Potential Indicators of Threats Involving Vehicle Borne Improvised Explosive Devices (VBIEDs)
May 15, 2003
The following information is meant to advise the public as well as
people who own and operate facilities about possible indicators of
terrorist attack planning. DHS encourages individuals to report
information concerning suspicious or criminal activity to law
enforcement or a Homeland Security watch office.
Individuals also may report incidents to the Homeland Security Center
(HSC) at 202-282-1616, email to State.Local.HSCenter@dhs.gov.
This document is intended to provide general information to assist in
efforts to recognize potential VBIED-related threats or incidents
based on the recent Riyadh bombings.
The Department of Homeland Security (DHS) believes that a truck
bombing by terrorists may be pre-empted if the general public remains
alert for certain indicators. DHS has no information to indicate that
a truck bombing of any
kind is currently being planned in the United States.
Current Tactics Used in the Riyadh Attack
a.. Multiple targets
b.. Simultaneous attacks
c.. Multiple vehicles per target
d.. Assault/breaching cadre accompany the VBIED to clear security
personnel and gain access to the compound.
International terrorist groups have demonstrated the ability to plan
and conduct complex attacks, simultaneously, against multiple
targets. In the 11 May Riyadh attack terrorists, possibly Al-Qaida,
assaulted three compounds occupied by western guest workers using
multiple vehicles. At least one vehicle in each assault team carried
a large explosive charge which was detonated by a suicide bomber.
Media reports that the attackers drove up to each compound killing
those guarding the compound gates with small arms fire. Vehicles
carrying the explosive charges were then driven into each compound
and detonated. In one instance it appears that the terrorists
attempted to breach the gate security check point by ramming it with
a sedan. It is likely that those involved with executing these
attacks conducted extensive preoperational surveillance of the
compounds selected. Meticulous planning, to include preoperational
surveillance, is a hallmark of Al-Qaida terrorist attacks.
JEDAWAL COMPOUND
a.. Sustained the least amount of damage of the three targets.
Initial attack penetrated one Saudi Military Guard manning watch post
at rear corner of compound.
b.. Assailants killed the guard and drove the explosive laden car
up to the next gate in the back of the compound, where it was
detonated. Of note; the terrorist's safe house -- which was raided by
Saudi authorities on 6 May -- was only 400 meters from the Jedawal
Compound
VINNELL CORPORATION - (Cordoval Compound)
a.. This compound was located on a Saudi National Guard (SANG)
controlled facility.
b.. Initial attack was conducted with a Ford Crown Victoria sedan,
which attempted to ram through the gate of the compound.
c.. When the car became stuck, terrorists from a pick-up truck
dismounted
and attacked the guard post.
d.. Firefight ensued, killing all SANG personnel.
e.. Terrorists forced open the gate, and drove the pick-up on the
compound.
f.. Truck was driven up to residence housing, where it was
detonated (initial estimate suggests 400-500 kilograms of HE may
have been used).
AL-HAMRA COMPOUND - (Lucent Technologies)
a.. Toyota sedan pulled up to the gate, followed by a GMC Suburban
truck.
b.. An unknown number of terrorists dismounted from the truck and
attacked. the unarmed guard force, forcing their way into the
compound after shooting and injuring one guard.
c.. Both vehicles drove toward the center of the compound, the
terrorists shooting wildly into buildings and at anything that moved.
d.. Upon reaching a housing area south of the main recreation and
sports complex, an explosive device in the GMC Suburban was detonated
by a suicide terrorist.
While the ability to conduct multiple, near simultaneous attacks
against several targets is not new for terrorist groups such as Al-
Qaida, the manner in which these attacks was conducted indicates a
more refined capability. In each attack a number of armed terrorists
was used to eliminate the security elements guarding the compounds so
suicide cadre could drive a vehicle borne improvised explosive device
to the desired location and detonate it.
Media reports suggest that the terrorist perpetrators may also have
fired shots in the air to lure victims out of their dwellings in
order to maximize casualties. The split second timing among the
reported three attacks -- while not unprecedented for accomplished
terrorist groups - indicates that a trained and dedicated cadre
perpetrated this attack.
Potential VBIED Indicators
The existence of any one of the following indicators does not in and
of itself suggest terrorist activity. Each incident should be
carefully assessed together with other information present to judge
whether there is cause for further investigation:
a.. Theft of explosives, blasting caps, or fuses, or certain
chemicals
used in the manufacture of explosives.
b.. Rental of self-storage space for the purpose of storing
chemicals or mixing apparatus.
c.. Delivery of chemicals directly to a self-storage facility or
unusual deliveries of chemicals to residential or rural addresses.
d.. Chemical fires, toxic odors, brightly colored stains, or rusted
metal fixtures in apartments, hotel/motel rooms, or self-storage
units.
e.. Rental, theft, or purchase of truck or van with minimum (1) ton
carrying capacity.
f.. Modification of truck or van with heavy duty springs to handle
heavier loads.
g.. Small test explosions in rural wooded areas.
h.. Treatment of chemical burns or missing hands/fingers.
i.. Untreated chemical burns or missing hands/fingers.
