The study showed that simple analytical processes could produce operationally relevant findings from 911 calls. The process was documented for implementation and refinement in other jurisdictions. The proposed analysis of 911 calls that report suspicious activity involves five steps. The first step analyzes and compiles data from original 911 calls into a single searchable database. The second step filters records based on call type, and the third step narrows records by surveillance-related key words, such as photography, video, note taking, and visual aids. This pertains to possible terrorist surveillance of strategic targets. Step four sorts these surveillance reports by date, time, and location. Step 5 then assesses each call to determine locations with the greatest potential risk. Four main factors are used to assess risk: whether the incident is atypical or can be easily explained by tourist activities; whether the location is attractive for a terrorist attack; whether the call is part of a larger cluster for the same target; and whether a police report was filed. This five-step process reduced the amount of information to a manageable level for an analyst. Out of the more than 1.3 million calls that initially went into the database, 175 calls for 12 locations were identified as potentially related to preoperational terrorist activities. Plans are being made to continue to refine this method by automating some of the data-processing steps and testing it in additional U.S. jurisdictions. The Office of the Director of National Intelligence is working on establishing a nationwide capacity to collect, analyze, and share terrorism-related suspicious activity reports. 4 listings for additional information, 9 notes, and 3 figures