“Whether a plan for a terrorist attack is homegrown or originates overseas, important knowledge that may forewarn of a future attack may be derived from information gathered by state, local, and tribal government personnel in the course of routine law enforcement and other activities.” —Office of the Director of National Intelligence
In 1990 I was a police recruit in Jacksonville, Florida. During our firearms training, Special Agent Ron Worth from the FBI gave a lecture on machineguns and other Title II weapons. The lesson was informative but routine. What stuck out to me, though, had nothing to do with firearms. After covering the ins and outs of fully automatic weapons, S/A Worth went off script and gave one of the most rousing “survival mindset” lectures I have ever heard. During his speech, he thundered, “Police officers are the backbone of law enforcement!”
As a young rookie with no experience, this statement left a big impression on me. In 1999, I joined ATF, where I served as a Special Agent for the next 20 years. S/A Worth’s words were confirmed over and over again as I developed vital partnerships with officers from coast to coast. Sometimes, patrol officers do not imagine themselves or their work to be of great importance. This is simply not the case. The law enforcement machine would grind to a halt without them.
This certainly applies to the topic of terrorism. American patrol officers have arrested multiple terrorists after bombings or active-shooter events. After the Oklahoma City bombing, Timothy McVeigh was arrested by Trooper Charles Hanger on a traffic stop. Centennial Park bomber Eric Rudolph was arrested by Officer J.S. Postell while Rudolph rummaged through a trash bin in Murphy, N.C. Boston Marathon bomber Dzhokhar Tsarnaev was arrested after a massive manhunt by state and local law enforcement officers. Syed Farook and Tashfeen Malik were shot dead in a gun battle on a San Bernardino street with police officers four hours after their Dec. 2, 2015, rampage. Police officers have always been on the front line in the battle against foreign and domestic terrorism.
As a police officer, you are always “on duty” even when you are not on the clock. You know your beat, your town and the people who live there like no one else. This is why it is crucial for you to be aware of the steps that have led to terrorist attacks in the past. By learning to recognize the phases of the Terrorist Attack Cycle, you may be able to break the cycle before plans are finalized and lives are lost. The phases of the cycle are:
- Preliminary target selection
- Initial surveillance
- Final target selection
- Pre-attack surveillance
- Planning
- Rehearsal
- Execution
- Escape and exploitation
Let’s take a look at each phase and some historical examples.
1. Preliminary Target Selection
Preliminary target selection is dependent on the motive of the terrorist. According to the FBI, the Animal Liberation Front (ALF) engages in “direct action” against companies or individuals who utilize animals for research or economic gain. The Earth Liberation Front (ELF) advocates “monkeywrenching,” a euphemism for acts of sabotage and property destruction against industries and other entities perceived to be damaging to the natural environment. International terrorist groups may focus on critical infrastructure components or symbolic locations. Domestic terrorists may focus on government entities they deem to be unjust.
You must be aware of potential targets within your area of responsibility (AOR) and pay close attention to them. Potential targets may include public utility hubs, cultural sites, government buildings, outdoor gathering places, houses of worship, military bases and schools, to name a few. Make a list of potential targets on your beat and conduct unscheduled patrols there. Stop and talk with security personnel or other employees at irregular times. Drive by at night and check the perimeter. This tactic, as simple as it seems, is known as a “random anti-terrorism measure” (RAM). Such measures make it difficult for terrorists to determine an exact time when it would be safe to conduct their attack. Although suicide bombers are a reality, history has shown most terrorists typically want to escape and continue their campaign.
2. Initial Surveillance
The initial surveillance phase of the terrorist attack cycle is a particularly vulnerable time for terrorists because they must linger in or around the target location to gather intelligence. While much can be gained from internet searches, terrorists desire current, accurate information to develop their strategies. They need to have eyes on the target, especially if they intend on launching an attack inside a structure.
To capitalize on this vulnerability, you need to think like a terrorist. Once you have identified a potential target in your AOR, you need to identify the crucial asset present there. Is the asset the students at the elementary school? Is it a research laboratory where animal testing is done? Is it a chemical storage facility? Now, ask yourself where a person would have to position themselves to view that asset. Find the best surveillance position for a potential terrorist to use.
Once you have determined the ideal surveillance position, find a place to observe it. It may be a block away with binoculars or on a hilltop close by. Just be sure that you are outside of the immediate area and can view the ideal surveillance spot. A person in the ideal surveillance spot using a camera or binoculars to view a site that you have determined to contain vulnerable assets is worth talking to. Is he or she in violation of the law? Maybe not. Is it worth a consensual encounter and an information report? Absolutely.
3. Final Target Selection
Once terrorists have conducted initial surveillance, they will make their final target selection. Terrorists desire their attacks to be in public with a high body count. Think of the attempted car bombing in Times Square by Faisal Shahzad in 2010. After his arrest, Shahzad admitted he had recently received bomb-making training in Pakistan and that, had he not been arrested, he intended to detonate another device in New York in the near future. The Tsarnaev brothers’ bomb attack at the Boston Marathon, an international event, was broadcasted globally as it happened.
Take these factors into account during your patrols. What locations or entities in your AOR would be newsworthy if attacked or worth using violence to disrupt?
