On The Lookout

Be aware of suspicious signals

Throughout history terrorists have appeared invincible. They plan their operations meticulously to ensure success and, once implemented, they seldom fail to strike and kill their targets.If their attack is against an individual, terrorists gather information and intelligence through surveillance. To select a target, terrorists begin by picking a group of individuals. The information they collect during surveillance is used to narrow the field of candidates. When a target is finally chosen, surveillance continues.The reason terrorists succeed is that they never attack unless they have a well-organized plan, and their plan is supported by information and intelligence gathered through surveillance. Because of this factor, surveillance detection is the best way to protect unsuspecting executives from the harm planned by terrorists.The objective of surveillance is to gather information to develop a precise plan. The most important information terrorists gather from surveillance is a target's daily schedule.Terrorists document what time their victims leave for work, what type of cars they drive, what routes they drive to work, what time they go to lunch, where they go for lunch, and where they go for leisure activity. Terrorists' objective is to know every step their target takes.To be successful, terrorists must take a victim by surprise. In the process of surveillance, however, terrorists often inadvertently give signals that they are organizing an attack. These signals are called pre-incident indicators.

The objective of surveillance detection is to read these signals and take action to prevent an incident.

Preincident indicators, no matter how many or how often, must be detected and acted on. Unfortunately, many times they are ignored.

A classic example of indicators of surveillance that were ignored is the assassination of German businessman Alfred Herrhausen on November 30, 1989.

The Red Army Faction, the terrorist group responsible for the attack, began setting up for the Herrhausen assassination eight weeks before the attack. Those eight weeks did not include surveillance time by the terrorists.

As always, hindsight is 20/20. But Herrhausen's death might have been prevented. From October 1 to October 18, 1989, the terrorists posed as construction workers, working less than 500 yards from Herrhausen's home. No one in the neighborhood called the city to ask if the road work was legitimate. At that stage of the operation to assassinate the businessman, the terrorists were probably in the final phase of surveillance and were determining Herrhausen's daily routine to schedule their attack.

On the day of the attack, Herrhausen drove to work in an armored car with bodyguards in a lead car and a follow car. Herrhausen was killed when his car broke a light beam generated by a photoelectric cell. Interruption of the beam triggered the detonation of a bomb. The bomb, packaged to look like a child's knapsack, was affixed to a child's bicycle that was left alongside the road.

No amount of driver training and no armored car would have saved Herrhausen.Despite the use of bodyguards and extra vehicles, his best protection would have been surveillance detection.

The bicycle was an important part of the ambush. The terrorists had to make the bicycle part of the environment in order not to create suspicion.

Beginning as early as October 18, the terrorists placed an expensive bicycle alongside the road even though a bicycle rack was less than 100 feet away.

The terrorists left the bicycle there for more than a week, took it away, and then put it back again. They did this until the bicycle became part of the environment. Again, no one questioned why an expensive bicycle was left alongside the road for days, how it got there, or who was the owner.

On November l7, 1986, George Besse, president of Renault Car Company, was assassinated as he walked from his car to the front door of his house. Besse was shot with a 9mm handgun by a couple hiding in the shrubbery surrounding his apartment. A French terrorist group, Action Direct, claimed responsibility for the assassination of the executive.

Later, in March 1987, French police raided a farmhouse in France. Inside, they found videotapes of Besse, another assassination victim, General René Audran, plus 60 additional videotapes of other prominent French business people.

The videos were an important discovery. They showed the business people going about their daily routine in only two locations, near their homes and offices. The videotapes proved two important points: Terrorists rely heavily on surveillance, and their surveillance is concentrated around homes and offices.

The tactic of videotaping during surveillance is no different from what any police department in the United States does. Action Direct used the modern convenience of a video recorder to conduct surveillance. They selected the time and place to attack their victims based on the information on the videos.

The Besse Assassination is one of many incidents that indicates how much terrorists rely on surveillance for their success. The solution, therefore, is for executives to avoid routine and change their routes.

While this is good advice and should be adhered to whenever possible, protection professionals know that getting an executive to alter his or her routine is not easy. Executives do not get to be executives by showing up to work late, and leaving for work at roughly the same time is a hard habit for them to break.

Does this solution make a big difference? If departure and arrival times can be varied significantly, the answer may be yes. But if the time is varied by only 10 or 20 minutes or even an hour, it really does not matter much. It simply means terrorists will have to wait a few minutes longer.

Even though departure times may be changed, in many instances the route traveled cannot, which is the main reason terrorists select the area around the home or office to kidnap or assassinate their victim. If the executive lives in an area with limited access. changing the travel routes may not work. There may be no routes to change. The farther away from the home or office, the more alternatives that are generally available.

