Indicators
of Terrorist Attacks
Anoop
Chengara
Executive
Summary
Terrorist attacks in the
world over the past five years have become more organized,
widespread, more frequent and deadly. Their impact on society is
so severe that it has become imperative to predict and disrupt
terrorist strikes. Successful terrorist strikes share several
common features – meticulous long-term planning, careful
target selection, access to means of destruction, and efficient
logistics support. Evidence of such preparations should alert
law enforcement to an impending event. At Bharat
Rakshak Forum, a thread was dedicated to listing possible
indicators of a terrorist attack. The thread was meant to be of
use to the general public and to law enforcement agencies in
identifying the patterns that presage a strike. Several
suggestions were received on that thread, and this article sorts
the suggestions into different categories – possible, likely
and almost certain indicators (red flags). The list covers the
patterns of movement and storage of explosives, financial
transactions, appearance of publicity material and
‘dry-runs’ or rehearsals of the actual events. The material
covered in this article is by no means complete; the author
hopes that the article will serve to provoke an expanded
discussion of the issue.
Contents
Introduction
A basic classification of
indicators
Conclusion
References
and Footnotes
Introduction
Terrorist
attacks have become commonplace in most parts of the world over
the past decade. While most terrorist movements have
traditionally remained localized to conflict-prone areas, in the
past 5 years or so, a global dimension has emerged to terrorist
attacks and the scale and scope of attacks has expanded.
Terrorist attacks have been delivered using unconventional
means. The focus of the attacks seems to be on inflicting
extremely large civilian casualties and causing lasting economic
damage and in some cases influencing electoral results. There is
an urgent need to be able to predict and pre-empt such attacks.
An attempt was made at Bharat-Rakshak
Forum (BRF) [xi]
to list possible indicators of a terrorist strike. This article
summarizes the discussion that followed and attempts to sort the
indicators into a conceptual framework. Primarily, attention is
focused on identifying the indicators of well planned, large
scale attacks as seen in Mumbai (1993), New York (2001), Bali
(2002), Moscow (2002), Madrid (2004) and Beslan (2004). Smaller
scale attacks that take place everyday in insurgency-hit regions
are not analyzed in this piece. The dynamics of these attacks
tends to be influenced by local factors. Though it may be
possible to extend the type of analysis done here to insurgency
prone regions, this represents a different level of complexity
and is therefore out of the scope of this paper.
In
the aftermath of high intensity terrorist attacks, often clues
have been unearthed, which if recognized in time, would have
provided advance warning of the impending attack. For instance,
in the case of the Black Friday Blasts in Mumbai (1993)
explosives were smuggled by sea and stocked in private
storehouses hired for the purpose. Although villagers were aware
of the increased frequency of smuggling, they did not alert the
police because they did not connect it to a possible terrorist
attack. Even the most basic detection work at that time in the
villages could have prevented the Black Friday Blasts, which
left six hundred people dead. While it may be possible to
dismiss this sort of thinking as post-hoc analysis, or detection
by hindsight, it is important to note that high profile attacks
require long-term preparation, the best time to disrupt them is
during the planning and preparation stages when the weapon of
choice has yet to be assembled.
The
major challenges in pre-empting terrorism lie in identifying the
time, place and mode of attack. For most intelligence agencies
the real difficulty lies in sorting through the raw data
collected and separating the “noise” from the real warning
signs. This task is made more difficult by the fact that every
agency has limited resources and time with which to process the
raw data. It helps therefore to look carefully at some of the
common features of high intensity terrorist acts as this helps
create some reasonable filters to eliminate noise in the raw
data.
Let
us briefly examine some of the common factors in terrorist acts
today.
-
Choice
of Targets:
Most high intensity terrorism seeks to attack the foundations of
a state i.e. its political, military and economic
infrastructure. The act itself may be punitive or symbolic. For
example an analysis of the targets of suicide terrorism around
the world shows that most attacks take place in public transport
modes (30 percent), entertainment and shopping centers (24
percent), bus and railway stations (22 percent), military
targets (21 percent) and non-urban targets (3 percent), a
pattern that coincides with population density [vi].
-
Claims
of Responsibility:
Credit for every major attack is claimed by at least one
group, seeking to expand its profile and attract recruits
and funds.
-
Dry
Runs:
Dry runs are conducted to perfect the procedure; for example,
the LTTE suicide bombers who assassinated former Indian Prime
Minister Rajiv Gandhi had gained admittance to campaign rallies
of political parties and had even managed to get front row seats
at a rally attended by the then Prime Minister V.P. Singh posing
as members of the press.
