Brussels was hit in two different locations approximately seven miles apart by multiple attackers. We have at least one confirmed suicide bomber, an AK-47 and reports of Arabic spoken prior to the attack. We have “suspicious packages” reported at the royal residence and one other government building which are in the process of being dealt with by explosive ordinance teams.
At about 8:00AM local time, a suicide bomber approached the security checkpoint at Zaventem airport and detonated his explosives. He did not pass the internal security zone and detonated in the crowd cueing at the check in desks near the entrance to the internal security checkpoints. Reports of shots being fired prior to detonation have been reported, but not confirmed. An AK-47 is reported to have been found near the scene. 10 people are currently reported dead and 100 injured.
Surveillance video reveals three men, one of whom left prior to detonation indicating the second and third bombers were quite likely suicide bombers.
We have less information about the Maelbeek metro station attack. It occurred approximately an hour after the attacks at the airport. This attack was focused on the center car of a three-car train in the subway, which is reported to have been just pulling away from the platform. 20 people are reported dead and 130 injured.
What that tells us:
It is nearly impossible that these attacks were carried out by a single attacker, and the only reasonable assumption is that it was a coordinated attack. That tells us we are dealing with a terrorist cell and not a lone wolf or disgruntled employee. Multiple attackers indicate collusion, which rarely happens with out extensive planning, secrecy and a long history of anti-government sentiment. We are not dealing with a few angry locals who happened to get together in a chat room and put this together.
It was a complex attack meaning we have more then one type of weapon involved. That tells us we are dealing with a sophisticated logistics network, which is able to source explosives, weapons and ammunition. This requires different contacts, different ratlines, and different procurement security practices. AQ and ISIS are the likely organizations with the desire, expertise and capability to pull this off.
There is evidence of extensive training. The attackers were capable of operating both remote detonated (potentially timed and active) as well suicide explosives, and firearms as well. That does not mean each individual had to have all of those skills, but at some point in that chain, there is one planner or central figure who put the people with those skills into motion. Further, this is not training you can get outside of specialized military and law enforcement units and unfortunately, terrorist organizations. The trainer or trainers are very likely to have come from conflict zones like Syria, Iraq, Chechnya, Afghanistan, etc… The safe bet is on ISIS or Al Qaeda. (Update – ISIS claimed responsibility this afternoon).
The attacks occurred at times and locations when the expected number of potential casualties would be maximized which is evidence of specific planning. The blast in the subway was focused on a moving center car (the location it is most likely to cause maximum damage) and random timing is highly unlikely to have been as effective. This adds an additional level of complexity in that we see some of the package bombs failed to detonate. Based on the accuracy, we have to assume that this one was actively detonated. A suicide bomber is the likely mechanism, however, if the package was placed and remotely detonated, we have yet another level of sophistication.
Lastly, the placement of secondary explosives inside the airport was placed to impact people running from the primary explosive. While a common tactic employed by ISIS / AQ / and a few terrorist organizations, it another indicator of training and planning.
What We Do with this Information:
Prediction is the key to resource allocation of security forces. It is completely unsurprising that an airport and subway were the targets of the attack. Anywhere crowds are likely to gather where security can be predicted or accounted for is a likely target. Enhanced “random” patrols and counter surveillance are the only feasible means of providing persistent, unpredictable presence at these locations. Theses measures are expensive, time consuming and quite likely to be inadequate, but it is the first line of defense.
The long term solution to this problem is engaging the public to become observers and reporters of suspicious behavior. Educating private citizens to recognize the attack cycle, perform surveillance identification what pre-incident indicators to look for are the keys to accurate reporting. If we can engage the public as the eyes and ears of the police, police can focus on pattern identification, link analysis and sifting through the volume of false reporting they would expect to receive, and investigating and interdicting. The volume of reporting and observation requires a constant, persistent presence, but to dedicate professionals to trying to be present and engaged at the key moment and at the key time is far too expensive to be effective. Ultimately, it is a very poor use of public resources.
Prevention is based on the identification and linking of the indicators prior to the attack occurring. That requires functioning reporting processes, analysis, and the ability to act on the information via a streamlined warrant or authorization process. Next, you need credible forces with the equipment and training to interdict on standby. Interdiction may consist of raids to capture material or personnel crucial to the attack, or it may be and information collection mission to explore the network of supporters, planners and actors.
The larger the network of informants, the better able our analysts become at vetting and differentiating between credible and unreliable reports. It provides interrogators a means of sourcing information from would-be perpetrators. This network is being built in every country on the planet, however, western culture is so reticent to collect on religious organizations, be accused of “racial profiling”, or be called fascists that they fail to do so in large enough scale to be effective. That needs to change.
Response is the final and least preferable option. After a suicide attack is in progress, the ability of even the most well placed responder to stop the attack is almost zero. Typically dead-mans triggers are employed (meaning a lever or button is pushed, a safety removed and when the lever or button is released, the device detonates). This means that a highly effective response results in a detonation with less people then perhaps was intended, but it does not stop the attack.
As a society, we spend an inordinate amount of effort on response. We can measure police trained, equipment sourced and man hours dedicated to the problem. We miserably fail at prediction and prevention portion of the equation in this case. It is nearly impossible to develop a response option that is robust enough to stop an attack in progress, and yet we continue to attempt to do so. Making this fundamental shift in our approach to safety and security requires the participation of a portion of society in the process, but it is the only feasible means of putting enough collectors on the street to be effective.
DHS has been putting this information out in the form of “if you see something, say something”, but sadly, they have not put the education component into the equation. Ultimately, it’s a good practice, but has become cannon fodder for morning talk show jokes for the most part. Regardless of where that education occurs, public outreach, high schools or a citizens academy, every person we educate produces a safer, more secure community at a much lower cost then our current practices.
~ Aegis Academy