AQAP: Paradigm Shifts and Lessons Learned

Global Security & Intelligence Report (WWW.STRATFOR.COM ) provided this comprehensive report on international terrorism with emphasis on al Qaeda in Arabian Peninsula (AQAP) which ISPLA gratefully acknowledges.

By Scott Stewart - September 2, 2009

On the evening of Aug. 28, Prince Mohammed bin Nayef, the Saudi Deputy Interior Minister, and the man in charge of the kingdom’s counterterrorism efforts, was receiving members of the public in connection with the celebration of Ramadan, the Islamic month of fasting. As part of the Ramadan celebration, it is customary for members of the Saudi royal family to hold public gatherings where citizens can seek to settle disputes or offer Ramadan greetings.

One of the highlights of the Friday gathering was supposed to be the prince’s meeting with Abdullah Hassan Taleh al-Asiri, a Saudi man who was a wanted militant from al Qaeda in the Arabian Peninsula (AQAP). Al-Asiri had allegedly renounced terrorism and had requested to meet the prince in order to repent and then be accepted into the kingdom’s amnesty program. Such surrenders are not unprecedented, and they serve as great press events for the kingdom’s ideological battle against jihadists. Prince Mohammed, who is responsible for the Saudi rehabilitation program for militants, is a key figure in that ideological battle.

In February, a man who appeared with al-Asiri on Saudi Arabia’s list of most-wanted militants, former Guantanamo Bay inmate Mohammed al-Awfi , surrendered in Yemen and was transported to Saudi Arabia where he renounced terrorism and entered into the kingdom’s amnesty program. Al-Awfi, who had appeared in a January 2009 video issued by the newly created AQAP after the merger of the Saudi and Yemeni nodes of the global jihadist network, was a senior AQAP leader, and his renouncement was a major blow against AQAP.

But the al-Asiri case ended very differently from the al-Awfi case. Unlike al-Awfi, al-Asiri was not a genuine repentant, he was a human Trojan horse. After al-Asiri entered a small room to speak with Prince Mohammed, he activated a small improvised explosive device (IED) he had been carrying inside his anal cavity. The resulting explosion ripped al-Asiri to shreds but only lightly injured the shocked prince, the target of al-Asiri’s unsuccessful assassination attempt.

While the assassination proved unsuccessful, AQAP had been able to shift the operational paradigm in a manner that allowed them to achieve tactical surprise. The surprise was complete and the Saudis did not see the attack coming, the operation could have succeeded had it been better executed.

The kind of paradigm shift evident in this attack has far-reaching implications from a protective-intelligence standpoint, and security services will have to adapt in order to counter the new tactics employed. The attack also allows some important conclusions to be drawn about AQAP’s ability to operate inside Saudi Arabia.

Paradigm Shifts

Militants conducting terrorist attacks and the security services attempting to guard against such attacks have long engaged in a tactical game of cat and mouse. As militants adopt new tactics, security measures are then implemented to counter those tactics. The security changes then cause the militants to change in response and the cycle begins again. These changes can include using different weapons, employing weapons in a new way or changing the type of targets selected.

Sometimes, militants will implement a new tactic or series of tactics that is so revolutionary that it completely changes the framework of assumptions undefined or the paradigm, under which the security forces operate. Historically, al Qaeda and its jihadist progeny have proved to be very good at understanding the security paradigm and then developing tactics intended to exploit vulnerabilities in that paradigm in order to launch surprise attacks. For example:

•·         Prior to the 9/11 attacks, it was inconceivable that a large passenger aircraft would be used as a manually operated cruise missile. Hence, security screeners allowed box cutters to be carried onto aircraft, which were then used by the hijackers to take over the planes.

•·         The use of faux journalists to assassinate Ahmed Shah Masood with suicide IEDs hidden in their camera gear was also quite inventive.

•·         Had Richard Reid been able to light the fuse on his shoe bomb, we might still be wondering what happened to American Airlines Flight 63.

•·         The boat bomb employed against the USS Cole in October 2000 was another example of a paradigm shift that resulted in tactical surprise.

Once the element of tactical surprise is lost, however, the new tactics can be countered.

•·         When the crew and passengers on United Airlines Flight 93 learned what had happened to the other flights hijacked and flown to New York and Washington on Sept. 11, 2001, they stormed the cockpit and stopped the hijackers from using their aircraft in an attack. Aircraft cockpit doors have also been hardened and other procedural measures have been put in place to make 9/11-style suicide hijackings harder to pull off.

•·         Following the Masood assassination, journalists have been given very close scrutiny before being allowed into the proximity of a VIP.

