aviation discussion questions

profilehugh123
Week13-SEC421-RevOrg.pptx

©2013 Emirates. All Rights Reserved.

week #13 – Threat matrix

SEC421

https://www.youtube.com/watch?v=8NMnnMRWJ-0&list=PL2E3ktkpAeeZlDJFe0q1VidLqZfRwjITp&index=21&t=1s

The theme of this chapter is “what doesnʼt kill you tries to kill you again.”

In the first edition this was one chapter. It has been expanded into two. This chapter focuses on the existing and emerging threats along with new tactics and techniques in terrorism defense planning.

 

There is a YouTube clip titled “no Russians” which is a short video from the video game Modern Warfare. It shows an active shooter assault on airport. It can be difficult to watch, particularly for those that do not play those types of video games, but does make an effective argument for this chapter and is a good attention getter.

And exercise that is popular for this chapter is to put the students in groups, and send one group into another room. Have the groups then develop their own types of attacks on aviation and include the logistics.

1

THREAT MATRIX

Significant monetary resources since 9/11 to fix the aviation security system

Responsibility to detect / deter terrorist criminal acts, but resiliency?

Modern terrorism – Internet / highly advanced technologies

https://www.youtube.com/watch?v=MjG1n9FEDb0

What is the most dangerous threat to aviation?

4/5/2021

SEC421

2

The United States has expended significant monetary resources since 9-11 to "fix" the aviation security system; however, as a nation the United States has much more work ahead in developing security systems that can mitigate future threats.

Although part of our responsibility is to detect and deter terrorist and criminal acts, it is also part of our responsibility to build resiliency into the  aviation security system such that responses are rapid and effective when a terrorist or criminal act occurs.

 

Terrorism is a way to inflict harm on a country or entity with little risk to the infrastructure of the terrorist organization. Whenever a citizen sees heightened security, he or she is reminded of the attack that caused the new procedures and may continue to fear another attack.

Modern terrorism uses the Internet and other highly advanced technologies along with unconventional forms of implementing an attack. https://www.youtube.com/watch?v=MjG1n9FEDb0

Therefore, threats can no longer be eliminated through military power. Defeating current and future threats to our global aviation system requires strategies that combine military force where applicable and the construction of a resilient infrastructure.

2

THREAT MATRIX

Threat is unstoppable

GA and the use of GA aircraft

"Isn't it easier to rent a truck and fill it with explosives than it is to rent or steal an aircraft?"

Suicide bombers

"You cannot stop someone who is totally committed to attacking you and killing themselves in the process."

4/5/2021

SEC421

3

The most dangerous threat to aviation is perhaps the belief that a threat is unstoppable.

Although commonly believed, neither of these statements helps prevent the next attack on aviation. The first statement does not negate our responsibility to prevent an aircraft from being used in a terrorist attack, whether it is a commercial service or GA aircraft. In the second case, whereas some terrorists will die for their cause, they will not "donate their lives cheaply."

3

RELATIVE SUPERIORITY

Condition that exists when an attacking force, generally smaller, gains a decisive advantage over a larger or well-defended enemy.

Terrorist have planning, research, execution stages “SARA”

Six principles affect relative superiority

4/5/2021

SEC421

4

McRaven posits that in order for a small force to be successful they need to acquire what is known as relative superiority (McRaven, 1996), which he describes as a condition that exists when an attacking force, generally smaller, gains a decisive advantage over a larger or well-defended enemy. Relative superiority exists when it is achieved at the pivotal moment in the engagement and once achieved, sustained in order to guarantee victory.

McRaven explains how six principles, simplicity, security, repetition, surprise, speed and purpose, affect relative superiority. Each of these principles relate to the perspective of aviation security practitioners in designing methods to deter or effectively respond to a terrorist or criminal incident.

Terrorists have a planning stage (target selection, analyzing and assessing the mission), a research (reconnaissance) and planning stage, and an execution stage (the attack), and that the use of all the stages are inseparable and integrated (Ronczkowski, 2012). Thus, the four stages within the terrorism model are: Select target, Analyze and assess, Research and Attack (SARA).

In the absence of the integration the mission will fail. Terrorists do not randomly and spontaneously pick their targets – they are selective in order to maximize the tragedy. This provides law enforcement and security personnel the advantage of being able to identify and deter a plot in advance of the attack.

Simplicity relies on three elements – focusing on a limited number of objectives, having good intelligence and using innovation.

Security relates to operational security (OPSEC) while the attack is being planned and pieces put into place (training, acquisition of materials, funding).

Repetition is indispensable in achieving success and relates to training to perform the operation.

