Coming Monday: The first part of a four-part series on transport infrastructure development in East Africa

26 3 googleplus 1 608 70

NOV 8 !"#$ % ##:&$ 'MT

This *ee;ly is part of multiple Timelines

- Choose Timel ine -

The (roactive Tool of (rotective )ntelligence

Security Weekly *E+NE,+A- NOVEM.E/ 0 !""0 - #!:$8 d Print 1 Te2t ,i3e 4

Terrorist Attac; Cycle Timeline

B Vie: Aull Timeline

By Fred Burton and Scott Stewart On Nov5 6 67-year-old ,panish 8usinessman Edelmiro Manuel (9re3 Merelles :as freed from captivity after 8eing held for nearly t:o :ee;s 8y ;idnappers :ho gra88ed him from his vehicle in the Me2ico City metropolitan area5 The fact that a ;idnapping occurred in Me2ico is not at all unusual5 *hat is unusual is the enormous press coverage the case received largely 8ecause of the audacity and 8rutality of the attac;ers5 (9re3 Merelles :as snatched from his car Oct5 !! after a gang of heavily armed assailants 8loc;ed his vehicle and in full vie: of :itnesses ;illed his 8odyguard<driver delivering a coup de gr4ce shot to the 8ac; of his head5 The a8ductors then shoved the driver=s 8ody into the trun; of (9re3 Merelles= car :hich :as later found a8andoned5 After the a8duction :hen the family 8al;ed at the e2or8itant amount of ransom demanded 8y the ;idnappers the criminals reportedly upped the ante 8y sending t:o of (9re3 Merelles= fingers to his family5 A ransom finally :as paid and (9re3 Merelles :as released in good health though sans the fingers5 )n a :orld in :hich militants and criminals appear increasingly sophisticated and 8rutal this case highlights the need for protective intelligence >()? to augment traditional security measures5 Action versus /eaction As any foot8all player ;no:s action is al:ays faster than reaction5 That principle provides offensive players :ith a slight edge over their opponents on the defense 8ecause the offensive players ;no: the snap count that :ill signal the 8eginning of the play5 No: some crafty defensive players :ill anticipate or @ump the snap to get an advantage over the offensive players 8ut that anticipation is an action in itself and not a true reaction5 This same principle of action and reaction is applica8le to security operations5 Aor e2ample :hen mem8ers of an a8duction team launch an assault against a target=s vehicle they have the advantage of tactical surprise over the target and any security personnel protecting the target5 This advantage can 8e magnified significantly if the target lac;s the proper mindset and free3es in response to the attac;5 Even highly trained security officers :ho have 8een schooled in attac; recognition and in responding under pressure to attac;s against their principal are at a disadvantage once an attac; is launched5 This is 8ecause in addition to having the element of tactical surprise the assailants also have conducted surveillance and have planned their attac;5 Therefore they presuma8ly have come prepared -- :ith the num8er of assailants and the right :eaponry -- to overcome any security assets in place5 ,imply put the criminals :ill not attac; unless they 8elieve they have the advantage5 Not all attac;s succeed of course5 ,ometimes the attac;ers :ill 8otch the attempt and sometimes security personnel are good enough -- or luc;y enough -- to regain the initiative and fight off the attac; or other:ise escape5 )n general ho:ever once an attac; is launched the attac;ers have the advantage over the defender :ho not only is reacting 8ut also is simultaneously attempting to identify the source location and direction of the attac; and assess the num8er of assailants and their armament5 Aurthermore if a gang is 8ra3en enough to conduct a serious crime such as ;idnapping for

NE*E/ C
AE. !0 !""8

'rassroot s Dihadist s and the Thin .lue Eine

DAN $" !""8

The =Eone *olf= +isconnect

NOV 7, 2007

The (roactive Tool of (rotective )ntelligence

AF' !! !""0

Threat s ,it uational A:areness and (erspective

MA- $" !""0

The Challenge of the Eone *olf

DAN #8 !""7

.e:are of =Gramer=: Tradecraft and the Ne: D ihadist s

OCT !& !""&

The Terrorist Att ac; Cycle: Escape

OCT #" !""&

The Terrorist Att ac; Cycle: Media E2ploit ation

OCT 7 !""&

The Terrorist Att ac; Cycle: +eployment and Att ac;

