Hostile reconnaissance in a terrorist attack

Hostile reconnaissance is a crucial part of a terrorist attack, nearly always preceding it. 

Define hostile reconnaissance in a terrorist attack

There are many hostile actors that wish organisations harm. For example, criminals, activists and terrorists all present a threat. They may attack an organisation online, in person or both.

Hostile actors that attack in person first need to locate an organisation’s assets. This involves desktop research, normally through Google Maps. Thereafter, they will need to identify any weaknesses in their target’s security measures. Therefore, they will perform ‘in the field’ research and visit their targets. This visit is the definition of hostile reconnaissance. It nearly always precedes a terrorist attack.

Can we predict hostile reconnaissance?

Simon Riley, UK government’s subject matter expert on hostile reconnaissance believes ‘ If we understand that a venue/person/event is potentially vulnerable to hostile activity, then it is possible to both identify with high certainty where this activity will take place and actually predict the event” City Security Magazine Spring 2024. Unfortunately, it’s extremely difficult to have any useful certainty around where and when hostile reconnaissance will happen.

Manchester Arena Bombing

In May 2017 a bomb exploded at the Ariana Grande concert, Manchester Arena, UK. It killed 22 people.

The Manchester Arena Inquiry found the bomber got access to the concert venue and hid in an area not covered by CCTV. “Lives could have been saved had ‘pre-egress’ security checks carried out.” Security experts said the attacker “would likely have been spotted and reported to the Arena control room had the… patrols covered the area in their pre-egress checks.”

If the patrol guard spoke to the bomber and identified him as a hostile actor the area doors could have been shut. As a result, if there was an explosion many lives would have been saved.

The Manchester Arena bombing shows how the disruption of hostile reconnaissance could impact a terrorist attack. Because even if we can’t stop an attack, we may lessen its impact. Therefore, it’s important to consider how to deter, detect and deny hostile reconnaissance.

Deter, detect and deny hostile reconnaissance

Security teams should aim to deter, detect and deny hostile reconnaissance. For example, a security patrol should:

1. Deter hostile reconnaissance by being visible (wear high visibility clothes), alert, and vigilant.

2. Detect hostile reconnaissance if it spots suspicious:

• Technology on or near site. For example, drones or remote control cameras.
• People who watch, listen and record site security. For example, hostile actors may sit in a local cafe and take pictures or videos.

A person who undertakes hostile reconnaissance is likely to feel anxious. As a result, their body language will provide ‘tells’, signs of their state of mind. (Further guidance on how to spot hostile reconnaissance is available here.)

3. Deny hostile reconnaissance if they speak with suspicious actors and challenge their intentions. This can be enough to disrupt an attack. Because the hostile actor will fear they are identified and therefore target elsewhere.

Share suspicions

If a security patrol denies an attack it does not mean the attack will not take place elsewhere. Therefore, it is important security teams report suspicions to the security services and technology can help with that.

Counter terrorism technology and hostile reconnaissance

Counter terrorism technology helps security teams identify and report hostile reconnaissance, something Martyn’s Law is likely to encourage.

Martyn’s Law and hostile reconnaissance

Martyn’s Law is a UK bill to improve the safety and security at public venues. It’s a response to a number of terrorist incidents in public spaces, in particular the Manchester Arena bombing. Moreover, it forms part of the UK government’s larger counter terrorism strategy.

The bill is not expected to pass into law until 2025.

There is some uncertainty about what are Martyn’s Law’s likely requirements. However, many believe it will mean eligible organisations regardless of size, should spot and report hostile reconnaissance. Therefore, the adoption of counter terrorism technology is likely.

Conclusion: Hostile reconnaissance in a terrorist attack

Although hostile actors may use different means to enact an attack (from self-initiated to drones), hostile reconnaissance is an ever present part of attack planning; it may be undertaken frequently, over long periods of time and at numerous locations. Therefore, it’s important organisations play their role to detect, deter and deny hostile reconnaissance.

Further resources:

• National Protective Security Authority has a number of hostile reconnaissance articles.
• Protect UK has one hostile reconnaissance article.