The early minutes, hours, and days following a terrorist attack or similar incident – e.g., the 24 January 2011 Moscow bombing at Domodedovo Airport, or Jared Loughner’s 8 January 2011 Tucson shooting spree – were, in only a few short minutes, filled with speculation and a broad spectrum of assumptions, many of them totally unprovable, about the perpetrators of the attack and their modus operandi. Such uncertainty and unverified rumors are similar in many ways to what is called the fog of war, and might accurately be described as the fog of crisis.
In the 24-hour news cycle, there is a constant stream of information being generated from a broad spectrum of "sources," some of them well informed, but others not. With so many interpretations being offered, it is important that not only homeland-security professionals but the general public as well be able to carry out their own fact-check assessments of a major mass-casualty event or incident, relying on those facts rather than on amateur speculations and unwarranted assumptions.
When analyzing a terrorist attack – failed or successful – there are in most cases at least a few fundamental and verifiable facts worth considering. Despite the limited amount of information usually released by official government spokesmen during and immediately after the initial phase of an investigation, outside observers can use at least some seemingly reliable media reports and open intelligence sources, and/or even surf the internet, to develop a few reasonably informed conclusions of their own – which in most cases should be based on what might be called "The Three ‘T’s” of a terrorist attack – Target, Tactics, and Technology.
Clear Thinking and an Open Mind Here, a word of caution is necessary: Far too often, political pundits and news anchors – using unquoted and unnamed sources – are quick to conclude that one well known group or another, usually one already in the news, has perpetrated a specific attack. Knowing what information to focus on in these news reports, and how to apply that information to think somewhat more critically – more logically, in other words – about the event, is an important skill for any media consumer, particularly in the face of sudden disaster. Keeping that point in mind, it is usually possible, focusing on the Three T's, to develop at least a few tentative conclusions, as follows, from the limited evidence that is available:
1. TARGET – Knowing with reasonable certitude what person, group, or organization was the probable target of the attack will usually (but, of course, not always) permit the development of some reasonable assumptions about the terrorist organization responsible for the attack. By definition, most terrorist groups have publicly stated the political objectives for which they are fighting. The target of an attack by a specific group, therefore, can frequently be determined by analyzing the group's known political goals and objectives. Determining the group's most likely targets – which might range from indiscriminate civilian population centers to political institutions – can provide valuable information about the possible motives of the individual or organization launching an attack. Political institutions, public transit systems, and places of religious worship all represent what many terrorist groups might well consider to be "ideal targets" for getting aneological message to an intended audience.
There are significant differences in that message, of course, when the target selected is the civilian population, a symbol of authority (a police station or other government building, for example), critical infrastructure such as a power plant, or individual political officials. Through fear and coercion, even a failed attempt to attack a well known target can have dramatic consequences, primarily because it sends such a clear message – namely, that an attack is possible, even in the middle of a suburban shopping center or against a major transportation center such as an airport or subway system, both of which are today heavily guarded, or at least monitored, by law-enforcement agencies.
2. TACTICS – In the initial moments following a terrorist incident, knowing the terrorists' tactic of choice, which is usually quite obvious, can be useful in assessing the capabilities of the perpetrator. It is not always necessary for terrorists to launch major attacks such as al Qaeda's destruction of the World Trade Center towers on 11 September 2001 to achieve their goals. In the business of fear and intimidation, striking targets that are both unprotected and unprepared is of considerable value to the terrorist organization. In fact, the methods of attack have in recent years, and for various reasons, moved toward the use of a lone gunman rather than a group of suicidal extremists. Nonetheless, the continued use of suicide bombers and of improvised explosive devices (IEDs) is proof in itself that these methods still work and are likely to be continued far into the future. However, a single terrorist in a shooting-spree scenario typically (but not always) represents only a lone gunman acting on his/her own accord.
Conversely, the ability to destroy a selected target by using an IED – then getting away to fight another day – gives the individual terrorist the ability to make numerous attacks with minimal financial resources. In fact, publicly available do-it-yourself IED manuals can easily be obtained over the internet. Moreover, the IEDs themselves can be assembled by persons possessing little or no in-depth knowledge of chemistry or explosives. The complexity of the IED itself, therefore, can be a helpful clue to the level of training the terrorist group or individual terrorist probably has received. The use of a suicide bomber – a tactic seen most frequently, but not exclusively, in the Middle East – typically points to an organization with deep roots in Islamic Extremism, which sees the taking of one’s own life for a religious cause as a form of martyrdom.
3. TECHNOLOGY – The level of technology used in a terrorist attack often provides the foundation for a more thoughtful assessment of the particular terrorist organization that might be involved. A comparative analysis of the technology used in attacks of similar scope will probably show at least some similarities and/or differences in the resources available to a terrorist organization. Comparing the technology of last month's Domodedovo attack – in which the terrorists used 5-10 kg of trinitrotoluene (TNT) stuffed with metal objects, including screws and metal balls, according to open-source intelligence reports – to al Qaeda’s failed 2009 Christmas Day attempt, using pentaerythritol tetranitrate (PETN – a very powerful high explosive) to blow up an airplane en route to Detroit provides a clear indication of the various resources available to totally different organizations striking similar aviation targets.
Larger terrorist organizations usually have more resources they can draw on for “best practices” in building explosive devices that can maximize casualties. Many but not all of the IEDs used in attacks in Iraq and Afghanistan, in fact, have used various chemical combinations, usually concealed in hidden devices packed with ball bearings, nails, and other shrapnel-like materials to increase not only the number of deaths but also the property damage resulting from the explosion. The presence, or absence, of these explosive components can be and frequently is a reliable indicator of the possible source of the device schematics and often provides other credible clues about the origin of the terrorist.
Without the forensic and investigatory resources needed to run fingerprints and review closed-circuit television footage, media consumers often are provided only the usually limited information that public officials are willing and/or able to make public. Nonetheless, the three essential elements, described above, of most terrorist attacks provide the basic framework needed for thinking more critically about the facts available and will allow everyday citizens to question the conclusions that are being offered by the news media and/or by public officials charged with investigating such attacks. In short, by focusing on the Target, Tactics, and Technology aspects of a specific incident, the average media consumer can be empowered to draw his or her own conclusions – and quite possibly come much closer to "the real truth" than is possible by simply accepting the information provided, even with the best of intentions, by the media and/or the public officials investigating the attack.