In the previous blog, we reviewed concepts behind the thinking or ideation phase of the attack planning cycle. Part II will focus on the subsequent phases of the cycle, planning and logistical preparation.
The planning phase presents an opportunity for potential initial discovery of target identification, assuming a protective intelligence program exists to detect targeting activities. This phase includes early reconnaissance, initial attack planning and final attack planning sub-efforts. To avoid being discovered, Al-Qaeda provides distinct directions for “covert planning” and “covert practice.” Suggesting that the mujahideen make all efforts to take precautions and apply security measures before, during and after an operation.1 While target selection is achieved during the thinking phase of the cycle, it is during the planning phase that the decision to commit an unwanted act is solidified. Initial target selection may shift as a result of a variety of factors including the level of risk posed by the operation. A great example of a target change is Arthur Bremer’s attempt to assassinate President Nixon. Bremer conducted his initial reconnaissance by researching his target and identifying his vulnerabilities. At one point in his investigation, he found his way into the White House Press Room and noted that he “strolled into the press room like I belonged there.”2 He then attended a Nixon rally, where he was tapped on the shoulder by a Royal Canadian Mounted Police (RCMP) agent who stepped in front of him to photograph protestors. “What a dope!” Bremmer cited in his diary, “those noise makers were all on the news film! He should have photographed the quiet ones. He never pointed his camera at me.”3 After all these reconnaissance efforts, Bremer determined Nixon was too difficult of a target and shot George Wallace instead.
Al-Qaeda’s Inspire publication directs lone mujahideen towards a two-step process in their assassination planning. The first step is to collect intelligence from outside sources including television, media and the internet. This could include social engineering the relationships of people who have direct or indirect contact with the target. The second step is to collect information at close proximity through tactics like surveillance, blending into an environment such as Bremer did or overtly visiting a site, perhaps under pretext.4 In the supposed “Antifa Manual,” the group similarly suggests covert efforts to access positions of power within the media by obfuscating their true intentions and masking themselves on social media. While the intention here may not be associated with committing violence, the similar covert practices of planning and plan execution are clear.
The planning phase is often associated with active surveillance and perhaps even boundary probing. In the case of Sirhan Bishara Sirhan, a Palestinian Christian militant, and his assassination of Senator Robert F. Kennedy, it is indicated that there may have been four stalking events to probe security prior to the assassination. One at Robbie’s Restaurant on May 20, 1968, one on May 24th at the Los Angeles Sports Arena, one on June 2nd at a campaign rally and one on June 3rd at the El Cortez Hotel where Kennedy spoke.5
Once an attacker determines a final target, they may continue their efforts with further probes into their target’s vulnerabilities. As protection agents, we repeatedly analyze the vulnerabilities of the arrival and departure points. We also recognize that many static positions are prime opportunities for an attack to take place. During this final attack planning stage, the location is selected and the methods and means of identification may occur. In some cases, the attacker enters the initial reconnaissance phase with a preferred method and means, or perhaps an attack site; especially if the site is representative of a statement. Often, there is a level of tactical analysis present. As James Holmes prepared to attack the cinema in Aurora, Colorado, he noted in his journal that the first step was to “case the place.” He contemplated bombs or biological warfare as possible methods and means. He narrowed down his attack site from an airport to a movie theater.
His analysis of the Cinemark 16 identified several vulnerabilities he intended to exploit. The most notable weak points were that the complex seemed “isolated”, “proximal” and “large.” He also indicated the theatre would be easy to surveil due to its accessibility as an entertainment venue. He rated internal sites to the cinema on criteria such as the number of exits, size of the theater and considerations for his field of fire.6 After gathering this information, Holmes began calculating the means for his covert entry by taking into consideration his vehicle’s position and the estimated response time of law enforcement.
In the previous blog, we learned that the attack objective often dictates the attack location. The site of the Charlie Hebdo attacks, for example, seemed to send a deliberate message that was later clarified through Inspire:
The [attack] was not mainly directed to the persons targeted, but it was essentially directed to the publishing company itself.7
Al-Qaeda suggests three factors for identifying attack locations. First, the location must be able to achieve multiple objectives as in the Charlie Hebdo attacks. The second objective is to limit the amount of security and fortification present which may make the planned attack unachievable. The third is to hide all traces of the individual carrying out the attack for safe withdrawal.8
Al-Qaeda suggests attackers should discover ways of getting closer to a target at a time when they feel safe and can take fewer precautionary measures.9 Next, they need to determine a target’s security posture and consider the protection vulnerabilities in their workplace or home. According to Inspire:
At home there is less security than the workplace but reaching the targeted person at work and knowing his workplace is much easier than locating his home in which he resides.10
As discussed in a previous blog, predictability is a risk. With most executives working from home during the COVID crisis, the planning process for attackers has become much easier. While many will argue that the risk of being attacked in one’s own home is extremely low, let’s consider the amount of personal information available through the internet. Even those with extensive resources can be found at home. Take the Chief of Police in Seattle, Washington or Jeff Bezos, CEO of Amazon, as prime examples. Protestors recently set up a guillotine outside of Bezos’ Washington, D.C. home. While the protestors didn’t appear to have intelligence on when Bezos would be home, they were certainly able to discern his home address through open-source information gathering. By studying a household’s vulnerabilities and analyzing the lifestyle patterns of a specific target, assailants can inform and facilitate their plan of attack.11 These means of intelligence gathering may come through covert surveillance techniques such as hidden cameras, drones or websites like Google Earth.