•·         The traveling public has felt the impact of the Reid shoe-bombing attempt by being forced to remove their shoes every time they pass through airport security. And the thwarted 2006 Heathrow plot has resulted in limits on the size of liquid containers travelers can take aboard aircraft.

•·         The U.S. Navy is now very careful to guard against small craft pulling up alongside its warships.

Let’s now take a look at the paradigm shift marked by the Prince Mohammed assassination attempt.

AQAP’s Tactical Innovations

First, using a repentant militant was a brilliant move, especially when combined with the timing of Ramadan. For Muslims, Ramadan is a time for introspection, sacrifice, reconciliation and repentance, it is a time to exercise self-restraint and practice good deeds. Additionally, as previously mentioned, Ramadan is a time when the Saudi royal family customarily makes itself more accessible to the people than at other times of the year. By using a repentant militant who appears on Saudi Arabia’s list of most-wanted militants, AQAP was playing to the ego of the Saudis, who very much want to crush AQAP, and who also want to use AQAP members who have renounced terrorism and the group as part of their ideological campaign against jihadists. The surrender of an AQAP member offered the Saudi government a prize and a useful tool, it was an attractive offer and, as anticipated, Prince Mohammed took the bait. (Another side benefit of this tactic from the perspective of AQAP is that it will make the Saudis far more careful when they are dealing with surrendered militants in the future.)

The second tactical innovation in this case was the direct targeting of a senior member of the Saudi royal family and the member of the family specifically charged with leading the campaign against AQAP. In the past, jihadist militants in Saudi Arabia have targeted foreign interests and energy infrastructure in the kingdom. While jihadists have long derided and threatened the Saudi royal family in public statements, including AQAP statements released this year, they had not, prior to the Prince Mohammed assassination attempt, ever tried to follow through on any of their threats. Nor has the group staged any successful attack inside the kingdom since the February 2007 attack that killed four French citizens, and it has not attempted a major attack in Saudi Arabia since the failed February 2006 attack against a major oil-processing facility in the city of Abqaiq. Certainly the group had never before attempted a specifically targeted assassination against any member of the very large Saudi royal family, much less a senior member. Therefore the attack against Prince Mohammed came as a complete surprise. There are many less senior members of the royal family who would have been far more vulnerable to attack, but they would not have carried the rank or symbolism that Mohammed does.

But aside from his rank, Mohammed was the logical target to select for this operation because of his office and how he conducts his duties. Mohammed has long served as the primary contact between jihadists and the Saudi government, and he is the person Saudi militants go to in order to surrender. He has literally met with hundreds of repentant jihadists in person and had experienced no known security issues prior to the Aug. 28 incident. This explains why Mohammed personally spoke on the phone with al-Asiri prior to the surrender and why he did not express much concern over meeting with someone who appeared on his government’s list of most-wanted militants. He met with such men regularly.

Since it is well known that Mohammed has made it his personal mission to handle surrendering militants, AQAP didn’t have to do much intelligence work to realize that Mohammed was vulnerable to an attack or to arrange for a booby-trapped al-Asiri to meet with Mohammed. They merely had to adapt their tactics in order to exploit vulnerabilities in the security paradigm.

The third tactical shift is perhaps the most interesting, and that is the use of an IED hidden in the anal cavity of the bomber. Suicide bombers have long been creative when it comes to hiding their devices. In addition to the above-mentioned IED in the camera gear used in the Masood assassination, female suicide bombers with the Liberation Tigers of Tamil Eelam have hidden IEDs inside brassieres, and female suicide bombers with the Kurdistan Workers’ Party have worn IEDs designed to make them look pregnant. However, this is the first instance we are aware of where a suicide bomber has hidden an IED inside a body cavity.

It is fairly common practice around the world for people to smuggle contraband such as drugs inside their body cavities. This is done not only to get items across international borders but also to get contraband into prisons. It is not unusual for people to smuggle narcotics and even cell phones into prisons inside their body cavities (the prison slang for this practice is “keistering”). It is also not at all uncommon for inmates to keister weapons such as knives or improvised stabbing devices known as “shanks.” Such keistered items can be very difficult to detect using standard search methods, especially if they do not contain much metal.

In the case of al-Asiri, he turned himself in to authorities on the afternoon of Aug. 27 and did not meet with Mohammed until the evening of Aug. 28. By the time al-Asiri detonated his explosive device, he had been in custody for some 30 hours and had been subjected to several security searches, though it is unlikely that any of them included a body cavity search. While it is possible that there was some type of internal collusion, it is more likely that the device had been hidden inside of al-Asiri the entire time.

