Perhaps you are scared by fundamenralism. So you get tactical training, use encryption because you hate "big-brother", and anonymize your IP... Then because of your fear you research prior attacks.

I'm going to argue that's at least a tens of thousands of people if not many more. A lot of apps are implementing encryption (tens of millions of users), millions of Americans have tactical training, plus most Americans are interested in attacks.

Seems like this list doesn't really narrow down the suspect pool to meaningful numbers. More like, it makes it seem like people made this list to seem like they were doing something.

I'm not saying that this is a perfect filter that has no false positives. No one is saying that. But if you were to give me profiles of every American citizen and ask me to find the terrorists - it's exactly where i'd start.

See my reply to another comment. I concede that Encryption in tandem with the other criteria is possibly something to take into account, but it certainly should not be in the same category of things like "expressing desire to travel overseas to engage in violence." On reading the first page, it looks the questionnaire answers are weighed, but I certainly hope that "wanting violence" isn't anywhere near the same weight as "encrypts his shit."

I imagine it's not a weighting system per se. I don't know any more than you, so all I can say really is that if I were designing it, encryption would be considered a major red flag one someone who already had the other characteristics.

That is, if someone encrypts, that means nothing. But if you are comparing two fundamentalists predisposed to violence, and one of them uses crypto and privacy software and the other doesn't - I would lean heavily towards investigating the crypto guy. He's likely planning something.

I guess what i'm saying is that I think the interaction of a feature like crypto should be nonlinear with certain other features.

Fundamentalism, tactical training and a keep interest in prior attacks is a red flag on its own. I don't think that encryption adds anything.

Someone like that who suddenly starts using encryption is a major red flag. Fundamentalism, tactical training and a keep interest in prior attacks aren't enough to single out someone who's preparing an attack, but someone like that who went off the grid, started using encryption and just maxed out his credit card needs far more attention than someone spreading have from their basement.

Again, maxing credit cards and going to the grid are red flags, but I still don't see what encryption adds.

Encryption suggests active planning. Using encryption is what you do when you are actively trying to hide your activity. The others are indicators of susceptible traits - but encryption suggests imminence and active involvement. If you have gone beyond just developing radical beliefs and start actually planning an attack, that's when you're likely to start using encryption and taking operational security seriously.

Look at the actual wording:

Has the subject engaged in or discussed tradecraft to hide their online activities contextually different from previous activity?

The relevant part isn't the encryption, but the context. If you have two email accounts, one for general usage, unencrypted, and one encrypted that you rarely use, but suddenly see a spike in usage, that's a red flag.

It isn't if you use encryption, but how you use it.