Mumbai Attack Was Tip of the Iceberg

The latest open source intelligence reveals that the late November attack in Mumbai was designed to replace another plot that Indian government counter-terrorism forces successfully disrupted earlier this year. Examining the evolutionary track of these attacks provides insight as to how the threat is evolving and hints at what is coming in the uncertain future.

It seems the first group of attackers conducted preliminary reconnaissance of the same locations that were targeted by their successors. The potential attackers were also equipped with the same package of heavy assault rifles, pistols, explosives and grenades that were utilized to great effect during the attack, particularly at the Oberoi and Taj Palace hotels. The group, comprised of both nationals from Pakistan and, notably, India itself, was detained in February of this year.  They divulged that they had been trained in Pakistan to conduct the raid and not return alive.

The attack was aborted when police took apart the network due to quality intelligence work. As a result, the terrorist network had to reboot the raid with new operatives, equipment, and a support network within India’s borders. At first glance, it seems the second attempt is an exact replica of the first, with different actors but the same tactics. However, there are some fundamental differences that reveal the true nature of the attack.

Local human intelligence networks provide insider information that is essential when planning to overrun a city. The most efficient road transit routes, where people cluster at night, how long police forces take to respond, and identifying prominent city dwellers are just a few areas where localized knowledge can prove invaluable. However, this intelligence does not come without risks.

Specialized knowledge requires expanding an attack network to include people who know that information – in this case, the staff at five-star hotels, railway terminals, and top restaurants. It only takes one individual, misidentified as a possible asset, going to the police to blow apart a month’s long operation. This is likely how the original plan was prematurely aborted. To avoid this same fate, the terrorists even went so far as to kill the navigator of the boat hijacked to carry them into the bay to prevent any information from being leaked.  Once inside the city, they hijacked vehicles, rather relying on a local asset stealing vehicles, and relied on GPS technology to navigate the city.

Instead of depending on local assets to expand the assault team, the terrorists made use of command and control hubs, located inside the two hotels, to out maneuver the Indian security apparatus. Each phase of the operation, every tactical movement, every step was coordinated via Blackberry, computer, and satellite phone in real time. This served as a force multiplier: by acting in concert, they manipulated security force and media estimates of their capabilities, allowing them more time and space within to maneuver. When their ability to travel around the city was cutoff by police forces, these rooms also provided a ready location to fortify and sustain a siege.

So based on this analysis, what could a possible and likely third attack look like? The original attempt was designed to be a high intensity, high impact attack that consumed the lives of scores, including the terrorists themselves. The second attempt was successful in this regard, but, from the terrorist perspective, there are some areas of improvement.

To achieve greater speed and inflict exponentially more damage, terrorists will likely cut out command and control hubs entirely, instead opting for greater operational flexibility and peer-to-peer communication. They may use small, cheap, aerial drones or networks of strategically placed webcams or even elaborate disinformation campaigns to misdirect first responders and police forces.

It is likely that each two-man unit will act independently with instructions to direct others only as needed. Their primary common objective will be the creation of chaos, followed by an imperative to stay alive, for the longer they are alive and free, the greater the success that can be achieved. The sole captured member of this assault team has told police that his team was expecting to survive.  It seems the tactics are already evolving.

As evidenced by the rapid turnaround in mounting a second attempt, terrorists are deeply motivated by the potential payoff of urban overruns. The economic damage alone from this attack is estimated at $10 billion. The next generation of terrorists will be working around the clock to plan not just one, but a whole series of overruns, perhaps while using only one assault team in an effort to overwhelm the Indian state.

It is extremely unlikely their efforts will be limited to that country.