AQAP’s claim of responsibility for the attack included the following statement:
“…Abdullah Hassan Taleh al-Asiri, who was on the list of 85 wanted persons, was able, with the help of God, to enter Nayef’s palace as he was among his guards and detonate an explosive device. No one will be able to know the type of this device or the way it was detonated. Al-Asiri managed to pass all the security checkpoints in Najran and Jeddah airports and was transported on board Mohammed bin Nayef’s private plane.”

AQAP also threatened additional surprise attacks in the “near future,” but now that the type of device al-Asiri used is known, security measures can, and almost certainly will, be implemented to prevent similar attacks in the future.

While keistering an IED is a novel tactic, it does present operational planners with some limitations. For one thing, the amount of explosive material that can be hidden inside a person is far less than the amount that can be placed inside a backpack or is typically used in a suicide belt or vest. For another, the body of the bomber will tend to absorb much of the blast wave and most of any fragmentation from the device. This means that the bomber would have to get in very close proximity to an intended target in order to kill him or her. Such a device would not be very useful for a mass-casualty attack like the July 17 Jakarta hotel bombings and instead would be more useful in assassination attempts against targeted individuals.

We have not been able to determine exactly how the device was triggered, but it likely employed a command-detonated remote device of some kind. Having wires protruding from the bomber’s body would be a sure giveaway. The use of a wireless remote means that the device would be susceptible to radio frequency countermeasures.

One other concern about such a device is that it would likely have a catastrophic result if employed on an aircraft, especially if it were removed from the bomber’s body and placed in a strategic location on board the aircraft. Richard Reid’s shoe IED only contained about four ounces of explosives, an amount that could conceivably be smuggled inside a human.

What the Attack Says About AQAP

While the Aug. 28 attack highlighted AQAP’s operational creativity, it also demonstrated that the group failed to effectively execute the attack after gaining the element of surprise. Quite simply, the bomber detonated his device too far away from the intended target. It is quite likely that the group failed to do adequate testing with the device and did not know what its effective kill radius was. AQAP will almost certainly attempt to remedy that error before it tries to employ such a device again.

In the larger picture, this attempt shows that AQAP does not have the resources inside the kingdom to plan and execute an attack on a figure like Prince Mohammed. That it would try a nuanced and highly targeted strike against Mohammed rather than a more brazen armed assault or vehicle-borne IED attack demonstrates that the group is very weak inside Saudi Arabia. It even needed to rely on operatives and planners who were in Yemen to execute the attack.

When the formation of AQAP was announced in January, STRATFOR noted that it would be important to watch for indications of whether the merger of the Saudi and Yemeni groups was a sign of desperation by a declining group or an indication that it had new blood and was on the rise. AQAP’s assassination attempt on Prince Mohammed has clearly demonstrated that the group is weak and in decline.

AQAP has not given up the struggle, but the group will be hard-pressed to weather the storm that is about to befall it as the Saudis retaliate for the plot. It will be very surprising if it is able to carry through with its threat to attack other members of the Saudi royal family in the near future. Indeed, the very fact that AQAP has threatened more attacks on the royal family likely indicates that the threats are empty; if the group truly did have other plots in the works, it would not want to risk jeopardizing those plots by prompting the Saudis to increase security in response to a threat.

Lacking the strength to conduct large, aggressive attacks, the weakened AQAP will need to continue innovating in order to pose a threat to the Saudi monarchy. But, as seen in the Aug. 28 case, tactical innovation requires more than just a novel idea, militants must also carefully develop and test new concepts before they can use them to effectively conduct a terrorist attack.

Hotels as Targets

By Scott Stewart and Fred Burton

On the morning of July 17, a guest at the JW Marriott hotel in Jakarta came down to the lobby and began walking toward the lounge with his roll-aboard suitcase in tow and a backpack slung across his chest. Sensing something odd about the fellow, alert security officers approached him and asked him if he required assistance. The guest responded that he needed to deliver the backpack to his boss and proceeded to the lounge, accompanied by one of the security guards. Shortly after entering the lounge, the guest activated the improvised explosive device (IED) contained in the backpack, killing himself and five others. Minutes later, an accomplice detonated a second IED in a restaurant at the adjacent Ritz-Carlton hotel, killing himself and two other victims, bringing the death toll from the operation to nine undefined including six foreigners.

The twin bombings in Jakarta underscore two tactical trends that STRATFOR has been following for several years now, namely, the targeting of hotels in terrorist attacks and the use of smaller suicide devices to circumvent physical security measures. The Jakarta attacks also highlight the challenges associated with protecting soft targets such as hotels against such attacks.

