Episode 15

June 26, 2025

00:13:42

Sleeper Cells in the U.S.: How to Spot 'Hidden' Threats Using Behavior, Not Bias

Hosted by

Mickey Middaugh
Sleeper Cells in the U.S.: How to Spot 'Hidden' Threats Using Behavior, Not Bias
Red Dot Mindset
Sleeper Cells in the U.S.: How to Spot 'Hidden' Threats Using Behavior, Not Bias

Jun 26 2025 | 00:13:42

/

Show Notes

Is your awareness prepared for the long game?

Following the June 2025 U.S. airstrikes on Iranian nuclear sites, federal agencies have elevated alerts and issued global warnings. While no specific threats have been confirmed, the concern is real: sleeper cells and long-term operatives remain a persistent national security risk.

So what does that mean for you?

In this episode of Red Dot Mindset, we cut through the headlines and translate a complex geopolitical threat into practical, civilian-level awareness — built on frameworks developed by Mickey Middaugh, founder of Grey Matter Ops and a retired U.S. Air Force Security Forces Senior NCO with over two decades of experience in force protection and threat detection.

In this episode, we cover:

  • The Anatomy of a Sleeper — What sleeper cells are and how they operate in plain sight
  • Geopolitical Triggers — How global events can activate long-dormant threats on U.S. soil
  • The Grey Line Awareness™ Framework — A four-step system for detecting anomalies in your environment
  • Behavior Over Identity — How to recognize red flags without bias or fear-based thinking
  • Actionable Preparedness — Practical drills to sharpen your awareness before a crisis unfolds

This isn't about panic. It's about building the kind of awareness that makes you a critical sensor — not a bystander.

Because in a world of silent operators, awareness is your armor.

Train the mind. Win the fight.

For more situational awareness and preparedness content, visit Red Dot Mindset: https://reddotmindset.com/

Chapters

  • (00:00:01) - Introduction: Geopolitical Tensions and June 2025 Airstrikes
  • (00:00:31) - The Rising Threat: Sleeper Cells and Federal Warnings
  • (00:01:01) - Defining the Sleeper Cell: The Art of Normalcy
  • (00:02:14) - Activation Triggers: What Flips the Switch?
  • (00:02:51) - The Southern Border and Current Security Gaps
  • (00:04:16) - The Tactical Cycle: Infiltration to Integration
  • (00:05:18) - Historical Precedents: From 9/11 to Modern Plots
  • (00:06:44) - Beyond Iran: Global Perspectives on Long-Term Operatives
  • (00:07:20) - Behavior vs. Identity: The Core of Effective Awareness
  • (00:08:01) - The Grey Line Awareness™ Framework Explained
  • (00:09:32) - Red Flags: Observable Behaviors to Watch For
  • (00:11:09) - Tactical Checklist: Building Your Awareness Muscle
  • (00:12:26) - Final Takeaways: You Are the Sensor
View Full Transcript

