carapace – Not your father's america

Thursday, March 15, 2012

By Scott Stewart

For the past three weeks we have been running a series in the Security Weekly that focuses on some of the fundamentals of terrorism. First, we noted that terrorism is a tactic not exclusive to any one group and that the tactic would not end even if the jihadist threat were to disappear. We then discussed how actors planning terrorist attacks have to follow a planning process and noted that there are times during that process when such plots are vulnerable to detection.

Last week we discussed how one of the most important vulnerabilities during the terrorism planning process is surveillance, and we outlined what bad surveillance looks like and described some basic tools to help identify those conducting it. At the end of last week’s Security Weekly we also discussed how living in a state of paranoia and looking for a terrorist behind every bush not only is dangerous to one’s physical and mental health but also results in poor security. This brings us to this week, where we want to discuss the fundamentals of situational awareness and explain how people can practice the technique in a relaxed and sustainable way.

Situational awareness is very important, not just for personal security but as a fundamental building block in collective security. Because of this importance, Stratfor has written about situational awareness many times in the past. However, we believe it merits repeating again in order to share these concepts with our new readers as well as serve as a reminder for our longtime readers.

More Mindset than Skill

It is important to note that situational awareness — being aware of one’s surroundings and identifying potential threats and dangerous situations — is more of a mindset than a hard skill. Because of this, situational awareness is not something that can be practiced only by highly trained government agents or specialized corporate security teams. Indeed, it can be exercised by anyone with the will and the discipline to do so. Situational awareness is not only important for recognizing terrorist threats, but it also serves to identify criminal behavior and other dangerous situations.

The primary element in establishing this mindset is first to recognize that threats exist. Ignorance or denial of a threat make a person’s chances of quickly recognizing an emerging threat and avoiding it highly unlikely. Bad things do happen. Apathy, denial and complacency can be deadly.

A second important element of the proper mindset is understanding the need to take responsibility for one’s own security. The resources of any government are finite and the authorities simply cannot be everywhere and cannot stop every potential terrorist attack or other criminal action. The same principle applies to private security at businesses or other institutions, like places of worship. Therefore, people need to look out for themselves and their neighbors.

Another important facet of this mindset is learning to trust your "gut" or intuition. Many times a person’s subconscious can notice subtle signs of danger that the conscious mind has difficulty quantifying or articulating. I have interviewed many victims who experienced such feelings of danger prior to an incident but who chose to ignore them. Trusting your gut and avoiding a potentially dangerous situation may cause you a bit of inconvenience, but ignoring such feelings can lead to serious trouble.

The discipline part of practicing situational awareness refers to the conscious effort required to pay attention to gut feelings and to surrounding events even while you are busy and distracted. At such times even obvious hostile activity can go unnoticed, so individuals need to learn to be observant even while doing other things.

Levels of Awareness

People typically operate on five distinct levels of awareness. There are many ways to describe these levels ("Cooper’s colors," for example, which is a system frequently used in law enforcement and military training), but perhaps the most effective way to illustrate the differences between the levels is to compare them to the different degrees of attention we practice while driving. For our purposes here we will refer to the five levels as "tuned out," "relaxed awareness," "focused awareness," "high alert" and "comatose."

The first level, tuned out, is similar to when you are driving in a very familiar environment or are engrossed in thought, a daydream, a song on the radio or even by the kids fighting in the backseat. Increasingly, cellphone calls and texting are also causing people to tune out while they drive. Have you ever arrived somewhere in your vehicle without even really thinking about your drive there? If so, then you’ve experienced being tuned out.

The second level of awareness, relaxed awareness, is like defensive driving. This is a state in which you are relaxed but are also watching the other cars on the road and are looking at the road ahead for potential hazards. For example, if you are approaching an intersection and another driver looks like he may not stop, you tap your brakes to slow your car in case he does not. Defensive driving does not make you weary, and you can drive this way for a long time if you have the discipline to keep yourself from slipping into tuned-out mode. If you are practicing defensive driving you can still enjoy the trip, look at the scenery and listen to the radio, but you cannot allow yourself to get so engrossed in those distractions that they exclude everything else. You are relaxed and enjoying your drive, but you are still watching for road hazards, maintaining a safe following distance and keeping an eye on the behavior of the drivers around you.

The next level of awareness, focused awareness, is like driving in hazardous road conditions. You need to practice this level of awareness when you are driving on icy or slushy roads — or the pothole-infested roads populated by erratic drivers that exist in many developing countries. When you are driving in such an environment, you need to keep two hands on the wheel at all times and have your attention totally focused on the road and the other drivers around you. You don’t dare take your eyes off the road or let your attention wander. There is no time for cellphone calls or other distractions. The level of concentration required for this type of driving makes it extremely tiring and stressful. A drive that you normally would not think twice about will totally exhaust you under these conditions because it demands prolonged and total concentration.

The fourth level of awareness is high alert. This is the level that induces an adrenaline rush, a prayer and a gasp for air all at the same time. This is what happens when that car you are watching at the intersection ahead doesn’t stop at the stop sign and pulls out right in front of you. High alert can be scary, but at this level you are still able to function. You can hit your brakes and keep your car under control. In fact, the adrenaline rush you get at this stage can sometimes aid your reflexes.

