Terrorists Target Mass Transit

[thedrifter]

04-23-2004

For the Record: Terrorists Target Mass Transit



Compiled by DefenseWatch Staff



Editor?s Note: The following informational report was forwarded to DefenseWatch by NavySEALS.com. It has been slightly edited to give typographical emphasis to key segments of the report.



Subject: DHS Information Bulletin 04/20/04



Homeland Security Special Assessment



April 20, 2004



Lessons Learned from the Madrid Train Bombings



ATTENTION: State Homeland Security Advisors and Staff, Federal Departments and Agencies, all Information Sharing Analysis Centers (ISAC), and State Emergency Managers



Limited Distribution: This Special Assessment is ?FOR OFFICIAL USE ONLY.? It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). This Special Assessment is to be controlled, handled, transmitted, distributed, and disposed of in accordance with policies relating to FOUO information and is not to be released to the public or other personnel who do not have a valid ?need to know? without prior approval of the Information Analysis Requirements Division at (202) 282-8168.



DHS intends to update this information bulletin should it receive additional relevant information, including information provided to it by the user community. Based on this notification, no change to the Homeland Security Advisory System (HSAS) level is anticipated; the current HSAS level is YELLOW-ELEVATED.



Department of Homeland Security Special Assessments are informational in nature and are designed to provide updates on the training, tactics, techniques, procedures, or strategies of terrorists. DHS Special Assessments communicate issues that pertain to threats to the United States and to the critical national infrastructure. They are for informational purposes only.



This product is intended to provide possible indicators of terrorist attack planning and terrorists? tactics. Suspicious activities, especially surveillance of critical infrastructure, should be reported to local law enforcement, local FBI's Joint Terrorism Task Force or the Department of Homeland Security Operations Center (HSOC).



OVERVIEW



A group of al-Qaeda connected Moroccan Islamic extremists perpetrated the 11 March bombings of commuter trains in Madrid that killed nearly 200 and injured hundreds more. We know of no tactical indicators of the attacks, but strategic indicators were present. The attacks demonstrated the relative ease and speed with which local terrorist networks can develop and execute highly lethal attacks that do not require significant operational expertise. While the terrorists? primary goal was to inflict mass casualties, the timing of the attacks may have been a factor that led to a change of government in an important allied state. The Madrid attacks highlight a trend of increased operational activity by local Islamic extremist networks. We believe these networks pose a growing threat to soft targets in the [U.S.] Homeland and abroad.



THE PERPETRATORS



A cell of primarily Moroccan Islamic extremists who had immigrated to Spain was responsible for the bombings. The bulk of information suggests the cell was self-driven and operated independently, despite links between some cell members and mainstream al-Qaeda personnel. Authorities speculate the members are associated with the Moroccan Islamic Combatant Group or a newer offshoot called Salafiya Jihadia. The Moroccan Islamic Combatant Group and Salafiya Jihadia are Moroccan Islamic extremist networks that share al-Qaeda's ideology. The Salafiya Jihadia was responsible for a series of bombings in Casablanca , Morocco in May 2003 that targeted Western establishments.



Some of the key suspects: Now deceased ringleader Serhane Fakhet; detainee Jamal Zougam, who purchased the cell phones used to trigger the explosive devices; and detainee Jose Trashorras, a native Spaniard who helped the cell acquire the explosives.



As of early April, the Spanish had brought charges against 18 persons in conjunction with the March 11 attacks, 14 of whom were Moroccan. A handful of Moroccan suspects for whom there are arrest warrants remain at large. Several suspects, including a Tunisian believed to be a ringleader of the bombings, blew themselves up on 3 April when authorities raided their apartment in a Madrid suburb. At least three who died in the apartment were Moroccan. The Spanish had investigated some of the suspects before the attacks and knew some had links to prominent Islamic extremists and al Qaeda, to include Imad Barakat Yarkas. Yarkas, under arrest in Spain for involvement in the 11 September attacks, previously functioned as the leader of an al Qaeda support cell.



Lessons: The bombings demonstrated how al Qaeda-influenced regional extremist networks have increased in importance while the corporate al Qaeda structure has been dispersed and degraded since the onset of the War on Terrorism. We believe this trend will continue, with regional terrorist networks or groupings (often comprised of ?in place? persons of like ethnic origins) posing an increasing threat.



INDICATIONS AND WARNING



We know of no noted tactical-level warnings of the attacks, including pre-operational indicators such as surveillance, elicitation, tests of security or other suspect behavior. At a strategic level, however, Spanish authorities knew Spain was home to an active Islamic extremist network and, as indicated above, already had concerns about some of the suspects. Additionally, Osama Bin Ladin had threatened Spain in recent months for its role in the War on Terrorism, and jihadist propaganda on the Internet had carried threats against Spain.



Paradoxically, Spanish authorities who suspected the Basque separatist group, ETA, would attempt attacks sometime near Spain?s 14 March national elections, knew the rail system was a possible target and were concerned the attacks could be more lethal than those normally associated with ETA. This assessment was based, in part, on the foiling of an ETA plan to bomb passenger trains on Christmas Eve 2003 using a modus operandi similar to that of the 11 March attacks. We do not believe there were links between the Madrid cell of Islamic extremists and the ETA, but it is possible the cell took some inspiration from the disrupted ETA attacks.



Lessons: Generally, tactical warning of terrorist attacks remains difficult due to terrorists' operational security practices and their ability to take advantage of open societies, blend in with local populations, and hide in plain sight. Compounding this problem, the Madrid cell appears to have put the plot into practice in only a few months, further hindering the ability of authorities to obtain warning. The strategic indicators of an Islamic extremist threat to Spain seemingly were insufficient to allow Spanish officials to aggressively follow-up leads, and the more familiar ETA threat was a preoccupation.



