You are on page 1of 8



he evolution of terrorist threats — away
from organized and well-structured groups

and toward grassroots terrorism under a
“leaderless resistance” model — poses a number of

the Attack
risks for corporations and the security personnel
charged with protecting them.

Cycle and Its
But it is possible to protect both people and assets
around the world against potentially deadly and
costly attacks, with a smart security program that

takes into account all the steps of a terrorist attack
planning cycle. An attack will never just evolve out
of nowhere. People who are planning a strike follow
a discernible cycle — and both the cycle and the
behaviors associated with it can be observed if you
are looking for them.

attack planners will conduct detailed Terrorist attacks can come from a wide array of ac. In some cases. if the target is a IDENTIFYING A TARGET static facility. In other cases. and looks for targets that would be vul- nerable to that specific type of attack. based on the simplicity or complexity of the operation being planned and the capabilities of the actor. The time required to execute these steps can also vary considerably. regional militant gauge whether they have the ability to get past them. But once any of these actors decides to take action against a target. If the target is too difficult to strike (a “hard target”) dent cells (such as anarchist and animal rights affinity planners will typically move on to the next one on groups). and EXPLOITATION DEPLOYMENT sometimes target selection will be altered during the planning process. groups like India's Maoist Naxalites. This round will be far more detailed and is intended to provide all the details necessary for planning the 2 • STRATFOR UNDERSTANDING THE ATTACK CYCLE AND ITS VULNERABILITIES . For example. The Attack Cycle SURVEILLANCE Frequently. ESCAPE ATTACK Copyright Stratfor 2016 www. such as a vehicle-borne improvised The Terrorist Attack Cycle explosive device. small. there is A second round of surveillance comes after the target remarkable similarity in the planning process. We refer to this stage in attack motives and in the time and process required as pre-operational surveillance — surveillance that is to radicalize these different actors to the point that conducted before the operation is fully planned. has been selected. indepen. planners now will generally try to obtain Often an actor will come up with a list of potential a detailed description of physical security features and targets and then select one on which to focus. they decide to carry out a strike. The execution AP ION of these steps can be somewhat U ON fluid: Some degree of planning or preparation might come S before target selection. surveillance of potential targets to determine what tors — including sophisticated transnational groups security measures are in place around the target and to like al Qaeda or the Islamic State. There can be great variance their list rather than risk failure. and lone wolves. the actor will pick a target and then devise a method of attack TARGET PLANNING based on its characteristics and SELECTION WE ISIT AQ vulnerabilities. the actor has pre-select- ed a method of attack.

looking for choke points (places that complete. To observer can use the attack cycle model to understand protect operational security. especially if the target is mobile and the person passes through predictably. Vulnerabilities Often. but by and large there is no way to stop an attack once it has It should be noted that in some types of attacks — been set in motion. bullets fly or the explosive device is detonated. be briefed in any great detail about the target of their operation until they are very close to being deployed. in other cases. But frequently. The dry run may result in is little security forces can do but initiate their imme- final adjustments to the plan. the attackers plan to be captured as part of the media exploitation FURTHER PREPARATION phase — they will seek to escape the scene after the During the planning phase. or excellent attack recognition and reaction. the surveillance team will look for patterns and routines that the target follows between these known DEPLOYMENT locations. small-boat handling or land navigation. the weapons and money available. the weapons for the attack will be acquired during the If the target is a person. as a final step in the cycle. and whether good escape succeed once it has moved to the operational phase. can be expected around the facility at the time of day the concept of the operation will be constrained by the attack is anticipated. the means of attack established. this point frequently will be chosen as the attack site. Planners often will analyze the person’s Once planning. They also will focus on es. The team must be passed to get from one point to another). security force procedures. If frequently will conduct surveillance of the target one the surveillance team identifies a choke point that the last time. mission — or. Sometimes an attacker will have acquired weapons for tablishing a baseline understanding of the activity that the attack before the planning phase. some of the 9/11 hijackers took their ond. determine whether attackers can deploy to that point in secret. the attackers will generally be if they are to have any chance of stopping it. security personnel for the most part must detect assigned flights for the attack in August 2001. diate action drills in efforts to mitigate the impact of 3 • STRATFOR UNDERSTANDING THE ATTACK CYCLE AND ITS VULNERABILITIES . marksmanship. routes are available. If the location meets those criteria. they will then try to attack team is waiting at a predetermined site. the operatives may not how an attack was planned and executed. his or her residence. the attack team can be deployed. the planning phase will end with a dry run While plots are occasionally thwarted at the last sec- — for example. there tion from law enforcement. the personnel who will attack is carried out. bad luck. such as a suicide attack or acts carried out by a mental- ly disturbed person — escape is not necessarily a factor Unless the operation has been planned as a suicide considered during the planning process. Sometimes attacks fail because of mistakes. ally. hand-to-hand to group or target to target. an attack is very likely to the target from that location. whether they will be able to spot and control If it was properly planned. Addition. office and planning phase. Once the unarmed to ensure they do not needlessly attract atten. after the target has been selected and other frequented haunts will be surveilled. actually carry out the attack are identified and trained in any special skills they may require for the mission These rules of attack planning vary little from group — including languages. While and interdict the plot before it gets to the attack phase conducting a dry run. Therefore. training and weapons acquisition are usual routes. a thoughtful combat.