The last level of awareness, comatose, is what happens when you literally freeze at the wheel and cannot respond to stimuli, either because you have fallen asleep or, at the other end of the spectrum, because you are petrified. It is this panic-induced paralysis that concerns us most in relation to situational awareness. The comatose level is where you go into shock, your brain ceases to process information and you simply cannot react to the reality of the situation. Many times when this happens, a person can go into denial, believing that "this can’t be happening to me," or the person can feel as though he or she is observing the event rather than actually participating in it. Often, the passage of time will seem to grind to a halt. Crime victims frequently report experiencing this sensation and being unable to act during an unfolding crime.

Finding the Right Level

Now that we’ve discussed the different levels of awareness, let’s focus on identifying what level is ideal at a given time. The body and mind both require rest, so we have to spend several hours each day at the comatose level while asleep. When we are sitting at our homes watching a movie or reading a book, it is perfectly fine to operate in the tuned-out mode. However, some people will attempt to maintain the tuned-out mode in decidedly inappropriate environments (e.g., when they are out on the street at night in a Third World barrio), or they will maintain a mindset wherein they deny that criminals can victimize them. "That couldn’t happen to me, so there’s no need to watch for it." This results in their being tuned out to any potential threats.

If you are tuned out while you are driving and something happens — say, a child runs out into the road or a car stops quickly in front of you — you will not see the problem coming. This usually means that you either do not see the hazard in time to avoid it and you hit it, or you totally panic, freeze and cannot react to it — neither is good. These reactions (or lack of reactions) occur because it is very difficult to change mental states quickly, especially when the adjustment requires moving several steps, say, from tuned out to high alert. It is like trying to shift your car directly from first gear into fifth and it shudders and stalls. Many times, when people are forced to make this mental jump and they panic (and stall), they go into shock and will actually freeze and be unable to take any action — they go comatose. This happens not only when driving but also when a criminal catches someone totally unaware and unprepared. While training does help people move up and down the alertness continuum, it is difficult for even highly trained individuals to transition from tuned out to high alert. This is why law enforcement and military personnel receive so much training on situational awareness.

It is critical to stress here that situational awareness does not mean being paranoid or obsessively concerned about security. In fact, people simply cannot operate in a state of focused awareness for extended periods, and high alert can be maintained only for very brief periods before exhaustion sets in. The "fight-or-flight" response can be very helpful if it can be controlled. When it gets out of control, however, a constant stream of adrenaline and stress is simply not healthy for the body and mind, and this also hampers security. Therefore, operating constantly in a state of high alert is not the answer, nor is operating for prolonged periods in a state of focused alert, which can also be demanding and completely enervating. The human body was simply not designed to operate under constant stress. All people, even highly skilled operators, require time to rest and recover.

Because of this, the basic level of situational awareness that should be practiced most of the time is relaxed awareness, a state of mind that can be maintained indefinitely without all the stress and fatigue associated with focused awareness or high alert. Relaxed awareness is not tiring, and it allows you to enjoy life while rewarding you with an effective level of personal security. When people are in an area where there is potential danger (which, in reality, is almost anywhere), they should go through most of the day in a state of relaxed awareness. Then if they spot something out of the ordinary that could be a threat, they can "dial up" to a state of focused awareness and take a careful look at that potential threat (and also look for others in the area). If the possible threat proves innocuous, or is simply a false alarm, they can dial back down into relaxed awareness and continue on their way. If, on the other hand, the potential threat becomes a probable threat, seeing it in advance allows a person to take actions to avoid it. In such a case they may never need to elevate to high alert, since they have avoided the problem at an early stage.

However, once a person is in a state of focused awareness they are far better prepared to handle the jump to high alert if the threat does change from potential to actual — if the three guys lurking on the corner do start advancing and look as if they are reaching for weapons.

Of course, when a person knowingly ventures into an area that is very dangerous, it is only prudent to practice focused awareness while in that area. For example, if there is a specific section of highway where a lot of improvised explosive devices detonate and ambushes occur, or if there is a part of a city that is controlled (and patrolled) by criminal gangs — and the area cannot be avoided for whatever reason — it would be prudent to practice a heightened level of awareness when in those areas. An increased level of awareness is also prudent when engaging in common or everyday tasks, such as visiting an ATM or walking to the car in a dark parking lot. When the time of potential danger has passed, it is then easy to shift back to a state of relaxed awareness.

People can hone their situational awareness ability by practicing some simple drills. For example, you can consciously move your awareness level up to a focused state for short periods of time during the day. Some examples of this can include identifying all the exits when you enter a building, counting the number of people in a restaurant or subway car, or noting which cars take the same turns in traffic. One trick that many law enforcement officers are taught is to take a look at the people around them and attempt to figure out their stories, in other words, what they do for a living, their mood, what they are focused on and what it appears they are preparing to do that day, based merely on observation. Employing such simple focused-awareness drills will train a person’s mind to be aware of these things almost subconsciously when the person is in a relaxed state of awareness.

This situational awareness process also demonstrates the importance of people being familiar with their environment and the dangers that are present there. Such awareness permits some threats to be avoided and others to be guarded against when you must venture into a dangerous area.