Surprise is not the same as relative superiority. Surprise provides for momentary advantage and while usually necessary for success, is alone is not sufficient for success.

Speed, which also relies on proper security and constant repetition (i.e. training) relates to the ability to take action quickly.

Purpose means all personnel are focused on a single goal, which reduces extraneous objectives, isolates and limits the intelligence required, which, combined, makes operational security that much tighter.

4

Domestic / international terrorist groups

Recruitment

Preliminary organization and planning

Preparatory conduct

Terrorist act

4/5/2021

SEC421

5

Domestic and international terrorist group activities include (Ronczkowski, 2012):

Recruitment: membership of a group, attendance at rallies and meetings, exposure to Internet recruiting or informational sites, personal recruitment and accessing extremist literature

Preliminary organization and planning: identify and clarify roles, exposure to terrorist training materials or actual training, discussion of potential targets, drawings, assignments

Even the lone-wolf operator, usually the hardest to interdict, must begin with some type of target selection (planning), acquisition of weapons or explosives (preparation) and the attack (execution).

Preparatory conduct: theft and weapon acquisition, counterfeiting, procuring identification, bomb-related activities and weapon modifying

Terrorist act: bombings assassinations, hostage taking, hoaxes, threats, hijackings

5

EXISTING THREATS

AIRCRAFT BOMBING – Passenger, Baggage, and Cargo

Security Screening checked point

Checked baggage screening

BOMB THREATS – Airline

Specific or non?

AIRPORT ASSAULT

The third most frequent attack

AIRCRAFT HIJACKINGS – Airline

5-10 attempts each year worldwide

4/5/2021

SEC421

7

In 2006, the TSA stated that bombings were a greater threat to aviation security than hijackings. Bombs continue to be one of the most popular weapons of terror and remain an active current threat. The TSA has implemented an operational solution in the form of restricting the amount of liquid that can be taken onboard and conducting random use of explosive trace detection technologies. These processes are inconvenient to travelers and not as effective as they need to be to prevent a bombing.

The security screening checkpoint must be outfitted with technology that will detect explosives and metal on a passenger, and with technology that provides a better look inside carry-on baggage—technology that can distinguish between dangerous liquids and other substances from nonthreat items.

 

Checked baggage screening technologies are effective at identifying many prohibited materials, and these systems should continue to be implemented, inline to the automated baggage systems, wherever possible.

Focus must shift to the other methods a bomb can be introduced to an aircraft as terrorists and criminals will shift to the path of least resistance, which right now is represented primarily by cargo, mail, and placement of a device by an aviation employee.

There are programs that require random screening of airport workers by TSA personnel to counteract this threat.

Bomb threats to an airline, an industry that relies heavily on-time performance, can be a major disruption as flights are delayed or canceled across the national airspace system, personnel and resources are diverted for hours to handle the crisis, and other airport operations are interrupted.

 

Presently, handling the bomb threat from the air carrier perspective depends on where the call comes in. A call to:

An airport authority - will result in the airport responding by notifying air carriers and the CATSA/RCMP.

The airline - may not result in notification to the airport or other agencies.

If the threat is clearly a hoax or so unspecific as to not warrant further action, determined through a vetting process conducted by the airline security personnel, the airline may elect to not notify other agencies.

 

When an aircraft operator receives a bomb threat, the in-flight security coordinator of the flight in question must be notified, and any applicable threat measures that are part of the aircraft operators’ security program must be implemented.

 

The aircraft operator must also notify the airport operator at its intended point of landing when an aircraft has received a threat. The aircraft operator must attempt to determine whether any explosive or incendiary device is present by conducting a security inspection on the ground before the aircraft’s next flight, or if already in flight, as soon as possible after landing.

 

If an aircraft in flight receives a bomb threat or notification from the ground that a bomb may be onboard, the flight crew must be immediately notified so that in-flight security precautions may be taken. This may involve the movement of a suspicious package or item to an area of the aircraft known as the least risk bomb location (LRBL), where the aircraft manufacturer has determined that an explosion will result in the least damage to the aircraft.

 

If a threat is received and related to the facilities used by an aircraft operator, the airport operator must be immediately notified, along with the other domestic and foreign aircraft operators at that specific airport. The aircraft operator must conduct a security inspection before continuing to use the threatened facilities or areas.

 

To continue to reduce the hijacking threat, consideration should be given to requiring airline personnel to receive hands-on self-defense training and to allow local and state law enforcement officers to carry their weapons onboard.

7

Managing a hijack incident

Most strategies are confidential

Keep it on the ground

Move to an isolated parking position

Flight crew – attempt to disable the aircraft

Barricade should be place around the aircraft

If airborne…

4/5/2021

SEC421

8

Most strategies for managing hijack incidents are confidential and should not be made public.

