Evolution and Trends in Terrorism Tradecraft

October 11, 2012

By Scott Stewart

The terrorist tradecraft discussed in last week's Security Weekly does not happen in isolation. The practitioners of terrorist tradecraft conduct their activities in the midst of other people -- the authorities attempting to identify them and thwart their plans as well as civilians. Terrorist tradecraft also does not remain static. It is constantly evolving. These changes are prompted not only by countermeasures put in place to prevent terrorist attacks but also by advances in technology -- a powerful force that can serve to either nullify old tradecraft practices or to provide new tools to the purveyors of terror.

Terrorism is an enduring reality. While geopolitical changes may cause a shift in the actors who employ terrorism as a tactic, terrorism will continue to be used no matter what the next geopolitical cycle brings. It is, and will continue to be, a tactic used by militant actors who want to confront a militarily superior enemy. Focusing on the tradecraft used in attacks and charting its changes and trends not only permits observers to understand what is happening and why but also provides an opportunity to forecast what is coming next.

Documents

In the early terrorist plots of the late 1800s, many of the foundational tradecraft requirements were aided by the general simplicity of the times. Among the foundational tradecraft requirements discussed last week was procuring identification documents. Public records were very sparse, did not usually contain people's photographs and tended to be decentralized and not easily searched. (This is still true in some parts of the world today, such as in Afghanistan and Somalia.) There were no universal identification cards such as driver licenses, because automobiles had not yet become common. Passports and visas were not widely required for travel until after World War I, and even then the records of passport and visa issuance as well as traveler entries and exits were localized, hand-written entries into ledgers and were hard to search.

During this time, it was not difficult for Irish Fenian, nihilist or anarchist terrorist actors to travel, rent safe-houses or raise and transfer funds. Communication was certainly more difficult for everyone at that time -- authorities as well as terrorists. The mail system was slow, and while telegrams could be sent quickly, they were seen by many people. Law enforcement agencies did not communicate or coordinate very well across jurisdictional lines within one country, much less on an international scale.

During World War I, concerns over spies and saboteurs caused important changes to international travel, including stricter passport and visa requirements. This also had an impact on terrorist actors, such as Irish Republican Army members traveling to and from the United States or England, but early passports, visas and other identification documents were often hand-written and easily forged or altered. During this era, it was also still quite easy to assume the identity of an infant or young child who had died, because birth and death records were not often cross-referenced -- especially if they happened in different locations. This practice is referred to as an infant death identity in document-fraud investigations. Nazi and Soviet espionage agents used infant death identity quite frequently, which resulted in changes to the way records were kept, but domestic and international terrorist operatives continued to use infant death identities into the 1960s and 1970s.

Advances in technology in the 20th century allowed countries to make their identification documents more resistant, but not immune, to counterfeiting and alteration. The real difficulty in using counterfeit or altered documents started when the documents were linked to a central computerized database. This meant that counterfeit passports and visas did not show up in the databases and allowed a quick photo comparison to ensure that passports with altered photos could not be as easily used. In 1988, Japanese Red Army bombmaker Yu Kikumura was able to enter the United States using an altered Japanese passport.

In 1992, al Qaeda bombmaker Ahmed Ajaj was arrested trying to come through immigration at New York's John F. Kennedy International Airport using a Swedish passport in another name altered to bear his photo. His partner, Abdul Basit, ditched the altered passport he used to board the flight in Karachi, Pakistan, and used an authentic Iraqi passport in the name Ramzi Yousef to claim political asylum. In the 9/11 plot, and in all the follow-on al Qaeda plots directed against the United Sates, al Qaeda operatives have used authentic travel documents to enter, or attempt to enter, the United States. Some of the 9/11 operatives did commit document fraud in relation to driver licenses and state identification cards, but as outlined in the 9/11 Commission Report, that fraud almost resulted in the unraveling of the plot.

Changes in technology and enforcement in the United States and Europe have caused changes in identity and travel tradecraft for transnational jihadists, who are now searching for "clean skin" operatives who are unknown to law enforcement and who have the ability to travel internationally using legitimate travel documents.