Not everyone is forced to live in the type of intense threat environment currently found in places like Mogadishu, Juarez or Kandahar. Nonetheless, average citizens all over the world face many different kinds of threats on a daily basis — from common thieves and assailants to criminals and mentally disturbed individuals intending to conduct violent acts to militants wanting to carry out large-scale attacks.

As we noted two weeks ago, some of the steps required to conduct these attacks must be accomplished in a manner that makes the actions visible to the potential victim and outside observers — if people are looking for such actions. It is at these junctures that people practicing situational awareness can detect these attack steps, avoid the danger themselves and alert the authorities to protect others.

As the jihadist threat continues to devolve from one based on al Qaeda the group to one based on grassroots cells and lone wolves, grassroots defenders — ordinary citizens practicing good situational awareness — become more important than ever before.

From: www.Stratfor.com

What would happen if a 10 kiloton nuclear explosive were detonated in downtown Washington, DC at the intersection of 16th and K Streets NW?

That question is posed by a recent study performed for the Federal
Emergency Management Agency. It assesses the impact of a nuclear terrorism incident in the nation’s capital and seeks to derive the appropriate lessons for emergency response planning purposes.

It is clear that a nuclear detonation would "overwhelm response resources in the area." On the other hand, "the existing Washington, DC structures offered better than adequate protection [for a] shelter-in-place strategy  [that] would reduce the number of potential acute radiation casualties by 98%," the study said.

See "National Capital Region: Key Response Planning Factors for the
Aftermath of Nuclear Terrorism" by B.R. Buddemeier, et al, Lawrence
Livermore National Laboratory, November 2011 (large pdf):

http://www.fas.org/irp/agency/dhs/fema/ncr.pdf

From: The Secrecy News Blog at: http://www.fas.org/blog/secrecy/

March 7, 2012

By Scott Stewart

As we noted last week, terrorist attacks do not materialize out of thin air. In fact, quite the opposite is true. Those planning terrorist attacks follow a discernable process referred to as the terrorist attack cycle. We also discussed last week how terrorism planners are vulnerable to detection at specific points during their attack cycle and how their poor surveillance tradecraft is one of these vulnerable junctures.

While surveillance is a necessary part of the planning process, the fact that it is a requirement does not necessarily mean that terrorist planners are very good at it. With this in mind, let’s take a closer look at surveillance and discuss what bad surveillance looks like.

Eyes on a Potential Target

As noted above, surveillance is an integral part of the terrorist planning process for almost any type of attack, although there are a few exceptions to this rule, like letter-bomb attacks. The primary objective of surveillance is to assess a potential target for value, security measures and vulnerabilities. Some have argued that physical surveillance has been rendered obsolete by the Internet, but from an operational standpoint, there simply is no substitute for having eyes on the potential target — even more so if a target is mobile. A planner is able to see the location of a building and its general shape on Google Earth, but Google Earth does not provide the planner with the ability to see what the building’s access controls are like, the internal layout of the building or where the guards are located and what procedures they follow.

The amount of time devoted to the surveillance process will vary depending on the type of operation. A complex operation involving several targets and multiple teams, such as the 9/11 operation or 2008 Mumbai attacks, will obviously require more planning (and more surveillance) than a rudimentary pipe-bomb attack against a stationary soft target. Such complex operations may require weeks or even months of surveillance, while a very simple operation may require only a few minutes. The amount of surveillance required for most attacks will fall somewhere between these two extremes. Regardless of the amount of time spent observing the target, almost all terrorist planners will conduct surveillance and they are vulnerable to detection during this time.

Given that surveillance is so widely practiced, it is amazing that, in general, those conducting surveillance as part of a terrorist plot are usually terrible at it. There are some exceptions, of course. Many of the European Marxist terrorist groups trained by the KGB and Stasi practiced very good surveillance tradecraft, but such sophisticated surveillance is the exception rather than the rule.

The term "tradecraft" is often used in describing surveillance technique. Tradecraft is an espionage term that refers to techniques and procedures used in the field, but the term also implies that effectively practicing these techniques and procedures requires a bit of finesse. Tradecraft skills tend to be as much art as they are science, and surveillance tradecraft is no exception. As with any other art, you can be taught the fundamentals, but it takes time and practice to become a skilled surveillance practitioner. Most individuals involved in terrorist planning simply do not devote the time necessary to master the art of surveillance, and because of this, they display terrible technique, use sloppy procedures and generally lack finesse when they are conducting surveillance.

The main reason that people planning terrorist attacks are able to get by with such a poor level of surveillance tradecraft is because most victims simply are not looking for them. Most people do not practice situational awareness, something we are going to discuss in more detail next week. For those who do practice good situational awareness, the poor surveillance tradecraft exhibited by those planning terrorist attacks is good news. It provides them time to avoid an immediate threat and contact the authorities.

Keying on Demeanor

The behavior a person displays to those watching him or her is called demeanor. In order to master the art of surveillance tradecraft, one needs to master the ability to display appropriate demeanor for whatever situation one is in. Practicing good demeanor is not intuitive. In fact, the things one has to do to maintain good demeanor while conducting surveillance frequently run counter to human nature. Because of this, intelligence, law enforcement and security professionals assigned to work surveillance operations receive extensive training that includes many hours of heavily critiqued practical exercises, often followed by field training with a team of experienced surveillance professionals. This training teaches and reinforces good demeanor. Terrorist operatives typically do not receive this type of training — especially those who are grassroots or lone wolf militants.