Episode Transcript

[00:00] Speaker A: Welcome to the deep dive. Today we're cutting through some pretty serious headlines. We need to talk about a geopolitical situation that's—well, it's hitting close to home. Just this month, June 2025, the US carried out airstrikes on three Iranian nuclear sites: Isfahan, Natanz, and Fordo. And as you'd expect, this has significantly ramped up tensions with Iran, big time. The immediate impact here, we've seen the National Terrorism Advisory System (NTAS) alerts go up, plus those broad worldwide caution alerts from Homeland Security and the State Department. [00:31] Speaker B: Yeah, and CBP Commissioner Rodney Scott was pretty blunt about it. NewsNation reported him saying the threat of sleeper cells or sympathizers has never been higher. Stark words. Now, let's be clear: there haven't been any, you know, specific actionable threats confirmed publicly. That's important. But federal agencies are urging everyone to be more aware. So our goal today is to give you, our listener, the tools to understand this threat and, crucially, how you can contribute to security through informed awareness, not fear. Okay, so let's dig in. What exactly are these sleeper cells people are talking about? [01:01] Speaker C: That's the core question, isn't it? When we talk about these hidden threats right now, the focus really zooms in on sleeper cells, and drawing on the work of Mickey Middaugh, the founder of Grey Matter Ops. He's an expert in taking military and police tactics and making them usable for civilians. Sleeper cells are basically covert operatives. Could be individuals, could be small groups placed inside a target country. And they live there, sometimes for years, totally under the radar until they get activated. Activated for what? Could be espionage, could be sabotage, or, you know, terrorism. And what's really, well, fascinating—kind of disturbing—is this dormancy period. They aren't hiding in caves. They're living incredibly normal lives. [01:42] Speaker A: Normal how? [01:43] Speaker C: Like holding down regular jobs, joining community groups, maybe raising families. And often they make a point not to contact other cell members. It's all about minimizing risk, avoiding detection. [01:53] Speaker A: So they just blend in. [01:54] Speaker C: Exactly. But there's a nuance there. Sometimes, according to insights like those in Sleeper Agent Behavior: The Art of Normalcy, this normal act can seem too normal, almost rehearsed. [02:05] Speaker A: You know, like they're trying too hard to be unremarkable. [02:07] Speaker C: Precisely. It can feel a bit scripted. It's a deliberate tactic. Blending in is an art for them. [02:14] Speaker A: Okay, so how do they get activated? What flips the switch? [02:17] Speaker C: Activation is the critical point. It could be triggered by encrypted messages, maybe direct contact from their handler, or sometimes it's strong ideological motivation—maybe retaliation for something like these recent strikes we mentioned. [02:31] Speaker A: Right. [02:31] Speaker C: As former CIA officer Michael Scheuer put it, sleeper agents are "strategic implants," not operatives in a hurry. They are absolutely playing the long game. [02:41] Speaker A: "Strategic implants"—that's a chilling phrase. [02:43] Speaker C: It is, and it really brings us to the present moment. How does this long-term strategy fit with the immediate tension we're seeing right now? [02:51] Speaker A: Yeah, it feels like a very dangerous mix. The immediate trigger, like we said, those June 2025 airstrikes on Iran's nuclear sites that lit the fuse, seemingly. And a major worry flagged by places like NewsNation and experts like Pam Bondi is this influx of Iranian nationals coming into the US illegally. The numbers are stark. Between 2021 and 2024, reports say over 1,500 Iranians were caught crossing the southern border illegally. And get this: nearly half—729 people, that's 48%—were apparently released into the U.S. [03:23] Speaker C: And that's just the ones they caught. [03:25] Speaker A: Exactly. That figure doesn't even touch the estimated 2 million plus "known gotaways"—people who evaded capture entirely. [03:31] Speaker C: That's a significant unknown factor. [03:33] Speaker A: It really is. And all this is happening while our agencies are, frankly, stretched. The FBI is on high alert. DHS is warning about heightened threats: cyberattacks, physical attacks on big cities like New York, D.C., L.A., critical infrastructure—the usual high-value targets. Right. But here's the kicker: agencies like the DOJ and FBI are apparently facing budget cuts—cuts to crucial areas: investigations, counterintelligence, cyber ops. Pam Bondi's comment that they're "doing more with less" really hits home. It puts even more emphasis on, well, on everyone else being aware. [04:05] Speaker C: It absolutely does. Civilian awareness becomes a force multiplier in that scenario. [04:09] Speaker A: So, okay, if they're here, potentially integrated, how do they actually operate? What's the playbook look like? [04:16] Speaker C: Understanding the method is key. Mickey Middaugh’s Grey Matter Ops tactical model lays out a pretty clear cycle. It's got phases. First up is infiltration. This is how they get in. And it might happen years—literally years—before any hostile act. Often through legal channels: visas, maybe refugee or asylum claims. [04:32] Speaker A: But also illegal crossings, as we