OCT 6 !""&

The Terrorist Att ac; Cycle: Operational (lanning

,E( $" !""&

The Terrorist Att ac; Cycle: ,electing the Target

,E( !H !""&

Vulnera8ilit ies in the Terrorist Att ac; Cycle

'et our A/EE :ee;ly )ntelligence /eports

Enter -our Email Address

ransom :hich carries stiff penalties in most countries chances are the same group is capa8le of committing homicide during the crime5 ,o using the ;idnapping e2ample the gang :ill account for the presence of any security officers in its planning and :ill devise a :ay to neutrali3e those officers -- as the attac;ers neutrali3ed the 8odyguard in the (9re3 Merelles a8duction5 Even if the target is traveling in an armored vehicle the attac;ers :ill plan a :ay to immo8ili3e it 8reach the armor and get to their victim5 )n a ;idnapping scenario once the target=s vehicle is stopped or disa8led the assailants can place an e2plosive device on top of it forcing the occupants to open the door or ris; death -- a tactic :itnessed several times in Eatin America -- or they can use hand tools to pry it open li;e a can of sardines if given enough time5 ,ince most armored vehicles use the car=s factory-installed door-loc; system techniIues used 8y car thieves such as using master ;eys or punching out the loc;s also can 8e used effectively against an immo8ili3ed armored vehicle5 This same principle applies to physical security measures at 8uildings5 Measures such as 8adge readers closed-circuit TV coverage metal detectors cipher loc;s and so forth are an important part of any security plan -- though they have finite utility5 )n many cases assailants have mapped out Iuantified and then defeated or 8ypassed physical security devices5 (hysical security devices reIuire human interaction and a proactive security program to optimi3e their effectiveness5 Armed guards armored vehicles and physical security devices can all 8e valua8le tools 8ut they can 8e defeated 8y attac;ers :ho have planned an attac; and then put it into play at the time and place of their choosing5 Clearly a :ay is needed to deny attac;ers the advantage of stri;ing :hen and :here they choose or even 8etter to stop an attac; 8efore it can 8e launched5 )n other :ords security officers must play on the action side of the action<reaction eIuation5 That is :here () comes in5 (rotective )ntelligence )n simple terms () is the process used to identify and assess threats5 A :ell-designed () program :ill have a num8er of distinct and crucial components or functions 8ut the most important of these are countersurveillance investigations and analysis5 The first function countersurveillance serves as the eyes and ears of the () team5 As noted a8ove ;idnapping gangs conduct e2tensive preoperational surveillance5 .ut all criminals -- stal;ers thieves lone :olves militant groups etc5 -engage in some degree of preoperational surveillance though the length of this surveillance :ill vary depending on the actor and the circumstances5 A purse-snatcher might case a potential target for a fe: seconds :hile a ;idnapping gang might conduct surveillance of a potential target for :ee;s5 The degree of surveillance tradecraft -- from very clumsy to highly sophisticated -- also :ill :idely vary depending on the operatives= training and street s;ills5 )t is :hile conducting this surveillance that someone :ith hostile intentions is most apt to 8e detected ma;ing this the point in the attac; cycle that potential violence can most easily 8e disrupted or prevented5 This is :hat ma;es countersurveillance such a valua8le proactive tool5 Although countersurveillance teams are valua8le they cannot operate in a vacuum5 They need to 8e part of a larger () program that includes the analytical and investigative functions5 )nvestigations and analysis are t:o closely related yet distinct components that can help to focus the countersurveillance operations on the most li;ely or most vulnera8le targets help analy3e the o8servations of the countersurveillance team and investigate any suspicious individuals o8served5 *ithout an analytical function it is difficult for countersurveillance operatives to note :hen the same person or vehicle has 8een encountered on different shifts or at different sites5 )n fact countersurveillance operations are far less valua8le :hen they are conducted :ithout data8asing or analy3ing :hat the countersurveillance teams o8serve over time and distance5 )nvestigations also are important5 Most often something that appears unusual to a countersurveillance operative has a logical and harmless e2planation though it is difficult to ma;e that determination :ithout an investigative unit to follo:-up on red flags5 The investigative and analytical functions also are crucial in assessing communications from mentally distur8ed individuals for trac;ing the activities of activist or e2tremist groups and for attempting to identify and assess individuals :ho ma;e anonymous threats via telephone or mail5 Mentally distur8ed individuals have long posed a su8stantial >and still underestimated? threat to 8oth prominent people and average citi3ens in the Fnited ,tates5 )n fact mentally distur8ed individuals have ;illed far more prominent people >including (resident Dames 'arfield .o88y Gennedy and Dohn Eennon? than militants have in terrorist attac;s5 Aurthermore nearly all of those :ho have

'ET /E(O/T,J

Doin over $&" """ readers on our A/EE intel reports list5
We will never sell or share your email address or information with anyone.

E+)TO/=, CKO)CE
F5,5 and )ranian /ealit ies

.alancing ,hia and ,unni /adicalisms

The )slamic /evolut ionary 'uard Corps (art #: An Fnconvent ional Milit ary

/EEATE+ CONTENT
A Eoo; at Gidnapping t hrough t he Eens of (rot ect ive )nt elligence A8ove t he Tearline: )nside a (rot ect ive Agent =s Mind

Threat s ,it uat ional A:areness and (erspect ive

/EEATE+ ,)TFAT)ON /E(O/T,

Afghanistan: Camp .astion Attac;ed
,E( #6 !"#! % #7:"6 'MT

Algeria: Militants ,ay Army Attac; )n@ures ! Kostages

DAN #0 !"#$ % "7:&! 'MT

Genya: Authorities Fncover (lan Aor Terrorist Attac;