Hotels as Targets

During the 1970s the iconic terrorist target became the international airliner. But as airline security increased in response to terrorist incidents, it became more difficult to hijack or bomb aircraft, and this difficulty resulted in a shift in targeting. By the mid-1980s, while there were still some incidents involving aircraft, the iconic terrorist target had become the embassy. But attacks against embassies have also provoked a security response, resulting in embassy security programs that have produced things like the American “Inman buildings”, which some have labeled “fortress America” buildings due to their foreboding presence and their robust construction designed to withstand rocket and large IED attacks. Due to these changes, it became far more difficult to attack embassies, many of which have become, for the most part in our post-9/11 world, hard targets. (This is certainly not universal, and there are still vulnerable embassies in many places. In fact, some countries locate their embassies inside commercial office buildings or hotels.)

Overall, however, this trend of making embassies hard targets has caused yet another shift in the terrorist paradigm. As STRATFOR has noted since 2004, hotels have become the iconic terrorist target of the post-9/11 era. Indeed, by striking an international hotel in a capital city, militants can make the same type of statement against Western imperialism and decadence that they can make by striking an embassy. Hotels are often full of Western businessmen, diplomats and intelligence officers, providing militants with a target-rich environment where they can kill Westerners and gain international media attention without having to penetrate the extreme security of a modern embassy.

Our 2004 observation about the trend toward attacking hotels has been borne out since that time by attacks against hotels in several parts of the world, including Pakistan, Afghanistan, Iraq, Jordan, India and Egypt. In addition to attacks against single hotels, in the attacks in Mumbai, Amman , Sharm el-Sheikh undefined and now Jakarta undefined militants staged coordinated attacks in which they hit more than one hotel.

Hotels have taken measures to improve security, and hotel security overall is better today than it was in 2004. In fact, security measures in place at several hotels, such as the Marriott in Islamabad , have saved lives on more than one occasion. However, due to the very nature of hotels, they remain vulnerable to attacks.

Unlike an embassy, a hotel is a commercial venture and is intended to make money. In order to make money, the hotel needs to maintain a steady flow of customers who stay in its rooms; visitors who eat at its restaurants, drink at its bars and rent its banquet and conference facilities; and merchants who rent out its shop space. On any given day a large five-star hotel can have hundreds of guests staying there, hundreds of other visitors attending conferences or dinner events and scores of other people eating in the restaurants, using the health club or shopping at the luxury stores commonly found inside such hotels. Such amenities are often difficult to find outside of such hotels in cities like Peshawar or Kabul , and therefore these hotels also become gathering places for foreign businessmen, diplomats and journalists residing in the city, as well as for wealthy natives. It is fairly easy for a militant operative to conduct surveillance of the inside of a hotel by posing as a restaurant patron or by shopping in its stores.

Of course, the staff required to run such a huge facility can also number in the hundreds, with clerks, cooks, housekeepers, waiters, bellboys, busboys, valets, florists, gardeners, maintenance men, security personnel, etc. These hotels are like little cities with activities that run 24 hours a day, with people, luggage, food and goods coming and going at all hours. There are emerging reports that one of the suicide bombers in the Jakarta attack was a florist at one of the hotels and it is possible that he used his position to smuggle IED components into the facility among floral supplies. If true, the long-term placement of militant operatives within the hotel staff will pose daunting challenges to corporate security directors. Such an inside placement could also explain how the cell responsible for the attack was able to conduct the detailed surveillance required for the operation without being detected.

Quite simply, it is extremely expensive to provide a hotel with the same level of physical security afforded to an embassy. Land to provide standoff distance is very expensive in many capital cities and heavy reinforced-concrete construction to withstand attacks is far more expensive than regular commercial construction. Such costs must be weighed against the corporate bottom line.

Moreover, security procedures at an embassy such as screening 100 percent of the visitors and their belongings are deemed far too intrusive by many hotel managers, and there is a constant tension between hotel security managers and hotel guest-relations managers over how much security is required in a particular hotel in a specific city. In fact, this debate over security is very similar to the tension that exists between diplomats and security personnel at the U.S. Department of State. And the longer the period between successful attacks (there had not been a successful terrorist attack in Jakarta since September 2004 and in Indonesia since October 2005), the harder it is to justify the added expense undefined and inconvenience undefined of security measures at hotels. (Of course, in very dangerous places such as Baghdad , Islamabad and Kabul heavy security is far easier to justify, and some hotels in such locations have been heavily fortified following attacks on other hotels in those cities.)