At its heart, surveillance is watching someone while attempting not to be caught doing so. As such, it is an unnatural activity, and a person doing it must deal with strong feelings of self-consciousness and of being out of place. People conducting surveillance frequently suffer from what is called "burn syndrome," the belief that the people they are watching have spotted them. Feeling "burned" will cause surveillants to do unnatural things, such as hiding their faces or suddenly ducking back into a doorway or turning around abruptly when they unexpectedly come face to face with the person they are watching.

People inexperienced in the art of surveillance find it difficult to control this natural reaction. A video that recently went viral on the Internet shows the husband of the president of Finland getting caught staring down the blouse of a Danish princess. The man’s reaction to being caught by the princess was a textbook example of the burn syndrome. Even experienced surveillance operatives occasionally have the feeling of being burned; the difference is they have received a lot of training and they are better able to control their reaction and behave normally despite the feeling of being burned. They are able to maintain a normal-looking demeanor while their insides are screaming that the person they are watching has seen them.

In addition to doing something unnatural or stupid when feeling burned, another very common mistake made by amateurs when conducting surveillance is the failure to get into proper "character" for the job or, when in character, appearing in places or carrying out activities that are incongruent with the character’s "costume." The terms used to describe these role-playing aspects of surveillance are "cover for status" and "cover for action." Cover for status is a person’s purported identity — his costume. A person can pretend to be a student, a businessman, a repairman, etc. Cover for action explains why the person is doing what he or she is doing — why that guy has been standing on that street corner for half an hour.

The purpose of using good cover for action and cover for status is to make the presence of the person conducting the surveillance look routine and normal. When done right, the surveillance operative fits in with the mental snapshot subconsciously taken by the target as the target goes about his or her business. Inexperienced people who conduct surveillance frequently do not use proper (if any) cover for action or cover for status, and they can be easily detected.

An example of bad cover for status would be someone dressed as "a businessman" walking in the woods or at the beach. An example of bad cover for action is someone pretending to be sitting at a bus stop who remains at that bus stop even after several buses have passed. For the most part, however, inexperienced operatives conducting surveillance practice little or no cover for action or cover for status. They just lurk and look totally out of place. There is no apparent reason for them to be where they are or doing what they are doing.

In addition to plain old lurking, other giveaways include a person moving when the target moves, communicating when the target moves, avoiding eye contact with the target, making sudden turns or stops, or even using hand signals to communicate with other members of a surveillance team or criminal gang. Surveillants also can tip off the person they are watching by entering or leaving a building immediately after the person they are watching or simply by running in street clothes.

Sometimes, people who are experiencing the burn syndrome exhibit almost imperceptible behaviors that the target can sense more than observe. It may not be something that can be articulated, but the target just gets the gut feeling that there is something wrong or odd about the way a certain person is behaving toward them. Innocent bystanders who are not watching someone usually do not exhibit this behavior or trigger these feelings.

Principles of Surveillance Detection

The U.S. government often uses the acronym "TEDD" to illustrate the principles that can be used to identify surveillance conducted by counterintelligence agencies, but these same principles also can be used to identify terrorist surveillance. TEDD stands for time, environment, distance and demeanor. In other words, if a person sees someone repeatedly over time, in different environments and at a distance, or someone who displays poor surveillance demeanor, then that person can assume he or she is under surveillance.

However, for an individual, TEDD is really only relevant if you are being specifically targeted for an attack. In such an instance, you will likely be exposed to the time, environment and distance elements. However, if the target of the attack is a subway car or a building you work in rather than you as an individual, you likely will not have an opportunity to make environment and distance correlations, and perhaps not even time. You will likely only have the demeanor of the surveillant to key on. Therefore, when we are talking about recognizing surveillance, demeanor is the most critical of the four elements. Demeanor also works in tandem with all the other elements, and poor demeanor will often help the target spot the surveillant at a different time and place or in a different environment.

Time, environment and distance also have little bearing in an instance like the Fort Hood shooting, where the assailant is an insider, works at a facility and has solid cover for action and cover for status. In such instances, demeanor is also critical in identifying bad intent.

The fact that operatives conducting surveillance over an extended period can change their clothing and wear hats, wigs or other light disguises — and use different vehicles or license plates — also demonstrates why watching for mistakes in demeanor is critical. Because of a surveillant’s ability to make superficial changes in appearance, it is important to focus on the things that cannot be changed as easily as clothing or hair, such as a person’s facial features, build, mannerisms and gait. Additionally, while a surveillant can change the license plate on a car, it is not as easy to alter other aspects of the vehicle such as body damage (scratches and dents). Paying attention to small details can be the difference between a potential attacker being identified and the attacker going unnoticed.

One technique that can be helpful in looking for people conducting long-term surveillance is to identify places that provide optimal visibility of a critical place the surveillant would want to watch (for example, the front door of a potential target’s residence or office, or a choke point on a route the potential target frequently travels). It is also important to look for places that provide optimal visibility, or "perches" in surveillance jargon. Elevated perches tend to be especially effective since surveillance targets rarely look up. Perches should be watched for signs of hostile surveillance, such as people who don’t belong there, people lurking, or people making more subtle demeanor mistakes.

