4 Phases of Al Qaeda Operations

Knowing Al Qaeda

A review of the al Qaeda attacks against U.S. embassies in Africa in 1998 and against housing complexes in Saudi Arabia in 2003 reveals operations that unfold in discernible sequential and complementary phases within a compact operational timetable. The operational objective in each attack was the successful delivery of a primary explosive payload.

In the attack on the U.S. embassy in Nairobi, Kenya, a truck carrying explosives approached the main embassy gate, possibly posing as a delivery vehicle. It was redirected by guards to a back gate. There, a gun and grenade attack on security personnel by as many as three assailants preceded the explosion that destroyed the embassy.3 The preliminary gun and grenade assault ensured the primary weapon, the truck bomb, was delivered into the compound with devastating effect.

The 12 May 2003 midnight attacks on three housing complexes in Saudi Arabia displayed greater sophistication. In these synchronized operations, al Qaeda operatives dressed as Saudi National Guardsmen and driving vehicles typically used by Guardsmen approached security personnel manning the entrances at the compounds. When asked for identification, the terrorists engaged the security personnel with automatic rifles, opened the gates and drove explosives-laden vehicles through, detonating their bombs well inside the complexes.4

The al Qaeda attack on a gated housing community in Riyadh, Saudi Arabia, on 9 November 2003 combined diversion and deception. The diversion was an initial assault by gunmen who advanced and fired on Saudi guards. Then, terrorists dressed as police officers, driving in what resembled a police vehicle, approached the gates and claimed to be reinforcements sent to combat the attack. Once inside the compound, the terrorists detonated their car bomb.5

According to terrorist documents, "special operations" such as these are divided into three "integrated and inseparable" stages: research, planning, and execution.6 A closer review, however, reveals four phases in al Qaeda operations:

Operational Surveillance. During this phase, which can take weeks or months, al Qaeda seeks "precise information" on a target's patterns, behaviors, routines, and defenses.7 Using this information, al Qaeda plans and prepares for the attack. For example, the October 2000 attack on the USS Cole (DDG-67) in Yemen was preceded by months of operational surveillance from an apartment overlooking Aden harbor.8

Target Approach. The attacks on the Saudi housing complexes demonstrated how al Qaeda could use deception to advance on a target and cause security personnel to relax their defensive posture. Alternatively, as demonstrated at the Nairobi embassy in 1998, operatives might attempt rapid entry past a target's defenses with speed and force. The November 2003 attack on Saudi housing complexes combined deception with rapid entry to approach and clear defenses quickly. Common to the deceptive techniques are the use of uniforms and vehicles that either are or look official.



Initial Assault. The initial assault occurs during or on completion of the approach and is designed to soften, if not defeat, the target's defenses and open the way for delivery of the primary attack. In addition, this assault might serve to divert security forces and reinforcements from combating the primary attack.

Primary Attack. The primary attack, usually some type of vehicle-borne explosive, might be delivered in the same vehicle carrying the initial assault team or in a separate vehicle. The attack typically occurs along the same vector as the target approach and initial assault, although attacks from alternate or even multiple vectors cannot be discounted.


Beware the Head Fake

The attack on the Cole during a fuel stop in Aden reinforced for the U.S. Navy the painful lesson of controlling the water space around its ships, even in an ostensibly friendly or benign environment. Although al Qaeda succeeded against the Cole, it is now unlikely that a hostile boat will again get so close to a large U.S. Navy ship simply by appearing innocent, friendly, or official amid traffic in a busy port. No doubt, al Qaeda will explore new methods.

Possible future attack scenarios are limited only by the nefarious imaginations of terrorists. In the basic situations outlined below, a key point is the distinction between the initial assault and the primary attack phases. Like the head fake familiar to football and basketball players-feigning movement in one direction so the opponent is enticed to commit toward the feint and then moving quickly in the other direction-the terrorist head fake could be a diversionary assault on a pier gate or pier guards while the primary attack is delivered from a seaside vector by small boat or a swimmer. Alternatively, no head fake would be necessary in a direct assault that forcibly opens access to the pier for a primary attack by a truck or car bomb that detonates its payload near a ship.

A seaborne approach to a ship at pierside could completely bypass the base entry gates and pier gate by conducting a more sophisticated deception during the target-approach phase, similar to what was first suspected in the Cole attack. Early reports suggested the small boat that attacked the Cole gained access by operating among and possibly posing as one of the harbor workboats assisting with mooring and refueling preparations.9

Though apparently not the case in the Cole attack, a well-disguised or even hijacked harbor tug or workboat could cause enough uncertainty to delay a ship's force-protection response and allow a boat to approach close enough to detonate a potent payload. Terrorist teachings cite historical examples of commercial ships used as decoys to get close to enemy warships before opening fire with hidden guns.10

A ship under way, though less vulnerable, is not invulnerable. In the midst of heavy or even moderate traffic in a harbor, channel, or strait, a terrorist boat sufficiently disguised or at least inconspicuous could attempt an approach through a slow, nonthreatening closing movement. By appearing innocent and engaging in amiable communications and discussions regarding intentions, terrorists could defer requests to alter course and remain clear-essentially approaching in plain view close enough to conduct a successful attack. Alternatively, the same stratagem of a disguised or inconspicuous boat movement toward a Navy ship could be exercised in a much shorter operational timeline through a high-speed approach.

The approach to a ship under way could involve, at any time, an initial assault with an assortment of small arms and shoulder-launched weapons to facilitate closing with the ship and conducting the primary attack. Moreover, a target approach and initial assault that serve as a head fake to divert attention from a primary attack conducted from a different axis (or even multiple axes) would only further complicate defending against and defeating an attack while under way.

