the attacks in mumbai

The Attacks in Mumbai: A Scenario Reconstruction NC2IF Center, September 2009

of 22

The Attacks in Mumbai A Scenario Reconstruction for the Purposes of Simulation

Prepared by: Donald R. Shemanski David J. Saab Michelle L. Young Jeff Rimland Quinn Armstrong Christian Blandford Eugene Bonacci Eileen Chen

NC2IF Center College of Information Science and Technology The Pennsylvania State University University Park, PA 16802 September 2009


of 22

The Attacks in Mumbai A Scenario Reconstruction for the Purposes of Simulation

Executive Summary The terrorist attacks in Mumbai began at approximately 21:20 IST (Indian Standard Time) on November 26, 2008, taking Indian authorities completely by surprise. The attacks targeted several locations simultaneously—the Chhatrapati Shivaji railway station, the Cama and Albless Hospital, the Nariman House business and residential complex, Café Leopold and Oberoi-Trident Hotel, and the Taj Mahal Palace Hotel. There were five teams of attackers, each team consisting of two individuals. The terrorists were able to inflict considerable damage to property and kill numerous individuals before being killed (or, in the case of one terrorist, captured) by the Indian military, which brought the attack to an end. In fact, the terrorists held off the Indian authorities for approximately 60 hours, during which 164 persons were killed (of whom, 26 were foreigners) and 308 were injured. The attacks were conducted by members of a group known as LeT (Lashkar e Toiba), which is considered to be one of the best organized terrorist groups. LeT is believed to be based in Muridke, Pakistan and led by Hafiz Muhammad Saeed, a former Islamic Studies professor. LeT also engages in charitable activities through a front organization, Jamaat-ud-Dawah (JUD), which, for example, provided humanitarian relief to Kashmiri earthquake victims in 2005. Experts believe LeT receives funding from the Pakistani expatriate community in the Persian Gulf and Europe, as well as NGOs, and Pakistani and Kashmiri businesses. There are also credible reports linking the LeT to Pakistan’s Inter-Services Intelligence (ISI) and to the government of Saudi Arabia.

LeT recruits through a variety of strategies—from promises of monthly salaries, to targeted recruitment of educated and computer literate youth in India, to targeted disaffected youth in a variety of locales. Recruits are indoctrinated into LeT’s militant ideology, where literature and video of inflammatory speeches encouraging the taking of revenge for atrocities committed against Muslims is a standard practice after initial recruitment. Recruits then take part in a six-month long boot camp to train in basic military skills, followed by four to five months of advanced training in urban combat, guerilla tactics, sabotage and assassination. The most highly skilled recruits engage in a third phase of training that includes perpetrating attacks, advanced sabotage techniques, computer applications and operative communication.

The attack teams for the Mumbai attacks gathered in Azizabad, Pakistan on Saturday, 22 November 2008, and traveled to the port city of Karachi, where they set sail in a small boat. They boarded an LeT ship where they were given backpacks containing weapons for their attack mission. They subsequently hijacked an Indian fishing trawler in order to reach Mumbai under an Indian flag. Having seized the vessel, the terrorist teams killed all the persons on the fishing trawler, but kept the captain alive until they were about to land in Mumbai (at which time he was also killed). Upon landfall, each of the five teams took a taxi directly to their assigned locations, and within an hour the attacks were underway.

Only one of the attackers survived, having been taken into custody as his team was moving from their first attack location at the railway station to the Taj hotel. During the entire operation, the attackers were in constant communication with their co-conspirators in Pakistan through a virtual phone number that would route the calls to the appropriate handlers with a direct inward dialing system. Instructional and motivational inputs were being provided with


of 22

alarming regularity, with the attackers and handlers briefing each other in real time with respect to developments disclosed via media broadcasts and ongoing operations.

The attackers engage in gun battles with law enforcement and the Indian army within hours of the initiation of the attacks. An integral part of the terrorists' attack strategy is to set fire to a number of rooms at each hotel location. They kill non-Muslim hostages and seek out VIPs who they believe might be at their respective locations. Small groups of potential hostages manage to escape at both the Oberoi-Trident and Taj Mahal hotels during the first twelve hours of the attacks.

Nearly twenty-four hours after the initiation of attacks, Pakistani handlers direct attackers at the Nariman House, where many Israeli and Jewish hostages are being held, to keep two magazines and three grenades but to expend the rest of their ammunition. They are also advised to kill the hostages if they no longer serve as deterrents to the Indian authorites’ counter-operations. LeT plans for the attacks to conclude in another twelve hours, on the morning of Friday, 28 November 2008. Indian commandos drop from helicopters early Friday morning and end the attack at Nariman House by noon, freeing any remaining hostages after killing the attack team.

At the Taj hotel, the Indian army begins conducting room-by-room searches about thirteen hours after the initiation of the attacks, but the battle continues for the next 22 hours. Attackers there also set fire to a number of rooms on the lower floors and take hostages. The Taj hotel is the last location to be secured by the Indian authorities, with the killing of the attack team nearly 72 hours after the initiation of attacks.


of 22

The Purpose and Structure of this Document This document is an aggregation of information from many sources about the terrorist attack in Mumbai in November 2008. This document is intended to reconstruct the Mumbai attacks and present it as a chronological narrative. It is also intended to serve as the foundational reference for simulating the attacks within the context of the Extreme Events Lab at NC2IF at the College of Information Sciences and Technology at The Pennsylvania State University, University Park campus. The reconstruction of events leading to and during the attack are presented in a stark, factual format. The scenario reconstruction presented here allows for further development, embellishment and fictionalization of the Mumbai attacks. The authors expect that researchers using this document as the basis of a scenario simulation will include their own creative and variable content while constructing their research simulation.