Paying attention to the details of what is happening around you (what we call practicing good situational awareness) does not mean being paranoid or obsessively concerned about security. Living in a state of paranoia and looking for a terrorist behind every bush not only is dangerous to one’s physical and mental health but also results in poor security. We are going to talk more about practicing a healthy and sustainable level of situational awareness next week.

March 1, 2012

By Scott Stewart

Last week’s Security Weekly discussed the fact that terrorism is a tactic used by many different classes of actors and that, while the perpetrators and tactics of terrorism may change in response to shifts in larger geopolitical cycles, these changes will never result in the end of terrorism. Since that analysis was written, there have been jihadist-related attacks in Afghanistan, Nigeria, Yemen and Pakistan, an assassination attempt against the president of Abkhazia, and a failed timed-incendiary attack against the Athens subway. (The latter incident, which militant anarchists claimed, reinforces that jihadists are not the only ones who practice terrorism.)

But while terrorism is a continuing concern, it can be understood, and measures can be taken to thwart terrorist plots and mitigate the effects of attacks. Perhaps the most important and fundamental point to understand about terrorism is that attacks do not appear out of nowhere. Individuals planning a terrorist attack follow a discernable cycle — and that cycle and the behaviors associated with it can be observed if they are being looked for. We refer to these points where terrorism-related behavior can be most readily observed as vulnerabilities in the terrorist attack cycle.

The Attack Cycle

Many different actors can commit terrorist attacks, including sophisticated transnational terrorist groups like al Qaeda; regional militant groups like India’s Maoist Naxalites; small, independent cells like the anarchists in Greece; and lone wolves like Oslo attacker Anders Breivik. There can be great variance in attack motives and in the time and process required to radicalize these different actors to the point that they decide to conduct a terrorist attack. But once any of these actors decides to launch an attack, there is remarkable similarity in the planning process.

First, there is the process of selecting or identifying a target. Often an actor will come up with a list of potential targets and then select one to focus on. In some cases, the actor has preselected a method of attack, such as a vehicle-borne improvised explosive device, and wants to find a target that would be vulnerable to that specific type of attack. In other cases, the actor will pick a target and then devise a method of attack based on that target’s characteristics and vulnerabilities. Simply put, the execution of these steps can be somewhat fluid; some degree of planning or preparation can come before target selection, and sometimes target selection will be altered during the planning process. The time required to execute these steps can also vary considerably. Some attacks can be planned and executed within hours or days, while more complex plans, such as those used in the 9/11 or Mumbai attacks, may take months or even years to complete.

Frequently, those planning an attack will conduct detailed surveillance of potential targets to determine what security measures are in place around the target and to gauge whether they have the ability to successfully attack it. If the target is too difficult to attack — commonly known as a hard target — the attack planners will typically move on to their next target, which may prove easier to attack. (When they do continue with attacks against targets whose security measures exceed the attackers’ capabilities, those attacks fail.) We refer to this stage as preoperational surveillance, which means surveillance that is conducted before the operation is fully planned.

After the target has been selected, a second round of surveillance is conducted. This round will be far more detailed and is intended to provide all the details necessary for planning the attack. For example, if the attack is being planned against a static facility, this round of surveillance will generally try to obtain a detailed description of the target’s physical security features and security force procedures. It will also focus on establishing a baseline understanding of the activity that can be expected around the facility at the time of day the attack is anticipated.

If the target of the attack is an individual, the individual’s residence, office and other places the individual frequents will be surveilled. Additionally, the surveillance team will look for patterns and routines that the target follows between these known locations. The team will often analyze the target’s usual routes looking for choke points, or places the target must pass to get from one point to another. If the surveillance team identifies a choke point that the target passes through predictably, it will then try to determine whether that point will allow the attackers to deploy in secret, permit them to spot and control the target, and provide them with good escape routes. If it does, this point will frequently be chosen as the attack site.

In the case of large organizations, different groups or individuals may conduct different phases of the surveillance. Many organizations use specialized operatives for surveillance, though the operational planner will often attempt to get eyes on the target to help with the planning process. For instance, it is known from court testimony in the Mumbai case that David Headley made five extended trips to Mumbai as those attacks were being planned. The repeated trips were required because the operational commanders in Pakistan considered India a hostile environment and the operational planners could not go there to conduct the surveillance themselves. As a result, Headley was sent to observe and report on specific things as planning for the attacks progressed.

During the planning phase, the personnel to be used in the attacks are identified and trained in any special skills they may require for the mission, including languages, marksmanship, hand-to-hand combat, small-boat handling or land navigation. To protect operational security, the operatives may not be briefed in any great detail about the target of their operation until they are very close to being deployed.

Many times the planning phase will end with a dry run, as the preparation did for the 9/11 attacks, when some of the hijackers took their assigned flights in August 2001. While conducting a dry run, the attackers will generally be unarmed to ensure they do not needlessly bring law enforcement attention to themselves.

Sometimes an attacker will have acquired weapons for the attack before the planning phase. Other times the concept of the operation will be constrained by the weapons and money available. But quite frequently, the weapons for the attack will be acquired during the planning phase, after the target has been selected and the means of attack have been established.

