Physical Protection – Marauding Terrorist Attacks

Session 2

Marauding Terrorist Attacks

This session contains links to other websites.  PSN cannot guarantee your security or safety when linking to these sites.

Focus of this Practitioner Session

• Further understand the threat landscape.
• Encourage a deeper understanding into the topic including threat methods and countermeasures.

Terminology and Definitions

The definitions of key elements of protective security practice are important to:

• ensure messaging is accurately understood across security teams and other stakeholder networks, and
• assist problem solving at the operational levels.

The following key terminologies and definitions are from a variety of sources, for example the UK’s Centre for the Protection of National Infrastructure (CPNI) and the Australian-New Zealand Counter-Terrorism Committee (ANZCTC).

Definitions may change, perhaps reflecting different contexts, situations, threat trends, technological advancement, changing legislation and new national or International Standards.

The source of terminologies and definitions may not be known, or their origin may be ambiguous. This somewhat reflects the evolution of the body of knowledge for protective security. We apologise for any mistake in identifying or omitting the source. We would appreciate feedback to amend any sourcing.

Core terminologies and definitions for this session:

Marauding Terrorist Attacks (MTA):  Fast moving, violent incident where assailants move through a location aiming to find and kill or seriously injure as many people as possible.

Hostile Reconnaissance:  The purposeful observation with the intention of collecting information. Typically, this pre-attack activity by terrorists is to qualify a location as a target, discover weak spots (vulnerabilities), assess the level and type of security, inform the best time to conduct the attack, the resources needed and assess the likelihood of success. Sometimes the pre-attack process includes a ‘rehearsal’ to test assumptions and security integrity at the intended target location.

Issues and Trends: A Global Broader Context

• The term MTA is used in the UK and NATO. It is a meaningful label for this type of attack for countries outside of the UK and NATO contexts. It is likely in time the term will be further internationalised.
• MTA is a very rare event in Australia and comparable countries, like New Zealand. It could be viewed as a low likelihood but extreme consequence event (or whatever risk descriptor you use that is equivalent to low likelihood and extreme consequence).
• The notable MTA event in Australia was the 1996 Port Arthur Massacre (Tasmania) and in New Zealand the 2019 Christchurch Mosque Massacre.
• Both the Port Arthur and Christchurch attacks had a single perpetrator. Both attacks required pre-attack reconnaissance, planning and resourcing.
• Other comparable massacres include the 2011 attacks in Oslo and Utøya Island (Denmark) and the 2017 Islamic Cultural Center Quebec City (Canada).
• Common with the above attacks, the weapons were legally gained, including for example the ammonium nitrate used to make the vehicle bomb (Vehicle-Borne Improvised Explosive Device -‘VBIED’) used in the Oslo attack.
• Successful attacks are often credited for inspiring copycat attacks in other parts of the world. In particular, comparable locations, such as shopping centres, places of worship, street carnivals, movie theatres, holiday resorts, residential schools.
• Most deaths typically occur within the first few minutes of the attack. However, depending on the planning objectivities and complexity of the attack, deaths of victims may be over an extended period and over several pre-designated sites. An example being the 2008 Mumbai terrorist attack, which involved murder and mayhem over 3 days across several sites.
• Some attacks have a ‘handler’e. a person giving instructions using phones and located away from the attacks. This was the situation in the Mumbai attack.
• MTA in various forms has occurred in many countries including for example, the EU, Russia, India, in the Middle East and in Africa.
• In some MTA a primary objective is the mass kidnapping of young people.
• It is a common methodology that police and private security personnel on duty at the targeted locations are murdered at the early stage of the attack.
• After each MTA, extensive analysis is undertaken and shared around the world. The analysis examines aspects such as who the terrorists were, their leadership, their network, their motives, their capabilities, as well as the responses by authorities, legislative powers, resources including intelligence and specialist training.

Practitioner Fundamentals – Awareness

Protective security practitioners should be aware that the form of attack will reflect the opportunities at the targeted locations provided to the terrorists and the resources of the attackers.

For example, an MTA may:

• Be a lone attacker (sometimes referred to as ‘lone actor’ or ‘lone wolf’) or multiple attackers.
• Be an operation in which the terrorist(s) enter the targeted location on foot or in a vehicle.
• Use a vehicle to ram and breach the perimeter, perhaps using on-board explosives.
• Be perpetrated by an insider.
• Be by placing someone with access privileges top targeted property under duress.
• Use a combination of weapons for example, firearms, bladed weapons, fire and suicide vests.
• Involve weapons ranged from unsophisticated to military grade.
• Typically follow extensive intelligence gathering through ‘hostile reconnaissance’ at the selected target locations. Other methods of intelligence gathering may be from ‘trusted insiders’ at the targeted location.

