Risk Assessment: Vehicular Attacks


Initial reports on the Times Square incident last week—which killed one person and injured twenty-two others—were quick to question whether or not it was an act of terrorism. As the situation unfolded and details began to emerge, the incident was quickly determined to be accidental and not intentional. Though no less tragic, the incident did serve as another reminder of the global terrorist threat and was eerily reminiscent of the truck attacks in Nice and Berlin.

The Times Square incident last week reminded me of the reactionary measures that often arise post-crisis. After the 9/11 attacks the United States saw a dramatic increase and strengthening in the physical security of government facilities and critical infrastructures, such as airports and public utilities.

In this article I wanted to talk about the threat of non-explosive vehicular attacks (i.e., not SVBIEDs) and the defense of pedestrian spaces, and how the contraction of ISIS’s physical caliphate is likely to stimulate an increase in external attacks. While this cause and effect pattern is not new, I think it is important to talk about the steps that can be taken now to prevent and mitigate the damage from the next terrorist attack. And there will be another attack.

ISIS’s External Operations

As the Islamic State continues to lose ground in Iraq and Syria, some security and terrorism experts warn that remaining members of the group are likely to return to their roots as a clandestine, guerrilla organization. In fact, ISIS’s emphasis on external attacks—both in its actions and its propaganda—show that this shift is already underway; as the group loses more territory, inspired/directed attacks in the United States and Europe have increased. (For related reading, the Combating Terrorism Center at West Point has released several articles chronicling the coalition’s strategy for containing ISIS fighters in Mosul and how this strategy intends to prevent future external attacks.) Conversations about contemporary CT strategies integrate

The security raids that followed the Reina nightclub attack in Istanbul earlier this year uncovered an extensive network of financial, material, and personnel support that was previously unknown to Turkey’s counterterrorism officials. Many CT analysts view the evidence from the Reina nightclub attack as further proof that ISIS is putting greater resources into its external operations.

For the sake of simplicity, foreign attacks can be divided into two categories: those that are directed and those that are inspired by an organization. While an entire book can be written about the meaningful differences between directed and inspired attacks, this article isn’t that.

Typically, the spectacular attacks are planned, directed, funded, and carried out by ISIS operatives. This is because the operatives who ISIS sends overseas are more experienced, better trained, better funded, and usually very highly skilled. The Paris attack (2015) is an example of this. The so-called lone wolf attacks are self-explanatory: Inspired by ISIS’s doctrine and its leader but not associated in any tangible way with the group itself. Omar Mateen, the Pulse nightclub (2016) attacker, is an example of this.

As the Islamic State continues to contract, the group’s media and external operations wings have also ramped up their efforts. The objective for ISIS, looking ahead, is to promote solo jihadist attacks abroad while also increasing efforts to direct and launch attacks of their own. As others have written, ISIS’s ability to fight a defensive urban war does not necessarily translate into having an equal capacity to launch similarly lethal clandestine attacks against foreign targets. This disconnect in capability is one reason why low-cost tactics like car attacks are becoming more popular.

Now, from a strategy piece, ISIS has seemingly tracked well alongside the works of Abu Bakr Naji and Abu Musab al-Suri. For those of us familiar with their work, we are well aware of Naji’s and al-Suri’s individual contributions to Islamist militant strategy. For those who are less familiar, here’s a brief overview of their teachings and and how they can help us look ahead and inform domestic homeland security strategy. For those who are already informed, skip ahead.

Abu Bakr Naji

Abu Bakr Naji, a nom de plume as the real identity of the author has never been confirmed, is most famous for his writing of the “Management of the Savagery,” a long epitome that lays out Naji’s plans for building a caliphate. What is important to know about Naji and his influence on jihad is that he is a pragmatist who seems to preach revolutionary jihadist ideology, with some reference to global jihad. Though much of his work talks about state-building and civil administration, the relevance of Naji’s doctrine to this conversation is that he recognizes the utility in targeting western-linked places. By attacking soft targets—such as clubs, restaurants and theaters—similar venues around the world would theoretically be compelled to increase their financial spending and resources to ensure security; the 2002 Bali and 2016 Pulse nightclub attacks are two examples. For example, after the attacks in Paris, Washington, DC restaurant and nightlife association members were invited by the Department of Homeland Security and the FBI to attend a briefing on how to prepare for terrorist attacks.

