Convergence: The Challenge of Aviation Security
By Scott Stewart
On Sept. 13, As-Sahab media released an audio statement purportedly made by Osama bin Laden that was intended to address the American people on the anniversary of the 9/11 attacks. In the message, the voice alleged to be that of bin Laden said the reason for the 9/11 attacks was U.S. support for Israel. He also said that if the American people wanted to free themselves from "fear and intellectual terrorism," the United States must cut its support for Israel. If the United States continues to support Israel, the voice warned, al Qaeda would continue its war against the United States "on all possible fronts" — a not-so-subtle threat of additional terrorist attacks.
Elsewhere on Sept. 14, a judge at Woolwich Crown Court in the United Kingdom sentenced four men to lengthy prison sentences for their involvement in the disrupted 2006 plot to destroy multiple aircraft over the Atlantic using liquid explosives. The man authorities claimed was the leader of the cell, Abdulla Ahmed Ali, was sentenced to serve at least 40 years. The cell's apparent logistics man, Assad Sarwar, was sentenced to at least 36 years. Cell member Tanvir Hussain was given a sentence of at least 32 years and cell member Umar Islam was sentenced to a minimum of 22 years in prison.
The convergence of these two events (along with the recent release of convicted Pan Am 103 bomber Abdel Basset Ali al-Megrahi and the amateurish Sept. 9 hijacking incident in Mexico using a hoax improvised explosive device [IED]) has drawn our focus back to the topic of aviation security — in particular, IED attacks against aircraft. As we weave the strands of these independent events together, they remind us not only that attacks against aircraft are dramatic, generate a lot of publicity and can cause very high body counts (9/11), but also that such attacks can be conducted simply and quite inexpensively with an eye toward avoiding preventative security measures (the 2006 liquid-explosives plot.)
Additionally, while the 9/11 anniversary reminds us that some jihadist groups have demonstrated a fixation on attacking aviation targets — especially those militants influenced by the operational philosophies of Khalid Sheikh Mohammed (KSM) — the convictions in the 2006 plot highlight the fact that the fixation on aviation targets lives on even after the 2003 arrest of KSM.
In response to this persistent threat, aviation security has changed dramatically in the post-9/11 era, and great effort has been undertaken at great expense to make attacks against passenger aircraft more difficult. Airline attacks are harder to conduct now than in the past, and while many militants have shifted their focus to easier targets like subways or hotels, there are still some jihadists who remain fixated on the aviation target, and we undoubtedly will see more attempts against passenger aircraft — in spite of the restrictions on the quantities of liquids that can be taken aboard aircraft and the now mandatory shoe inspections.
Quite simply, militants will seek alternate ways to smuggle components for IEDs aboard aircraft. This is where another thread comes in — that of the Aug. 28 assassination attempt against Saudi Deputy Interior Minister Prince Mohammed bin Nayef. The tactical innovation employed in this attack highlights the vulnerabilities that still exist in airline security.
The airline security paradigm changed on 9/11. In spite of the recent statement by al Qaeda leader Mustafa Abu al-Yazid that al Qaeda retains the ability to conduct 9/11-style attacks, his boast simply does not ring true. After the 9/11 attacks, there is no way a captain and crew (or a group of passengers for that matter) are going to relinquish control of an aircraft to hijackers armed with box-cutters — or even a handgun or IED. A commercial airliner will never again be commandeered from the cockpit and flown into a building — especially in the United States.
Because of the shift in mindset and improvements in airline security, the militants have been forced to alter their operational framework. In effect, they have returned to the pre-9/11 operational concept of taking down an aircraft with an IED rather than utilizing an aircraft as human-guided missile. This return was first demonstrated with the December 2001 attempt by Richard Reid to destroy American Airlines Flight 63 over the Atlantic with a shoe bomb, and later by the thwarted 2006 liquid-explosives plot. The operational concept in place now is clearly to destroy rather than commandeer. Both the Reid plot and the 2006 liquid-bomb plot show links back to the operational philosophy evidenced by Operation Bojinka in the mid-1990s, which was a plot to destroy multiple aircraft in flight over the Pacific Ocean.
