ANALYTICAL SUMMARIES – SECURITY INFO BY SGM-R YODA

Collection of info on risks to locations, entities, and events.

Coming soon – Info papers on security of religious or faith based entities, schools, and shopping centers/malls.

SECURITY IN DEPTH (SID), LLC

ANALYTICAL SUMMARY OF THREAT

2025 LOUISIANA MARDI GRAS

Beginning on January 6, 2025, and running through March 4, 2025, thousands of people are anticipated to attend the 200+ Mardi Gras parades and celebrations. In addition, there will be many Mardi Gras Balls attended by hundreds of people.

Many of the large parades are held in New Orleans but other locales also have substantial attendance. Increased threat atmosphere is due to the New Year’s Day terrorist attack on Bourbon Street that left 14 dead and dozens injured. While a federal investigation is ongoing, questions remain about failed safety measures and several big events that are coming up for New Orleans. Early on Jan. 1, an attacker drove a rented truck down Bourbon Street, plowing through crowds. After crashing the truck, the attacker opened fire, wounding two police officers before being killed himself.

There are a few things you should know about the New Year’s Day attack. All 14 of the victims who were killed in the attack have been identified through the Orleans Parish Coroner’s Office or media reports. The FBI first said it was not terror before they said it was (which is normal for FBI since when they say it is they must take charge) but for those of us who recognize the Islamist tactics we knew it was. It was emblematic of their teachings; Vehicle ramming for maximum casualties followed by firearms or bladed weapons attacks with no escape intent. The ISIS flag was indicative of those who support the killing of all non-believers. Another New Year’s Day attack in Las Vegas is being investigated, but authorities believe the two cases are unrelated.

The New Orleans terror attack is a prime example of weak perimeter security with a lull in defensive posture that supports a belief that you cannot always prevent the attack. Maybe not but you can always have obstacles that stop or delay certain attack tactics that will allow for a response force to get in place. It’s an adage that states if an area is so secure that no one can get in then you can’t get out. Security in the defense efforts must address the various types of attack tactics and rank your defense elements accordingly. The system intended to protect pedestrians from vehicles on Bourbon Street has come under scrutiny in the wake of the attack. The bollard system was inoperable at the time of the attack. Jabbar drove over a mechanical wedge designed to stop traffic — but it wasn’t deployed —and around an NOPD cruiser parked at the intersection of Bourbon and Canal streets. NOPD Superintendent Anne Kirkpatrick acknowledged that Jabbar thwarted the city’s safety plans during a New Year’s Day press conference. New bollards planned for Bourbon Street are not designed to stop the type of truck attacks that have hit cities around the world. Cantrell announced that Mardi Gras will receive a level one Special Event Assessment Rating (SEAR), the highest potential threat rating the government can assign, after a meeting with President Joe Biden. The designation allows for higher security planning measures. The Super Bowl, scheduled for early February, was already classified as SEAR 1, as it is every year.

There are other issues that may affect radicalized individuals to act: the Israeli fight against the Iranian terror groups; deportations on illegal immigrants; and the Russian/Ukraine war.

There is a lot of discussion regarding the release of Hamas hostages and the ceasefire agreement between Israel and Hezbollah. Israel may have adopted an Islamic tactic Hudna where the pause allows for rearming, resupplying, and concentration on other fronts and never intended to stop attacking once prepared. A Hudna throughout Muslim history is defined as a truce meant to produce a period to gain concessions and allows time to regroup, rearm, and attack again at a choosing of their time. Any ceasefire now will likely be only a tactical maneuver and will not be honored.

One of the top issues today is that of deportations on illegal immigrants (they are not “migrants” as some have semantically tried to call them) and many local and state communities cannot even enforce traffic laws much less the larger ones because they never learned that the big is in the little. Deterrence is accomplished through establishing a real or perceived belief that those committing crimes will be caught and punished. Of course, we know that most everyone “does what they know” and there are little deterrent effects in LE today as political leaders only give lip service to address problems. Fears over President-elect Trump’s plan to declare a state of emergency at the border and make use of the military as part of a mass deportation plan have been overblown. It started after Trump confirmed that he is “prepared to declare a national emergency and will use military assets to reverse the Biden invasion through a mass deportation program.” Such plans have been rumored for much of Trump’s campaign, raising fears among some critics that a future Trump administration would deploy the military onto American streets. This fear mongering from the Left and their media don’t say that in any declared emergency the military is to play a support role and will most likely provide logistics support to the U.S. Immigrations and Customs Enforcement (ICE) and U.S. Customs and Border Protection (CBP). Posse Comitatus does not allow federal troops to do arresting sweeps of neighborhoods, but it is believed that there are going to be targeted arrests going after criminals (not just the crime of illegal entry). However, given that illegal immigrants committed a crime and many who were supposed to have already appeared for adjudication but did not may have put themselves into an indefensible position. A large majority of Americans support mass deportations. It appears that many of the Federal agencies who are responsible for citizen safety have been frivolous with the truth. The total number of immigrant noncitizens in the U.S. who have murder convictions is likely “tens of thousands” more than the 13,400 listed on Immigration and Customs Enforcement’s (ICE) national docket, given the criminal records of border-hoppers in their native countries are not baked into the data, a data expert has reported. The bombshell figures released last week via ICE’s national docket show that 277 noncitizens are currently being held by ICE, while 13,099 noncitizens are on the non-detained docket with homicide convictions. ICE’s non-detained docket includes noncitizens who have final orders of removal or are going through removal proceedings but are not detained in ICE custody. Of the 13,099 convicted murderers not being detained by ICE, it is unclear how many are incarcerated by federal, state or local law enforcement, or roaming the streets. There are an additional 1,845 on the non-detained docket with pending homicide charges. In total, 662,566 noncitizens with criminal histories are on ICE’s national docket, which stretches back decades. The figures underline the serious threat illegal immigration and not vetting immigrants thoroughly poses to law-abiding people living in the U.S. The figures sparked an outcry from border security advocates. Sean Kennedy, who specializes in law enforcement and crime data analysis, said the numbers of noncitizens in the U.S. who have murder convictions — as well as convictions for other crimes like assault and rape — is much higher than the 13,376 on ICE’s detained and non-detained dockets because those convictions only apply to crimes committed in the U.S. and not murders committed in migrants’ home countries. Very few of the immigrants who crossed the border who have criminal records will ever be properly vetted.

This is a dangerous time, and we must remain vigilant for threats nationally and internationally. Open-source information and some of the public messages may be mis- and/or dis-. We will see as we go but we must continue to know ourselves and know our enemies, both foreign and domestic within the present dynamic environment. It is estimated the there are hundreds of our enemies’ operatives already in the Homeland due to the weak immigration stance of the Biden administration and it is important to remember that our enemies will join forces to accomplish common objectives. Most see that the Jihad desire to destroy Israel is a root cause of the Iranian and their Islamic puppets drive to kill Jews and Infidels. For this reason, Trump’s history of strong support for Israel coupled with his beliefs the war in Gaza should end quickly may lead to all-out war between Israel and Iran, et al, before a stoppage of fighting is declared. Barring the achievement of elusive cease-fires before the inauguration, Trump will ascend to the highest office in the country as Hamas and Hezbollah fighting continues as well as conflicts with Iranian proxies in Iraq and Yemen — and Iran’s nuclear program remains a top concern for Israel. It is of importance that we remember that Iran has been trying to assassinate Trump and others for years. Also, Tehran had reportedly interfered in the U.S. election. Don’t forget Israel launched the war in response to Hamas’ attacks that killed 1,200 people in Israel and kidnapped 250, and dozens are still held captive. In addition, a ceasefire, or Hudna, favors the Islamists since throughout Muslim history their definition is that it is a truce meant to produce a period to gain concessions and allows time to regroup, rearm, and attack again at a choosing of their time. Any ceasefire now will likely be only a tactical maneuver and will not be honored.

It appears that many of the Federal agencies who are responsible for citizen safety have been frivolous with the truth. The total number of immigrant noncitizens in the U.S. who have murder convictions is likely “tens of thousands” more than the 13,400 listed on Immigration and Customs Enforcement’s (ICE) national docket, given the criminal records of border-hoppers in their native countries are not baked into the data, a data expert has reported. The bombshell figures released last week via ICE’s national docket show that 277 noncitizens are currently being held by ICE, while 13,099 noncitizens are on the non-detained docket with homicide convictions. ICE’s non-detained docket includes noncitizens who have final orders of removal or are going through removal proceedings but are not detained in ICE custody. Of the 13,099 convicted murderers not being detained by ICE, it is unclear how many are incarcerated by federal, state or local law enforcement, or roaming the streets. There are an additional 1,845 on the non-detained docket with pending homicide charges. In total, 662,566 noncitizens with criminal histories are on ICE’s national docket, which stretches back decades. The figures underline the serious threat illegal immigration and not vetting immigrants thoroughly poses to law-abiding people living in the U.S. The figures sparked an outcry from border security advocates. Sean Kennedy, who specializes in law enforcement and crime data analysis, said the numbers of noncitizens in the U.S. who have murder convictions — as well as convictions for other crimes like assault and rape — is much higher than the 13,376 on ICE’s detained and non-detained dockets because those convictions only apply to crimes committed in the U.S. and not murders committed in migrants’ home countries. Very few of the migrants who crossed the border who have criminal records will ever be properly vetted. Of course, we know that most everyone “does what they know” and there are little deterrent effects in LE today and political leaders only give lip service to address to the problem. A Colorado management company has shared brutal surveillance footage and a photo of a bloodied employee to illustrate its ongoing problem with a violent Venezuelan migrant gang. Members of Tren de Aragua commandeered entire apartment buildings in Aurora by threatening its employees and tried to extort the company for a cut of rent money in exchange for their continued operation of the properties. An employee found a group of male squatters in a recently vacated apartment and would not accept $500 to “overlook the situation” and was beaten so severely that he had to be treated at a hospital. One of the more recent cases is the Georgia case of Laken Riley would many believe be alive today if the Biden-Harris Administration had stronger border security and interior immigration enforcement policies in place. It is said that the present Biden/Harris administration willfully, recklessly, and unlawfully allowed poorly vetted individuals, including Laken Riley’s accused murderer, to unleash havoc on American families nationwide. They have paroled hundreds of thousands of poorly vetted individuals into communities across our country, and they could end their dangerous, unprecedented abuse of immigration parole today if they wanted to. They suspended deportations, halted construction of the border wall, and announced a plan to give amnesty to millions. That made it crystal clear from the start of their tenure that their goal was mass migration – not the safety and security of the American people. The historic crisis at the southern border saw millions of illegal immigrants arrive there, with a great many eventually released into the United States as officials struggled to deal with the numbers they were facing. It is unusual that very little is said about the number of known and possible radicalized Muslims that were also part of the illegal immigrant flood. These are not migrants but illegal immigrants that are documented and undocumented that are now among us. Just as European countries are finding out, Islam teaches the destruction of the infidel. It is important to realize that many of the “migrant” caravans to the U.S. gathered in Chiapas, Mexico, which is known to be a hotbed of Islamic radicalism. It is believed by many experts that all of this is part of the axis of China, Russia, North Korea, and Iran to lay the groundwork to cause economic problems for the Homeland and to set the stage for future attacks.

At present, there are not aware of any threats specific from international or domestic terrorist groups and knows of no group or individual in the state who possess the motivation, plans, or capability to target such venues. However, as we experienced, the anonymity of individual surveillance and operational planning that requires little preparation can easily complicate law enforcement efforts to disrupt a lone offender attack. Because of enhanced security measures at the event site, terrorist plots could focus more on associated “softer” venues such as the surrounding hotels, parking lot gatherings, and restaurants. Considering all these things, as well as recent events throughout the world, it is assessed that an attack with small arms, bladed weapons, improvised explosive devices, and vehicles to be the greatest threat scenarios to Mardi Gras events. As we have seen around the world, and now locally, when large crowds gather on the streets bad actors with deadly intent can use vehicles as a cheap and accessible means to inflict great damage with little effort.

This Analytical Summary is prepared to inform and assist security planners and law enforcement personnel in the monitoring of threat information and maintaining a safe and secure environment. Special events, large and small, always present high consequences and vulnerabilities. Assessment of the current terrorist threat to the United States is derived from extensive study and understanding of terrorists and terrorist organizations and is frequently dependent on analysis of classified information. Analysis of current adversary intent and capability and analysis of terrorists’ deeply rooted nature of their goals and motivations help identify domestic critical infrastructure (CI) and special events that are potentially prime targets for an attack. Another important aspect is the long-standing threat posed by insiders, or people who have access to sensitive information and facilities. Insider threats can result from intentional actions, such as infiltration of the organization by terrorists, or unintentional actions, such as employees who are exploited or unknowingly manipulated to provide access to, or information about the event venues. Insiders can intentionally compromise the security through espionage, sabotage, or other harmful acts motivated by real or perceived rewards offered to them by a terrorist or other party.

SID, LLC will work with all prevention efforts to place another eye on security plans and make suggestions for improvements for security in the defense.

EXECUTIVE SUMMARY

SID, LLC has no information to indicate a specific, credible threat to or associated with upcoming holiday celebrations throughout Louisiana. Currently, the overall international terrorist threat in the U.S. should be considered medium to high due to the high event population and being in the vicinity of CIKR designated as targeted infrastructure. Security efforts should address evolving terrorist tactics or the likelihood of terrorist attacks will increase and, through simple mathematical probability, future terrorist attacks may be successful. Historically, more than 95% of thwarted terror attacks have been the result of someone reporting something suspicious.

All special events where large crowds attend, e.g., concert venues and music festivals, remain an attractive target for foreign terrorist organizations and homegrown violent extremists (HVEs). These type venues have been attacked in the past and they are particularly attractive to terrorist due to the density of potential victims and the potential for stampede injuries as victims attempt to flee the incident site. Large pedestrian gatherings remain attractive targets for extremists who wish to conduct mass-casualty operations, and recent extremist propaganda releases by Iranian groups, al-Qa’ida, and the Islamic State have provided detailed instructional guidance on a range of lethal tactics that can be used against crowds. An Islamic State statement claiming continuation of attacks on “rejectionists” or “refusal infidels,” shows that the Sunni terrorists view Christians as infidels. Not be left out, Al-Qa’ida’s as-Sahab Media Foundation in an Arabic-language bulletin entitled “A Third 9/11,” argued that the U.S. did not learn the “lesson” from the 9/11 attacks or the Hamas-led 7 October assault on Israel (“the second 9/11”). The propaganda communique then pledged that another operation of similar scale was coming as revenge for U.S. support of Israel. Most suggested tactics include those that require little planning, preparation, or pre-operational training but terrorist tactics against special events generally will require some level of preoperational planning and recent plots/attacks indicate terrorists retain some interest in target symbolism. Threat warnings and protests may over tax local LE that have to focus on protest incidents and threats as well as produce threat warning fatigue. It is suggested by many experts that we are in need of a ready reserve to respond in order to be diligent to investigate online threats, concerning comments, and ties to radical organizations.

In many past attacks, an assailant’s use of cameras and strategic shooting location indicates research on tactics and targeting methods prior to the attack. In the past, HVEs who have received weapons training and/or have conducted research on a range of tactics and targeting methods have carried out attacks with high casualty counts. Trained or experienced operators are likely more adept both at drawing in security personnel and rapidly adapting to situations as they unfold, which likely increases the number of civilian and law enforcement casualties in active shooter attacks.

Attackers may seek elevated positions to fire on targets and responding law enforcement personnel as it is well known to present a tactical advantage since it necessitates that responders be aware of protective cover and consider the risk of open exposed locations.

Information sharing and prompt reporting of suspicious behavior indicators between the public, private-sector security personnel, and law enforcement are vital to the deterrence, detection, and disruption of terrorist activity and the prevention of attacks. Some special events may produce a condensed preoperational planning cycle that can make them difficult to detect along with the fact that there are numerous other distractions. In addition, these events have numerous law enforcement and military officials present that are targets of international or domestic terrorists and HVEs. In recent attacks the tactics differ and illustrate the complex challenge of securing public spaces. Before 9/11 we had not really considered that someone would hijack a plane of passengers to crash into a target and now we know we must address security at a distance beyond our normal “outer perimeter.” Recent attacks provide security planners with new and key concerns because increasing physical security displaces rather than fully alleviating vulnerabilities and requires that peripheral awareness must be at a high level. Public vigilance and awareness campaigns such as the “If you see something, say something” initiative play an important role in identifying suspicious behavior, as well as in identifying unattended packages, bags, and other items which could be used in terrorist attacks to conceal weapons or explosive devices.

In the annexes below many issues for planning are discussed in more detail:

ANNEX A: SUSPICIOUS ACTIVITY REPORTS (SAR) AND CLUES

ANNEX B: TERRORISM THREATS

ANNEX C: INDICATORS, VULNERABILITIES, and PROTECTIVE MEASURES

ANNEX D: TERRORISM PLANNING CYCLE

ANNEX E: THREATS TO HOMELAND CONSISTENT WITH OTHER CALLS TO ARMS

ANNEX F: SCENARIOS OF CONCERN

ANNEX G: HAZARDOUS MATERIAL

ANNEX H: INTELLIGENCE GAPS

ANNEX I: ROOFTOP SECURITY and DISPLACEMENT

ANNEX J: SPECIAL EVENTS WORKING AID

ANNEX K: SECURITY IN THE DEFENSE

KEY FINDINGS

Everyone remains concerned that the perceived symbolic nature of conducting an attack during upcoming holiday celebrations is of interest to international terrorists or homegrown violent extremists (HVEs). All should continue to monitor threats with an unspecified attack date emanating from any foreign terrorist organizations (FTOs)—particularly individuals associated with or inspired by the Islamic State in the event that these groups advance their plotting efforts in the near-term to coincide with the holidays. HVEs continue to pose the most significant near-term threat to the Homeland.

In the latest National Terrorism Advisory System (NTAS) bulletin the Department of Homeland Security (DHS) highlights the continuing terror threat to the U.S. Homeland. Foreign terrorist organizations exploit the Internet to inspire, enable, or direct individuals already here in the homeland to commit terrorist acts. Homegrown terror suspects increasingly rely on technology, such as end-to-end encrypted social media applications, to avoid detection. Terrorist groups are urging recruits to adopt easy-to-use tools to target public places and events. Specific attack tactics have included the use of vehicle ramming, to include the use of rental vehicles, small arms, straight-edged blades or knives, homemade explosives, and poisons or toxins. Some terrorist groups overseas are using battlefield experiences to pursue new technologies and tactics, such as unmanned aerial systems and chemical agents that could be used outside the conflict zones. Violent extremist media encourages individuals worldwide to launch attacks using all means possible. Prevention success relies on suspicious activity reporting and networking/collaboration between Law Enforcement (LE), Intelligence, and Homeland Security. Historically, a majority of thwarted terror attacks have been the result of someone reporting something suspicious.

All special events where large crowds attend, e.g., concert venues and music festivals, remain attractive targets for foreign terrorist organizations and homegrown violent extremists (HVEs) always presents high consequences and vulnerabilities. An assessment is the first step to assist security planners and law enforcement personnel in planning for and maintaining a safe and secure environment by identifying reducible vulnerabilities through the use of plausible threat scenarios.