It has taken several years for tradecraft. additional surveillance is often conducted attacks. it is frequently found that peo. it does not necessarily follow that members may engage in outside training that can terrorist planners are very good at it. where there are of ability. have displayed far greater comfort in conduct- ning stage and even sometimes in the attack stage. Each window of surveillance. Emphasis must decide they want to carry out a bombing. la recognized this problem and began to encourage ple who conduct terrorist surveillance tend to be quite grassroots jihadists to focus on conducting simple sloppy — even amateurish — in their surveillance attacks against soft targets. attackers can be identified by their actions is during the pre-operational surveillance period. ing simple attacks with readily available items. to include the dry run if conducted. Other types of grassroots militants. the attack and reduce casualty counts. surveillance is a mandatory part of Another significant vulnerability during the attack the planning cycle. a grassroots operative or cell might location of a building and its general shape on Google 4 • STRATFOR UNDERSTANDING THE ATTACK CYCLE AND ITS VULNERABILITIES . Some grassroots offenders have also tried to acquire Stinger anti-aircraft missiles. Money transfers might also take place at this stage. A planner can see the ties. communication between and move. even more so if a target is mobile. This creates a significant vulnerability in the evidence that attackers are actually following his advice terrorist attack cycle. The earliest point in the attack cycle that the agency informants. as with the 9/11 pilots. Additionally. to emerge as a trend in the jihadist realm. even if they be placed on identifying attackers early in the process. attending bad surveillance looks like. Unless the operation being planned involves something like a letter bomb. there simply is no grassroots operatives. planning process. cially pronounced when dealing with inexperienced but from an operational standpoint. who tend to aspire to conduct substitute for having eyes on the potential target — spectacular attacks that are far beyond their capabili. automatic firearms or Unless security forces have a source inside the group hand grenades. the only way to iden. Here. provides an additional opportunity for the Detecting Terrorist assailants to be identified and an attack prevented. reach out to someone for help with their attack instead tify attack planners is by noting their actions. such as an- at later stages of the attack cycle. don’t know how to make improvised explosive devices. but since 2014 there has been a discernible trend toward simpler As noted. jihadist leaders such as Nasir al-Wahayshi of al Qaeda in the Arabian Peninsu- Viewed with hindsight. with emphasis on what the firing range or. All of these scenarios can leave signs that tip EYES ON A POTENTIAL TARGET off authorities. archists. these types of grassroots plots no co-conspirators and no external communication have been disrupted by police or domestic security occurs. we’ll exam- attract attention — such as playing paintball. In many cases. Surveillance During the planning phase and as the operatives pre- pare to deploy. This is of settling on a more modest plan within their realm especially true of a lone wolf attack. This is espe. surveillance has been rendered obsolete by the Internet. As far back as 2009. Although target surveillance is a necessary part of the ment of group members often increases. When confronting the gap between that is planning the attack or manage to intercept their goals and capabilities. grassroots operatives often the group's communications. Some have argued that physical cycle comes with weapons acquisition. visiting ine surveillance more closely. For example. such as in the plan. well before they are in a position to strike. flight schools.

