Hostile reconnaissance in a terrorist attack

Hostile reconnaissance is a crucial part of a terrorist attack, nearly always preceding it. 


Define hostile reconnaissance in a terrorist attack

There are many hostile actors that wish organisations harm. For example, criminals, activists and terrorists all present a threat. They may attack an organisation online, in person or both.

Hostile actors that attack in person first need to locate an organisation’s assets. This involves desktop research, normally through Google Maps. Thereafter, they will need to identify any weaknesses in their target’s security measures. Therefore, they will perform ‘in the field’ research and visit their targets. This visit is the definition of hostile reconnaissance. It nearly always precedes a terrorist attack.

National Protective Security Authority logo<br />

Can we predict hostile reconnaissance?

Simon Riley, UK government’s subject matter expert on hostile reconnaissance believes ‘ If we understand that a venue/person/event is potentially vulnerable to hostile activity, then it is possible to both identify with high certainty where this activity will take place and actually predict the event” City Security Magazine Spring 2024. Unfortunately, it’s extremely difficult to have any useful certainty around where and when hostile reconnaissance will happen.


Manchester Arena Bombing

In May 2017 a bomb exploded at the Ariana Grande concert, Manchester Arena, UK. It killed 22 people.

Manchester Arena Bombing Location Map

The Manchester Arena Inquiry found the bomber got access to the concert venue and hid in an area not covered by CCTV. “Lives could have been saved had ‘pre-egress’ security checks carried out.” Security experts said the attacker “would likely have been spotted and reported to the Arena control room had the… patrols covered the area in their pre-egress checks.”

If the patrol guard spoke to the bomber and identified him as a hostile actor the area doors could have been shut. As a result, if there was an explosion many lives would have been saved.

The Manchester Arena bombing shows how the disruption of hostile reconnaissance could impact a terrorist attack. Because even if we can’t stop an attack, we may lessen its impact. Therefore, it’s important to consider how to deter, detect and deny hostile reconnaissance.

Security officer on patrol

Deter, detect and deny hostile reconnaissance

Security teams should aim to deter, detect and deny hostile reconnaissance. For example, a security patrol should:

1. Deter hostile reconnaissance by being visible (wear high visibility clothes), alert, and vigilant.

2. Detect hostile reconnaissance if it spots suspicious:

  • Technology on or near site. For example, drones or remote control cameras.
  • People who watch, listen and record site security. For example, hostile actors may sit in a local cafe and take pictures or videos.

A person who undertakes hostile reconnaissance is likely to feel anxious. As a result, their body language will provide ‘tells’, signs of their state of mind. (Further guidance on how to spot hostile reconnaissance is available here.)

3. Deny hostile reconnaissance if they speak with suspicious actors and challenge their intentions. This can be enough to disrupt an attack. Because the hostile actor will fear they are identified and therefore target elsewhere.

Security patrol to tackle Planning an attack - Hostile reconnaissance The more sophisticated the attack the more the hostile actor will plan and research their target. As part of this research, they will look for weaknesses in a company’s security measures. This is the definition of hostile reconnaissance. It nearly always precedes an attack.

Share suspicions

If a security patrol denies an attack it does not mean the attack will not take place elsewhere. Therefore, it is important security teams report suspicions to the security services and technology can help with that.

Counter terrorism technology and hostile reconnaissance

Counter terrorism technology helps security teams identify and report hostile reconnaissance, something Martyn’s Law is likely to encourage.

reconnaissance standard operating procedure - Learn about hostile reconnaissance	 Approach a suspect in a private space	 Approach a suspect in a public space
Approaching hostile reconnaissance - Remember In a public space the law does not allow a security guard to stop the individual from their current activity. But, the individual is under no obligation to answer your questions. You may make inquiries and record your findings.  Police officers have the right to stop and search members of the public if they believe they are in possession of items that might be used to commit a crime.  Next Steps You are encouraged to engage with the individual. If they are hostile they may recognise they have been identified and stop their activity or choose another target. Therefore, you are encouraged to engage with anyone you suspect of hostile reconnaissance.  Approach the individual Smile and Introduce yourself, say something like:  "Good morning / afternoon, my name is [first name], I’m a Security Officer working for [name of organization]" Ask about the individual’s purpose  "Do you mind my asking why you are videoing / photographing / sketching / noting our premises?"
Suspected hostile reconnaissance report form - suspicious behaviour by possible hostile actor

Martyn’s Law and hostile reconnaissance

Martyn’s Law is a UK bill to improve the safety and security at public venues. It’s a response to a number of terrorist incidents in public spaces, in particular the Manchester Arena bombing. Moreover, it forms part of the UK government’s larger counter terrorism strategy.

The bill is not expected to pass into law until 2025.

There is some uncertainty about what are Martyn’s Law’s likely requirements. However, many believe it will mean eligible organisations regardless of size, should spot and report hostile reconnaissance. Therefore, the adoption of counter terrorism technology is likely.

Crime statistics in London

Conclusion: Hostile reconnaissance in a terrorist attack

Although hostile actors may use different means to enact an attack (from self-initiated to drones), hostile reconnaissance is an ever present part of attack planning; it may be undertaken frequently, over long periods of time and at numerous locations. Therefore, it’s important organisations play their role to detect, deter and deny hostile reconnaissance.

Further resources:


SIRV email list subscribe

Get great content straight to your inbox

Join our mailing list to receive the latest news and updates from our team.

GDPR Consent

Terms and Conditions

You have Successfully Subscribed!