mentioned. [04:35] Speaker C: Yes, that too. The aim is just to get boots on the ground quietly. Phase one: establish presence. Then comes integration. This is that "normalcy" phase we talked about. Getting jobs, building social networks, joining community things. Living modestly is key here, too. Avoiding any kind of extremist talk. Obviously, they want to be forgettable, just part of the background noise. [04:55] Speaker A: Until they're not. [04:56] Speaker C: Exactly. Until activation. That trigger could be a coded signal, direct orders from a handler, or maybe a big geopolitical event acting as an ideological catalyst. Once activated, they might act alone or maybe coordinate with others. Targeting soft infrastructure is common—places with lots of people, symbolic locations. Maximum disruption or fear. [05:16] Speaker A: And we've seen this pattern before, haven't we? [05:18] Speaker C: Tragically, yes. Think about the 9/11 hijackers back in 2001. They mostly came in on legal visas—tourist, business, one student visa. They blended in, took flight lessons. Didn't raise major alarms beforehand. It was a catastrophic exposure of gaps in, well, visa oversight and connecting the dots. [05:36] Speaker A: A failure to see the behaviors leading up to it. [05:38] Speaker C: Precisely. It showed that legal entry doesn't guarantee safety. Then you had the Miami 7 in 2006—the Liberty City Seven. That was a domestic group, actually. An FBI sting uncovered them after they'd pledged allegiance to Al-Qaeda and were allegedly plotting attacks: Sears Tower, FBI building in Miami. [05:56] Speaker A: So proactive monitoring worked there? [05:58] Speaker C: It did. It showed the value of getting ahead of the plot. And then Najibullah Zazi in 2009—an Afghan-American radicalized overseas, trained in Pakistan. He planned coordinated suicide bombings on the NYC subway that were stopped by good intel sharing between agencies and tracking digital communications. Another win for prevention. [06:17] Speaker A: So these aren't new tactics, just maybe a renewed focus given the current tensions. [06:22] Speaker C: That seems to be the assessment. Former CIA/FBI counterterrorism officer Tracy Walder, for instance, she's been quite clear. She believes Iran has had cells here for decades. [06:30] Speaker A: Decades, just waiting. [06:32] Speaker C: Just waiting for the right moment, as she put it—ready to target critical infrastructure, maybe carry out suicide bombings. She pointed to the killing of Iranian General Qassem Soleimani in 2020 as something that put Iran on a warpath for us. [06:44] Speaker A: And it's not just Iran, right? You mentioned others? [06:47] Speaker C: No, absolutely not. Other countries like China, Russia, North Korea, Cuba—they're known to use similar long-term strategies. And Iran also has proxies like Hezbollah. Hezbollah is estimated to have, I mean, tens of thousands of fighters globally. A huge network. So the potential sources of this threat are diverse. [07:06] Speaker A: Okay, so if these threats can be hiding in plain sight, living normal lives for years, how on earth can an average person—how can you listening possibly help spot something without just being suspicious of everyone? That seems impossible. [07:20] Speaker C: It's not impossible, but it requires shifting your focus. That's the absolute core principle from both Grey Matter Ops and DHS: focus on behavior, not identity. [07:29] Speaker A: Behavior, not identity. Say more about that. [07:31] Speaker C: It means you're looking at what people do, not who they are or what they look like. As Brian Jenkins from Rand said, "Radicalization is behavioral, not ethnic." Watch actions, not accents. [07:40] Speaker A: That's crucial. So race, religion, ethnicity, appearance—none of that is inherently suspicious? [07:46] Speaker C: Absolutely not. That leads to bias, and frankly, it's ineffective. The real clues are in actions that deviate from the norm in a concerning way. [07:56] Speaker A: So how do you teach people to see that deviation without creating fear or bias? [08:01] Speaker C: That's exactly the challenge Mickey Middaugh tackled with the Grey Line Awareness™ framework. It's designed specifically for civilians. Think of it as a structured way to process what you observe. A mental checklist, almost. [08:13] Speaker A: Okay, break that down. What are the steps? [08:15] Speaker C: It starts with Baseline. First, you need to understand what's normal for wherever you are. What does this place usually look, sound, feel like? The everyday rhythm. [08:23] Speaker A: Got it. Establish normal. [08:24] Speaker C: Step two: Anomaly. This is where you notice something different, something that deviates from that baseline you just established. It might be subtle, just something that feels off, out of place. [08:34] Speaker A: Okay, I see something weird. Then what? [08:36] Speaker C: Then Evaluation. You have to consider the context. Is this anomaly, this weird thing, actually a potential threat? Or is it just unusual but harmless? A red herring, so to speak? Maybe someone's just lost or having a bad day. [08:49] Speaker A: Context matters. Makes sense. [08:51] Speaker C: Hugely. And finally, phase four is Action. And this is critical: you never confront someone you suspect. Ever. [08:59] Speaker A: Right. Don't play hero. [09:00] Speaker C: Definitely not. Your action is to observe carefully—know details: who, what, when, where—and report