,E( #6 !"#! % "H:"$ 'MT

committed attac;s have self-identified or other:ise come to the attention of authorities 8efore the attac; :as carried out5 .ecause of this () teams ensure that no mentally distur8ed person is summarily dismissed as a Lharmless nutL until he or she has 8een thoroughly investigated and his or her communications carefully analy3ed and data8ased5 +ata8asing is crucial 8ecause it allo:s the tenor of correspondence from a mentally distur8ed individual to 8e monitored over time and compared :ith earlier missives in order to identify signs of a deteriorating mental state or a developing intent to commit violence5 () teams :ill often consult mental health professionals in such cases to assist :ith psycholinguistic and psychological evaluations5 Not all threats from the mentally distur8ed come from outside a company or organi3ation ho:ever5 Although the common perception follo:ing a :or;place incident is that the employee L@ust snapped L in most cases the factors leading to the violent out8urst have 8een 8uilding up for a long time and the assailant has made detailed plans5 .ecause of this :or;place or school shootings seldom occur randomly5 )n most cases the perpetrator has a targeted a specific individual or set of individuals that the shooter 8elieves is responsi8le for his plight5 Therefore () teams also :ill :or; closely :ith human-resources managers and employee mental health programs to try to identify early on those employees :ho have the potential to commit acts of :or;place violence5 )n :or;place settings as :ell as other potential threat areas () operatives also can aid other security officers 8y providing them :ith the photographs and descriptions of any person identified as a potential pro8lem5 The person identified as the potential target also can 8e 8riefed and the information shared :ith that person=s administrative assistants family mem8ers and household staff5 Another crucial function of a () team is to Lred team L or to loo; at the security program from the outside and help identify vulnera8ilities5 Most security loo;s from the inside out 8ut () provides the a8ility to loo; from the outside in5 )n the e2ecutive protection realm this can include an analysis of the principal=s schedule and transportation routes in order to determine the most vulnera8le times and places5 Countersurveillance or even overt security assets can then 8e focused on these crucial locations5 /ed teams also sometimes perform cy8erstal;er research5 That is they study a potential target through a criminal or mentally distur8ed person=s eyes -- attempting to o8tain as much opensource and pu8lic record information on that target as possi8le in order to 8egin a surveillance operation5 ,uch a pro@ect helps to determine :hat sensitive information is availa8le regarding a particular target and highlights ho: that information could 8e used 8y a criminal planning an attac;5 /ed teams also :ill attempt to invade a facility in order to test access control or to conduct surveillance on the operations in an effort to identify vantage points >or LperchesL? that :ould most li;ely 8e used 8y someone surveilling the facility5 Once the perches around one=s facility are identified activities at those sites can 8e monitored ma;ing it more difficult for assailants to conduct preoperational surveillance at :ill5 One other advantage to () operations is that 8eing amorphous 8y nature they are far more difficult for a potential assailant to detect than are traditional security measures5 Even if one () operative is detected -- regardless of :hether the team has identified its targets -- the surveillers= an2iety :ill increase 8ecause they li;ely :ill not ;no: :hether the person they encounter is a countersurveillance operative5 This com8ination of countersurveillance analysis and investigation can 8e applied in a num8er of other creative and proactive :ays to help ;eep potential threats off 8alance and deny them the opportunity to ta;e the initiative5 Although a large glo8al corporation or government might reIuire a large () team these core functions can 8e performed 8y a s;illed compact team or even 8y one person5 Aor e2ample a person living in a high-threat environment such as Me2ico City can acIuire the s;ills to perform his or her o:n analysis of route and schedule and can run surveillance detection routes in order to smo;e out hostile operations5 The details of the (9re3 Merelles ;idnapping indicate that it :as a professionally planned and :elle2ecuted operation5 Crimes of this cali8er do not occur on the spur of the moment 8ut rather reIuire e2tensive surveillance intelligence gathering and planning -- the very types of activities that are vulnera8le to detection through the proactive tool of ()5 Tell Ared and ,cott :hat you thin;'et your o:n copy

,end us your thoughts on this report5

26

googleplus

608

70

/eprinting or repu8lication of this report on :e8sites is authori3ed 8y prominently displaying the follo:ing sentence including the hyperlin; to ,tratfor at the 8eginning or end of the report5 LThe (roactive Tool of (rotective )ntelligence is repu8lished :ith permission of ,tratfor5L Simply copy and paste this code LMa hrefNLhttp:<<:::5stratfor5com<:ee;ly<proactiveOtoolOprotectiveOintelligenceLPThe (roactive Tool of (rotective )ntelligenceM<aP is repu8lished :ith permission of ,tratfor5L

,F.,C/).E

EO')N

*hat is ,tratforQ
,tratfor provides glo8al a:areness and guidance to individuals governments and 8usinesses around the :orld5 *e use a uniIue intel-8ased approach to analy3e :orld affairs5

Copyright R !"#$ ,tratfor % !!# *est 7th ,treet ,uite 6"" - Austin TS 080"# F,A