detection points in the ...attack cycle _ stratfor

8/14/2019 Detection Points in the ...Attack Cycle _ Stratfor

http://slidepdf.com/reader/full/detection-points-in-the-attack-cycle-stratfor 1/4

Coming Monday: The first part of a four-part series on t ransport infrastructure development in East Africa NOV 8 !"#$ % ##:&$ 'MT

(etection )oints in the Terrorist Attac* CycleSecurity Weekly T+,.(A/ MAC+ # !"#! - "0:#$ d Print 1 Te2t .i3e 4

By Scott Stewart

5ast 6ee*7s .ecurity ee*ly

discussed the fact that terrorism is

a tactic used 9y many dif ferent

classes of actors and that 6hile

the perpetrators and tactics of

terrorism may change in response

to shifts in larger geopolitical

cycles these changes 6ill never

result in the end of terrorism .ince that analysis 6as 6ritten there have 9een ;ihadist-related

attac*s in Afghanistan Nigeria /emen and )a*istan an assassination attempt against the

president of A9*ha3ia and a failed timed-incendiary attac* against the Athens su96ay <The latter

incident 6hich militant anarchists claimed reinforces that ;ihadists are not the only ones 6ho

practice terrorism=

>ut 6hile terrorism is a continuing concern it can 9e understood and measures can 9e ta*en to

th6art terrorist plots and mitigate the effects of attac*s )erhaps the most important and

fundamental point to understand a9out terrorism is that attac*s do not appear out of no6here

?ndividuals planning a terrorist attac* follo6 a discerni9le cycle -- and that cycle and the 9ehaviorsassociated 6ith it can 9e o9served if they are 9eing loo*ed for e refer to these points 6here

terrorism-related 9ehavior can 9e most readily o9served as vulnera9ilities in the terrorist attac*

cycle

The Attac* Cycle

Many different actors can commit terrorist attac*s including sophisticated transnational terrorist

groups li*e al @aeda regional militant groups li*e ?ndia7s Maoist Na2alites small independent cells

li*e the anarchists in 'reece and lone 6olves li*e Oslo attac*er Anders >reivi* There can 9e great

variance in attac* motives and in the time and process reBuired to radicali3e these different actors

to the point that they decide to conduct a terrorist attac* >ut once any of these actors decides to

launch an attac* there is remar*a9le similarity in the planning process

irst there is the process of selecting or identifying a target Often an actor 6ill come up 6ith a list

of potential targets and then select one to focus on ?n some cases the actor has preselected a

method of attac* such as a vehicle-9orne improvised e2plosive device and 6ants to find a target

that 6ould 9e vulnera9le to that specific type of attac* ?n other cases the actor 6ill pic* a target

and then devise a method of attac* 9ased on that target7s characteristics and vulnera9ilities

.imply put the e2ecution of these steps can 9e some6hat fluid some degree of planning or

preparation can come 9ef ore target selection and sometimes target selection 6ill 9e altered during

the planning process The time reBuired to e2ecute these steps can also vary considera9ly .ome

attac*s can 9e planned and e2ecuted 6ithin hours or days 6hile more comple2 plans such as

those used in the D## or Mum9ai attac*s may ta*e months or even years to complete

reBuently those planning an attac* 6ill conduct detailed surveillance of potential targets todetermine 6hat security measures are in place around the target and to gauge 6hether they have

the a9ility to successfully attac* it ?f the target is too difficult to attac* -- commonly *no6n as a hard

target -- the attac* planners 6ill typically move on to their ne2t target 6hich may prove easier to

attac* <hen they do continue 6ith attac*s against targets 6hose security measures e2ceed the

attac*ers7 capa9ilities those attac*s fail= e refer to this stage as preoperational surveillance

F Vie6 ull Timeline

Terrorist Attac* Cycle

Timeline

'et our EE 6ee*ly?ntell igence eports

Enter /our Email Address

'ET E)OT.G

Hoin over $&"""" readers on our EE intel reports list

NEE I

MA #J !"#!

A )ractical 'uide to .ituat ional A6areness

MA K !"#!

(etect ing Terrorist .urveillance

MAR 1, 2012

(etection )oints in the TerroristAttac* Cycle

(EC #$ !"##

(ispatch: 5one olf At tac* in >elgium

.E) !! !"##

Cutting Through the 5one-olf +ype

.E) #0 !"##

Agenda: ith 'eorge riedman on the

Tali9an .trategy

.E) #$ !"##

(ispatch: Tactical 5oo* at the Em9assy Attac*in La9ul

H,5 !8 !"##

Nor6ay: 5essons from a .uccessful 5one olf

Attac*er

MA/ !& !"##

A9ove the Tearline: ?nside a )rotective

Agent7s Mind

MA/ #! !"##

Al @aeda7s 5eadership in /emen

A) K !"##

+o6 to Tell if /our Neigh9or is a >om9ma*er

MA $ !"##

(ispatch: ,. Airmen .hot in 'ermany

O5(E

674 92 0googleplus 3112 317



6hich means surveillance that is conducted 9efore the operation is fully planned

After the target has 9een selected a second round of surveillance is conducted This round 6ill 9e

far more detailed and is intended to provide all the details necessary for planning the attac* or

e2ample if the attac* is 9eing planned against a static facility this round of surveillance 6ill

generally try to o9tain a detailed description of the target7s physical security features and security

force procedures ?t 6ill also focus on esta9lishing a 9aseline understanding of the activity that can