An executive summary is presented as the first part of this document, followed by this section explaining this document’s purpose and structure. The scenario reconstruction begins with some background information about the terrorist group responsible for the Mumbai attacks and the names of the individuals and their handlers who carried out the attacks. Also included in the background section is general information with respect to how the terrorist group recruits and trains its members and specific information with respect to their communication methodology using mobile and satellite phones.

Following the background information, the reader will find a chronological recount of the journey the attackers took from Azizabad, Pakistan to each team of attackers’ assigned attack location. The chronological series of events that occurred during the attacks, including several intercepted phone conversations, specific actions taken by the attackers, and the actions of Indian authorities in response, are detailed in the next section.

Included as appendices are two narratives. The first narrative concerns weapons procurement, which is generic in nature and can be used as a supplement to any simulation reconstruction. The second appendix concerns Pakistan’s Inter-Service Intelligence (ISI) and their alleged relationships with militant groups throughout the region, including the one responsible for the Mumbai attacks, the Lashkar-e-Taiba (LeT).

This document is organized as follows:

The Attacks in Mumbai ...................................................................................................... 2 Executive Summary ...................................................................................................................................................2 The Structure of this Document ...........................................................................................................................4

Background ......................................................................................................................... 5 Who is Lashkar-e-Taiba? .........................................................................................................................................5 Who carried out the attacks? .................................................................................................................................5 Recruitment and Training.......................................................................................................................................6 Financial Support System........................................................................................................................................7 Communication Methodology ...............................................................................................................................9

Chronological Recount of Transportation Event to Mumbai ........................................... 9

Chronological Recount of Attack Events in Mumbai ...................................................... 10

Sources.............................................................................................................................. 16

Appendix A: Weapons Procurement ............................................................................... 17


of 22

Appendix B: Pakistan’s Inter-Service Intelligence........................................................... 19

Background This section of the document includes background information with respect to the identity, recruitment, training, and finances of Lashkar-e-Taiba (LeT), the Pakistani group responsible for the Mumbai attacks. The first part describes who LeT is and where they operate. The second part of this section situates LeT as a terrorist group and describes their general recruiting and training practices. The third part of this section offers a general schema of how Islamic extremist groups finance their operations and launder their monies using the traditional Islamic money-lending system of hawalas.

Who is Lashkar-e-Taiba? “The Indian government has often accused the group Lashkar-e-Taiba (LeT) of terrorist attacks, including the November 2008 deadly assault in Mumbai that killed nearly two hundred people and injured more than three hundred. LeT is among several banned Pakistani militant groups that experts say received backing from Pakistan's Inter-Service Intelligence agency (ISI) to fight in Indian-administered Kashmir. Analysts say the group continues to operate freely inside Pakistan under a different name and has now become a global terrorist organization.”1

The group has its headquarters in Muridke, near Lahore, in Pakistan. Experts say it is headed by Hafiz Muhammad Saeed, a former Islamic-studies professor. “According to most sources, the group collects donations from the Pakistani expatriate community in the Persian Gulf and Britain as well as from Islamic NGOs, and Pakistani and Kashmiri businessmen. Experts say it also receives funding from the ISI and elements within the government of Saudi Arabia. LeT also coordinates its charitable activities through its front organization Jamaat-ud-Dawah (JUD), which spearheaded humanitarian relief to the victims of the 2005 earthquake in Kashmir.”2

Who carried out the attacks? There were ten attackers assigned to the Mumbai mission. They were grouped into five teams of two, each having a specific location to attack as part of their mission. Table 1 lists each teams’ members, the locations to which they were assigned, the names of their Pakistani handlers, and each team’s designation (T1-T5) for the purposes of this document.

1 http://www.cfr.org/publication/17882/

2 http://www.cfr.org/publication/17882/


of 22

Table 1. Attacker Teams, Locations, and Handlers3

Team Designation Team Members Location Pakistani Handlers

Team 1 (T1) 1. Ismail

2. Qasab

Chhatrapati Shivaji Railway Station & Cama and Albless Hospital

Team 2 (T2) 3. Bada Abdul Rehman

4. Abu Ali

Taj Mahal Palace Hotel Wassi

Team 3 (T3) 5. Shoeb

6. Abu Umer

Taj Mahal Palace Hotel Wassi

Team 4 (T4) 7. Chhota Abdul Rehman (aka Saquib)

8. Fahadulla (aka Fahad)

Oberoi and Trident Hotel

Wassi

Zarar

Kafa

Team 5 (T5) 9. Abu Aksha (aka Imran Babbar, Imran, Kasha)

10. Abu Umar

Nariman House Wassi

Zarar

Jundal

Buzurg

Major General

Recruitment and Training LeT reportedly has over 2,200 recruitment offices across the country of Pakistan, and extends to other areas in the region, including Bangladesh, Nepal, Pakistan, the Gulf States and Saudi Arabia. Muhammad Omar Madni, a detained leader of LeT, was en route to recruit youth in these areas and send them for training in Pakistan when caught. He also targeted educated and computer literate youths from the major cities of India. Another recruitment strategy, employed by LeT divisional commander, Saiful Rehman, is to promise a monthly salary to youths for three months. Local recruiting teams also identify youth who can be lured successfully into anti-national activities in Pakistan. These local recruiting teams often travel with assigned militarily-trained commanders for the locale and endeavor to motivate youth into crossing the border and joining LeT.

Willing potential terrorist recruits typically are handed over to a LeT commander such as Shabir Atoo (alias Yasir) for the journey across the border into Indian-held Kashmir. Terrorist recruits are first indoctrinated into a militant ideology before being taken to LeT camps spread across Pakistan and the part of Kashmir occupied by Pakistan. The indoctrination phase of recruitment includes studying literature and watching videos containing inflammatory speeches of militant leaders who exhort them to seek revenge for the atrocities being committed against the Muslims.

