top of page



The Counterterrorism Group (CTG) is issuing a Global Flash Alert to citizens, law enforcement, and security personnel around the world but especially in Asia, Africa, Europe, the Middle East, and North America to be on the lookout for any suspicious activity that may be indicators of an imminent terrorist attack. CTG is issuing this alert due to the historical trend of New Year’s Eve and New Year’s Day being specific days when those intent on making statements and doing harm will attack. This alert is also being issued due to the increased amount of concerning-chatter related to conspiracy theories and is anti-government, anti-law enforcement, anti-technology, anti-media, racist and focused on the dissatisfaction with the U.S. 2020 election and mandates imposed by COVID-19 restrictions.

Although New Year’s Eve and New Year’s Day activities will be significantly limited and reduced this holiday season an attacker may look for an opportunity to cause harm. We are advising that everyone but especially restaurants/clubs, any celebratory events, hotels, government officials and facilities, critical infrastructure facilities (especially telecommunications and energy), transportation systems, places of worship, law enforcement, and security personnel, be on high alert. Based on trend analysis CTG recommends increased vigilance for the following types of threats:

  • Vehicle Attacks - Car Ramming into People and Locations

  • Active Shooters

  • Knife Attacks

  • Suicide Bombers

  • Vehicle Borne Improvised Explosive Device (VBIED) Attack

  • Ambush Attacks on Law Enforcement


We recommend that citizens, law enforcement, and security personnel stay on alert for suspicious vehicles, particularly large vehicles capable of bearing high yield explosives such as RVs, moving trucks, utility vehicles, large rentals, etc. Possible Indicators that are commonly shared by homeland security and law enforcement sources that may warrant suspicion include but are not limited to:

  • Vehicles unusually or illegally parked

  • Missing, mismatched, or expired license plates, registration stickers, or inspection decals

  • Missing or altered vehicle identification numbers (VIN)

  • Vehicles laden beyond normal capacity, in weight or amount of cargo

  • Cargo concealed or obscured (by a tarp, blanket, or illegally tinted windows)

  • Vehicles where interior appears tampered with or unusually altered

  • Vehicles where the driver appears extremely anxious, and is observed taking extreme care in opening or closing vehicle’s doors, trunk, or hood

  • Distinct odors emanating from a vehicle, including overwhelming gasoline, diesel, or kerosene odors and any odors of propane, acids, or industrial chemicals

  • Smoke emissions inconsistent with typical indicators of vehicle malfunction

  • Vehicle type, make, size, style, or condition is inconsistent with jurisdiction, season, weather, or use

  • Vehicle is abandoned in a crowded area or making illegal, unsafe, or otherwise unusual maneuvers

  • Driver appears overly anxious

  • Driver is observed taking extreme care in opening or closing vehicle’s doors, trunk, or hood

  • Driver hastily transfers from one vehicle to another

  • More cellular phones than the number of occupants in the vehicle

  • Area or vehicle seemingly under surveillance by suspicious person

  • Multiple calls to 911 regarding a specific vehicle or its location

If a person observes a suspicious vehicle or person or knows of a possible attacker, they need to be cautious but capture as many of the following details as possible and then call 911 and report the suspicious activity in detail. Try to report the following:

  • Who: Identify all of the individuals or vehicles involved in the suspicious activity. Describe each individual or vehicle in as much detail as possible. Information on individuals could include name, DOB, eye color, hair color, height, build, scars, marks, tattoos, glasses, other identifying marks, etc. Is there any known digital media information that is potentially relevant? If so, request the names of the accounts or screenshots of relevant information.

  • What: What concerning or suspicious activity was observed? Is there any digital media that has been captured that can be shared. Report any emails, texts, screenshots, voicemails, etc., potentially related to the suspicious activity.

  • When: When did you observe the suspicious activity?

  • Where: Where did you observe the suspicious activity?

  • Why: Why is the observed activity, vehicle, or person suspicious?

Law enforcement and security personnel should take any calls and reports of suspicious activity very seriously and conduct a thorough investigation during this time period in order to avoid an imminent attack being missed because of a failure to fully investigate a potential situation. Law enforcement and security personnel should also be alert that some attackers will try to lure in first responders in order to conduct an ambush attack or get them into the kill zone/radius of an improvised explosive device.

The United States Department of Homeland Security has published this infographic on what can be deemed as SIGNS OF TERRORISM-RELATED SUSPICIOUS ACTIVITY:



bottom of page