With a bottom-line up front approach, protective services security for the events during this period should focus on the vulnerable locations that include – transit routes, lodging, dining, and event inner and outer perimeter areas. Events held at known targeted infrastructure remain attractive targets for international or domestic terrorists, or homegrown violent extremists (HVEs) due to crowd density and media coverage of special events. Terrorist groups continue to urge recruits to adopt easy-to-use tools to target public places and events. Specific attack tactics have included the use of vehicle ramming, small arms, straight-edged blades or knives, homemade explosives, and poisons or toxins. Recent extremist attacks OCONUS (outside the continental U.S.) indicate the message is being received. The demonstrated ability of ISIS to motivate aspirational violent extremists through social media, increases the likelihood of additional attacks by Western and U.S.-based Islamic supporters using simple methods of attack such as small arms or edged weapons with little or no warning. Trends in violent extremism reflect the inherent challenges of disrupting individuals or small cells that mobilize over a very short period of time and attack “soft targets” using easily attainable tactics.

Some events may produce a condensed preoperational planning cycle that can make detection difficult. In addition, while these events have numerous Law Enforcement Officers (LEO) present, threats to and the targeting of law enforcement by international or domestic terrorists and HVEs remain a persistent concern. Also, in recent attacks the tactics differ and illustrate the complex challenge of securing public spaces since the attacks provide security planners with new and key concerns because increasing physical security sometimes displaces rather than fully alleviates vulnerabilities and requires that peripheral awareness be at a high level.

Assessment of the current terrorist threat includes the important aspect of the long-standing threat posed by insiders, or persons who have access to sensitive information and facilities. Insider threats can result from intentional actions, such as infiltration of the organization by terrorists, or unintentional actions, such as employees who are exploited or unknowingly manipulated to provide access to, or information about the event venues. Insiders can intentionally compromise security through espionage, sabotage, or other harmful acts motivated by real or perceived rewards offered to them by a terrorist or other party. In addition, there is no indication of a specific threat from domestic terrorist groups. Domestic terrorists fall into three general categories:

Single Issue /Special Interest Groups (Animal Liberation Front/Earth Liberation Front).
Right-Wing Groups (White Supremacist/Religious Based).
Left-Wing Groups (Anarchists).

It is important to remember that simple attack methods, including use of firearms, edged weapons and vehicle rammings, are the most commonly used by extremists and others intent to do harm. Of course, attacks using IEDs, methods unique to the vulnerabilities of the attack location, or a combination of methods are also possible. Incidents and plots highlighting several recent attack methods are provided below to demonstrate the way different methods have been used since 2020.

SECURITY ISSUES and LOCATIONS OF INTEREST

There are many issues in the forefront and many soft target locations due to the numerous manufacturing, storing, or transporting through the state of hazardous materials, accidental or intentional.

In addition to the numerous event venues on the calendar, shopping centers/malls and houses of worship remain extremely vulnerable soft targets. There are thousands shopping malls in U.S. and there are hundreds in Louisiana. The risk, with its associated high vulnerabilities, unknown threats, and high consequences, of an attack on a large mall by homegrown violent extremists (HVEs) is extremely high. Active shooters often choose to target religious locations/houses of worship during peak times and may make use of a wide range of tactics and weapons in attacks. Some events may produce a condensed preoperational planning cycle and have numerous Law Enforcement Officers (LEO) present, we should remember that threats to and the targeting of law enforcement by international or domestic terrorists and HVEs remain a persistent concern that could impact venues. Recent attack tactics differ and illustrate the complex challenge of securing public spaces since the attacks provide security planners with new and key concerns because increasing physical security sometimes displaces rather than fully alleviates vulnerabilities and requires a higher level of peripheral awareness. Despite increased protective deployments, entry control measures, and expanded perimeters around areas with a large security presence, law enforcement and security personnel remain vulnerable at the security perimeter. Attackers, understanding where the security perimeter begins, strike just outside where congestion creates predictable crowds and security is less extensive, and also allow attackers to use high vantage points that conceal a shooters’ location from law enforcement, delayed emergency response times, and caused confusion as to the direction of the threat. The “displacement of vulnerabilities” issue relocates a security weakness from one place, time, target, offense, or tactic to another because of some prevention initiative. The most common is when increased security and expanded perimeters create new bottlenecks where crowds wait to clear security.

Elevated tactical positions or “rooftops” provide a potential violent individual with an unobstructed view of a possible target area. The need for peripheral awareness is important to the security effort and the entire perimeter, including “rooftops” and areas that require access control. The goals of any perimeter patrol or reconnaissance is to provide early warnings, report suspicious activities, identifying any possible adversarial observations, and gathering information on any suspicious persons in the area. Overwatch, strategic, tactical, and operational planning and preparation is critical to prevention.

In a present-day technical expansion of the elevated tactical position theory, it is well documented that terrorists want to use drones as new avenue of approach and a force multiplier. They can be used to recon areas, drop explosives on large crowds, or deliver spyware remotely. Counterterror officials think Islamists could launch a multi-drone attack carrying several bombs and even using airborne cameras to film the bloody carnage below for twisted propaganda videos. Some believe that ISIS has already tested how much plastic explosive the flying machines can carry, going as far as experimenting with detonation devices. We have always considered the possibility that drones could be hacked, infected with some kind of spyware, and controlled by an enemy power but now it seems that work is being done on giving drones the ability to deliver spyware remotely instead. We should expand on using drones to aid in security in the defense and the need for response tactics to effectively neutralize illegal drone use.

Criminals and violent extremists can also use fireworks to construct improvised explosive devices by removing the black powder from the devices. First responders may encounter fireworks, including those that are illegal, prior to and during celebrations. Furthermore, first responders may respond to emergencies that could yield other illegal or precursor activity. Law Enforcement Officers should visit the wholesale and retail distributors in their area (see lists of distributors that have permits from Louisiana State Fire Marshal) and ask vendors to report suspicious purchases/questions/comments.

In the planning effort the Circles of Prevention were developed from previous incident intelligence and information and strategic and tactical suggestions from personal defense theory. The Circles consists of Areas Physical Security Systems, i.e., Interior – intrusion alarms, panic/duress alarms, video surveillance; Building Perimeter – access control, video surveillance, lighting; Venue Perimeter – fence or other boundary, video surveillance, lighting; and Outer Perimeter – reference points of visible locations within the maximum effective range of possible weapons or explosives and includes all security displacement areas. Particularly the Outer Perimeters that extend to the maximum effective range of possible weapons including locations that provide concealment and/or cover to an attacker.

SCENARIOS OF CONCERN

Firearm attacks remain the most likely and potentially severe attack scenario in most countries. Semi-automatic firearms are likely to remain the most popular weapons, given their low cost, lethality and relative ease of acquisition in many jurisdictions. Firearms are conducive to active shooters with doomed hostage attack methods and the most telling statistic in mass fatalities is that the shooter is to only one with a weapon. Public gatherings can be soft targets for vehicle ramming incidents. Violent extremist messaging by FTOs repeatedly encourages attacks focused on targeting large crowds in the West using “all available means.” Their tactics focus on inflicting the greatest number of casualties and highlight the prospect of widespread media attention at notable holiday-related events. Bomb attacks, including vehicle and suicide attacks, remain common in current or post-conflict jurisdictions with active jihadist groups, particularly in the Middle East and sub-Saharan Africa. Malicious actors behind mass casualty events primarily focus on soft targets, such as sporting events, music venues, shopping and entertainment districts, and mass transportation systems. However, terrorists also previously demonstrated the intent to attack locations with hardened security measures.

Scenarios using hazardous materials or toxic industrial chemicals is of particular interest. Most events are near normal routes for Hazardous Material (HM) carriers. This could set the stage for accidental or intentional release of a hazardous material into the area while crowds are still present. Terrorists have been known to use these Toxic Industrial Chemicals (TICs) as weapons. Security planners should take these routes into account by examining the wind direction on event days and planning for any possible accidental or intentional releases.

NOTE: In Annex G there is a section with reverse pluming to aid in the prevention and response planning any event area. Security planners should area routes into account by examining the wind direction on event day and planning for any possible accidental or intentional releases. Upwind Areas of Concern: It is always a concern that a release of chemical, biological, or radiological materials/substances, from locations miles away, could target event attendees. As a result, the event’s forecasted weather can be modeled to identify areas where such a release could originate to be effective.

NOTE: Many cities have normal routes for Hazardous Material (HM) carriers. Prior to event time, HM traffic needs to be diverted from avenues that pass near the event to an alternate downwind route. Of concern are instances when event, and the resulting after- event traffic, runs later than anticipated and, as a result, the traffic control points are relocated to facilitate egress. Due to the extended time and resulting relocation of traffic control points, HM traffic can enter the associated area if not closely monitored. This could set the stage for accidental or intentional release of a hazardous material into the area while crowds are still present.

OTHER POTENTIAL ISSUES OF CONCERN

Many other issues may arise and need to be addressed in planning.

• DRONES/UAS: The increased popularity and availability of UAS, commonly known as drones, among hobbyists for recreation has made it more difficult to determine whether their usage is legitimate or nefarious in nature. The unauthorized use of UAS continues to pose a challenge for security at partially covered or open-air venues. In their publications, FTOs encouraged using UAS in attacks for various reasons. UAS can be remotely controlled outside a target venue, allowing the operator to bypass security measures. Additional factors include their small size, relative ease of operation, capacity to accommodate payloads, ability to capture high-resolution images and video, and moderate degree of anonymity. Unauthorized UAS have been encountered despite established flight restrictions, due to their proximity to local airports.

• Security Breaches and Insider Threats: Security breaches facilitated by stolen or counterfeit credentials, or by individuals with legitimate access to the facility, pose a tactic which terrorists could use to facilitate attack scenarios. Terrorists affiliated with al-Qaida, ISIS, Taliban in Afghanistan, the Tehrik-e Taliban Pakistan, Hamas, Hezbollah, and other groups, have impersonated officials and used stolen or cloned official vehicles in conducting attacks overseas. This tactic provides terrorists access to restricted areas or closer proximity to targets without raising suspicions.

• Protests or Disruptions: Remain aware of planned disruptions or protests scheduled to occur during this period.

• Displacement of Vulnerabilities: Crime displacement is the relocation of crime from one place, time, target, offense, or tactic to another as a result of some crime prevention initiative. “Displacement” in security is commonly referred to when increased security and expanded perimeters create new bottlenecks where crowds wait to clear security. Despite increased protective deployments, entry control measures, and expanded perimeters around areas with a large security presence, law enforcement and security personnel remain vulnerable at the security perimeter. Attackers, understanding where the security perimeter begins, strike just outside where congestion creates predictable crowds and security is less extensive. Recent examples are the attacks on a police officer on duty just outside the TSA checkpoint in Flint, Michigan, bombing on the Ariana Grande concert where the egress corridor was crowded, and shooting in Las Vegas from an elevated vantage point beyond the immediate security perimeter. Even though displacement is viewed as a negative consequence of crime prevention efforts, in some cases it can still provide some benefit. Current thinking suggests that beneficial displacement can occur when the harm produced by the displaced crime is less than what existed before the intervention. When considering how best to manage risks, less visible security outside of a perimeter and efforts to moderate crowd size may prove effective in mitigating the risk to both civilians and security personnel. In any event, the need for peripheral awareness is important to the security effort as a whole and to the individual officers.

• “ROOFTOP” SECURITY:

Fifty-two years ago on August 1, 1966, Charles Whitman climbed to the top of the University of Texas Tower observation deck with three rifles, two pistols, and a sawed-off shotgun where he shot 43 people and killed thirteen. From an elevated tactical position, former Marine Whitman introduced the nation to the idea of mass murder in a public space. With this knowledge everyone should be concerned about elevated locations that can provide a potential violent individual an unobstructed view of a possible target area. Attacks from an elevated position can provide an unobstructed view of a possible target area and provide concealment of an actor’s location, delay emergency response times, and cause confusion as to the direction of the threat. This makes the current training of what to do in an active-shooter situation, i.e., “run, hide, fight” less effective since it is difficult to determine from where the shots may be coming. Also, victims on the ground are not afforded access to adequate cover due to the shooter’s elevated position and vantage points. The Dallas Chief of Police reported on the night of the Dallas police shootings that sniper(s) fired at police officers “from elevated positions…” In Las Vegas, shots were fired from the 32nd floor of a casino hotel room. It should be remembered that snipers do not sit with their guns hanging out of a window and a long-range shot is not one block or two blocks, it’s about 8 or 9 blocks or 600 to 900 yards. “Rooftops” are the ultimate elevated perch for shooters. The shootings in Dallas and Las Vegas are prime examples from an elevated vantage points beyond the immediate security perimeter. The need for peripheral awareness is important to the security effort and the entire perimeter, including “rooftops” and areas that require access control must be defined. The goals of any perimeter patrol or reconnaissance are to provide early warnings, report suspicious activities, identifying any possible adversarial observations, and gathering information on any suspicious person in the area. Overwatch, strategic, tactical, and operational planning and preparation is critical to prevention. In the planning effort the Circles of Prevention were developed from previous incident intelligence and information and strategic and tactical suggestions from personal defense theory. The Circles consists of Areas Physical Security Systems, i.e., Interior – intrusion alarms, panic/duress alarms, video surveillance; Building Perimeter – access control, video surveillance, lighting; Venue Perimeter – fence or other boundary, video surveillance, lighting; and Outer Perimeter – reference points of visible locations within the maximum effective range of possible weapons or explosives and includes all security displacement areas.

• FIREWORKS:

Due to the upcoming celebrations with its high use of fireworks, and since the recent weapons vary, this summary is intended to inform law enforcement personnel and other first responders of the use of fireworks to construct IEDs. When law enforcement around the country have their pre-shift meetings over the next few weeks, all should be reminded that fireworks – so popular around this time of year – can be used to build bombs and ask that all make contact with the firework retailers, wholesalers, and display operators in their area to ask for information on any suspicious purchases or thefts. Incidents in the Homeland and overseas demonstrate that consumer fireworks (widely used during the upcoming celebrations) can be misused by criminals and violent extremists to construct improvised explosive devices. There is an added sense of caution around the holiday season because of the advertised use of fireworks in improvised bombs. Explosive powder from fireworks was used to construct the bombs Paris, Boston, New York, and Colorado. Two months before the Boston bombing the terrorists bought 48 mortars containing about eight pounds of low explosive powder and after the attack authorities found fireworks emptied of their explosive powder in the suspect’s college dormitory room. Even before terror group messages offered detailed bomb-making instructions to anyone with Internet access, homegrown terrorists tried to use fireworks in their plots against the U.S. homeland. In 2010, Faisal Shahzad, trained by the Pakistani Taliban, used more than 150 small fireworks in his failed attempt to blow up a Nissan Pathfinder in New York City’s Times Square. In the 2012 theater shooting by James Holmes in Colorado, authorities found fireworks components in a complex IED in his apartment.

SUSPICIOUS ACTIVITY

Due to the increased security for most current events, individuals or groups in the area are unlikely to present a significant threat to event security. In light of the increased threat environment and the uptick in violent law enforcement encounters, heightened awareness and increased operational security and force protection posture in all circumstances is recommended. Suspicious activity reporting (SAR) information underscores the role of the public and private sector in alerting law enforcement to potential terrorist activity and stay as far “left of the boom” as possible. According to an early study from Duke University’s Institute for Homeland Security Solutions, approximately 98% of initial clues regarding terrorism come from law enforcement, the general public, and intelligence reporting. This effectiveness has not subsided. Success in detection and prevention/mitigation of present day terror threats depend on reporting suspicious activity, as well as training, networking, and collaboration within the agencies that investigate suspicious activity reports and recognizing signs of international and domestic terrorist activity during the course of routine criminal investigations. In suspicious activity reporting it is important to focus on an individual’s behavior, not the individual.

The implications of terrorist planning patterns are significant. Committing an act of terrorism will usually involve local preparations. Although much of this conduct will not necessarily be criminal, early intelligence may give law enforcement the opportunity to stop the terrorists before an incident occurs. It is important to understand how long terrorists prepare for their attacks and that most terrorists think globally but act locally (almost half of all terrorists live within 30 miles of their targets). The planning cycle of terrorists is significant in that international terrorist incidents that occurred on American soil had an average planning cycle of 92 days, as opposed to 6-14 days for environmental, single-issue, and right-wing terrorists. These patterns may be used by agencies to more efficiently patrol known, high-risk target areas and gather intelligence on suspected actions within a specific distance from potential targets. In general, terrorist preparations for an attack generally begin less than six months before the attack and end with a flurry of actions a day or so before. Foreign fighters who have returned from conflict zones have the ability to leverage violent extremists in their home countries and are more likely to plot a large, complex attack than are their less-experienced counterparts. Those influenced and radicalized by Jihadist rhetoric that cannot leave the U.S. may become frustrated and act violently within the U.S. homeland. Below are some Potential Threat Indicators and further discussion can be found in Annexes.

Questioning employees off-site about security practices and procedures.
Unattended packages (e.g., backpacks, briefcases, boxes).
Possessing or attempting to acquire maps, plans, blueprints, or drawings that indicate unusual interest in a sensitive location.
Parking, standing, surveilling, or loitering in the same area over a multi-day period without reasonable explanation.
Unusual observation of security reaction drills or procedures or multiple false alarms or fictitious emergency calls to the same locations or similar venues.
Consumption and sharing media glorifying violent extremist acts in attempting to mobilize others to violence.
Praising successful or attempted extremist attacks or mass killings.

SUMMARY

The United States is engaged in a generational fight against terrorists who seek to attack the American people, the country and way of life. An informed, vigilant and engaged public remains one of our greatest assets to identify potential terrorists and prevent attacks. Law enforcement personnel should remain cognizant of attacks on venues on a worldwide scale in order to better anticipate and plan against such on the U.S. homeland. Since recent attacks and continued posturing by the various Islamic Jihadists, vigilance is a must.

Ideologically motivated lone offenders and small groups will pose the greatest threat of extremist targeted violence in 2025, particularly Iran with Palestinian groups as well as domestic violent extremists and foreign terrorist inspired homegrown violent extremists.

Unaffiliated lone offenders will continue to pose a steady threat of lethal violence due to lack of observable behaviors traditionally associated with radicalization, limiting law enforcement’s ability to detect, prevent, and disrupt attack planning.

A range of threat actors will likely continue to target law enforcement and government personnel and facilities. Demonstrated trends in attacks and threats against these sectors in recent years indicates a sustained targeting priority, likely due to perceived symbolic importance and accessibility.

It is assessed that the most likely attack methods will utilize simple weapons and focus on accessible targets. Primary weapons are most likely to be small arms, rudimentary improvised explosive devices, arson, and edged weapons; vehicle ramming is possible. It is also judged that Unmanned Aerial Systems are unlikely to be used for violent criminal activity. Cyber threats will remain persistent, and we anticipate that both nation-state actors and cybercriminals will continue to evolve their tactics and techniques over the coming year and will continue to inflict losses on individuals and organizations. Increased collaboration between law enforcement, public safety officials, private sector partners, and other community partners could partially mitigate the challenges associated with identifying individuals on a pathway to violence through earlier and more frequent reporting of behaviors or activities that may indicate preoperational planning.

All special events will remain as potential targets and counterterrorism (CT) planning should create symbiotic relationships where each part gains a tactical advantage due to the actions of the others. Our inherent vulnerabilities are generally well known but some experts believe we need to improve limiting self-created vulnerabilities, such as displacement, and eliminate information sharing that may be the results of agency politics and personal ambitions. Prevention success relies on suspicious activity reporting and networking/collaboration between Law Enforcement (LE), Intelligence, and Homeland Security. To see more information with breadth and depth on various topics see the Annex Table of Contents below.