Explosives

Bombing has been a staple of terrorism since Guy Fawkes and his co-conspirators' failed attempt to destroy the British Parliament in 1605 in the so-called Gunpowder Plot. The invention of dynamite in 1867 was a very big boon for early terrorists, who no longer had to use black powder, a low explosive, as the main charge in their devices. Dynamite was not only more stable and less sensitive to moisture than black powder but was also more powerful. Dynamite was widely used by Irish Fenians in their attacks, but perhaps the image of the anarchist bombthrower is the most iconic of that period.

In the age of modern terrorism, bombmakers have had the luxury of access to high-powered military explosives such as TNT, C-4 and Semtex. Technologies such as shaped charges, platter charges and explosively formed penetrators have also increased the impact of these powerful explosive compounds. Another development that has greatly altered the art of bombmaking has been the advent of microelectronics. Bombmakers can use sophisticated timers to activate a device days or even weeks after it is placed. They can also use sensors that detect motion, light, the presence of metal objects or changes in altitude in order to detonate the explosive device. Command-detonated devices using radio signals or cell phones have also been widely employed.

Perhaps one of the most influential bombmakers in the modern terrorist era is Abu Ibrahim, a former member of Black September, the Popular Front for the Liberation of Palestine and the 15 May Organization. Ibrahim is often referred to as the "grandfather of all bombmakers" for his innovative improvised explosive device design and his willingness to train other bombmakers in his dark arts. Ibrahim was an early adopter of electronics in his designs.

During the 1970s and 1980s, state sponsorship did a lot to help advance bombmaking tradecraft, as sabotage experts from the Soviet KGB and the East German Stasi passed on training and technology. (The Eastern bloc was also a very important source of funding and identification documents during this period.) In addition, state sponsorship meant that sponsors, such as Libya, could use the diplomatic pouch to transport weapons and explosive components to terrorist operatives in places like London and Paris.

Controls on the purchase of explosives, and even on items like ammonium nitrate fertilizer, which can be readily used to make homemade explosive mixtures, have made it more difficult in recent years to make improvised explosive mixtures. This has caused bombmakers to change to mixtures made from more readily available precursors, such as acetone and peroxide. But these mixtures tend to be not only more dangerous to brew -- the Palestinians refer to triacetone triperoxide, or TATP, as "the mother of Satan" -- they also have a limited shelf life, are less stable and more difficult to transport and correctly synthesize. In 2009, would-be New York City subway bomber Najibullah Zazi was frustrated in his attempts to manufacture viable TATP.

In the realm of targets and tactics, we've talked elsewhere of the arms race in aviation security and how it has caused the threat to aircraft to evolve, with the next likely step being non-metallic explosive devices hidden inside the bodies of suicide attackers. There has also been an evolution in the targeting of Western interests abroad. Embassies have become harder targets and Western hotels have been increasingly more desirable targets, although the Sept. 11, 2012, attack in Benghazi may shift terrorists' focus back to vulnerable diplomatic missions in volatile locations. 

Databases

Perhaps one of the most powerful inhibitors of terrorist tradecraft has been the use of computerized databases, allowing authorities to crunch a lot of data. One of the first well-documented uses of computers to locate terrorist suspects was the massive effort undertaken by the German Federal Criminal Police in the 1970s to combat the Red Army Faction. The German police created a database and then cross-referenced its information on a wide variety of indices. They then created a profile of the Red Army Faction safe-house with features such as young people living together, paying their rent and utility bills in cash and not registering with the local government or registering their motor vehicles. When a computer search identified addresses that matched the profile, they then dispatched detectives to investigate these possible safe-houses in person. This campaign was very successful in helping round up the first generation of Red Army Faction operatives.

Lists of terrorist suspects and their aliases have also proved quite useful in inhibiting terrorist travel, but it has not been without its failures or criticism. The U.S. State Department first adopted a database called TIPOFF in the 1980s designed to prevent terrorists from getting visas. The system was later turned it into the Visas Viper system after the 9/11 attacks. The United States has created the Terrorist Screening Center, which is charged with consolidating all the various U.S. government watch lists as well as administering the controversial terrorist watch list and the no-fly list.

Computers are also being used to monitor terrorist communication, whether by telephone, satellite phone or the Internet. But like the watch lists, these efforts have proved to be quite controversial. 