The military operations training has three sub-phases:

3 Reconstructed through telephone transcripts.


of 22

1. In the first sub-phase, the recruits take part in a six-month long boot camp where they are trained in basic military skills, including the use of firearms.

2. The second sub-phase lasts 4-5 months, during which the trainees undergo advanced training which focuses on urban combat, guerilla warfare tactics, sabotage operations, and assassination.

3. The best operatives move on to the third sub-phase, which includes training in perpetrating firearms attacks, using advanced sabotage techniques, computer applications, and operative communication.

LeT also provides training to both militant cadres and the Ulema (religious scholars). Militant cadres are given two months training in the handling of weapons that provides a 21-day training program called Daura-e-Aam and three months of specialized training program called Daura-e-Khas. The Ulema are provided with a 42-days course. Young recruits are made to go through a refresher course called Bait-ur-Rizwan. The organization’s operatives undergo military training formerly carried out mostly by the Inter-Services Intelligence (ISI). It appears that retired Pakistani military officers are still involved in training LeT’s operatives.

Financial Support System Terrorist groups such as LeT need funding, but they also need to be able to hide their financial transactions from anti-terrorist government agencies and groups who wish to track them. To minimize a financial paper trail that would allow others to track their social and financial networks, many of the Islamic-identified extremist groups use a traditional system of financial networks found throughout the Middle East, North and Northeast Africa, and South Asia, that rely upon an honor system rather than promissory notes like modern banking systems. This system is known as Hawala, has its origins in Islamic law, and is an informal value transfer system based on the performance and honor of a huge network of money brokers (hawaladars).

The use of hawala by LeT and other groups can be broken into three basic steps: placement, layering, and integration. Below is a description of how these steps occur in sequence through the actions of individuals, couriers, and hawaladars. Figure 1 charts the possible flows of money described in the narrative below.

Step 1 (Placement): The placement steps are all denoted by the color orange. Charity 1 and Individual 1 are given directions (red arrows) by the financial facilitator. The Charity will then send money via courier to Hawaladar 1. This limits the exposure to the financial facilitator. Individual 1 sends his money to the financial facilitator and the facilitator routes to hawaladar 2. Hawaladar 1 and 2 begin the process of Layering.

Step 2 (Layering): The layering steps are denoted by the light blue boxes. Hawaladar 1 sends his money to hawaladar 3 via wire transfer such as Western Union. This creates a more difficult paper trail to follow. Hawaladar 3 will then deposit the money into his/hers stores (hawaladars usually operate as a side business in stores) bank account. A courier will then withdraw the money and have hawaladar 8 transfers to hawaladar 9 via under invoicing (this means that 8 will send 9 a shipment of goods and will charge below cost in order to account for the hawala transaction). All of these steps create a very difficult paper trail to follow and the money that has gone through this path is now ready to be integrated. Hawaladar 2 splits the money and sends it to 4 and 5. Hawaladar 2 and 4’s connection is the most difficult to track because nothing moves at all because the deal is settling a debt between 2 and 4. Hawaladar 4 and 5 then send the money via courier to the terror group’s leadership.


of 22

Step 3 (Integration): The integration steps are denoted by black. When hawaladar 9 sends the money via courier to operative 1. The different paths from the terror group leadership are the three primary examples of the way money can be transferred from the leadership to the operatives. Hawaladar 6 and 7 offer the most discrete way to transfer money and is difficult to track. The banking way was popular in pre 9/11 but with the increased efforts in finding terrorist funding in the formal financial system this way is not used as often anymore. The third method is the most secure and discrete and that is the use of courier to move the money. No paper trail is left.

Figure 1. Flow of Money through Hawala Network


of 22

Communication Methodology “During the entire operation, the terrorists were in constant communication with the co-conspirators in Pakistan through mobile numbers: (1) 9819464530, (2) 9820704561 and (3) 9910719424. Real-time instructional and motivational inputs were being provided with alarming regularity to the terrorists at Nariman House, Oberoi and Trident Hotel and the Taj Mahal Hotel. Both the terrorists and the co-conspirators were in communication with each other and briefing each other in real time as regards the developments during the ongoing operations. A total number of 41 calls (8834 seconds) were made from Taj Mahal Hotel, 62 calls (15,705 seconds) were made from Oberoi/Trident and 181 calls (35, 172 seconds) were made from Nariman House.”4

The terrorists had Callphonex (a communication solutions company located in the US) set up one virtual number based in the US and 5 Direct Inward Dialing (DID) numbers. The base platforms used by the handlers were VOIP phones. The DID served to connect the VOIP phones to the standard phone network. The virtual number was the number that the terrorists could call and then it would route the call to the appropriate handler on one of the five DID extensions.

The Callphonex services were initially set up by an individual who claimed to go by the name of Kharak Singh and also claimed to be from India. The account was paid for by a western union wire from a Javaid Iqbal on November 25, 2008. On the Form IV that was provided, Javaid used a Pakistani passport number. Apparently Callphonex asked why the payment was coming from Pakistan when initially Kharak Singh claimed he was from India. The company received no reply.

Chronological Recount of Transportation Event to Mumbai

Saturday, 22 November 2008, 04:15-08:00 IST (Indian Standard Time) “The attack teams led by Zaki-ur-Rehman (alias Chacha and Kafa) left from Azizabad, Karachi to the sea shore at 0415”5 The terrorists started in a small boat leaving from Karachi at approximately 0800 IST. “After boarding a trawler and traveling for 22 to 25 nautical miles, the attack team boarded a bigger trawler. After journeying for 1 hour, the team boarded Al-Husseini, a LeT ship, in the deep sea.”6 According to the captured terrorist, the Al-Husseini belonged to Zaki-ur-Rehman Lakhvi, chief commander of LeT. While boarding the said ship, each attacker was given a backpack containing “8 grenades, one AK-47 rifle, 200 cartridges, 2 magazines and one cell phone for

communication.” 7

Sunday, 23 November 2008, 15:00-Wednesday, 26 November 2008 16:00 IST (Indian Standard Time) The Al-Huseini navigated into Indian territorial waters where the LeT attackers hijacked the MV Kuber, an Indian fishing trawler. Except for the captain, four Indian seamen were transported to the Al-Huseini ship and were murdered. The captain (Amar Singh Solanki), held at gunpoint, navigated the trawler to Mumbai, a three-day journey (around 550 nautical miles).

