IRTB Module 02 PG 01.2017

Incident Response to Terrorist Bombings
Training Support Package Participant Guide
Table of Contents
Table of Contents .......................................................................................................... 1
MODULE 2 UNDERSTANDING TERRORIST BOMBING INCIDENTS –
Administration Page ..................................................................................................... 2
Duration ....................................................................................................................... 2
Scope Statement ......................................................................................................... 2
Terminal Learning Objectives (TLO) ............................................................................ 2
Enabling Learning Objectives (ELO)............................................................................ 2
Resources ................................................................................................................... 2
Instructor to Participant Ratio ...................................................................................... 3
Reference List ............................................................................................................. 3
Assessment Strategy ................................................................................................... 3
ICON MAP ...................................................................................................................... 4
MODULE INTRODUCTION ............................................................................................ 5
BASIC DEFINITIONS ................................................................................................... 10
COMMON CHARACTERISTICS OF TERRORISTS .................................................... 16
TERRORIST ORGANIZATIONS .................................................................................. 23
TERRORISM AND ENERGETIC MATERIALS IN HISTORY ....................................... 41
TERRORIST TARGETS, PLANNING, AND EXECUTION ........................................... 46
PRE-ATTACK INDICATORS AND COUNTERMEASURES ........................................ 67
SUMMARY .................................................................................................................... 72
January 2017 Version 01.2017 Page 2-1

Emergency Operations Sensitive
MODULE 2 UNDERSTANDING TERRORIST BOMBING

INCIDENTS – Administration Page
Duration
1.75 Hours
Scope Statement
This module sets the stage for the contemporary use of explosives and incendiaries in
terrorist attacks. Included are discussions of pertinent terminology, descriptions of
terrorist targeting criteria, preparatory activity prior to attack, and tactics used by
terrorists when employing explosives and incendiaries. The module will focus on
assisting participants in developing an awareness of potential targets in their home
communities, and in recognizing pre-attack indicators of a terrorist attack.
Terminal Learning Objectives (TLO)
At the conclusion of this module, participants will be able to identify pre-attack
indicators, tactics, and techniques likely to be used during terrorist attacks.
Enabling Learning Objectives (ELO)
2-1 Define the terms energetic material, terrorism, and weapons of mass
destruction (WMD).
2-2 Identify common characteristics of terrorists.
2-3 Identify types of international and domestic terrorist organizations and
their goals.
2-4 Identify reasons why terrorists often select energetic materials for use in
their attacks.
2-5 Identify characteristics of potential targets for a terrorist attack.
2-6 Identify the steps in terrorist planning and execution for a bombing attack.
2-7 Identify sources where terrorists acquire information and obtain explosive
and incendiary material, devices, and device components.
2-8 Identify common terrorist methods for packaging and delivery of explosive
and incendiary devices.
2-9 Identify types of WMD materials (including chemical, biological, and
radiological) that can be disseminated using conventional explosives.
2-10 Identify common indicators of terrorist preoperational surveillance and
basic first responder countermeasures.
Resources
• IRTB Course Handouts, including course evaluation forms, pre-test forms,
registration forms, travel reimbursement forms, and participant self-evaluation
forms (one per participant).
• Pencil or pen, protective glasses, badge, and nameplate (one per participant).

• Flash drive containing Participant Guide, Video Library, Case Study Library, and
Additional Resources (one per participant).
• Digital projectors, flip-chart, and whiteboard.
• Slides and video clips.
Instructor to Participant Ratio
Conference (Classroom–2:50; Range–3:50).
Reference List
See Appendices.
Assessment Strategy
• Observation of the level and quality of classroom participation.
• Participation and quality of performance on the course performance exercise.
• Administration of the post-test to assess mastery of module objectives (TLO and
ELOs).

ICON MAP
Question: Used when there is an opportunity to ask a question or start a class
discussion.
Key Points/Learning Objectives: Used to highlight each time lesson content is

directly relevant to an Enabling Learning Objective.
First Responder Safety: Used to highlight information that relates directly to the
personal safety of first responders.

MODULE INTRODUCTION
Slide 2-1 IRTB Module 2
Terrorist groups have the capability to strike U.S. targets using

energetic materials. They have demonstrated this capability on
several occasions. For instance, the attacks of September 11, 2001
involved energetic materials—fuel—delivered by large, commercial
aircraft flying at high speed. Previous attacks on the World Trade
Center in 1993 and the Alfred P. Murrah Federal Building in
Oklahoma City in 1995 also involved large explosive devices.
Lastly, the 2013 Boston Marathon bombing involved small
improvised explosive devices (IEDs) that were carried in
backpacks.
To prepare for potential terrorist attacks, managers in emergency

response organizations must be able to identify potential targets in
their communities and understand the tactics and techniques that
terrorists are likely to use when executing such attacks. This
module supports subsequent instruction in this program. A basic
understanding of the terrorist threat and how terrorists are likely to
execute and attack using energetic materials is a prerequisite for
mastering much of the material that follows.