Seizing or freezing bank accounts associated with known terrorists and efforts to crack down on charities that were funding terrorist groups have been somewhat successful in limiting the money moving to terrorist entities. But the presence of significant informal money transfer networks has made it impossible to totally stop the flow. The ability of terrorist groups to use narcotics sales and other criminal activity to fund themselves has also been hard to stop.

Trends

Since the 9/11 attacks, the United States and its allies have spent billions of dollars on security improvements and have made great efforts to increase security and to counter the tradecraft used by terrorist groups. It is now more difficult for terrorist operatives to travel to the United States and Europe -- as evidenced by the lack of serious attacks and by the calls of groups such as al Qaeda in the Arabian Peninsula and the al Qaeda core group for grassroots terrorist operatives to conduct simple attacks where they are rather than travel overseas for training or to wage jihad. It has also led them to recruit individuals who have travel documents like Richard Reid, Najibullah Zazi and Faisal Shahzad for attacks rather than send well-trained operatives to conduct them.

Read more: Evolution and Trends in Terrorism Tradecraft | Stratfor 

Terrorism Tradecraft

October 4, 2012

By Scott Stewart

One of the distinctive features of Stratfor's terrorism and security analysis is its focus on the methodology of attacks. Of course, identifying those responsible for an attack is important, especially in ensuring that the perpetrators are brought to justice. But Stratfor believes that analyzing the way in which an attack was conducted is more important because it can prevent future attacks and protect potential victims. It is likewise important to recognize that even if a terrorist is killed or arrested, other groups and individuals share terrorist tactics. Sometimes this comes from direct interaction. For example, many of the Marxist terrorist groups that trained together in South Yemen, Lebanon and Libya in the 1980s employed similar tactics. Otherwise, a tactic's popularity is derived from its effectiveness. Indeed, several terrorist groups adopted airline hijacking in the 1960s and 1970s.

The mechanics of terrorism go far beyond target selection and the method of attack. This is especially true of aspiring transnational terrorists. Basic military skills may be helpful in waging terrorist attacks in areas where a militant group has access to men, weapons and targets -- such was the case with Ansar al-Sharia in Benghazi, Libya -- but an entirely different set of skills is required to operate in a hostile environment or at a distance. This set of skills is known as terrorist tradecraft.

Foundational Skills

Before an attack can be planned, an aspiring terrorist group must be organized, funded and trained. Would-be terrorists in Libya, Yemen or Pakistan's North Waziristan agency can achieve these things relatively easily. However, aspiring terrorists in New York, London and Paris encounter more difficulty. The recent arrests of such terrorists in the West, most recently the Sept. 15 arrest of a would-be jihadist in Chicago, show just how difficult it can be to find like-minded individuals to organize a terrorist cell.

Therefore, operational security is a critical skill that must be mastered to protect the fledgling organization from infiltration by law enforcement or intelligence agencies. Every person brought into the group decreases the group's operational security. So the very existence of the group must remain hidden, and every new member must be thoroughly vetted to ensure they are not plants. As the organization matures and becomes involved in actual attacks, operational security will continue to be vitally important to the organization's success and survival.

A key sub-skill to operational security is the ability to procure false identification documents. False identification is required for more than just international travel; these documents are required for domestic travel as well as for commercial transactions, such as buying or renting vehicles, procuring safe-houses and purchasing firearms, explosives and other components of manufactured explosives and improvised explosive devices. False documents are more important for operatives or organizations that want to attack continually than they are for suicide bombers, provided the authorities do not know the identity of the bomber and provided the bomber can travel to the operational destination.

Establishing a secure form of communication is also a priority. As a terrorist group grows, communication tradecraft must evolve beyond the verbal communication. Naturally, the more members a group has, and the farther away they are from one another, the more challenging secure communication becomes.

Once a group is securely organized, the members must fund their operations. Indeed, the ability to transfer funds clandestinely is a skill closely related to communication. Funding varies greatly from organization and location. Some terrorist groups obtain funding from the surrounding population. In places where the group is seen as fighting a colonial power or a dictator, financial support may be willingly given. In other circumstances, the population may give support grudgingly through extortion or informal taxes levied by the terrorist group.

