DHS See Something Say Something: Public Awareness Program
The "If You See Something, Say Something®" campaign is a national public awareness initiative administered by the U.S. Department of Homeland Security that encourages the public to report suspicious activity to local law enforcement. Originally developed by New York's Metropolitan Transportation Authority (MTA) and licensed to DHS in 2010, the program operates across transportation networks, sports venues, universities, retail environments, and federal facilities throughout the United States. Understanding how the program works — and where its boundaries lie — is essential for both the general public and the institutional partners who display its messaging.
Definition and scope
"If You See Something, Say Something®" is a registered trademark of the MTA, licensed exclusively to DHS for national deployment (DHS official program page). The program's core function is to bridge the gap between public observation and law enforcement response by establishing a clear, low-barrier reporting pathway for behaviors that may indicate terrorism, mass violence, or other threats to public safety.
The program operates at the federal level through DHS but relies on partnerships with state and local agencies, transit authorities, sports leagues, and private-sector entities. The DHS state and local partnerships framework is central to the program's reach — as of the program's national expansion, DHS had partnered with more than 200 organizations across sectors including professional sports, higher education, and retail. Critically, the program is designed to supplement — not replace — 911 systems and traditional law enforcement channels.
The scope is explicitly national. The program's messaging appears in 22 languages to accommodate the linguistic diversity of communities served by major transit systems and urban centers (DHS).
How it works
The operational mechanism is straightforward:
- Observe: A member of the public notices a behavior or situation that seems out of place in the immediate environment.
- Assess: The observer considers whether the activity is genuinely suspicious or has a reasonable, innocent explanation.
- Report: The observer contacts local law enforcement — via 911, a non-emergency police line, or a venue-specific tip line — providing a description of what was seen, where it occurred, and any relevant details about individuals involved.
- Disengage: Reporters are instructed not to confront individuals or intervene physically.
DHS emphasizes that reports should focus on behaviors, not personal characteristics such as race, ethnicity, religion, or national origin. This distinction is a deliberate design choice intended to prevent discriminatory reporting. The program's published guidance states that neither the DHS program nor its law enforcement partners should act on tips motivated solely by a person's demographic attributes (DHS Civil Rights and Civil Liberties guidance).
The reporting infrastructure itself is decentralized. DHS does not operate a single national tip line. Instead, reports flow to local police departments, transit police, venue security, or — in cases involving federal facilities — to the Federal Protective Service, a component within DHS.
Common scenarios
The program identifies two broad categories of concern: criminal behaviors and pre-incident indicators of terrorism or mass violence.
Criminal behaviors warranting a report include:
- Unattended bags or packages left in transit stations, airports, or public gathering spaces
- Individuals conducting surveillance of a facility, photographing security measures, or sketching building layouts in a context that suggests reconnaissance
- Attempts to access restricted or secured areas without authorization
- Discovery of suspicious or improvised devices
Pre-incident indicators — behaviors that may suggest planning for a larger attack — include unusual inquiries about building capacities, security protocols, or utility shutoffs; acquisition of materials in quantities inconsistent with stated purposes; and communications suggesting intent to commit violence.
The contrast between a criminal behavior report and a pre-incident indicator report is functionally significant. A criminal behavior report typically triggers an immediate law enforcement response, while a pre-incident indicator report may be routed to fusion centers for threat assessment analysis. The DHS fusion centers network processes the latter category within the broader DHS intelligence and analysis framework.
Decision boundaries
The program explicitly delineates what does — and does not — constitute reportable behavior. This boundary is operationally important because over-reporting degrades law enforcement capacity while under-reporting creates gaps in threat detection.
Reportable: Specific, observable behaviors that are objectively out of place — an unattended bag in a crowded terminal, a person recording security checkpoints at a federal building, or an individual expressing explicit intent to harm others.
Not reportable under program guidance: A person's appearance, religion, or ethnicity in the absence of any specific behavioral indicator. DHS guidance is explicit that "the public should report only what they see, not who they see" (DHS).
The program also distinguishes between immediacy thresholds. An active or imminent threat — a weapon visible, an explosion heard, an attack in progress — requires a 911 call. Non-urgent observations with no immediate danger present can be directed to non-emergency law enforcement lines or tip systems.
These decision boundaries connect directly to the DHS privacy and civil liberties framework, which governs how reported information is stored and used. The broader DHS counterterrorism role provides institutional context for how public tips integrate into national threat detection infrastructure. For a broader overview of DHS programs and mandates, the DHS Authority homepage provides navigation to all primary subject areas.