4 http://www.hindu.com/nic/mumbai-terror-attack-final-form.pdf

5 http://www.ucm.es/info/unisci/revistas/UNISCI%20DP%2019%20%20ROHAN%20MUMBAI.pdf 6 http://www.ucm.es/info/unisci/revistas/UNISCI%20DP%2019%20%20ROHAN%20MUMBAI.pdf

7 http://www.ucm.es/info/unisci/revistas/UNISCI%20DP%2019%20%20ROHAN%20MUMBAI.pdf

http://www.hindu.com/nic/mumbai-terror-attack-final-form.pdf

http://www.ucm.es/info/unisci/revistas/UNISCI%20DP%2019%20%20ROHAN%20MUMBAI.pdf




of 22

The terrorists performed watch duties while aboard the MV Kuber. The MV Kuber reached a point around four nautical miles off Mumbai at 1600 hrs on November 26, 2008. The operational commander, Ismail, and another team member, Fahadulla, took the captain below the deck and killed him.

Communication about the Sea Journey to Mumbai (27 November 2008) Source: LeT, Pakistan Receiver: T2 at Taj Mahal Hotel, Mumbai

0126 IST: Status Update As the LeT did not wish to leave behind any traces to Pakistan, the LeT pre-instructed the attackers to throw the satellite phone into the sea and to sink the vessel after killing the seaman. When a LeT caller from Pakistan checked with the team at the Taj Mahal Hotel at 01:26 IST on 27 November 2008 the intercepted call revealed the following conversation: “What did you do to the dead body?” The attacker said, “Left it behind.” When the caller asked, “Did you not open the locks for the water below?” The attacker responded,

“No, they didn’t open the locks. We left it like that because of being in hurry. We made a huge mistake.” When questioned “What big mistake?” the attackers admitted their operational mistake to their handlers, “When we were getting into that boat, the waves were quite high.

Another boat came. Everyone raised an alarm that the Navy had come. Everyone jumped quickly. In this confusion, the satellite phone of Ismail got left behind.”

“Later the Indian authorities recovered the body and the boat, especially the phone uncovering the links to Pakistan.”8 “The Satellite phone yielded several numbers that linked the terrorist to top people in Pakistan that belong to LeT. One of the numbers is that of a Thurya satellite phone and is (+88 216) 44 44 7049. This belongs to Abu Al Qama, a senior known member of LeT.”9

Wednesday, 26 November 2008 16:00-20:30 IST (Indian Standard Time) After reaching Mumbai in the trawler, the attack teams boarded a floatable dinghy and reached Budwar Park Jetty at approximately 20:30 IST.

Chronological Recount of Attack Events in Mumbai

Wednesday, 26 November 2008, 15:00-21:00 IST (Indian Standard Time) At approximately 20:30 IST, the LeT attackers arrived in Mumbai by sea. A chronology of their sea voyage was recounted in the previous section. Each of the five teams took a taxi directly to their assigned locations.

Wednesday, 26 November 2008, 21:20-22:00 IST (Indian Standard Time) Based on several news sources, the Mumbai Attacks began at the Chhatrapati Shivaji railway station. Two gunmen (T1) were seen firing aimlessly at the large crowds, killing many. The Mumbai police assumed the violence to be the actions of rival gangs rather than those of terrorist attackers.

T1 had arrived at the railway station by taxi. They “went to the common toilet, took out the weapons from our sacks, loaded them, came out of toilet and started firing indiscriminately towards the passengers. Suddenly one police officer in uniform came towards us and opened fire. In retaliation, we threw hand

8 http://www.ucm.es/info/unisci/revistas/UNISCI%20DP%2019%20%20ROHAN%20MUMBAI.pdf

9 http://www.fas.org/irp/eprint/mumbai.pdf


http://www.fas.org/irp/eprint/mumbai.pdf


of 22

grenades towards him and also opened fire towards him. Then we went inside the railway station threatening the commuters and randomly firing at them. Then we came out of the railway station and started searching for a building with rooftop. But we did not find a suitable building. Therefore, we entered a lane. Then we entered a building and went upstairs. On 3rd or 4th floor we searched for hostages but we found that the said building was a hospital and not a residential building. Therefore we started coming down.”10

At approximately the same time, more gunmen were seen raiding the Cama and Albless Hospital. Fortunately, one gunman was captured. It turns out that this was T1, who had left the railway station in search of a residential building rooftop to continue their assault. Realizing that it was a hospital rather than residential building, T1 made the decision to leave the building. When T1 reached ground level, “we suddenly saw one police vehicle passing in front of

us. Therefore, we took shelter behind a bush. Another vehicle passed in front of us and stopped at some distance. One police officer got down from the said vehicle and started firing at us. One bullet hit my hand and my AK-47 dropped down. I bent to pick it up when second bullet hit me on the same hand. I got injured. Ismail opened fire at the officers who were in said vehicle. They got injured and firing from their side stopped.”11

“Unknown to the terrorists, their firing killed Mumbai’s Anti-terrorism Squad (ATS) chief Hemant Karkare, Additional Commissioner Ashok Kamte and encounter specialist Vijay Salaskar who were in that vehicle. To quote Qasab: “We waited for some time and then went towards the said vehicle. Three bodies lying there. Ismail removed the three bodies and drove the said vehicle. I sat next to him. While we were moving in the said vehicle, some police men tried to stop us. Ismail opened fire towards them while we were on the move; our vehicle got punctured near a big ground by the side of road. Ismail got down from the driver seat, stopped a car at the gun point and removed the three lady occupants from the said car. Then Ismail carried me to the car and sat me inside as I was injured. Then he drove the said car.