State sponsors are another source of funding, as are wealthy individuals sympathetic to the terrorists' causes. Terrorists also are funded through illegal activity, including large-scale narcotics sales, which are frequently used by the Revolutionary Armed Forces of Colombia and the Taliban. Hezbollah generates revenue through cigarette tax fraud and through selling counterfeit goods and fake prescription drugs. Kidnapping is also an age-old method of funding terrorism.

The Attack

With organizational structure and funding in place, the terrorist organization can then turn to acquiring the skills necessary to conduct an attack. But to understand the tradecraft skills required to conduct an attack, one must first recognize that attacks do not happen randomly. They are the result of planning that follows a discernible attack cycle.

VIDEO: Stratfor on the Terrorist Attack Cycle

The specific skills required to conduct an attack can range from constructing an improvised explosive device to marksmanship, to driving a truck or even piloting a jumbo jet. Sometimes these skills can be acquired legally by joining a gun club or attending driver or pilot training. In other instances, skills like bomb making must be learned illicitly, either by trial and error or by attending a terrorist training camp.  

Perhaps the most important tradecraft skill in the attack planning cycle is surveillance tradecraft, or the ability to observe a potential target without alerting anyone that the target is being watched. The vulnerabilities noted during surveillance are frequently used in selecting the target. Further surveillance is often used to plan the attack, and then another round of surveillance may be conducted as part of the attack to track the target's progress to the attack site.

Planning the attack is another tradecraft skill, which requires the ability to observe a target, identify a security weakness and then contrive a means to exploit the vulnerability. The best planners devise novel approaches, such as using jumbo jets as human-guided cruise missiles, or invent ways to disguise more traditional devices, like improvised explosive devices, in such items as dolls, radios, shoes, underwear, bottles of contact lens solution, brassieres and pregnancy prosthetics.

An attack tradecraft component that has often proved vulnerable during the attack planning cycle is weapons acquisition. In fact, many attacks were disrupted when the plotters attempted to procure firearms or explosives.

Operational security continues to be important during the attack planning phase. Operatives must be able to create believable cover stories to explain their presence and actions in certain locations. This cover ranges from clothing -- wearing a telephone company uniform while conducting a kidnapping or dressing as a road repair crew member to plant an improvised explosive device, for example -- to renting a farm in order to purchase large quantities of ammonium nitrate fertilizer, a common ingredient in improvised explosive mixtures.

Projecting Power

Generally, these tradecraft skills are not concentrated in one member of a terrorist organization. Some people will be proficient at surveillance while some have a knack for making money or procuring weapons. Others may be good at manufacturing improvised explosive mixtures or assembling improvised explosive devices. However, this is true only of groups operating in their native areas.

The problem comes when a group wants to project power and conduct transnational attacks outside its core territory. In such a case, the group must identify a person proficient in a number of these tradecraft skills who can conduct an operation alone or with the assistance of a small group. This person must also be able to travel to the targeted country -- a requirement that has caused groups like al Qaeda in the Arabian Peninsula to attempt transnational strikes from afar. The fact that the al Qaeda franchise's attempts to go long have all failed -- the underwear bomber and the printer bomb plots, for example -- demonstrates how difficult such plots are.

source: http://www.stratfor.com

Read more: Terrorism Tradecraft | Stratfor

Terrorist Recognition Handbook

A Practitioner's Manual for Predicting and Identifying Terrorist Activities, Second Edition

for more, here is the link to get the book: http://www.crcnetbase.com/doi/book/10.1201/9781420071849

Terrorism and the Not-So-Exceptional Individual

May 24, 2012 | 0900 GMT

By Scott Stewart

In last week's Security Weekly, we used a thwarted underwear bomb plot, as well as the U.S. government's easing the rules of engagement for unmanned aerial vehicle strikes in Yemen, as an opportunity to examine the role of exceptional individuals in militant groups that conduct terrorist attacks. Al Qaeda in the Arabian Peninsula's (AQAP's) innovative bombmaker, Ibrahim al-Asiri, is one such individual.

