Which of the following suspicious behaviors is associated with the 'pre-incident indicators' of a terrorist attack?