Patterns in AQ-LeT Gun-team Attacks

Last month's attack by a three-man gun team on the Chechen Parliament in Grozny, and the attack earlier this week on Our Lady of Salvation Church in Baghdad, have many features in common with the Parliament House attack in India in December 2001. The principal movers at this time are Al Qaeda affiliates and Lashkar-e-Taiba (LeT).

It's important to maintain basic citizen awareness of this very dangerous tactic, which poses a real threat even though the coordinated gun-team attack has not materialized recently in the West. While a gun-team attack in a major Western city would be up against a fast and capable security response, attackers tend to hold a tactical advantage in the early moments. The best response is to stop these before the shooting starts, and a vigilant citizenry may well help alert the police to precursor events, such as hostile reconnaissance or cache preparation. I understand that now the press is zeroed in on the attempted package-bomb attack last week on cargo airliners, but I recommend that the gun-team attack move up in the public's awareness.

I checked Google News and press coverage of the package bombs is a great deal more intense than coverage of the gun-team attack on Sunday that killed 52 at Our Lady of Salvation in Baghdad. And there was even less press coverage of the October gun-team attack in Grozny.

These common features of a gun-team attack are a squad or squads who move quickly from target to target; who are trying to get past guards and into a closed area packed with people; and who act in such a way to cause maximum havoc and maximum publicity.

If the attack aims for a hostage standoff -- and most gun-team attacks do, as a means to stretch out the timeline -- there will certainly be attempts to use media  for publicity. Note that during the church attack, the gunmen tried to use Al-Baghdadiya television as an outlet for demands, until the government cut the transmitter. Extended attacks also see the gun teams carrying GPS units, satellite phones, and backpacks with ammunition, explosives, and concentrated food. There is some evidence of pre-positioned caches with additional munitions.

Gun teams typically rely on standard assault weapons (the AK-47 and a Chinese copy called the Type 56 have been common), semi-automatic handguns, grenades, and some form of suicide bomb. Lately the equipment has included cellphones linked to a VoIP address to make the controllers hard to trace.

I use the term “gun-team attack” because of the defining characteristic: one or more fast-moving assault teams relying mostly on firearms and other light weapons to attack multiple targets in a city with economic and cultural significance. This is to distinguish it from three other main types of historical terror attacks (mass hostage-taking attacks that are mostly static; assassinations; and explosive attacks on crowded buildings and mass-transit facilities).

Usually a gun team is two to four in size. Some attacks involved multiple gun teams, as in Mumbai 2008. The attack at Mumbai started out as five teams, two of which joined up on the sixth floor of the Taj Hotel (which recently reopened after two years of repairs and security upgrades). The reason for the rendezvous on the sixth floor likely was a hotel room that had been rented and stocked with a cache of weapons and supplies. (A cache was also part of preparations for the mass-hostage event at a school in Beslan, North Ossetia.)

Gun teams are not new. They were among the first in the modern terror tactics – see the 1972 Lod Airport attack by Japanese Red Army members who sympathized with the PFLP.

Three well-documented cases revealing gun-team tactics against soft targets are:

• Lashkar-e-Taiba (LeT): “Parliament House” attack, December 2001
• Al Qaeda (AQ): Attack on the Oasis executive compound, Al Khobar, Saudi Arabia, May 2004
• LeT: Attack on multiple targets in downtown Mumbai, November 2008

In general, a major gun-team attack like Mumbai 2008 develops in ten stages:

1. Hostile reconnaissance of the target, possibly a year or more ahead: these operatives walk around with cameras and GPS devices to note hallways and doors. A list of ~200 principal targets around the world is already known from interrogations, ELINT, and captured computer files and we can hope the security people are watching the cameras for such behavior. 
2. Gun-team training in a remote location, currently Pakistan but Yemen and Somalia are also likely. Gun teams receive intensive training based on such reconnaissance. They spend much time on tactical shooting and physical endurance. These men are young and highly motivated until captured, at which point their resistance seems to melt.
3. Acquisition of special gear, like satellite phones, IEDs, SIM cards for cellphones, and inflatable boats. The attackers at Grozny were in touch with a handler by cellphone, as were the attackers in Mumbai. Given this pattern it's likely that authorities in major cities are now ready to shut down local cellphone networks.
4. Sometimes, staging caches of supplies inside the primary targets.
5. Final selection of gun teams at the training camp. The organizers try to screen out those who will balk at indiscriminate killing.
6. Arrival in target city. Teams split up and try to reach the primary targets without detection. The idea is to penetrate deeply into the target without using most of the ammunition, leaving most of it for use in a confined space crowded with targets. This didn't work at Parliament House but only because the Indian Vice President's motorcade happened to be blocking the narrow gate the attackers were trying to use.
7. First stage of attack: “Large-space attacks”. Timed for high traffic hours in a crowded public place like a mall, tourist destination, or train station. Teams throw grenades and fire automatic weapons at anyone in sight, killing as many as they can and then running off. If police return fire the gun teams will retreat and move to a softer target. If the space is large enough and has enough exits this stage of shooting might go on for an hour, and so the death toll is high. The gun teams are hard to stop unless police can arrive very quickly.
8. Second stage of attack, “Small-space attacks”: A gun team leaves the first location and moves to someplace more confined. Most likely is a restaurant or club near a five-star hotel. They continue shooting there. They begin setting fires and taking hostages before they move to the final destination. If they don't break off the attack and try to escape, this leads to:
9. The third stage of attack, “hostage-holding”: Hostages are brought to a defensible location, likely to be upper floors of a hotel or apartment building. More fires are set, and boobytraps may be laid. At this point the teams may join up with each other and try to establish regular communication with leaders in a remote location. The organizers want to prolong the event as long as possible, adding fires and explosions. Often this involves checking identification and making a big show of releasing Muslims.
10. Fourth stage of attack, “martyrdom”: Die as martyrs in a firefight with police or in a bomb explosion.

The main goals of a gun team attack like Mumbai are to promote the organization as an effective fighting force, attract recruits, and polarize Muslim and non-Muslim societies. Since all these goals depend on receiving 24/7 worldwide publicity, organizers try for attacks in internationally-known locations, that are sustained over many hours, and that have visual elements suited for TV. Mumbai 2008 achieved all of these. Indications are that AQ affiliates and LeT have decided that classic suicide bombings are not able to achieve the high publicity profile that only a sustained drama can provide, though IEDs are likely to be in the list of weapons.

Why don't these attacks happen more often? Obviously there is a lot of preparation and planning but I think the main reason is that the organizers go to a great deal of extra effort to avoid failed missions. Mission failure and particularly capture of their fighters alive strike at the heart of the belief system. If the recruit base starts to think that such attacks aren't working, it's harder to get would-be martyrs to come forward. 

A large-scale collapse of martyr-willingness happened halfway through the Iran-Iraq War of 1980-1988. There is good evidence that the human wave attacks of Basij early in the war couldn't be sustained politically among the Iranian population because human waves just weren't working against massed Iraqi artillery, tanks, and Mi-24 gunships.

So it's important to capture enemy fighters alive during these events, then gather information through patient, humane interrogation. No Abu-Ghraib heavy-handed tactics are necessary. Most young fighters agree to talk, once separated from their handlers. Additional evidence that their resolve is weaker than commonly thought comes from cellphone calls recorded between the attackers in Mumbai and their controllers. Despite LeT's screening efforts, some of the attackers once on the ground repeatedly balked at controllers' orders to carry through with the carnage expected of them, during the hostage-taking stage.