-
Signature
Style:
The modus operandi of terrorist organizations also provides
clues to law enforcement agencies since most major terrorist
groups have a signature style. For example, Al Qaeda has focused
on causing very large-scale civilian casualties in its strikes
on Western symbols of political and economic influence as seen
in the death tolls in the hits on the World Trade Center in New
York and in the 1998 embassy bombings in Nairobi and Dar-es-Salaam.
In the case of World Trade Center attack, the mode of delivery
i.e. hijacked aircraft [xii],
was highly effective in achieving the surprise element as well
as in the resulting impact – in the first week following the
attack, the US airline industry lost between $1 to 2 billion
[Goodrich, 2002]. While the use of aircraft has captured the
world’s attention since 9-11-2001, more commonly explosives
have been used to cause fatalities. Chechen terrorists thrice
posed as construction workers to stash explosives to be used
later – in the sieges of a Moscow theatre in October 2002 and
more recently of the school in Beslan and an artillery shell to
assassinate the Chechen President Akhmad Kadryov in May 2004 [iii].
This
identification of common factors sets the stage for the
discussion of possible indicators of terrorist activity that we
outline in our next section. Each of the factors stated above
has associated with it a certain set of activities that could
serve as indicators of a possible attack.
A
basic classification of indicators
There
are many angles to view terrorism from. We seek the simplest way
of dissecting the pattern of a terrorist strike, which is to
work backwards to identify common minimum requirements for an
attack to succeed:
1.
Availability of raw material (guns, explosives,
chemicals),
2.
Expertise in handling them,
3.
Logistic support in the form of false identities,
transportation, safe houses and sleeper agents and money for
purchases or bribes.
However,
rarely do all details of such preparation come to light prior to
an attack. Yet evidence of even one of them must be investigated
with a view to unearthing evidence of others to put together a
composite picture of the threat. Viewed in this light, we can
categorize possible indicators:
A.
Red
Flags (Almost Certain Indicators) :
These are clues that warrant immediate and exhaustive
investigation because they point to a high likelihood of an
attack.
(i)
Unusual
patterns of movement of a known explosive expert, as an example,
B. Raman quotes the case of a Sri Lankan Tamil residing in
Germany who visited Chennai often before Rajiv Gandhi’s
assassination. Although the German police had warned Indian
authorities of his local reputation as an explosive expert,
adequate follow-up like requesting the German police to detain
him for joint interrogation or investigation into the basis of
his reputation was missing. Similarly the disappearance of
explosive experts from law enforcement agencies, mining and
controlled destruction companies and the military need to be
investigated thoroughly whenever it comes to light [xi].
(ii)
The
reported sale of large quantities of chemicals to uncommon
customers, Ramsi Yousef and Timothy McVeigh purchased chemicals
(ammonium nitrate and fuel oil) directly from manufacturers to
assemble the explosive devices for use in the 1993 WTC and in
the 1995 Oklahoma City bombings. Further, the chemicals were
delivered to self-storage units directly from the manufacturer
in the case of Ramsi Yousef, which should have set off a warning
to the law enforcement via the manufacturer [ii].
(iii)
The reported theft of explosives like dynamite, fuses and
blasting caps from mining or construction sites.
(iv)
Tell-tale
signs of failed explosive experiments. A chemical fire broke-out
when Ramsi Yousef was building an Improvised Explosive Device (IED)
and bright stains and rusted metal were found in his apartment.
Apartment rental agencies must periodically inspect apartments,
particularly when the tenant has recently moved in. Although
this is not easy to accomplish, since most terrorists will not
stay long in the target area, such inspections could be
valuable. The perpetrators of the 11 March 2004 Madrid subway
bombings killed themselves in an explosion in a rented apartment
in the suburbs of Madrid after police surrounded them. Two
backpacks of explosives, dynamite and detonators were found in
the apartment and a car packed with explosives was parked nearby
[BBC, April 4, 2004]. Neighbors told investigators that the
suspects rented the apartment in the suburbs a month before the
attacks, and were rarely seen in public and kept the window
blinds drawn. Similarly, hospitals must be required to report
the treatment of injuries resulting from explosions to law
enforcement agencies [ii].
(v)
Seizure
of large quantities of explosives, on February 29, 2004, just
over 10 days before the explosions on the subways of Madrid,
police seized two vans, one of them containing 536 kilos of
explosives and arrested two persons [CNN, February 29, 2004]. On
30 March 2004, more than 500 kg of ammonium nitrate, the
chemical used in the Oklahoma City bombing and Bali bombings,
was seized from a self-storage unit in London following a raid
[BBC, March 30, 2004]. This sort of discovery should prompt the
most stringent forms of surveillance and investigation.
B.
Probable
Indicators:
These are warning signs that merit further investigation,
particularly when more than one of them occurs simultaneously.
The difficulty lies in identifying precisely what the messages
mean and how they can be translated to actionable intelligence.
