terrorist attack cycle
Back on March 16, I talked about Scott Stewart of the global intelligence company Strategic Forecasting, Inc., or STRATFOR, authoring a series of Security Weekly reports entitled “Fundamentals of Terrorism.” The first of these, “The Myth of the End of Terrorism,” was released on February 23, and I wrote:
It’s a good, informative read, and serves as a reminder that just because major terror attacks directed against the United States and its interests haven’t been too successful lately, the threat hasn’t gone away.
The second “Fundamentals” report, entitled “Detection Points in the Terrorist Attack Cycle,” came out on March 1, and pointed out that those planning a terrorist attack must follow something called a “terrorist attack cycle,” and certain stages opens them up to detection.
Reprinted with permission of STRATFOR:
Detection Points in the Terrorist Attack Cycle
By Scott Stewart
Last week’s Security Weekly discussed the fact that terrorism is a tactic used by many different classes of actors and that, while the perpetrators and tactics of terrorism may change in response to shifts in larger geopolitical cycles, these changes will never result in the end of terrorism. Since that analysis was written, there have been jihadist-related attacks in Afghanistan, Nigeria, Yemen and Pakistan, an assassination attempt against the president of Abkhazia, and a failed timed-incendiary attack against the Athens subway. (The latter incident, which militant anarchists claimed, reinforces that jihadists are not the only ones who practice terrorism.)
But while terrorism is a continuing concern, it can be understood, and measures can be taken to thwart terrorist plots and mitigate the effects of attacks. Perhaps the most important and fundamental point to understand about terrorism is that attacks do not appear out of nowhere. Individuals planning a terrorist attack follow a discernible cycle — and that cycle and the behaviors associated with it can be observed if they are being looked for. We refer to these points where terrorism-related behavior can be most readily observed as vulnerabilities in the terrorist attack cycle.
The Attack Cycle
Many different actors can commit terrorist attacks, including sophisticated transnational terrorist groups like al Qaeda; regional militant groups like India’s Maoist Naxalites; small, independent cells like the anarchists in Greece; and lone wolves like Oslo attacker Anders Breivik. There can be great variance in attack motives and in the time and process required to radicalize these different actors to the point that they decide to conduct a terrorist attack. But once any of these actors decides to launch an attack, there is remarkable similarity in the planning process.
First, there is the process of selecting or identifying a target. Often an actor will come up with a list of potential targets and then select one to focus on. In some cases, the actor has preselected a method of attack, such as a vehicle-borne improvised explosive device, and wants to find a target that would be vulnerable to that specific type of attack. In other cases, the actor will pick a target and then devise a method of attack based on that target’s characteristics and vulnerabilities. Simply put, the execution of these steps can be somewhat fluid; some degree of planning or preparation can come before target selection, and sometimes target selection will be altered during the planning process. The time required to execute these steps can also vary considerably. Some attacks can be planned and executed within hours or days, while more complex plans, such as those used in the 9/11 or Mumbai attacks, may take months or even years to complete.
Frequently, those planning an attack will conduct detailed surveillance of potential targets to determine what security measures are in place around the target and to gauge whether they have the ability to successfully attack it. If the target is too difficult to attack — commonly known as a hard target — the attack planners will typically move on to their next target, which may prove easier to attack. (When they do continue with attacks against targets whose security measures exceed the attackers’ capabilities, those attacks fail.) We refer to this stage as preoperational surveillance, which means surveillance that is conducted before the operation is fully planned.
After the target has been selected, a second round of surveillance is conducted. This round will be far more detailed and is intended to provide all the details necessary for planning the attack. For example, if the attack is being planned against a static facility, this round of surveillance will generally try to obtain a detailed description of the target’s physical security features and security force procedures. It will also focus on establishing a baseline understanding of the activity that can be expected around the facility at the time of day the attack is anticipated.
If the target of the attack is an individual, the individual’s residence, office and other places the individual frequents will be surveilled. Additionally, the surveillance team will look for patterns and routines that the target follows between these known locations. The team will often analyze the target’s usual routes looking for choke points, or places the target must pass to get from one point to another. If the surveillance team identifies a choke point that the target passes through predictably, it will then try to determine whether that point will allow the attackers to deploy in secret, permit them to spot and control the target, and provide them with good escape routes. If it does, this point will frequently be chosen as the attack site.
