The Coordinated Attack - Unique Dangers and Countermeasures to be Taken

By: SK, Nathaniel Aron

It is 0800 on the 28th of November 2008. Finally, after roughly 58 hours of chaos, Indian National Security Guards have been able to defeat the last terrorist holding out at the Taj Mahal Hotel, thereby bringing to an end one of the most destructive and lethal terrorist attacks in the bloody history of terrorism in India. 173 men, women and children were killed in what has come to be known as the “Mumbai Massacre” or the “Indian 9/11”. That such a successful operation should be carried out by only 10 terrorists (9 killed, one wounded and apprehended) is a clear testament to the power of the method of choice: “The Coordinated Attack”.

The coordinated attack can be characterized by a number of elements upon which we shall expand in this paper, followed by a series of suggested measures to be taken if one is to successfully prevent or limit the scope of such an attack. Not all the elements described herein will be present in every coordinated attack. However, the following can be said of all coordinated attacks, and will therefore serve as our working definition: a number of coordinated terrorist teams attacking a number of separate targets simultaneously, or within a short space of time, within the same zone of operations.

The following elements are usually evident in coordinated attacks. Such an attack is usually planned in such a way as to maximize the confusion created by the multiplicity of targets and to compel the security forces of the affected zone to split their forces in order to simultaneously confront a number of threats in different locations spread sometimes throughout the zone of operations. Two other elements that emerged in a number of coordinated attacks were the high level of fighting prowess displayed by the terrorists and their mission specific weaponry and munitions. Though these are not necessary facets of a coordinated attack, they are usually evident because coordinated attacks take longer to prepare and terrorist organizations have more of a stake invested in their success.

The existence of a number of terrorist teams within the same zone of operations can sometimes enable one team to come to the aid of another. This depends, of course, on the distance between the teams and the presence of security forces between them. Finally, the teams participating in the attack can, in many cases, coordinate the attacks with each other or with their operators after the fighting has already commenced. This can be accomplished with cell phones or other communication devices, such as satellite phones, walky-talkies or two way radios. On the other hand, the iconic coordinated attack of 9/11, for instance, did not, to our knowledge, include any communication between the terrorists or between any of them and their operators, once they had become airborne.
The Coordinated Attack thus has innate advantages. The multiplicity of its focal points and the force of the surprise created by numerous attacks make it much harder for security forces to contain and neutralize the incident. The sense of uncertainty created by numerous attacks makes for captivating media coverage, thus bringing the terrorist attack to the attention of television viewers the world over. The relatively long time it takes for security forces to put an end to the attack ensures that those viewers are exposed to it continually for hours or even days on end, as the attack unfolds. Ultimately, all of the above creates more of what the terrorist attackers mean to achieve; namely, terror.

The Elements in Action
Some characteristics of the coordinated attack are by no means new. Detonation of numerous IED’s (improvised explosive devices) in the same operational zone is a tactic well known to the citizens of both India and Israel; however, these are usually limited to a series of blasts and at the most include suicide bombers detonating their devices in the space of a few minutes, with the secondary blast targeting the security and medical teams which have responded to the initial one. Herein, we will focus on the more sophisticated and prolonged coordinated attacks, which combine commando like assaults with the familiar array of IED’s, suicide bombers and car bombs.

We will examine three terrorist attacks which best typify the emergence of the coordinated attack: the attack on the city of Mumbai, India of 26-29th of November 2008 (the Mumbai Massacre); the Taliban attack on the Ministries of Justice and Education and on the Directorate of Prisons, all located in Kabul, Afghanistan, of February 11th 2009; and the recent attack on the Presidential Palace and other sites, also in Kabul, on January 18th 2010. What follows is a cursory summary of the attacks, followed by a discussion of each of the 4 previously defined elements prevalent in coordinated attacks.

The first, both in order and in success (from the point of view of the adversary), is the coordinated attack on Mumbai. The attackers, members of the Lashkar-e-Toiba terrorist organization based in neighboring Pakistan, arrived by sea on the evening of the 26th of November 2008. They split into five teams and went on to attack the Taj Mahal and Oberoi hotels, the Chhatrapati Shivaji train depot, the Leopold Café, the Cama Hospital, the Metro Cinema and the Nariman House (a Chabad Jewish center).