Reported by AP on May 7, the news of the thwarted underwear plot overshadowed another event in Yemen that occurred May 6: a U.S. airstrike in Shabwa province that killed Fahd al-Quso, a Yemeni militant wanted for his involvement in the attack against the USS Cole in October 2000. Al-Quso appeared in a video released by AQAP's al-Malahim Media in May 2010, during which he threatened attacks against the continental United States, its embassy in Yemen and warships in the waters surrounding Yemen.

The media and the U.S. government frequently mention al-Quso's involvement in the USS Cole bombing, but they rarely discuss his precise duty the day of the attack. Al-Quso had been tasked to record the attack from ashore so that the video could be used later in al Qaeda propaganda. Unfortunately for the group, al-Quso was derelict in his duty; he slept through his alarm, and the attack went unrecorded.

Oversleeping a terrorist attack was not al-Quso's only operational gaffe. According to the 9/11 Commission Report, al-Quso had been dispatched in January 2001 to transport money to al Qaeda facilitator Walid bin Attash in Kuala Lumpur, Malaysia. The money reportedly funded the travel and initial living expenses of 9/11 operatives Nawaf al-Hazmi and Khaled al-Midhar. However, al-Quso failed to get a Malaysian visa. He was stuck in Bangkok, and bin Attash, al-Hazmi and al-Midhar had to meet him in Bangkok to retrieve the funds.   

If al-Asiri gives cause to discuss the role of the exceptional individual in terrorism operations, al-Quso provides us the opportunity to discuss the not-so exceptional individual -- and how these maladroit actors nonetheless pose a threat.

Tradecraft Errors

The history of al Qaeda's war against the United States is replete with examples of jihadist operations that were foiled due to tradecraft failures. In September 1992, Ahmed Ajaj attempted to enter the United States with a poorly altered Swedish passport while carrying a suitcase full of bombmaking instructions and other training manuals and videos. Both lapses in judgment are characteristic of a novice. An alert customs inspector stopped Ajaj, who later was detained and charged with passport fraud.

Ajaj was traveling from Osama bin Laden's Khaldan training camp in Afghanistan with Abdel Basit, also known as Ramzi Yousef, the mastermind of the 1993 World Trade Center attack. An immigration inspector likewise stopped Basit, but he requested political asylum. Because he was not carrying a suitcase full of bombmaking manuals or using an altered passport, Basit later was released pending a hearing on his asylum claim. (Had he remained in custody, the 1993 World Trade Center bombing would not have been conducted.)

In another instance of tradecraft error, the would-be millennium bomber, Ahmed Ressam, fell victim to "burn syndrome" while attempting to enter the United States from Canada in December 1999. Ressam panicked when approached by a U.S. customs inspector, who was performing a routine check of the ferry on which he was traveling. The inspector was unaware that Ressam was an Islamist militant or that he was in operational mode. In fact, when Ressam lost his composure, she assumed he was smuggling drugs rather than explosives.

The 9/11 Commission Report also detailed a number of errors committed by the supposed al Qaeda elite prior to hijacking the four aircraft on 9/11. Mohammed Atta was cited for driving with an invalid license and failed to appear at the subsequent court hearing, causing a bench warrant to be issued for his arrest. Moreover, known al Qaeda associates al-Hamzi and al-Midhar entered the United States under their own names. (A flight instructor even characterized al-Hamzi and al-Midhar as "Dumb and Dumber," saying they were "clueless" as would-be pilots.) Any of these errors could have brought down the entire 9/11 operation.

More recently, we have seen cases where individuals such as Faisal Shahzad and Najibullah Zazi have shown the intent, but not the ability, to conduct attacks. While Shahzad was able to assemble a large vehicle-borne improvised explosive device without detection, the design of the device's firing chain was seriously flawed -- clearly the work of a novice. U.S. government surveillance of Zazi's activities determined thathe was an inexperienced bombmaker and that he could not create the proper chemical mixture to manufacture effective triacetone triperoxide (TATP). This is common problem for novice bombmakers. We have seen several planned attacks, such as the London bomb attempt on July 21, 2005, fizzle out due to bad batches of TATP.

In another example, U.S. Army Pfc. Naser Jason Abdo was arrested and charged with planning an attack on Ft. Hood in July 2011. Abdo was brought to the attention of the authorities after purchasing smokeless powder to be used in an improvised explosive device. His furtive demeanor caused a store clerk to report him to the police.