In many places, hotel guests are subjected to less security scrutiny than visitors to the hotel, as the hotel staff seeks to make them feel welcomed, and it is not surprising that militants in places like Mumbai (and perhaps Jakarta ) have been able to smuggle weapons and IED components into a hotel concealed inside their luggage. We have received a report from a credible source indicating that one of the Jakarta attackers had indeed been checked into the JW Marriott hotel. The source says the attacker, posing as a guest, was an Indonesian but was likely from a remote area because he did not appear to be familiar with how to use modern conveniences such as the room’s Western-style toilet. That the attackers were Indonesians supports the theory the attack was conducted by the Southeast Asian group Jemaah Islamiyah (JI) or a JI splinter group. JI has conducted (or is a suspect in) every high-profile terror attack in Indonesia in recent years.

Sources advise that significant similarities exist between the unexploded device discovered in the attacker’s hotel room in the JW Marriott and known JI explosive devices used in past attacks and recovered in police raids. This is another strong indication JI was involved.

One other important lesson that travelers should take from this string of hotel attacks is that, while they should pay attention to the level of security provided at hotels, and stay at hotels with better security, they should not rely exclusively on hotel security to keep them safe. There are some simple personal security measures that should also be taken to help mitigate the risk of staying at a hotel.

Size is Not Everything

As STRATFOR has noted since 2005, the counterterrorism tactic of erecting barricades around particularly vulnerable targets undefined including government buildings such as embassies and softer targets such as hotels undefined has forced militants to rethink their attack strategies and adapt. Instead of building bigger and bigger bombs that could possibly penetrate more secure areas, operational planners are instead thinking small undefined and mobile. In fact it was the October 2005 triple-bomb attacks against restaurants in Bali , Indonesia , by JI and the November 2005 triple suicide-bombing attacks against three Western hotels in Amman , Jordan , that really focused our attention on this trend.

Like the July 7, 2005, London bombings, these two attacks in Jakarta and Amman used smaller-scale explosive devices to bypass security and target areas where people congregate. Such attacks demonstrated an evolution in militant tactics away from large and bulky explosives and toward smaller, more portable devices that can be used in a wider variety of situations. Flexibility provides many options, and in the case of the operative who attacked the JW Marriott on July 17, it appears that he was able to approach a meeting of foreign businessmen being held in the lobby lounge and attack them as a target of opportunity. A vehicle-borne IED (VBIED) detonated in front of the hotel would not likely have been able to target such a group so selectively on the fly.

Of course, this trend does not mean that large VBIEDs will never again be employed any more than the trend to attack hotels means aircraft and embassies will never be attacked. Rather, the intent here is to point out that as security has been increased around targets, militants have adapted to security measures designed to stop them and they have changed their tactics.

At first glance, it would seem logical that the shift from large VBIEDs would cause casualty counts to drop, but in the case of JI attacks in Indonesia , the shift to smaller devices has, in fact, caused higher casualty counts. The August 2003 attack against the JW Marriott in Jakarta used a VBIED and left 12 people dead. Likewise, the September 2004 attack against the Australian embassy in Jakarta used a VBIED and killed 10 people. The use of three smaller IEDs in the 2005 Bali attacks killed 23, more than JI’s 2003 and 2004 VBIED attacks combined. Additionally, the 2005 attacks killed five foreigners as opposed to only one in the 2003 attack and none in the 2004 attacks. The operatives behind the July 17 attacks surpassed the 2005 Bali attacks by managing to kill six foreigners.

The reason that smaller is proving to be more effective at killing foreigners is that the rule for explosives is much like real estate undefined the three most important factors are location, location and location. Though a larger quantity of explosives will create a larger explosion, the impact of an explosion is determined solely by placement. If a bomber can carry a smaller explosive into the center of a heavily packed crowd undefined such as a wedding reception or hotel lobby undefined it will cause more damage than a larger device detonated farther away from its intended target. These smaller devices can also be used to target a specific person, as seen in the December 2007 assassination of former Pakistani Prime Minister Benazir Bhutto .

A person carrying explosives in a bag or concealed under clothing is much more fluid and can thus maneuver into the best possible position before detonating. In essence, a suicide bomber is a very sophisticated form of “smart” munition that can work its way through gaps in security and successfully seek its target. This type of guidance appears to have worked very effectively in the July 17 Jakarta attacks. As noted above, of the seven victims in this attack (the nine total deaths included the bombers), six were foreigners. JI has received criticism from the Islamist community in Indonesia for killing innocent bystanders (and Muslims) and such targeted attacks will help mute such criticism.

