Hostile reconnaissance in a terrorist attack
Hostile reconnaissance is a crucial part of a terrorist attack, nearly always preceding it.
Define hostile reconnaissance in a terrorist attack
There are many hostile actors that wish organisations harm. For example, criminals, activists and terrorists all present a threat. They may attack an organisation online, in person or both.
Hostile actors that attack in person first need to locate an organisation’s assets. This involves desktop research, normally through Google Maps. Thereafter, they will need to identify any weaknesses in their target’s security measures. Therefore, they will perform ‘in the field’ research and visit their targets. This visit is the definition of hostile reconnaissance. It nearly always precedes a terrorist attack.
Can we predict hostile reconnaissance?
Simon Riley, UK government’s subject matter expert on hostile reconnaissance believes ‘ If we understand that a venue/person/event is potentially vulnerable to hostile activity, then it is possible to both identify with high certainty where this activity will take place and actually predict the event” City Security Magazine Spring 2024. Unfortunately, it’s extremely difficult to have any useful certainty around where and when hostile reconnaissance will happen.
Manchester Arena Bombing
In May 2017 a bomb exploded at the Ariana Grande concert, Manchester Arena, UK. It killed 22 people.
The Manchester Arena Inquiry found the bomber got access to the concert venue and hid in an area not covered by CCTV. “Lives could have been saved had ‘pre-egress’ security checks carried out.” Security experts said the attacker “would likely have been spotted and reported to the Arena control room had the… patrols covered the area in their pre-egress checks.”
If the patrol guard spoke to the bomber and identified him as a hostile actor the area doors could have been shut. As a result, if there was an explosion many lives would have been saved.
The Manchester Arena bombing shows how the disruption of hostile reconnaissance could impact a terrorist attack. Because even if we can’t stop an attack, we may lessen its impact. Therefore, it’s important to consider how to deter, detect and deny hostile reconnaissance.
Deter, detect and deny hostile reconnaissance
Security teams should aim to deter, detect and deny hostile reconnaissance. For example, a security patrol should:
1. Deter hostile reconnaissance by being visible (wear high visibility clothes), alert, and vigilant.
2. Detect hostile reconnaissance if it spots suspicious:
- Technology on or near site. For example, drones or remote control cameras.
- People who watch, listen and record site security. For example, hostile actors may sit in a local cafe and take pictures or videos.
A person who undertakes hostile reconnaissance is likely to feel anxious. As a result, their body language will provide ‘tells’, signs of their state of mind. (Further guidance on how to spot hostile reconnaissance is available here.)
3. Deny hostile reconnaissance if they speak with suspicious actors and challenge their intentions. This can be enough to disrupt an attack. Because the hostile actor will fear they are identified and therefore target elsewhere.
Share suspicions
If a security patrol denies an attack it does not mean the attack will not take place elsewhere. Therefore, it is important security teams report suspicions to the security services and technology can help with that.
Counter terrorism technology and hostile reconnaissance
Counter terrorism technology helps security teams identify and report hostile reconnaissance, something Martyn’s Law is likely to encourage.
![Approaching hostile reconnaissance - Remember In a public space the law does not allow a security guard to stop the individual from their current activity. But, the individual is under no obligation to answer your questions. You may make inquiries and record your findings. Police officers have the right to stop and search members of the public if they believe they are in possession of items that might be used to commit a crime. Next Steps You are encouraged to engage with the individual. If they are hostile they may recognise they have been identified and stop their activity or choose another target. Therefore, you are encouraged to engage with anyone you suspect of hostile reconnaissance. Approach the individual Smile and Introduce yourself, say something like: "Good morning / afternoon, my name is [first name], I’m a Security Officer working for [name of organization]" Ask about the individual’s purpose "Do you mind my asking why you are videoing / photographing / sketching / noting our premises?"](data:image/svg+xml;nitro-empty-id=NDMzOjI1NzU=-1;base64,PHN2ZyB2aWV3Qm94PSIwIDAgMTA4MCAyMjIwIiB3aWR0aD0iMTA4MCIgaGVpZ2h0PSIyMjIwIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg== "Screenshot_20201230-160104_SIRV")
Martyn’s Law and hostile reconnaissance
Martyn’s Law is a UK bill to improve the safety and security at public venues. It’s a response to a number of terrorist incidents in public spaces, in particular the Manchester Arena bombing. Moreover, it forms part of the UK government’s larger counter terrorism strategy.
The bill is not expected to pass into law until 2025.
There is some uncertainty about what are Martyn’s Law’s likely requirements. However, many believe it will mean eligible organisations regardless of size, should spot and report hostile reconnaissance. Therefore, the adoption of counter terrorism technology is likely.
Conclusion: Hostile reconnaissance in a terrorist attack
Although hostile actors may use different means to enact an attack (from self-initiated to drones), hostile reconnaissance is an ever present part of attack planning; it may be undertaken frequently, over long periods of time and at numerous locations. Therefore, it’s important organisations play their role to detect, deter and deny hostile reconnaissance.
Further resources:
- National Protective Security Authority has a number of hostile reconnaissance articles.
- Protect UK has one hostile reconnaissance article.