Historically, a majority of thwarted terror attacks have been the result of someone reporting something suspicious. An important aspect of prevention is to involve the public in a Suspicious Activity Reporting system. In Louisiana Suspicious Activity Reports may be submitted by going on line to http://dpsweb.dps.louisiana.gov/suspicious.nsf/WebForm?OpenForm or by calling the 24 hour line at 1-800-434-8007. Another program that allows suspicious activity to be reported via smartphone on a free app. Go to http://www.mymobilewitness.com/consumer-services.php.

BUREN R. (Ric) MOORE, SGM(R)

SID, LLC

Cell: 225.936.0404

Buren.ric.moore@gmail.com

ANNEXES:

ANNEX A: SUSPICIOUS ACTIVITY REPORTS (SAR) AND CLUES

ANNEX B: TERRORISM THREATS

ANNEX C: INDICATORS, VULNERABILITIES, and PROTECTIVE MEASURES

ANNEX D: TERRORISM PLANNING CYCLE

ANNEX E: THREATS TO HOMELAND CONSISTENT WITH OTHER CALLS TO ARMS

ANNEX F: SCENARIOS OF CONCERN

ANNEX G: HAZARDOUS MATERIAL

ANNEX H: INTELLIGENCE GAPS

ANNEX I: ROOFTOP SECURITY and DISPLACEMENT

ANNEX J: SPECIAL EVENTS WORKING AID

ANNEX K: SECURITY IN THE DEFENSE

ANNEX L: SOURCES

ANNEX A: Suspicious Activity Reports (SAR) and Clues

More than 95% of thwarted terror attacks in the past two years have been the result on someone reporting something suspicious. Terrorists may attempt to breach secured perimeters or gain unauthorized access to facilities, sensitive locations, or restricted areas for preoperational activity or to conduct an attack. While Tamerlan and Dzhokhar Tsarnaev openly purchased hundreds of fireworks to use the black powder inside along with improvised shrapnel in the Boston Marathon attack, Timothy McVeigh breached a locked storage shed at a Kansas rock quarry with a battery-operated drill and stole explosives for use in the Oklahoma City bombing. Attempts at intrusion could take the form of trespassing, forced entry or impersonation of authorized personnel and could possibly involve the assistance of knowledgeable “insiders.”

Historically, terrorists have been known to conduct preoperational surveillance to obtain and document detailed information on prospective target sites. Terrorists may use observation in combination with other surveillance techniques, such as photography, elicitation, and note- taking to assess security measures and procedures in preparation for an attack. There have been numerous reports of suspicious photography, trespassing, breach of security and other alarming activities pertaining to venues over the past few years. While many of the activities were likely harmless by themselves, they nevertheless demonstrate potential vulnerabilities common to protecting people attending special events. Context should be carefully considered in order to rule out legitimate, non-suspicious activities. Along with the context—time, location, personal behaviors, and other indicators—all suspicious activities should be reported.

Importance of Suspicious Activity Reporting

Given the range of targets and tactics of ISIS-associated plots since last year, we encourage security, military, and law enforcement partners to remain vigilant and to report all suspicious activity. We face an increased challenge in detecting terrorist plots underway by individuals or small groups acting quickly and independently or with only tenuous ties to foreign-based terrorists. Preoperational indicators are likely to be difficult to detect; as such, state, local, tribal, territorial, and private sector partners play a critical role in identifying and reporting suspicious activities and raising the awareness of federal counterterrorism officials.

The need for vigilance and preparation on the part of all public and private sector partners in identifying indicators of a potential terrorist attack is extremely important. WARNING!! Threat warning fatigue is occurring because the public or first responders’ endeavor to maintain a constant state of vigilance and at the same time specific information on the potential timing and target of most attacks is lacking, e.g., most information is preceded by the statement that government “lacks any credible, specific information.” This may result in credible threat warnings not being heeded by the intended audience. All potential target institutions need to have communication and response protocols to aid in the further dissemination of warnings to the affected audience. As an example, the Kenyan Garissa University attackers’ knowledge of the target location emphasizes the role of the public and private sector in alerting law enforcement through suspicious activity reporting. Kenyan government warnings of terrorist threats prior to the attack lacked specificity and detail and likely left local and university security officials unsure how seriously to take the threat or what security response measures were warranted. Similar Kenyan government threat advisories over the last several years, many of which did not result in actual attacks may have created “warning fatigue” among both officials and the populace. In the aftermath of this incident there are many complaints that public warnings of a potential attack did not strongly communicate credibility or imminence and lacked specific and “actionable” information. Officials stated that everyone receives “a lot of inconsistent information” that is of a generalized nature and “too vague to be acted upon.” While this analysis also states that there are currently no “known threats” to Louisiana special events we do know that locations with large crowds remain highly vulnerable targets for terrorist groups and their sympathizers who wish to stage high-profile attacks. Security personnel are advised to maintain heightened situational awareness and be alert for suspicious behavior that could indicate preoperational surveillance for an attack. To accurately describe unusual activity at a large special event is difficult but officials who have worked security should be able to spot someone disengaged from the action, dressed inappropriately, carrying backpacks, etc. The public plays an important role in the identification of suspicious activity and the reporting of unusual behavior which could indicate hostile pre-operational surveillance and attack planning.

In addition to possible “warning fatigue”, some experts believe we need to improve on limiting self-created vulnerabilities in information sharing that may be the results of agency politics and personal ambitions. Prevention success relies on suspicious activity reporting and networking/collaboration between Law Enforcement (LE), Intelligence, and Homeland Security. The path to such success begins with coordinating communication efforts on the scene and with a season-long local intelligence task force that includes members from the existing intelligence groups. Pre-event training for all law enforcement, traffic and parking control, baggage examiners, and event officials and workers on “suspicious activities.” Advertise to encourage event attendees to look for and report suspicious activity. The event security plan should be exercised and trained prior to the season with an after action review (AAR) after each event to modify the event security plan after AAR if necessary.

SAR Indicators

The public and federal, state, local, tribal, and territorial counterterrorism officials, as well as first responders and private sector security partners, are encouraged to remain alert and immediately report suspicious activity and potential behavioral indicators of pre-operational terrorism planning activities. This includes suspicious acquisition of materials and construction of explosive devices. Activities with articulable facts and circumstances that support suspicion that the observed behavior is not innocent, but rather reasonably indicative of criminal activity should be reported.

Unmanned Aerial Vehicles or Systems (UAV/UAS) or “drones” are gaining visibility as the U.S. military’s explosive ordnance disposal community is girding for a new threat: flying drones as IEDs.

ANNEX B: TERRORISM THREATS

Domestic Terrorist Threat (DTT)

The DTT to events in Louisiana is assessed as low. At this time there is no intelligence indicating that domestic terrorists are targeting the events in Louisiana with violence as a means of advancing their causes. As of this date, the various local groups have not posted any events or marches within the city related to the 2017 events in Louisiana.

Domestic terrorists fall into three general categories: Single Issue /Special Interest Groups (Animal Liberation Front/Earth Liberation Front), Right-Wing Groups (White Supremacist/Religious Based), Left-Wing Groups (Anarchists). Some individuals have adopted the principles of leaderless resistance, which include the operation of very small, autonomous cells independent of any group structure. There have been indicators that the National Alliance has a presence in the Louisiana and other people claim membership with most other groups.

A number of hate and anti-government groups are present and active within the State of Louisiana, including those which adhere to white supremacist, black separatist, or sovereign citizen ideologies. Such groups are engaged primarily in recruitment efforts and the spreading of propaganda, and tend to target specific individuals/establishments consistent with their ideology as opposed to the general population. U.S. persons are of particular value to terrorist organizations. They can travel throughout the United States, as well as return to the United States from travel abroad, and they are familiar with the U.S. environment and culture. As seen in the multiple law enforcement ambushes this year, violent domestic extremists motivated by anti-government ideologies, such as militia extremists and lone offenders who hold violent anti-government beliefs, do sometimes commit violent acts as well. These groups and individuals recognize government authority but facilitate or engage in acts of violence due to their perception that the U.S. Government is tyrannical and oppressive and believe that the government needs to be violently resisted or overthrown. While sovereign citizens were not included in these groups even though they do not recognize government authority, law enforcement sees them as the leading threat to LEOs/government and CI. While law enforcement officers have been targeted to date domestic groups have not been known to specifically target public venues.

International Terrorism Threat (ITT)

There is no intelligence indicating that any international terrorist organization is planning an attack in conjunction with the USMC 2019 Birthday Ball however there have been at least 131 ISIS-linked plots to attack Western targets since 2014 including 40 ISIS-linked plots inside the United States. International terrorist groups maintain a presence in the United States, often using front organizations to hide their activities. With tensions rising in the Middle East some terror cells may be waiting for aggression as a trigger to inflict attacks on U.S. soil. The Iranian Government is the main financial backer of several terrorist groups, including Hezbollah. The United States remains a primary target for Islamic Jihadists; and the group continues plotting attacks against U.S. interests at home and abroad. As such, the large number of people expected to attend events in Louisiana raises concerns that the events could be subject to soft target attacks.

Suicide attacks (to include using female bombers and teenagers) and vehicle-borne improvised explosive devices (VBIEDs) represent the most significant threat scenario to crowds attending events. Female suicide bombers are better able than men to conceal explosives under traditional loose-fitting garments. Since no reliable, predictable profile of suicide terrorist exists, first responders and law enforcement personnel should be alert to the possible use of female operatives in suicide attacks. Similar to females, teenagers typically receive less scrutiny by security officials, allowing them greater ease in gaining access or proximity to target locations.

DHS and the FBI assess that the increased use of females and recruitment of teenagers for suicide operations reflect tactical adjustments by Islamic militants in reaction to increase security measures that have made it more difficult for adult male operatives to carryout successful attacks.

The United States faces its highest Islamist terror threat environment since 9/11, and much of the threat now stems from individuals who have been radicalized at home. Since 9/11, the nation has seen 227 homegrown jihadist cases with a recent surge of 115 cases in 2015 and 2016 alone.

LESSONS FROM RECENT TACTIC, TECHNIQUES, and PROCEDURES

ISIS’s ideology continues to exert a powerful pull. The number of individuals joining or planning to join ISIS has not diminished. While focus upon al Qaeda (AQ) in the recent past has waned compared to the meteoric rise of ISIS, Osama bin Laden’s vision is coming to fruition. Al Qaeda declared war on the United States nearly 20 years ago and continues to be dedicated to attacking the “far enemy,” the U.S.

Terrorists almost always have the advantage and theoretically can attack anything, anywhere, anytime. Roughly 80 percent of all terrorist attacks are carried out at locations where there are no security perimeters to penetrate and no armed guards to respond. The lethality of the recent attacks reflects the determination of the attackers to kill wantonly, not tactical sophistication or combat skills. The attackers combined suicide bombers with armed assaults and hostage taking at multiple locations and is a worst-case scenario for law enforcement. “Hostages” may be a misnomer since the Jihadists intend to kill them, not hold them for ransom or self-protection. Even if an active shooter is a Jihadist, it is important to respond as in any other active shooter incident. Recent cases show that the attackers took “hostages” and that would be an opportune time to counterattack. Most cases show that these “hostages” are in fact “doomed captives” and without interdiction they will all be killed. It is most important that we do our very best to encourage suspicious activity reporting, remain vigilant, and make an effort to prevent any attacks.

Any place where large numbers of people gather are historically attractive targets for terrorist because they are soft targets, i.e., easily targeted, extremely accessible, capable of producing mass casualties, and attacks on them would provide wide spread news coverage for the group or person who perpetrated the attack. In addition these venues have no national standard for security measures. Public and private sector partnerships are key to preparedness for prevention or response to any type of potential attack, so we must endeavor to both inspire owners and officials include all public security and first responder agencies in their planning.

Assessments of active shooter scenarios in Louisiana show that it is low probability/high consequence; however, about one fourth of all active shooting incidents occur in open commercial locations, making it a mathematical probability that it’s only a matter of time before a group or lone gunman decides to start shooting in a Louisiana location. The key is to be vigilant in prevention efforts and in response be prepared to have quick decisive action to end any incident. Any efforts for the mitigation of risks does not imply that any loss of life as a consequence is acceptable, and the main effort is to prevent an attack by deterring, interrupting, repelling, or defeating a planned or an actual attack.

Among the infrastructure that can be targeted are the parking areas that hold large crowds before and after an event and also allow greater mobility and flexibility for terrorists as vehicles and its occupants are not searched prior to entering the site. The relative accessibility and low level of security into and inside the parking areas surrounding the site would make an IED or vehicle borne IED (VBIED) attack feasible. Levels of security at an event site also vary depending on the usage. When there is an event, security is at its maximum, but during non‐event hours security is usually at minimal levels.

In addition to individuals associated with terrorist organizations obtaining employment with a vendor at the event, they could gain unauthorized access by utilizing stolen or counterfeit staff, personnel, and law enforcement badges and credentials. These items can facilitate unauthorized access to various locations within the area. Individuals associated with terrorist groups like ISIS/ISIL, al‐Qaida, the Pakistan Taliban (TTP), Hamas, and Hezbollah have utilized various forms of impersonation abroad to conduct their attacks. It is relatively easy to obtain counterfeit items such as badges considering the availability of them for purchase on the internet. These counterfeit credentials and badges are often of high quality, and it would be hard to differentiate from legitimate credentials. Food and beverage goods are also delivered to the event either by the supplying company or outsourced transportation, which increases the level of accessibility to a location. International and domestic terrorist groups have the potential to bring a variety of equipment and materials into the event, such as explosives, to carry out an attack. They can exploit delivery or equipment trucks that have authorized access to the location for their logistical needs or execute a vehicle ramming attack.

NOTE: In Annex G there is a section with reverse pluming to aid in the prevention and response planning for the event. Security planners should area routes into account by examining the wind direction on event day and planning for any possible accidental or intentional releases. Upwind Areas of Concern: It is always a concern that a release of chemical, biological, or radiological materials/substances, from locations miles away, could target event attendees. As a result, the event’s forecasted weather can be modeled to identify areas where such a release could originate to be effective.

ANNEX C: INDICATORS, VULNERABILITIES, and PROTECTIVE MEASURES

SAR Indicators – suspicious activity and potential behavioral indicators of pre-operational terrorism planning activities; Indicators of suspicious breach/attempted intrusion activity.

Lone Offenders and Small Cell Indicators – indicators of possible lone offender activity: Potential Indicators of Violent Extremist Radicalization and Mobilization; Potential Indications of Material Support Activities to Terrorist Groups; Behaviors Associated with Pre-Operational Preparations for Attack.

Extremist Planning Indicators – activities that should raise red flags when dealing with individuals possibly indicating extremist planning

Potential Tripwire Indicators of Terrorist Activities – Tripwire indicators of terrorist activities relate to firearm shops and ranges.

Potentially Indicative Behaviors of Suicide Bombers – behaviors related to suicide bombers taken from previous attacks.

Site Vulnerabilities – Indicators/Reportable Items; Suggested Measures/Protective Actions to Reduce Risk;

Suggested Protective Measures – Physical Security – conduct vulnerability assessments and consider the applicable protective measures.

INDICATORS

New or increased advocacy of violence, including providing material support or recruiting others to commit criminal acts;

Reports to law enforcement that a community member has adopted a new name, style of dress or speech, and/or other significant changes in presentation to others in association with advocacy of violence;
Communicating with known or suspected homegrown or foreign-based violent extremists using e-mail or social media platforms;
Photography or videography focused on security features, including cameras, security personnel, gates, or barriers;
Attempts to purchase all available stock of explosives precursors or to acquire materials in bulk without explanation or justification or making numerous smaller purchases of the same products at different locations within a short period of time—a possible sign of covert stockpiling;
Theft of chemicals, hazardous substances, weapons, pre-cursor materials, or items that could compromise facility security, such as uniforms, identification, blueprints, vehicles (or components), technology, or access keys or cards;

Internet research for target selection, acquisition of technical capabilities, planning, or logistics;
Insisting on paying in cash or using a credit card in another person’s name;
Participation in weapons training, paramilitary exercises, and reconnaissance and surveillance activities in a manner that is reasonably indicative of pre-operational planning related to terrorism, particularly in conjunction with advocacy of violence;
Use of cover terms to mask the true meaning of events or nefarious activities combined with active advocacy of violence;
Acquisition of suspicious quantities of weapons and ammunition, or materials that could be used to produce explosives, such as hydrogen peroxide, acetone, gasoline, propane, or fertilizer; and
Activities that a reasonable person would deem as suspicious, indicating a storage facility or other areas are being used to construct an explosive device.

Indicators of suspicious breach/attempted intrusion activity are:

Presence of unauthorized individuals/vehicles in a restricted area or location.
Evidence of breached security perimeters, such as cut/damaged/removed locks or fencing.
Indications that unauthorized individuals attempt to “piggyback,” on employees or vehicles entering secure controlled access points.
Unauthorized individuals apparently trying to access secure or restricted areas and exhibiting suspicious behavior, such as entering during an unusual time of day, or obviously trying to avoid detection.
Personnel who deviate from protocols or lack the correct uniform or identification.
Unattended and/or illegally parked vehicles.
Unattended bags, purses, boxes or luggage.
Individual(s) showing interest in features such as security equipment, personnel, or checkpoints.
Drawing diagrams or taking notes on: building plans, security shift changes, security weak points, traffic flow and location of security personnel.
Viewing facilities from remote or obscure locations.
Using binoculars to view a facility or an infrastructure component.
Collecting or possessing large amounts of material, related to buildings being observed; to include blueprints, floor plans, delivery points, or security checkpoints.

An intruder entered a fire station through a door secured with coded entry; it is unknown how the intruder gained access. Video surveillance captured images of the intruder talking on a cellular phone while receiving what appeared to be instructions. The intruder stole a fire “turnout” coat and pants, boots, helmet, and eye protection.

A man dressed in black and wearing a headlamp was seen trying to use a tool to open a manhole cover late at night. The manhole covers in the area are typically used only by water, telephone, or sewer utilities personnel.

INTEL Note:Many cities have areas similar to “tunnels” that access various areas. Efforts to monitor and secure these access avenues should be part of prevention plans.

Lone Offenders and Small Cell Indicators

While lone offenders and small cells exhibit a high level of operational security, there are some indicators of possible lone offender activity, such as:
Predisposition toward violence and advocating violent action;
Obtaining, or expressing interest in obtaining, and using weapons, explosives, and bomb-making manuals for use in violent actions;
Expressing desire to attack a specific target and taking action to collect information on it;
Rejection by, or voluntary departure from, a group for advocating violence that the group does not support;
Expressing solidarity with, or admiration for, other lone offender extremists or terrorists.
On their own, the above actions may not be indicative of potential violence. The presence of multiple indicators, however, does warrant heightened awareness.

Potential Indicators of Violent Extremist Radicalization and Mobilization

• Sharing of media glorifying violent extremist acts in attempting to mobilize others to violence.