4. Planning
The planning phase is another opportunity to disrupt the cycle. During this phase, the terrorists must make purchases or other transactions that could create video surveillance footage, witnesses or a paper trail. Remember that before the 1993 World Trade Center bombing Mohammad Salameh rented an apartment, a vehicle and a locker where he and others stored bombmaking materials. He reported the van stolen two days later to develop an alibi. With this in mind, should you look at the report of a stolen rental van or truck more closely than other auto thefts?
Salameh and his co-conspirators purchased several tanks of hydrogen gas to enhance the explosion. Is there a source for hydrogen gas or other hazardous materials in your AOR? Does the proprietor have your number on hand? These stories and others are not classified or top secret. They have been the subject of movies and television for years. Business owners and their employees are aware of past incidents and may recognize suspicious purchases. But they may be afraid to voice suspicions for fear of being labeled an alarmist or a racist. If you have established a rapport during your visits, they will be more apt to call when something raises their suspicion.
To learn more about the rapport-building process officers should familiarize themselves with the Bomb-Making Materials Awareness Program. [1]
5. Rehearsal
The rehearsal phase of the terrorist attack cycle allows the terrorists to see if their attack is feasible and finetune their plot. The 9/11 Commission Report describes how a conspirator named Tawfiq bin Attash, aka “Khallad,” tested airport security measures by carrying a box cutter on board an American aircraft in his toiletries bag. [2] He then removed the bag from his carry-on luggage and observed that the flight staff paid no attention. Khallad was also involved in the 1998 embassy bombings and the attack on the USS Cole. The 9/11 Commission Report goes on to describe how the “muscle” hijackers were trained in Afghanistan to hijack airplanes, disarm air marshals, use knives effectively and handle explosives.
Where might terrorists rehearse in your AOR? Firearm ranges? Paintball facilities? Public lands? Take reports of unauthorized shooting or “militia” activity seriously. Since investigation of these activities may be beyond your scope, pass the information along. The Suspicious Activity Report (SAR) process is critical to sharing information about suspicious activity with a potential nexus to terrorism, which can help prevent terrorist attacks and other related criminal activity. [3]
6. Pre-Attack Surveillance
The surveillance potential attackers do before the attack is another vulnerable time when they may expose themselves. In 2006, Ehsanul Islam Sadequee and Syed Haris Ahmed were charged in a terrorism case. Investigation revealed, among other things, that the duo traveled to Washington, D.C., to shoot “casing videos” of the Capitol building and other potential targets. [4]
Indicators of pre-attack surveillance include video recording, making sketches, eliciting information from security personnel, probing secure areas to see if they can gain access, and calling in hoax bomb threats in order to observe the law enforcement response. These indicators are often recognized and reported via 9-1-1. According to the National Institute of Justice, new processes allow the information to be analyzed and synthesized to point investigators in the right direction. [5]
7. Execution
The execution phase may hard to detect before it occurs. However, an alert officer still may be able to disrupt the attack. An illegally parked car or unattended backpack at an area you have deemed to be a possible target may contain an improvised explosive device. A van load of strangers lingering in an area where they have no business may be staging for an attack. A lone individual in an idling car near one of your locations may be a “getaway” driver.
This is not paranoia. It is preparedness. Richard Reid, commonly known as the “shoe bomber” attempted to detonate a shoe bomb while on an American Airlines flight in 2001. Alert passengers realized he was trying to light a fuse and restrained him until the plane landed. Although stopping a plot in the execution phase is difficult and rare, it is not impossible.
8. Escape and Exploitation
The final phase of the terrorist attack cycle allows the terrorist to fight another day and claim a victory. After you have determined certain locations in your AOR to be possible terrorist targets, look for routes of escape. Where would you go if you were fleeing the area? Planning ahead like this may allow you to intercept the attackers immediately after the event.
Exploitation is typically not in the investigatory purview of patrol officers; nonetheless, it is informative. In 2019, a member of the Royal Saudi Air Force opened fire at Naval Air Station Pensacola, where he was receiving training, killing three people and wounding eight. Before the shooting, the gunman had coordinated with al-Qa’ida in the Arabian Peninsula (AQAP), which claimed credit for the attack.
It’s Up to You
Since 9/11, the government has increased anti-terrorism funding and personnel dramatically. Joint Terrorism Task Forces (JTTF), Fusion Centers, bomb squads, and SWAT teams are better equipped than ever. Whether you are a police officer, deputy sheriff or state trooper, it is crucial for you to remember that the JTTF and Fusion Centers are analyzing reports generated by you. Likewise, specialized units are typically responding well after you have arrived and coordinated the scene. The patrol officer is still the tip of the spear and the backbone of law enforcement. Stay safe!
Additional References
1. Cybersecurity & Infrastructure Security Agency. Bomb-Making Materials Awareness Program.
2. The 9/11 Commission Report.
3. Nationwide SAR Initiative (NSI).
4. Prosecutors allege suspects shot ‘casing video.’ MSNBC.
5. Strom S, Hollywood J, Pope. Using 911 Calls to Detect Terrorism Threats. NIJ Journal, Issue 263, 6/1/2009.
