Demystifying the Criminal Planning Cycle

By Scott Stewart

Over the past few weeks I've had the opportunity to teach a couple of classes on situational awareness to different audiences. One of the assertions I make during these training classes is that criminals follow a process very much like the terrorist attack cycle while planning a crime. As I was teaching a class last week, it occurred to me that I have hinted at this fact in past analyses but that I've never written about the topic and fully explained the criminal planning cycle.

Understanding the criminal planning cycle is important, because that understanding can then be used by potential victims and law enforcement officers to look for the various aspects of the cycle as it progresses and then take action to thwart crimes before the criminals' plans can be executed.
The Terrorist Attack Cycle and the Criminal Planning Cycle

Click to Enlarge


When one spends some time thoughtfully examining what we have long referred to as the "terrorist attack cycle" the parallels to the criminal planning cycle become readily apparent -- especially in crimes perpetrated against individuals. The correlation becomes a bit less obvious when we think about crimes such as selling narcotics or prostitution, though it does arguably still apply. For example, a drug dealer first needs to decide to deal narcotics (target selection). He then needs to plan his activities (planning), acquire the dope and deploy to the place he will sell it (deployment). After he commits the sale (crime), he needs to leave the scene (escape) and spend the illicit cash he made on the deal (exploitation).

However, for the sake of our discussion here, I am going to focus primarily on violent crime such as mugging, rape, kidnapping and carjacking.

All crimes begin with selecting the type of crime that will be committed and where it will be committed. This process may or may not be as formal as that followed by the al Qaeda central command, but nevertheless the criminal or group of criminals must decide which house to burglarize, which purse to snatch or who to abduct and rape. During the target selection phase of the process, the criminal will perform a rough risk-benefit analysis to determine if the risk of obtaining the target is worth the eventual payoff. All things being equal, a criminal will attempt to obtain the object of the crime with the smallest risk. Therefore, they will tend to divert from a target that presents more risk if they can obtain a comparable payout from a target that is easier to acquire. For example, a purse-snatcher is far more likely to target a woman who is under the influence of alcohol or who is distractedly texting than a victim who is alert and paying attention to her surroundings.

Because of this, the objective of most security measures, whether residential alarm systems or practicing situational awareness, is not to make the target impervious to an attack (something that is very difficult to achieve). Rather, the objective of these measures is merely to raise the risk side of the risk-benefit equation and cause the criminals to divert to another target that is easier to attack.
Detection Points

Like in a terrorist attack, during the target selection and planning phases of the criminal planning cycle, the criminal will need to have eyes on the target to determine if the target fits his criteria and if the benefit of committing a crime against the target is worth the risk associated with such an attack. Certainly, some of this surveillance can be accomplished electronically, such as when a potential kidnapping victim posts his running routes and times on Facebook or a potential burglary victim announces on Twitter that she is halfway across the world and her home is empty.

Still, while such helpful intelligence can be useful in reducing the amount of criminal surveillance required, there is still no substitute for having eyes on the target. The criminal will want to surveil or "case" the target before conducting the crime. I learned this firsthand as a federal agent planning operations to serve arrest and search warrants. I could gain a vast amount of intelligence from online sources, but I still wanted to see and study the building myself before the operation to ensure I could properly plan the raid. There are some things you simply cannot observe and understand from online sources.

The amount of time devoted to the criminal surveillance process will vary, depending on the type of crime and the type of criminal involved. A criminal who operates like an ambush predator, such as a rapist, may lie in wait for a suitable target to come within striking distance. This is akin to a crocodile lying in a watering hole waiting for an animal to come and get a drink. The criminal may have only a few seconds to size up the potential target and conduct the risk-benefit calculation before formulating his plan, getting ready and striking.

On the other extreme are the criminals who behave more like stalking predators. Such a criminal is like a lion on the savannah that carefully looks over the herd and selects a vulnerable animal believed to be the easiest to take down. A criminal who operates like a stalking predator, such as a kidnapper or high-end jewel or art thief, may take weeks or months to select a suitable target and then take days or even weeks of additional time to conduct follow-on surveillance, assess the target's vulnerabilities and develop a detailed plan to conduct the crime. Normally, stalking criminals will prey only on targets they feel are vulnerable and can be successfully hit, although they will occasionally take bigger risks on high-value targets. In such a scenario, they are likely to strike the target with overwhelming force, very similar to a military or SWAT takedown of a high-value target.

Of course, there are many other types of criminals who fall somewhere in the middle, and they may take anywhere from a few minutes to several hours to watch a potential target. Even among criminals conducting the same general type of crime, there can be a large difference in the amount of criminal surveillance required. For example, a bank robber who is planning to hold up a local bank branch has very different intelligence needs from a bank robber planning to tunnel into the bank vault of a large central bank. Nevertheless, they all conduct some degree of criminal surveillance and they are therefore all vulnerable to detection while they are conducting that surveillance -- if someone is looking for them.

The closer one gets to the point in time when the crime is to be committed, the more difficult it is to prevent it. Once the criminal has selected his target and deployed, e.g., the carjacker has pulled out his gun or the rapist lunges for his target, it is very difficult to stop or thwart the attack. Certainly, crime victims do escape due to the incompetence of the criminals or even sheer luck, but generally once the attack begins it is difficult to stop. Attack recognition can sometimes help an alert victim anticipate the crime and take immediate action to get away from the attack zone before the criminal can succeed, but it is simply not prudent to rely upon attack recognition and immediate action. It is far preferable to avoid the situation before an attack is launched.

By the escape and exploitation phases of the criminal cycle, there is generally little that a victim can do, which is why it is important to detect criminals as early in the cycle as possible -- in the surveillance phase.

While it may be hard for some people to believe, most criminals are terrible at conducting surveillance. This leaves them quite vulnerable to detection if the potential victim is looking for them. I have interviewed a large number of crime victims who noticed the criminals before they were attacked, but for some reason chose not to take action to avoid the situation. In most cases, they simply had the wrong mindset. They ignored what they were seeing because they either didn't trust their senses or somehow thought they couldn't be victimized.

Such cases can be avoided if people would just realize there are criminals in the world who prey upon other humans. Potential victims also need to realize that crimes don't just happen -- they are the result of a process. This means that criminals conducting the process can be identified by their behavior and the process can be thwarted before a crime is committed.