• Withholding or misrepresenting information necessary for counterterrorism efforts such as residency status or immigration history, including use of multiple questionable residence locations, social security numbers, or personal contacts on official DHS records or public documents;

• Communicating with known or suspected foreign-based or HVEs using email or social media platforms;

• A subject’s advocacy that their religious, cultural, or national group requires violent action against an external threat;

• Use of cover terms to mask the true meaning of events or nefarious activities combined with active advocacy of violence;

• Acquisition of suspicious quantities of weapons and ammunition, or materials that could be used to produce explosives such as hydrogen peroxide, acetone, gasoline, propane, or fertilizer;

• Suspicious weapons purchases, such as attempted purchases by individuals providing inconsistent or suspect identification, refusal to fill out the appropriate documentation, or issuance of vague or cryptic warnings that are violent in nature during purchase; and

• Attempting to enlist in the US military or state and local law enforcement, or seeking employment in a correctional institution by individuals confirmed to be known or suspected terrorist matches in government counterterrorism screening databases.

Potential Indications of Material Support Activities to Terrorist Groups

Efforts to conceal or mask the transfer of money or other financial resources or records into or out of the United States, including the use of bulk cash smuggling, stored value cards (for example, gift cards with a cash value or CashU cards), or structuring of wire transfers (this refers to sending funds out of the country in a series of increments below the $10,000 reporting limit) to assist terrorist organizations or violent extremists in the United States or overseas; and
Acquiring or shipping military/tactical equipment and clothing, firearms accessories, and off-the-shelf gear to assist terrorist organizations or violent extremists in the United States or overseas.

Behaviors Associated with Pre-Operational Preparations for Attack

Some of the below behaviors should be reported if they support the suspicion that the observed behavior is not innocent and reasonably indicates criminal activity, including pre-operational activity. Observable behaviors that may constitute indicators of attack planning include the following:

Participation in weapons training, paramilitary exercises, and reconnaissance and surveillance activities in a manner that is reasonably indicative of preoperational planning related to terrorism, particularly in conjunction with advocacy of violence;
Use of cover terms to mask the true meaning of events or nefarious activities combined with active advocacy of violence;
Acquisition of suspicious quantities of weapons and ammunition, or materials that could be used to produce explosives such as hydrogen peroxide, acetone, gasoline, propane, or fertilizer;
Activities indicating a storage facility or other area is being used to construct an explosive device which a reasonable person would deem as suspicious.

EXTREMIST PLANNING – The following is a list of activities that should raise red flags when dealing with individuals possibly indicating extremist planning and warrant reporting.

Exploration and/or possession of extremist media: Various forms of extremist media exist and are often utilized by those wishing to perform terrorist acts. Inspiration and training are often derived from these sources, whether it is through books, DVDs, CDs, internet forums, and publications.
Do not work well with others. Often, these individuals will live alone and isolate themselves from society. Some may join extremist groups and end up leaving due to having separate agendas. They may adopt completely new lifestyles, new names and segregate themselves from peer and family groups.
Posting/expressing of principles: Posting/expressing of extreme ideology is a high priority for many terrorists; they want their message to be heard and made available to the public.
Increased advocacy of violence: Developing anger toward society and government systems often leads to a new outlook on the use of violence in order to get a point across.
Purchasing excessive quantities of weapons, explosive materials, and precursor chemicals such as nitroglycerin, acetone peroxide, and ammonium nitrate.
Persistent belief in correcting a perceived injustice: They will not only talk about correcting a problem, they will take action by force in hopes of becoming a hero for their cause.
New or increased interest in critical infrastructure locations and landmarks, including aerial views of these locations.
Behavior that could indicate participation in surveillance of potential targets.
Travel to, or interest in traveling, overseas to attend violent extremist institutions or

paramilitary training camps.

Potential Tripwire Indicators of Terrorist Activities

Tripwire indicators of terrorist activities relate to firearm shops and ranges enhance voluntary reporting by industry representatives and assist law enforcement in identifying potential suspicious activities that could be in preparation for a terrorist act. No single indicator should be the sole basis for law enforcement action but the totality of behavioral indicators and other relevant circumstances should be evaluated when considering any law enforcement response or action. Indicators of suspicious activity at firearm shops and ranges include:

Unusual comments made regarding extremist rhetoric vague or cryptic warnings;
Purchasing firearms in a way revealing intent to circumvent legal restrictions;
Expressing interest in the deadly force of the firearm beyond the interest typically shown by purchasers; and
Inquiring about the illegal conversion of firearms.

The FBI also notes, suspicious behavior displayed by individuals purchasing chemicals or fertilizers may also be indicators for preparations to employ homemade explosive (HME) devices in a lone offender attack. As a result, local businesses (e.g. farm supply stores, beauty supply shops) should be considered as possible facilitation platforms for use in a terrorist act.

Potentially Indicative Behaviors of Suicide Bombers

Below is a list of behaviors related to suicide bombers taken from previous attacks, but the totality of circumstances – not just behavior alone – provides the best indicator of suspicious activity. An individual displaying one or more of these indicators cannot necessarily be pegged as a probable terrorist, underscoring the difficulty in countering suicide bombers.

Inappropriate attire, such as loose or bulky clothing inconsistent with weather conditions.

Carrying heavy luggage or wearing a backpack.
Unfocused eyes, paying little attention to surrounding activities or persons.
Unresponsiveness to authoritative voice commands, salutations, or other routine distractions.
Behavior consistent with lack of future plans, such as purchase of a one-way ticket or lack of concern about getting receipts or receiving change from purchases.
Unnatural gait and posture.
Ambivalent or anxious behavior, such as retracing steps or movements or engaging in seemingly purposeless actions.

Any of the above factors, coupled with suspicious actions—fumbling with or trying to light objects inside a package or inside clothing, or excessive autonomic responses such as unusual sweating can serve to tip off potential risks.

Site Vulnerabilities

Large numbers of people entering with varying levels of inspection of the items carried in. The inspection of and prohibitions/restrictions on items carried into an event, combined with the use of metal detectors, has reduced—but not eliminated—the vulnerability of venues.

Little control or inspection of vehicles entering parking areas adjacent to facility. Event sites are vulnerable to attacks both outside and inside their security perimeter, but it is on the periphery that the greatest vulnerability exists; in contiguous parking areas and areas where patrons line up to purchase tickets or to enter an event. There are generally no security controls on the contents of vehicles entering parking lots that surround the majority of event sites. A potential adversary could bring almost any type of weapon or explosive into the area. This is a danger exacerbated by tailgating fans that bring in cooking equipment, which could easily be used to conceal weapons or explosives.

Little or no inspection of items carried in by event participants, vendors, contractors, as well as by maintenance and cleaning workers.

Concession food contamination. The potential exists for the contamination of food supplied to concessionaires. This food is often not inspected and may not be secured.

Limited Security of facility (e.g., lock downs, patrols, inspections) between events. Security sweeps of the event sites before an event would reduce the vulnerability of the facility to adversaries who may store prohibited items in the event sites prior to the event.

Date and time of events are known well in advance. Large numbers of people are present at scheduled and publicly announced events, making for ready targets, as potential adversaries have ample time to plan an attack and determine the best time to maximize its impact.

Patrons waiting in line at ticket windows and access points.

Indicators/Reportable Items

Interest in or discussion concerning any of Louisiana’s event sites by detained or suspected terrorists.
Planned travel to any area near Louisiana’s college/university campuses by subjects closely associated with investigations.
Efforts by terrorists/criminals to obtain badges, access cards, credentials, tickets, volunteer positions or jobs with access to event sites.
Attempts to test or penetrate security at venues, including bomb threats, fake devices, or abandoned backpacks or travel bags.
Information regarding abnormal interest in or knowledge of security operations, security details, personnel, volunteers, law enforcement protection, emergency plans, access control, and event procedures, or any interest by suspicious individuals/groups to obtain such information.
Public or private statements calling for people to vacate or avoid any Louisiana event sites.
Any theft or suspicious purchase of small/medium aircraft, SUVs, cargo containers, or related equipment.
Updates to terrorist website postings/blogs that include communication related to any of event sites.
Theft or acquisition of explosives, blasting caps, fuses, or certain chemicals and precursors used in the manufacture of explosives.
Theft or cash purchase of weapons or ammunition; or of chemical, biological, or radiological materials. Any reported acquisition of chemical manuals, protective gear, or other equipment that could be used in an attack.
Theft or attempted theft of emergency vehicles, delivery vehicles, taxis, buses, or other vehicles that could be used for concealment of an IED or CBRN weapon.
Increased activity near critical infrastructure including loading docks, water intakes, main roads, rail lines, etc.

Suggested Measures/Protective Actions to Reduce Risk

Provide adequate (temporary) perimeter fencing or walls around facility grounds.
Reduce the number of access points for pedestrians and vehicles.
Increase the security at each access point with additional guards and inspections.
Restrict access by non-employees to those contractors and vendors needed to support essential activities.
Evacuate personnel from any facility where a confirmed threat exists and consider closing the facility until the threat level is reduced.
Restrict what people are permitted to carry into the venue. Deploy portable metal detectors and X-ray scanners to increase the level of inspection.
Incorporate a screening process that denies access to patrons with hand-carried items until the items have been physically inspected.
Provide inspection areas that are not visible to the public.
Screen delivery, emergency, and service personnel, employees, event participants, and guests before allowing them to enter the venue.
Search all vehicles entering the event area, including the undercarriage.
In areas easily visible to the public, identify the driver and physically inspect all vehicles before allowing vehicles to approach the venue.
Monitor all access points and restricted areas 24 hours a day, 7 days a week using closed-circuit television.
Consider increasing the number of police patrols and providing additional equipment and weapons to security forces at any facility where a confirmed threat exists.
Provide special passes or tickets to enable undercover officers to enter venues discreetly and without delay.
Provide daily awareness and security briefings to administrative and other essential personnel.
Train security staff regularly on detecting threats, including counter-surveillance techniques.
Employ advanced security surveillance technologies.
Check multiple forms of identification for every visitor and implement a strict credential system. Escort all non-credentialed support personnel while they are at the facility.
Portray the venues as a hard targets. Publicizing strong security measures without going into detail could bolster terrorist perceptions that venues are too hard to strike.
Use temporary barriers to expand zones around buildings, facilities, and populated areas.
Inspect and repair all barriers. Deploy additional temporary barriers using Jersey barriers, heavy vehicles and equipment, or empty containers to increase the standoff distances from the venue.
Strategically place barriers to guide the flow of vehicles for access to delivery, drop-off/pickup points and parking areas.
Ensure grounds are covered by plain-view closed-circuit televisions (CCTVs).
Increase inspection, monitoring, and surveillance of critical and sensitive assets, equipment, materials, people, and vehicles. Ensure that all official and emergency vehicles are accounted for. Reassign staff to assist with inspection, monitoring, and surveillance duties.
Ensure that lighting illuminates the venue and is equipped with emergency backup power.
Arrange for law enforcement vehicles to park randomly near entrances and exits before and during events.
Coordinate with local authorities regarding restrictions/closing of public facilities and roads.
Increase standoff areas by limiting parking in the vicinity of facility structures.
Provide continuous guard visibility.
Ensure that all appropriate personnel protection measures have been taken.
Ensure that all emergency responders and security forces have the necessary protective equipment and tools.
Implement continuity and emergency plans to help carry out evacuation and to respond to emergencies.
Activate command centers and assign staff members to local government emergency operations centers.
Ensure that Incident Command Teams work closely with fire departments, law enforcement, and other agencies to prepare for emergencies through drills and planning.
Pre-position emergency response personnel and equipment to locations to enable rapid response to incidents.
Establish communication with utility service providers to review plans for responding to any disruptions.
Increase inspections, patrols, and testing of all utility services; request local law enforcement assistance.
Increase the frequency of communications with local law enforcement. Advise them of increased security status of the venue. Identify additional security measures that will be implemented.

SUGGESTED PROTECTIVE MEASURES – PHYSICAL SECURITY

Terrorists have demonstrated continued interest in attacking significant infrastructure, economic, and symbolic targets. We encourage state and local law enforcement, and critical infrastructure security personnel, to train, network, and collaborate to conduct vulnerability assessments and consider the applicable protective measures below:

Report suspicious activity to proper authorities, to include missing or stolen weapons;
Install secure locks and protection on all external and internal doors and windows with quick-release capability from within for emergency and fire escape;
Establish a process by which security staff, nonsecurity staff, and members of the general public can report such suspicious activity.
Implement a process whereby event sites’ security, and state and local law enforcement share information regarding potential threats.
Train security personnel be alert for preoperational surveillance which provide pre-incident indicators, e.g. Suspicious or unattended vehicles on or near facilities; Repeated visitors or outsiders who have no apparent business in non-public areas; Consider establishing safe areas within facility for assembly and refuge during crises;
Consider installing closed-circuit television systems, intruder detection systems, and lighting to cover key areas;
Ensure that emergency communications equipment is present and operable. Practice emergency communications plans and systems;
Install vehicle barriers and designate vehicle marshaling locations to ensure adequate standoff distances from vehicle-borne improvised explosive device;
Establish personnel screening checkpoints for access control into the facility or event;
Conduct explosive detection canine team searches of vehicles requiring entrance into a secure zone;
Ensure personnel receive training on improvised explosive device (IED) and threat awareness, emergency communication, response actions, and SAR;
Remove objects (e.g., trash containers, crates, etc.) which could conceal IEDs in accordance with stand-off distance guidelines;
Conduct additional sweeps of the facility or event area using roving patrols and explosive detection canine teams; and
Be vigilant of secondary devices, specifically at anticipated evacuation routes.
Maintain a visible presence of security personnel conducting vehicle and foot patrols that vary in size, timing, and routes.
Ensure proper identification and credentials of employees at an event.
Strictly enforce access control procedures to critical areas of the facility.
Inspect items brought into venues by spectators and vendors.
Provide security and protective driving training to bus drivers to prepare them for ambush situations.
Vary the transit routes used traveling to and from sports venues.

ANNEX D: Terrorism Planning Cycle

Many security experts have stated in the past, and continue to believe, that terrorists will again target a major special event. Sports venues attract the attention of terrorist groups. The 12th issue of Inspire, a publication of AQAP, carried instructions on how to construct a car bomb that will cause maximum damage in “places flooded with individuals.” While it is unproven that Inspire articles translate into attacks, dismissing the magazine as irrelevant is also imprudent. It was revealed during the trial of Dzokhar Tsarnaev, the lone surviving suspect of the Boston Marathon bombings that the Tsarnaev brothers had learned to construct their improvised explosive devices from the first issue of Inspire. Their pressure cooker bombs were similar to the device described in the how-to article titled: “Make a Bomb in the Kitchen of Your Mom.”

Intelligence continues to show that one primary terrorists weapon of choice is still the Improvised Explosive Device (IED) which can be planted, carried or worn by an individual, motor vehicle borne, motorcycle/bicycle borne, aircraft, or water vessel borne. However, in addition to IEDs, plots and attacks in the homeland have evolved into a multipronged approach that includes IEDs, firearms and arson or the use of each weapon alone. This may be of significance with regard to the difficult-to-detect, lone wolf terrorist who has intentions to attack soft targets such as special event venues.

DHS and the Federal Bureau of Investigation (FBI) advise that detainee statements, captured material, and domestic and overseas terrorist attacks in the past have led to the assessment of events as potential targets. Given that “operational planning and surveillance against facilities are often difficult to detect” the Terrorist Planning Cycle can be used to show activity categories that are used in planning and conducting attacks. The second, fourth, and fifth steps in the cycle are our best opportunity see something and say something to prevent attacks.

TERRORIST PLANNING CYCLE – Used by terrorist groups (and criminals) when planning and conducting operations include broad target selection(target list, looking for easy targets); training, intelligence gathering & initial surveillance; specific (final) target selection: pre-attack surveillance, pre-operational attack planning; attack rehearsal, dry run, final surveillance; attack team deployment / action on objective / attack; and escape, evasion, exploitation (this step is sometimes not of concern since many of the missions are suicidal).

INTEL Note:Understanding of this planning cycle is important since interdiction of any plan is possible at any phase. An important aspect of prevention is to involve the public in a Suspicious Activity Reporting system.

ANNEX E: Threats to Homeland Consistent with Other Calls to Arms

There have been media and other propaganda efforts by ISIS, al-Qaeda, and affiliated violent extremist organizations to radicalize and recruit elements of the U.S. population. These efforts also provide additional context on the possible rhetorical support behind the recent attacks and illustrate the potential that similar statements may incite future violence. Most of the recent thwarted attacks and planned attacks are representative of a response to calls for action by Islamic State Extremists and underscores the high possibility of operational capacity and intent of homegrown violent extremists (HVEs) in the United States. Even with the leadership of AQ being depleted, the rhetoric to incite individual jihad has not abated.

Media statements by Islamic State of Iraq and Syria (ISIS or just IS), al-Qaeda, and linked associates such as Boko Haram, continue to call for violence against Western targets and suggest the possible existence of attack-ready operatives within the United States. Although we lack specific information on the nature of Islamists plotting against the United States, these statements are indicative of interest in targeting U.S. cities and indicate possible future attacks. Islamic Jihadist spokesmen continue to justify attacks in the United States, stating that America “deserves to be invaded in its own land,” and asserting that all Americans are guilty of crimes against Muslims.

In addition to ISIS and al-Qaeda, other transnational extremist groups, such as Hezbollah and Hamas, maintain a presence in the U.S., where they conduct fundraising, recruitment, propaganda and other logistical activities. There has been evidence indicating that Mexican Drug Cartels (MDC) and Hezbollah (and possibly other Islamic terror organizations) have been collaborating in Mexico. According to Department of Justice (DOJ) reports the MDCs have a presence in Louisiana.

While still remembering the bombing at the Boston Marathon, which was a completely open and large area, we must remember that venue security will experience attempts to penetrate secured areas. With any large-scale publicized event, there are often people who try to gain access to areas that are not open to the public, some by using stolen or counterfeit badges and credentials. As such, security and law enforcement personnel should canvass for any potential breaches in security or threat information directed at the event, the venue, or its participants. Usually these incidents are benign. However, individuals may penetrate security as a method of pre-attack surveillance or to conduct an attack. Security officials should be aware of individual(s) not dressed appropriately, or acting nervous or in a suspicious manner. Security should not hesitate to question an individual’s credentials if they suspect the individual does not belong in a particular area.

Historically there are advertised attack tactics designed to circumvent protective measures for venues. Terrorist groups overseas have attacked in locations other than inside a venue where a special event is taking place–conducting attacks against spectators just outside of venues and against people traveling to event sites. In these instances, operatives were able to attack without having to engage facility security forces directly. Conducting attacks outside of event sites and arenas can provide attackers with mobility and flexibility in choice of weaponry, while providing opportunities to inflict casualties and garner press coverage. Outer perimeter security is key to an effective entry point control access and security that serves to restrict the introduction of operatives and weapons to the interior of event sites, but entrances and exits are still exposed to possible attacks.

Potential Issue of Concern: Security Breaches and Insider Threats

Security breaches facilitated by individuals with legitimate access to the facility pose a tactic which terrorists often use to initiate the attack scenarios described later in this assessment. Attack planners could attempt to gain entry to event sites by leveraging the access of an employee or by impersonating a seemingly authorized individual. Illicit use of such credentials to gain access to event sites may be difficult to detect.

Terrorists affiliated with al-Qa’ida, ISIS, Taliban in Afghanistan, the Tehrik-e Taliban Pakistan, Hamas, Hezbollah, and other groups, have impersonated officials and used stolen or cloned official vehicles in conducting attacks overseas. This tactic provides terrorists access to restricted areas or closer proximity to targets without raising suspicions.