TACTICS, TECHNIQUES AND PROCEDURES



The terrorists boarded commuter trains outside of Madrid during the morning rush hour and placed 13 improvised explosive devices (IEDs) in passenger cars on four Madrid-bound trains. The IEDs were concealed in innocuous back packs/sporting bags. After placing the IEDs, the terrorists disembarked the trains. The placement had to involve multiple teams of operatives, with an individual probably placing one device. We assume the terrorists spent time learning the trains? schedules and familiarizing themselves with the security environment.



The terrorists timed the explosions to coincide with the times the trains would be in station. Ten of the 13 IEDs detonated between 0739L and 0742L, with the first set exploding near-simultaneously on a train in Atocha Station and on second train located approximately 500m from Atocha Station, but on a different track. Had the second train not been running behind schedule, it is likely the IEDs would have detonated while it was in station. The other functional IEDs near-simultaneously detonated a few minutes later on a third and fourth train at the El Pozo and Santa Eugenia Stations.



Three of the IEDs failed to detonate. Authorities destroyed two of them near the scene of the attacks via controlled detonation. The bag containing the third unexploded IED inadvertently was taken to a police station amidst articles belonging to the victims. This IED consisted of approximately 10 kilograms of a locally produced gelatin dynamite called ?Goma 2 ECO? (commonly used in mining operations), more than half a kilogram of bolts and nails, and a timing/initiating device consisting of an adapted cell phone and a locally produced electrical detonator. The cell phone based initiating system was to be activated via the cell phone?s alarm feature and not to a call-activated detonation mechanism. It is believed all the IEDs were constructed similarly.



Composition of recovered IED: Sports bag, modified cell phone with detonator, Goma-2 ECO explosives, and bolts and nails for shrapnel.

Lessons: Multiple, near-simultaneous mass-casualty attacks against separate targets remain a trademark of al-Qaeda and its affiliates. The relative short time between the times the terrorists placed the IEDs and the detonations, the crowds, and the ability to carry luggage inconspicuously on the trains lessened the chance that commuters or authorities would notice the abandoned bags. The coordinated timing of the blasts meant that passengers and authorities had little time to evacuate other trains. The operation demonstrated that suicide bombers are not necessarily the preferred modus operandi, although the events in the subsequent manhunt demonstrated members of the cell were willing to kill themselves when surrounded by police. The IED construction was relatively simple, yet effective. The terrorists' utilization of timing devices to initiate the IEDs did not allow them to compensate for delays in trains' schedules and thus precisely pinpoint where on the lines the explosions would occur. The discovery of the unexploded IEDs underscores the threat of post-incident explosions - whether the devices are deliberately left behind, timed to target responders, or the result of a malfunction.

Intent



The target, timing and method of attack, to include IED construction, demonstrated the intent of the bombings was to produce significant commuter casualties. We do not believe the terrorists plotted to achieve second-order consequences or destroy the train stations. The size/power of the IEDs was sufficient to destroy individual train cars, but not enough to destroy the stations.



The bombings occurred three days before Spain 's national elections, which contributed to the ouster of the sitting government. While we suspect the attacks were scheduled to coincide with the elections, we are not sure the terrorists deliberately attempted to influence the elections or manipulate its outcome. Since the attacks, we have learned al Qaeda may be encouraged to conduct attacks in the United States in advance of the November 2004 elections given the reaction of the Spanish electorate to the Madrid bombings. Al-Qaeda has threatened other countries for cooperating with the United States and the War on Terrorism; some of these countries, to include several European states, Japan, and Australia, are scheduled to hold national elections this year. (The 2004 elections in European states are primarily for the European Union Parliament).



Lessons: Islamic extremists continue to aspire to high-casualty producing attacks, with relatively soft targets the most appealing, particularly for less sophisticated, less developed groups. We suspect that, based on the success of the Madrid attacks, post-Madrid thwarted rail sector attacks in Spain and elsewhere, and previous indications of al Qaeda?s interest in attacking the rail sector, terrorists will look closer at further attacks against surface public transport. Al Qaeda?s assessment of the political fallout from the Madrid attacks, combined with the previously held assessment of the susceptibility of Western states to ?cut and run? when sustaining high casualties, ensures Islamic extremists increasingly will factor political effects into future attacks. This is likely to include analyses of the impact of conducting attacks against or near elections of key countries, particularly those deemed by al-Qaeda to be weak links in the War on Terrorism.



Logistics



A Spaniard with ties to the mining community helped the terrorists obtain approximately 200 kilograms of gelatin dynamite (about 150 kilograms was used in the train bombings) and the detonators used in the attacks, but claimed he did not know their intended use. The explosives were stolen in northern Spain over a period of time, then provided to the terrorist cell in late February. One cell member, who died in the 3 April police raid, rented a house near Madrid where the terrorists constructed the IEDs. The terrorist cell purchased the cell phones legitimately in early March. A van used to transport the explosives also was stolen in Madrid in February 2004. At this juncture, it appears the terrorist cell financed the attacks independently via criminal activity, primarily narcotics trafficking.



Lessons: The terrorists made use of local, readily available material in pursuing the plot, but exposed themselves to risk of discovery by engaging in criminal activity. However, the theft of explosives from mining and construction firms is fairly common in Spain, as well as the [U.S.] Homeland, and even relatively small thefts provide sufficient quantities for high impact terrorist attacks. The cell?s involvement in criminal activity underscores the modus operandi of other North African extremist networks in Europe and North America that have engaged in common criminal activity to fund their terrorist activity. Financing the attacks probably amounted to no more than a few thousand dollars.

http://www.sftt.org/cgi-bin/csNews/...1.0703168787552


Ellie