The second attack we shall discuss is the Taliban attack on the Ministries of Justice and Education and on the Directorate of Prisons. This attack included a five member team that targeted the Justice Ministry, a lone suicide bomber who was killed before he could enter the Education Ministry and a two man team that attacked the Directorate of Prisons.

The third attack case study is the recent assault on the Presidential Palace in Kabul. This attack included a number of teams as well, though the exact number is in dispute, using small arms and incorporating suicide bombers. Among the sites attacked, in addition to the palace, were the Ferushgah Mall, the Serena Hotel, the Education Ministry and the Pamir Cinema.

The core of the coordinated attack is the execution of a number of separate strikes in the same zone of operations, thereby forcing the defender to address a number of threats at once. The higher the number of attacks and the farther they are from one another, the more confusion is sown and the longer it takes the security forces to achieve full control of the situation (all other variables being the same). Among our three cases, the best example of this is the assault on Mumbai. Not only were five teams used in the series of attacks, two of the teams left time detonating explosive devices in the cabs they took to their targets, thereby bringing the number of attack sites to a total of seven.

Another factor that can serve as a force multiplier is the mobility of a terrorist team after the initial attack has been launched. Consider the case of the two-man team that attacked the Chhatrapati Shivaji train station. Rather than staying there and continuing the assault until stopped, the team left the station, attacked Cama Hospital and later captured a police jeep. This movement makes it harder for the security forces to understand what parts of the operation zone are immediately under threat and thus to effectively engage and neutralize the terrorist team.

In the first Kabul attack, a somewhat different attack strategy was devised. Rather than splitting the force equally into teams of two, one main effort was aided by two smaller attacks. The main body of five attacked the Ministry of Justice, while two suicide bombers attacked the Directorate of Prisons and one suicide bomber attacked the Ministry of Education. The exact number and size of the teams which participated in the second Kabul attack is in dispute, but there were probably two or three “main thrusts” aided by suicide bombers in different locations.

The level of fighting skills required of a terrorist in a coordinated attack is much higher than that required of a suicide bomber. He (and possibly she, although no women have yet to take part in a coordinated attack) must be able to shoot well, remain mobile and make quick decisions. The ability to prolong the attack simply by continuing to exchange fire and remaining alive is converted into a longer period of media coverage. The success of this aspect of the coordinated attack on Mumbai was extraordinary. Some of the terrorists, trained by retired professionals from Pakistani security forces, were able to last more than three whole days, hold their own against forces outnumbering them by more than ten to one and become the constant focal point of the media across the globe. While the attacks in Kabul might seem less successful in comparison, it must be remembered that in the first attack the assailants were able to control the Afghani Justice Ministry for about an hour, and that in the second the Presidential Palace itself was in the range of fire and shots exchanged in its vicinity for more than three hours. The experience gained by the Taliban in fighting the Western led coalition for almost a decade now enables them to deploy very capable fighters in such attacks.

The facet of mutual aid is always manifest in any coordinated attack, since the mere presence of a number of independent groups in the same zone of operations means that the defending security forces cannot concentrate all their power on any single squad. However, in a number of instances individuals or teams have afforded direct aid to other terrorist teams during the course of the attack. The two terrorists who attacked the Leopold Café in Mumbai later joined the team perpetrating the killing spree in the Taj Mahal Hotel. In the attack on the Presidential Palace in Kabul, suicide bombers twice provided aid to aid other cell members. The attack was commenced with a suicide bomber detonating his charge near the southern gate to the palace, probably in an attempt to burst the gate of the Central Bank for the team which ultimately attacked the Faroshga shopping center. Later on, a suicide bomber driving a van disguised as an ambulance detonated an explosives-laden truck near the nearby Gulbahar Center. A person claiming to have taken part in the attack wrote in a jihadist forum that the VBIED was detonated near security forces on their way to the facilities already under assault.

Finally, in two out of our three case studies there is evidence of communication between the terrorist forces and an operator, either on the ground or in a base elsewhere. The simpler form of communication was exercised by the Taliban when it attacked the area south of the Presidential Palace in January of this year. One member, according to the communications mentioned above in the jihadist forum, was responsible for the opening of the attack. Situated at a surveillance post, he made sure via an unspecified communication device that all the teams were at their assigned posts and then reported the following to the first suicide bomber: “–All our brothers are in place… They are with all their equipment and are settled at their targets (staging area) and are waiting for you to accomplish your mission, which will be the sign for the commencement of the attack.”

