We spend a whole lot of time and money every year trying to stop “bad people” from doing “bad things.” We attempt as best we can to catch terrorists, both domestic and international, before they act and before people are killed. The sad truth, however, is that much of the time what we are really doing is trying to catch ourselves.
We look at a target. We think about how we would attack it and what we would need to do to prepare for such an attack, and then we go out and try to stop anyone from implementing the plan that we have formulated. Meanwhile, individuals with a radically different worldview and radically different objectives remain, all too often, undetected.
If you want to see this thought process in action take a look at the plethora of courses taught every year across this country on the terrorist attack cycle. There are several different versions of the cycle floating around at present, all with slightly different wording, but they all basically agree that terrorist attack planning occurs in a six-stage cycle: preliminary target selection, initial surveillance, final target selection, pre-attack surveillance, planning, rehearsal, execution, escape and exploitation.
There is nothing wrong with the use of frameworks like this to help us organize our thoughts. Without them, we are likely to find it difficult to analyze information in front of us. As taught, however, the terrorist attack cycle concept often suggests that terrorists are bound to some formal, rigid planning process much like a military staff officer preparing an ops plan.
Terrorists don’t work that way, and to understand just how true that is let’s consider the assassination of Rafik Hariri, one of the most high-profile targets killed by a terrorist group in recent years.
Hariri, a former prime minister of Lebanon, was killed with 21 others on Feb. 14, 2005, when a truck bomb exploded near his motorcade in Lebanon. The massive explosion that killed Hariri literally shook all of downtown Beirut and destroyed not just his vehicle but the entire motorcade.
Subsequent investigation determined that Hariri had been killed by Hezbollah, a Shia terrorist group allied with Iran. Hariri had a strong pro-Western orientation and had been an opponent of Hezbollah, Iran and Syria for years. He and his security personnel were well aware that he was being targeted for assassination.
As a result, the security measures in place to protect Hariri were on par with those that might be deployed to protect the president of the United States. He traveled in an armored vehicle as part of a six-car convoy. He was protected by guards carrying handguns and wearing radio earphones connected to a private radio network. In their cars were automatic rifles, a radio-signal jammer and rocket-propelled grenades and missile launchers. The jammer designed to prevent the remote detonation of explosive devices was so powerful that it disrupted communications in Beirut neighborhoods as the motorcade passed through them.
Unfortunately for Hariri, Hezbollah did not elect to get in a gunfight with his security personnel nor did they choose to utilize a remote detonated device. Instead, based on their assessment of the situation they elected to go with a massive, mobile improvised explosive device, carried on a flatbed truck and detonated by a suicide bomber.
Hariri lived and worked in a compound called Quraitem Palace. On the morning of the attack Hariri’s motorcade left that location for Nejmeh Palace, Lebanon’s Parliament building. It arrived about 13 minutes later, and Hariri spent the next hour inside. At 11:56 a.m., Hariri returned to his convoy, and prepared to depart.
According to subsequent investigation of cellphone activity in the area, at that same moment, several cellphone calls were made from the vicinity of the Parliament building to another group of phones a short distance away. Shortly thereafter the flatbed truck, carrying two tons of plastic explosive, began to move north along what would be Hariri’s route back to his residence.
Hariri then changed his mind about leaving. He decided at the last minute to meet a contact at a café across the street. The bodyguards were notified of the delay. Immediately thereafter another series of cellphone calls took place, and the driver of the flatbed truck pulled over and parked. Hariri stayed in the café for 45 minutes. During that time the cellphones remained silent.
Finally, Hariri left the cafe and returned to his car. The convoy moved out, and the cellphone traffic picked up again. Shortly thereafter the flatbed truck carrying the bomb began to move again. The truck moved slowly in order to ensure that it would be overtaken by Hariri’s motorcade, which was traveling on the same route. In effect, the suicide bomber driving the vehicle was letting Hariri come to him.
Shortly thereafter the motorcade overtook the flatbed truck. The bomber detonated the device next to the fourth vehicle to pass. This was likely a miscalculation as Hariri, driving himself, was in the third vehicle.
Only fragments of the bodies of the individuals in the fourth car were ever found. Hariri was blown out of his car and almost certainly died immediately.
After the attack UN investigators, using cellphone records from two Lebanese cellphone companies, were able to piece together a picture of the surveillance that had been mounted on Hariri prior to the attack. What they uncovered was remarkable.
Beginning in October 2004, a cluster of cellphones began following Hariri and his motorcade wherever they went. These phones stayed close day and night, until the day of the bombing when nearly all 63 phones in the group immediately went dark and never worked again.
