The answer is to look for maintenance activities that double as reconnaisance & preparatory missions. And to look for drills that ligitimately deploy police and military, and provide cover for an attack. In other words, look for REPDA, REconnaissance—Preparation—Drill—Attack.
28.11.1994 - The Sinking of the MS Estonia Reconnaissance: First bomb drill onboard in February 1994 (to learn where to place a bomb and what its requirements should be).
Preparatory mission: Second bomb drill onboard days before the sinking (to place the actual bomb).