The Terrorist Attack Cycle: Operational Planning

October 4, 2005

Editor's Note: This is the third in a series of reports on the terrorist attack cycle.

Terrorist attacks often require meticulous planning and preparation. As we have said, this process takes place in a six-stage attack cycle: target selection, planning, deployment, the attack, escape and exploitation. After a target is selected and surveilled, operational planning for the actual attack begins.

During this phase, the who, how, where and when of the attack are determined. To make these decisions, the plotters must conduct more surveillance, initiate logistic support and assemble the attack team. In the course of performing these acts, the cell is further exposed to vulnerabilities that can compromise the operation.

Surveillance conducted during the target-selection stage of the attack cycle is aimed at determining which aspects of a target make it a desirable candidate for attack. Once these factors are established and a specific target is chosen over others, planning for the actual attack begins. This preparation includes more surveillance, weapons selection or bomb assembly, money transfers, bringing the attack team together and sometimes conducting dry runs.

During this time, communication in the form of phone calls or Internet traffic increases, as does the movement of group members. This increase in activity naturally leaves signs that can tip-off law enforcement or intelligence personnel. The money transfers, the communications traffic and the movement of individuals across borders leave trails that can be followed. If enough pieces of the puzzle are collected from this activity, a complete picture of the planned attack can emerge.

During the operational planning stage, target surveillance is often more difficult to detect than during the target-selection stage. For one thing, the operatives conducting operational surveillance generally are better at their jobs than the ones who conduct target-selection surveillance. Instead of gathering information about possible targets, these operatives are looking at specific aspects of the target. In many cases, those conducting the surveillance are the ones who will carry out the actual attack.

This also creates vulnerability in the attack cycle. Because the operatives who will carry out the attack usually are more closely linked to the plotters than those who initially surveilled the target, they likely are known to intelligence or law enforcement agencies. Knowing this makes them more careful, or more nervous, depending on the individual. If they are more nervous about being observed by countersurveillance personnel, they might make mistakes that can expose them.

During the planning stage, terrorists begin performing operational acts that are more visible to law enforcement and intelligence agencies. Some of the training and preparation—the pilot training for the Sept. 11 attacks, for example—can take months or even years. In addition, if counterterrorism personnel have good intelligence that allows them to piece the puzzle together, they possibly can determine which stage of the attack cycle the cell is in. Cell members can then be rounded up immediately, or allowed to continue operating so as to expose others involved in the operation. From a counterterrorism perspective, the critical decision is, at what point to strike. Moving in too early could result in failure to round up the entire team; too late could find the attack in progress.

During the attack cycle, law enforcement and intelligence agencies usually receive some indication that an operation is being planned. Lack of resources, including in human intelligence and analytical capacities, however, sometimes prevents the full picture from forming in time to prevent an attack.

It is during the planning stage that terrorists begin carrying out duties that can attract attention, even though counterterrorism personnel often lack the resources to understand what they are seeing. This is a critical phase of the attack cycle in which a cell can either be exposed or move one step closer to committing its attack.

© Copyright 2005 Strategic Forecasting Inc.