Hostile reconnaissance in a terrorist attack
Hostile reconnaissance is a crucial part of a terrorist attack.
Define hostile reconnaissance in a terrorist attack
There are many hostile actors that wish organisations harm. For example, criminals, activists and terrorists all present a threat. They may attack an organisation online, in person or both.
Hostile actors that attack in person first need to locate an organisation’s assets. This involves desktop research, normally through Google Maps. Thereafter, they will need to identify any weaknesses in their target’s security measures. Therefore, they will perform ‘in the field’ research and visit their targets. This visit is the definition of hostile reconnaissance. It nearly always precedes a terrorist attack.
Manchester Arena Bombing
In May 2017 a bomb exploded at the Ariana Grande concert, Manchester Arena, UK. It killed 22 people.
The Manchester Arena Inquiry found the bomber got access to the concert venue and hid in an area not covered by CCTV. “Lives could have been saved had ‘pre-egress’ security checks carried out.” Security experts said the attacker “would likely have been spotted and reported to the Arena control room had the… patrols covered the area in their pre-egress checks.”
If the patrol guard spoke to the bomber and identified him as a hostile actor the area doors could have been shut. As a result, if there was an explosion many lives would have been saved.
The Manchester Arena bombing shows how the disruption of hostile reconnaissance could impact a terrorist attack. Because even if we can’t stop an attack, we may lessen its impact. Therefore, it’s important to consider how to deter, detect and deny hostile reconnaissance.
Deter, detect and deny hostile reconnaissance
Security teams should aim to deter, detect and deny hostile reconnaissance. For example, a security patrol should:
1. Deter hostile reconnaissance by being visible (wear high visibility clothes), alert, and vigilant.
2. Detect hostile reconnaissance if it spots suspicious:
- Technology on or near site. For example, drones or remote control cameras.
- People who watch, listen and record site security. For example, hostile actors may sit in a local cafe and take pictures or videos.
A person who undertakes hostile reconnaissance is likely to feel anxious. As a result, their body language will provide ‘tells’, signs of their state of mind. (Further guidance on how to spot hostile reconnaissance is available here.)
3. Deny hostile reconnaissance if they speak with suspicious actors and challenge their intentions. This can be enough to disrupt an attack. Because the hostile actor will fear they are identified and therefore target elsewhere.
If a security patrol denies an attack it does not mean the attack will not take place elsewhere. Therefore, it is important security teams report suspicions to the security services and technology can help with that.
Counter terrorism technology and hostile reconnaissance
Martyn’s Law and hostile reconnaissance
Martyn’s Law is a UK bill to improve the safety and security at public venues. It’s a response to a number of terrorist incidents in public spaces, in particular the Manchester Arena bombing. Moreover, it forms part of the UK government’s larger counter terrorism strategy.
The bill is not expected to pass into law until 2023.
There is some uncertainty about what are Martyn’s Law’s likely requirements. However, many believe it will mean eligible organisations regardless of size, should spot and report hostile reconnaissance. Therefore, the adoption of counter terrorism technology is likely.
Conclusion: Hostile reconnaissance in a terrorist attack
Although hostile actors may use different means to enact an attack (from self-initiated to drones), hostile reconnaissance is an ever present part of attack planning; it may be undertaken frequently, over long periods of time and at numerous locations. Therefore, it’s important organisations play their role to detect, deter and deny hostile reconnaissance.