Article updated 3/16/2019 to reflect new information about the incident.
What happened: A series of attacks were launched on two mosques in the New Zealand city of Christchurch. Both the Masjid Al Noor Mosque in the center of the city and the Masjid Mosque in the nearby suburb of Linwood were attacked by a man armed with multiple long guns. Improvised explosive devices were found in the vehicle as well.
Status: At the time of this report, it’s believed that at least 49 have been killed and nearly 50 injured in the attacks. Police initially took four people into custody, but said only three were connected to the attacks. Citizens captured video footage showing one of the suspected attackers being taken into custody.
The horrific attacks in New Zealand occurred just hours ago, and details are still unfolding, but there are already several critical takeaways emerging from these terror attacks:
1. The value of social media intelligence.
Information from Australian media sources indicates the attacker at the Masjid Al Noor Mosque posted images of his firearms – inscribed with the dates and names of historical battles in which Muslim armies were defeated, and with the names of the warriors who defeated them – on Twitter in the days leading up to the attack. Additionally, the killer wrote a 73-page manifesto that detailed his intentions, and live-streamed 16:56 minutes of video on Facebook during his approach to, attack on and flight from the mosque. Today’s terrorists and active shooters are tech savvy and adept at using social media platforms to document their activities. They do this to boast, to feel important, to create a desired legacy, to inspire others, to disseminate a message and to spread terror. It’s important for law enforcement to be engaged in the social media and internet arenas, and to encourage the public to report suspicious behavior in cyberspace since many offenders openly display pre-attack indicators online. There is a wealth of information and actionable intelligence for law enforcement in cyberspace, and police need to be trained, organized, equipped, manned and prepared to make use of online intelligence within legal and ethical constraints.
2. The public must assume a role in their own defense.
I’ve written about what I call the “third generation” of active shooter response, and this tragedy underscores my points. Regardless of where you are in the world, whether it be a synagogue in Pennsylvania, a church in Texas, or a mosque in New Zealand, the police will almost always be absent when the attacker strikes. Faith-based organizations, schools, workplaces and public venues must take an active role in their own security, and leave behind the fiction that the police will be able to protect them from evil during the initial minutes of an attack. The public must embrace target hardening, security protocols, emergency response training, security teams, medical training, emergency communications and armed defense preparations to ensure they can discourage attacks, deny access and defeat attackers prior to police response. In the live-streamed attack on the Masjid Al Noor Mosque, the attacker was on site for six minutes killing innocents and was able to escape and take his attack mobile, several minutes before police responded. Time is a precious commodity in attacks like these, and the killing is often done before the police have arrived. It’s no longer acceptable for the public to outsource their security to the police – they must take an active role in their own defense and defense preparations.
3. We face well-armed and skilled attackers.
Video evidence from the Masjid Al Noor Mosque shows the killer was armed with at least five long guns when he started the attack, large quantities of ammunition and several gasoline bombs. The footage also indicates the killer had previous experience with his firearms and was reasonably skilled with a variety of weapon types. The killer began his attack with a semiauto shotgun, continued with two semiauto rifles and finally used a pump action shotgun in the livestream footage. He executed multiple magazine changes, cleared malfunctions and even removed magazines to check on his remaining capacity, showing a certain degree of tactical acumen. Police officers often deal with criminals who are poorly armed and skilled, and this can encourage an officer to be dismissive of potential threats. It’s critical, however, to avoid underestimating the enemy. An active shooter might be armed with a subpar weapon and might lack skill, or he might be much better equipped than you, skilled with his tools and using good tactics. As SWAT Commander and tactical trainer Dan Murphy (NTOA) says, “You should always pick and use tactics for the 2 percent threat.” Assume your enemy is highly skilled, prepared and armed, and plan your response accordingly.
4. Complex, coordinated attacks complicate response.
Most active shooter events involve a single individual, acting with little preplanning and using limited weaponry. These so-called Level One attacks are the ones most agencies are prepared to handle, but as the number of attackers and the sophistication of their attacks increases, many law enforcement agencies are quickly overwhelmed by circumstances. It appears that the pair of mosque attacks may have been carried out by a single individual, but his rapid movement from one scene to the next gave the assault characteristics similar to complex, coordinated attacks (CCAs), or Level Three attacks, involving multiple attackers, working in concert. The near-symphonic nature of these attacks made them incredibly disorienting and highly complicated the police response. Top experts in the field of active shooter studies, like NTOA’s Don Alwes, have been warning us for years that we’re going to see more CCA or “swarm” tactics used by our adversaries – like those seen in Paris and Mumbai before – because they can be paralyzing. Make sure your agency is prepared to respond to this level of threat.
5. We must prepare for mobile attackers.
The shooter at the Masjid Al Noor Mosque spent six minutes on site killing innocents, then fled the scene in a car. During his escape, he engaged multiple innocents with shotgun fire from his moving vehicle, shooting through his windshield and side windows to do so. It then appears that he drove approximately 2.5 miles to a second mosque in Linwood, to carry out another attack there, before fleeing again. The mobile nature of the attack complicated the police response and allowed the shooter to operate inside the OODA loop of the responding police for a while. It can be hard to assimilate information quickly in fast-breaking circumstances, but we must do our best to put training and processes in place to rapidly extract useful intelligence (like direction of travel, weapons, or troop strength) from 911 calls and other reports (including social media). Additionally, since attackers often go mobile, it’s important we do not commit all assets to the original crime scene – supervisors must act to leave some forces in reserve, to respond to secondary attack locations or participate in a pursuit when the suspect is located.
6. Situational awareness must be ever-present.
Units must maintain a high degree of situational awareness as they respond to these attacks. At several points during the killer’s escape from the Al Noor Mosque, he was passed by emergency vehicles going the opposite direction, responding to the mosque. If any of these units had noticed the car with the gunfire-shattered windshield and side window, it is possible they could have intercepted the killer more rapidly, possibly before he got to the second mosque. It’s very hard to avoid tunnel vision when stress is high, so it’s important to use techniques like autogenic breathing to lower stress levels and increase perception and awareness.
7. Assume IEDs are on scene.
The killer apparently rigged his vehicle with IEDs, which were discovered at the termination of the pursuit. Video footage from the Al Noor Mosque attack clearly indicates the killer had gasoline cans in the trunk of his vehicle that may have been configured as incendiary devices. Police responders must assume the presence of IEDs in these kinds of attacks due to the proliferation of IED information, technology and tactics, and must use appropriate tactics and countermeasures when they respond.
We will certainly learn more as the investigation into these attacks matures, but we cannot wait to start our own preparations to respond to this kind of event. We already have a lot of actionable intelligence to work with, so make use of the time and opportunity to prepare.
We at Police1 extend our deepest sympathies to the families and friends of the victims of these cowardly attacks and ask you keep the first responders in your thoughts as they deal with the impact of this evil attack.