Once planning, training and weapons acquisition are complete, the attack team can be deployed. The attack team frequently will again conduct surveillance of the target, especially if the target is mobile and the attack team is deployed and waiting at a predetermined attack site.

If it was properly planned, an attack is very likely to succeed once it has moved to the operational phase. Sometimes attacks do fail because of mistakes or bad luck, but by and large there is no way to stop an attack once it has been set in motion.

At the attack’s conclusion, the attackers will seek to escape the scene. The exception is suicide attacks or when, like Breivik, the attacker intends to be captured as part of the media exploitation phase, the final step in the cycle.

Regardless of whether the attack is a suicide attack against a church in Nigeria or a timed-incendiary attack against a subway in Athens, the same attack cycle is followed. With an eye toward averting future attacks, a thoughtful observer can use the attack cycle model to understand how an attack was planned and executed.

Vulnerabilities

While plots are occasionally thwarted at the last second, for the most part law enforcement and security personnel must detect and interdict the plot before it gets to the attack phase to have any chance of stopping it. Once the bullets fly or the explosive device is detonated, there is little security forces can do but initiate their immediate action drills in an effort to reduce the body count. This means that an emphasis must be placed on identifying attackers earlier in the process, well before they are in a position to strike.

Unless security forces have a source inside the group that is planning the attack or manage to intercept the group’s communications, the only way to identify attack planners is by noting their actions. This is especially true of a lone wolf attack, where no external communication occurs. The earliest point in the attack cycle that the attackers can be identified by their actions is during the preoperational surveillance required for target identification.

There is a widely held conception that terrorist surveillance is generally sophisticated and almost invisible, but when viewed in hindsight, it is frequently discovered that individuals who conduct terrorist surveillance tend to be quite sloppy and even amateurish in their surveillance tradecraft. We will discuss what bad surveillance looks like, and how to recognize it, in more detail next week, but for now it is sufficient to say that poor surveillance tradecraft is a significant vulnerability in the terrorist attack cycle.

As noted above, additional surveillance is often conducted at later stages of the attack cycle, such as in the planning stage and even sometimes in the attack stage, as the attackers track the target from a known location to the attack site. Each instance of surveillance provides an additional opportunity for the assailants to be identified and the attack to be prevented.

During the planning phase and as the operatives prepare to deploy, communication between and movement of group members often increases. Additionally, group members may engage in outside training that can attract attention, such as playing paintball, visiting the firing range or, as was the case with the 9/11 pilots, attending flight schools. This increase in activity, which also might include money transfers, leaves signs that could tip off the authorities.

Another significant vulnerability during the attack cycle is weapons acquisition. This vulnerability is especially pronounced when dealing with inexperienced grassroots operatives, who tend to aspire to conduct spectacular attacks that are far beyond their capabilities. For example, they may decide they want to conduct a bombing attack even though they do not know how to make improvised explosive devices. It is also not uncommon for such individuals to try to acquire Stinger anti-aircraft missiles, automatic firearms or hand grenades. When confronted by this gap between their capability and their aspirations, grassroots operatives will often reach out to someone for help with their attack instead of settling on an attack that is within their ability. Increasingly, the people such would-be attackers are encountering when they reach out are police or domestic security agency informants.

As far back as 2010, jihadist leaders such as Nasir al-Wahayshi of al Qaeda in the Arabian Peninsula recognized this problem and began to encourage grassroots jihadists to focus on conducting simple attacks against soft targets. Nevertheless, grassroots jihadists are consistently drawn toward spectacular attacks, as seen in the Feb. 17 arrest near the U.S. Capitol of a Moroccan man who thought his handler, who was in fact an FBI informant, had equipped him for a suicide attack. Unlike most jihadists, other types of grassroots militants, such as anarchists, are far more comfortable conducting simple attacks with readily available items.

Personality traits and psychological profiles aside, anyone desiring to plan a terrorist attack must follow the attack planning cycle, which at certain stages will necessarily open them up to detection.

http://www.Stratfor.com

By Scott Stewart | February 23, 2012

In this week’s Geopolitical Weekly, George Friedman discussed the geopolitical cycles that change with each generation. Frequently, especially in recent years, those geopolitical cycles have intersected with changes in the way the tactic of terrorism is employed and in the actors employing it.

Geopolitical cycles will change, and these changes may cause a shift in who employs terrorism and how it is employed. But as a tactic, terrorism will continue no matter what the next geopolitical cycle brings.

Tuesday, February 7, 2012

By George Friedman

U.S. Defense Secretary Leon Panetta suggested last week that the United States could wrap up combat operations in Afghanistan by the end of 2013, well before the longstanding 2014 deadline when full control is to be ceded to Kabul. Troops would remain in Afghanistan until 2014, as agreed upon at the 2010 Lisbon Summit, and would be engaged in two roles until at least 2014 and perhaps even later. One role would be continuing the training of Afghan security forces. The other would involve special operations troops carrying out capture or kill operations against high-value targets.