(i)
Consistent appearance of reports of linkage between local
insurgent and criminal groups and terrorist organizations are
probable indicator. Foreign terrorist organizations depend upon
the connections of local criminal gangs to ease the movement of
men and material in a country. They may align themselves with
gold and drug smugglers (to subvert Customs procedures), money
launderers (to avail of large sums of local currency to make
purchases) and insurgent groups (to exploit their ability to
store and move large quantities of ammunition). For example, the
Dawood Ibrahim gang was instrumental in bribing Customs
officials to ignore the large scale smuggling of explosives
along the Dighi coast of Maharashtra in January 1993, two months
before the serial explosions. The law enforcement agencies
generally depend on informers within the ranks of the criminal
groups to alert them to such connections. Where that is not
possible, the sudden and coordinated flight of criminals from
the country can be a pointer to an impending attack. In the case
of the 1993 serial blasts, police recognized the connection
between the sudden and coordinated departure of the Memon family
(an important lieutenant of Dawood Ibrahim) from Mumbai to Dubai
between 10 and 12 March (the day of the blasts) and then on to a
safe sanctuary in Karachi on March 20 [vii].
(ii)
The appearance of literature, video-tapes, electronic
communications, or material on web sites of terrorist
organizations, predicting a major event is another indicator.
For example, on June 25, 2001, an Arabic news channel reported
that Al Qaeda leaders were predicting that the U.S. and Israel
“will witness important surprises” and had released a
recruitment and fund-raising video-tape on the heels of a summer
of hectic inter-cell activity [iv].
Also, soon after the downing of two Russian airplanes on
25 August 2004 and suicide bombings in Moscow on 1 September,
there were reports [New Zealand Herald, September 1, 2004]
attributed to the Islambouli Brigade, an affiliate of Osama bin
Ladin’s IIF, of further attacks against Russia. These
announcements seemed to presage the tragedy at Beslan on
September 3rd.
(iii)
The split of a well-established terrorist organization
into two factions or the creation of a new terrorist entity from
the dregs of many old ones is also the sign of impending terror.
On February 23, 1998, Osama bin Ladin issued a fatwa for attacks
on all Americans, including civilians and for the creation of an
International Islamic Front for Jihad Against the Jews and the
Crusaders. On May 28, he formally announced the formation of
this entity [v].
This was soon followed by the attacks on the U.S. embassies in
Africa on August 7, 1998 that left 258 dead and 5000 injured.
The point to note is that the constituent groups of the IIF
including the Egyptian Jihad, Jaama Islamiya, the Harkat ul
Ansar and Al- Mujahiroun had all been co-operating with each
other since 1990, but the formal announcement of the new entity
was followed by a demonstration of its potency.
(iv)
The transfer of large sums of money using unusual methods
and between parties not known to have large business deals.
Mohammed Atta received $100,000 in a single transaction between
his U.S. bank account and a source in the UAE and subsequent
transfers added up to $500,000 [Washington Post, September 7,
2001]. Since Atta did not have a business front set up, such
large transfers should have evoked suspicion. Similarly Ramzi
bin al-Shibh, who was denied a visa to the U.S. four times in
2000 because he was expected to be untraceable once he arrived
here, transferred money in installments of around $10,000 each
from Germany to Zacharias Moussaoui and Marwan al-Shehi
[Associated Press, June 6, 2002]. Operation Green Quest, a task
force instituted by the U.S. Treasury Department in the
aftermath of the 9/11 attack, lists 12 suspicious activities
including transaction inconsistent with past activity, high
volume transactions through countries known to be sympathetic to
terrorists, unexplained clearing of third party cheques,
transfers between bank accounts of related entities or charities
for no apparent reason, lack of apparent fund raising activity
(i.e. small donations) in charities’ accounts, issuing cheques
numbered sequentially to the same person or business and deposit
in one country coinciding with withdrawal in another country of
concern or vice-versa [x].
In the Indian context, a sudden spurt in incidences of extortion
of businessmen or in hawala transactions may point to the method
of moving money.
C.
Possible
Indicators:
Under this category are those signs that may or may not mean a
terrorist attack is in the offing. However, since a single lapse
may prove to be fatal, law enforcement agencies must still
attempt to enlarge the scope of investigation to check for other
telltale signs of terrorism.
(i)
The
sudden spurt or decline in communications between known
high-ranking terrorist leaders.
(ii)
Increase in incidences of bribes being offered to Law
Enforcement, Customs and Immigration officials.
(iii)
Large-scale theft of passports and the appearance of
those numbers elsewhere. Usually, thefts of passports are
relatively common and are used more for illegal traffic of
workers, but the possibility of it being used for terrorist
infiltration also exists.