As Stratfor has noted, there has been a shift in the jihadist threat. Once stemming from the al Qaeda core, the jihadist threat now emanates primarily from grassroots jihadists. While grassroots jihadists pose a more diffuse threat because they are more difficult than hierarchical groups for national intelligence and law enforcement agencies to detect, they also pose a less severe threat because they generally lack the terrorist tradecraft required to conduct a large-scale attack. Since they lack such tradecraft, they tend to seek assistance to conduct their plots. This assistance usually involves the acquisition of explosives or firearms, as seen in the February 2010 case involving Amine el Khalifi. In this case, an FBI informant posing as a jihadist leader provided the suspect with an inert suicide vest and a submachine gun before the suspect's arrest for plotting to attack the U.S. Capitol building.

The dynamic of would-be attackers reaching out for help has been seen repeatedly in the United States. In June 2011, two jihadists were arrested in Seattle and charged with plotting to attack a U.S. Military Entrance Processing Station in an industrial area south of downtown Seattle. The men attempted to obtain M16 rifles and hand grenades from an FBI informant. Notably, this trend also has been seen outside the jihadist world. On April 30, five self-identified anarchists were arrested in connection with a plot to destroy a bridge outside Cleveland, Ohio. They had purchased remotely detonated improvised explosive devices from an FBI informant.

The Cleveland group had previously discussed constructing improvised explosive mixtures using recipes they had found on the Internet. But the possibility of buying authentic C4 explosives was attractive to them because, according to the FBI criminal complaint filed in the case, the group believed the real explosives would be more powerful and destructive than homemade explosives.

Would-be attackers, such as Shahzad and the anarchists of the Cleveland group, typically do not have a realistic assessment of their capabilities and therefore tend to attempt attacks that are beyond their capabilities. In attempting a spectacular attack, they frequently achieve little or nothing. As we have previously noted, it is a rare individual who possesses the requisite combination of will, discipline, adaptability and technical skill to make the leap from theory to practice and become a successful militant in a lone-wolf or small-cell environment.

The Danger of 'Kramer Jihadists'

Through retrospective trial testimony or FBI arrest affidavits, the exploits of Abdo, el Khalifi or the Cleveland anarchists can appear almost comical. In fact, such cases often leave people wondering if ridiculous would-be attackers could be involved in terrorist activity to begin with. However, militant groups -- indeed, most organizations -- are composed of exceptional individuals and not-so-exceptional individuals. Just as the business world needs chief executive officers, engineers and assembly line workers, the militant world needs operational planners, bombmakers, foot soldiers and suicide bombers. Placed in the proper roles, these individuals can combine their efforts to produce effective results.

It is easy to dismiss novice militants as inept, but we should keep in mind that if some of these individuals found an actual terrorist facilitator rather than a federal informant, they probably would have killed many people in an attack. Richard Reid, often referred to as the "Kramer of al Qaeda" after the bumbling character from the television series Seinfeld, came very close to taking down a jumbo jet full of people over the Atlantic Ocean because he had been equipped and dispatched by those more capable than himself. Working under the leadership of exceptional individuals, even al-Hamzi and al-Midhar ("Dumb and Dumber") helped hijack American Airlines Flight 77, which was crashed into the Pentagon on 9/11.

The 1993 World Trade Center bombing provides a valuable lesson on dealing with Kramer jihadists. Before the attack, a government informant infiltrated the core group of perpetrators. After the informant proved to be too difficult to handle, coverage of the group was dropped because its members were considered inept. In truth, many of them were; one suspect, Mohammed Salameh, tried to retrieve the deposit he put down on the rental truck used to transport the bomb. But this only highlights the importance of the exceptional individual -- in this case, Abdel Basit. He was sent to New York to lead what proved to be a successfully executed bomb plot.

History demonstrates clearly that even groups of bumbling aspiring attackers can be organized successfully if they are empowered by someone who provides them with means and oversight. Accordingly, authorities cannot afford to ignore bumblers, no matter how inept they may appear.

Read more: Terrorism and the Not-So-Exceptional Individual | Stratfor