Structured Observation in Action: Identifying a Concealed Weapon at a Protest

In this post, we've updated how we describe this case to reflect our current structured observation framework, and expanded on how the same skill applies beyond law enforcement. This post was originally published on March 1, 2021, and has been substantially revised and republished in 2026.

The right to peaceful protest is a foundational part of a free society, and the communities where these protests take place need to be safe. Ensuring that safety, without interfering with a lawful demonstration, is part of what makes this work difficult. The ability to identify a person carrying a concealed weapon in a large crowd, quickly and accurately, is one of the clearest real-world tests of a structured observation process.

This is a story about one of our trainees putting that process to work.

The Setup

John, a retired law enforcement officer who spent his final years working with a gun interdiction unit, was tasked with monitoring a camera feed during a protest alongside another investigator. The crowd numbered somewhere between 300 and 400 people.

Most large crowds like this establish their own baseline of consistent behavior fairly quickly: people moving with the group, engaging with those around them, generally oriented toward the event itself. Against that baseline, a small number of people stood out to John, not because of anything about who they were, but because of how they were behaving. Their manner of watching the environment, their clothing, and what they were doing didn't fit the pattern around them. Establishing that baseline, the first step in the structured observation framework we teach, is what made the rest of what John noticed possible.

Reading the Cluster

John kept watching one individual in particular. That person was standing against a wall, a positioning we teach as a Position of Advantage, and repeatedly placed a hand in his sweatshirt pocket, a combination of behaviors we refer to in training as Security Feel and Hands in Pocket.

No single one of these behaviors means anything on its own. People lean against walls and put their hands in their pockets constantly, for entirely ordinary reasons. What made this worth continued observation was the cluster, not any one signal in isolation.

When the individual removed his hand, John noticed the fabric of his sweatshirt was stretched in a way consistent with something heavy inside the pocket, what we call Clothing Fiber Stress, and that one side of his clothing was hanging noticeably lower than the other, a sign we call Jacket Displacement.

John relayed what he was seeing to observers on scene, who continued watching the individual. Using binoculars, one of those observers, also trained in this same process, saw the man reach into his pocket and briefly expose the handle of a handgun. That same observer went on to identify a second small group of men displaying a similar set of deviations from the crowd's baseline. One of them was also later confirmed to be carrying a handgun.

Why This Matters

This case illustrates something we emphasize throughout our training: no single behavior indicates wrongdoing. It's the accumulation of specific, related behaviors, read together and in context, that turns an ordinary person in a crowd into someone worth a closer look. We walk through this four-step process, establishing a baseline, identifying deviations, interpreting clusters of behavior, and articulating a decision for which action to take, in more detail in Proactive Safety and Threat Recognition: A Structured Observation Framework.

The specific terms used here, Position of Advantage, Security Feel, Clothing Fiber Stress, Jacket Displacement, are part of a shared vocabulary we teach so that personnel can communicate what they're observing quickly and precisely, both to each other in real time and afterward in a report. We cover why that shared vocabulary matters in our post on the subject.

This Applies Well Beyond Law Enforcement

While John's story took place at a protest, the underlying skill, monitoring a camera feed, establishing a baseline for the environment, and picking out a small number of individuals whose behavior deviates from it, is not unique to law enforcement. Security professionals across a range of industries are asked to do exactly this kind of observation every day, often from a camera monitoring station rather than out in the field.

A hospital security team monitoring lobbies and waiting areas, a school security officer watching hallway and entrance cameras, a corporate security operations center reviewing feeds from a lobby or parking structure, and a gaming or hospitality surveillance team watching a casino floor are all doing the same fundamental work John was doing: establishing what normal looks like in that specific environment, and identifying the small number of people whose behavior doesn't fit it. The setting changes. The behavioral indicators and the process for interpreting them do not. 

Building This Skill in Your Personnel

Recognizing a cluster of behavioral indicators under real conditions, whether in a crowd of hundreds at a protest or on a bank of monitors in a security operations center, isn't something personnel pick up by chance. It takes structured training in what to look for and how to interpret it. Our Threat Observation, Threat Awareness for Law Enforcement, and Threat Awareness for Security Professionals programs build this capability from the ground up.

If you want to build this capability in your own team, we'd like to hear from you.