In the case of large organizations, different groups or individuals may conduct different phases of the surveillance. Many organizations use specialized operatives for surveillance, though the operational planner will often attempt to get eyes on the target to help with the planning process. For instance, it is known from court testimony in the Mumbai case that David Headley made five extended trips to Mumbai as those attacks were being planned. The repeated trips were required because the operational commanders in Pakistan considered India a hostile environment and the operational planners could not go there to conduct the surveillance themselves. As a result, Headley was sent to observe and report on specific things as planning for the attacks progressed.
During the planning phase, the personnel to be used in the attacks are identified and trained in any special skills they may require for the mission, including languages, marksmanship, hand-to-hand combat, small-boat handling or land navigation. To protect operational security, the operatives may not be briefed in any great detail about the target of their operation until they are very close to being deployed.
Many times the planning phase will end with a dry run, as the preparation did for the 9/11 attacks, when some of the hijackers took their assigned flights in August 2001. While conducting a dry run, the attackers will generally be unarmed to ensure they do not needlessly bring law enforcement attention to themselves.
Sometimes an attacker will have acquired weapons for the attack before the planning phase. Other times the concept of the operation will be constrained by the weapons and money available. But quite frequently, the weapons for the attack will be acquired during the planning phase, after the target has been selected and the means of attack have been established.
Once planning, training and weapons acquisition are complete, the attack team can be deployed. The attack team frequently will again conduct surveillance of the target, especially if the target is mobile and the attack team is deployed and waiting at a predetermined attack site.
If it was properly planned, an attack is very likely to succeed once it has moved to the operational phase. Sometimes attacks do fail because of mistakes or bad luck, but by and large there is no way to stop an attack once it has been set in motion.
At the attack’s conclusion, the attackers will seek to escape the scene. The exception is suicide attacks or when, like Breivik, the attacker intends to be captured as part of the media exploitation phase, the final step in the cycle.
Regardless of whether the attack is a suicide attack against a church in Nigeria or a timed-incendiary attack against a subway in Athens, the same attack cycle is followed. With an eye toward averting future attacks, a thoughtful observer can use the attack cycle model to understand how an attack was planned and executed.
While plots are occasionally thwarted at the last second, for the most part law enforcement and security personnel must detect and interdict the plot before it gets to the attack phase to have any chance of stopping it. Once the bullets fly or the explosive device is detonated, there is little security forces can do but initiate their immediate action drills in an effort to reduce the body count. This means that an emphasis must be placed on identifying attackers earlier in the process, well before they are in a position to strike.
Unless security forces have a source inside the group that is planning the attack or manage to intercept the group’s communications, the only way to identify attack planners is by noting their actions. This is especially true of a lone wolf attack, where no external communication occurs. The earliest point in the attack cycle that the attackers can be identified by their actions is during the preoperational surveillance required for target identification.
There is a widely held conception that terrorist surveillance is generally sophisticated and almost invisible, but when viewed in hindsight, it is frequently discovered that individuals who conduct terrorist surveillance tend to be quite sloppy and even amateurish in their surveillance tradecraft. We will discuss what bad surveillance looks like, and how to recognize it, in more detail next week, but for now it is sufficient to say that poor surveillance tradecraft is a significant vulnerability in the terrorist attack cycle.
As noted above, additional surveillance is often conducted at later stages of the attack cycle, such as in the planning stage and even sometimes in the attack stage, as the attackers track the target from a known location to the attack site. Each instance of surveillance provides an additional opportunity for the assailants to be identified and the attack to be prevented.
During the planning phase and as the operatives prepare to deploy, communication between and movement of group members often increases. Additionally, group members may engage in outside training that can attract attention, such as playing paintball, visiting the firing range or, as was the case with the 9/11 pilots, attending flight schools. This increase in activity, which also might include money transfers, leaves signs that could tip off the authorities.
Another significant vulnerability during the attack cycle is weapons acquisition. This vulnerability is especially pronounced when dealing with inexperienced grassroots operatives, who tend to aspire to conduct spectacular attacks that are far beyond their capabilities. For example, they may decide they want to conduct a bombing attack even though they do not know how to make improvised explosive devices. It is also not uncommon for such individuals to try to acquire Stinger anti-aircraft missiles, automatic firearms or hand grenades. When confronted by this gap between their capability and their aspirations, grassroots operatives will often reach out to someone for help with their attack instead of settling on an attack that is within their ability. Increasingly, the people such would-be attackers are encountering when they reach out are police or domestic security agency informants.