In addition to being more efficient, smaller IEDs also are cheaper to make. In an environment where explosive material is difficult to obtain, it is far easier to assemble the material for two or three small devices than the hundreds of pounds required for a large VBIED. An attack like the July 17 Jakarta attack could have been conducted at a very low cost, probably not more than a few thousand dollars. The three devices employed in that attack (as noted above, there was a third device left in the hotel room that did not explode) likely did not require much more than 60 pounds of explosive material.

This economical approach to terrorism is a distinct advantage for a militant group like Noordin Mohammad Top’s faction of JI, Tanzim Qaedat al-Jihad. Due to the Indonesian government’s crackdown on JI and its factions, the Indonesian militants simply do not have the external funding and freedom of action they enjoyed prior to the October 2002 Bali attack. This means that, at the present time, it would be very difficult for JI to purchase or otherwise procure the hundreds of pounds of explosive material required for a large VBIED undefined coming up with 60 pounds is far easier.

Even though JI is fragmented and its abilities have been degraded since the 2002 Bali attack, a cell like the one headed by Top certainly maintains the ability and the expertise to conduct low-cost, carefully targeted attacks like the July 17 Jakarta bombings. Such attacks are easily sustainable, and the only real limiter on the group’s ability to conduct similar attacks in the future is finding attackers willing to kill themselves in the process. Perhaps a more significant limiter on their operational tempo will be the law enforcement response to the attack, which could force the cell to go underground until the heat is off. It might also be difficult to move operatives and IEDs from safe houses to targets when there is more scrutiny of potential JI militants.

Increased security at potential targets could also cause the cell to wait until complacency sets in before attacking a less wary undefined and softer undefined target. Of course, the group’s operational ability will also be affected should the Indonesian government capture or kill key operatives like Top and his lieutenants.

From the standpoint of security, the challenges of balancing security with guest comfort and customer service at large hotels will continue to be a vexing problem, though certainly it would not be surprising to see an increase in the use of magnetometers and X-ray machines to screen guests and visitors at vulnerable facilities. This may also include such measures as random bomb-dog searches and sweeps in areas where dogs are not a cultural taboo. Additionally, in light of the threat of suicide bombers using smaller devices or posing as guests, or even placing operatives on the hotel staff, much more effort will be made to implement proactive security measures such as protective intelligence and counter surveillance, which focus more on identifying potential attackers than on his or her weapons.

Hotel staff members also need to be taught that security is not just the role of the designated security department. Security officers are not omnipresent; they require other people on the hotel staff who have interactions with the guests and visitors to be their eyes and ears and to alert them to individuals who have made it through security and into the hotel and appear to be potential threats. Of course, the traveling public also has a responsibility not only to look out for their own personal security but to maintain a heightened state of situational awareness and notify hotel security of any unusual activity

Above report prepared by Stratfor Global Intelligence.

Security at Places of Worship: More Than a Matter of Faith

June 17, 2009 | 1706 GMT - By Scott Stewart and Fred Burton of Stratfor Global Intelligence

In recent months, several high-profile incidents have raised awareness of the threat posed by individuals and small groups operating under the principles of leaderless resistance. These incidents have included lone wolf attacks against a doctor who performed abortions in Kansas, an armed forces recruitment center in Arkansas and the U.S. Holocaust Memorial Museum in Washington, D.C. Additionally, a grassroots jihadist cell was arrested for attempting to bomb Jewish targets in the Bronx and planning to shoot down a military aircraft at an Air National Guard base in Newburgh, N.Y.

In addition to pointing out the threat posed by grassroots cells and lone wolf operatives, another common factor in all of these incidents is the threat of violence to houses of worship. The cell arrested in New York left what they thought to be active improvised explosive devices outside the Riverdale Temple and the Riverdale Jewish Community Center. Dr. George Tiller was shot and killed in the lobby of the Reformation Lutheran Church in Wichita. Although Abdulhakim Mujahid Muhammad conducted his attack against a Little Rock recruiting center, he had conducted preoperational surveillance and research on targets that included Jewish organizations and a Baptist church in places as far away as Atlanta and Philadelphia. And while James von Brunn attacked the Holocaust Museum, he had a list of other potential targets in his vehicle that included the National Cathedral.

In light of this common thread, it might be instructive to take a more detailed look at the issue of providing security for places of worship.

Awareness: The First Step

Until there is awareness of the threat, little can be done to counter it. In many parts of the world, such as Iraq, India and Pakistan, attacks against places of worship occur fairly frequently. It is not difficult for religious leaders and members of their congregations in such places to be acutely aware of the dangers facing them and to have measures already in place to deal with those perils. This is not always the case in the United States, however, where many people tend to have an “it can’t happen here” mindset, believing that violence in or directed against places of worship is something that happens only to other people elsewhere.