“While we were moving in the said car, we were stopped on the road near sea shore. Ismail fired towards them. Some policemen got injured. Police also opened fire towards us. Due to the police firing Ismail got injured. Then police removed us to some hospital. In the hospital I came to know that Ismail succumbed to the injuries he has sustained.”12

T1 was neutralized. Qasab became the only surviving attacker.

T5 seized control of the Nariman House business and residential complex between the times of 21:20 and 22:00. More gunmen (T5) were reported storming and firing at the Café Leopold and Oberoi-Trident hotel, where about 400 people were residing.

According to some reports, several gunmen from the Café Leopold and Chhatrapati Shivaji railway station joined more gunmen at the lobby of the Taj Mahal Palace Hotel. These gunmen fired aimlessly and large fires broke out. We know that T1 was responsible for the railway station attacks and were neutralized soon after leaving the hospital, so reports of their joining the attackers at the Taj hotel were inaccurate.

Wednesday, 26 November 2008, 22:50 IST (Indian Standard Time) The Times of India offices are notified of the simultaneous attacks. 10 Statement of accused Mohd Ajmal Amir Qasab; Age 21 yrs. Occupation: Labour, Resident of Faridkot, Tehsil -

Dipalpur, Â Dist -Ukada, State -Suba Punjab, Pakistan, provided by the Mumbai Police to the International Centre for Political Violence and Terrorism Research, Singapore, December 2008. 11 Ibid. 12 Ibid.


of 22

Thursday, 27 November 2008, 01:00-04:00 IST (Indian Standard Time) The Indian army engages in gun battles with the T2 and T3 at the Taj Mahal Palace Hotel, and T4 at the Oberoi-Trident hotel. During this time, small groups of guests managed to escape.

Communication Source: Pakistan Receiver: T3 at Taj Mahal Hotel, Mumbai

0108 IST: Status of hostages Belgian, Bangladeshi, No Muslims

0126 IST: Strategy The LeT handlers wanted to set fire to the hotels by initiating fires in the rooms. At 01:26, a LeT caller phoned and asked the attacker at the Taj Mahal hotel: “Are you

setting the fire or not?”, he responded: “Not yet. I am getting a mattress ready for burning.”13

Again at 01:37 when the caller said: “Try to set the place on fire”, the attacker said: “We have

set fire in four rooms.”14 They asked the attackers to look for a government minister.

“The “Vazir” [Minister] should not escape.”15

0137 IST: Moral Support & Strategy LeT: The ATS (Anti-Terrorist Squad) chief has been killed. Your work is very important. Allah is helping you. The Vazir (Minister) should not escape. Try to set the place on fire. Mumbai terrorist: We have set fire in four rooms. LeT: People shall run helter skelter when they see the flames. Keep throwing a grenade every 15 minutes or so. It will terrorize.

0310 IST: Strategy At 03:10, the LeT caller phoned and informed an attacker at the Taj Mahal hotel: “Greetings! There are three Ministers and one Secretary of the Cabinet in your hotel. We don’t know in which room.” When the attacker responded: “Oh! That is good news! It is the icing on the cake,” the caller said: “Find those 3-4 persons and then get whatever you want from India.” Based on TV coverage of the event, these experienced handlers controlled the attackers. The same caller added: “Do one thing. Throw one or two grenades on the Navy

and police teams, which are outside.”

0353 IST: Moral Support & Strategy The LeT handlers motivated and guided their attackers throughout the episode. Speaking from Azizabad, Karachi, the first caller said: “Brother Abdul. The media s comparing your action to 9/11. One senior police officer has been killed.” said an LeT caller from Pakistan to an attacker at Hotel Oberio at 03:53.16 To which Abdul Rehman responded: “We are on the 10th/11th floor. We have five hostages.” Kafa, the deputy operational leader of the LeT was then heard to say: “Everything is being recorded by the media. Inflict maximum damage. Keep fighting. Don’t be taken alive.”17 On the same phone,

13 Ibid., Idem.

14 Ibid., p. 53

15 Ibid., Idem.

16 Translation of some selected intercepted conversations, Mumbai Terrorist Attacks, November 26 -29,

2008, Government of India, Annexure-VII, p. 52.

17 Ibid., p. 53


of 22

the first caller instructed, “Kill all the hostages, except the two Muslims. Keep your phone switched on so that we can hear the gunfire.” When the attacker Fahadullah said, “We have three foreigners including women from Singapore and China,” the caller responded, “Kill them.”18 In the background were the voice of Fahadullah and Abdul Rehman directing the hostages to stand in a line and telling the two Muslims to stand aside. Momentarily after the gunfire in Mumbai, there were cheering voices in Karachi. Zarar then directs: “Fahad, find the way to go downstairs.”

The standoff with T5 continues at the Jewish outreach centre at Nariman House at 04:00.

Thursday, 27 November 2008, 02:45 IST (Indian Standard Time) A group calling itself the “Deccan Mujahedeen” claims responsibility for the attacks. According to Telegraph UK, the Deccan Mujahedeen “appears to be the latest in a string of home-grown Indian Islamic militant splinter groups”19.

Thursday, 27 November 2008, Dawn As the morning dawns, the gun battle continue between the attackers and army. Army personnel infiltrate part of the Taj Mahal Palace Hotel.

Thursday, 27 November 2008, 10:30 IST (Indian Standard Time) The army begins conducting room-by-room searches of the Taj hotel. Explosions continue to be heard at both the Taj and the Oberoi-Trident hotels.

