CHAPTER 6
THERE ARE COUNTLESS TYPES OF ATTACKS based on targets, weapons used, and other considerations. There are, however, certain similarities regardless of the specific type of attack. The similarities are based on what is known as the Hostile Events Attack Cycle. Whether the attack is mounted by a sophisticated, organized group or by a lone individual, there are steps that will always be followed, and surveillance is their most common denominator.
As attackers plan, prepare, and execute their operation, the Hostile Events Attack Cycle demonstrates how they can succeed and often escape. While there are examples of incidents that were impulsive, most attacks require considerable planning that will often span weeks, months, or even years.
Apparently, Osama bin Laden began thinking about what became the September 11 plot in 1996. It was not until early in 1999 that bin Laden gave his approval for Khalid Sheikh Mohammed to begin formal planning. What followed throughout the year was a series of meetings about selecting individuals to manage the attack with special consideration given to the nationalities of attackers so they could more easily get visas to go to the United States. An al-Qaeda “military committee” was formed and led by Khalid Sheikh Mohammed that was responsible for the complicated operational support. This included selecting targets and arranging for the hijackers’ travel to the United States. The list of potential targets was long and included nuclear facilities, but was finally cut down to four targets on the east coast.
In order to avoid having all of the participants located in the same place, the al-Qaeda leadership created the Hamburg cell in 1998. Mohamed Atta, who had gone to Hamburg to study urban planning in 1992, was in charge of the Hamburg cell. He was later joined by Ramzi bin al-Shibh who arrived in Hamburg in 1997. The two became roommates and both received training at al-Qaeda training camps in Afghanistan. Originally, bin al-Shibh was supposed to be a hijacker pilot but failed to get a visa to come to the United States. The selection of the hijackers was made by bin Laden and his lieutenant Mohammed Atef after a series of meetings with Mohamed Atta.
Before applying for US visas, the Hamburg-based terrorists were able to get new passports after claiming their old ones had been lost. Once group members were back in Germany, they followed guidance on proper demeanor by changing their appearance, as well as their behavior. They stopped attending radical mosques where they had met and no longer engaged in radical discussions. Their goal was to appear as moderate and as normal as possible in every way.
In order to support their visa applications, group members paid tuition for programs in schools such as the Florida Flight Training Center. Such applications were an essential part of the story they were telling consular officers at the US Embassy. Other necessary steps involved the creation of bank accounts and the transfer of money into those accounts so they could prove they had the resources to support themselves in the United States. The next step in this complicated effort was the hijackers’ applications to attend airline training programs. Mohamed Atta was responsible for this aspect of their plan and sent over fifty emails to various flight training schools in the United States. With this success, in May 2000, Atta applied for and received his visa, as did the other members of the team.
There were considerable financial resources required for the US planning stage of the plot. According to the 9/11 Commission Report, Atta distributed as much as $500,000 to the group members shortly before the day of the attack. The precise identities of those who had provided this support were never made public, but numerous official statements indicated a complicated network that led to Saudi Arabia. The 9/11 Commission Report also paints a picture of failure by the FBI, the CIA, and other security services in the United States that failed in their investigatory and surveillance responsibilities.
It is easy to understand that a massive plot such as the 9/11 attacks would be complicated and expensive. However, the basic steps in a plot such as this and a more modest one involving a lone attacker are similar. In June of 2015, a white supremacist neo-Nazi named Dylann Roof entered a Bible study at Emanuel African Methodist Episcopal Church in South Carolina. In planning this attack, Roof followed the principles outlined in the Hostile Events Attack Cycle. He began his planning at least nine months before the actual attack. He visited the target on several occasions and even attended a church service there at one time. His preliminary observations were followed by a series of intense observations to determine attendance patterns. He rigorously practiced using his weapons, including rapid reloading procedures, and his escape plan. He even operated his own website in which he proclaimed his hatred of African Americans and other minorities. He outlined his motives, saying that he hoped to spark a race war in the United States and that he believed at the end of that war he would be pardoned by the victorious whites. He expressed his confidence that he would then be appointed as governor of South Carolina. Instead, he was convicted of murder and sentenced to death.
Whether the threat is complex, such as the September 11 attacks, or limited to one person, as in the South Carolina church attack in 2015, protection professionals require highly specialized training. An important step in this is known as Hostile Environment Surveillance Operations or HESO. To understand conditions affecting surveillance activities in a hostile environment, it is important to know what constitutes a hostile environment. Preliminary observations will enable a surveillance team to know if the region is under a threat of war, civil unrest, or insurrection. Less devastating but still critical to surveillance operations are high levels of crime or public disorder. The same impact on operations will be caused by natural events, such as earthquakes, floods, or hurricanes.
There is a clear distinction between hostile locations caused by environmental factors as opposed to man-made factors. This distinction does change the operational demands for surveillance teams. Activities such as covert filming pose special threats because there is often a popular, as well as an official, distrust of operatives doing this. The same risk exists for surveillants needing to observe terrorist incidents. For a surveillance team conducting a risk assessment during a reconnaissance mission, it will be important to report issues, hazards, and controls affecting future operations in that region.
The most important objective for Hostile Environment Surveillance Operations (HESO) is to gather information about any force that might constitute a threat and to use that information to prevent an attack. This is relevant for the protective efforts of a government or for an individual. In order to satisfy these objectives, HESO training is divided into four categories.
The first is protective surveillance (PST) which is an effort to create a protective ring around the potential target. Members of this team must identify any land or location that could be used as a perch for surveillance of the target. A team member must secure each such location whether it is a rooftop or a ditch. If any member identifies a hostile surveillance team, the close protection team must be called. Should their response not be quick enough, the protective surveillance personnel must act as a quick reaction force and protect the target or remove the target from the danger zone. For this reason, protective surveillance team members must be trained in tactics for close protection and kidnap prevention.