9e e2pected around the facility at the time of day the attac* is anticipated

?f the target of the attac* is an individual the individual7s residence off ice and other places the

individual freBuents 6ill 9e surveilled Additionally the surveillance team 6ill loo* for patterns and

routines that the target follo6s 9et6een these *no6n locations The team 6ill often analy3e the

target7s usual routes loo*ing for cho*e points or places the target must pass to get from one point

to another ?f the surveillance team identifies a cho*e point that the target passes through

predicta9ly it 6ill then try to determine 6hether that point 6ill allo6 the attac*ers to deploy in secret

permit them to spot and control the target and provide them 6ith good escape routes ?f it does

this point 6ill freBuently 9e chosen as the attac* site

?n the case of large organi3ations different groups or individuals may conduct different phases of

the surveillance Many organi3ations use speciali3ed operatives for surveillance though the

operational planner 6ill often attempt to get eyes on the target to help 6ith the planning process

or instance it is *no6n from court testimony in the Mum9ai case that (avid +eadley made five

e2tended trips to Mum9ai as those attac*s 6ere 9eing planned The repeated trips 6ere reBuired9ecause the operational commanders in )a*istan considered ?ndia a hostile environment and the

operational planners could not go there to conduct the surveillance themselves As a result

+eadley 6as sent to o9serve and report on specific things as planning for the attac*s progressed

(uring the planning phase the personnel to 9e used in the attac*s are identified and trained in any

special s*ills they may reBuire for the mission including languages mar*smanship hand-to-hand

com9at small-9oat handling or land navigation To protect operational security the operatives may

not 9e 9riefed in any great detail a9out the target of their operation until they are very close to 9eing

deployed

Many times the planning phase 6ill end 6ith a dry run as the preparation did for the D## attac*s

6hen some of the hi;ac*ers too* their assigned flights in August !""# 8hile conducting a dry run

the attac*ers 6ill generally 9e unarmed to ensure they do not needlessly 9ring la6 enforcement

attention to themselves

.ometimes an attac*er 6ill have acBuired 6eapons for the attac* 9efore the planning phase Other

times the concept of the operation 6ill 9e constrained 9y the 6eapons and money availa9le >ut

Buite freBuently the 6eapons for the attac* 6ill 9e acBuired during the planning phase after the

target has 9een selected and the means of attac* have 9een esta9lished

Once planning training and 6eapons acBuisition are complete the attac* team can 9e deployed

The attac* team freBuently 6ill again conduct surveillance of the target especially if the target is

mo9ile and the attac* team is deployed and 6aiting at a predetermined attac* site

?f it 6as properly planned an attac* is very li*ely to succeed once it has moved to the operationalphase .ometimes attac*s do fail 9ecause of mista*es or 9ad luc* 9ut 9y and large there is no

6ay to stop an attac* once it has 9een set in motion

At the attac*7s conclusion the attac*ers 6ill see* to escape the scene The e2ception is suicide

attac*s or 6hen li*e >reivi* the attac*er intends to 9e captured as part of the media e2ploitation

phase the final step in the cycle

egardless of 6hether the attac* is a suicide attac* against a church in Nigeria or a timed-

incendiary attac* against a su96ay in Athens the same attac* cycle is follo6ed 8ith an eye

to6ard averting future attac*s a thoughtful o9server can use the attac* cycle model to understand

ho6 an attac* 6as planned and e2ecuted

Vulnera9ilities

8hile plots are occasionally th6arted at the last second f or the most part la6 enforcement and

security personnel must detect and interdict the plot 9efore it gets to the attac* phase to have any

chance of stopping it Once the 9ullets fly or the e2plosive device is detonated there is little security

forces can do 9ut initiate their immediate action drills in an effort to reduce the 9ody count This

,. and ?ranian eali t ies

>alancing .hia and .unni

adicalisms

The ?slamic evolut ionary

'uard Corps )art #: An

,nconventional Milit ary

(etecting Terror ist

.urveillance

The Terrorist Attac* Cycle: Operational

)lanning

The Terrorist Attac* Cycle: (eployment and

Att ac*

W e will never sell or shar e your email addr ess or

infor mation with any one.

E(?TO7. C+O?CE

E5ATE( CONTENT

E5ATE( .?T,AT?ON E)OT.