U.S. persons are of particular value to terrorist organizations. They can travel throughout the United States, as well as return to the United States from travel abroad, and they are familiar with the U.S. environment and culture. This grants them a unique platform from which to plan, facilitate or effect operations. As depicted below, all of our attention for suspected terrorist focused on Middle Eastern Males after 9/11. Today this has changed. In the past few years “terrorists” or “extremists” acts or attempts that we have disrupted and the one successful attack have all had some connection to the United States.

Some lessons drawn from the al-Shabaab terrorist attack at the Garissa University College in Kenya suggests some best practices in preventing and responding to potential terrorist attack threats in the Homeland. In review of the attack it should be noted that the security guards stationed outside the main gates protecting the campus were among the first killed in the attack. Indications are that the Kenyan terrorists investigated and/or had insider knowledge of the target area, providing them familiarity of their target location and personnel which likely aided in the planning and execution of the attack. The attackers specifically targeted Christian students during the attack, seeking out locations where Christian students congregated. Lack of credible information should not lead to a lack of vigilance.

Lone Offenders and Small Cell Indicators

While lone offenders and small cells exhibit a high level of operational security, there are some indicators of possible lone offender activity along with potential indicators of violent extremist radicalization and mobilization, potential indications of material support activities to terrorist groups, and behaviors associated with pre-operational preparations for attack. These indicators and behaviors should be reported.

Potential Tripwire Indicators of Terrorist Activities

Tripwire indicators of terrorist activities relate to firearm shops and ranges enhance voluntary reporting by industry representatives and assist law enforcement in identifying potential suspicious activities that could be in preparation for a terrorist act. The FBI also notes, suspicious behavior displayed by individuals purchasing chemicals or fertilizers may also be indicators for preparations to employ homemade explosive (HME) devices in a lone offender attack. As a result, local businesses (e.g. farm supply stores, beauty supply shops) should be considered as possible facilitation platforms for use in a terrorist act.

ANNEX F: Scenarios of Concern

Combination of Tactics

The highest area of concern at this time is an individual actor or a small group employing small arms or combination of scenarios, but recently a preempted planned attack in Belgium by a large group of terrorists possibly operating under ISIL direction may indicate the group has developed the capability to launch more complex operations in the West. We differentiate this complex, centrally planned plotting in Belgium from other, more-simplistic attacks by ISIS-inspired or directed individuals, which could occur with little to no warning. Organizations routinely change tactics to thwart security measures; and the latest attacks have incorporated small arms, explosives and arson. While the initial attack vector may vary, all three may be used. In Iraq, some suicide bombers are sent on foot to attack targets that are well protected against car bombs. Another tactic is to attack in two stages, with a lead bomber breaching security, followed by a second operative who then attempts to attack the primary target or responding emergency personnel. Small arms or arson are almost always utilized to either move targets or responders into a kill zone or to cover the attacker’s movements.

Information on scenarios is meant to be used to identify vulnerabilities. Therefore, it is to support all activities to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States. The above-mentioned Belgian incident in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIS direction has been discovered and may indicate group capability to launch more complex operations. The planning in this effort shows that the group chose to operate across several countries (or states). This highlights the intentions to significantly challenge law enforcement to detect and investigate multi-jurisdictional threats and the interagency information sharing about emerging and ongoing threats.

The Belgian group’s plotting may have included the use of small arms, improvised explosive devices, and the impersonation of police officers and underscores the role of the public and private sector in alerting law enforcement of potential terrorist activity through suspicious activity reporting (SAR). However, of most importance is the security measures used by this group to avoid physical and technical collection highlight how knowledge of law enforcement tactics can help subjects adapt their behavior and the need for investigators to consider whether subjects may be using countermeasures to deflect scrutiny. The group was likely aided by members’ criminal background and possible access to criminal groups underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts. Belgian law enforcement discovered automatic firearms, precursors for the explosive triacetone triperoxide (TATP), a body camera, multiple cell phones, handheld radios, police uniforms, fraudulent identification documents, and a large quantity of cash. The subjects were also searching for an ice machine to cool and transport the TATP. The group made extensive efforts to prevent or limit law enforcement’s ability to conduct technical surveillance by changing cell phones five times and urged operatives to change vehicles often and to search the vehicles for microphones in an effort to thwart potential surveillance by police and intelligence officials. While they were surveilled the intercepted communications were conducted in French, Arabic, and a Moroccan dialect, and frequently used coded language to discuss attack planning to make translation problematic for law enforcement and intelligence services.

Small Arms: (active shooter attack targeting crowds at the event sites)

The past shooting sprees against crowds of people at Louisiana and Colorado Theaters, a Tennessee recruiting office, and the Hebdo office in France demonstrate the deadly outcomes that can result from lone, and often amateur, gunmen. The relative ease of preparing such an attack, guidance by al-Qaeda, and the difficulty of pre-incident discovery may enhance the attractiveness of conducting active shooter attacks. Unfortunately there is no profile for the active shooter.

The al-Qaeda in the Arabian Peninsula’s (AQAP) English-language magazine, Inspire, urges U.S.-based readers to conduct small arms attacks – the author praising such operations for their ease of preparation. While terrorist organizations almost certainly will continue to attempt future attacks on the U.S. using explosives, operational planners may also incorporate small-arms attacks that do not require mastery of improvised explosive construction or risk the failure of a complex bomb design.

Improvised Explosive Devices (IED)

An IED attack during an event would inflict immediate casualties and destruction and create fear and panic among spectators. Terrorists could also use IEDs (or VBIEDs) against crowded, unsecured targets nearby, such as local businesses and public parking lots, as diversions or to stage secondary attacks against first responders.

A successful improvised explosive device (IEDs) could cause significant damage to people and property. At this time, there is no current, specific information that al-Qaeda or any other terrorist group is planning to conduct an IED attack in the United States. Law enforcement and security personnel should be alert to potential threat of IEDs and maintain a high level of vigilance during the events in Louisiana.

Vehicle-Borne Improvised Explosive Devices (VBIED)

A VBIED attack at event sites would represent a “worst case” scenario and could inflict immediate casualties and destruction, create fear and panic among survivors, paralyze businesses in the affected area, and potentially lead organizers to adjourn or cancel the events. The large media presence would ensure an attack would attract the extensive global attention that terrorists seek.

VBIEDs are a favorite instrument for terrorist groups because they can act as their own delivery mechanism and can carry a sizable quantity of explosives without raising suspicion. The preferred method of attack, cited in al-Qaeda casing reports, was a VBIED loaded into a limousine or a service or delivery truck to discourage any undue attention or suspicion on the part of security personnel. Terrorists could use large commercial motor vehicles (CMVs) such as trucks or buses loaded with explosives or toxic industrial chemicals as weapons to attack public gatherings and secure or sensitive sites such as airports, power facilities, critical bridges and tunnels or fuel depots.

A successful VBIED, using a large amount of explosives, could cause significant damage to people and property. At this time there is no current, specific information that al-Qaeda or any other terrorist group is planning to conduct a large VBIED attack in the United States. Law enforcement and security personnel should be alert to potential threat of VBIEDs and maintain a high level of vigilance during the events in Louisiana.

Suicide Bombers

Suicide bombings conducted either by vehicle or on foot, are a preferred terrorist tactic because the bomber controls the location, method of delivery and timing. Many facilities, such as public places, are inherently vulnerable to suicide bombing attacks; and permanent physical defenses are often impractical to establish or maintain. The terrorist’s latitude in determining and adjusting an attack up to the point of detonation further complicates countermeasures. These factors place a premium on disciplined security measures and alertness by those charged with implementing them.

Despite the frequency of suicide bombings abroad, a predictable profile of a bomber is lacking. Suicide bombings generally are carried out by motivated, committed recruits who have the mental discipline to accomplish the operation. Most suicide bombers have been males aged 16 to 35, but recently some terrorist organizations in Chechnya, Nigeria, the Palestinian territories, and Sri Lanka, have used females to circumvent detection strategies that focus on male operatives. Boko Haram has used young females in their last half dozen attacks.

The suicide bomber tactic is a prevalent IED-related terrorist tactic overseas that has been used at soccer matches and locations where large numbers of fans were gathered to watch broadcasts of the FIFA World Cup. Such attacks could target crowded, unsecured targets nearby special event sites. Terrorists may be more likely to employ suicide attacks during cooler months where the bulky clothing necessary to conceal explosives would not appear abnormal.

The author of a posting on a jihadist message board entitled, “How You Can Kill Thousands of Americans with a Few Hundred Dollars and Three Men,” recommended using three to five “blond or black” American Muslim suicide bombers. To avoid detection, the bombers would hide explosive belts under their clothing. The author also outlined how a suicide bomber would detonate explosives inside a venue, after which other operatives would detonate their bombs at the exit gates where they expected spectators to flee. The author believed the combined explosions would create a stampede that would kill far more people than the bombings themselves.

Potentially Indicative Behaviors of Suicide Bombers

In Annex E is a list of behaviors related to suicide bombers taken from previous attacks, but the totality of circumstances – not just behavior alone – provides the best indicator of suspicious activity. An individual displaying one or more of these indicators cannot necessarily be pegged as a probable terrorist, underscoring the difficulty in countering suicide bombers. Any of the above factors, coupled with suspicious actions—fumbling with or trying to light objects inside a package or inside clothing, or excessive autonomic responses such as unusual sweating can serve to tip off potential risks.

Other Tactics

Arson

Intentional fires can be set by using highly flammable materials placed in a container that is tossed into a crowded venue. Accelerants that promote the spread and intensity of a fire can be applied beforehand and then ignited. Arson, or fire, although not highly publicized, is the most used weapon in the area of terrorism. The Mumbai India attacks and similar ones in Pakistan have all employed fire as a weapon or force multiplier. Fire can be used tactically to develop avenues of approach for responders and to move targets into a kill zone or screen the movement of the attackers.

Vehicular Attacks

“Vehicle ramming” has recently become a primary tactic for both international and domestic terrorists. An article in AQAP’s Inspire magazine named, “The Ultimate Mowing Machine,” details a plan to use a truck outfitted with steel blades to attack “pedestrian only” areas closed to vehicular traffic. Other articles have just suggested ramming into the crowd with the vehicle to kill and maim people. Vehicle rammings continue to be a popular tactic for terrorists because they require minimum preparation and operational skill and remain very difficult for security officials to detect and disrupt. A report released by the London-based Risk Advisory Group found that terrorist attacks in which the perpetrator utilized a vehicle as a weapon became the most lethal form of attack in Western countries for the first time in 2016. Since the beginning of 2017, terrorist have carried out multiple vehicle ramming attacks on western soil, varying in targeting, severity and motivation. Most recent attack was in New Orleans on New Year’s Day on Bourbon Street that left 14 dead and dozens injured.

Aircraft Attacks

Hijacked commercial and general aviation aircraft could be used to deliver explosives or hazardous material to a building or be used as weapons themselves. Employment of an aircraft to attack an occupied venue may be an attractive attack method as the target is easily identifiable from the air and the concentration of people would guarantee mass casualties.

Follow-up reports on convicted al-Qaeda operative, Dhiren Barot, contained pamphlets and information about private helicopter companies and heliports, suggesting the consideration of helicopters for attacks.

Drones, UAV/UAS

Radio-controlled (RC) aircraft has also been discussed as a possible method for delivering explosives/chemical/bacteriological agents. Although the amount of material such vehicles are capable of carrying is small, the psychological impact of an over flight seen to be spraying liquid, even if totally inert, could be considerable. The U.S. military’s explosive ordnance disposal community, bedeviled by roadside bombs in recent wars, is girding for a new threat: flying drones as IEDs. The crash landing of a hobbyist’s quadcopter on the grounds of the White House in January has sparked fears that a low-tech enemy like the Islamic State could harness such a device to deliver a bomb — and that explosive ordnance disposal (EOD) techs would have to confront it.

Terrorists want to use drones to help in two of the most desirable tactics today. One to drop explosives on large crowds and two deliver spyware remotely. Counterterror officials think Islamists could launch a multi-drone attack carrying several bombs and even using airborne cameras to film the bloody carnage below for twisted propaganda videos. Some believe that ISIS has already tested how much plastic explosive the flying machines can carry, getting as far as experimenting with detonation devices. We have always considered the possibility that drones could be hacked, infected with some kind of spyware, and controlled by an enemy power but now it seems that work is being done on giving drones the ability to deliver spyware remotely instead.

Other Tactics and Tradecraft

Security efforts must maintain awareness of some of the tactics, targets, and tradecraft individuals associated with or inspired by Jihadists. These usual modes of operation can potentially be used to identify vulnerabilities and assist with disrupting plots in the United States. In the last few years, Jihadist have encouraged HVEs to use low tech weapons and methods but the threat of a large group of terrorists operating under foreign direction and the development of more complex operations is still a scenario of concern. Some other possible tactics and tradecraft mentioned by Jihadists recently are Tunnel Bombs. Islamic State militants are digging tunnels in the Middle East to plant massive bombs under buildings and other targets, borrowing from an ancient tactic with modern applications, such as those used extensively by Syrian rebels. Islamist insurgents have built a network of bunkers, trenches and tunnels in Iraq to move people and weapons beyond detection by U.S. and allied air assets. NOTE: Underground networks of below-grade transportation, communication, and utility systems exist de facto in many cities worldwide and offer terrorists targets, as well as focal and access points to the surface.

ANNEX G: HAZARDOUS MATERIALS

FBI Weapons of Mass Destruction Directorate and FBI Boston Field Office assess threat actors likely are attempting to transport illicit chemicals across the US northern border with Canada for use in chemical attacks, despite inherent security measures meant to intercept the transportation of chemicals that cause casualties or incite fear and panic. This assessment is based on northern Border States reporting the incidents of threat actors attempting to transport illicit chemicals to and from the United States and Canada and the impact of the use of TICs or EPCs in a chemical attack. The transportation of illicit chemicals typically includes the bidirectional border crossings of TICs and EPCs, to be used by threat actors in a range of hazardous scenarios including, but not limited to, an attack or for manufacturing or attempted manufacturing of improvised explosive devices.

As of 26 October 2018, according to an FBI investigation, two Canadian nationals at the Maine POE in Houlton, refused to comply with law enforcement commands to get out of their vehicle. A subsequent search of their vehicle revealed five-gallon gas cans in the back seat. Previously identified as sovereign citizens, CBP reportedly refused the same Canadian nationals entry into the United States at the Vermont POE in Derby Line in 2015. Both individuals were part of a group known to post videos of “causing chaos to the unsuspecting public. The FBI reporting is often intertwined with CBP and CBSA evidence, as the agencies’ jurisdictions often overlapped. Reporting received from Canadian and US law enforcement authorities on the same incident were critical to the assessment, as it demonstrated a pattern of border crossings for criminal intent and for the purpose of smuggling chemicals and corroborated foreign government intelligence crucial in making the assessment in this external intelligence note. A commercial bus applied for admission to the United States at the Detroit- Canada Tunnel, he claimed to be traveling to Huntsville, Alabama, to pick up items he had left behind. A name check of the individual revealed that on 20 March 2018, an identified airline denied the Canadian national’s boarding of his flight back to Canada from Huntsville, after he attempted to check two bottles of 98 percent sulfuric acid in his luggage. When questioned by the FBI, the individual stated he had purchased the sulfuric acid at a local chemical company in Alabama and planned to use it as drain cleaner in Canada. During the 30 March interview with CBP officers, the Canadian national admitted he had travelled to the United States for the sole purpose of picking up two bottles of sulfuric acid to throw on his pregnant wife and her friend. He had ordered two 950 mL bottles of sulfuric acid, chemical resistant gloves, and a chemical resistant container and shipped them to a hotel in Alabama for transport back to Canada. The individual stated he traveled to Alabama because sulfuric acid was difficult to acquire in Canada.

As of 11 January 2017, the CBSA reported a Canadian national attempting to return to Canada at the Canadian POE at Rainbow Bridge in Niagara Falls, New York was in possession of 2 lbs. of hexamine, 1 lb. of citric acid labeled 100 percent pure, 2 lbs. of potassium nitrate, and 950 mL of 98 percent sulfuric acid – all EPCs used to manufacture the explosive hexamethylene triperoxide diamine. A Royal Canadian Mounted Police explosives expert stated the amount of chemicals found in the vehicle were capable of producing a significant explosive device. Additional investigative efforts revealed the same individual ordered as many as nine packages from a chemical company for shipment to his post office box in the United States, where he planned to collect the packages and transport them back to Canada.

As of 20 January 2015, the CBSA reported two identified USPERs illegally possessed flash powder, M-150 series fireworks, bottle rockets, packages of black cat fireworks, tins of percussion caps, a set of brass knuckles, a switchblade knife, and a butterfly knife during a secondary inspection at the Detroit-Canada Tunnel. As a result of the seizures the USPERs were arrested as they attempted to enter Canada. CBP social media exploitation of one individual revealed anti-government and anti-police sentiments and previous charges in 2011 for manufacturing explosives, possession of a Molotov cocktail, and other explosives causing property damage.

All the successful security interdiction examples on the northern border occurred at POEs. The FBI has minimal reporting of illicit chemical transportation, as defined in this external intelligence note, occurring through non-POEs. Due to the vast rural and forested terrain surrounding the majority of the northern border and its POEs, a threat actor’s ability to transport illicit chemicals or other nefarious goods without detection is a substantial concern for US Canadian Border States. For example, according to a human source in November 2017, human trafficking and drug smuggling operations occurred in a known Native American reservation within the FBI Albany region across the border. The smugglers waited until the winter when the local river froze over and then used snow sleds and snowmobiles to cross the border. Other detection avoidance techniques included a chemical spray used on license plates to avoid plate reader detection, use of Canadian and US license plates, and masking vehicle identity through new paint schemes.5 Bodies of water, to include the Great Lakes, surround portions of the northern border serving both as natural boundaries and perspective transportation avenues for threat actors looking to move illicit chemicals from Canada to the United States, or from the United States to Canada. Nautical activities, ranging from boats and jet skis to the potential growth in use of unmanned aerial vehicles or aquatic drones, could stretch border security resources as they surveil extensive maritime regions. In addition, CBP was in the process of implementing three camera and radar towers in FBI Buffalo’s territory, one camera was operational at Sturgeon Point, a second was being installed in Dunkirk, while the location of a third had not been determined. As of 24 May 2016, CBP’s goal was to implement camera and radar towers along Lake Erie and Lake Ontario.6 While POEs already have security measures in place to inhibit illicit activity, there are no known deployed monitoring systems specifically for the detection of chemicals crossing the border. Those factors make the northern border a soft target for the illicit transportation of chemicals, to include TICs and EPCs. Enhanced security measures to deter such acts serve to impede a portion of the attempted smuggling. Gaps still exist, however, in security and technological capabilities to completely halt the transportation of illicit chemicals across the northern border either at POEs or non-POEs.

(Weapons of Mass Destruction (WMD)/Chemical, Biological, Radiological, Nuclear (CBRN)

Most event venues are near high traffic routes for Hazardous Material (HM) carriers, for river, rail and vehicular traveling to the numerous chemical plants located in the state. This could set the stage for accidental or intentional release of a hazardous material into the area while crowds are present. Terrorists have been known to use these Toxic Industrial Chemicals (TICs) as weapons. Security planners should take these routes into account by examining the wind direction on event days and planning for any possible accidental or intentional releases. Upwind Areas of Concern: It is always a concern that a release of chemical, biological, or radiological materials/substances, from locations miles away, could target event attendees. As a result, each day’s forecasted weather can be modeled so as to identify areas where such a release could originate to be effective. Weather predictions for event locations including the probability of rain, wind direction and speed, and humidity will indicate the possibility of an effective upwind release affecting the event area.