Thursday, 27 November 2008, 16:30 IST (Indian Standard Time) The Indian Prime Minister, Manmohan Singh, delivers a speech to the nation vowing that the militants will not escape and making reference to the complicity of “our neighbors” in the attacks in Mumbai.20 The Indian Navy locates and boards a cargo vessel that they believe to be linked to the attacks. Indian Navy personnel seize the log sheets maintained by the attackers aboard the MV Kuber.

Thursday, 27 November 2008, 16:40 IST (Indian Standard Time) Roughly ten minutes later, Pakistan’s President, Asif Ali Zardari, issues a public statement about the need for strong measures to eradicate terrorism.

Thursday, 27 November 2008, 16:40-Friday, 28 November 2008, 02:30 IST (Indian Standard Time) Gunfire and loud explosions continued into the night into the midnight hours of Friday.

Communication Source: Pakistan

Receiver: T5 at Nariman House, Mumbai

1945 IST: Status of hostages LeT leadership in Pakistan communicated to the attackers holding Israeli and Jewish hostages in the Nariman House at 19:45: “the Major General [a code for the LeT operational leader] directed us to do what we like. We should not worry. Pray to God. Keep

18 Ibid., p. 56

19 http://www.telegraph.co.uk/news/worldnews/asia/india/3529983/Mumbai-attacks-Who-are-the-

Deccan-Mujahedeen-terrorists-Bombay-India.html

20 “Prime Minister’s Address to the Nation,” South Asia Terrorism Portal, November 27, 2008.

http://www.telegraph.co.uk/news/worldnews/asia/india/3529983/Mumbai-attacks-Who-are-the-Deccan-Mujahedeen-terrorists-Bombay-India.html



of 22

two magazines and three grenades aside, and expend the rest of your ammunition. Keep in mind that the hostages are of use only as long as you do not come under fire because of their safety. If you are still threatened, then don’t saddle yourself with the burden of the hostages. Immediately kill them.”21 The LeT high command controlled the overall operation. They wanted to conclude the siege in the morning of November 28th. “The operation has to be concluded tomorrow morning. Pray to God. Keep two magazines and three grenades aside, and expend the rest of your ammunition.”22

2226 IST: Moral Support At 22:26 IST the LeT Pakistan called again to inform the attackers at the Nariman House, “Brother, you have to fight. This is a matter of prestige of Islam. Fight so that your fight

becomes a shining example. Be strong in the name of Allah. You may feel tired or sleepy but the Commandos of Islam have left everything behind. Their mothers, their fathers, their homes. Brother, you have to fight for the victory of Islam. Be strong.”23

Friday, 28 November 2008, 02:30 IST (Indian Standard Time) At 02:30 gunfire and loud explosions are constantly heard from the Taj and the Jewish centre, Nariman House.

Friday, 28 November 2008, 07:30 IST (Indian Standard Time) Commandos are dropped from helicopters on to the Nariman House and begin a sweep throughout the building.

Friday, 28 November 2008, 07:30-11:00 IST (Indian Standard Time) Indian commandos battle the attackers and finally take control of the Oberoi-Trident hotel by 11:00. Hostages are released.

Friday, 28 November 2008, 07:30-13:00 IST (Indian Standard Time) The battle with the attackers continues at the Taj hotel. Indian commandos report finding about 30 bodies at 13:00.

Friday, 28 November 2008, 07:30-15:00 IST (Indian Standard Time) After several hours of sweeping through the Nariman House, which housed the Jewish Centre, at 15:00, the Mumbai police reported that five hostages have been found dead.

Friday, 28 November 2008, 18:00 IST (Indian Standard Time) Indian security forces confirm they have secured the Jewish Centre and announced that eight Israeli or dual Israeli-US citizens have been killed as well as the two gunmen.

Friday, 28 November 2008, 18:30 IST (Indian Standard Time) Security operations continue at the Taj hotel, though the intensity of the gunfire between attackers and authorities is noticeably diminished.

Saturday, 29 November 2008, 04:30-07:30 IST (Indian Standard Time) Renewed explosions and gunfire are heard from inside the Taj hotel. Authorities report fires on the lower floors of the Taj at approximately 07:30.

21 Translation of some selected intercepted conversations, Mumbai Terrorist Attacks, November 26 -29,

2008, Government of India, Annexure-VII, p. 51

22 Ibid., p. 51

23 Ibid., p. 52


of 22

Saturday, 29 November 2008, 08:50 IST (Indian Standard Time) The Indian police declare the Taj Mahal siege over by announcing the deaths of three gunmen in the hotel.


of 22

Sources 1. Gunaratna, R. (2009) Mumbai Investigation: The Operatives, Masterminds and Enduring

Threats, UNISCI Discussion Papers, No. 19, January 2009, Online: 2. The Telegraph (2009) Mumbai attacks: Who are the Deccan Mujahedeen terrorists? Online:


3. Translation of some selected intercepted conversations, Mumbai Terrorist Attacks, November 26-29, 2008, Government of India, Annexure-VII, p. 51.

4. Ghosh, S. (2009) Mumbai Terror Attacks: An Analysis, Institute for Peace and Conflict Studies, Special Report, No. 66, February 2009, New Delhi, India.

5. http://www.ucm.es/info/unisci/revistas/UNISCI%20DP%2019%20%20ROHAN%20MUMBAI.pdf

6. http://en.wikipedia.org/wiki/Lashkar-e-Taiba 7. http://www.satp.org/satporgtp/countries/india/states/jandk/terrorist_outfits/lashkar_e_

toiba.htm 8. http://www.zimbio.com/Lashkar-e 9. http://www.expressindia.com/news/fullstory.php?newsid=24130





http://en.wikipedia.org/wiki/Lashkar-e-Taiba

http://www.satp.org/satporgtp/countries/india/states/jandk/terrorist_outfits/lashkar_e_toiba.htm

http://www.satp.org/satporgtp/countries/india/states/jandk/terrorist_outfits/lashkar_e_toiba.htm

http://www.zimbio.com/Lashkar-e

http://www.expressindia.com/news/fullstory.php?newsid=24130


of 22

Appendix A: Weapons Procurement The information contained in this appendix is excerpted from: Stohl, R. (2005) Fighting the Illicit Trafficking of Small Arms, SAIS Review, 25(1), Winter-Spring 2005, pp. 59-68. The content below is solely attributable to Stohl.