It is critically important to remember that terrorists intend to kill and do not intend to negotiate.

Planning and Actions

Assessments

It is important that possible MTA scenarios are evaluated within the security risk management framework for each site that has identified the risk of terrorism.

The security risk assessment should be conducted, or at least guided by a subject matter expert.

Current threat assessment and advice from police should be sought as input into the process.

Assessments should be conducted at intervals that reflect the security risk assessment.

A security risk assessment with a focus on MTA should be conducted soon as practicable after an MTA incident, especially at a comparable site or the receipt of specific threat advice or assessment from authorities.

Training

Training to provide a co-ordinated response to a terrorist attack should be developed and influenced by security risk assessments and the local context such as legislation, remoteness of location, local police response capability.

Although resource intensive and disruptive, simulation exercises involving attack scenarios and response and the participation of response authorities (in particular police) are always beneficial to hone skills, refine procedures and evaluate resources including for example, effectiveness and reliability of physical security controls, video surveillance capabilities, communication systems and power supply.

This level of strategic training is typically beyond the authority of security management and involves considerable stakeholder engagement and collaboration at high levels of organisations.

Desktop exercises provide benefit with less complexity, less resources and less disruption than a simulation exercise. This type of training is more likely to be able to be influenced by security management. Desktop exercises should be considered between simulation exercises. Another advantage of desktop exercises is that they offer the flexibility to use a broader range of scenarios.

At the practical operational level, training may take the form of regular briefings to security and other personnel to remind them of the current threat (associated with their context) and the need for vigilance, situational awareness and practical knowledge of procedures and protocols relevant to MTA, including what to expect from a police or military response action.

The level of competence and additional training required can be identified during an MTA-specific audit.

Security Posture

Ensure all security and facilities personnel are:

• Aware of the risk for your facility or your special event. Include risk and relevant procedures in team discussions, such as briefings. Include relevant section of the facility’s standard operating procedure (SOP), site plans (identifying vulnerable locations) and any aerial imagery of the site / precinct. Include in discussion any current threat assessments or advice that has been provided by police.
• Trained –For example to:
• Identify and report suspicious people especially if they appear to be placing your facility under surveillance and possibly exhibiting signs of rehearsal (of an attack).
• Provide SitReps.
• Identify the sounds of gun shots.
• Identify and safely respond or react to attack methodologies.
• Safely respond or react to building collapse and fire.
• Administer advanced first when safe to do so and under challenging conditions.
• Reminded to maintain situational awareness.
• Encouraged to listen and act upon their professional instinct – this may save lives. This applies to both vehicles on site and vehicle moving around or towards the site.
• Reminded to report immediately if they see ‘something’.
• Competent to operate systems or equipment intended to counter a threat. For example, this may be bollards recessed into ground.
• Competent in implementing the site’s emergency response procedures.
• Reminded that drivers of hostile vehicles may not obey road traffic rules. For example, driving down the wrong way or along a pedestrian path.
  • Note: A driver of a hostile vehicle may leave the vehicle with a weapon intending to kill people.

More Information

• For threats received contact police on emergency number (within Australia – TRIPLE ZERO – ‘000’).
• For advice on current security threats and precinct security issues contact local police.
• You are welcome to contact PSN for additional resources or discussion on this topic.

Understanding the Broader Context

PSN members are encouraged to conduct further research into this topic. The following are recommended starting references:

• Active Armed Offender Guidelines for Crowded Places published by the Australian-New Zealand Counter-Terrorism Committee (ANZCTC) 2017.
• There are videos on Marauding Terrorist Attacks on YouTube.                                                                                                            

Note: Caution should be taken in using information and advice from other countries, for example assessments, currency, emergency phone numbers and terminology.

This Practitioner Session published November 2021. This topic is dynamic with information and practices subject to change.  Professional advice from qualified security consultants/advisors or security trainers should be considered to ensure, among other issues, your specific context.

Feedback and questions welcomed – admin@protectivesecuritynetwork.com.au

© Protective Security Network, Sydney  –  All Rights Reserved. 2022.