Employee Vigilance - Power of Hello

Industries face a variety of threats, both internal and external, from hostile governments, terrorist groups, disgruntled employees and malicious introducers. Alert employees can spot suspicious activity and report it. The power is in the employee, citizen, patron, or any person who can observe and report.

Used effectively, the right words can be a powerful tool. Simply saying “Hello” can prompt a casual conversation with unknown individuals and help you determine why they are there. The OHNO approach – Observe, Initiate a Hello, Navigate the Risk, and Obtain Help – helps employees observe and evaluate suspicious behaviors, and empowers them to mitigate potential risk, and obtain help when necessary.

The OHNO approach to risk prevention relies on reasonable persons to make these observations to properly detect and report terrorism/criminal-related suspicious behavior.

Understanding the Threat (OHNO)

The OHNO approach describes suspicious activities and behaviors that may be indicative of criminal activity. Some of these observed behaviors can include constitutionally protected speech and activities. These protected activities should be reported only when there are articulable facts and circumstances that suggest the behavior is indicative of criminal activity. These behaviors should also be weighed in the context of other activities that do not necessarily indicate criminal or suspicious behavior. Nothing in this approach should be construed as condoning reporting based on biases or stereotypes. Instead, reporting should be grounded in reasonable and articulable belief based on the totality of the circumstances.


Observe - Alert employees can identify suspicious behavior, such as:

  • Putting down a bag or item and then walking away from it.
  • A prolonged interested in or taking pictures/videos of personnel, facilities, security features, or infrastructure in an unusual or covert manner.
  • Unauthorized people trying to enter a restricted area by impersonating authorized personnel.
  • Loitering at a location without a reasonable explanation.
  • Suspicious Activity Indicators:
    • Expressed or implied threats to commit an act of violence or destruction.
    • Using abusive language that a reasonable person might find threatening.
    • Any statements or behaviors indicative of suicidal or homicidal ideations.
    • Contextually inappropriate statements about harming others.
    • Exaggerated or violent gestures eg. clenching fists or jaws could be interpreted as threatening or intimidating.

Initiate a Hello

Initiate a Hello - Acknowledging a potential risk can significantly mitigate or deter a threat. Use the Power of Hello to engage with individuals you observe in your space.

Practice the Power of Hello by doing or saying the following (Tip: These are important questions and active listening is key):

  • Smile, make eye contact, and introduce yourself.
  • “Hello, how are you?”
  • “May I help you with anything today?”
  • “How can I assist you?”
  • “Welcome, is this your first time here?”
  • “Are you looking for something or someone in particular?”
  • “Let me take you to the person or place you are looking for.”
  • “I will be here in case you need help.”

Navigate the Risk

Navigate the risk by asking yourself if the behavior you have observed is threatening or suspicious.

When the following are done in a manner that would arouse reasonable suspicion of terrorism or other criminal activity, employees should consider these questions:

  • Do they appear to be legitimately patronizing the business or service?
  •  Is their clothing consistent with the weather or for the gathering of the day?
  • Are they acting in a way that suggests they have a legitimate reason to be there or in a manner that would arouse suspicion of terrorism or other criminality in a reasonable person?
  • Are they avoiding security?
  • Do they appear to be patronizing the business, service, or facility in a way that is consistent with someone entering the facility for the purpose of the gathering that is occurring that day?
  • Is this person taking pictures of security cameras or exit areas?
  • Are they showing irritated or detached behavior when acknowledged that would arouse suspicion in a reasonable person?
  • Are they asking questions about the business functions or employee information? (Who is closing? What is their schedule like? How many people work here? Etc.)
  • Have I seen this person lingering around before?
  • Do I feel threatened?

Obtain Help

Obtain help when you have navigated the risk it is important to obtain help from management or the authorities.  

  • Call 911 for emergencies or if you feel in danger.
  • To organize your thoughts to management or the police ask yourself 5Ws:      
    • What is happening?
    • Who is doing it?
    • Where is it taking place?
    • When did you observe it?
    • Why are they here?
  • You can submit suspicious activity reports to your local law enforcement or call the non-emergency number.
  • Work to develop a relationship with local police/fire authorities.
  • Have law enforcement and fire phone numbers listed for all employees to see.
  • Remember the 5 questions when you are speaking with law enforcement; they may ask you similar questions. Using OHNO, provide the best information to first responders and security personnel. Write down your interaction with the person(s).


The Department of Homeland Security provides the Power of Hello tools and resources with no endorsement of any specific company, entity, or content. The tools and resources identified are a starting point for an organization’s employee vigilance campaign and do not encompass all resources.

  • The CISA Homeland Security Starts with Hometown Security fact sheet targets employees and businesses to proactively think about the role they play in the safety and security of their businesses and communities. 
  • CISA’s Cyber Essentials is a guide for leaders of small businesses as well as leaders of small and local government agencies to develop an actionable understanding of where to start implementing organizational cybersecurity best practices.  
  • The Department of Homeland Security developed their See Something, Say Something campaign in order to support public safety and security by targeting individual citizens and teaching them how to report. 
  • The Department of Homeland Security produced Tools and Resources to Help Businesses Plan, Prepare, and Protect from an Attack, a fact sheet to advise hometowns and businesses to plan for a potential attack. This fact sheet contains resources from DHS and a 4 Step plan for businesses to follow. 
  • The Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI) is a joint collaborative effort by the U.S. Department of Homeland Security, the Federal Bureau of Investigation, and state, local, tribal, and territorial law enforcement partners. This initiative provides law enforcement with another tool to help prevent terrorism and other related criminal activity by establishing a national capacity for gathering, documenting, processing, analyzing, and sharing SAR information.
  • The Nationwide SAR Initiative developed the Suspicious Activity Reporting Indicators and Behavior visual chart to be used to report indicators and behavior of a possible threat.
  •  The See Something Say Something FDA Campaign is an educational visual to see signs, and stop a threat. 
  • The U.S. Department of Labor created workplace violence website which provides information on the extent of violence in the workplace, assessing the hazards in different settings and developing workplace violence prevention plans for individual worksites. 
  • Developed by the San Diego Police Department, Tips for Reporting Suspicious Persons, Activities, Vehicles, etc To Prevent Terrorism is a report targeted to individuals, community groups, and businesses, as well as with schools, hospitals, religious groups, private organizations, and other government agencies to fight crime and improve the quality of life for the people of San Diego. 
  • America’s Neighborhood Watch Program was developed by the National Sherriff’s Association to target individual citizens to help them support local law enforcement and their local community to stop crime. 
  • The National Crime Prevention Council’s (NCPC) mission is to be the nation’s leader in helping people keep themselves, their families, and their communities safe from crime. To achieve this, NCPC produces tools that communities can use to learn crime prevention strategies, engage community members, and coordinate with local agencies. 
  • Santa Clara County created Workplace Violence Prevention: A Guide for Employees to mitigate workplace violence against different persons of risk, such as strangers, or family members. It contains measures and procedural practices that ought to take place to maximize employee security. 
  • Running a Staff Vigilance Campaign was created by Centre for the Protection of National Infrastructure to guide employers how to engage their staff in threat reporting and protection against risk. 
  • Hostile Reconnaissance: Understanding and Countering the Threat is a guide by the Centre for the Protection of National Infrastructure on understanding threat produced for security managers.


Was this document helpful?  Yes  |  Somewhat  |  No