This mindset is particularly pervasive among predominantly white American Protestant and Roman Catholic congregations. Jews, Mormons, Muslims and black Christians, and others who have been targeted by violence in the past, tend to be far more aware of the threat and are far more likely to have security plans and measures in place to counter it. The Jewish community has very well-developed and professional organizations such as the Secure Community Network (SCN) and the Anti-Defamation League that are dedicated to monitoring threats and providing education about the threats and advice regarding security. The Council on American-Islamic Relations has taken on a similar role for the Muslim community and has produced a “Muslim community safety kit” for local mosques. The Church of Jesus Christ of Latter-day Saints (LDS) also has a very organized and well-connected security department that provides information and security advice and assistance to LDS congregations worldwide.

There are no functional equivalents to the SCN or the LDS security department in the larger Catholic, evangelical Protestant and mainline Protestant communities, though there are some organizations such as the recently established Christian Security Network that have been attempting to fill the void.

Following an incident, awareness of the threat seems to rise for a time, and some houses of worship will put some security measures in place, but for the most part such incidents are seen as events that take place elsewhere, and the security measures are abandoned after a short time.

Permanent security measures are usually not put in place until there has been an incident of some sort at a specific house of worship, and while the triggering incident is sometimes something that merely provides a good scare, other times it is a violent action that results in tragedy. Even when no one is hurt in the incident, the emotional damage caused to a community by an act of vandalism or arson at a house of worship can be devastating.

It is important to note here that not all threats to places of worship will emanate from external actors. In the midst of any given religious congregation, there are, by percentages, people suffering from serious mental illnesses, people engaged in bitter child-custody disputes, domestic violence situations and messy divorces. Internal disputes in the congregation can also lead to feuds and violence. Any of these situations can (and have) led to acts of violence inside houses of worship.

Security Means More than Alarms and Locks

An effective security program is more than just having physical security measures in place. Like any man-made constructs, physical security measures undefined closed-circuit television (CCTV), alarms, cipher locks and so forth undefined have finite utility. They serve a valuable purpose in institutional security programs, but an effective security program cannot be limited to these things. Devices cannot think or evaluate. They are static and can be observed, learned and even fooled. Also, because some systems frequently produce false alarms, warnings in real danger situations may be brushed aside. Given these shortcomings, it is quite possible for anyone planning an act of violence to map out, quantify and then defeat or bypass physical security devices. However, elaborate planning is not always necessary. Consider the common scenario of a heavy metal door with very good locks that is propped open with a trashcan or a door wedge. In such a scenario, an otherwise “secure” door is defeated by an internal security lapse.

However, even in situations where there is a high degree of threat awareness, there is a tendency to place too much trust in physical security measures, which can become a kind of crutch undefined and, ironically, an obstacle to effective security.

In fact, to be effective, physical security devices always require human interaction. An alarm is useless if no one responds to it, or if it is not turned on; a lock is ineffective if it is not engaged. CCTV cameras are used extensively in corporate office buildings and some houses of worship, but any competent security manager will tell you that, in reality, they are far more useful in terms of investigating a theft or act of violence after the fact than in preventing one (although physical security devices can sometimes cause an attacker to divert to an easier target).

No matter what kinds of physical security measures may be in place at a facility, they are far less likely to be effective if a potential assailant feels free to conduct preoperational surveillance, and is free to observe and map those physical security measures. The more at ease someone feels as they set about identifying and quantifying the physical security systems and procedures in place, the higher the odds they will find ways to beat the system.

A truly “hard” target is one that couples physical security measures with an aggressive, alert attitude and sense of awareness. An effective security program is proactive undefined looking outward to where most real threats are lurking undefined rather than inward, where the only choice is to react once an attack has begun to unfold. We refer to this process of proactively looking for threats as protective intelligence.

The human interaction required to make physical security measures effective, and to transform a security program into a proactive protective intelligence program, can come in the form of designated security personnel. In fact, many large houses of worship do utilize off-duty police officers, private security guards, volunteer security guards or even a dedicated security staff to provide this coverage. In smaller congregations, security personnel can be members of the congregation who have been provided some level of training.

However, even in cases where there are specially designated security personnel, such officers have only so many eyes and can only be in a limited number of places at any one time. Thus, proactive security programs should also work to foster a broad sense of security awareness among the members of the congregation and community, and use them as additional resources.