This soft-target strategy is the the first part of Naji’s three-step plan for establishing an Islamic state, which he describes in detail, and which he calls the “power of vexation and exhaustion against an enemy.” Attacking soft targets has the power to exhaust an enemy’s forces, deplete and disperse their resources, and attract new recruits. This seems to characterize ISIS’s current strategy and is reflected in the coordinated Paris attacks in 2015.

Abu al Musab al-Suri

Whereas Naji emphasized state-building and administration, Abu al-Musab al-Suri preached the opposite. Al-Suri is sometimes referred to as the “architect of jihad” because his emphasis on urban terrorism reflects the character of jihad that we are familiar with today. The crux of al-Suri’s argument is that jihad should be decentralized, in contrast to Naji, and that solo jihadist work is a great low-cost way to maintain momentum within a movement.

The upside of al-Suri’s strategy is that anyone can participate and contribute to jihad. The downside is that individuals often lack substantial capability to carry out attacks on their own; after all, it takes skill and experience to construct a bomb vest that is stable enough to be deployed in the field. We saw this last year, again, in the Paris and Brussels attacks. The geographic spread of the Europe Union and its relatively porous borders—combined with the recent flood of migrants and refugees—allowed experienced ISIL operatives to infiltrate the European heartland and build suicides vests in Europe to use in attacks. The United States doesn’t suffer to the same degree and has the benefit of having greater domestic surveillance and reporting programs that prevent the bulk acquisition of explosive material. Thus, it is extremely difficult and unlikely that ISIS would be able to launch an equally sophisticated attack in the US homeland. It is for these reasons, in part, that ISIS has promoted lone wolf attacks and is why vehicular attacks have become more common.

The High Per-Attacker Lethality of Vehicular Attacks

The number of vehicular attacks has increased over the last several years, with notable incidents such as the 2014 attack in Dijon, the 2016 attacks in Nice, Berlin, and Ohio, and most recently the 2017 attacks in London and Stockholm. Those attacks showed that homegrown terrorism is a continued threat and terrorist plots do not need to be elaborate to be effective.

The Nice attack was particularly lethal (due to the dense Bastille Day crowds and the relatively open space of the promenade) with 87 deaths and over 400 injured. This is even more remarkable given that it was carried out by a single individual, though other associates were later arrested by French security forces. The Paris attacks in 2015, though more deadly in absolute terms, was carried out in coordination by a team of nine individuals and was far more sophisticated in its planning and execution.

To compare the lethality of the two, the Nice attack was greater because the per-person-body-count was far higher at 87 deaths per attacker with 434 wounded; by comparison, the Paris attack would have had to claim 783 lives and injured almost 4,000 in order to have a parallel “success” rate. The point is, ceteris paribus, the Paris attackers would theoretically have had greater success if they had instead opted for a simpler attack using only cargo trucks.

Overall, the results satisfied the Islamic State. For them, the Nice attack was successful because of the significant number of casualties; the Paris attack was successful not only for its number of casualties but also (and maybe more importantly) because of the psychological terror the coordinated attacks brought against the French people and the world.

Function Over Form

Whereas al-Qaeda prefers carrying out spectacular attacks against its targets, the Islamic State has for the most part embraced small-scale, low-intensity tactics. It is not necessary for every mujahideen or sympathizer in the west to plan and execute attacks like Paris or 9/11; simpler attacks like the ones in London and Nice are just as effective. Though the use of vehicles in carrying out an act of terror is nothing new—indeed, they have previously been used as car bombs, transports, ramming devices to breach barriers, or as a weapon itself—the use of them as ramming tools in densely populated urban areas has become increasingly prominent in ISIS speech and tactic.

In the most recent issue of Rumiyah, ISIS’s English-language publication which replaced Dabiq in late 2016,* the Islamic State dedicated an entire section to weapons procurement, titled “Just Terror Tactics,” in which it identified vehicles as an excellent opportunity for exploitation. In addition to using vehicles as rams to breach firearms shops in order to steal weapons (pg. 46, Rumiyah, Issue 9), ISIS also gave recommendations for identifying the ideal vehicle, how to acquire a vehicle, and ideal targets, all with the purpose of helping ISIS-sympathizers carry out a Nice-syle attack.

Two things are made clear in Rumiyah: acquiring a vehicle, especially in the United States, is extremely easy; and trucks are far more lethal than sedans or SUVs when they are used to plow into crowds of people. This combination of ease-of-access and high lethality has prompted some European governments to install concrete barriers in public spaces, Berlin and Nice as examples. In the United States, highly visited public spaces like Times Square are frequently outfitted with anti-ram steel bollards.

