The attack planning cycle is a common talking point within the security community, dating from the earliest law enforcement publications to modern-day outlines on public safety. As our understanding of the attack planning cycle evolves, so does our ability to anticipate and prevent acts of targeted violence. This three-part series will examine the components of the attack planning cycle and explore how each piece integrates with our current understanding of targeted violence. We will study popular terrorist organizations, mass shooters and anti-government movements to uncover the thread that ties these groups together. By better understanding the planning cycle of historical attacks, we can help prevent future threats to our modern way of life.
One of the earliest versions of the attack planning cycle was derived from the Minimanual of the Urban Guerilla by Carlos Marighella, 1969.1 Written by a Brazilian politician and Marxist revolutionary, this 40-page document outlines the required strategies and tactics to overthrow an authoritarian regime. Through this manual, Marighella outlines his general plan of attack by detailing the stages of investigation and intelligence planning, observation and vigilance, the study and timing of routes and the careful selection of weapons and personnel.
As our understanding of the attack cycle has evolved, we have seen acceptance of the current model described by the U.S. Director of National Intelligence (DNI), which lists the phases of the attack planning cycle as follows: preliminary target selection, initial surveillance, final target selection, pre-attack surveillance, planning, rehearsal, execution, escape and exploitation.2 We can see the similarities within the Marighella and DNI attack strategies. Both the Marighella and DNI models suggest collecting intelligence, understanding a target’s movements, proper planning and rehearsing the plan to ensure the attack’s success.
Before continuing, let’s consider the popular threat assessment models and how they apply to the attack planning cycle. There are two commonly referenced threat assessment models currently in use. The first model, known as “idea to action continuum,” was developed by the U.S. Secret Service under Dr. Robert Fein and Robert Vossekuil. In this continuum, the process from idea to action is as follows: situation, thinking, planning, logistical preparation and lastly, attack.3 A second model more frequently discussed is the pathway to violence model, which lists the path to violence as grievance, ideation, planning, preparation, breach and attack. Since we have explored these pathways in a previous blog, we will skip the basics and look at these two models as a single hybrid process.
For this series, our pathway to violence will be situation (grievance), thinking (ideation), planning, logistical preparation (breach) and attack execution (attack). We can find examples of each stage in the writings of prominent attackers like James Holmes and Robert Hinkley and the publications of extremist groups like Al-Qaeda, Antifa, Kurdistan Workers’ Party (PKK) and Weather Underground. While it may seem unreasonable to combine assassins, active shooters, terrorist groups and protest movements into a single category, my goal is to highlight the similarities within each group’s approach and provide insight into how to mitigate these strategies. We will discuss the first step of the attack planning cycle, situations and grievances, in an upcoming article. For now, let’s focus on the ideation stage of the process and explore common objectives behind unwanted acts.
Thinking or ideation is a critical first step in the decision to commit violence. When assessing behavioral-based threats, it is crucial to consider the ideas surrounding an individual’s decision to commit an unwanted act. That unwanted act could be espionage, sabotage, kidnapping or abduction, assassination or even mass murder. We also need to evaluate the situation that influenced this violent act, keeping in mind that some factors may not be evident upon first glance. Most often, an individual’s idea to commit an unwanted act comes in response to a situation they are hoping to resolve.
In many cases, the idea of committing an act of violence comes from the need to correct a real or perceived wrong. A delusional worker set with the intention of murdering their supervisor may be trying to correct for wrongful termination. A terrorist organization planning an attack may be retaliating against the west for perceived injustices to their country. A vindictive spouse sabotaging their partner’s workplace may be responding to an extramarital affair. Or, a rioting anti-government movement may be fighting against perceived fascism and police brutality. We certainly can’t categorize all violence as retaliation. We will get into grievances later, for now we will focus on objectives.