Purchase or theft of explosives or chemicals may be a precursor to
terrorist attacks -Ramsi Yousef--the mastermind behind the 1993 World
Trade Center (WTC) attack--purchased the required chemicals directly
from a chemical manufacturer. Timothy McVeigh--the perpetrator of the
attack on the Murrah Federal Building--used a combination of theft
and small purchases over a six (6) week period to amass the necessary
ingredients used to assemble his explosive device.
Rental of self-storage units and the delivery of chemicals to such
units - Both Ramsi Yousef and Timothy McVeigh rented self-storage
units in order to store chemicals. Ramsi Yousef had the chemical
manufacturer deliver $3,400 in chemicals directly to his self-storage
unit.
Chemical fires, toxic odors, brightly colored stains, or rusted metal
fixtures in apartments, hotels rooms, or self-storage units - Self-
storage site managers, motel/hotel staff, and apartment
superintendents may wish to be sensitive to any fires, toxic odors,
bright stains, or rusted metal fixtures within their facilities. In
attempting to prepare an improvised
explosive device in the Philippines following the 1993 WTC attack,
Ramsi Yousef caused a violent chemical fire to break out in the
kitchen where he was preparing his device. Subsequent investigation
of this apartment revealed bright stains and rusted metal fixtures
(i.e., door hinges, window locks, etc.) throughout the apartment.
Theft of truck or van with minimum one (1) ton carrying capacity -
The 1993 WTC attack and 1995 bombing of the Murrah Federal Building
were carried out with rented vehicles. However, terrorists may use a
stolen vehicle in order to impede subsequent investigation. Moreover,
most VBIEDs used in recent
years have carried large explosive charge that weighed in excess of
2,000 pounds suggesting that continued use of large vans, SUVs or
trucks for this purpose is likely.
Modification of smaller capacity vehicles to accept a minimum one (1)
ton load - The two vehicles used in the 1998 East Africa bombings
were imported into the target country and then locally modified with
heavier springs in order to accommodate the weight of the explosive.
Local law enforcement may wish to liaise with appropriate garages or auto mechanic trade associations in their jurisdictions to sensitize them to this indicator.
Small test explosions in rural or wooded areas - Timothy McVeigh
detonated at least one small explosive device in a wooded area near
his residence in order to test his chemical mixture. Local law
enforcement, as well as fire and rescue departments, may be in the
best position to report this indicator to the FBI.
Treated/untreated chemical burns or missing hands and/or fingers -
Terrorists may seriously injure themselves while manufacturing their
bomb that they require immediate and substantial medical care.
Hospitals and out-patient clinics should therefore be requested to
report such injuries.
Physical surveillance - Nearly every major terrorist attack is
preceded by a thorough surveillance of the targeted facility. It is
likely that similar activity preceded the Riyadh compound bombings.
Purchase of, or illicit access to, blue prints of the targeted
facility – In a foiled 1996 attempt to destroy the FBI's fingerprint
facility in Clarksburg, WV, a domestic anti-government group
attempted to acquire the facility's blue prints from a local
emergency services worker.
Receiving offices may wish to sensitize local fire and rescue
departments, and architectural firms, to the possibility that
terrorists may attempt to acquire a targeted facility's blue prints
from local emergency services worker.
General Characteristics of Terrorist Surveillance:
Terrorist surveillance may be either fixed or mobile.
a.. Fixed surveillance is done from a static position, possibly an
adjacent building, business, or other facility. In fixed surveillance
scenarios, terrorists may establish themselves in a public location
over a period of time or choose disguises or occupations such as
street vendors, tourists, repair or deliverymen, photographers or
even demonstrators.
b.. Mobile surveillance usually entails observing and following
persons or individual human targets, although it can be conducted
against non-mobile
facilities (i.e. driving by an embassy to observe the building or
compound). To enhance mobile surveillance, many terrorists have
become more adept at progressive surveillance.
c.. Progressive surveillance is a technique whereby the terrorist
will follow a target for a short period of time from point A to point
B, withdraw for a time, possibly days or even weeks, and then resume
surveillance from point B to point C. This will continue until the
terrorist develops target suitability and/or noticeable patterns in
the targets movements. This type of transient presence makes the
surveillance much more difficult to detect
or predict.
d.. More sophisticated surveillance is likely to be accomplished
over a long period of time. This tends to disrupt detection
techniques and improve the quality of gathered information. Some
terrorists are noted to perform surveillance of a target or target
area over a period of months or even years.
e.. Terrorists are known to use advances in technology such as
modern optoelectronics, communications equipment, video cameras, and
other electronic equipment. Such advances include commercial and
military night-vision devices, GPS systems, and cellular phones. It
should be assumed that many terrorists have access to high-dollar
technological equipment.