Along with this announcement, the White House gave The New York Times some details on negotiations that have been under way with the Taliban. According to the Times, Mullah Mohammad Omar, the senior-most leader of the Afghan Taliban, last summer made overtures to the White House offering negotiations. An intermediary claiming to speak for Mullah Omar delivered the proposal, an unsigned document purportedly from Mullah Omar that could not be established as authentic. The letter demanded the release of some Taliban prisoners before any talks. In spite of the ambiguities, which included a recent public denial by the Taliban that the offer came from Mullah Omar, U.S. officials, obviously acting on other intelligence, regarded the proposal as both authentic and representative of the views of the Taliban leadership and, in all likelihood, those of Mullah Omar, too.

The idea of negotiating with the Taliban is not new. Talks, as distinct from negotiations, in which specific terms are hammered out, have gone on for some time now. Several previous attempts have ended in failure, including one instance when the supposed representative proved to be a fraud. However, according to the Times report, the negotiations took on a degree of specificity last summer. They began in November 2010, initiated by a man named Tayyab Agha, who claimed to speak for Mullah Omar. The administration of U.S. President Barack Obama regards authenticating the present offer as unimportant and the intermediary as having authority; the question on the table is the release of Taliban captives as a token of American seriousness.

The Taliban see themselves as already having made a major concession. Their original demand was the complete withdrawal of Western forces from Afghanistan as a precondition for negotiations. The talks have continued in spite of the U.S. refusal to comply. The Taliban shifted their position to a very specific timetable for withdrawal, something Panetta may have been hinting at last week, though not on a timetable to the Taliban’s liking. Two more years of combat operations — not to mention an unspecified time in which U.S. special operations forces will continue working in Afghanistan — is a long time. In addition, the United States has not delivered on the release of the Taliban, an issue that has not emerged as a campaign issue in the U.S. presidential election.

Still, U.S. operations have become less aggressive. This is in part due to the season: It is winter in Afghanistan, a time of year when large-scale operations are not practical in many areas. At the same time, we are not seeing the level of operations we have seen in previous winters after Obama increased the number of U.S. forces in Afghanistan. This in part reflects a realization of the limits of U.S. military power in Afghanistan. Regardless of the motive, the Taliban interpret it as a signal — and it is understood in Washington as a signal, too.

The Pakistani-Taliban Channel

To get negotiations going, the United States had to reach two conclusions. The first was that negotiations could not happen without Pakistani involvement. U.S. accusations that current and former military figures in Pakistan maintained close ties with the Taliban undoubtedly were true. Conversely, this meant Pakistan represented a clear channel the United States could use to reach the Taliban. That channel permitted the Obama administration to conclude that it had no hope of meaningfully dividing the Taliban.

Certainly, the Taliban are an operationally diffuse group. Even so, Mullah Omar is at their center, with the political operatives surrounding him representing the political office of the Taliban. The line of communications with the Taliban runs through Pakistan and terminates with Mullah Omar. This means that U.S. hopes of splitting the Taliban politically and conducting factional negotiations are not realistic. Particularly after a series of attacks and suicide bombings in Kabul last fall, it also became apparent that the United States would not be able to manage negotiations at arm’s length using Afghan President Hamid Karzai and his advisers as the primary channel.

The Pakistanis and the Taliban also had to face certain realities. The Taliban had claimed that the United States and its allies in Afghanistan had lost. This underpinned their demand for an immediate U.S. withdrawal; their offer to permit this without harassment was made under the assumption that the United States had a defeated military force at risk.

The reality was that, while the United States had not won the war in Afghanistan and in all likelihood could not defeat the Taliban militarily, it was far from defeated. The United States remained, and remains, able to conduct operations in Afghanistan as and where it wishes. The Taliban have not reached the point where they can operationally defeat the forces arrayed against them. Where large Western forces exist, the Taliban must decline combat and disengage or be annihilated. As important, there is no overwhelming pressure from the American public to withdraw — something not true of some U.S. allies. However, in this election, Obama is likely to be challenged by candidates supporting his position in Afghanistan or wanting a more aggressive stance. Mitt Romney, for example, not only rejected the idea of releasing Taliban fighters, but also said in response to a question that his strategy in Afghanistan was to "beat them."

The United States could hypothetically remain in Afghanistan indefinitely given the current cost and force structure. But we would argue that defeating a guerrilla force with sanctuary and support across the border in Pakistan, an excellent intelligence capability and units able to operate independently is unlikely. But neither, for that matter, can the Taliban defeat the coalition forces.

Stalemate in Afghanistan

This makes for a stalemate, one the Americans hope to solve by creating an Afghan state under Karzai and a security and military force able and willing to engage the Taliban. As I have argued in the past, the core problem with this plan is the same problem that existed during the Vietnamization phase of the Vietnam War. The Afghan military must recruit troops, and some of the most eager volunteers will be Taliban operatives. These operatives will be indistinguishable from anti-Taliban soldiers, and their presence will have two consequences. First, the intelligence they will provide the Taliban will cause the Afghan army offensive to fail. Second, shrewd use of these operatives will undermine the cohesion and morale of the Afghan forces. Surprise is crucial in locating, engaging and destroying a guerrilla force. Afghan security forces will face the same problem the South Vietnamese army did; namely, they will lack the element of surprise and at least some of their units will be unreliable.

