In their 1997 book Learning from Disasters, Toft and Reynolds state that “the activity of risk management is the embodiment of the old adage that ‘an ounce of prevention is better than a pound of cure’. That is, management should be proactive and attempt to identify and measure hazards and control the risk of their occurrence before they occur.”
This theme of security being used to control risk is also referred to in other works. “Security implies a sense of confidence that risks are or will be managed, and is thus a check against specific known hazards and risks” (University of Leicester, Department of Criminology, Module 4, 2003).
However, while the modern security manager in the UK has at his or her disposal the tools to identify, measure and control such ‘normal’ crimes as assault, robbery, theft and fraud, to what extent can he or she reasonably be expected to prevent another 9/11 or 7/7? Is terrorism, as the question posed in the heading of this article suggests, a form of risk that is impossible to manage?
The Oxford Dictionary defines ‘terrorism’ as “the unofficial or unauthorised use of violence and intimidation in the pursuit of political aims.” The British Government, during the height of the Provisional IRA campaign in the 1970s, refined this definition further, stating that terrorism was “the use of violence for political ends, and includes any use of violence for the purpose of putting the public, or any section of the public, in fear.”
The key elements of terrorism
Perhaps what constitutes the essential elements of terrorism is summed up best by Williams and Head (2006) who simply state that: “There are definitely three key elements to terrorism – violence, fear and intimidation – and each of these elements produces terror in its victims.”
Over the years, terrorist organisations have devised a variety of tactics to create the violence, fear and intimidation required to produce such terror in their victims. Based on a study of various terrorist attack scenarios in Jerusalem, Linett (2005) breaks these terrorist tactics down into seven categories: (1) Intelligence gathering (2) Shooting attacks (3) Sniper attacks (4) Roadblocks (5) Roadside ambushes (6) Bombings (7) Abductions, hijackings and takeovers.
A firm believer in the relevance of the Israeli experience to fighting terror in the international arena, Linett states that “the applicability of the analysis of each (Israeli) incident is universal. Whether you live in a modern American metropolis, the surrounding suburbs or the mountains hundreds of miles away, the tactics that terrorists will use against you come from the same shared terrorist manual and operational experiences. Think of these tactics as if they were simply ‘tested in Israel’.”
To what extent, though, can UK-based security managers realistically be expected to manage risk for each of Linnett’s seven terrorist attack scenarios?
Intelligence gathering: how is it done?
Linett believes that intelligence can be gathered by terrorist groups in a number of ways. “Terrorist groups have sympathetic subject-matter experts to approach when they require specialist information on engineering principles in order to better bring down a bridge or building. They walk homicide/suicide bombers through full dress rehearsals at the target site, and they conduct run-throughs designed specifically to cause interaction between the attack group and the security personnel they will have to defeat.”
He goes on to state: “They know how to access public-domain resources to learn the capabilities of security cameras monitoring vulnerable public places. They use modern equipment, such as radio scanners and tracking devices, to pinpoint the schedules and routes of trucks hauling hazardous materials. They are masters of surveillance.”
This view is supported by Cannon (2004) who explains: “There is a generally set modus operandi employed in the planning and execution of an attack or serious crime, regardless of the target. These will differ group by group and, while some may be crude, the majority are professional in nature and military in their precision.”
Cannon adds: “A key element is acquiring as much information and intelligence as possible, through both open and covert means. This process will entail thorough studies of airport plans, maps, satellite imagery and web sites, followed by surveillance on the ground.”
The Al Qaeda training manual ‘Military studies in the Jihad against the Tyrants’ also stresses the importance of intelligence gathering. It places great emphasis on the use of both public source information and covert ‘information gathering’. Public source information can provide at least 80% of the information required about ‘the enemy’. The remaining 20% can be gained through covert ‘information gathering’.
Of particular note is the fact the training manual directs that “…the individual who gathers information about a desired location should, in addition to drawing a diagram, describe it and all its details.”
Years of covert surveillance
The first attack on the World Trade Centre in 1993 and the twin vehicle bombings of the US Embassies in Kenya and Tanzania on 7 August 1998 (which resulted in 213 killed in Kenya and 11 killed in Tanzania) were all preceded by years of terrorist information gathering and covert surveillance.