UN investigators were ultimately able to identify several distinct teams of individuals working in cells. Working in these cells and under the clear direction of Hezbollah headquarters, these surveillants maintained coverage of Hariri continuously for six months without detection, mapping his movements, making book on his security and analyzing every aspect of the security around him. This coverage did not extend purely to official movements; Hariri was literally covered all day, every day until his murder.
Analysis of cellphone records for the cell that was covering Hariri on the day he was killed also showed that one week prior to the attack cell members were in exactly the same locations at exactly the same times. Hariri followed the same pattern on that day as he did on the day of his death. Either the attack cell rehearsed the attack on that date, or they attempted and failed to assassinate Hariri on that date.
After Hariri’s death all of the attack cell’s phones went offline forever.
The facts surrounding Hariri’s murder paint a chilling picture. Let’s consider, however, what they tell us about the terrorist attack cycle and how rigidly we ought to apply it.
Preliminary target selection, initial surveillance and final target selection: As taught, the cycle suggests that terrorists will look at multiple potential targets, assess them and then select one for attack. It typically also is interpreted to mean that terrorists will discard “hard” targets and move on to one that is less secure and more easily attacked. None of that happened in this case.
Hariri employed massive security resources. Killing him required the dedication of huge resources for an extended period of time. It did not matter. Hariri had made himself the No. 1 enemy of Iran, Hezbollah and Syria in Lebanon. He needed to be killed to send a message to everyone that this would not be tolerated and that the real power in Lebanon lay not with the government but with Hezbollah.
This operation began with final target selection. Hariri was the mark from Day One.
Pre-attack surveillance: This phase was lengthy, and the resources dedicated to it were massive. Dozens and dozens of operatives followed Hariri for months. A security team could have literally any day detected this coverage and provided the warning that would have saved Hariri’s life.
Yet, the scope of the surveillance alone suggests how difficult this would have been without proper surveillance detection and countersurveillance capabilities and training. Hariri was not followed by a handful of individuals continuously for months. He was covered by a constantly shifting constellation of surveillance teams, all composed of individuals native to Beirut, driving local vehicles and blending in perfectly. Expecting security guards in a motorcade moving at high speed to pick up on this kind of sophisticated coverage is unrealistic. What were needed were dedicated countersurveillance personnel working for Hariri but operating outside the bubble of his motorcade’s physical security.
Planning: By definition, this phase is likely invisible to the target. That is doubly so in this case. By 2005 Hezbollah had massive real-world experience in the use of very large vehicle-borne improvised explosive devices. They also had in Beirut ready access to the infrastructure to construct such a device. Once Hariri’s movements had been mapped sufficiently to allow a time and location to be fixed for an attack, this operation was essentially over.
Rehearsal: The attack team may or may not have rehearsed the attack as suggested by the cellphone records. It is largely irrelevant. There was nothing that would have been visible on that date, given the way in which the attack was structured, that had not been visible for months prior.
Execution: Hariri was killed when a truck his motorcade passed on the road exploded. He was moving through traffic on a busy street in downtown Beirut and likely passing similar vehicles every few moments. By this point in the operation, it was too late. There was nothing to see or detect.
Escape and Exploitation: As with many attacks connected to Islamic terror there was no planning for escape. This was a suicide bombing. Also, interestingly, after the attack Hezbollah attempted to escape blame by deflecting responsibility onto a fictitious Sunni extremist group. There was, therefore, nothing in the planning and preparation for this action that had to do with exploitation.
None of the above is meant to suggest that the use of the concept of a terrorist attack cycle as a means to structure our analysis is incorrect. What it does mean, however, is that what we will or can see will vary dramatically from case to case and will be dependent on the locale, the target and the group seeking to stage an attack.
In Hariri’s case his security had one huge opportunity to save his life: They could have detected the extensive pre-attack surveillance. Prior to that, there was nothing to see. After that, it was too late.
Hariri was followed by surveillance 24 hours a day for almost six months. Had his security personnel detected that surveillance and taken appropriate action Hariri might still be alive today. Doing so, however, would have required employing techniques and trained personnel that were appropriate for the locale and the threat level. No such countersurveillance teams were fielded, and the physical security surrounding the motorcade simply had no chance against surveillance teams of the size and sophistication that were employed.
Hariri and his guards died waiting for an attack that never came, the one they would have launched. Meanwhile, terrorists thinking and operating in a very different way put together a brutal and highly effective operation. The challenge for all of us in this business is to avoid the same fate.