As far back as 2010, jihadist leaders such as Nasir al-Wahayshi of al Qaeda in the Arabian Peninsula recognized this problem and began to encourage grassroots jihadists to focus on conducting simple attacks against soft targets. Nevertheless, grassroots jihadists are consistently drawn toward spectacular attacks, as seen in the Feb. 17 arrest near the U.S. Capitol of a Moroccan man who thought his handler, who was in fact an FBI informant, had equipped him for a suicide attack. Unlike most jihadists, other types of grassroots militants, such as anarchists, are far more comfortable conducting simple attacks with readily available items.
Personality traits and psychological profiles aside, anyone desiring to plan a terrorist attack must follow the attack planning cycle, which at certain stages will necessarily open them up to detection.
Detection Points In The Terrorist Attack Cycle is republished with permission of STRATFOR.
Part 1 of STRATFOR’s “Fundamentals of Terrorism” series is reprinted here.
(Editor’s note: Link to original STRATFOR report added on “Resources” page)
One more great STRATFOR piece for you today. While surfing the “Shadow CIA” website last night, I stumbled on a Security Weekly report from Scott Stewart back on June 10, 2010, which focused on situational awareness. What is situational awareness? According to the Austin, Texas-based global intelligence company, it’s the process of recognizing a threat at an early stage and taking measures to avoid it. As they believe it’s more of an attitude or mindset than a hard skill, situational awareness can be adopted and employed by anyone. It can even be used to thwart acts of terrorism. Reprinted with STRATFOR’s permission…
A Primer on Situational Awareness
By Scott Stewart
The world is a wonderful place, but it can also be a dangerous one. In almost every corner of the globe militants of some political persuasion are plotting terror attacks — and these attacks can happen in London or New York, not just in Peshawar or Baghdad. Meanwhile, criminals operate wherever there are people, seeking to steal, rape, kidnap or kill.
Regardless of the threat, it is very important to recognize that criminal and terrorist attacks do not materialize out of thin air. In fact, quite the opposite is true. Criminals and terrorists follow a process when planning their actions, and this process has several distinct steps. This process has traditionally been referred to as the “terrorist attack cycle,” but if one looks at the issue thoughtfully, it becomes apparent that the same steps apply to nearly all crimes. Of course, there will be more time between steps in a complex crime like a kidnapping or car bombing than there will be between steps in a simple crime such as purse-snatching or shoplifting, where the steps can be completed quite rapidly. Nevertheless, the same steps are usually followed.
People who practice situational awareness can often spot this planning process as it unfolds and then take appropriate steps to avoid the dangerous situation or prevent it from happening altogether. Because of this, situational awareness is one of the key building blocks of effective personal security — and when exercised by large numbers of people, it can also be an important facet of national security. Since situational awareness is so important, and because we discuss situational awareness so frequently in our analyses, we thought it would be helpful to discuss the subject in detail and provide a primer that can be used by people in all sorts of situations.
First and foremost, it needs to be noted that being aware of one’s surroundings and identifying potential threats and dangerous situations is more of a mindset than a hard skill. Because of this, situational awareness is not something that can be practiced only by highly trained government agents or specialized corporate security countersurveillance teams. Indeed, it can be exercised by anyone with the will and the discipline to do so.
An important element of the proper mindset is to first recognize that threats exist. Ignorance or denial of a threat — or completely tuning out one’s surroundings while in a public place — makes a person’s chances of quickly recognizing the threat and avoiding it slim to none. This is why apathy, denial and complacency can be (and often are) deadly. A second important element is understanding the need to take responsibility for one’s own security. The resources of any government are finite and the authorities simply cannot be everywhere and cannot stop every criminal action. The same principle applies to private security at businesses or other institutions, like places of worship. Therefore, people need to look out for themselves and their neighbors.
Another important facet of this mindset is learning to trust your “gut” or intuition. Many times a person’s subconscious can notice subtle signs of danger that the conscious mind has difficulty quantifying or articulating. Many people who are victimized frequently experience such feelings of danger prior to an incident, but choose to ignore them. Even a potentially threatening person not making an immediate move — or even if the person wanders off quickly after a moment of eye contact — does not mean there was no threat.