The attacks of September 11 2001 in New York and Washington (which lead to the loss of 2,981 lives) were conceived in the late 1990s and only executed after 50 ‘dry runs’ or evaluation flights. The US Department of Homeland Security Information Bulletin of 2003 advised that “nearly every major terrorist attack is preceded by a thorough surveillance of the target facility.”
Given the apparent universality of intelligence gathering as part of the terrorist attack cycle, it would seem highly appropriate for the security manager to take account of this when formulating his or her own organisational security procedures.
The importance of disrupting terrorist attacks at the information gathering stage is clearly recognized in the UK, where Project Griffin (a joint initiative between the City of London Police, the Metropolitan Police Service and the private security industry) gives private security officers access to a one-day, police-taught training course in ‘Terrorism Awareness’, with particular attention paid to spotting hostile reconnaissance.
In addition, the Association of Chief Police Officers and the Joint Security Industry Council produced an aide memoire for police and security officers detailing nine indicators of hostile reconnaissance.
Counter-surveillance in plain clothes
Where the risk of terrorism is deemed highest – for instance at such iconic targets as Canary Wharf (the site of London’s three tallest buildings: the HSBC Building, One Canada Square and the Citigroup Centre) – private sector security managers are using plain clothes counter-surveillance specialists to identify those engaged in hostile reconnaissance.
Specialist companies such as ISS Training can provide tuition in counter-surveillance for those security managers who require their staff to undertake this demanding role.
Given the ready availability from the police of such things as Project Griffin and the ACPO/JSIC booklet and specialist training, it appears reasonable to conclude that the terrorist tactic of ‘intelligence gathering’ is well within the abilities of a forward-thinking security manager to risk manage.
By ensuring that his/her security officers and CCTV operators have been trained in how to spot hostile reconnaissance and, depending on the threat assessment, perhaps by using the services of a counter-surveillance team the security manager can effectively disrupt meaningful intelligence gathering around the facility they are charged to protect.
Looking to manage shooting attacks
Linett states that “attacks employing firearms not only afford the leaders of terrorist groups great flexibility in conducting their campaigns, but they also conserve manpower resources. Unlike homicide or suicide bombings, shooting attacks do not require the gunman’s death and allow repeated use of hunter/killer packs in hit-and-run operations. The pack members grow more skilled from kill to kill.”
Shooting attacks may be conducted on foot in either urban or rural areas, or they may be drive-by shootings. An article in USA Today (issue dated 23 May 2006) describes a typical attack scenario in Iraq. “Gunmen opened fire on Iraqi laborers and ironsmiths travelling to work north of Baghdad, killing seven people and wounding eight.”
An article in The Guardian (issue dated 30 May 2006) describes a similar incident in Afghanistan. “Four aid workers were killed by a gunman riding a motorbike in northern Afghanistan today, officials said. Three employees of Action Aid International and their male driver – all of whom were Afghan – died when the gunman pulled up alongside their vehicle and opened fire.”
To date, Al Qaeda and its associated networks have not carried out any shootings in the UK (although they’ve claimed responsibility for the shooting of a British national in Riyadh, Saudi Arabia back in September 2004). However, the security manager only has to look to recent British history to assess the likelihood of such a scenario.
The Metropolitan Police Service web site states that “during an exceptionally busy period between 1970 and 1997, the Anti-Terrorist Branch investigated 1,312 bombings and 58 shootings.” These included the murder on 8 September 1989 of the German wife of a British soldier shot in Germany, and the 26 October 1989 murders of an RAF Corporal and his six month-old child, all of them killed by two IRA gunmen in Germany.
Lessons learned from both the Provisional IRA of old and the international lessons of Iraq and Afghanistan today point to the likelihood of shooting attacks occurring in the UK in the not-too-distant future.
Our private security sector is unarmed
Given that a terrorist shooting attack in the UK seems a case not of if it’s going to happen but when, what actions can the security manager take to manage risk in a country where the private security industry’s operatives are unarmed?