in Mumbai. intelligence. a man at Warren Street Underground station. the husband-and-wife shooter team in San Bernardino. Calif. In fact. Regardless. security professionals assigned to work surveillance op- ing that. in general. And the main like. (SCOTLAND YARD VIA GETTY IMAGES) Earth. Because of this. the things involved extremes. planners are vulnerable to detec. it is amaz. It allows them time to avoid an attack teams deployed in the November 2008 strikes immediate threat and to contact the authorities. surveillance professionals. This training teaches and 5 • STRATFOR UNDERSTANDING THE ATTACK CYCLE AND ITS VULNERABILITIES . But for The amount of time devoted to the surveillance those who do practice good situational awareness. KEYING ON DEMEANOR plex operations may require weeks or even months of To master the art of surveillance tradecraft. the process will vary depending on the type of operation poor surveillance tradecraft exhibited by those planning and its complexity (think. July 21. of course. law enforcement and Given that surveillance is so widely practiced. Practicing good for most attacks falls somewhere between these two demeanor is not intuitive. Com. but not what the building's access controls are essary to master the art of the tradecraft. surveillance frequently run counter to human nature. while a very simple operation may require to master the ability to display appropriate demeanor only minutes. The amount of surveillance required for whatever situation he or she is in. one needs surveillance. right. often some exceptions. vs. those conducting surveillance as erations receive extensive training that includes many part of a terrorist plot are usually terrible at it. There are hours of heavily critiqued practical exercises.. in maintaining good demeanor while conducting tion during this time. Left. the internal layout of the building or where the reason that so many have been able to get away with guards are located and what procedures they follow. but most people involved in followed by field training with a team of experienced terrorist planning simply do not devote the time nec. a man flees Oval Underground station. in December 2015). 2005. CCTV images of two out of four men wanted in connection with attempted suicide bombings in London. sloppy surveillance and demeanor is simply because most victims simply are not looking for them. for example. of the many attacks is good news.

they are able to control their reaction the target can sense more than observe. In other words. making sudden back into a doorway or turning around abruptly when turns or stops. 6 • STRATFOR UNDERSTANDING THE ATTACK CYCLE AND ITS VULNERABILITIES . assume he or she is under surveillance. people who are experiencing the burn feeling of being burned. rienced surveillance operatives occasionally have the Sometimes. due to syndrome exhibit almost imperceptible behaviors that their training.S. attempting not to be caught doing so. government uses the acronym "TEDD" to The purpose of using good cover for action and cover illustrate the principles that can be used to identify for status is to make the presence of the person con. or even using hand signals to commu- they unexpectedly come face to face with the person nicate with other members of a surveillance team or they are watching. In a sense. Feel. surveillance is watching someone while at that bus stop even after several buses have passed. them. such as hiding their faces or suddenly ducking avoiding eye contact with the target. TEDD stands for time. however. communicating when the target moves. if a target as he or she goes about his or her business. then that person can status. SURVEILLANCE DETECTION The U. person sees someone repeatedly over time. these feelings. things. They tend to just lurk and out of place. People conducting surveillance frequently look totally out of place. Surveillants also can tip off the person they are watching by entering or leaving a building im- People inexperienced in the art of surveillance find it mediately after the person they are watching or simply difficult to control this natural reaction. These same principles also can be used to identify When done right. it is For the most part. envi- with the mental snapshot subconsciously taken by the ronment. inexperienced operatives an unnatural activity. distance and demeanor. by running in street clothes. veillance is the failure to get into proper "character" for the job (“cover for status”) or. when in character. the difference is that. but the target just able to maintain a normal-looking demeanor while gets the gut feeling that there is something wrong or their insides are screaming that the person they are odd about the way a certain person is behaving toward watching has seen them. cies. It may not be and behave normally despite the sensation. surveillance conducted by counterintelligence agen- ducting the surveillance look routine and normal. and they can be easily detected. Even expe. or someone who dis- do not use proper (if any) cover for action or cover for plays poor surveillance demeanor. Innocent bystanders who are not watching someone usually do not exhibit this behavior or trigger Another very common mistake made by amateurs in sur. An example of bad cover for action is some- one pretending to be sitting at a bus stop who remains At its heart. Other giveaways include a person moving when the ing "burned" will cause surveillants to do unnatural target moves. the surveillance operative fits in terrorist surveillance. Inex. and a person doing it must deal conducting surveillance practice little or no cover for with strong feelings of self-consciousness and of being action or cover for status. in different perienced people who conduct surveillance frequently environments and at a distance. appear. PRINCIPLES OF ing in places or carrying out activities that are incongru- ent with the character's "costume" (“cover for action”). reinforces good demeanor. suffer from "burn syndrome" — the belief that the people they are watching have spotted them. criminal gang. the beach. Terrorist operatives typically An example of bad cover for status would be someone do not receive this type of training — especially those dressed as "a businessman" walking in the woods or at who are grassroots or lone wolf militants. They are something that can be articulated.