Levels of Awareness
People typically operate on five distinct levels of awareness. There are many ways to describe these levels (“Cooper’s colors,” for example, which is a system frequently used in law enforcement and military training), but perhaps the most effective way to illustrate the differences between the levels is to compare them to the different degrees of attention we practice while driving. For our purposes here we will refer to the five levels as “tuned out;” “relaxed awareness;” “focused awareness;” “high alert” and “comatose.”
The first level, tuned out, is like when you are driving in a very familiar environment or are engrossed in thought, a daydream, a song on the radio or even by the kids fighting in the backseat. Increasingly, cell phone calls and texting are also causing people to tune out while they drive. Have you ever gotten into the car and arrived somewhere without even really thinking about your drive there? If so, then you’ve experienced being tuned out.
The second level of awareness, relaxed awareness, is like defensive driving. This is a state in which you are relaxed but you are also watching the other cars on the road and are looking well ahead for potential road hazards. If another driver looks like he may not stop at the intersection ahead, you tap your brakes to slow your car in case he does not. Defensive driving does not make you weary, and you can drive this way for a long time if you have the discipline to keep yourself at this level, but it is very easy to slip into tuned-out mode. If you are practicing defensive driving you can still enjoy the trip, look at the scenery and listen to the radio, but you cannot allow yourself to get so engrossed in those distractions that they exclude everything else. You are relaxed and enjoying your drive, but you are still watching for road hazards, maintaining a safe following distance and keeping an eye on the behavior of the drivers around you.
The next level of awareness, focused awareness, is like driving in hazardous road conditions. You need to practice this level of awareness when you are driving on icy or slushy roads — or the roads infested with potholes and erratic drivers that exist in many third-world countries. When you are driving in such an environment, you need to keep two hands on the wheel at all times and have your attention totally focused on the road and the other drivers. You don’t dare take your eyes off the road or let your attention wander. There is no time for cell phone calls or other distractions. The level of concentration required for this type of driving makes it extremely tiring and stressful. A drive that you normally would not think twice about will totally exhaust you under these conditions because it demands your prolonged and total concentration.
The fourth level of awareness is high alert. This is the level that induces an adrenaline rush, a prayer and a gasp for air all at the same time — “Watch out! There’s a deer in the road! Hit the brakes!” This also happens when that car you are watching doesn’t stop at the stop sign and pulls out right in front of you. High alert can be scary, but at this level you are still able to function. You can hit your brakes and keep your car under control. In fact, the adrenalin rush you get at this stage can sometimes even aid your reflexes. But, the human body can tolerate only short periods of high alert before becoming physically and mentally exhausted.
The last level of awareness, comatose, is what happens when you literally freeze at the wheel and cannot respond to stimuli, either because you have fallen asleep, or, at the other end of the spectrum, because you are petrified from panic. It is this panic-induced paralysis that concerns us most in relation to situational awareness. The comatose level of awareness (or perhaps more accurately, lack of awareness) is where you go into shock, your brain ceases to process information and you simply cannot react to the reality of the situation. Many times when this happens, a person can go into denial, believing that “this can’t be happening to me,” or the person can feel as though he or she is observing, rather than actually participating in, the event. Often, the passage of time will seem to grind to a halt. Crime victims frequently report experiencing this sensation and being unable to act during an unfolding crime.
Finding the Right Level
Now that we’ve discussed the different levels of awareness, let’s focus on identifying what level is ideal at a given time. The body and mind both require rest, so we have to spend several hours each day at the comatose level while asleep. When we are sitting at our homes watching a movie or reading a book, it is perfectly fine to operate in the tuned-out mode. However, some people will attempt to maintain the tuned-out mode in decidedly inappropriate environments (e.g., when they are out on the street at night in a third-world barrio), or they will maintain a mindset wherein they deny that they can be victimized by criminals. “That couldn’t happen to me, so there’s no need to watch for it.” They are tuned out.
