TL;DR
You can't detect abnormal behavior without knowing what normal looks like. Baseline awareness means spending 30-60 seconds establishing the normal activity, body language, and behavior of any environment you enter. Deviations stand out automatically against that baseline. The skill is learning to trust and act on the signal when something registers as wrong — before you've consciously identified what it is.
How Threat Detection Actually Works
Most people describe threat recognition as a sudden realization: "I knew something was wrong." What they usually experienced was a slower process their conscious mind wasn't tracking: an accumulation of small deviations from normal that eventually crossed a threshold.
The problem with waiting for conscious realization: threats often move faster than conscious processing. By the time you've articulated "that person seems threatening," they may have already closed the distance.
Baseline awareness trains the unconscious processing — the part that notices deviations before they're consciously labeled — to operate more effectively. You've established what normal looks like, so abnormal stands out immediately.
Establishing Baseline
When you enter a new environment, spend 30-60 seconds noting:
Activity baseline:
- What are people here doing? (Shopping, eating, waiting, working)
- At what pace? (Relaxed weekend pace vs. busy lunch rush)
- Where is movement flowing?
Behavioral baseline:
- What's the emotional register? (Calm, focused, social, rushed)
- What's normal attention direction? (People looking at products, phones, menus, each other)
- What's normal body language for this context?
Environmental baseline:
- Where are the exits?
- Where are service personnel?
- What are the acoustic characteristics? (Ambient noise level — important for hearing disturbances)
- What's the sightline — how far can you see?
This takes 30-60 seconds. It becomes automatic with practice until you're doing it continuously without effort.
Behavioral Deviations That Warrant Attention
These behaviors deviate from most environmental baselines:
Surveillance behavior:
- Someone whose attention is on people rather than the environment's purpose (watching others instead of looking at merchandise, menu, or their own activity)
- Repeated scanning or checking behind and to the sides
- Loitering at a position with sightlines to an entry or high-value point
- A person who positions to observe without an apparent reason to be at that position
Stress indicators:
- Inappropriate dress for the context (heavy clothing in hot weather is a documented indicator for concealed threats)
- Gross motor movement inconsistent with calm — jerky, tense, rapid movements
- High anxiety body language (hands in pockets repeatedly, fidgeting, scanning)
- Face touching, neck touching, avoiding eye contact specifically (not just introversion — avoidance)
Pre-attack indicators:
- Target glancing: someone who looks at a specific person or position, looks away, looks back repeatedly
- Interview behavior: seemingly purposeless conversation or questions with someone to assess their response
- Closing distance against the flow of normal movement
- Hands concealed (in pockets, waistband, or bag) in contexts where this isn't normal
What these are not: Definitive evidence of threat. They are reasons to move from Yellow to Orange — increased attention and readiness — and to begin the "if-then" mental rehearsal. Most people displaying these behaviors have benign explanations.
Gavin de Becker's "Gift of Fear"
Gavin de Becker's 1997 book "The Gift of Fear" is the most accessible treatment of pre-violence indicators and the value of intuition. His research on violence prediction led to the conclusion that people who are attacked almost always noticed something before the attack — they just dismissed the signal because they didn't want to seem rude, paranoid, or wrong.
The central argument: the feeling that something is wrong is a signal generated by subconscious threat processing. It represents pattern recognition operating below conscious articulation. Dismissing that feeling for social reasons ("I don't want to offend anyone by moving away") is the most common preparatory failure for victimization.
The practical teaching: when you feel something is wrong, act on it without waiting for conscious justification. Move away. Increase distance. Leave the environment. The cost of a false positive (seeming slightly rude) is trivially low compared to the cost of a true positive dismissed for politeness.
Training Baseline Awareness
Daily practice: Every new environment you enter, run the 30-60 second baseline check. What's normal here? After a few weeks, this is automatic and takes no deliberate effort.
Notice and note deviations: During your normal day, when something feels slightly wrong — the person on the elevator who seemed off, the car that seemed to slow near you — note it mentally. Most are benign. Tracking the pattern teaches your baseline establishment system what's worth flagging.
Practice with specific scenarios: Ask yourself occasionally, "what would a person casing this location look like?" or "if someone wanted to commit violence in this room, where would they position?" This isn't morbid — it's training the pattern recognition that enables early detection.
The goal isn't paranoia. It's competence. The person who can tell the difference between a busy, normal grocery store and a grocery store with something wrong in it — and does something about that difference — is simply more capable of protecting themselves and their family.
Sources
- Gavin de Becker - 'The Gift of Fear' (1997)
- Paul Ekman - Emotions Revealed and micro-expression research
- FLETC - Behavior Detection Training
Frequently Asked Questions
How do I know what 'normal' looks like in a place I've never been?
Establishing baseline takes about 30-60 seconds of observation when you enter a new space. Normal behavior in a grocery store: people moving through aisles with cart or basket, checking shelves, heading toward checkout. Normal demeanor: relaxed, purposeful, mobile phone use common, occasional interaction with staff. Once you have that mental picture, deviations are noticeable: someone standing still for extended time, someone moving against the traffic flow of the store, someone whose attention is on people rather than merchandise.
What if I'm wrong and someone is just having a bad day?
Being wrong frequently is normal and correct. Most Orange activations are false alarms — and that's fine. The goal is to notice early and be alert, not to accurately identify malicious intent. If you move to the other side of the room because someone's behavior registered as unusual and it turns out they were just looking for their keys, you've lost nothing. The practice of noticing and acting on low-level concerns — even when they're wrong — is what creates the habit that protects you when it's right.
Can children learn baseline awareness?
Yes, at an age-appropriate level. The 'Uh-oh feeling' — when something feels wrong but you don't know why — is a valid internal signal that children can be taught to act on: move away from the feeling, find a trusted adult. This doesn't require teaching threat assessment theory; it teaches children to trust their instincts rather than dismiss them for social politeness reasons.