 

Conventional wisdom and lessons learned are not a secret; if the incident occurs when the aircraft is still on the ground, the strategy is to do everything possible to keep it there. Response should include:

Moving the aircraft to an isolated parking position (IPP)

The flight crew should attempt to disable the aircraft.

Barricades should be placed around the aircraft to prevent it from taking off

 

Once the aircraft is airborne, numerous variables come into play, including the potential that the aircraft will be used as a weapon or that it will be shot down by military aircraft.

8

Emerging conventional threats

Military facilities, embassies, hotels, businesses

Should be assumed similar attacks could be used against aviation

Airport attack – Improvised Explosive Device

Continue to be the most common weapon, significant challenge in identifying an IED

4/5/2021

SEC421

9

When a bag has been left unattended:

Note the location

Carefully examine for travel date, identification information, general condition

Security should make a public announcement asking for the owner of the bag to identify him or herself or ask if anyone can identify who may have left the bag or item

Notification should be done at least 50 feet from the item, radio and cell phone transmissions may detonate an IED

The area surrounding the item should be evacuated until law enforcement arrives

 

The quickest way to check for an IED in an airport is to use a K-9 explosives detection team.

Personnel handling incoming mail should be trained on what to look for to detect whether a parcel or letter contains an IED or a chemical/biological/radiological agent.

 

Signs include:

Excessive string or tape on a parcel,

Lopsided or uneven parcels,

Rigid or bulky parcels with the package clearly too small for the contents,

Oily stains or discoloration,

Wrong name and address or wrong title,

Strange odors

Letters with restrictive markings such as “personal” or “only to be opened by” written or printed on them,

Badly typed or written addresses,

Excessive postage,

Packages that have been mailed from a foreign country,

Misspelled words,

Absence of a return address

 

Some airports may consider installing small X-ray devices in their mailrooms to scan all incoming mail.

9

Manned portable air defense system

4/5/2021

SEC421

10

Manned Portable Air Defense systems, which distinguish them from vehicle, vessel, or land-based air defense systems, MANPADs can be launched by one person to strike an aerial target. MANPADs can reach speeds of Mach 2 and altitudes up to 18,000 feet.

 

Another challenge to the MANPAD threat is that it does not have to be fired on an airport or even near an airport to ensure a hit. A RAND study concluded that the envelope for firing a MANPAD was 870 square miles around Los Angeles International Airport.

 

Other factors to consider in relation to MANPADs are whether an attacker can actually hit the target and whether the missile with a small warhead (less than five pounds) can cause enough damage to take down a large commercial airliner.

 

A missile can be deterred by providing its tracking sensors (seeker head) with something else to chase or by confusing its sensors. With the seeker head not knowing which direction to go, the missile “goes stupid” and either self-destructs or falls to the ground. Antimissile technologies used to protect aircraft include flares, laser jammers and high-energy lasers.

10

Emerging threats

Vehicle-Borne Improvised Explosive Device

300 foot rule

1995

Suicide or Homicide Bomber

Belief that it cannot be stopped?

4/5/2021

SEC421

11

The basic concept behind a vehicle-borne improvised explosive device (VBIED), is to fill a car or truck with large quantity of an explosive, drive it to the target area, then detonate it, either from inside the vehicle, by a remote command or timing device.The “300-foot rule” took effect in 1995, in response to the bombing of the Murrah building in Oklahoma City, and prevents unattended vehicles from being parked within 300 feet of an airport terminal building. Vehicle checkpoints on roads accessing the airport can be a deterrent and airport design can help mitigate an attack by a VPIED.

Unlike command-detonated improvised explosive devices (IEDs), suicide bombers adjust to the environment, identify law enforcement and security measures, flee and return another day, or relocate into a crowd or key infrastructure to increase destruction. A suicide bomber can also quickly move into position and detonate.

 

Another advantage is a common belief that a suicide bomber cannot be stopped. This is not true. Suicide bombers are committed to dying in the attack. However, they do not want the attack to be a wasted effort and thus will spend considerable time planning for the attack, often receiving help from others.

 

Once a suicide bomber is loaded up and walking to the target area, stopping the attack is very difficult—but not impossible. In Israel, police and citizens are trained in tactics to defeat suicide bombers. These have been shown to be about 80% effective when employed by someone trained in the proper techniques.

 

Suicide bombers typically carry 2 to 30 pounds of plastic explosives attached to a firing trigger kept in their hand, pocket, or chest area. Pushing a button or toggling a switch completes the circuit and detonates the bomb. Sometimes, the bomber pushes the button to arm the device. When the button is released, the bomb explodes. This technology makes it difficult for law enforcement to stop a detonation.