Some people are so tuned out as they go through life that they miss even blatant signs of pending criminal activity directed specifically at them. In 1992, an American executive living in the Philippines was kidnapped by a Marxist kidnapping gang in Manila known as the “Red Scorpion Group.” When the man was debriefed following his rescue, he described in detail how the kidnappers had blocked off his car in traffic and abducted him. Then, to the surprise of the debriefing team, he said that on the day before he was abducted, the same group of guys had attempted to kidnap him at the exact same location, at the very same time of day and driving the same vehicle. The attackers had failed to adequately box his car in, however, and his driver was able to pull around the blocking vehicle and proceed to the office.
Since the executive did not consider himself to be a kidnapping target, he had just assumed that the incident the day before his abduction was “just another close call in crazy Manila traffic.” The executive and his driver had both been tuned out. Unfortunately, the executive paid for this lack of situational awareness by having to withstand an extremely traumatic kidnapping, which included almost being killed in the dramatic Philippine National Police operation that rescued him.
If you are tuned out while you are driving and something happens — say, a child runs out into the road or a car stops quickly in front of you — you will not see the problem coming. This usually means that you either do not see the hazard in time to avoid it and you hit it, or you totally panic and cannot react to it — neither is good. These reactions (or lack of reaction) occur because it is very difficult to change mental states quickly, especially when the adjustment requires moving several steps, say, from tuned out to high alert. It is like trying to shift your car directly from first gear into fifth and it shudders and stalls. Many times, when people are forced to make this mental jump and they panic (and stall), they go into shock and will actually freeze and be unable to take any action — they go comatose. This happens not only when driving but also when a criminal catches someone totally unaware and unprepared. While training does help people move up and down the alertness continuum, it is difficult for even highly trained individuals to transition from tuned out to high alert. This is why police officers, federal agents and military personnel receive so much training on situational awareness.
It is critical to stress here that situational awareness does not mean being paranoid or obsessively concerned about your security. It does not mean living with the irrational expectation that there is a dangerous criminal lurking behind every bush. In fact, people simply cannot operate in a state of focused awareness for extended periods, and high alert can be maintained only for very brief periods before exhaustion sets in. The “flight or fight” response can be very helpful if it can be controlled. When it gets out of control, however, a constant stream of adrenaline and stress is simply not healthy for the body or the mind. When people are constantly paranoid, they become mentally and physically burned out. Not only is this dangerous to physical and mental health, but security also suffers because it is very hard to be aware of your surroundings when you are a complete basket case. Therefore, operating constantly in a state of high alert is not the answer, nor is operating for prolonged periods in a state of focused alert, which can also be overly demanding and completely enervating. This is the process that results in alert fatigue. The human body was simply not designed to operate under constant stress. People (even highly skilled operators) require time to rest and recover.
Because of this, the basic level of situational awareness that should be practiced most of the time is relaxed awareness, a state of mind that can be maintained indefinitely without all the stress and fatigue associated with focused awareness or high alert. Relaxed awareness is not tiring, and it allows you to enjoy life while rewarding you with an effective level of personal security. When you are in an area where there is potential danger (which, by definition, is almost anywhere), you should go through most of your day in a state of relaxed awareness. Then if you spot something out of the ordinary that could be a potential threat, you can “dial yourself up” to a state of focused awareness and take a careful look at that potential threat (and also look for others in the area).
If the potential threat proves innocuous, or is simply a false alarm, you can dial yourself back down into relaxed awareness and continue on your merry way. If, on the other hand, you look and determine that the potential threat is a probable threat, seeing it in advance allows you to take actions to avoid it. You may never need to elevate to high alert, since you have avoided the problem at an early stage. However, once you are in a state of focused awareness you are far better prepared to handle the jump to high alert if the threat does change from potential to actual — if the three guys lurking on the corner do start coming toward you and look as if they are reaching for weapons. The chances of you going comatose are far less if you jump from focused awareness to high alert than if you are caught by surprise and “forced” to go into high alert from tuned out. An illustration of this would be the difference between a car making a sudden stop in front of a person when the driver is practicing defensive driving, compared to a car that makes a sudden stop in front of a person when the driver is sending a text message.
Of course, if you know that you must go into an area that is very dangerous, you should dial yourself up to focused awareness when you are in that area. For example, if there is a specific section of highway where a lot of improvised explosive devices detonate and ambushes occur, or if there is a part of a city that is controlled (and patrolled) by criminal gangs — and you cannot avoid these danger areas for whatever reason — it would be prudent to heighten your level of awareness when you are in those areas. An increased level of awareness is also prudent when engaging in common or everyday tasks, such as visiting an ATM or walking to the car in a dark parking lot. The seemingly trivial nature of these common tasks can make it all too easy to go on “autopilot” and thus expose yourself to threats. When the time of potential danger has passed, you can then go back to a state of relaxed awareness.