In the case of last week’s Times Square incident, despite it not being a terrorist attack, the role of a car to kill and injure people had a similar outcome to vehicular attacks like Westminster, but it of course lacked the ideological motive. The purpose of the comparison is to highlight the need for an increase the defense of public pedestrian spaces, which can prevent accidental deaths and damage, and thwart intentional attacks.

In photographs of the scene by CNN, the Times Square driver’s Honda Accord could be seen lifted into the air by high security steel bollards. It was reported in CNN’s breaking news article that “the sidewalks around Times Square are secured with more than 200 steel bollards intended to prevent accidental or criminal vehicle intrusions…the bollards are designed to stop vehicles going about 30 miles an hour.” That might be sufficient to defend against a (potentially) inebriated driver, but can they repel a hostile attack? Can they defend against a 7.5-ton cargo truck? What about 20-ton trucks? The Times Square accident is a reminder of the vulnerability of dense public spaces.

Vehicle Security Barriers

A potentially-drunk driver in a 3,500-pound sedan is far easier to stop than a 15,000-pound cargo truck (like the Renault Midlum used in the 2016 Nice attack). The suggestion is not that cities should develop their infrastructure plans solely around the threat of a cargo truck attack, but at the least such plans should account for vehicle threats when they are developing large pedestrian spaces, such as town squares.

The Department of State and Department of Defense both use the ASTM F2656-07 Standard Test Method for Vehicle Crash Testing of Perimeter Barriers. Needless to say, both DoS and DoD have significant experience in providing physical security to their respective assets such as foreign embassies and military bases. The established ASTM standard rates physical security barriers based on their anti-ram performance, which includes metrics for velocity and penetration based on a standardized 15,000-pound test vehicle. Physical security barriers can include devices like beam barriers, wedge barriers, bollards, booths, fencing, and gates.

K-rated/ASTM-rated barriers, as certified by the Department of State, can repel a 7.5-ton vehicle traveling between 30 and 50 miles per hour, depending on the grade. So, at the low end, a K4/M30 security bollard can easily repel Class 4 (e.g., UPS delivery trucks) vehicles and under; but Class 6-8 vehicles, which include school buses and fire trucks, are more capable of penetrating such defenses.

The steel security bollards in Times Square are at least K4/M30-rated based on CNN’s reporting but could also be K-12/M-50-rated bollards as those too would be backwards compatible against a vehicle moving 30 miles an hour.

In short, security bollards are effective in protecting pedestrian spaces from smaller vehicles and accidents but the kinds widely used in cities are likely vulnerable to Class 6 vehicle attacks and larger. If the terrorist attacks over the past few years have a lesson, it is that urban planning needs to be refined and reimagined to include security features that defend public pedestrian spaces in order to mitigate non-explosive vehicular attacks.

Risk Assessment

Government facilities and critical infrastructures in the United States underwent dramatic transformations to bolster their physical security following the 9/11 attacks. Airports were particularly transformed. In the 1990s it was possible to park in front of an airport and walk into the terminal to greet family members as they exited the plane.

Airports now are divided into two distinct spaces, with security checkpoints acting as the dividing line: soft and hard areas. Soft areas are the parts of the airport that aren’t subject to routine security screenings (though they are routinely searched and patrolled). Hard targets are the areas after airport security. The Ataturk Airport attack in 2016 happened in the soft zone of the airport, as did the Brussels attack. The point is that airport security and even their physical designs have changed as a result of terrorist attacks that used commercial airliners, and it should be expected going forward that cities will include the threat of non-explosive vehicular attacks into their urban planning.

This is not to say that urban areas need to be completely redeveloped in order to respond to the threat of non-explosive vehicular attacks, but I do suggest that retrofitting existing environments and exposed public spaces would make it less attractive for solo jihadists to carry out low cost, high impact attacks.

Large public gatherings like concerts, farmers markets, and mass protests should include vehicular attacks in their risk assessments. Organizers should select venues with that risk in mind or should introduce preventative measures to protect vulnerable spaces. After the Berlin Christmas market attack in 2016, some European cities deployed temporary concrete barriers in public areas in order to protect pedestrian walkways against such attacks. While this was only a temporary solution to the problem, it does reveal a gap in urban design.