JDLR Reports

“Something Just Didn’t Look Right.”

On page 152 of the book, True Believer: Inside the Investigation and Capture of Ana Montes, Cuba’s Master Spy  by Scott W. Carmichael, you’ll read how Reg Brown, a Defense Intelligence Agency analyst, felt motivated to tell the DIA counterintelligence office his concerns about fellow senior DIA Cuban analyst Ana Montes after he had attended one of Ray Semko’s D*I*C*E briefings in 1996.

Ana Montes, who held a TS/SCI clearance and rose to the position of the senior Cuban analyst at DIA influencing intelligence and policy, was a long-time devastating mole for the Cuban intelligence service.

Motivated to do the right thing after listening to D*I*C*E Man Ray Semko, Brown’s tip was instrumental in finally bringing Montes to justice.

Have a “JDLR” (Just Didn’t Look Right) report to tell someone? Here are people to contact:



To Reach a Specific FBI Office


Reporting Crime

You can report violations of U.S. federal law or submit information in a criminal or terrorism investigation as follows:



  • ICE  – Homeland Security Investigations Tip Line: 1-866-DHS-2-ICE
  • CBP – Report Suspicious Activity : 1-800-BE-ALERT
  • Report illegal import and export activity
  • Cybersecurity US-CERT Incident Reporting System
  • Emergencies in Federal Buildings: Report life-threatening and non-life-threatening emergencies in federal buildings to Federal Protective Service (FPS). Report suspicious activity by calling 1-877-4FPS-411 (1-877-437-7411).
  • Chemical Security: To report a possible security concern involving the Chemical Facility Anti-Terrorism Standards (CFATS) regulation at your facility or another facility, you may contact the CFATS Chemical Facility Security Tip Line at 877-FYI 4 DHS (877 394-4347)  You are welcome to report these concerns on the voicemail anonymously, or, if you would like a return call, please leave your name and number.  If you are calling to report a potential security incident that has already occurred, please call the National Infrastructure Coordination Center at 202-282-9201. If you have a security emergency or terrorist incident, please hang up and call the FBI or 911 immediately.



From US Air Force ‘Eagle Eyes’

These are categories of suspicious behavior:


Someone recording or monitoring activities. This may include the use of cameras (either still or video), note taking, drawing diagrams, annotating on maps or using binoculars or other vision-enhancing devices.


People or organizations attempting to gain information about military operations, capabilities, or people. Elicitation attempts may be made by mail, fax, telephone, or in person. Examples could include being approached at a gas station (or mall or airport or library, etc) and asked about what’s happening at the base; getting a fax (or an e-mail or a telephone call, etc) asking for troop strength numbers… or the number of airplanes on base… or deployment procedures… or how a trash-collection truck gets on base… or the location of the HQ building… or how many people live in a certain dorm… or where the commander lives… or how many people hang out at the officers/enlisted club at night… or which nightclubs/restaurants off base are highly frequented by military people… or the workings of the base’s network firewall, etc.

Tests of security:

Any attempts to measure reaction times to security breaches or to penetrate physical security barriers or procedures in order to assess strengths and weaknesses. Examples: a person grabs the base fence and shakes it and sees how long it takes for police to respond; a driver approaches the front gate (without ID and/or car sticker) and pretends to be lost or to have taken a wrong term, just to learn the procedures of how he is dealt with and how far into the gate he can get before being turned around; a person places a “smoke bomb” near the fence or throws it over the fence, just to learn how quickly police respond and what effect that has on front-gate operations, etc.

Acquiring supplies:

Purchasing or stealing explosives, weapons, ammunition, detonators, timers, etc. Also includes acquiring military uniforms, decals, flight manuals, passes or badges (or the equipment to manufacture such items) or any other controlled items.

Suspicious persons out of place:

People who don’t seem to belong in the workplace, neighborhood, business establishment, or anywhere else. Includes suspicious border crossings and stowaways aboard ship or people jumping ship in port. This category is hard to define, but the point is that people know what looks right and what doesn’t look right in their neighborhoods, office spaces, commutes, etc, and if a person just doesn’t seem like he or she belongs, there’s probably a reason for that.

Dry run:

Putting people into position and moving them around according to their plan without actually committing the terrorist act. This is especially true when planning a kidnapping, but it can also pertain to bombings. An element of this activity could also include mapping out routes and determining the timing of traffic lights and flow. Take note of people moving around from place to place without any apparent purpose and doing it, perhaps, many times. The appropriate example here is the Sept. 11 hijackers, who are now known to have actually flown on those exact flights several times before Sept. 11. Their purpose was to practice getting their people into position, working out arrival times, parking, ticketing, going through security, boarding, etc. By taking note of everything around them, in one sense they were conducting surveillance and testing security, but they were also doing a dry run of the actual activity.

Deploying assets:

People and supplies getting into position to commit the act. This is a person’s last chance to alert authorities before the terrorist act occurs. Look for people loading up vehicles with weaponry/explosives, etc, and/or parking that vehicle somewhere, or people in military uniforms (who don’t look right) approaching an installation or getting into a vehicle, or people who seem out of place standing by at a certain location as if waiting for something to happen. One fairly good example of this is the attack on the Khobar Towers in Saudi Arabia. When the explosives-laden truck pulled up to the fence line (which was the “deploying assets” step) and the driver jumped out and ran away, that was seen by a spotter on the roof of the dormitory, who recognized this as suspicious activity. He then sprinted down stairs and began pounding on doors, rousting people out of bed and getting them out of the building. Because of that, he saved many, many lives, and it’s all because he recognized the “deploying assets” element.