This process also demonstrates the importance of being familiar with your environment and the dangers that are present there. Such awareness allows you to avoid many threats and to be on the alert when you must venture into a dangerous area.
Clearly, few of us are living in the type of intense threat environment currently found in places like Mogadishu, Juarez or Kandahar. Nonetheless, average citizens all over the world face many different kinds of threats on a daily basis — from common thieves and assailants to criminals and mentally disturbed individuals aiming to conduct violent acts to militants wanting to carry out large-scale attacks against subways and aircraft.
Many of the steps required to conduct these attacks must be accomplished in a manner that makes the actions visible to the potential victim and outside observers. It is at these junctures that people practicing situational awareness can detect these attack steps, avoid the danger and alert the authorities. When people practice situational awareness they not only can keep themselves safer but they can also help keep others safe. And when groups of people practice situational awareness together they can help keep their schools, houses of worship, workplaces and cities safe from danger.
And as we’ve discussed many times before, as the terrorist threat continues to devolve into one almost as diffuse as the criminal threat, ordinary citizens are also becoming an increasingly important national security resource.
A Primer on Situational Awareness is republished with permission of STRATFOR.
Est. 2010, Chicagoland, USA
Christopher E. Hill, Editor
Successor to Boom2Bust.com
"The Most Hated Blog On Wall Street"
(Memorial Day Weekend 2007-2010)
PLEASE RATE this blog HERE,
and PLEASE VOTE for the blog below:
Thank you very, very much!
- Chicago Suffers Deadliest Weekend So Far In 2016: 59 Shot, 17 Killed on
- Chicago Suffers Deadliest Weekend So Far In 2016: 59 Shot, 17 Killed on
- Is Pepper Spray Legal In Chicago, Illinois? on
- Latest On Proposed Niles, Illinois, Gun Shop, Range on
- Quote For The Week on
- Quote For The Week on
- Are Expandable Batons Legal In Chicago, Illinois? (2015 Update) on
- Is Pepper Spray Legal In Chicago, Illinois? on
- Latest On Proposed Niles, Illinois, Gun Shop, Range on
- Landline Phones Still Valuable In An Emergency on
- List Of Offshore Private Vaults UpdatedThe list of private, non-bank vaults outside the United States (offering safe deposit boxes/lockers at a minimum) located on this blog’s sister site- Offshore Private Vaults- has just been updated. Safe deposit facilities now open for business have been added under the following countries: -Hong Kong (Smart Secured Storage) -Liechtenstein (Liemeta AG, Triesen) -United Kingdom […]
- Related Reading: The Telegraph Looks At Latest Security Technology In Bank, Private VaultsI’m back after several days spent on matters related to the research business (focus: specialized asset protection) I’m in the process of rolling out. Despite the “spring break,” I compiled a good deal of material to blog about in the near future. Getting back into the saddle then… “How to rob a bank” This headline […]
- Next Degussa Numis Day To Take Place March 30, 31Rare numismatic coins often find their way into safe deposit boxes. And Degussa, a leading international player in the precious metals world which also offers safe deposit boxes (for customers) at branches in Germany, Singapore, Spain, and Switzerland, has posted information about the next Numis Day (first blogged about here) at their Geneva and Zurich […]
- Related Reading: Switzerland, Canada, United Kingdom Top U.S. News & World Report’s 2017 ‘Best Countries’ RankingsHere’s an annual survey one might consider when selecting an offshore safe deposit box location. U.S. News & World Report just released its “Best Countries” rankings for 2017. Kevin Drew reported Tuesday morning on the American media company’s website: Switzerland is viewed as the No. 1 overall country, according to a survey of more than […]
- Related Reading: London’s Sharps Pixley Spotlighted By The Spectator MagazineMonday evening I read an interesting article about London, England-based precious metals showroom/safe deposit box service Sharps Pixley (first blogged about here). Margareta Pagano wrote on the website of The Spectator (UK) this past weekend: When the going gets tough, the tough go shopping. And when the going is seriously tough- as it may be […]