—signals curiosity about how things run and where protections may be weaker.

Attending routine training sessions is normal and indicates legitimate participation or interest, not reconnaissance. Publicly sharing security plans would be a dangerous act and is not a typical or appropriate behavior for someone with legitimate access, though it would indeed raise red flags if it occurred. Following posted procedures is standard compliance and doesn’t imply planning to exploit vulnerabilities. If you notice the first set of behaviors, it’s a sign to increase vigilance and consider escalating to security.