The return to Bojinka principles is significant because it represents not only an IED attack against an aircraft but also a specific method of attack: a camouflaged, modular IED that the bomber smuggles onto an aircraft in pieces and then assembles once he or she is aboard and well past security. The original Bojinka plot used baby dolls to smuggle the main explosive charge of nitrocellulose aboard the aircraft. Once on the plane, the main charge was primed with an improvised detonator that was concealed inside a carry-on bag and then hooked into a power source and a timer (which was disguised as a wrist watch). The baby-doll device was successfully smuggled past security in a test run in December 1994 and was detonated aboard Philippine Air Flight 434.
The main charge in the baby-doll devices, however, proved insufficient to bring down the aircraft, so the plan was amended to add a supplemental charge of liquid triacetone triperoxide (or TATP, aptly referred to as "Mother of Satan"), which was to be concealed in a bottle of contact lens solution. The plot unraveled when the bomb-maker, Abdel Basit (who is frequently referred to by one of his alias names, Ramzi Yousef) accidentally set his apartment on fire while brewing the TATP.
The 2006 liquid-bomb plot borrowed the elements of using liquid explosives and disguised individual components and attacking multiple aircraft at the same time from Bojinka. The 2006 plotters sought to smuggle their liquid explosives aboard using drink bottles, instead of contact lens solution containers, and planned to use different types of initiators. The biggest difference between Bojinka and more recent plots is that the Bojinka operatives were to smuggle the components aboard the aircraft, assemble the IEDs inside the lavatory and then leave the completed devices hidden aboard multi-leg flights while the operatives got off the aircraft at an intermediate stop. The more recent iterations of the jihadist airplane-attack concept, including Richard Reid's attempted shoe bombing and the 2006 liquid-bomb plot, planned to use suicide bombers to detonate the devices midflight. The successful August 2004 twin aircraft bombings in Russia by Chechen militants also utilized suicide bombers.
The shift to suicide operatives is not only a reaction to increased security but also the result of an evolution in ideology: Suicide bombings have become more widely embraced by jihadist militants than they were in the early 1990s. As a result, the jihadist use of suicide bombers has increased dramatically in recent years. The success and glorification of suicide operatives, such as the 9/11 attackers, has been an important factor in this ideological shift.
One of the most recent suicide attacks was the Aug. 28 attempt by al Qaeda in the Arabian Peninsula (AQAP) to assassinate Saudi Prince Mohammed bin Nayef. In that attack, a suicide operative smuggled an assembled IED containing approximately one pound of high explosives from Yemen to Saudi Arabia concealed in his rectum. While in a meeting with Mohammed, the bomber placed a telephone call and the device hidden inside him detonated.
In an environment where militant operational planning has shifted toward concealed IED components, this concept of smuggling components such as explosive mixtures inside of an operative poses a daunting challenge to security personnel — especially if the components are non-metallic. It is one thing to find a quantity of C-4 explosives hidden inside a laptop that is sent through an X-ray machine; it is quite another to find that same piece of C-4 hidden inside someone's body. Even advanced body-imaging systems like the newer backscatter and millimeter wave systems being used to screen travelers for weapons are not capable of picking up explosives hidden inside a person's body. Depending on the explosive compounds used and the care taken in handling them, this method of concealment can also present serious challenges to explosive residue detectors and canine explosive detection teams. Of course, this vulnerability has always existed, but it is now highlighted by the new tactical reality. Agencies charged with airline security are going to be forced to address it just as they were previously forced to address shoe bombs and liquid explosives.
Currently, there are three different actors in the jihadist realm. The first is the core al Qaeda group headed by bin Laden and Ayman al-Zawahiri. The core al Qaeda organization has been hit hard over the past several years, and its operational ability has been greatly diminished. It has been several years since the core group has conducted a spectacular terror attack, and it has focused much of its effort on waging the ideological battle as opposed to the physical battle.