it. Report it through the proper channels: local police or 911 if it's an immediate emergency. Let the professionals handle it. Always. Leave investigation and intervention to the trained authorities. Your role is observation and reporting. That's the Grey Line process: Baseline, Anomaly, Evaluation, Action. [09:25] Speaker A: Okay, that framework makes sense. But what kind of specific behaviors—what actual red flags—should people look out for? [09:32] Speaker C: Good question. There are specific indicators, and these align with what both Grey Matter Ops teaches and what DHS advises. For example, someone taking photos or video, or just intensely watching security features: cameras, exits, how crowds move—especially in sensitive areas or public spaces. [09:48] Speaker A: Like mapping the place out? [09:49] Speaker C: Potentially. Or someone showing unusual interest in building plans, security rules, emergency procedures—asking questions that go beyond normal curiosity. Okay, what else? Seeing people conduct what look like rehearsals or dry runs—practicing movements or actions, maybe multiple times at busy locations or events. Also, sudden changes: someone abruptly withdrawing from their job or social life without explanation, or unexplained frequent travel. [10:14] Speaker A: Hmm. Anything else tangible? [10:16] Speaker C: Stockpiling materials—it seems suspicious without a clear reason. Like large amounts of chemicals, maybe, tactical gear, weapons parts. If it doesn't fit their job or hobbies. [10:24] Speaker A: Right. Context again. A farmer buying fertilizer is normal. Someone else buying tons of it? [10:29] Speaker C: Maybe not exactly. Online signals can be relevant too, but again, focus on behavior. Are they suddenly deep into encrypted apps for potentially illicit communication? A drastic, overt shift in online ideology towards violence—expressing violent extremist views, that's tricky. [10:46] Speaker A: The online space? [10:48] Speaker C: It is. Other key signs: making threats, even vague ones; testing security systems; trying doors; probing guards; trying to get information about operations that isn't public; attempting to get into places they shouldn't be. [11:00] Speaker A: So a whole range of observable actions. [11:02] Speaker C: Actions, yes. Not appearances or backgrounds. Observable behaviors that deviate from the established baseline. [11:09] Speaker A: Okay, so to help people put this all together, you mentioned a checklist. [11:12] Speaker C: Well, yeah, sort of a tactical civilian checklist to build these habits. First, keep an eye on those DHS NTAS bulletins—just be aware of the official threat level. Second, wherever you go in public—malls, stations, stadiums, even church—consciously identify multiple exit routes. Just know how you'd get out if you needed to. [11:30] Speaker A: Basic situational awareness. [11:31] Speaker C: Exactly. Third, get familiar with the "See Something, Say Something" guidelines. You can find them easily online at dhs.gov. Know how and what to report. [11:41] Speaker A: Okay, what else? [11:42] Speaker C: Fourth, practice mental readiness drills. Things like combat breathing—simple controlled breaths to stay calm under pressure. The five-second reset—a quick mental pause to clear your head and refocus. And mental snapshotting—training yourself to observe and remember details quickly. [11:58] Speaker A: Tools to manage your own response. [12:00] Speaker C: Yes, staying calm helps you observe clearly. And finally, actively train your observation skills. Use resources like the tactical content from Grey Matter Ops. Practice noticing details, identifying baselines, spotting anomalies in everyday life. [12:15] Speaker A: It sounds like building a muscle. [12:17] Speaker C: It really is. Awareness is a skill you cultivate, which raises the final question: how do you keep building that awareness muscle? How do you make it an ongoing practice? [12:26] Speaker A: And that really brings us back to the core message for everyone listening. You are that frontline of awareness. You're a crucial sensor in the whole national security picture. This deep dive—our aim was to take all this complex info and boil it down into something useful for your preparedness. Not to make you scared, but to empower you. It comes back to our principles: train the mind, win the fight. And remember, awareness is armor. [12:49] Speaker C: Absolutely. And Grey Matter Ops exists precisely for that reason. It's a trusted source for civilians serious about building real situational awareness and preparedness. Mickey Middaugh’s specific expertise is translating those proven professional tactics from military, from police, into strategies that you can actually use—empowering you to observe, document, and report effectively, without bias, without fear. [13:15] Speaker A: So keep training that mind. We encourage you to follow Red Dot Mindset for more deep dives like this one, focused on giving you the knowledge you need. [13:23] Speaker C: Remember, Red Dot Mindset is about that focused precision, like a laser dot cutting through the noise, highlighting exactly what you need to know. [13:30] Speaker A: And maybe the thought to leave you with is this: in a world that's always changing, real security isn't just about the threats we manage to stop. [13:38] Speaker C: It's also profoundly about how clearly you can see what's happening right there in front of you.

Other Episodes