Inciting unrest is a common objective for targeted violence, as indicated in the Al-Qaeda publication Inspire. Taken from issue 15, the group notes:
The goal of any party in a conflict is to drag back the enemy into a state of proving its existence. Beginning by seizing the military control by force, depriving them from military presence, and then depriving them of their internal security by inciting disturbance and disorder of security in the heart of the enemy state, whereby it is striving hard to prove its security presence.4
This objective also resonates with similar insurgent missions across history and other activities in the modern world. Take, for example, the strategies and tactics used by the PKK throughout their conflict with Turkey. The Kurdish militant group has created an environment of unrest within its country and deprived citizens of their security by specifically targeting security forces and abducting police. The radical group even managed to eliminate 28 Turkish soldiers and police with snipers and Improvised Explosive Devices (IEDs) in late 2019.
Per Inspire, another objective of terrorist organizations is to incite distrust. Al-Qaeda mentions this as one of the outcomes in their mission to undermine the west. Taken from the same Inspire issue, the terrorist group lists the frustration and distress of additional safety precautions as evidence for their victory, stating:
The return of checkpoints in the heart of the capitals of so-called superpowers, the ever-increasing security checks of passengers in airports, internal and external flights, the high level of security procedures, the infringement of individual privacy, spying and mass surveillance on their citizen’s communications.6
Through targeted acts of violence, terrorist groups can effectively cause a society to distrust their government and create civil unrest. We see this happening today as security forces continue to impose greater restrictions on their citizens, while citizens grow more unsure that their security forces are fit to protect them.
By using uncertainty to disrupt the economy and drive policy change, terrorist groups successfully integrate fear into society and reach their ultimate goal. While causing fear is not a primary objective for lone attackers, it is common for lone jihadists. Al-Qaeda writes:
Conveying a message is as important as the execution of the operation itself because sometimes it needs some terror for the message to reach the oppressor effectively.7
Other common objectives for terrorism include retaliation, achieving notoriety or to be removed from society through an act of violence. In their 1999 study, Fein and Vossekuil suggest that political ideologies are not common motivators for assassination, at least throughout American history. For attackers like James Holmes of Aurora, Colorado, the goal was no message. As he planned his attack, Holmes wrote in his diary that he found it unwise to attack the airport, not solely due to the security risks, but because terrorism was not the ultimate message.8
While not absolute, these common objectives offer an excellent understanding to evaluate potential threats. After deciding on an objective, the attacker moves to the next step of the thinking phase, target selection. There are two possible scenarios when choosing a target. The attacker has created a personal attachment to the target, or a higher power selected the target. Many attackers identify their victims through a pre-existing relationship, such as a former employee or intimate partner. Others may choose their target because of an erotomanic pursuit. Celebrities and public figures are often targeted because of what they represent. A famous example is John Hinkley Jr.’s attempt to assassinate President Reagan in 1981. This assassination attempt was an indirect attack that came about through Hinkley’s obsessive fixation with the actress Jodi Foster.
The attacks in Paris against Charlie Hebdo represent those that were directed from above as well as an attempt for indirect engagement. Al-Qaeda’s own outline of this attack suggested they would first engage with the broader lone mujahideen community indirectly by placing Charlie Hebdo on a wanted list. The second step, to ensure action was taken, was to direct an organized attack by a Jihad group with direction from Al-Qaeda9. Al-Qaeda clearly indicates their first step in the attack planning process as “specifying a target.” As they explore their thinking into target selection, it becomes clear that target selection is driven by identifying “prioritizing economic personalities.”10 They further this, noting target selection falls into two categories, either a strategic or tactical goal. The strategic goals may help them win the war with the west, while the tactical goals like those committed by the PKK, may target military or security personnel. It is noted, especially for the lone mujahideen, that these types of attacks require greater resources, and thus the targeting of economic personalities may have a higher likelihood of success. These directives are not direct guidance, but suggestive, hoping to inspire lone actors to engage. Attacking economic personalities, wealthy entrepreneurs and company owners is intended to achieve a level of insecurity which will later bring instability to the economy.11
We’ve seen similar attempts to motivate others on behalf of an organization here in the U.S. Antifa targets their opponents by labeling people as extreme conservatives on their “Alt-Who” website.12 This action raises an interesting dilemma for the security community. We often focus our attention on the person or group identifying the potential target, when the ultimate predator may be the person on the fringe that identifies with the act.