While strict access control to the facility being protected – using such technical devices as metal detectors and X-Ray machines in conjunction with bullet-resistant doors – may deter the terrorist at the ‘intelligence gathering’ stage and encourage him or her to choose a softer target, unless these are backed by the threat of a lethal (ie armed) response, the determined terrorist may choose to attack the facility anyway by targeting those en route to/away from the facility.
For instance, the security manager of a major sporting venue would be powerless to prevent a terrorist shooting on a gathering of sports fans walking en masse to a stadium for a game, irrespective of the security measures put in place at the stadium itself.
There is, however, some scope for risk management by the security professional when it’s an individual within the organisation, rather than the organisation itself, that’s being targeted. The use of a specialist close protection team could manage the risk to, say, the CEO of a multi-national company. Although unarmed, a good close protection team using route selection and reconnaissance (together with solid vehicle escort procedures) will make it as difficult as possible for a terrorist team to assassinate or kidnap anyone.
How to deal with sniper attacks
Linett also believes the sniper to be “the most feared and loathsome of killers, dealing ‘death from afar’ to use the military jargon… The sniper is a marksman able to hit targets at ranges of 1,000 yards or more.”
The word ‘sniper’ comes from a play on words by British Soldiers in India as early as 1773. Here, troops hunted the snipe – a small, quick, bird that was difficult to shoot. Successful shooters were dubbed ‘snipers’.
The British Army’s sniper cadre lasts six weeks, and concentrates on the seven basic sniper skills: sniper knowledge, navigation (map reading and aerial photography), concealment, observation, stalking, judging distance and shooting. Other militaries around the world follow a similar training plan for their own snipers cadres.
In November 2005, the insurgency group Islamic Army in Iraq released video footage of sniper attacks against US soldiers in Iraq, allegedly the work of ‘Juba’, a member of their forces who is an accurate sniper and who has killed and wounded up to 100 US soldiers.
An article in The Guardian (dated 5 August 2005) says of Juba: “They have never seen him. They hear him, but by then it’s too late: a shot rings out and another US soldier slumps dead or wounded. There is never a follow-up shot, never a chance for US forces to identify the origin, to make the hunter the hunted. He fires once and vanishes.”
To date, Al Qaeda and its associated networks have not carried out a sniper attack in the UK. However, as with shootings the security manager only has to look to recent British history to assess the likelihood of such a scenario.
Sniping by the Provisional IRA
In Northern Ireland during the 1990s, the South Armagh unit of the Provisional IRA maintained a sniping campaign against the British Army and the RUC. The last British soldier to die in the conflict, Stephen Restorick, was killed by an M82 Barrett sniper rifle in 1997. The Provisional IRA sniper Michael Caraher was later arrested, and his M82 captured by the British Army.
In the US the case of the so-called ‘Washington Sniper’, John Allen Muhammad, also shows the effectiveness of a sniper-based terror campaign. An expert rated marksman who had previously served in both the US National Guard and the US Army, Muhammad used a Bushmaster XM-25 rifle to kill ten people and seriously wound three more in a three-week shooting spree during 2002.
With regards to what actions the security manager can take to manage the risk posed by a sniper, the answer is little or none. Where snipers are concerned, it takes one to catch one, which is why the best counter-snipers inevitably begin their careers as snipers. The services of counter-snipers are not available to the private sector.
However, there is some (albeit miniscule) scope for risk management by the security manager when it’s an individual within the organization being targeted. Close protection will again come to the fore in obscuring the identity of the target. For instance, when the target is jogging, golfing or ski-ing members of the close protection team can wear similarly coloured clothing and help to make target acquisition more difficult.
Although members of the team will generally only have the chance to react after the first shot has been fired, should this not prove critical the team may be able to move the target rapidly to hard cover, in turn preventing a follow-up shot from being fired.
Roadblocks: classic hit and run terror tactics
Roadblocks are the classic hit-and-run terror tactic, used by terrorists who want to kill or kidnap and live to do it again. If the terrorists are going to use firearms, they simply want to surprise you, stop your vehicle, spray you and your passengers with their M16s and AK47s and then escape.
Roadblocks divide into three types: improvised (using trees, large rocks or boulders), vehicle (where a vehicle is placed 90 degrees to the flow of traffic) and moving (where a vehicle is used to overtake and then block a targeted vehicle). The latter of these option ss often used in Iraq as a precursor to kidnappings.