When evaluating an attack site, as well as the methods and means, an attacker will consider a variety of options to facilitate their plan. For example, an overt frontal attack on a corporate office may have limited success. That is unless the timing of the attack allows for direct access to the intended victim such as on arrival or departure. The possibility of “silent infiltration” as an employee, cleaner, cook, customer or visitor is clearly detailed as an option within the Inspire publication.12 While much of this may sound like Hollywood make-believe, protectors and their principals should always bear in mind the patience of an assassin or terrorist. It is no coincidence that the Charlie Hebdo attack happened when a group of the publication’s personnel were gathered together. Citing from Inspire issue 14, Al-Qaeda reflects on the Charlie Hebdo attack:
The target was inside the heart and protection of the French intelligence system. And what really tormented the west was the ability of an organized group to plan an assassination operation in such a manner. And the years it took to lie in wait for the enemy and execute the operation.13
Logistical preparation may become evident near the final phase of the attack planning cycle. Acquisition of weapons, skill development and attack rehearsals are sub-phases of this stage. Days after the Boston Marathon bombing, friends of the attackers discovered a backpack containing fireworks that had been emptied of their explosive powder. Years prior to the attack, the FBI received intelligence suggesting that Tamerlan Tsarnaev, one of the Boston Marathon bombers, was planning travel to Russia to meet with what was described as “bandit underground groups.”14 It is in this final phase that the development of skills critical to the success of the attack occurs. Participating in martial arts training, as seen with Tsarnaev, going to a gun range, as seen with Sirhan, or traveling abroad for training are all evidence of this skill enhancement effort.
In many cases, the attackers have also rehearsed their attack plans. In Inspire issue 15, Al-Qaeda advised lone mujahideen to “plan a scenario and work upon it i.e. train yourself to the steps and stages of assassination.”15 They also encourage weapons training to ensure swift and accurate strikes. In some cases, however, the means and methods identified may not require close proximity but setting a trap. Guidance on the creation of parcel and package bombs, magnetic car bombs and door trap bombs are openly provided. In fact, the bomb used in the Boston Marathon was identified as being produced through Al-Qaeda publications. While U.S. bombings have become rare in recent times, there was a period in the 1970s when the country suffered 25 bombings by the domestic terrorist organization, Weather Underground.16
The final step in the elaborated attack planning cycle is the actual attack execution. At this point, few decisions could force a delay or withdrawal from the mission. Alongside their planning and preparation, the attacker would likely want to determine a personal outcome from this event; whether it’s to die at the hands of law enforcement or escape to attack another day. Unlike the D.C. sniper attacks, a series of coordinated shootings that occurred during three weeks in October 2002 in the District of Columbia, Maryland, and Virginia, Holmes planned his attack to facilitate an escape. His apartment was booby-trapped for responding police and he attempted to blend in with police as he left the cinema. Alternatively, the D.C. snipers committed attacks covertly so they could easily move to the next victim. The Boston Marathon bombers also conducted their attack in a way that facilitated escape, however, this part of their plan was not clearly outlined.
Part III of this blog series will focus on the situation or grievances that lead to an attack and how to diminish an attack risk.
References:
- Al-Qaeda… (2016). Lone Jihad. Inspire, 15, 44.
- Lemay, Harding, “An Assassin’s Diary” by Arthur H. Bremer, Introduction by Harding Lemay, 10-109, 1972
- Lemay, Harding, “An Assassin’s Diary” by Arthur H. Bremer, Introduction by Harding Lemay, 10-109, 1972
- Al-Qaeda…(2015). Assassination Operations, Inspire 14, 67
- TRAP-18 pg. 11
- Holmes Journal
- Al-Qaeda… (2016). Professional Assassinations. Inspire, 15, 69.
- Al-Qaeda… (2016). Professional Assassinations. Inspire, 15, 69.
- Al-Qaeda… (2016). Professional Assassinations. Inspire, 15, 67.
- Al-Qaeda… (2016). Professional Assassinations. Inspire, 15, 71.
- Al-Qaeda… (2016). Professional Assassinations. Inspire, 15, 74.
- OIG… (2014). Unclassified Summary of Information Handling and Sharing Prior to the April 15, 2013 Boston Marathon Bombings. Retrieved 2020, from https://www.oig.dhs.gov/assets/Mgmt/2014/OIG_Bos_Marathon_Bom_Rev_Apr14.pdf
- Al-Qaeda… (2016). Professional Assassinations. Inspire, 15, 68.
- Federal Bureau of Investigations. (2016, May 18). Weather Underground Bombings. Retrieved August 24, 2020, from https://www.fbi.gov/history/famous-cases/weather-underground-bombings
