Last week, the French satirical magazine Charlie Hebdo republished cartoons of the Prophet Muhammad. This action was in advance of the trial of 14 people who were accused of supporting two Islamist attackers to carry out an attack on Charlie Hebdo on Jan. 7, 2015. This support included providing weapons and logistical support, key elements in many complex coordinated terrorist attacks that occurred in Europe in the mid-2010s. It was the publication of the cartoons in the first place that was a contributing factor in the attack. Reviewing these incidents can help provide valuable lessons learned, which can help organizations plan and prepare for a potential future attack.
Background. Charlie Hebdo is a French satirical weekly newspaper that pokes fun at a wide variety of topics and institutions. As such, it has a history of controversy, especially for targeting religious groups, and particularly Islam. While there is nothing that specifically says depictions of Muhammad are forbidden in the Koran, it is widely believed by most Muslims to be an absolute prohibition. For many, depictions (pictures or statues) of Muhammad, or any of the other prophets of Islam, should not be pictured in any way as they could be thought to encourage the worship of idols.
- The cartoons in question, one which depicts Muhammad wearing a bomb-shaped turban, were first published in 2005 by the Danish newspaper Jyllands-Posten. It was then reprinted by Charlie Hebdo, which, as expected, led to outrage and death threats against the editorial team.
- In 2006, Islamic organizations under French hate speech laws unsuccessfully sued over the newspaper’s re-publication of the cartoons of Muhammad.
- The cover of a 2011 issue, retitled Charia Hebdo (French for Sharia Weekly), featured a cartoon of Muhammad.
- The newspaper’s office was fire-bombed and its website was hacked.
- In 2012, the newspaper published a series of satirical cartoons of Muhammad, including nude caricatures which came days after a series of violent attacks on U.S. embassies in the Middle East, which themselves were purportedly in response to the anti-Islamic film Innocence of Muslims. This prompted the French government to close embassies, consulates, cultural centers, and international schools in about 20 Muslim countries. Riot police surrounded the newspaper’s offices to protect it against possible attacks.
- In 2013, cartoonist Stéphane “Charb” Charbonnier, who had become the director of publication for Charlie Hebdo in 2009, stated, “We have to carry on until Islam has been rendered as banal as Catholicism.” Al-Qaeda in turn added him to their most wanted list. In addition, he had strongly defended the cartoons as symbolic of freedom of speech. “I don’t blame Muslims for not laughing at our drawings,” he told the Associated Press in 2012. “I live under French law. I don’t live under Koranic law.”
Timeline of the Attack. The above background help set the stage for the attack described below. Note, the account captured is derived from multiple open source reports and news articles including the BBC and NPR.
07 January 2015.
- At 11:30 local time, brothers Said and Cherif Kouachi drove their car up to the Charlie Hebdo building and stormed the offices. They wore masks, dressed in black and were armed with AK-47 assault rifles. However, they initially went into the wrong address, before realizing the Charlie Hebdo offices were on the second floor a couple doors away. This in and of itself is an indicator that the threat actors did not do a high degree of surveillance in support of their plan. Most likely they did online research which can be effective in early planning phases, but physical surveillance and eyes on the target is generally needed to ensure the plan can be executed as intended.
- Once inside the office building, the men asked the maintenance staff in the reception area where the magazine’s offices were, before shooting and killing a caretaker.
- On the second floor, the men then grabbed one of the magazine’s cartoonists and forced her to enter the code for the keypad entry to the newsroom on the second floor – where a weekly editorial meeting was taking place. The keypad securing the second floor is an effective security measure for external access, but it is encouraged that this is reinforced with another access level inside.
- Once in the Charlie Hebdo offices, the men shot and killed the editor’s police bodyguard before asking for editor Stephane “Charb” Charbonnier and four other cartoonists by name. Once identified, the attackers killed them, along with three other editorial staff and a guest who were attending a meeting.
- Witnesses said they had heard the gunmen shouting “We have avenged the Prophet Muhammad” and “God is Great” in Arabic while calling out the names of the journalists.
- Police responded to the offices as the gunmen were leaving the building.
- The gunmen left using the same car they arrived in.
- A police car arrived and blocked their initial escape route. The gunmen opened fire on the police car and fled via an alternate route.
- During the escape, video footage captured the attackers getting out of their vehicle and shooting a police officer who was on a nearby sidewalk. One of the attackers then walked up to the injured policeman and killed him at close range. It is not clear if the police officer had recognized the car and attempted to engage or if he was on a regular patrol.
- The attackers then abandoned the car, hijacked another car and disappeared. In the abandoned car, police found Molotov cocktails and two jihadist flags, which could be an indication that the Molotov cocktails could have been used as a secondary attack method or if the security situation was tougher than anticipated.