The communication between the teams carrying out the terrorist attack in Mumbai and their operator was maintained throughout most of the attack. The Taj Mahal Hotel was set on fire in response to a direct order by phone from a Lashkar-e-Toiba operator situated in Pakistan. A call for an exchange between two hostages held in the Nariman House and the terrorist caught alive was also orchestrated by a Pakistani operator. At times, the operator ordered the killing of hostages and waited to hear the gunshots verifying that his orders had been carried out. When terrorists at some locations were exhausted or faced a threat of capture, they were told by the operator: “You mustn’t let them arrest you, remember that”; and “for your mission to end successfully, you must be killed” (both of these quotes are from a conversation between the operator and Fahadullah, one of the terrorists who raided the Oberoi hotel).

The access such an operator has to media coverage, and especially to live footage of the attack, effectively turns him into a field intelligence officer. In the case of the Mumbai attack the operator, viewing live video coverage of the Taj Mahal in the night, knew exactly what setting fire to it would look like on screen. More importantly, he was able to warn the terrorists controlling the Nariman House that security forces were landing on the roof, thus nullifying any chance of the assault coming as a surprise.

The Coordinated Attack Calls for a Well-Coordinated Response
As the “Mumbai Massacre” and to a lesser degree both Kabul attacks have shown, a coordinated attack mounted by terrorists can end in a tragedy of disastrous proportions. However, by taking the proper actions a coordinated attack can be contained to a large degree, or even prevented altogether.

Stage 1: Prevention
A coordinated attack is a large-scale attack and, as such, requires a significant pre-operational intelligence collection process. The strong presence of alert security forces can dissuade terrorist organizations from mounting an attack altogether. Furthermore, even if the terrorist group decides to press ahead despite the presence of security forces, the adversarial agents collecting the pre-operational intelligence can more easily be recognized and apprehended.

The targets of a coordinated attack generally have symbolic value. Thus, facilities such as government buildings, important hotels, foreign embassies and consulates and foreign agencies should be well protected by personnel who are familiar with the traits of a coordinated attack. Guards in civilian attire, as well as uniformed guards, should be used in the interest of picking up on pre-operational surveillance and probing. Shop owners, vendors and businessmen in the vicinity of potentially targeted assets on a regular basis should be discreetly questioned and provided with contact information so they might speedily contact security forces upon noticing anything out of the ordinary. It is critical that both security personnel and key civilians be made sensitive to behaviors indicating pre-operational surveillance by adversarial elements, as well as related probing and active terrorist actions. This heightened awareness can be an indispensable counterterrorist force multiplier.


Stage 2: Containing a coordinated attack
When all else fails and a coordinated attack has been set in motion, the immediate aim of security forces becomes containing and neutralizing the multi-pronged threat. As clearly seen in both the Kabul attacks, a quick and resolute response by the security personnel protecting a facility can stem a specific attack before it develops. However, immediate response should not be limited to the guards protecting an asset under assault. Any armed security person or civilian finding him or herself in the midst of or in proximity to a terrorist attack can, if properly trained, oppose the terrorists and serve as a first response. The chance of security personnel or armed civilians acting of their own accord is directly related to their training. The rank and file police officer or other security related person must go through simple “drop, locate, aim & fire” drills simulating terrorist situations. Since there is no way of knowing who might find themselves near the scene of action, incorporating simple “terrorist attack” drills into small-arms training will, over time, make security personnel on the scene more proactive.

Although security forces or civilians on the scene may “save the day”, in many cases special forces specially trained to deal with terrorist attacks will have to be deployed to contain and neutralize the threat posed by a coordinated attack. The time span of a coordinated attack can be roughly split into two: from the first combative action of a terrorist attack until the areas of attack have been sealed off; and from that moment until the neutralization of the last terrorist has been secured. Numerous instances have shown that neutralization is certain only when the terrorist is no longer among the living. Many “neutralized” terrorists have been able to detonate IED’s hidden on their bodies or draw a knife likewise hidden [Admittedly, dead terrorists cannot be questioned and so a balance must be struck between the intelligence value of an apprehended terrorist and the risks of not fully securing neutralization by elimination.] The initial goal of the security forces, when facing an evolving coordinated attack is to shorten the first part of the attack as much as possible.