Illegal Arms Trade Weapons Types: small-arm rifles, pistols, revolvers, assault rifles, shotguns, light arms, heavy machine guns, rocket-propelled grenades, grenade launchers, recoilless rifles, mortars over 100mm, shoulder-fired missiles. http://www.cdi.org/program/document.cfm?DocumentID=2996

Methods of Introduction of arms into illicit market

Diversion A movement of arms from the legal realm to the illicit market it can be authorized, or unauthorized, intentional or unintentional, since in the broadest sense diversion is simply the movement of a weapon from legal origins to the illicit realm. Most often it is through government corruption or neglect that allows these arms to enter the legitimate market.

9 methods for small arms entering illicit networks 1. States, companies or individuals can violate national, regional or international

sanctions and embargoes in order to ship weapons to barred countries or parties. The U.N. sanctions panels on Angola and Liberia reported the most widely known flouting of such international controls, describing numerous examples of government contravention of arms embargoes by supplier states and those that allow their countries to be used as trans-shipment points.

2. Corrupt government officials allow weapons exports from or through a country

where it would otherwise be difficult or illegal to do so. Government officials may accept bribes to provide export licenses to those ineligible due to domestic or international laws, and customs officials and other relevant government workers may accept payoffs to look the other way as weapons are shipped from or through ports. Cash payouts are common in countries where government workers receive meager salaries or indefinitely delayed wages.

3. Inadequate weapons stockpile security and management allow small arms to flow

out of government arsenals into the networks of shady arms brokers or organized crime syndicates, terrorists, pariah governments, and insurgent groups. These insecure stockpiles carry the risk of theft and are vulnerable to accidental loss. Indeed, looted arsenals provide the bulk of diverted weapons.

4. Opportunists raid national arsenals and weapons caches during periods of instability

or rampant crime. In 1997, Albanian government arsenals emptied as the country descended into chaos and more than half a million weapons flowed into the hands of Albanian citizens. Many of these guns made their way throughout the Balkans and into other regions. Today in Iraq, insurgents routinely steal former military caches for use against U.S. soldiers and Iraqi civilians.

http://www.cdi.org/program/document.cfm?DocumentID=2996


of 22

5. Small arms are misplaced or lost from government and military stocks. Each year, an estimated 1 million light weapons are stolen or lost around the world.i[9] Rarely recovered, these weapons make their way into illicit trafficking networks and are sold on the black market.

6. In countries where surplus weapons remain part of insecure stockpiles and soldiers have

not received salaries or are sympathetic to a specific group, soldiers may sell their weapons for cash. Israeli soldiers are known to sell weapons to Palestinians with the full understanding that these weapons will be used against Israeli soldiers and citizens.

7. Weapons are stolen from legitimate owners. In the United States alone,

approximately 500,000 small arms enter the black market every year due to theft from private citizens.

8. Ambiguous or ineffective domestic laws concerning the purchase of small arms can

contribute to the quantity of small arms available on the black market. If there are no limits to how many guns a person may own or buy at one time, “straw purchasers” can buy several weapons at once and then illegally resell them. These illegal weapons are often sold across international borders from a country with lax regulations to one with quite strict gun laws, as is common between the United States, Mexico and Canada.

9. Individuals or organizations make their own weapons for sale on the illicit market,

a process referred to as “craft production.” Craft production is a “low-scale, low-profile, informal, and illegal economic activity, carried out in small private workshops, garages, huts, or backyards.” Although “in economic terms, craft production is a minor, but not negligible, segment of global small arms production,” in some areas even a small number of weapons can successfully destabilize a government or facilitate violence.

Example: Ukraine in the Arms Trade After the fall of the Soviet Bloc Ukraine was left with many weapons. During the Cold war there was 1 million men stationed in Ukraine and when the wall fell. Due to lack of hard currency and ineffective controls put in place it is estimated that between 1992 and 1998 Ukraine “lost” 32 billion dollars worth of weapons. Compared to in 1999 Ukraine spent 500 million on legal arms for defense. Ukraine’s Arms industry grew tenfold from 1997-2000 and exported 1.5 billion worth of arms. The claims are that high-level Ukrainian officials are either supporting or ignoring blatant arms dealing. For example “The Ukrainian government has shown little interest in looking into corruption, organized crime, or arms dealing. Ukrainian politicians and journalists who have pursued the matter have found it difficult and potentially dangerous. There has been only one official inquiry into arms dealing, and it ended abruptly when the defense official heading it was court-martialed. The panel's findings vanished and its members remained silent. A journalist who leaked some of the inquiry's findings was shot and wounded in an attack case that is still unsolved. Journalists who question the government routinely face censorship, harassment, and violence.”


of 22

Appendix B: Pakistan’s Inter-Service Intelligence The information contained in this appendix is excerpted from: South Asia Terrorism Portal, Available at http://www.satp.org/. The content below is solely attributable to the respective authors contributing to satp.org and was not verified for accuracy by NC2IF.

Pakistan's ISI background and past Activities

ISI Background Founded in 1948 by a British army officer, Maj Gen R Cawthome due to failure of IB

during 1947 Indo Pak war

ISI is controlled by Pakistan's Ministry of Defence (MOD)

ISI director is always a Lieutenant General from the army

At first ISI’s mandate limited to only outside (exceptions were NWFP and Kashmir)

Intel work (mostly against India). Today ISI operations take place inside and outside

Pakistan.