- This is the first indication of a well thought out escape plan, which is the last phase of the Hostile Events Attack Cycle. Not only did they leave the scene but they had an alternate route in mind, and an extensive support network in place to hide them. Related to escapes in general, some extremist, or active shooter attacks, do not plan on an escape. Some attackers plan on taking their own life, or plan to fight to the death. In the most recent U.S. Secret Service report, “Mass Attacks in Public Spaces – 2019”, 15 percent of attacks ended with police arriving on the scene and killing the attacker, and approximately 20 percent resulted in suicide either at the scene or after leaving the scene. Almost half of the attacks resulted in the attackers being able to leave the scene on their own.
- Paris had been then put on alert and a major security operation was launched with an additional 500 police deployed around the capital.
08 January 2015.
- At approximately 08:45 local time, as police continued their search for the Hebdo attackers, a lone gunman killed a policewoman and injured another man in a southern Paris suburb. The attacker was armed with a machine gun and a pistol. Initially this was thought to be a separate incident, but the police later confirmed they were connected.
- At 10:30 local time, the Hebdo attackers robbed a gas station northeast of Paris, taking food and gas. According to the gas station manager, the two men also had rocket-propelled grenade launchers in addition to their assault weapons. They had been driving the same car they hijacked after their initial attack, which is another indicator of a support network that would allow them to conceal their car after police had mobilized to search for them.
- There would be reports of sightings around the suburbs and a police chase throughout the day on 08 January but no additional threat-based activity. In the meantime, police were able to confirm the identities of the attackers and their backgrounds.
09 January 2015.
- The attackers hijacked another vehicle in another Paris suburb with one of the attackers being wounded in a shootout with police. This engagement with police resulted in a high-speed chase leading back to Paris.
- The chase led to a printworks in Dammartin-en-Goele, on an industrial estate on the outskirts of the town.
- Police surrounded the building and culminated shortly thereafter. The brothers, who had talked to local mediaand indicated they would die “martyrs'” deaths, emerged from the building, firing at police. Both suspects were killed and two police officers were injured.
- During this time, another situation took place where a gunman took several people hostage at a kosher supermarket at Porte de Vincennes in the east of Paris after a shootout. The attacker threatened to kill people unless the Charlie Hebdo attackers were allowed to go free.
- Once the situation at the printworks was concluded, police launched a rescue operation at the supermarket. The gunman was killed and 15 hostages were freed. However, four hostages were killed. The gunman was later confirmed to have shot and wounded a jogger on 07 January, which was believed to have been an isolated incident at the time.
WHAT CAN BE LEARNED? The threat actors in these instances had all pledged allegiance to the Islamic State, which was on the rise, having just taken large swaths of territory in Iraq and Syria and proclaiming the establishment of the Islamic Caliphate the year prior. Because all the gunmen in these attacks were killed, it is not completely possible to dig into the details of each individual and their respective motivations, but some points are worth noting:
- Was the appropriate risk identified?
- Charlie Hebdo clearly understood they were a target based on their content and prior incidents (firebombing in 2011 and threats against journalists). They even had a layer of security intended to protect the organization which included a keypad lock and a security guard. Considering the threat environment at the time, to include several incidents in and around Paris in previous years, it would be important to ensure that coordination with local authorities was done, as well as ensuring employees knew to report any suspicious activities in and around the area.
- Understand the associated or indirect risk. For example, for businesses that may be in and around Commercial Real Estate properties, it is important to understand who the tenants are within the property and if they bring additional risks or threats. If a tenant is threatened, or has taken or made a provocative action, it can have an increased risk for landlords and nearby / adjacent / collocated tenants and facilities. This equally applies to businesses that may have VIPs or other high-profile figures in and around the property. Election season is upon us and there could be public appearances that may increase the risk. Threat actors could identify these as an opportunity to plan and carry out an attack putting not just that business at risk, but those in and around it.
- With risk identification and a risk assessment, it is important to be self-aware and understand triggering events. These are events that can push individuals over the line from bystander to someone who takes action. This incident and the Capital Gazette shooting in 2018 had been triggered by incidents several years in the past. The Capital Gazette shooter was angry over a news report, while the Charlie Hebdo attackers were angry over the depiction of Muhammad to the point that they were calling out the names of the journalists they wanted to kill. But these incidents served as triggers that would propel them to action.
- Be aware of coordinated attacks. It may never be known if the supermarket attack was planned from the onset or done as a response to help the Hebdo attackers; however, organizations are encouraged to consider coordinated or simultaneous attacks. Terrorist groups have long advocated for diversionary tactics in which one attack or incident could draw the attention of security forces while another attack, potentially larger and to greater effect, could be carried out.