Special forces should be dispatched to engagement points as soon as possible and their first mission should be to seal off the area and evacuate all civilians. The first senior commander to arrive on the scene should take control of the situation. All senior commanders arriving afterward should defer to him or her. After establishing control, the incident commander should collect available intelligence to identify the various immediate threats, including: the number and current location of the terrorist cells; the weapons at their disposal; their probable aim (penetrating a specific facility, for instance); the possible presence of hostages; and the terrorists’ current direction.

Utilizing this information, the commander should move quickly to isolate the various terrorist groups from one another and from civilian targets. This includes not only stopping the terrorists from breaking out of the quarantined area and continuing their killing spree, but also preventing any civilian or other unauthorized personnel from entering it. As both Kabul attacks have shown, terrorist groups use suicide bombers to target security forces responding to the incident. Therefore, as much as the situation allows, all forces approaching the attack areas, including ambulances, medical teams and men wearing uniforms, should be identified. Success in sealing off the terrorists is imperative to minimizing civilian casualties and creating a safer environment for the assault to finally neutralize the threat.

It is impossible to give a guidebook answer to the question of when to assault. Wait for the perfect moment and the killing may continue unopposed; rush in unprepared and your forces will simply be added to the victims’ list. In most cases, the preparatory stage should be brief.

As blatantly evident in the attack on Mumbai, the media at the scene can be detrimental to forces attempting to engage the terrorists. The media, especially video cameras, should be kept as far from the area of operations as possible, with the importance of their not broadcasting live footage quickly and resolutely explained. Ensuring that the media is “on the same page” is important, because they can, if they choose, use long range lenses. Thus, merely distancing them from the scene is insufficient.

Looking Ahead – Evolution of the Coordinated Attack in the Near Future
A direct relationship exists between the military capabilities of a terrorist and the complexity of attacks he or she can take part in. Thus, we predict that as the training terrorists undergo become more professional, the attacks they take part in will become more complex. It seems far from coincidental that in all three cases the terrorists received paramilitary training – by Pakistani retired officers or by the Taliban. One of the acute dangers posed by state sponsored terrorism rises from the military training and expertise it receives. The line drawn between military and terrorist actions are fading quickly in the sands of the Middle East and the hills of Afghanistan. As all indications at the moment point to a continuing erosion of this line, the reality of coordinated attacks by terrorists seems all but certain. Therefore, all security forces facing such a threat must learn to identify it quickly and train their units to provide a swift and resolute response.

Related Article: Archangel Offers New SWAT Tactics
His breaths were coming in sharp rasps as he raced across open ground under withering automatic weapons fire from the second story windows of the school the Islamists had seized. He had already seen three of his teammates fall under the hailstorm of bullets racing down at them, seeming to reach out for them with venomous steel fingers. He couldn’t hesitate, couldn’t stop to tend to his wounded friends. In all his years in SWAT operations he had never actually had to fight his way to the wall of the building in which hostages were being held. None of them had, and they were paying the price for having failed to prepare for this in their training.

Related Article: Color Code of Mental Awareness
I recently read an article in SWAT magazine by Patrick A. Rogers, which contained the following story.  I really left me wondering what people are thinking as they walk around this big blue marble.  Please, read on...

Related Article: Color Code of Mental Awareness Part II
In my last article I talked about the first two colors of The Color Code of Mental Awareness, White and Yellow.  White is being in a state of inattention with your head in the clouds, while Yellow is relaxed but alert, ready to react.  You’re aware of your surroundings and you’re using all your senses to warn you of anything out of the norm.

Related Article: "Commando-style" Terrorist Attacks - Considerations for US Responders
The November 2008 attack in Mumbai, India, should get everyone’s attention.   It was a well planned, tightly coordinated, extremely violent attack on the center of India’s financial and entertainment industry.   Ten terrorists, operating in small teams of two to four men, entered the city using a small boat and unleashed 3 days of hell.   The small group caused massive chaos, killed over 130 people, and added fuel to an already volatile situation between two neighboring countries.   Their tactics were similar to a military operation - hence the description as a “commando style” attack.