ISI’s power was substantially increased under Ayub Khan.

ISI Organizational Units Joint Intelligence X, coordinates all the other departments in the ISI.Intelligence and

information gathered from the other departments are sent to JIX which prepares and

processes the information and from which prepares reports which are presented.

Joint Intelligence Bureau, responsible for gathering political intelligence. It has three

subsections, one divided entirely to operations against India.

Joint Counterintelligence Bureau, responsible for surveillance of Pakistani diplomats

abroad, along with intelligence operations in the Middle East, South Asia, China,

Afghanistan and the Muslim republics of the former Soviet Union.

Joint Intelligence North, exclusively responsible for the Jammu and Kashmir region.

Joint Intelligence Miscellaneous , responsible for espionage, including offensive

intelligence operations, in other countries.

Joint Signal Intelligence Bureau, operates intelligence collections along the India-

Pakistan border.

Joint Intelligence Technical

There are also separate explosives and a chemical warfare sections.

Kashmir Operations ISI’s Kashmir operations consist of providing funding and support to insurgent groups.

http://www.satp.org/


of 22

- Hizb-ul-Mujahideen (HM);

- Laskhar-e-Tayyiba (LeT);

- al Badr;

- Jaish-e-Mohammad (JeM); and

Insurgent groups are cost effective way of fighting proxy war in Indian occupied

Kashmir ( RAW Estimate of 125-250 million $ per annum)

Hizb-ul-Mujahideen Formed in 1989 by Master Ahsan Dar and Muhammad Abdullah Bangroo.

Currently led by Muhammad Yusuf Shah, alias Syed Salahuddin.

Set up by ISI to counter JKLF (Jammu Kashmir Liberation Front)

HM wants the merger of Kashmir and Jammu with Pakistan and “Islamization” of those

two areas.

HM employs training camps to train fighters which employ hit and run / raid attacks.

HM does not employ suicide tactics

HM was largest terrorist group in Kashmir until it lost much power of its power in

2001 when it lost support from Musharraf and lost most of its “officers” and 300 cadres

when they were killed or captured in 2007 by Indian defense forces.

HM is believed to have fallen out of favor of the ISI and is being replaced by Lashkar-e

Toiba and Jaish- e- Muhammed.

Laskhar-e-Tayyiba (Army of the Pure) Formed in 1991 by Hafiz Muhammad Saeed and Zafar Iqbal.

Currently led by Hafiz Muhammad Saeed and Zafar Iqbal.

Set up ISI to conduct attacks in Jammu and Kashmir. Has been urged by ISI to expand

operations in Jammu because it has many members who are Punjabi so they can blend in

easier.

The group's aims include establishing an Islamic state in South Asia and uniting all

Muslim majority regions in countries that surround Pakistan.

Uses Suicide bombings, conventional bombings and Fedayeen squads.

Controversy over whether ISI supported and trained the LET for the 11/26 Mumbai

attacks.


of 22

al Badr Formed in 1998 by Arfeen Bhai, al Badr was originally part of Hizb-ul-Mujahideen but

was encouraged by the ISI to splinter and form its own group.

Currently led by Bahkt Zameen Khan.

The groups stated purpose is to liberate the Indian states of Jammu and Kashmir to be

merged with Pakistan.

Employs suicide tactics and also is comprised of up to 30% of foreign mercenaries.

Jaish-e-Mohammad (JeM) Formed by Masood Azhar in March of 2000.

The group's primary motive is to separate Kashmir from India and to merge it with

Pakistan.

Tactic is predominately fedayeen raids.

Leader Masood Azhar claims to have met Osama bin Laden for a meeting in early 2000

JeM has gained a lot of support in recent years and is now one of the largest operators

in the Jammu and Kashmir region.

Figure 2. …

Afghanistan Operations The ISI assisted the CIA in distributing weapons and providing training camps along the Pakistan in operation Cyclone (July 3, 1979 – February 15, 1989) . This resulted into many elements of the ISI receiving CIA training and funding. The ISI also created and controlled intricate networks of mujahedeen fighters which many argue evolved into the terrorist groups that today are commanded and funded by elements in the ISI.


of 22

Bangladesh Operations Bangladesh is a country with a very large Muslim majority of 83%. The ISI operates a number of agents in the area that help to coordinate terrorist activities into India in the same manner as they do in Pakistan administered Kashmir. The ISI will provide funding and training to groups as well as try to maintain certain levels of coordination between groups. The goal of these operations is to turn the Northeast states of India into an Islamic State. An example of operations can be found at: http://www.atimes.com/atimes/South_Asia/FC06Df02.html

Mumbai Attacks Many internet sources and officials of the Indian Government speculate that the ISI coordinated the attacks and had assets train the LeT terrorists involved in carrying out the attacks. There is also speculation that the terrorist’s handlers during the attack may have been ISI or Pakistani military assets Foreign Secretary Shivshanakr Menon said in Paris on 02/06/2009 that the Mumbai attacks were "creations of the ISI". The LeT is known to be one of the many groups that the ISI developed and supported. The group was officially outlawed by Pakistani President Musharaff on 01/12/02 however with the continued operations of the LeT and other outlawed group brings increased speculation that the ISI does not answer to the civilian government. http://www.satp.org/satporgtp/countries/india/states/jandk/terrorist_outfits/lashkar_e_toiba.

http://www.atimes.com/atimes/South_Asia/FC06Df02.html

http://www.satp.org/satporgtp/countries/india/states/jandk/terrorist_outfits/lashkar_e_toiba

http://www.satp.org/satporgtp/countries/india/states/jandk/terrorist_outfits/lashkar_e_toiba

the attacks in mumbai

Documents