(iv)
Appearance of strange publicity material on the Internet
that appeals to a specific community or people. This could
indicate the beginning of a recruitment drive in the target
zone. Of special interest should be the sudden appearance of
suicide bomber tapes and eulogies on websites.
(v)
Appearance of unusual financial activity among groups
trading in the futures markets or news reports of unusual
activity in general. In the case of Sept 11, there was similar
such activity in United and American Airlines (the airlines
owning the aircraft used in the attacks) shares. The scheme was
to buy many ‘put’ options (i.e. options which gave the owner
the right to sell shares at well below current prices) perhaps
with the knowledge that the stock prices would plummet so
sharply in the near future that the options would multiply and
so even selling at below current prices would be profitable.
Such purchase of options was done not only in the United and
American Airline shares, but also in shares of Morgan Stanley
Dean Witter and Merrill Lynch, who had significant presence in
the WTC towers [ix].
(vi)
Appearance of wild theories and unusual reports in the
lay press. For example In the case of Mumbai 1993, there were
reports appearing in the Indian Express, which spoke of
large-scale landings of explosives on the Konkan coast. At the
time these were dismissed as being hype aimed at increasing
circulation.
Conclusion
We
have listed some of the vulnerabilities of the society that
terrorists choose to target. Our list is by no means complete;
it is however a promising start to a line of debate that could
potentially open up new avenues to detecting the onset of
terrorist acts. Taken to its logical conclusion, this kind of
work could at the very least provide a higher level of general
awareness about terrorism and perhaps even contribute in
building actionable intelligence estimates.
The
author seeks to caution readers that ultimately terrorists
modify their attack strategy according to the choice of target.
So it is very important to keep a society’s vulnerabilities in
mind when drawing up indicators for a likely terrorist strike.
For example, terrorist attacks seek to incite communal passions
in a society like India by attacking places of worship and
religious processions, the riots that are provoked by this act,
serve as a force multiplier for the terrorists in their fight
against an open society. Similarly for a global organization
like the Al Qaeda, economic targets like oil tankers, harbors,
transportation nodes and electronic commercial transactions are
attractive for the damage that it will do to the global economy.
Keeping sight of things like this should provide a useful tool
in divining meaningful indicators.
Ultimately
to combat terrorism eternal vigilance, timely sharing of
intelligence and prompt follow-through action are essential.
However supporting strategies that involve identifying terrorism
indicators, followed by a global effort to deny safe havens to
terrorists and their supporters will also aid considerably in
mitigating the threat.
References
and Footnotes
[i]
J.N.
Goodrich (2002), Tourism Management, 23, pp. 573-580.
[ii]
U.S.
Department of Homeland Security (2003), Potential Indicators of
Threats Involving Vehicle Borne Improvised Explosive Devices, Homeland
Security Information Bulletin, 15 May 2003
[iii]
R.V.
Prasad (2004), Rust Never Sleeps, Hindustan Times,
September 22 2004.
[iv]
The
9/11 Commission Report
(2004), W.W. Norton and Co, NY, Chapter 8, p. 257.
[v]
Terror
Tuesday, http://www.satp.org/satporgtp/usa/IIF.htm
[vi]
K.
Mukherjee (2004),
Suicidal terrorism on curriculum of counter-insurgency
school http://www.southasiamonitor.org/defence/2004/sep/13def1.html
[vii]
S..B.
Chavan (1993), Lok Sabha Debates, http://parliamentofindia.nic.in/ls/lsdeb/ls10/ses6/0521049301.htm
[viii]
N.M.
Ahmed (2002), ‘The War on Freedom’, Tree of Life
Publications, CA, pp. 83-85.
[ix]
N.M.
Ahmed (2002a), ‘The War on Freedom’, Tree of Life
Publications, CA, p. 118.
[x]
U.S.
Customs Service (2002), ‘Green Quest’, Customs Publication
No. 0000-0171, Office of Investigations, Washington D.C.
[xi]
BRF
Thread If this link is broken please contact editorial
team.
[xii]
Note 1:
It must be noted however that the use of civilian aircraft to
inflict casualties was not entirely novel. Three attempts to do
so occurred in 1994, with one Air France flight from Algiers
being hijacked by the Armed Islamic Group with the intention of
crashing it into the Eiffel Tower, which however was thwarted by
the storming of the plane on the ground [viii].
Ahmad also lists various sources to prove that American
intelligence agencies were aware, at least since 1995, of
Project Bojinka, a plan discovered from the computer of Abdul
Murad, a named co-conspirator with Ramzi Yousef in the plan to
assassinate Pope John Paul II in Manila and in the attack on the
WTC towers in 1993. Project Bojinka called for the hijack and
either destruction of 11 civilian airlines over the Pacific or
alternatively for the planes to be crashed into major
skyscrapers in the U.S.
|