?ran: Ne6 Cy9er Attac* (etected

H,5 #K !"#! % #":&$ 'MT

Afghanistan: Camp >astion Attac*ed

.E) #J !"#! % #0:"J 'MT

?srael : ?nvestigations )oint To emale Attac*er

NOV !# !"#! % "&:&0 'MT



means that an emphasis must 9e placed on identif ying attac*ers earlier in the process 6ell 9efore

they are in a position to stri*e

,nless security forces have a source inside the group that is planning the attac* or manage to

intercept the group7s communications the only 6ay to identify attac* planners is 9y noting their

actions This is especially true of a lone 6olf attac* 6here no e2ternal communication occurs The

earliest point in the attac* cycle that the attac*ers can 9e identified 9y their actions is during the

preoperational surveillance reBuired for target identification

There is a 6idely held conception that terrorist surveillance is generally sophisticated and almost

invisi9le 9ut 6hen vie6ed in hindsight it is freBuently discovered that individuals 6ho conduct

terrorist surveillance tend to 9e Buite sloppy and even amateurish in their surveillance tradecraft

e 6ill discuss 6hat 9ad surveillance loo*s li*e and ho6 to recogni3e it in more detail ne2t 6ee*

9ut for no6 it is sufficient to say that poor surveillance tradecraft is a signif icant vulnera9ility in the

terrorist attac* cycle

As noted a9ove additional surveillance is often conducted at later stages of the attac* cycle such

as in the planning stage and even sometimes in the attac* stage as the attac*ers trac* the target

from a *no6n location to the attac* site Each instance of surveillance provides an additional

opportunity for the assailants to 9e identified and the attac* to 9e prevented

(uring the planning phase and as the operatives prepare to deploy communication 9et6een and

movement of group mem9ers often increases Additionally group mem9ers may engage in outsidetraining that can attract attention such as playing paint9all visiting the firing range or as 6as the

case 6ith the D## pilots attending flight schools This increase in activity 6hich also might include

money transfers leaves signs that could tip off the authorities

Another significant vulnera9ility during the attac* cycle is 6eapons acBuisition This vulnera9ility is

especially pronounced 6hen dealing 6ith ine2perienced grassroots operatives 6ho tend to aspire

to conduct spectacular attac*s that are far 9eyond their capa9ilities or e2ample they may decide

they 6ant to conduct a 9om9ing attac* even though they do not *no6 ho6 to ma*e improvised

e2plosive devices ?t is also not uncommon for such individuals to try to acBuire .tinger anti-aircraft

missiles automatic firearms or hand grenades hen conf ronted 9y this gap 9et6een their

capa9ility and their aspirations grassroots operatives 6ill often reach out to someone f or help 6ith

their attac* instead of settling on an attac* that is 6ithin their a9ility ?ncreasingly the people such

6ould-9e attac*ers are encountering 6hen they reach out are police or domestic security agency

informants

As far 9ac* as !"#" ;ihadist leaders such as Nasir al-ahayshi of al @aeda in the Ara9ian

)eninsula recogni3ed this pro9lem and 9egan to encourage grassroots ;ihadists to focus on

conducting simple attac*s against soft targets Nevertheless grassroots ;ihadists are consistently

dra6n to6ard spectacular attac*s as seen in the e9 #K arrest near the ,. Capitol of a

Moroccan man 6ho thought his handler 6ho 6as in fact an >? informant had eBuipped him for a

suicide attac* ,nli*e most ;ihadists other types of grassroots militants such as anarchists are far

more comf orta9le conducting simple attac*s 6ith readily availa9le items

)ersonality traits and psychological profiles aside anyone desiring to plan a terrorist attac* must

follo6 the attac* planning cycle 6hich at certain stages 6ill necessarily open them up to detection

Clic* here for The Myth of the End of Terrorism

Clic* here for (etecting Terrorist .urveillance

eprinting or repu9lication of this report on 6e9sites is authori3ed 9y prominently displaying the follo6ing sentence

including the hyperlin* to .tratfor at the 9eginning or end of the report

(etection )oints in the Terrorist Attac* Cycle is repu9lished 6ith permission of .tratfor

Simply copy and paste this code:

a hrefPhttp:666stratforcom6ee*lydetection-points-terrorist-attac*-cycleQ(etection )oints in theTerrorist Attac* CycleaQ is repu9l ished 6ith permis sion of .tratfor

.end us your thoughts on this repor t

674 92 0googleplus 3112 317



.,>.C?>E 5O'?N

hat is .tratforR

.tratfor provides glo9al a6areness and guidance to

individuals governments and 9usinesses around the 6orld:

e use a uniBue intel-9ased approach to analy3e 6orld

affairs:

Copyright S !"#$ .tratfor % !!# est 0th .treet .uite J"" - Austin T K8K"# ,.A

detection points in the ...attack cycle _ stratfor

Documents