Protective Measures
Terrorists continue to select soft targets for attack -- particularly
those that will yield a high casualty count. Some examples, though
not all inclusive, are: residences, recreational and shopping venues,
and business buildings and complexes. All available antiterrorism
measures should be rigorously reexamined - to include: physical
security perimeters set back
distances between security fences and key buildings, and barricades.
a.. Maintain situational awareness of world events and ongoing
threats.
b.. Ensure all levels of personnel are notified via briefings,
email,
voice mail and signage of any changes in threat conditions and
protective measures.
c.. Encourage personnel to be alert and immediately report any
situation that may constitute a threat or suspicious activity.
d.. Encourage personnel to avoid routines, vary times and routes,
pre-plan, and keep a low profile, especially during periods of high
threat.
e.. Encourage personnel to take notice and report suspicious
packages, devices, unattended briefcases, or other unusual materials
immediately; inform them not to handle or attempt to move any such
object.
f.. Encourage personnel to keep their family members and
supervisors apprised of their whereabouts.
g.. Encourage personnel to know emergency exits and stairwells.
h.. Increase the number of visible security personnel wherever
possible.
i.. Rearrange exterior vehicle barriers, traffic cones, and road
blocks to alter traffic patterns near facilities and cover by alert
security forces.
j.. Institute/increase vehicle, foot and roving security patrols
varying in size, timing and routes.
k.. Implement random security guard shift changes.
l.. Arrange for law enforcement vehicles to be parked randomly near
entrances and exits.
m.. Review current contingency plans and, if not already in place,
develop and implement procedures for receiving and acting on threat
information, alert notification procedures, terrorist incident
response procedures, evacuation procedures, bomb threat procedures,
hostage and barricade procedures, chemical, biological, radiological
and nuclear (CBRN)
procedures, consequence and crisis management procedures,
accountability procedures, and media procedures.
n.. When the aforementioned plans and procedures have been
implemented, conduct internal training exercises and invite local
emergency responders (fire, rescue, medical and bomb squads) to
participate in joint exercises.
o.. Coordinate and establish partnerships with local authorities to
develop intelligence and information sharing relationships.
p.. Place personnel on standby for contingency planning.
q.. Limit the number of access points and strictly enforce access
control procedures.
r.. Approach all illegally parked vehicles in and around facilities,
question drivers and direct them to move immediately, if owner can
not be identified, have vehicle towed by law enforcement.
s.. Consider installing telephone caller I.D., record phone calls,
if necessary.
t.. Increase perimeter lighting.
u.. Deploy visible security cameras and motion sensors.
v.. Remove vegetation in and around perimeters, maintain regularly.
w.. Institute a robust vehicle inspection program to include
checking under the undercarriage of vehicles, under the hood, and in
the trunk. Provide vehicle inspection training to security personnel.
x.. Deploy explosive detection devices and explosive detection canine teams.
y.. Conduct vulnerability studies focusing on physical security,
structural engineering, infrastructure engineering, power, water, and
air infiltration, if feasible.
z.. Initiate a system to enhance mail and package screening
procedures (both announced and unannounced).
aa.. Install special locking devices on manhole covers in and
around facilities.
ab.. Implement a counter-surveillance detection program.
Table 1 Chemicals and Other Demolitions Paraphernalia Used in
Recent Truck Bomb Attacks Against US Government Facilities
Substance Amount (where available)
Urea Crystals 1,000 lbs. (47% purity)1
Nitric Acid 105 Gals.1
Sulphuric Acid 60 Gals. (93% purity)1
Ammonium Nitrate (fertilizer) 108 bags (50 lbs. each) 2
Nitro-Glycerine 1
Potassium Nitrate 1
Methenamine 1
Hydrogen 4 Bottles (4 feet long)1
Sodium Azide 1
Magnesium Azide 1
Aniline Reagent 1
Ethanol 3
Battery Acid 18 liters 3
Liquid Nitromethane (racing fuel) 3 drums (50 gals. each) 2
Tovex blasting gelatine 2
Shock Tube 2
Anhydrous Hydrazine (boiler cleaner) 2
Note: Substances and Amounts compiled from publicly available sources.
Prepared by: Risk Assessment Division, Information Analysis
Directorate,
Department of Homeland Security.
Regards,
SA Art F. Fierro
afierro@fbi.gov
_______________________________________________________________ |