The second group of actors in the jihadist realm involves the regional al Qaeda franchise groups or allies, such as al Qaeda in the Arabian Peninsula, Jemaah Islamiyah and Lashkar-e-Taiba. These regional jihadist groups have conducted many of the most spectacular terrorist attacks in recent years, such as the November 2008 Mumbai attacks and the July 2009 Jakarta bombings.
The third group of actors is the grassroots jihadist militants, who are essentially do-it-yourself terrorist operatives. Grassroots jihadists have been involved in several plots in recent years, including suicide bomb plots in the United States and Europe.
In terms of terrorist tradecraft such as operational planning and bomb-making, the core al Qaeda operatives are the most advanced, followed by the operatives of the franchise groups. The grassroots operatives are generally far less advanced in terms of their tradecraft. However, any of these three actors are capable of constructing a device to conduct an attack against an airliner. The components required for such a device are incredibly simple — especially so in a suicide attack where no timer or remote detonator is required. The only components required for such a simple device are a main explosive charge, a detonator (improvised or otherwise) and a simple initiator such as a battery in the case of an electric detonator or a match or lighter in the case of a non-electric detonator.
The October 2005 incident in which a University of Oklahoma student was killed by a suicide device he was carrying demonstrates how it is possible for an untrained person to construct a functional IED. However, as we have seen in cases like the July 2005 attempted attacks against the London Underground and the attempted strikes in July 2007 against nightclubs in London and the airport in Glasgow, grassroots operatives also can botch things, due to a lack of technical bomb-making ability. Nevertheless, the fact remains that constructing IEDs is actually easier than effectively planning an attack and successfully executing it.
Getting a completed device or its components by security and onto the aircraft is a significant challenge, but as we have discussed, it is possible to devise ways to overcome that challenge. This means that the most significant weakness of any suicide-attack plan is the operative assigned to conduct the attack. Even in a plot to attack 10 or 12 aircraft, a group would need to manufacture only about 12 pounds of high explosives — about what is required for a single, small suicide device and far less than is required for a vehicle-borne explosive device. Because of this, the operatives are more of a limiting factor than the explosives themselves, as it is far more difficult to find and train 10 or 12 suicide bombers.
A successful attack requires operatives not only to be dedicated enough to initiate a suicide device without getting cold feet; they also must possess the nerve to calmly proceed through airport security checkpoints without alerting officers that they are up to something sinister. This set of tradecraft skills is referred to as demeanor, and while remaining calm under pressure and behaving normally may sound simple in theory, practicing good demeanor under the extreme pressure of a suicide operation is very difficult. Demeanor has proven to be the Achilles' heel of several terror plots, and it is not something that militant groups have spent a great deal of time teaching their operatives. Because of this, it is frequently easier to spot demeanor mistakes than it is to find well-hidden explosives.
In the end, it is impossible to keep all contraband off aircraft. Even in prison systems, where there is a far lower volume of people to screen and searches are far more invasive, corrections officials have not been able to prevent contraband from being smuggled into the system. Narcotics, cell phones and weapons do make their way through prison screening points. Like the prison example, efforts to smuggle contraband aboard aircraft can be aided by placing people inside the airline or airport staff or via bribery. These techniques are frequently used to smuggle narcotics on board aircraft.
Obviously, efforts to improve technical methods to locate IED components must not be abandoned, but the existing vulnerabilities in airport screening systems demonstrate that emphasis also needs to be placed on finding the bomber and not merely on finding the bomb. Finding the bomber will require placing a greater reliance on other methods such as checking names, conducting interviews and assigning trained security officers to watch for abnormal behavior and suspicious demeanor. It also means that the often overlooked human elements of airport security — including situational awareness, observation and intuition — need to be emphasized now more than ever.