Accordingly, the U.S. strategy of using the stalemate to construct a capable military force accordingly looks unlikely to succeed even leaving aside the issue of the fragmentation of the Afghan nation and the Karzai government’s internal problems. The Taliban are intimately familiar with the U.S. dilemma and are positioned to choose from two strategies. One is to increase their tempo of operations and so increase American casualties prior to the November elections. But this strategy would see Taliban casualties increase even more dramatically, and its impact on the elections would be unclear to say the least. The Taliban are more likely to pursue the second strategy, which involves accepting the stalemate and permitting the United States to try to build an Afghan military.

Like the Taliban, the United States is aware of the difficulty of building an Afghan army. It also understands that deploying troops in Afghanistan is unlikely to lead anywhere. It does not have to flee defeat in Afghanistan, but there are strategic reasons for leaving, beginning with the fact that the military situation is about as satisfactory as it likely ever will be. Improving the situation would incur costs without yielding anything like victory. With the United States reducing its military budget, serious issues emerging in Iran and throughout the Arab World, and a new emphasis by the U.S. Navy, Marine Corps and Air Force on the Pacific, the world is moving on. A violent yet frozen conflict in Afghanistan simply does not benefit the United States.

This, of course, leaves a crucial question: Will Afghanistan become a base for al Qaeda or follow-on transnational jihadist groups in the event of a U.S. withdrawal? It is true that these groups can form anywhere, but the fact is that they did form in Afghanistan while Mullah Omar was in charge. The negotiators undoubtedly have promised that, in exchange for withdrawal, they will take responsibility for suppressing jihadist elements. But trusting the Taliban, or trusting those in Pakistan who took violent offense at the killing of Osama bin Laden, poses obvious risks for the United States. In truth, it does not increase the risk much: Afghanistan is not necessary for the jihadists, but it is naturally fragmented and the threat of its re-emergence as a sanctuary is always there. Even so, the issue will remain a sticking point in the negotiations. The United States will want a residual force to deal with the jihadist threat, something the Taliban and Pakistan will oppose.

The Pakistani Role

In this sense, the negotiations really come down to Pakistan and the burden it is willing to undertake in the event of a U.S. withdrawal.

The United States does not trust the Taliban or many of those Pakistani officials speaking to and for the Taliban. But the United States also knows two things. First, that the future of Afghanistan is of fundamental interest to Pakistan. Instability or Indian or Iranian influence in Pakistan is not in Pakistan’s interest. Therefore, the Pakistanis will play a leading role in Afghanistan as they did after the end of the Soviet occupation. Second, the United States knows that India remains Pakistan’s major adversary. The Pakistanis have tried to play the China card to make the United States nervous about Pakistan. But the fact is that the Chinese People’s Liberation Army does not have the training and logistics to support Pakistan against India, and the last thing Pakistan wants is a large Chinese military deployment in Pakistan. Indeed, that is the last thing China wants.

The issue over time will boil down to this: The United States will want a coalition government in which Taliban elements take Cabinet positions in the current structure of the Karzai regime. The Taliban will want an entirely new government in which elements of the existing power structure (Karzai has promised not to seek a third term when his current one ends in 2014) might have a position but that would be an altogether new regime. In either case, the Taliban assume, as the North Vietnamese assumed a generation ago, that a political settlement followed by a U.S. withdrawal would, after a "decent interval," result in a Taliban-dominated regime.

Ultimately, the United States could remain in Afghanistan indefinitely and there is nothing the Taliban could do about it. But the United States cannot defeat the Taliban. The Taliban have nowhere to go and no desire to leave. The United States has other issues to attend to and no overriding strategic interest in Afghanistan. From the American point of view, its presence in Afghanistan does not reduce Islamist threats to the homeland but it does absorb military resources.

What the United States is engaged in now, as it was in 1971, is the complex process of crafting a political path from the current situation to the inevitable end. This isn’t easy, since the manner in which the United States withdraws will influence its position in the region as much as its indefinite presence would. This is why the administration is so eager to pursue the current initiative and prepared to release prisoners as a gesture. It is also why the Taliban will accept a coalition government for a while, and why Pakistan will make and likely honor guarantees.

However this war is brought to an end will be a complex and time-consuming process, during which the fighting will continue. But then the how is never trivial in ending a war.

http://www.stratfor.com/

BOOK: The Next Decade: What the World Will Look Like by George Friedman

The author of the acclaimed New York Times bestseller The Next 100 Years now focuses his geopolitical forecasting acumen on the next decade and the imminent events and challenges that will test America and the world, specifically addressing the skills that will be required by the decade’s leaders.

The next ten years will be a time of massive transition. The wars in the Islamic world will be subsiding, and terrorism will become something we learn to live with. China will be encountering its crisis. We will be moving from a time when financial crises dominate the world to a time when labor shortages will begin to dominate. The new century will be taking shape in the next decade.

In The Next Decade, George Friedman offers readers a pro­vocative and endlessly fascinating prognosis for the immedi­ate future. Using Machiavelli’s The Prince as a model, Friedman focuses on the world’s leaders—particularly the American president—and with his trusted geopolitical insight analyzes the complex chess game they will all have to play. The book also asks how to be a good president in a decade of extraordinary challenge, and puts the world’s leaders under a microscope to explain how they will arrive at the decisions they will make—and the consequences these actions will have for us all.