An article in the China Daily (dated 25 July 2004) describes a typical attack scenario: “The kidnapping of a diplomat and a top businessman indicated that militants, who had previously preyed on truck drivers and other foreign workers, may be changing tactics and were now aiming much higher in their effort to weaken the coalition. In the latest kidnapping, unidentified men riding in two cars blocked Raad Adnan’s vehicle as he was driving through south eastern Baghdad on Saturday and snatched him.”
Were such a tactic to be employed in the UK it would undoubtedly take place on secluded stretches of road. Victims could either be killed on the spot or be taken to remote locations and murdered in a controlled environment in a manner similar to the videotaped beheadings of hostages seen in Iraq.
For the security manager, the management of such a risk would be limited to ensuring that ‘at risk’ employees were taught the basics of anti-ambush diving. For those employees such as CEOs who may be most at risk, the deployment of a close protection team using two or three vehicles may also be considered.
Potential for a roadside terrorist ambush
Just about any location from which they think they can make a successful getaway holds the potential for a terrorist ambush on passing vehicles. There’s only one ingredient absolutely necessary to their recipe – near the site of the ambush, their must be a place to position a getaway vehicle or to find sanctuary.
In Iraq, such roadside ambushes are often initiated with a directional-shaped charge. The EFP (or Explosively Formed Penetrator) is mounted on crash barriers at window level where vehicles must slow down at choke points such as intersections and junctions. This gives the operator time to judge the moment to strike because the vehicle is moving more slowly.
Detonation is controlled by cable, radio control or remote arming with a PIR trigger. The intent is to penetrate the vehicle crew compartment, allowing the shooters to ambush a largely defenseless crew.
As with roadblocks, were a roadside ambush to take place in the UK it would undoubtedly occur on a secluded stretch of road. The ability of the security manager to manage risk would be limited to the provision of anti-ambush driving courses for ‘at risk’ employees.
Bombing tactics constantly evolving
Linett suggests that “the tactics of terrorist bombers are constantly evolving. As they develop more powerful, compact and lethal bombs, they also develop new ways to exploit their improved capacity to inflict mass murder.”
The bomb itself may be concealed in a variety of ways: in food (“a large can of coffee, a box of cornflakes, even a watermelon have been discovered to contain bombs”), in electrical devices (“pocket calculators, Game Boys and mobile telephones have all been used to conceal explosives”), in carry bags (“briefcases, handbags and suitcases, the bigger the case the bigger the bomb… and the target”) and in vehicles (“cars, SUVs, vans and light pick-ups are used as anti-personnel bombs, while larger trucks are used against structures”).
Al Qaeda has been responsible for numerous bombings: the bombing of the World Trade Centre in February 1993, the twin bombings of the US Embassies in Kenya and Tanzania in August 1998, the bombing of the warship USS Cole in the Yemeni port of Aden in October 2000, the Bali bombings of October 2002 and October 2005, the synchronised detonation of ten bombs placed on commuter trains in Madrid in March 2004 and the co-ordinated bombing of three underground trains and one bus in London during July 2005.
Given that “the number of ways terrorists can plant and detonate their bombs is limited only by their creativity, determination, patience and ruthlessness” (Linett 2005), what scope does the security manager have to manage against the risk of further atrocities?
As with snipers, the answer is little or none. Strict access control to the facility being protected – using a combination of metal detectors, X-Ray machines and bomb-sniffing scanners, together with counter-terrorist vehicle control systems such as delta barriers – will not prevent a Vehicle Borne Improvised Explosive Device from simply being detonated in the adjacent street, having been packed with a larger quantity of explosives beforehand.
Abductions, hijackings and takeovers explained
Abductions, hijackings and takeovers are among the most classic of terrorist tactics. If the operation is sufficiently large scale or high profile, it serves the terrorist agenda for worldwide publicity with resulting increases in volunteers and financial support.