Do Not Assume Friendly Intent

More imaginative and dangerous scenarios are conceivable, though, fortunately, not so simple to plan or execute. There are two important points. First, regardless of whether a ship is in port or under way, the threat sector is 360� and involves surface, subsurface, and air dimensions. Second, it is imperative when detecting and defeating terrorists not to assume friendly intent. In more traditional wars, the U.S. military shapes a battle space extended out as far as possible to allow for early detection of hostile intent. Against al Qaeda, however, the U.S. Navy operates in a much more limited-and vulnerable-attack space.

In this confined space, establishing hostile intent requires avoiding assuming friendly or innocent intent. The Israel Navy is aware of terrorist tactics that use emergency calls to lure a navy ship close to a vessel ostensibly in need of assistance but rigged for a lethal explosion-a stratagem often augmented by the distressed voice of a female caller. Terrorists teach the value of authentic disguises, a masquerade enhanced by terrorists trained to an intimate understanding of the role being played.11

Though not a "false emergency" lure, a friendly or at least open invitation to come alongside for a compliant boarding might have been the lure tactic employed in the 24 April 2004 suicide boat attack during a boarding operation by the USS Firebolt (PC-10) in the Arabian Gulf. From what is known at present about the attack that killed two Navy sailors and one Coast Guardsman , the Firebolt's rigid inflatable boat was permitted to come alongside the suicide boat-an otherwise routine permission.

In today's threat environment, facing a foe unconstrained by rules of engagement or the laws of war and versed in the use of stratagem, Navy force protection requires heavily armed defenses imbued with a healthy skepticism regarding everything not positively and definitively identified as friendly.

"Know the Enemy and Know Yourself"

A study of al Qaeda tactics reveals a meticulous, careful, and educated foe capable of designing multidimensional attacks within a limited attack space. Disrupting, deterring, and defeating an al Qaeda attack requires Navy force-protection measures that address each phase of an al Qaeda operation.

Show-of-force random antiterrorism measures. These measures delay, complicate, and, if completely effective, confound operational surveillance and planning by presenting a constantly changing, complex defense for which no pattern is distinguishable and no weaknesses are evident. Terrorists are taught to continue reconnaissance until shortly before conducting an operation "to confirm that nothing new has occurred."12 Random antiterrorism measures can complicate and disrupt the detailed planning inherent in such frequent reconnaissance. Furthermore, a side effect is the ability to combat the potentially deadly complacency that can easily infect watch standers who become too familiar with routine and too unaccustomed to change. Although random antiterrorism measures can take many forms, those involving just unusual activity and movement will give observers only brief cause to pause.

Formidable, visible, layered force-protection posture. Show-of-force measures reinforce the objective for any Navy ship, base, or installation to appear too hard to approach and attack. By practicing countersurveillance, conducting an aggressive random antiterrorist measures program, adhering strictly to security procedures, and deploying an obvious, layered, and imposing defense, we reduce the likelihood of being targeted, or, if we are targeted, the attack space is extended in our favor.

Training on the head fake. In a violent, chaotic situation, maintaining complete situational awareness, recognizing a suspicious approach, repelling an initial assault, and reserving forces to defeat a primary attack are unlikely unless force-protection personnel are organized and trained on all four phases of an al Qaeda attack. The tendency on the athletic playing field is to go all out for the head fake; do so, and the opponent sprints by. That tendency is only magnified in deadly and confusing attacks where the military and human instinct is to concentrate attention and assets toward defeating the immediate and obvious threat.

As a commanding officer, I used the analogy of the head fake to inculcate in my crew the fact that the threat sector is all around them, even when an attack is occurring from one direction. That initial assault, though lethal, may be a misdirection and a precursor. As compelling as repelling the initial assault may be (and it must be repelled), maintaining complete situational awareness and reserving forces to repel the primary attack might prevent the destruction or crippling of a Navy ship. Only through training that aspires to capture the chaotic characteristics of a terrorist attack can forces be conditioned and prepared to extend the attack space, avoid falling for the head fake, and establish hostile intent in the face of what otherwise appears benign.

Shoot to Kill

Although posing a challenge both to normal peacetime procedures and the imperative to limit collateral damage, the greatest deterrent to an al Qaeda operation is a defense poised to shoot early-and shoot to kill-in the event of any attack. Fundamental to this ability is unquestioned proficiency with the weapons manned by force-protection watch standers. In the 1993 battle in Mogadishu, Somalia, several hundred U.S. servicemen were able to hold off thousands of Somalis because of the U.S. forces' knowledge of their own weapons, specifically in rapidly loading and skillfully shooting those weapons.13 Al Qaeda needs to know we are fluent in the "dialogue of bullets."14

Terrorists who are willing to die for their cause are deterred only by certain failure in the execution of their operation. If force-protection measures meant to disrupt and deter a threat fail, Navy forces must recognize the deceptive and diversionary features of an attack and defeat it through adroit employment of firepower, ensuring the terrorists who attempt an attack die in vain.

Fleetwide countersurveillance. In today's threat environment, countersurveillance cannot be left solely to skilled but widely tasked intelligence operatives. By operating under a cautious assumption that al Qaeda surveillance is occurring at all times, watch standers can disrupt terrorist operational surveillance simply by remaining alert to what is happening not just around their posts, but beyond the obvious perimeter, lifeline, gate, or fence, and by detecting and taking action on any activity that appears unusual or even too normal. It is important to note that al Qaeda surveillance techniques involve establishing regular patterns of behavior that attempt to mask the surveillance and condition an observer to accept those behaviors as routine and unsuspicious. Therefore, countersurveillance requires healthy skepticism, if not a light dose of paranoia, to avert wrongly assuming friendly or innocent intent for activities that are, in fact, preoperational.

LINK


Mr. M