NOTE: Even if the location of the event is in an enclosed facility, it could still be subjected to offsite releases that may enter HVAC systems. Hazardous Material (HM) does not have to be released inside a facility to be a threat. An intentional or accidental release of chemical, biological, or radiological materials/substances from locations miles away could affect attendees.

An attack on Louisiana’s event sites involving chemical, biological, radiological or nuclear (CBRN) WMD weapons is highly unlikely due to the complex technical hurdles involved in effective delivery. However, it would certainly create a great deal of panic and media attention while potentially rendering the area of attack uninhabitable.

Chemical Attack – Toxic industrial chemicals transported by truck or railroad can be brought near event sites and then disbursed by explosives. The procurement of chemicals and explosives, as well as the method of attack, would be difficult to pull off; though the 1995 Sarin gas attack in the Tokyo subway is one such example. ISIS’s recruiting efforts of ‘highly trained” specialists in an effort to develop chemical weapons show that the militants’ suspected use of chlorine as a weapon coupled with this recruitment suggests a far more serious effort in chemical weapons development than previously seen. Furthermore, terrorists continue to encourage homegrown violent extremists (HVE) to use toxic industrial chemicals (TIC), such as chlorine and cyanide, in homeland attacks.

NOTE: LE and homeland security responders need to be aware of possible indicators of the “use of chemicals for nefarious purposes,” such as observation of injuries, odors, or other suspicious activity associated with TIC. While use of TIC for the purpose of terror attacks may seem plausible to HVE due to availability and perceived relative ease of handling, first responders should be aware that accidents involving amateurs and fledgling jihadists are a possible consequence of such plots.

Biological Attack – Biological agents are attractive to terrorists because of the potential for mass casualties. They can be introduced into event sites through its HVAC system or can be spread by contact.

Radiological Attack – Radiological agents can be introduced into event sites through the HVAC system or by directly spreading them on surfaces where people will have contact. Radiological dispersion devices (RDDs), often called “dirty bombs,” have these materials attached to an explosive to create a wide area of contamination. Presently, the Islamic State may have collected enough radioactive material, from hospitals, research centers and oil drilling areas in Syria and Iraq to build a “large” dirty bomb. For the first time, the concept of obtaining a WMD for use in a spectacular attack by the group was introduced in the most recent issue of its online propaganda magazine posing a hypothetical situation where the militants might acquire a nuclear weapon from Pakistan to be smuggled into the United States via Mexico.

NOTE: The major consequences of a dirty bomb attack would be largely psychological and economic. Controlled tests of dirty bombs included dispersal in a building’s ventilation system that resulted in radiation levels that were inconsequential outside the immediate blast areas. However, first responders should understand that psychological impact is a major goal of terrorist acts and they should be prepared to avoid contributing to any hysteria associated with conceptual, potential, or actual radiological dispersal by having a solid understanding of measurements and associated consequences.

ANNEX H: Intelligence Gaps

Any suspicious acts which might indicate preoperational surveillance or dry runs.

Attempts to acquire credentials, security passes, uniforms, etc. to facilitate access.

Any thefts or diversion of radios or uniforms, or evidence that communications channels have been compromised.

Any suspicious attempts to obtain employment as facility or event staff, suppliers, contractors, security, etc.

Any suspicious inquiries into event plans or procedures.

Any evidence of tampering or compromise of food or water supplies.

Any evidence of groups rehearsing tactics (small arms attacks, paintball, RC aircraft).

Any evidence of surveillance or attempted sabotage of first responder capabilities (equipment, uniforms, procedures, ingress and egress routes).

Any suspicious internet or social media postings by individuals or groups.

ANNEX I: “ROOFTOP” SECURITY and DISPLACEMENT

ANALYTICAL SUMMARY

“ROOFTOP” SECURITY and DISPLACEMENT

Fifty-eight years ago on August 1, 1966, Charles Whitman climbed to the top of the University of Texas Tower observation deck with three rifles, two pistols, and a sawed-off shotgun where he shot 43 people and killed thirteen. From an elevated tactical position, former Marine Whitman introduced the nation to the idea of mass murder in a public space: With this knowledge everyone should be concerned about elevated locations that can provide a potential violent individual an unobstructed view of a possible target area. On July 7, 2016, in Dallas and last October 2017 we were again reminded when mass shootings came from a high vantage point that concealed the shooters’ location from law enforcement, delayed emergency response times, and caused confusion as to the direction of the threat. This product will examine “rooftops” as ultimate elevated position.

The Dallas Chief of Police reported on the night of the Dallas police shootings that sniper(s) fired at police officers “from elevated positions…” In Las Vegas, shots were fired from the 32nd floor of a casino hotel room. Snipers do not sit with their guns hanging out of a window and a long range shot is not one block or two blocks, it’s about 8 or 9 blocks or 600 to 900 yards. If a shooter is up high they can easily see those distances. “Rooftops” are the ultimate elevated perch for shooters. “Rooftops” can provide concealment for a shooter and an unobstructed view of a target area while delaying emergency response times, cause confusion on the direction of the threat, and limit areas of cover.

Particularly the Outer Perimeters that extend to the maximum effective range of possible weapons include locations that provide concealment and/or cover to an attacker. Elevated positions, especially “rooftops,” are extremely important and securing of “rooftops” should be included in all preplanning. Rooftopping has been a type of “urban exploration” hobby for individuals seeking illicit access or examination of normally unseen or off-limit areas of critical infrastructure. Some perform death-defying acts where people hang off the edge of rooftops or perform gymnastic feats or other stunts for a more shocking photograph. It is particularly concerning to security because it often encompasses criminal trespassing and other acts prohibited by facility owners and operators for safety, security, liability, and other reasons.

The shootings in Dallas and Las Vegas are prime examples from an elevated vantage points beyond the immediate security perimeter. The need for peripheral awareness is important to the security effort and the entire perimeter, including “rooftops” and areas that require access control must be defined. The goals of any perimeter patrol or reconnaissance is to provide early warnings, report suspicious activities, identifying any possible adversarial observations, and gathering information on any suspicious person in the area. Overwatch, strategic, tactical, and operational planning and preparation is critical to prevention. In the planning effort the Circles of Prevention were developed from previous incident intelligence and information and strategic and tactical suggestions from personal defense theory. The Circles consists of Areas Physical Security Systems, i.e., Interior – intrusion alarms, panic/duress alarms, video surveillance; Building Perimeter – access control, video surveillance, lighting; Venue Perimeter – fence or other boundary, video surveillance, lighting; and Outer Perimeter – reference points of visible locations within the maximum effective range of possible weapons or explosives and includes all security displacement areas.

Social Engineering – Use of deception to manipulate individuals into providing access to a location or divulging confidential information, such as the names of employees, security procedures, or site vulnerabilities. Information provided could also be used to enhance an individual’s credibility to gain access to a location or explain the presence if challenged by security or law enforcement.

Tailgating – Following an employee with access privileges into a restricted area. This is most likely to occur in resorts that allow employee access to the rooftops for breaks.

Breaking and Entering – Criminal act of entering an enclosed area through the slightest amount of force even access to a rooftop by merely pushing a door open without authorization. Properties that use the rooftop as an emergency exit are particularly susceptible to this tactic, as fire codes may prohibit properties from locking emergency exit doors.

Unauthorized Access – Entering a restricted area from an adjacent public space. In this case, there may also be little or no security warnings (e.g., “Restricted Access”, “Do Not Enter”, or “Employees Only” signs) in place to prevent unauthorized access from the public area.

Pretexting – The creation of a plausible but fabricated scenario explaining why an individual is in a restricted area if he or she is intercepted by security or law enforcement. This may also involve impersonating an employee or a contractor who requires access to a restricted area, or the use of uniforms, clothing, or badges resembling those worn by facility personnel.

Testing or Probing of Security – Deliberately interacting with or challenging security in order to test the strengths and vulnerabilities of security systems and personnel at a site by engaging in overtly suspicious actions to provoke and observe responses by security or law enforcement officers.

Online Surveillance – Leveraging publicly available information on the internet to gain insight on a potential target to support pre-operational planning efforts. This includes the use of internet search engines for various kinds of information (e.g., maps, company photographs, or logos) and social media sites and blogs for additional details about a facility’s layout or security procedures.

The”rooftopping” tactics used to access rooftops must be understood in order to prevent access in an events outer perimeter. Methods to enter the “rooftops” vary depending on the individual and the particular facility, but any of these tactics can enable an individual(s) with violent intent to conduct an elevated attack targeting mass gatherings using similar means.

In review, “Rooftops” are the ultimate elevated positions. High vantage points conceal the shooters’ location from law enforcement, delays response, causes confusion as to the direction of the threat, and limits protection for targeted individuals. In planning employ the concept of the Circles of Prevention. The Circles consists of Areas Physical Security Systems, i.e., Interior, Building Perimeter, Venue Perimeter, and Outer Perimeter. Outer Perimeters include elevated locations that provide concealment and/or cover to an attacker and securing of “rooftops” is important. Tactics used to access “rooftops” must be understood in order to prevent access in an events outer perimeter. Methods to enter the “rooftops” vary depending on the individual and the particular facility, but similar means can enable an individual(s) with violent intent to conduct an elevated attack targeting mass gatherings.

DISPLACEMENT OF VULNERABILITIES

Crime displacement is the relocation of crime from one place, time, target, offense, or tactic to another as a result of some crime prevention initiative. Spatial displacement is by far the most commonly recognized form, though the other four are also frequently acknowledged by those studying crime prevention effects. Formally, the possible forms of displacement are:

Temporal – offenders change the time at which they commit crime;
Spatial – offenders switch from targets in one location to targets in another location;
Target – offenders change from one type of target to another;
Tactical – offenders alter the methods used to carry out crime; and
Offense – offenders switch from one form of crime to another.

“Displacement” in security is commonly referred to when increased security and expanded perimeters create new bottlenecks where crowds wait to clear security. Despite increased protective deployments, entry control measures, and expanded perimeters around areas with a large security presence, law enforcement and security personnel remain vulnerable at the security perimeter. Attackers, understanding where the security perimeter begins, strike just outside where congestion creates predictable crowds and security is less extensive. Recent examples are the attacks on a police officer on duty just outside the TSA checkpoint in Flint, Michigan, bombing on the Ariana Grande concert where the egress corridor was crowded, and shooting in Las Vegas from an elevated vantage point beyond the immediate security perimeter.

Even though displacement is viewed as a negative consequence of crime prevention efforts, in some cases it can still provide some benefit. Current thinking suggests that beneficial displacement can occur when the harm produced by the displaced crime is less than what existed before the intervention. When considering how best to manage risks, less visible security outside of a perimeter and efforts to moderate crowd size may prove effective in mitigating the risk to both civilians and security personnel. In any event, the need for peripheral awareness is important to the security effort as a whole and to the individual officers.

As always suspicious activity reports (SAR) from LE, Security, event employees, employees of surrounding entities, and attendees are key to prevention efforts. More than 95% of thwarted terror attacks in the past two years have been the result on someone reporting something suspicious. Terrorists may attempt to breach secured perimeters or gain unauthorized access to facilities, sensitive locations, or restricted areas for preoperational activity or to conduct an attack. Attempts at intrusion could take the form of trespassing, forced entry or impersonation of authorized personnel and could possibly involve the assistance of knowledgeable “insiders.” While many of the activities may be harmless by themselves, they demonstrate potential vulnerabilities common to protecting people and infrastructure. The need for vigilance and preparation on the part of all public and private sector partners in identifying indicators of a potential terrorist attack is extremely important.

BUREN R. (Ric) MOORE

In the case of terrorism, to wait for an indication of crime before investigating it is to wait too long. There is no guarantee of success, but there has to be a guarantee of effort. Let’s make it hard to hurt us. If you see something suspicious, report it.

ANNEX J: Special Events Working Aid

The security footprint for a special event extends past the perimeters of event venues and could have cascading effects on surrounding areas and critical infrastructure. It is important that law enforcement, fire, emergency medical services (EMS), and private sector partners plan, train, and work together whenever possible to ensure preparedness and effective response. By taking into consideration a wide variety of potential terrorist tactics, techniques, and procedures and then planning, coordinating, and exercising against them, stakeholders will be better able to prevent, respond to, and mitigate the effects of terrorist attacks.

GENERAL CONSIDERATIONS:

 SECURITY BARRIERS: Rings of concentric security are typically established. Events may have barriers making entry into the outer perimeter of the event hard for responding officers. Event planners should consider pre-deploying assets to handle issues inside zones such as multi-agency joint hazard assessment or mass decontamination teams.

 COMMUNICATIONS: Pre-event plans must establish primary and alternate methods of communication for first responders. Ensure first responders have access to security and close-circuit television. Establish unified command and communications capabilities, ensuring interoperability across all stakeholders.

 TRANSPORTATION: Consider establishing dedicated routes for EMS transport, as both pedestrian and vehicular traffic could become overwhelming due to a large transient population.

 PERSONNEL VETTING: It is important to perform thorough background checks of employees, contractors, and support staff during the application and hiring process, and periodically vet them, as they may have access to potentially sensitive areas.

COORDINATION: Development of an appropriate security presence for rapid and comprehensive emergency response is contingent upon close interagency coordination and private sector partnerships. While developing a comprehensive plan, current terrorist tactics and trends must be taken into account. Joint training can greatly enhance preparedness and increase early incident stabilization.

 PLANNING: Understanding current and evolving trends in terrorist tactics, techniques and procedures will facilitate the development of adaptive security measures, increasing the chances of attack detection and disruption. Planning should also include transition from emergency response to investigation, as well as maintaining core local and regional emergency services.

 IDENTIFYING STAKEHOLDERS: It is critical to identify key venue staff, facility, and security personnel, and include them in event plans and preparations, as they will potentially assist and advise first responders during a crisis.

 DEFINING ROLES AND RESPONSIBILITIES: Provide specific operational considerations and requirements to security personnel and first responders so that all stakeholders are best positioned to identify, prevent, or effectively respond to a terrorist attack.

 MANAGEMENT: The overlapping authorities of numerous stakeholders could complicate response. Unify the various stakeholders by conducting joint meetings leading up to an event to improve relationships, and establish a shared understanding of the threat picture.

 INFORMATION SHARING: Effective information sharing between government, public, and private sector stakeholders will create a common understanding of the threat environment and facilitate recognition of suspicious activities by providing context which otherwise might go unnoticed. Protocols must be established pre-event for threat information and situational awareness messaging at both command and tactical levels.

VENUES: The security focus during a large special event should include not only the venue and its immediate surroundings, but also neighboring jurisdictions, which may be considered soft and therefore more attractive targets.

 Emergency response plans should identify key venue staff members to assist and advise first responders, as well as highlight their roles and responsibilities during a crisis.

 Interior and exterior building or venue control points may limit responder access and affect the rapid deployment of emergency response tools and equipment.

 Ensure first responder access, including combinations, master keys, or swipe cards to provide full access and/or entry into restricted areas.

 Exterior building features and security measures may affect the placement of response vehicles or the ability to ventilate the building and rescue victims.

 Ensure a risk analysis is performed and shared with all security stakeholders to effectively allocate finite resources to those areas and events with the highest associated risk.

MEDICAL: A mass incident can rapidly deplete local and regional resources, stress even robust incident command structures, and overwhelm emergency medical services, including local hospitals requiring continual coordination of bed capacity, consumables, and specialty, burn, and surgical services. Establish a mass casualty incident plan which includes medical response triage by:

 Mapping out the nearest trauma centers and hospitals;

 Planning for special needs victims, including children, the elderly, the physically disabled, and those with other special needs;

 Coordinating closely with law enforcement to prevent the triage response from complicating evidentiary and forensic collection;

 Addressing on-scene capabilities such as ambulance routes and casualty collection points, and;

 Reviewing and coordinating mutual aid agreements and medical staging

locations, especially taking into account expected attendance loads.

EVACUATION: Planning for an evacuation requires close coordination, communication, and cooperation between all stakeholders. Evacuation of crowds requires comprehensive planning and must address:

 Venue location, traffic patterns, and egress points from the premises and surrounding areas;

 Activation, staging, and mobilization of specified areas and personnel;

 Sectional evacuation plans;

 Primary and alternate evacuation routes for both pedestrian and vehicular traffic;

 Collection and relocation points for special needs population;

 Surrounding transportation infrastructures;

 Family reunification;

 Designated emergency response routes;

 Public address of the premises and surrounding areas, and;

 Personal items left behind, which may need to be cleared by bomb squad personnel.

CHEMICAL ATTACK INDICATORS:

 Explosion with little or no structural damage;

 Reports of a device that dispersed a mist or vapor;

 Multiple casualties exhibiting similar, non-trauma related symptoms;

 Reports of unusual odors, liquids, spray devices, or cylinders;

 Dead animals;

 Discarded personal protective equipment;

 Suspicious/unexplained packages, vehicles, or containers, and/or;

 Unexplained burns or injuries.

SECONDARY ATTACKS: After an initial attack, terrorists may try to target first responders and onlookers by detonating a second explosive device in or around the anticipated safe area or evacuation locations.

 Terrorists may conduct secondary attacks by infiltrating suicide bombers into crowds of bystanders or by detonating preset bombs remotely through the use of timers, remote triggers, or motion sensors. Explosive devices may be concealed in innocuous items of various sizes, such as vehicles, backpacks, garbage cans, mail boxes, and planters.

IMPERSONATION: Use of commandeered or fake emergency services identification, uniforms, and equipment could be used to:

 Gain access to secure sites;

 Conduct a secondary attack to create more victims, including first responders already on scene;

 Affect response times and delay genuine emergency responders, and/or;

 Allow access for individuals to conduct surveillance or collect information.

STOLEN, CLONED, OR REPURPOSED OFFICIAL VEHICLES: Official or official-looking vehicles may be used to conduct surveillance, or to gain access to a venue to conduct an attack.

Indicators include:

 Destination and origin are inconsistent with the company or service being represented;

 Driver is not knowledgeable about the company or its service;

 No uniform or uniform is inconsistent with the vehicle’s advertised business;

 Vehicle registration and insurance are in named individual instead of company;

 Vehicle make, model, and year may not match company’s current fleet;

 Multiple or conflicting corporate names and logos appear on the same vehicle;

 Visible identifiers, such as phone numbers, license plates, or call numbers that are inconsistent with the vehicle’s operating area or mission, and/or;

 The vehicle appears to be heavily loaded, possibly beyond capacity.

DECEPTION:

 LURING is creating a disturbance, false alarm, or preliminary attack intended to lure first responders to a particular location or area for the purpose of conducting a direct attack against arriving personnel.

 DIVERSION draws security forces and first responders away from the intended primary target and may be used as part of a complex or multipronged attack. This tactic delays the response, provision of medical care to victims, and depletes first responder resources.

 SWATTING is reporting false emergencies using technology that makes calls difficult to trace, which can lead dispatchers to deploy substantial resources in response to nonexistent emergencies.

REPORTING SUSPICIOUS ACTIVITY: It is critical for all stakeholders and the public to know how and to whom to report suspicious activity, which may include:

 MATERIALS ACQUISITION/STORAGE: Storage of material inconsistent with the occupancy.

 OBSERVATION/SURVEILLANCE: Response patterns that are being observed or recorded.

 BREACH/ATTEMPTED INTRUSION: Unauthorized individuals in a restricted area.

