BMAP Special Advisory Bulletin

BMAP Header

BMAP Special Advisory Bulletin


Iranian-Inspired Terrorism Threat

January 8, 2020

SCOPE: In the wake of the recent strike in Iraq that killed Iranian IRGC-Quds Force commander Qassem Soleimani, DHS National Terrorism Threat Advisory Bulletin, issued 4 January 2020, provided a summary of the terrorism threat to the US Homeland. While no information indicating a specific, credible threat to the Homeland was assessed, the terrorism summary acknowledged the intent and capability of the Iranian Government, their proxies, and radicalized persons to conduct operations in the United States. These threats could include cyber-attacks through the Iranian State’s robust cyber program or terrorist organizations, as well as physical attacks and destructive hybrid attacks by proxies against U.S targets and interests abroad. Physical attacks continue to include the possibility of improvised explosive device (IED) attacks, which are a staple tactic of the Islamic Revolutionary Guard, Quds Force, and proxy entities such as Hizbollah.

Attack cycle

WARNING: While no information indicating a specific, credible threat to the Homeland, was assessed, individuals inspired to commit acts of terrorism may try to acquire or legally purchase common household items such as explosive precursor chemicals (EPCs), explosive powders, and IED components at retailers in your community to construct IEDs for use against infrastructure targets.

GENERAL CONSIDERATIONS: Our best opportunity to prevent an IED attack is to disrupt terrorists during the planning phase of the terrorist attack cycle. During the planning phase, terrorists are most vulnerable and susceptible to exploitation while attempting to acquire the materials necessary to build IEDs. Alert members of the public can play a vital role in preventing terrorist attacks by reporting suspicious behaviors to law enforcement with a detailed description of the person, products purchased, and vehicle(s) involved.

Suspicious Activity and Purchasing Behavior: Recognize and Report

Terrorists intending to procure the necessary materials to manufacture and employ IEDs may display suspicious behaviors in the process. Identifying and reporting suspicious and uncommon behavioral patterns can be safely and successfully accomplished by anyone in the community. Please consider the following when determining if a behavior is suspicious:

Normal Behavior:

Routinely observe common shopping behaviors in your environment. Establishing a baseline will assist in identifying suspicious behaviors.

NSI Logo

Suspicious Behaviors:

Suspicious behaviors can be broad and include verbal behaviors such as:

  • Aloof, or unfriendly and distant
  • Argumentative and/or defiant
  • Manipulative and/or scheming

Suspicious physical behaviors could include:

  • Acting aggressively or agitated
  • A customer exhibiting a noteworthy level of nervousness while inquiring about or purchasing potentially dangerous items
  • Guarded/antisocial
  • Observation/surveillance or testing security
  • Performing bomb-making research
  • Possessing or testing materials

Suspicious Purchases:

Point-of-sale retail employees play particularly important roles in counter-IED efforts and act as the nations “eyes and ears” during the planning phase of the terrorist attack cycle. Attentive store employees may experience unusual customer interactions or witness suspicious purchases. Some examples of suspicious purchasing behavior includes, but is not limited to:

Suspicious purchasing
  • Unusual ordering, purchasing patterns and/or purchases spread across multiple stores in a chain
  • Vague knowledge of the proper uses for the product
  • Unusually large quantities purchased
  • Out of season purchases
  • In-store pick-up for bulk purchases
  • Large cash purchases or using another person’s credit card
  • IED components bought in conjunction with precursor chemicals or explosive powders
  • Refusing to accept substitute products that perform better or are less expensive
  • Shopping for an unusual combination of products
  • Unusual preoccupation with certain products’ chemical composition
  • Questions not relevant to lawful or proper use of the product

R.A.C.K. for Retailers

New RACK Card

NOTE: Any determination of possible suspicious behavior or indicators should be supported by additional facts that justify reasonable suspicion. Although one activity may seem insignificant on its own, the indicators should be looked at under the totality of the circumstances.

Report suspicious activity to law enforcement or

1-855 TELL FBI (1-855-835-5324)

If you are a current BMAP partner, it is highly encouraged that you conduct and document outreach in your community to reduce the risk of terrorists making and using IEDs in your community. For readers who are not members and are interested in starting a program, please email OBP@cisa.dhs.gov for more information.


Bomb-Making Awareness and SAR Training Courses

Bomb-Making Materials Awareness Employee Training (AWR-921): This course teaches participants how to recognize suspicious purchasing behaviors in a retail setting that might indicate bombmaking activity and what to do when a suspicious incident occurs.

Homemade Explosives and Precursor Awareness for Public Safety (AWR-349): This course provides participants with a foundational understanding of HME and common precursor materials. Participants will define HME, This Course will explore the considerations involved in a decision by perpetrators to use HME as the explosive for an attack, and will learn to identify common precursor chemicals and materials used to make HME.

Response to Suspicious Behaviors and Items for Bombing Prevention (AWR-335): This course provides participants with a foundational introduction to recognizing and responding to suspicious behaviors and activities related to terrorist or criminal activities. This course also highlights what to do when encountering an unattended or suspicious item and to whom to report it.

Nationwide SAR Initiative (NSI) Explosive Precursor Point of Sale Training: The Suspicious Activity Reporting (SAR) Explosive Precursors Point of Sale Training was developed to assist those persons involved at the point of sale for explosive precursors in recognizing what kinds of suspicious behaviors are associated with pre-incident terrorism activities, understanding how and where to report suspicious activity, and protecting privacy, civil rights, and civil liberties when documenting information. This training also provides information about integrating the Nationwide SAR Initiative (NSI) into your organization's operations.

You can access other Office for Bombing Prevention courses through TRIPwire.dhs.gov. (Click on the banner below to navigate to TRIPwire)

New TRIPwire

More information available from CISA

BMAP Tri-Fold

CISA Insights: Increased Geopolitical Tensions and Threats


Become a Part of the BMAP Team

For more information about how to receive training and become a BMAP partner, visit: https://www.cisa.gov/bmap or email OBP@cisa.dhs.gov.