For an individual. One technique that can be helpful in looking for you would have only the demeanor of the surveillant people conducting long-term surveillance is to identify to key on. TEDD is really relevant only if you mannerisms and gait. environment and distance also have little bear. such as shootings or 2015 San Bernardino attacks). security plan. Maintaining a state of relaxed awareness vehicles or license plates — also demonstrates why — and understanding the vulnerabilities in the attack watching for mistakes in demeanor is critical. Therefore. you will likely be exposed to the time. opportunity to make environment and distance cor- relations. it is not as easy to instance. provide optimal visibility. In such an can change the license plate on a car. Living in a state of paranoia and looking for a The fact that operatives conducting surveillance over terrorist behind every bush not only is dangerous to an extended period can change their clothes and wear one's physical and mental health but also results in hats. Time. build. since surveillance targets rarely look up. In these people who don't belong there. the Demeanor also works in tandem with all the other front door of a potential target's residence or office. 7 • STRATFOR UNDERSTANDING THE ATTACK CYCLE AND ITS VULNERABILITIES . being paranoid or obsessively concerned about secu- rity. worked at a ple making more subtle demeanor mistakes. demeanor is also critical in Practicing good situational awareness does not mean identifying bad intent. places that provide optimal visibility of a critical place cal of the four elements in recognizing surveillance. or elements: Poor demeanor will often help the target a choke point on a route the potential target frequent- spot the surveillant at a different time and place or in a ly travels). wigs or other light disguises — and use different poor security. In these cases. while a surveillant are being specifically targeted for an attack. Perches should ing in insider attacks (such as the 2009 Fort Hood be watched for signs of hostile surveillance. or "perches" in surveillance jargon. facility and had solid cover for action and cover for status. However. the assailant was an insider. the surveillant would want to watch (for example. people lurking. if the target (scratches and dents). n ing or hair — such as a person's facial features. then. In all probability. It is also important to look for places that different environment. and perhaps not even time. envi. Additionally. alter other aspects of the vehicle such as body damage ronment and distance elements. Elevated perches tend to be especially effective. Focus on planning cycle — are the keys to an effective corporate the things that cannot be changed as easily as cloth. or peo- instances. demeanor is the most criti. Paying attention to small details of the attack is a subway car or a building you work can be the difference between a potential attacker be- in — not you personally — you likely won’t have an ing identified and the attacker going unnoticed.

provide training offering insight into its ing. Stratfor Enterprise Memberships leverage technology to disseminate content across organizations and can be customized to fit every size organization and budget. CONTACT: business@stratfor. insightful. thought-provoking tants and strategists that supports our presentations on current headlines and clients' business objectives by performing future trends for industry events and a range of advisory services. consul. STRATFOR PROVIDES 3 CORE ENTERPRISE PRODUCTS ENTERPRISE MEMBERSHIP Stratfor’s Enterprise Membership platform organizes and delivers daily. investors and fund managers as well as military and academic professionals. analysis and forecasting. Stratfor can also assessments. among others. strategic planning support. CUSTOM ADVISORY KEYNOTE SPEECHES & SERVICES METHODOLOGY TRAINING Our advisory engagements focus on direct Stratfor's keynote speakers deliver contact with a team of WEBSITE: stratfor. including risk corporate gatherings. and methodology for developing such protective intelligence. weekly and monthly analysis to meet the needs of busy . global intelligence monitor.