 TESTING OF SECURITY: Evidence of tampering or disabling facility security cameras, locks, gates, fences, and other security mechanisms.

 ELICITATION: Inquiries about emergency procedures by individuals with no need to know.

 MISREPRESENTATION: Cloned emergency vehicles or personnel uniforms with forged or incorrect insignia.

 ACQUISITION OF EXPERTISE: Maps, plans, blueprints, or drawings that may indicate unusual interest.

ANNEX K: SECURITY IN THE DEFENSE

SECURITY/DEFENSIVE TACTICAL FUNDAMENTALS

Strategies for security should all contain similar characteristics of the defense that constitute planning fundamentals for securing an area or a facility. To ensure the success of the security, security officers, administrators, store managers/clerks, sales staff, and other stakeholders must understand the characteristics of security defense during all phases. These fundamentals are:

 Planning

 Preparation

 Tactical Sequence of the Defense

 Reorganization and Reunification

PLANNING

Since the “defenders” of a facility are usually very familiar with the area prior to any incident, they must take advantage of this by completing an all hazard plan with input from all stakeholders. Based on information and intelligence from all stakeholders the plan should thoroughly analyzing factors such as the mission, scenarios of natural hazards and adversarial threats, terrain/physical plant features, seasonal weather considerations, in-house employee and outside security support available, preparation time available, and other local agencies/entities that may be of assistance when needed. With this planning leaders will gain an understanding of how to adapt to daily situations and identify tactical positives and weaknesses.

Information and intelligence (I&I) function consists of the related tasks and systems that facilitate understanding of possible adversaries, terrain, weather, and other considerations. It is a flexible, adjustable architecture of procedures, personnel, organizations, and equipment. These provide relevant information and products relating to the current threat and environment to planners and decision makers such as:

– Assisting in risk assessments of facility.

– Identify likely avenues of approach.

– Identify an attackers’ scheme of maneuver, i.e. where will active shooter want to go.

– Plan and integrate obstacles.

– Emplace armed security systems if required or desired at tactically advantageous positions.

– Conduct an engagement area rehearsal for security and first responders, i.e. identification of lockdown locations, displacement and evacuation routes to other positions, and evacuation of casualties.

Six factors of planning are:

Mission: After deciding on the essential tasks and purposes a visualization of the interrelationships of the other factors. The goal in this analysis is to clarify what each section or designated groups are to accomplish and why they must accomplish it. Key considerations in this analysis include:

 What is the overall intent?

 What are the overall specified tasks and purposes?

 What are the specified tasks for each scenario that must be accomplished)? (Should align with overall intent, operational issues, tasks to others, and coordinating instructions.)

 What are the implied tasks for the operation? These are other tasks, not specifically noted but must be accomplished during any scenario.

 What are the essential tasks for each scenario? These are all tasks, both specified and implied, that are absolutely required to ensure mission success.

Scenarios of natural hazards and adversarial threats: The analysis of each scenario and possible situations should focus on the following considerations:

 What types of natural hazards and adversarial threats would pose high risks?

 Where are the most probable scenarios?

 What kind of equipment does an adversary have?

 What are possible adversary capabilities and weaknesses?

 Where will the adversary be most vulnerable?

 How is information and intelligence received on an adversary’s possible intentions, objectives, and most probable tactics?

 What can an adversary do in response to our courses of action?

Terrain/Physical Plant features and seasonal weather considerations: Leaders should analyze the terrain/physical plant features using the factors of observation points or OPs (the first echelon of security in the defense that allows for both cover and concealment for in-house employees/security support); other OPs that can be seen by an adversary as a deterrence; obstacles; key terrain features; and avenues of approach. The following are questions to use in analysis:

 Where can an adversary observe and engage the security?

 Where can camera locations or observation posts be established to maximize the ability of in-house employee or security support to see the area?

 What routes within the area offer cover and concealment for the adversary?

 What dismounted routes offer in-house or outside responders the best available cover and concealment?

 Where is the key terrain location or area whose control affords a marked advantage to either security effort or to the adversary?

 How can the key terrain location be utilized to support the mission?

OPs can be executed either mounted (roving in a vehicle) or dismounted (walking or stationary). As they are complementary, if possible they should be used in combination. The main advantage of a dismounted OP is that it provides maximum stealth hopefully preventing the enemy from detecting it. The two main disadvantages are that it has limited flexibility, taking time to displace and limited ability to protect itself if detected. The main advantages of a mounted OP are the flexibility that comes from vehicle mobility as well as the additional ability resident in the vehicle’s protection. The main disadvantage is that vehicles are inherently easier to detect and can prevent the detection of an adversary. To select and secure the OP a leader must determine how many OPs to establish and where they must be positioned to allow long-range observation along the avenues of approach. Ideally, the fields of observation of adjacent OPs overlap to ensure full coverage of an area.

During this process, planners should also identify existing and reinforcing any obstacles (or locations to add an obstacle) that may limit an adversary’s mobility or in retrospect also hinder in-house employee or security support mobility and affect the objectives, avenues of approach, and corridors. Existing obstacles may include:

 Gullies, ravines, gaps, and ditches over 3 meters wide.

 Streams, rivers, and canals over 1 meter deep.

 Mountains or hills with a slope in excess of 60 percent.

 Lakes, swamps, and marshes over 1 meter deep.

 Tree stumps and large rocks over 18 inches high.

 Forest with trees 8 inches or more in diameter and with less than 4 meters of space between trees.

 Man-made existing obstacles, including built-up areas such as buildings outside campus or railroad embankments.

 In public places, areas between parking areas and buildings should be cleared to allow observation and to provide an invitation to non-tactical adversaries to use this avenue of approach. Reinforcing obstacles may include ditches, bollards, or fences. Based on the degree of obstruction posed by obstacles, terrain can be classified in one of the following categories:

 Unrestricted. This is terrain that is free of any restriction to movement; no actions are required to enhance mobility. For vehicles, unrestricted terrain is typically flat or moderately sloped, with scattered or widely spaced obstacles such as trees or rocks. This type of terrain generally allows wide maneuver and offers unlimited travel over well-developed road networks.

 Restricted. This is terrain that hinders movement to some degree. Little effort is needed to enhance mobility, but some vehicles may have to zigzag or make frequent detours. They may have difficulty maintaining optimum speed. For vehicles, restricted terrain typically encompasses moderate to steep slopes and/or moderate to dense spacing of obstacles such as trees, rocks, or buildings. Swamps and rugged ground are examples of restricted terrain for adversaries on foot.

 Severely restricted. Terrain in this classification severely hinders or slows movement of vehicles or individuals walking. Severely restricted terrain for vehicles is typically characterized by steep slopes, densely spaced obstacles, and/or the virtual absence of a developed road system.

The definition of an avenue of approach is an area that provides ease of movement for an adversary to significantly affect the outcome an attack as well as one that enhances timeliness of assistance from responders. Analysis should include considerations of the location of the most favorable avenues of approach for both adversarial and responding support.

Weather conditions should be part of the evaluation of the terrain. The following considerations should be included:

 What seasonal weather changes require adjustments to plans?

 What are the light conditions (including percentage of night illumination) and visibility?

 What are the times for beginning of sunrise, sunset, moonrise, and moonset?

 How has recent weather affected the area?

 Will weather become better or worse?

 How will fog, rain, dust, heat, snow, wind, or blowing sand affect both in-house security and adversaries, and equipment during the mission?

Available In-house employee and outside security support: Analysis of support available for a response includes an assessment of the personnel, vehicles, and equipment. Considerations include:

 Is security personnel armed?

 Are security personnel in uniform?

 What is the present condition of the personnel, vehicles, and equipment?

 What is the supply status of necessary items?

 What is the state of training of the employees, responders, and stakeholders?

 How many key personnel or their substitute are present?

 Is there a need for any additional equipment to support or accomplish the mission?

 Are all substitute or temp employees trained?

 How many observation positions (OPs) can be manned with the available assets?

Preparation Time available: The time available begins with the “one-third/two-thirds” rule of planning and preparation. When preparing daily security or increasing planned efforts for a new threat posture additional planning considerations should include the following:

 How much time is available to plan and conduct reconnaissance of the campus perimeter?

 How long will it take to man OPs, to the initiate lockdown/lockout, and complete alert notifications?

 Is there enough time for rehearsals?

 When will training and exercises be conducted?

 Is there means for all players to provide input at after action reviews (AARs)?

Other local agencies/entities: In his analysis of how the security will handle situations when family, and others who arrive in response after an incident, leaders should assess the following considerations:

 What are the applicable rules of interaction (ROI)?

 What procedures and guidelines to be used in dealing with parents/family; i.e., a reunification plan.

 Will the security be working with other organizations, such as non-law enforcement governmental agencies, private groups, or the media?

 Who will speak to the media?

PREPARATION

The security personnel are in the area before an attack and they should constantly ensure that planned preparations are in place. In the planning phase leaders should have thoroughly analyzed the mission, scenarios of natural hazards and adversarial threats, terrain/physical plant features, seasonal weather considerations, in-house employee and outside security support available, preparation time available, and other local agencies/entities that may be of assistance when needed. From the planning phase, leaders gain an understanding of identifying tactical positives and weaknesses on a daily basis or a current situation.

For example, by being in the area first, the security leaders have the advantage of preparing terrain/physical plant features before an adversarial event. Through the proper selection of terrain and reinforcing obstacles, security efforts can direct the energy of any attack into an area of their choosing in order to engage the attackers or as a delay tactic. If in-house security is not armed the use of obstacles to block, delay, or redirect an attackers’ efforts is extremely important; response time of law enforcement will influence the proper use of obstacles. Leaders must take advantage of this time by making the most thorough preparations possible and to improve any defensive security measures, engagement areas, and survivability positions. Preparation consists of plans for lockdowns; lockouts; movement; law enforcement response plans; preparation of positions, routes, obstacles, logistics, communications, and command and control elements; and personnel reunification. Codes to be initiated that identify plan elements, such as lockdown, lockout, evacuate, etc. should be known by all but it is highly recommended that plain English be used to avoid any misinterpretation or confusion. Any codes should be released only to those who have a need to know.

Using vulnerability information, security on-site is achieved by separating the various zones and corresponding circulation routes. Security personnel, staff, and especially employee entry points are generally placed away from the visitors. Buildings and parking areas should be isolated by providing barriers that have the capability to stop most vehicles. A standoff perimeter could be used to protect from vehicles or improvised explosive devices (IEDs) that could be used to breach buildings. Explosives have been a tactical tool of attackers in some incidents. The leaders must exploit every aspect of terrain and weather to its advantage. In developing a defensive plan, the security responders account for key terrain and observe all possible adversary avenues of approach into their area. The defense seeks to maximize effective cover, concealment, movement, and surprise. Always assume that security preparations are being observed. To hinder adversarial intelligence efforts, leaders should establish counter reconnaissance when exercising or improving physical obstacles.

The goals of a religious facilities’ individual security effort are normally tied to the administration, security, and store manager efforts. These efforts include communicating the discovery of suspicious activity and the early warning tactic that discovered it. All security or defensive plans vary with the circumstances, but all such concepts aim at disrupting an attacker’s plans or synchronization. Counterattacks, obstacles, and the retention of key terrain prevent the adversary from concentrating his strength against selected portions of the facility. In the event of more than one attacker, separating them from one another allows them to be defeated piecemeal. If the facility has armed security available, they must mass the overwhelming effects of that power at the decisive place and time if it is to defeat the attackers. It must obtain a local advantage at points of decision since most attacks have concluded before local law enforcement reinforcements can arrive. Offensive action may be a means of gaining this advantage. Leaders must remember that this massing refers to power and its effects—not just numbers of personnel and weapons. It is of utmost importance that flexibility is practiced and maintained. Flexibility is derived from sound preparation and effective command and control and results from a detailed analysis of the planning factors. Security personnel and/or first responders must be agile enough to counter or avoid the attacker’s blows and then strike back effectively. For example, supplementary positions may provide additional flexibility to the defense. Immediate transitions from defense to offense are difficult. To ease this transition, the leaders must think through and plan for actions that might be needed, and then rehearse them in a prioritized sequence based on time available.

TACTICAL SEQUENCE OF THE DEFENSE

To defend an area certain tactics should be accomplished in a sequence of integrated and overlapping phases. The following phases are within the sequence of the security defense and should be completed daily:

 Security operations.

 Occupation.

 Approach and assault of an adversarial attack.

 Counterattack.

 Reorganization and Reunification.

Security Operations

The outer perimeter should be patrolled prior to start of the business day in order to protect employees and patrons, and allow workers to settle in and secure main area as plans dictate. The goals of a perimeter patrol or reconnaissance personnel include providing early warning, report suspicious activity, identifying any possible adversarial observations, and gathering information on any suspicious person in the area. Additionally, such actions may be conducted periodically as part of the overall daily security operations IAW the defensive plan including manning observation posts (OPs) or monitoring of camera surveillance.

It may be wise, especially on days of expected high traffic, to employ law enforcement to serve as traffic control for the perimeter patrol while monitoring vehicles entering or departing the area. These traffic control efforts may deny likely adversarial attack corridors to enter area at a congested time. This will enhance flexibility and force adversaries into changing plans and drawing attention to them. The same security operation should be considered for close of business traffic tasks to ensure safe and secure departures and that no one has entered area to lie in wait overnight for the next day.

Occupation

The occupation phase of the defense includes moving from the security operations prior to the start of the business day in order to allow employees to secure their individual areas as plans dictate. As outer perimeter tasks withdraw into the main areas it is important that a subtle communication with all elements affirms that everyone is safe, secure, and understand the duties and responsibilities, including priorities of work as it pertains to security plans. Occupation and preparation of the site is sometimes conducted concurrently with in order to ensure an effective and efficient operation. Security should check the primary locations or positions of all elements to verify that they are located IAW the security plan. If there are discrepancies between actual positioning of the elements/classes and the plan, corrections or adjustments should be made. Security leaders should personally walk the area to ensure that everyone understands the security plan to include where the alternate, supplementary, and subsequent positions as well as various rendezvous points are located. It is imperative that the characteristics and considerations of the various positions or locations are understood by all employees that are stakeholders in the security. An alternate position – covers the same avenue of approach or sector of fire as the primary position; located slightly to the front, side, or rear of the primary position; and positioned forward of the primary positions during limited visibility operations. They are also used to fall back to if the primary position is rendered ineffective or as a position for rest if incident is long lasting. Subsequent positions – covers the same avenue of approach and or sector of fire as the primary position; located and identified throughout the area; and occupied based on adversary actions or conducted as part of a scheme of maneuver for evacuation or reassembly of staff. Supplementary positions – covers an avenue of approach or sector of fire different from those covered by the primary position and may be occupied based on specific adversarial actions. Rendezvous points or RPs are locations that are designated for the congregation of evacuated persons in order to account for them. (It is imperative to ensure that RPs is not subject to surveillance or common knowledge outside the “need to know” arena.) Since some employees have not had training in these terms and could be confused, leaders may want touse codes to assign personnel to the desired positions.

Approach and Assault of Adversarial Attack

When an adversary’s attack is discovered and engaged outside the building perimeter, the ability to solidify the inner defense is enhanced by allowing time to effectively use obstacles, tactical protective maneuvers, and armed security when provided. Of course, alert notifications and calls to law enforcement are made immediately when an attack is suspected to be imminent or is in progress. The goal is to use security assets and obstacles to disrupt the attacker’s advance, allow for local law enforcement reinforcements, and thereby increase survivability. Blocking obstacles are used but because they require extensive engineer effort and are employed only at critical choke points, they have not been proven to be feasible in buildings. Obstacles can also provide turning effects that support the planned scheme of maneuver by diverting the attacker from one avenue of approach to another to deny access to areas where personnel have locked down or may be evacuating or repositioning and/or into an engagement area for security or law enforcement. Positions described previously may be shifted in response to the attackers’ actions or other factors. Whether the initial engagement is in outer or inner perimeter area, during an assault, attackers especially if more than one will attempt “fix and finish” any persons resisting them and destroy obstacles in order to pass through. During the execution of the defense, security efforts should mass the defensive effects to deter, repel, disable, or slow to stop the assault. If armed security is available it is necessary that their positions (basically fighting not observation) provide cover. Most observation positions may provide concealment; others are very visible to offer a deterrent effect. However, when an attack begins cover is essential for the security while others should rely on concealment, cover, and light/noise discipline for obvious safety reasons. After an attack begins the leaders must control security operations with standard commands or other prearranged signals.

NOTE: It is important that non-security personnel do not move out of position unless directed or forced to by dangers such as fire, smoke, etc. because it will destroy the integrity of the defense. All movements and actions to reposition elements must have covered and concealed routes when moving to alternate, supplementary, or subsequent defensive positions and be thoroughly rehearsed. By rehearsing, elements can increase the speed at which it moves and provide an added measure of security. A concerted effort should be made whenever time is available to rehearse movement in limited visibility and degraded conditions.

Counterattack

It is always hopeful that law enforcement will arrive for a counterattack whether on site security is armed or not. The counterattack purpose is to seize the initiative from the attacker or to completely halt his attack and restore safety and security control of the area. The law enforcement actions must be planned, trained, and exercised by law enforcement from all responding agencies with all officials at each location in the jurisdiction. Maps and floor plans of all locations should accompany all training to familiarize officers with the areas and be available to agency dispatchers that can advise and guide officers. It is of utmost important that officials, while trained on actions to take before and during initial attack moments, also know what to do/not do when law enforcement and other first responders arrive.

REORGANIZATION AND REUNIFICATION

Once the area is secure security should reestablish the defense positioning and accounting for all elements, treating and evacuating casualties, processing of law enforcement prisoners, and reestablishing obstacles. Administration should conduct all necessary sustainment functions and prepare to continue security during this vulnerable time. Concurrently, the Standard Reunification Method, a critical aspect of crisis response that is the accounting for and reunification of employees and patrons with parents/family, spouses, or friends in the event of a crisis or emergency, must be initiated. The Standard Reunification Method provides safety teams with proven methods for planning, practicing and achieving a successful reunification. This evolving artful process practices can be integrated into security and safety plans but site-specific considerations will impact how it is accomplished. Successful planning and implementation also demands partnerships with all responding agencies participating in a crisis response. Reunification and recovery efforts starts with the crisis, not after, and “winging it” with reunifying ignores both the mental health demands which accompany an event and the responsibility of maintaining the chain of custody for every person. A predetermined, practiced reunification method ensures the reunification process will not further complicate what is probably already a chaotic, anxiety-filled scene.

SUMMARY

We must “make it hard to hurt us.” Active shooter incidents in a public places such as religious facilities produce feelings of vulnerability and anxiety in all of us. There are currently more than 46,000 religious facilities in the U.S. and hundreds in Louisiana. At a meeting of the Louisiana House Select Committee on Homeland Security, law enforcement officials from around the state told lawmakers that it’s only a matter of time before an active shooting incident occurs. They key, they said, is to have religious facilities prepared for such an event and have quick decisive action to end it. “It’s not a matter of ‘if’ something will happen in Louisiana,” State Police Col. Mike Edmonson told the House committee. “It will.”

While it is believed that copycat behavior is very common, a “profile” of the shooter or a checklist of danger signs does not exist. Although given that there is no accurate profile of an “active shooter”; in most cases these persons do exhibit some behavior that causes concern prior to the incident. It is of the utmost importance that prevention strategies advertise and encourage the quick reporting of concerns and suspicious activity.