Statistics also indicate the area around the home and office is the most dangerous.Consider the following:

• A German businessman was assassinated 300 yards from his home by terrorists
• A French businessman was assassinated at his doorstep.
• A US military attaché was assassinated 300 yards from his home
• A Colombian businessman was kidnapped 200 yards from his office.
In a high-risk environment implementing a surveillance detection program near the home and office is a necessity and not that difficult.Within a few blocks of someone's home, it is common to see the same people and cars in roughly the same places. If something or someone different enters this environment, it should be questioned. This is where the system often fails. Most of the time, even though people notice a change in the environment, they do nothing. Instead, they rationalize why it is there. Detecting surveillance requires alertness. It must become an unconscious habit. Paranoia should never be encouraged, but developing a sense of what is normal and what is unusual around the home, office, and route taken to and from work could be the most important security precaution an executive can take.

Special emphasis should be placed at choke points along the route to and from work. Choke points are locations near the home or office that,because of the environment, cannot be avoided.

They should know what cars and people, residents and workers should be in the areas in question.An executive's driver should know where all choke points are. If the executive decides to do his or her own driving, his or her company's security department should not assume the executive knows what to look for; he or she should be briefed.

Someone should go in advance of the executive to examine choke points.

The definition of an advance can be as little as a minute and can be done by motorcycle or car. The advance person is looking for signs of an ambush. This means not only looking for suspicious individuals or people who are new to the environment but also looking for anything unusual.

Is this task complicated and time consuming? Yes. But in many situations there are no alternatives. In many attacks, the only chance the victim had of avoiding the incident was detecting the ambush. Since most attacks occur at choke points, that means detecting the ambush at a choke point. If at all possible, the executive should not drive through a choke point unless it has been investigated first.In many parts of the world, a surveillance detection program may be the most important security precaution taken. If the threat is assassination, the importance of surveillance detection cannot be stressed enough. A basic surveillance detection program consists of several steps:

Step 1:

Someone who knows the environment needs to determine what is normal around the home, office, and choke points. This has to be done by an individual familiar with the area, especially if in a foreign country. What may appear to be unusual to someone living in the United States may not be unusual to a native of the country.

A plan must ensure all areas around the home, office, and choke points have been investigated to determine the normal environment.

Step 2:

Once the environment around the home, office, and choke points is determined, constant observation of these areas is required. The people watching the area must know what to look for and clearly communicate what they see to others. If in a foreign country, the people who perform this task must be nationals.

Step 3:

Once the surveillance information is gathered. it must be compared to the activities of the normal working environment. Basically, what is found in step 1 is compared to what is found in step 2. This is easily done with a computer. Off-the-shelf database computer programs are available.

Some companies working in high-risk areas have developed their own surveillance detection computer programs. These programs can also be used to determine routes traveled and choke points of their executives.

The need for a computer depends on the amount of information a company is looking at. If a company, for example, has five executives working in high-risk locations, running a surveillance detection program without using a computer is impossible to perform.

Step 4:

If a change in the normal environment occurs, a system needs to be developed that immediately indicates what that change is. Surveillance may have already been in place for a while before it is detected.

Step 5:

Once the surveillance information has been collected and analyzed,it needs to go out to those in the field. If a vehicle goes in advance of the executive, the people in the vehicle must have the latest information as soon as possible.

These steps may sound complicated at first, but they are not. If there is a surveillance detection person who has been assigned to a location,that individual can usually do all the steps listed above in his or her mind. What is important is that the individual knows what to look for during a surveillance operation and what action to take if something is found to be suspicious.

The following case study is a shining example of a surveillance detection program. A guard in Bogota, who had been trained in surveillance detection, was patrolling an area of the city inhabited predominantly by US business executives as well as Colombian military and political figures.

During his patrol, the guard noticed an unfamiliar truck parked on a narrow street, and he knew the truck did not belong there. He was also aware that one of the ways the country's drug cartel assassinated people was by placing a bomb alongside the road and detonating it as the victim drove by.

The guard called authorities, who discovered that the truck was loaded with 1,650 pounds of explosives, and defused it.

Does surveillance detection work? You bet. It can save lives and, in many parts of the world, it's not just the best protection, it's the only protection.

Any and all reprints and redistributions of this article are strictly prohibited without the expressed written consent of the Author. Please direct questions or comments about this site to the webmaster@securitydriver.com. Copyright © 1999-2008. SecurityDriver.Com. All rights reserved.