The People’s Protection Units (YPG) of the Kurdish militia have manipulated social identities to motivate others to act. Changing the paradigm from a discussion about “what is wrong” to a dialogue focused on “what should be done” or “what can I do?” The line between these approaches to motivating others isn’t as blurry as we may think. In July 2020, a report from the Turkish National Police Academy indicated that Foreign Terrorist Fighters (FTF) from Syria returned to their home countries after years at war:
The Kurdistan Workers’ Party (PKK) and its affiliates in Syria – namely the Democratic Union Party (PYD), People’s Protection Units (YPG) and Women’s Protection Units (YPJ) – have recruited many westerners from far-left organizations including Antifa groups operating in European countries, the U.S., Canada and Australia.13
Whether we are considering terrorism, assassination, protest movements or active shooters, studies have consistently suggested that an identification warning behavior, such as identifying with previous attackers or assassins, is a distinguished risk factor. Dr. Reid Meloy, within the Terrorist Radicalization Assessment Protocol (TRAP-18), outlines this in detail using sample cases of Breivik and David Copeland.14 Measuring social identity is a valuable tool within the assessor’s tool kit. Social Identity is “an individual’s knowledge that he belongs to certain social groups together with some emotional and value significance to him of his group membership.”15 The authors of “An Integrative Theory of Intergroup Conflict” further note that as individuals invest in the social groups with which they have affiliated themselves, they may begin to take on the group’s social identity. They may make the leap from a sympathizer to committing a terrorist, violent or other criminal act in support of this new identity. It is ironic when we consider the expression “drinking the Kool-Aid.” While this phrase is most often associated with irony or humor, the origins of the phrase have very negative associations with the death of over 900 members of the Peoples Temple movement who committed mass suicide. The influence of organizations on an individual’s actions shouldn’t be dismissed. While the likelihood that an individual will voluntarily move from thinking about to committing violence may be low, unknown external factors may propel them to identify a target.
References:
- (Marighella, C. (2002). Mini Manual of the Urban Guerilla. Retrieved 2020, from https://socialhistoryportal.org/sites/default/files/raf/0719730000_0.pdf).
- NCTC (2020). JCAT Counterterrorism Guide for Public Safety Personnel. Retrieved August 25, 2020, from https://www.dni.gov/nctc/jcat/index.html
- Xxx Fein and V.
- Al-Qaeda,… (2016). Lone Jihad. Inspire, 15, 43-43.
- Blaser, N. (2019, April 09). The PKK’s Urban Warfare Tactics. Retrieved August 24, 2020, from https://www.atlanticcouncil.org/blogs/menasource/the-pkk-s-urban-warfare-tactics/
- Al-Qaeda,… (2016). Professional Assassinations. Inspire, 15, 66.
- Holmes diary
- Al-Qaeda,…(2015). Charlie Hebdo Military Analysis, Inspire 14, 40-42
- Al-Qaeda,…(2015). Assassination Field Tactics, Inspire 14, 83-87
- Al-Qaeda,…(2015). Assassination Operations, Inspire 14, 66
- Anonymous, A. (2017). The Alt-Who? Identifying Local Fascist Figures. Retrieved August 24, 2020, from https://www.indybay.org/newsitems/2017/04/13/18798295.php
- Tinas, M., Ph.D. (2020). News. Retrieved August 24, 2020, from http://www.interpa.org/e2809cforeign-terrorist-fighters-in-pkk-ypg-in-syria-violent-extremism-backfirese2809d-report-news.html
- Meloy, J. R. (2017). TRAP-18 Terrorist Radicalization Assessment Protocol (TM): User manual., CA: J. Reid Meloy.
- Tajfel, H., Turner, J. C., Austin, W. G., & Worchel, S. (1979). An integrative theory of intergroup conflict. Organizational identity: A reader, 56-65.