Risk assessments with analysis of consequence, vulnerability, and threat should be the first priority. It is important for all of us to be proactive. We must remain vigilant, encourage others to be alert, and share information. The real first responders at a shooting are administrators and store managers/clerks and illustrates the importance of procedures, systems, and training designed to prevent any attack by mitigating the risks from active shooters. Note that the mitigation of risks implies that deterrence, mitigation, and prevention are the goals and that any loss of life as a consequence is unacceptable.

If armed security is to be used, planning and training the specifics to personnel is of utmost

importance; if not used all efforts should be aimed at early warning, securing the area, and use of

obstacles to delay attackers long enough for law enforcement to respond. The mission is to prevent

an attack by deterring, interrupting, repelling, or defeating a plan or an actual attack and thereby

protecting the congregation, the staff, and administrators.

ANNEX L: SOURCES

https://www.nola.com/news/crime_police/key-updates-bourbon-street-attack/article_10c37d9c-cc8b-11ef-bdc8-cfbd6abf0a2d.html
https://www.cbsnews.com/news/intelligence-report-warns-of-rising-foreign-terror-threats/
https://www.cnn.com/2021/09/28/us/shreveport-louisiana-crime-spike/index.html
https://www.dni.gov/files/NCTC/documents/jcat/firstresponderstoolbox/NCTC-FBI-DHS_Vehicle-Borne_Attacks-_Tactics_and_Mitigation-survey.pdf
https://www.dni.gov/files/NCTC/documents/jcat/firstresponderstoolbox/First-Responders-Toolbox—Planning-Promotes-Effective-Response-to-Open-Access-Events.pdf
https://247wallst.com/special-report/2019/10/23/americas-most-dangerous-cities/
DHS/FBI/NCTC, Joint Intelligence Bulletin (JIB), Targeting of Law Enforcement by Domestic and Homegrown Violent Extremists, 12 October 2018.
Marc Santora, William K. Rashbaum, Al Baker, and Adam Goldman, “Ahmad Khan Rahami is Arrested in Manhattan and New Jersey Bombings,” The New York Times, September 19, 2016.
http://www.defensenews.com/story/defense/policy-budget/warfare/2015/07/28/us-militarys-bomb-techs-fear-flying-ieds/30747275/
http://abcnews.go.com/International/thousands-online-isis-followers-inside-us-homeland-fbi/story?id=30882077
http://content.time.com/time/specials/packages/article/0,28804,1882967_1882966_1882949,00.html
http://www.latimes.com/local/california/la-me-1206-policing-20151206-story.html
The Guardian; “London Bridge: attacker had been jailed for al-Qaida inspired bomb plot”; 29 November 2019 https://www.theguardian.com/uk-news/2019/nov/29/london-bridge-police-shoot-stabbing-suspect-after-five-injured.
The Washington Post; “Driver rams into Tokyo New Year’s crowd, injuring 8, in anger over ‘death penalty,’ police say”; 01 January 2019; https://www.washingtonpost.com/world/asia_pacific/driver-rams-into-tokyo-new-years-crowd-injuring-8-in-anger-over-death-penalty/2019/01/01/2fe04d20-0d8a-11e9-92b8-6dd99e2d80e1_story.html.
Firstpost; 22 Nov 2021; From Nice in 2016 to Wisconsin in 2021: How ramming vehicles into crowds has become a deadly terror tactic; https://www.firstpost.com/world/from-nice-in-2016-to-wisconsin-in-2021-how-ramming-vehicles-into-crowds-has-become-a-deadly-terror-tactic-10155121.html
Bidgood, Jess; Boston Globe; 31 Oct 2021; In Harm’s Way – The car becomes the weapon; https://apps.bostonglobe.com/news/nation/2021/10/vehicle-rammings-against-protesters/tulsa/
http://www.latimes.com/nation/la-na-terror-threat-20150518-story.html
Wisconsin STIC 2022 Report.
http://www.rand.org/content/dam/rand/pubs/conf_proceedings/CF300/CF317/RAND_CF317.pdf
Bruce Hoffman, Edwin Meese III, and Timothy J. Roemer, “The FBI: Protecting the Homeland in the 21st Century,” FBI, March 2015, p. 83, 94, 111, http://www.fbi.gov/stats-services/publications/protecting-the-homeland-in-the-21st-century.
http://www.isn.ethz.ch/Digital-Library/Articles/Detail/?lng=en&id=180139
https://www.dni.gov/files/NCTC/documents/jcat/firstresponderstoolbox/NCTC-FBI-DHS_Vehicle-Borne_Attacks-_Tactics_and_Mitigation-survey.pdf
https://www.dni.gov/files/NCTC/documents/jcat/firstresponderstoolbox/First-Responders-Toolbox—Planning-Promotes-Effective-Response-to-Open-Access-Events.pdf
New York Police Department (NYPD). (NOV 2019). NYPD Shield: SETA
TRADOC G-34, Overnight Protection Bulletin, 15 August 2018.
http://www.bignewsnetwork.com/index.php/sid/234255227
http://www.latimes.com/nation/la-na-terror-threat-20150518-story.html
http://www.isn.ethz.ch/Digital-Library/Articles/Detail/?lng=en&id=180139
DHS/I&A Homeland Counterterrorism Division-Mehsud’s Threats to the Homeland

Consistent with Other Calls to Arms.

Homeland Security Bureau, SEFL Fusion Center, 9/11 Anniversary Bulletin, 19 AUG 2014.
http://cnsnews.com/news/article/al-qaeda-propagandist-called-attacks-sports-events
http://abcnews.go.com/blogs/politics/2014/04/rep-peter-king-us-sporting-events-going-to-be-targets-for-terrorists/
http://www.dailymail.co.uk/news/article-2587196/Jihadists-told-target-Queen-high-profile-sporting-events-series-lone-wolf-attacks-including-Wimbledon-FA-Cup-matches.html
http://content.time.com/time/specials/packages/article/0,28804,1882967_1882966_1882949,00.html
http://news.nationalgeographic.com/news/2013/03/130415-sports-marathon-olympics-bombers-culture/
http://www.defensenews.com/story/defense/policy-budget/warfare/2015/07/28/us-militarys-bomb-techs-fear-flying-ieds/30747275/
http://abcnews.go.com/International/thousands-online-isis-followers-inside-us-homeland-fbi/story?id=30882077
http://www.foxnews.com/politics/2015/05/08/pentagon-put-on-elevated-alert-level-amid-recent-threats/
9/11 Commission (2004). Final report of the national commission on terrorist attacks upon the United States. Washington, DC: National Commission on Terrorist Attacks.
Elliot, M. (2002, February 16). The shoe bomber’s world. Time. Retrieved February 9,

2010 from http://www.time.com/time/world/article/0,8599,203478-1,00.html

Goldthorpe, J. H. (1997). Current issues in comparative macrosociology: A debate on methodological issues. Comparative Social Research, 16, 1–26.
Hess, P., & Gearan, A. (2009, November 21). Levin: More e-mails from Ft. Hood suspect possible. Associated Press. Retrieved February 9, 2010 from

http://abcnews.go.com/Politics/wireStory?id=9143884

“Efforts by NY Jews to unify and fight violent anti-Semitism undone by pandemic.” The Times of Israel, September 30, 2021. https://www.timesofisrael.com/efforts-by-ny-jews-to-unify-and-fight-violent-anti-semitism-undone-by-pandemic/

http://report.heritage.org/ib4384 David Inserra, a Research Associate for Homeland Security and Cyber Security in the Douglas and Sarah Allison Center for Foreign and National Security Policy, of the Kathryn and Shelby Cullom Davis Institute for National Security and Foreign Policy, at The Heritage Foundation.

http://www.latimes.com/nation/la-na-terror-threat-20150518-story.html

Department of Homeland Security, “Fusion Center Locations and Contact Information,” January 9, 2015, http://www.dhs.gov/fusion-center-locations-and-contact-information (accessed April 10, 2015), and Federal Bureau of Investigation, “Protecting America from Terrorist Attack,” http://www.fbi.gov/about-us/investigate/terrorism/terrorism_jttfs

Field Analysis Report (FAR); Southern Nevada Counterterrorism Center (SNCTC), DHS I&A, DHS NPPD OCIA, Counterterrorism Mission Center; Las Vegas: Recent Rooftop Breaches Highlight Continued Vulnerability to Elevated Attacks; Possible Tactics to Gain Unauthorized Access.

https://www.theguardian.com/cities/2015/feb/17/rooftoppers-urban-explorers-risk-photographsskyscrapers-bradley-garrett; accessed on 19 JUL 2018.

SNCTC: Suspicious Activity Report 20180426_1014; published on 26 April 2018; Roof access door damaged at Four Queens. Suspicious Activity Report 20180502_1520; published on 2 May 2018 “Unauthorized subject attempts to access hotel roof”. Suspicious Activity Report 20180415_0709; published 15 April 2018; “Subject located on roof area of local casino hotel property”. Suspicious Activity Report 20171024_1608; published on 24 October 2017; “Take photos for social media posting”.

LVMPD: Preliminary Investigative Report; 18 JAN 2018; DOI 01 OCT 2017; (U); 01 OCT 2017 Mass Causality Shooting. Preliminary Investigative Report; 18 JAN 2018; DOI 01 OCT 2017; (U); 01 OCT 2017 Mass Causality Shooting.

https://www.youtube.com/watch?v=F4XERm6eR4o

https://www.quora.com/In-urban-settings-what-are-some-best-positions-for-sniper

https://www.texasmonthly.com/category/topics/ut-tower-shooting/

http://www.globalsecurity.org/military/library/policy/army/fm/7-8/ch1.htm#s2p8

2018 Update to Risk Mitigation and Prevention of Active Shooters in Schools MAY 22, 2018.

http://www.latimes.com/nation/la-na-texas-shooter-20180519-story.html; https://www.njhomelandsecurity. gov/active-shooter-response; http://www.dhs.gov/active-shooter-preparedness; http://rems.ed.gov/docs/ ThreatAssessmentinSchools.pdf; https://www.dhs.gov/stopthebleed; https://www.dhs.gov/topic/cybersecurity; http://www.dhs.gov/sites/default/files/publications/dhs-active-shooter-preparedness-program-fact-sheet-01-16-508.pdf; https://www.dhs.gov/active-shooter-preparedness; https://everytownresearch.org/school-shootings/#2905; https://thinkprogress.org/school-shootings-2018-e139b247474e/

NYPD SHIELD: “High School Shooting in Santa Fe, Texas”, NYPD Counterterrorism Bureau, 18 MAY 2018.

U.S. Army FM 7-8, Chapter 5, Section 1-8c-e Defense and Section 1-9c Security, https://suntzusaid.com/index/position Pittsburgh Synagogue Shooting Incident, Intelligence Dissemination Report, Office of the Regional Operations and Intelligence Center (ROIC) Threat Analysis Unit Office of the ROIC, 27 October 2018.

NYPD SHIELD, NYPD CT Bureau, Open Source Assessment; October 27, 2018.

https://securecommunitynetwork.us17.list-manage.com/track/click?u=0b3c7e1421bd2734b0610a1fb&id=9e5fd6c89d&e=685af2c03d

http://www.vocativ.com/386579/isis-lists-u-s-churches-to-attack-during-the-holidays/.

http://www.cbsnews.com/pictures/charleston-south-carolina-church-shooting/.

http://ktla.com/2015/09/20/father-allegedly-shoots-newborn-girlfriend-and-pastor-in-alabama-church/.

DHS I&A Protective security Coordination Division, Potential Indicators, Common Vulnerabilities, and Protective Measures: Religious Facilities; April 2014.

Maryland, [http://www.mcac.maryland.gov/how_to_help/TerrorismIndicators.html]

NJOHSP, n.d., “Terrorism Indicators: Eight Signs of Terrorism.”

http://www.njhomelandsecurity.gov/press-room/publications.html.

http://copycateffect.blogspot.com/2015/06/church-list.html.

http://www.defensivecarry.com/forum/general

http://www.defensivecarry.com/forum/general-firearm-discussion/98256-18-church-shootings-11-years-comprehensive-list.html

Gunman kills 11 in Pittsburgh synagogue massacre investigated as a hate crime. Washington Post. 27 October 2018.

Pittsburgh Synagogue Shooting: At Least 11 Dead and Gunman Identified. The New York Times. 27 October 2018.

11 people killed in Pittsburgh synagogue shooting, official says. CNN. 27 October 2018

Pittsburgh synagogue shooting: 11 dead, suspect in custody. ABC. 27 October 2018.

http://www.newsweek.com/us-sends-warning-european-travel-715023

Louisiana House of Representatives Homeland Security Committee meeting reports: http://www.thetowntalk.com/article/20130118/NEWS01/301180314/State-Police-chief-Attack-will-happen-Louisiana-school

FM-8 chap 8 Defensive Operations, Section I – Characteristics of the Defense; http://www.infantrydrills.com/

Florida Fusion Center Network (FFCN), Joint Intelligence Bulletin, 2021 Winter Holiday Advisory, November 23, 2021 – December 31, 2021.

A Guide to mall Vulnerability Assessments, Key Principles for Safe malls U.S. Department of Education. Office of Safe and Drug-Free malls; 2008.

“2021 Holiday Shopping Ecommerce Stats & Trends.” ROI Revolution – Blog, 20 September 2021.

https://www.roirevolution.com/blog/2021/09/2021-holiday-shopping-ecommerce-stats-trends-june-2021/

“Holiday Online Shopping Tips” Cybersecurity & Infrastructure Security Agency, 20 September 2021. https://www.cisa.gov/sites/default/files/publications/Holiday%20Online%20Safety_tip%20sheets_2020-v5-DW_508%20pobs.pdf

“2021 Report on Package Theft in America.” DeliverySafe, 20 September 2021. https://deliverysafe.com/blogs/news/2021-report-on-package-theft-in-america

“Knife attacker in Nice kills three people.” The Guardian, 30 September 2021. https://www.theguardian.com/world/2020/oct/29/knife-attack-in-nice-france-people-killed-church

“Woman pleads guilty to terror charge on train tracks.” AP News, 30 September 2021. https://apnews.com/article/canada-business-2b6c59e727bb907de88013f026445b1d

“Douglas teen arrested for alleged bomb making activities.” Douglas Dispatch, 20 September 2021. https://www.myheraldreview.com/news/douglas/douglas-teen-arrested-for-alleged-bomb-making-activities/article_65fb4960-b589-11eb-b986-df8f1f474a07.html

https://abcnews.go.com/US/powerful-bomb-suggests-suspects-jersey-city-kosher-market/story?id=68245368

“Strasbourg shooting: What we know.” BBC News, September 30, 2021. https://www.bbc.com/news/world-europe-46535862

“Newton gunman Adam Lanza USPER had obsession with Columbine.” BBC news, 30 September 2021. https://www.bbc.com/news/world-us-canada-25097127

“Berlin Lorry Attack: What we know.” BBC News, 30 September 2021. https://www.bbc.com/news/world-europe-38377428

“FBI: Nashville bomber driven by conspiracies, paranoia.” ABC news, 29 September 2021. https://abcnews.go.com/Politics/wireStory/fbi-nashville-bomber-driven-conspiracies-paranoia-76468250

“ROOFTOP” SECURITY and DISPLACEMENT

2 JULY 2020

In Sun Tzu’s “The Art of War”, military leaders are advised to take high ground and let the enemy try to attack from a lower position. Attacks from an elevated position can provide a potential violent individual an unobstructed view of a possible target area. During an attack, a higher vantage point could be used to conceal an actor’s location from law enforcement, delay emergency response times, and cause confusion as to the direction of the threat. This makes the current training of what to do in an active-shooter situation, i.e., “run, hide, fight” less effective since it is difficult to determine from where the shots may be coming. Also victims on the ground are not afforded access to adequate cover due to the shooter’s elevated position and vantage points.
Hollywood has given a really screwed up misconception of snipers. Snipers do not sit with their guns hanging out of a window and a long range shot is not one block or two blocks, it’s about 8 or 9 blocks or 600 to 900 yards. If a shooter is up high from a window or rooftop they can see down the street they do not have to hang over a window sill or the edge of the rooftop to see those distances down a street. Snipers want to see and not be seen, so they can kill and not be killed. Rooftops are the ultimate elevated perch for shooters. Rooftops can provide concealment for a shooter and an unobstructed view of a target area while delaying emergency response times, cause confusion on the direction of the threat, and limit areas of cover.
Fifty-two years ago on August 1, 1966, Charles Whitman climbed to the top of the University of Texas Tower observation deck with three rifles, two pistols, and a sawed-off shotgun where he shot 43 people and killed thirteen. From an elevated tactical position, former Marine Whitman introduced the nation to the idea of mass murder in a public space: With this knowledge everyone should be concerned about elevated locations that can provide a potential violent individual an unobstructed view of a possible target area. On July 7, 2016, in Dallas and October 2017 we were again reminded when mass shootings came from a high vantage point that concealed the shooters’ location from law enforcement, delayed emergency response times, and caused confusion as to the direction of the threat.

In all cases, trespassers seek to exploit open security vulnerabilities as corporations, particularly those in the hotel and resort industry seek to strike a balance between ensuring appropriate security measures to protect people and property, as well as providing friendly and caring customer service. Some of the tactics used by individuals attempting to gain access to “rooftops” and other restricted areas are:
Social Engineering – Use of deception to manipulate individuals into providing access to a location or divulging confidential information, such as the names of employees, security procedures, or site vulnerabilities. Information provided could also be used to enhance an individual’s credibility to gain access to a location or explain the presence if challenged by security or law enforcement.
Tailgating – Following an employee with access privileges into a restricted area. This is most likely to occur in resorts that allow employee access to the rooftops for breaks.
Breaking and Entering – Criminal act of entering an enclosed area through the slightest amount of force even access to a rooftop by merely pushing a door open without authorization. Properties that use the rooftop as an emergency exit are particularly susceptible to this tactic, as fire codes may prohibit properties from locking emergency exit doors.
Unauthorized Access – Entering a restricted area from an adjacent public space. In this case, there may also be little or no security warnings (e.g., “Restricted Access”, “Do Not Enter”, or “Employees Only” signs) in place to prevent unauthorized access from the public area.
Pretexting – The creation of a plausible but fabricated scenario explaining why an individual is in a restricted area if he or she is intercepted by security or law enforcement. This may also involve impersonating an employee or a contractor who requires access to a restricted area, or the use of uniforms, clothing, or badges resembling those worn by facility personnel.
Testing or Probing of Security – Deliberately interacting with or challenging security in order to test the strengths and vulnerabilities of security systems and personnel at a site by engaging in overtly suspicious actions to provoke and observe responses by security or law enforcement officers.
Online Surveillance – Leveraging publicly available information on the internet to gain insight on a potential target to support pre-operational planning efforts. This includes the use of internet search engines for various kinds of information (e.g., maps, company photographs, or logos) and social media sites and blogs for additional details about a facility’s layout or security procedures.

DISPLACEMENT OF VULNERABILITIES
Crime displacement is the relocation of crime from one place, time, target, offense, or tactic to another as a result of some crime prevention initiative. Spatial displacement is by far the most commonly recognized form, though the other four are also frequently acknowledged by those studying crime prevention effects. Formally, the possible forms of displacement are:
• Temporal – offenders change the time at which they commit crime;
• Spatial – offenders switch from targets in one location to targets in another location;
• Target – offenders change from one type of target to another;
• Tactical – offenders alter the methods used to carry out crime; and
• Offense – offenders switch from one form of crime to another.