- Understanding influenced attacks. In 2015, international terrorism looked different than it does currently. It has been widely reported that the Islamic State and al-Qaeda, while still wielding great influence and inspirational ability, have not had the ability to carry out large-scale attacks as they had done in years prior. Both the U.S. Department of State Country Reports on Terrorism 2019 and the European Union Terrorism Situation and Trend report (TE-SAT) 2020 noted declines in international terrorist group activity, while pointing out the rise in violent extremism. But while these groups may not have the same ability to directly impact an attack, they still possess the ability to heavily influence threat actors.
- On 07 September, the Islamic State group claimed that its fighters carried out an attack in Tunisia that saw one security officer killed and another injured. No direct evidence was given but as has been the case, the group’s influence can extend far beyond direct communication with the group. And that is because they can employ resources for others to use, such as the below.
- Last week, the Institute of Strategic Dialogue (ISD) identified one of the largest digital library collections of online material belonging to the Islamic State, which contained more than 90,000 items and has an estimated 10,000 unique visitors a month. The site includes everything an attacker or group would need to know to plan and carry out an attack, and more.
- Bleed over to extremist attacks. While international terrorism may be showing declining numbers (though it is important not to dismiss these groups), violent extremist groups have been on the rise. And there are indications that the groups share a lot in common including the ways in which they use propaganda and exploit civil unrest. Additionally, last week it was reported that the extremist group Boogaloo Bois tried to make an arms deal with Hamas to fund a domestic terror camp (“The enemy of my enemy is my friend”).
- A new report from Politico noted that the Department of Homeland Security is currently drafting a report that will identify domestic violent extremists as the greatest terror threats to the U.S.. The document is currently in draft form but notes, “Foreign terrorist organizations will continue to call for Homeland attacks but probably will remain constrained in their ability to direct such plots over the next year.” However, extremist groups will continue to exploit “social grievances” which have been driving lawful protests.
- Specifically, “Lone offenders and small cells of individuals motivated by a diverse array of social, ideological, and personal factors will pose the primary terrorist threat to the United States. Among these groups, we assess that white supremacist extremists – who increasingly are networking with likeminded persons abroad – will pose the most persistent and lethal threat.” Different versions of this document interchange Domestic Violent Extremism with White Supremacists, but the theme remains the same.
MITIGATION. Whether it is international terrorism or domestic violent extremism, the Commercial Facilities Sector has been impacted by it all. And as such, it is important to learn the lessons from previous incidents to remind organizations and reinforce key security principles that may get overlooked or brushed aside.
- Conduct Risk Assessments. This has been a repeated theme but it cannot be overstated enough. These help set the foundation for the rest of the security plan. At a minimum, these should be completed on an annual basis, but they should also be considered on an ad hoc basis should the organization undertake a new direction or plan a new product.
- Know the Threat. This may seem simple, but it can be challenging depending on the business line. Was there a decision made that could impact a specific group or affect an individual? If so, is that being seen through customer service or social media platforms? Have there been increases in certain criminal activity in and around your brick-and-mortar locations, or through online targeting? This can be challenging. For example, Charlie Hebdo was aware of the threat because their business centered on making jokes, but similarly the Capital Gazette reported on an incident that occurred, as was their journalist responsibility. The likelihood of an increased threat may have been higher in the Charlie Hebdo incident, but both were targeted and both resulted in multiple deaths. Therefore:
- It is important to continuously assess and reassess the threat.
- Consult with local law enforcement.
- Continuously review threats from customer service and social media.
- Check in with your neighbors and see if they have experienced increased threats which could create an associated risk for your organization.
- Implement Security Measures. Based on the risk assessments and the threat, the organization can then implement the appropriate level of security for the risk and the threat.
- Once implemented, it is encouraged that organizations evaluate the effectiveness of the measures and improve as needed.
- In addition, while some measures will be long term and ever-present, organizations can also include added in Random Access Measures (RAM). These are measures that can be implemented at any time and without prior notice. For example, a RAM could be implementing 100 percent ID card screening and bag check in and out of the office. Or it could include setting up a new direction for entrance or exits. A benefit to RAM is that it will disrupt potential threat surveillance and operational planning. It could cause the threat to think twice about attempting their action.
- Communicate with Employees. Once these decisions are made, it will be necessary to ensure the employees are kept aware of what is going on and trained on what to be alert for, and trained on how to respond to potential incidents. Employees represent the first line of defense in many areas and educating them on these areas can have long-term impacts and create a positive security culture and move the organization to a better state of preparedness.
ISIS Magazine Calls on Supporters to ‘Race’ to Emulate Charlie Hebdo Attack