Unfortunately, in many cases, there is often a sense in the religious community that security is bad for the image of a particular institution, or that it will somehow scare people away from houses of worship. Because of this, security measures, if employed, are often hidden or concealed from the congregation. In such cases, security managers are deprived of many sets of eyes and ears. Certainly, there may be certain facets of a security plan that not everyone in the congregation needs to know about, but in general, an educated and aware congregation and community can be a very valuable security asset.

Training

In order for a congregation to maintain a sense of heightened awareness it must learn how to effectively do that. This training should not leave people scared or paranoid undefined just more observant. People need to be trained to look for individuals who are out of place, which can be somewhat counterintuitive. By nature, houses of worship are open to outsiders and seek to welcome strangers. They frequently have a steady turnover of new faces. This causes many to believe that, in houses of worship, there is a natural antagonism between security and openness, but this does not have to be the case. A house of worship can have both a steady stream of visitors and good security, especially if that security is based upon situational awareness.

At its heart, situational awareness is about studying people, and such scrutiny will allow an observer to pick up on demeanor mistakes that might indicate someone is conducting surveillance. Practicing awareness and paying attention to the people approaching or inside a house of worship can also open up a whole new world of ministry opportunities, as people “tune in” to others and begin to perceive things they would otherwise miss if they were self-absorbed or simply not paying attention. In other words, practicing situational awareness provides an excellent opportunity for the members of a congregation to focus on the needs and burdens of other people.

It is important to remember that every attack cycle follows the same general steps. All criminals undefined whether they are stalkers, thieves, lone wolves or terrorist groups undefined engage in preoperational surveillance (sometimes called “casing,” in the criminal lexicon). Perhaps the most crucial point to be made about preoperational surveillance is that it is the phase when someone with hostile intentions is most apt to be detected undefined and the point in the attack cycle when potential violence can be most easily disrupted or prevented.

The second most critical point to emphasize about surveillance is that most criminals are not that good at it. They often have terrible surveillance tradecraft and are frequently very obvious. Most often, the only reason they succeed in conducting surveillance without being detected is because nobody is looking for them. Because of this, even ordinary people, if properly instructed, can note surveillance activity.

It is also critically important to teach people undefined including security personnel and members of the congregation undefined what to do if they see something suspicious and whom to call to report it. Unfortunately, a lot of critical intelligence is missed because it is not reported in a timely manner undefined or not reported at all undefined mainly because untrained people have a habit of not trusting their judgment and dismissing unusual activity. People need to be encouraged to report what they see.

Additionally, people who have been threatened, are undergoing nasty child-custody disputes or have active restraining orders protecting them against potentially violent people need to be encouraged to report unusual activity to their appropriate points of contact.

As a part of their security training, houses of worship should also instruct their staff and congregation members on procedures to follow if a shooter enters the building and creates what is called an active-shooter situation. These “shooter” drills should be practiced regularly undefined just like fire, tornado or earthquake drills. The teachers of children’s classes and nursery workers must also be trained in how to react.

Liaison

One of the things the SCN and ADL do very well is foster security liaison among Jewish congregations within a community and between those congregations and local, state and federal law enforcement organizations. This is something that houses of worship from other faiths should attempt to duplicate as part of their security plans.

While having a local cop in a congregation is a benefit, contacting the local police department should be the first step. It is very important to establish this contact before there is a crisis in order to help expedite any law enforcement response. Some police departments even have dedicated community liaison officers, who are good points of initial contact. There are other specific points of contact that should also be cultivated within the local department, such as the SWAT team and the bomb squad.

Local SWAT teams often appreciate the chance to do a walk-through of a house of worship so that they can learn the layout of the building in case they are ever called to respond to an emergency there. They also like the opportunity to use different and challenging buildings for training exercises (something that can be conducted discreetly after hours). Congregations with gyms and weight rooms will often open them up for local police officers to exercise in, and some congregations will also offer police officers a cup of coffee and a desk where they can sit and type their reports during evening hours.

But the local police department is not the only agency with which liaison should be established. Depending on the location of the house of worship, the state police, state intelligence fusion center or local joint terrorism task force should also be contacted. By working through state and federal channels, houses of worship in specific locations may even be eligible for grants to help underwrite security through programs such as the Department of Homeland Security’s Urban Areas Security Initiative Nonprofit Security Grant Program.

The world is a dangerous place and attacks against houses of worship will continue to occur. But there are proactive security measures that can be taken to identify attackers before they strike and help prevent attacks from happening or mitigate their effects when they do.

This report may be forwarded or republished on your website with attribution to www.stratfor.com