The second category is surveillance detection and is aimed at detecting hostile or suspicious activity before an attack can be mounted. The surveillance detection team (SDT) must identify any locations that could be used for observing the possible target they are protecting. By considering how they would attack their own facility and studying avenues of attack, they can develop a comprehensive detection plan. They will monitor the critical locations and watch for any traffic in those areas, including both foot and automobile traffic. The key is to determine which traffic consists of people or vehicles that seem out of place. The SDT is responsible for examining the travel routes taken by the target and when he would be most vulnerable to an attack. This work must be done discreetly so the hostile surveillance team does not realize the SDT is observing them. This situation will make it easier for the hostile team to become over-confident and make mistakes. If the surveillance detection team collects sufficient intelligence, it will be possible to call in counter surveillance personnel to organize an operation against the hostile surveillance team.
The third category in Hostile Environment Surveillance Operations is counter surveillance. CS includes actions taken to neutralize hostile surveillance operations. By observing the actions of a hostile surveillance team, CS personnel can develop deceptive efforts to mislead the hostile threat and exploit any mistakes they might make. A typical tactic employed in this context is to create alternative routes that the person you are protecting may take to travel from one place to another. The use of a multi-car convoy was used by the US-trained team protecting Augusto Pinochet when Chilean terrorists attempted to assassinate him. The chauffeurs employed defensive driving techniques and confused the attackers who guessed wrong about which car Pinochet was traveling in. Because civilian contractors are playing a bigger role in counter surveillance, these necessary skills are now on the market for would-be attackers to employ against protective services.
The collection of detailed intelligence that identifies the vulnerabilities of a potential target is the final category in Hostile Environment Surveillance Operations. This is referred to as Close Target Reconnaissance (CTR). If CTR personnel are protecting commercial buildings or residences, they will assemble intelligence that helps them identify possible entry points into the building and determine structural vulnerabilities of those facilities. This is work requiring a different skill set from those working in other aspects of HESO. Special emphasis is placed on a vast array of disciplines including environmental and terrain analysis, tactical tracking operations, covert patrol tactics, and facility vulnerability assessments. There are additional specializations that constitute the core curriculum of HESO training: advanced level training in covert physical surveillance, specialized training in night surveillance operations, target identification, and firearms training. Moreover, experiences in Afghanistan and Iraq have recognized the development of skills to detect suicide bombers and IEDs.
Among the most important facilities requiring protection are US embassies. The embassy is one of the most convenient targets for radical groups hoping to express their hatred of the United States. The history of embassy attacks can be traced back more than fifty years with 1968 marking the first chapter in this terrible history. At that time, an anti-Vietnam War demonstration in front of the US Embassy in London turned violent when several thousand demonstrators invaded the embassy grounds. Other attacks followed, most painfully, in 1979 when the US Embassy in Tehran was occupied by rioters who took the embassy personnel hostage and held them for 444 days. American embassies and consulates have become primary terrorist targets in recent years. In 1998, al-Qaeda gained infamy for attacking two US embassies in Africa on the same day.
Specific responsibility for the protection of embassies and embassy personnel rests with the Diplomatic Security Service. One recent innovation has been the creation of a safe room in most embassies located in what are regarded as hostile environments. CTR teams may be employed for special purposes such as management of convoys, their protection against terrorist attacks, and protection of employees in the safe rooms.
Diplomatic personnel are frequent targets, such as in 2012 with the attack on the US consulate in Benghazi, Libya and the deaths of the US ambassador and multiple security personnel. Over the last five years, dozens of American diplomats and intelligence officers have experienced a range of strange and often severe ailments. Most of these victims in these “health attacks” were serving in Cuba, Russia, or China although some were in the United States when struck by health problems, including traumatic brain injuries, part of something now known as “Havana Syndrome.” There have been documented cases of at least twenty-one US victims who have suffered from long-term hearing loss and speech problems. In 2021, there was increased speculation in the media about this phenomenon because of a work injury lawsuit that was filed by a retired National Security Agency counterintelligence officer. The officer developed a rare form of Parkinson’s disease that, according to his lawyer, was caused by some sort of high-tech weapon.
Apparently, this has been an issue within the US intelligence community for decades. “Havana Syndrome” victims experience nausea, ringing ears, vertigo, and traumatic brain injury. These reports prompted both the White House and the Senate Intelligence Committee to direct research on the possibility that high-tech weapons are being used to attack diplomatic personnel. Members of the Senate Intelligence Committee suggested that a high-powered microwave weapon may have been used in the attacks. This is a weapon that can weaken or even kill an enemy over a long period of time while leaving no evidence. In 2012, intelligence information indicated that this weapon was intended to flood the target’s living quarters with microwaves. This would result in physical injuries such as a damaged nervous system. Working with bipartisan support, the Biden White House initiated a program to discover the cause of the “Havana Syndrome.”
Russia is known to have experience with radio frequency research, and this has fueled speculation that the diplomats may have been attacked with a microwave weapon, as cited above. In the case of the injuries sustained at the US Embassy in Havana, there is suspicion that a botched surveillance job may have been responsible. The fact that attacks seem to have been limited to specific rooms or even certain parts of those rooms has added to official confusion about the attacks. Not surprisingly, this uncertainty makes the work of a target reconnaissance team more difficult. These problems seem to have been caused by “pulsed” and “directed frequencies” that are often associated with hostile surveillance efforts.