One of the first things we teach in every HBPR&A course is the rule of 3s. It's simple enough to explain in a sentence but takes real practice to apply under pressure.
A single behavioral indicator means nothing. Three indicators in sequence tell a story.
Somebody sweating on a hot day isn't an anomaly. Somebody avoiding eye contact in a busy train station isn't suspicious. Somebody wearing a bulky jacket in winter is just cold.
Taken alone, any of these behaviors has a dozen innocent explanations. And that's exactly the problem with untrained observation. People either see everything as a threat (exhausting, inaccurate) or nothing as a threat (dangerous, also inaccurate).
The rule of 3s gives your brain a framework. You're not looking for one thing. You're looking for a cluster.
Person A is sweating on a cool day (indicator 1). They're also fixated on a specific area while everyone else is moving freely through the space (indicator 2). And they keep adjusting something under their jacket in a way that doesn't match normal grooming behavior (indicator 3).
That's a cluster. Three indicators, occurring in the same person, within a compressed timeframe. Now you have something worth investigating.
The same cluster in a different context means something completely different. Three unusual behaviors at a military checkpoint carry different weight than three unusual behaviors at a school pickup line.
That's why HBPR&A doesn't hand you a checklist of "suspicious behaviors." It teaches you to establish a baseline first, then identify anomalies against that baseline, then cluster those anomalies to determine intent.
Baseline. Anomaly. Cluster. Decision.
The best part about the rule of 3s is you can practice it anywhere. A coffee shop. A parking lot. A school hallway. A subway platform.
Pick a space. Establish what normal looks like. Then watch for deviations. When you spot 3 deviations in the same person or group, you've got a cluster worth tracking.
Most of the time, the cluster will resolve to something harmless. That's fine. The point isn't to find threats everywhere. The point is to build the observation muscle so that when a real cluster appears, you don't miss it.