A ‘spotter’ foiled the Amsterdam train attacker. What is that?

By Deanna Zammit

This week in Amsterdam a jihadist knifeman was stopped thanks to the vigilance of a security expert that Dutch police call a “spotter.” According to this BBC report, the spotter took note of the attacker’s strange behavior almost the moment he got off the train and called colleagues to confer. “While they are working out how to go and talk to him, they see he starts stabbing,” said Amsterdam Police Commissioner Pieter-Jaap Aalbersberg. Moments later, police had shot the attacker twice.

But just what is a spotter? How are they trained and what role do they play on a security team? We turned to our favorite security expert, Michael Rozin, president of Rozin Security, to learn more.

So, to the point, what is a ‘spotter’?

A spotter is a threat detection officer or a behavior threat detection officer who is trained to recognize the onset of an attack, pre-attack indicators and is trained to engage appropriately. They are typically in plain clothes. They are undercover. They are tactically deployed in areas where they have a chance to identify and intervene before a potential threat element reaches its target. Or they are at the areas where they can assist in response in case the target has been reached.

In this case, the attack unfolded as the spotter was strategizing with his colleagues about what to do next. Is that typical? What do you make of that timeline?

It depends. The environment dictates the attack. Sometimes you sometimes have two, three, four up to ten minutes, at times, before the attack occurs. But at times, it could happen that fast, right? It could happen a matter of a minute or less where the perpetrator comes, sees the best opportunity at a time and his target is right there and he just attacks.

How does training for a spotter, or a behavior detection officer, differ from a typical security guard?

The training itself is advanced training. It teaches them how to think as the aggressor, how to think as a potential threat element in any environment. Then they’re trained on how to identify, how to define the norm in any environment, how to baseline, as we call it.

Then they’re trained to recognize specific aggressors’ modus operandi in one’s actions, behavior, appearance, belonging, potential profile documents and other elements relevant. And based on the type of MO they detect on the grounds, based on observable indicators and activities, they are either trained to engage hands-on or respond to the threat or conduct an interview and assess, gather additional information, to be able to apply additional resources.

This doesn’t sound like a day course.

No, it’s not. Generally, the courses are something like a 40- to 60-hours in a classroom. And then, typically, you extend it to the field. So, the trainee, when they go through a classroom portion that includes field exercises and workshops, they then go into the field and they’re trained in the field for probably a good two to three weeks at a minimum before they are certified to perform this work.

You spent time in the Israeli special forces, and it was said that ‘spotters’ are an Israeli security tactic. What can you tell us about the origin of spotters?

The origins of this actually come from the United States. As a result of a terrorist attack [on the Lod Airporti] in ’72, the Israeli government gave the responsibility to protect our most critical sites, our federal agency who started developing different strategies for getting ahead of the perpetrators. And they came to the FBI here, which has a program known as Behavioral Analysis Unit that is designed to identify and predict malicious intent based on common characteristics.

They have an extensive library of common characteristics of certain type criminals. We in Israel really like the idea that it’s possible to predict one’s intent based on common characteristics. The characteristics here are very different, and sometimes they have to be re-engineered from scratch, depending on the on type of threat. We simply developed this system around it for security needs, rather than for investigative needs, as the FBI uses it.

The Amsterdam train station had been identified as a potential terrorist target. Outside of Israel, are spotters often deployed in public places?

It’s becoming more and more popular. And the places we could expect to see this is airports, mass transit. It’s also getting in the private sector. Things like sporting events, like football games and other events that attract masses, we tend to see more and more of that. Some high-profile fortune companies that are higher targets deploy layers of these types of measures at their headquarters or at venues where their executives might be speaking. So it becomes more and more a norm. Truly though it’s, comparatively speaking to other security measures that are more standard, it’s still a relatively rare thing in the U.S.

In the United States, our emphasis seems to be on using technologies like weapons scanners and access control to monitor threats in crowded places. How can a spotter work improve security by working with that kind of technology?

This program typically is zeroed on the human rather than weapons detection. Spotters are looking at the behavior of the person, their actions, their overall profile. So the technology could help in several ways, like in surveillance systems, when you have an operator behind the surveillance system that is trained in this methods the use of the system becomes a lot more effective.

Today, artificial intelligence allows systems themselves to be smarter, which could help security find the needle in a haystack so to speak. The technology itself can read out abnormalities. It can significantly make this program more efficient and more effective. The intention, especially, to combine that capability with this capability of a spotter/behavior detection officer is a great solution, because that allows us to detect, possibly detect a weapon as well as assess the potential for malicious intent in real-time.


Many of the articles within the media pages of the patriot1tech.com website are 3rd party in origin and have been included for informative purposes only. Decisions to include articles are solely based on the timely nature of the storyline as it applies to the security industry in general and to the proliferation of threats to public safety in particular. The inclusion of these articles does not imply that PATRIOT ONE its management, agents or employees endorses any statements expressed. The public is advised to fully investigate any contentious claims or assertions prior to arriving at any conclusions. Any hyperlinks included in these articles does not imply that PATRIOT ONE monitors or endorses these websites. Accordingly, PATRIOT ONE accepts no responsibility for such websites. Additional information regarding exclusions and liability limitations are outlined here.