Classically, the terrorist organisation concerned believes that it can trade kidnap victims for imprisoned members of their groups. A more recent manifestation of this tactic, used in Iraq, is detailed by Linett. “Terrorist groups fighting American forces have taken to snatching soldiers, relief workers and foreign laborers and using them as pawns to further their agendas. If the victim’s Government refuses to comply with the terrorists’ demands, they’ll likely be beheaded on videotape. The entire grisly procedure is broadcast worldwide over the Internet.”
At any given time, between 20% and 25% of all warnings about active terrorist operations in Israel relate to attempted kidnappings of members of the uniformed services. This tactic may already have arrived in the UK. An article in The Sunday Times (edition dated 4 February 2007) refers to a series of kidnappings and beheadings ordered by Al Qaeda.
“The strategic assassination instruction was issued by Al-Qaeda’s leaders in Pakistan and Iraq to dozens of their followers in this country. It was uncovered by MI5 last autumn, senior security sources say. As a result, police are on standby for multiple attempts by terrorists to kidnap and then behead people across Britain. MI5 is conducting a counter-terrorism surveillance operation to prevent such an attack. The alleged attempt to kidnap and behead a Muslim soldier or soldiers in Birmingham was just the first of a series of planned attacks.”
How can the security manager best manage the risk related to abductions, hijackings and takeovers? While little can be done to prevent the kidnap of a given individual, dedicated hostage/kidnapping awareness training courses are available to increase the likelihood of the victim coming through the event unscathed. These courses, taught by companies such as Rapport, include training in personal security awareness, the aims of a hostage, resistance, behaviour under stress and hostage-captor bonding.
Major conclusions to be drawn
At the outset I asked to what extent can the security manager reasonably be expected to prevent a terrorist attack, and whether terrorism was indeed a form of risk that is impossible to manage?
As can be seen in the examples provided throughout this polemic, the answer largely depends upon the nature of the terrorist attack itself. Against a sniper or a Vehicle Borne Improvised Explosive Device, terrorism would indeed seem to be a form of risk that is impossible for the private security manager to manage.
However, against the intelligence gathering that precedes these, or any other, terrorist attacks an awareness of hostile reconnaissance among those security officers and CCTV operators employed to protect the facility – combined, where appropriate, with the use of a plain clothes counter-surveillance team – would appear to offer considerable scope for the management of risk.
Intelligence analyst Crispin Black believes that “the real killer likely to emerge from Iraq is what analysts call ‘blowback’ – shorthand for the likely diaspora of terrorist know-how and motivation from Iraq in the future… Iraq may not just have been a radicaliser – it may also be the best training ground there is.”
If the private sector security manager is to effectively manage the greater risks yet to come then disrupting the terrorist attack cycle at the planning stage would seem be the best place to start.
Alan Cain is the operations manager for ISS Pegasus (City and East). Prior to this role, Alan was the security manager at the US Embassy in London. He has also served with the British Army in both Iraq and Afghanistan.
This essay formed part of Alan’s course requirements for the MSc in Security and Risk Management
Bibliography
Al Qaeda Training Manual, ‘Military Studies in the Jihad Against the Tyrants’ (www.usdoj.gov/ag/trainingmanual.htm)
Association of Chief Police Officers and Joint Security Industry Council, ‘Aide Memoire for Police and Security Officers’
Managing Risk and Security (2003), Leicester University, Module 4, Unit 1, Perpetuity Press: Leicester
Metropolitan Police Web Page (2007), ‘Anti-Terrorist Branch History’ (www.met.police.uk/terrorism)
US Department of Homeland Security Joint Information Bulletin (15 May 2003), ‘Potential Indicators of Threats Involving Vehicle Borne Improvised Explosive Devices’
Black, C (2005), ‘7-7: The London Bombs. What went wrong?”, Central Books: London
Cannon, M (2004), ‘Airport Surveillance and Targeting Threat” (www.drum-cussac.comlfeatlfeat2.html)
Linett, H (2005), ‘Living with Terrorism: Survival Lessons from the Streets of Jerusalem”, Paladin Press: Boulder, Colarado
Toft, B and Reynolds, S (1997), ‘Learning from Disasters: A Management Approach”, Perpetuity Press: Leicester
Williams, A and Head, V (2006), ‘Terror Attacks: The Violent Expression of Desperation”, Futura: London
cool