 

Occasionally, nails and bits of metal are wrapped with the IED to increase the damage caused by the blast. There have even been rumors of suicide bombers injecting themselves with the AIDS virus in an attempt to spread the disease during the blast. Chemical and biological elements may also be mixed in to an explosive. However, one challenge to this concept is that the temperatures created by the explosion may vaporize these elements.

11

EMERGING THREATS

Perimeter Breach and standoff

Fencing, gates, access control, barriers

Low priority based on very few attacks

Stronger fencing?

Detection monitoring sensors?

CCTV?

4/5/2021

SEC421

12

The perimeter of an airport will include fencing, gates and access control systems, and other barriers. Perimeters have received low priority as few attacks on airports of aircrafts occur through or over a perimeter fence.

 

An airport perimeter can be exploited in many ways including:

An armed assault by aggressors can drive through a perimeter gate,

Individuals posing as airport security guards could access the airport perimeter without creating notice.

 

Natural barriers, such as water or densely wooded or populated areas, impact the ability of an airport to keep that section of the airport perimeter secure.

 

Some foreign airports are switching to stronger fencing and including detection monitoring capabilities such as seismic sensors triggered when an individual touches the fence. Due to cost of seismic sensors, many larger airports combine CCTV with smart software to keep track of a perimeter.

 

Equally important are threats that occur just outside of an airport’s perimeter fence, such as rocket-propelled grenade (RPG) attack, an aerial IED, or an automatic weapon attack on an aircraft that is taking off or landing.

One other potential standoff attack has been brought up in the media, but its actual use remains in question. In Iraq, some observers have discussed the use of so-called aerial IEDs. An aerial IED is a shaped-charge explosive that is placed along the known flight paths of a helicopter. When the helicopter flies over the IED, it is detonated, sending a cloud of shrapnel into the flight path. The helicopter quickly ingests the shrapnel, causing the engine to flame out at a high speed and low altitude. The helicopter crashes before the crew has time to react. With the known flight paths around an airport, this type of device could be very effective.

12

INDICATORS OF TERRORIST THREAT

Key indicators of terrorist activity

Surveillance

Elicitation

Testing Security

Acquiring Supplies

Suspicious persons

Trial runs

Deploying assets

4/5/2021

SEC421

13

The key indicators of terrorist activity have been defined as (1) surveillance, (2) elicitation, (3) testing security, (4) acquiring supplies, (5) suspicious persons, (6) trial runs, and (7) deploying assets. In addition to what has already been listed, these activities should also be regarded as suspicious (with respect to context):

Counter surveillance and testing of security procedures

Elicitation of information from security and police personnel

Attempts to enter secure facilities, or attempts to smuggle contraband onto the premises

Stockpiles currency (cash), weapons, ammunition, or in possession of multiple forms of identification, passports, driver’s licenses

Espouses extremists views in the workplace, social media or in personal communications

Attempts to acquire or in possession of blueprints, layout plans of sensitive or governmental infrastructure

Commits hoaxes or makes statements to determine the response

13

How to Identify and Respond to Suspicious Behavior

https:// www.youtube.com/watch?v=vlEELMeyHks&index=42&list=PL2E3ktkpAeeZlDJFe0q1VidLqZfRwjITp&t=0s

4/5/2021

SEC421

14

EXERCISE

Split into 10 groups

Groups 1-5 – Terrorists

Develop a scenario to attack aviation

Include the logistics required to carry out the attack (planning)

DON’T GO OVERBOARD WITH YOUR SCENARIO

Group 6-10 – Canadian Security Intelligence Service

Develop the security measures they will use to try and counter the threat.

STAY WITHIN REASONABLE MEASURES

4/5/2021

SEC421

15

And exercise that is popular for this chapter is to put the students in groups, and send one group into another room. Have the groups then develop their own types of attacks on aviation and include the logistics.

 

The group in the other room represents Homeland Security. Their job is to describe the security system measures they will use to try and counter the threats being generated in the classroom. However they do not know what those threats are. Ensure that the terrorist groups do not go way overboard into science fiction and ensure that the homeland security group stays within reasonable measures that are affordable and sustainable.

 

Have the “terrorist” groups get together with the homeland security group and compare notes to see if the Homeland security groups measures would have successfully countered the attack.

Group 1 – Airport Assault (5)

Group 2 - Air Cargo (6)

Group 3 – General Aviation (8)

Group 4 – International Airline

Group 5 – Domestic Airline

15