Slide 2-2 Terminal Learning Objective
At the conclusion of this module, participants will be able to identify

pre-attack indicators, tactics, and techniques likely to be used
during terrorist attacks.

Slide 2-3 Enabling Learning Objectives

Enabling Learning Objectives (cont.)

2-7 Identify sources where terrorists acquire information
and obtain explosive and incendiary material, devices,
and device components.
2-8 Identify common terrorist methods for packaging and
delivery of explosive and incendiary devices.
2-9 Identify types of WMD materials (including chemical,
biological, and radiological) that can be disseminated
using conventional explosives.
2-10 Identify common indicators of terrorist preoperational
surveillance and basic first responder
countermeasures.
EMERGENCY OPERATIONS SENSITIVE Module 2, Slide 2-4
Slide 2-4 ELOs (cont.)
2-1 Define the terms energetic material, terrorism, and weapons

of mass destruction (WMD).
2-2 Identify common characteristics of terrorists.
2-3 Identify types of international and domestic terrorist
organizations and their goals.
2-4 Identify reasons why terrorists often select energetic
materials for use in their attacks.
2-5 Identify characteristics of potential targets for a terrorist
attack.
2-6 Identify the steps in terrorist planning and execution for a
bombing attack.
2-7 Identify sources where terrorists acquire information and
obtain explosive and incendiary material, devices, and
device components.
2-8 Identify common terrorist methods for packaging and
delivery of explosive and incendiary devices.
2-9 Identify types of WMD materials (including chemical,
biological, and radiological) that can be disseminated using
conventional explosives.
2-10 Identify common indicators of terrorist preoperational
surveillance and basic first responder countermeasures.

Slide 2-5 Course Map
Module 2 is the first module focusing on background knowledge of

terrorism and explosives. This background knowledge will help the
participants participate more effectively in discussions in later
modules, which deal with response to terrorist bombing incidents.

BASIC DEFINITIONS
Slide 2-6 Energetic Material
ELO 2-1
Define the terms energetic material, terrorism, and weapon of
mass destruction (WMD).
This slide contains two photographs of energetic materials

exploding.
An energetic material is one that can undergo rapid chemical

decomposition giving off heat, light, and sound and release a large
amount of energy. Energetic materials include explosives and
incendiaries.

Slide 2-7 Definitions of Terrorism
This slide contains an image of armed terrorists displaying their

weapons in silhouette.
There is no single, universally accepted, definition of terrorism.

Terrorism is defined in a number of different ways in different
federal agencies, international organizations, and research
communities. Many organizations favor the definition used by the
FBI (depicted on this slide):
“The unlawful use of force or violence against persons or property

to intimidate or coerce a government, the civilian population, or any
segment thereof, in furtherance of political or social objectives.”1
Most definitions of terrorism share common components. Terrorist

acts are typically unlawful and involve force, violence, or coercion
against members of the civilian population (or other
noncombatants) in furtherance of political or social objectives.
These acts are intended to coerce or intimidate a government or
civilian population. Terrorists bypass the established institutions for
effecting change in a society because, in most cases, their
1
28 Code of Federal Regulations (C.F.R.) § 0.85 (2010).

objectives lack support from the government and the people.

Terrorists attempt to cause change in government policy through
intimidation of the populace—intimidation that they hope will
translate into government action.
For purposes of this definition, the term “civilian” includes military

personnel who at the time of the incident are unarmed and/or not
on duty. Attacks on military installations or on armed military
personnel when a state of military hostilities does not exist at the
location (such as bombings against U.S. bases in Europe) are also
considered acts of terrorism.
Such incidents include the October 12, 2000 attack on the USS
Cole. Seventeen American sailors were killed and 39 were injured
when the USS Cole, which was anchored for refueling in the
Yemeni port of Aden, was attacked by a small boat carrying
explosives. Al-Qaeda claimed responsibility for the attack. The
United States was not in a state of war at that time.

Slide 2-8 Weapon of Mass Destruction 18 USC 2332 a
This slide presents the definition of WMDs as found in Title 18 of

the United States Code.

Slide 2-9 WMD 18 USC Section 921(a)(4)
This slide presents definitions of WMDs as found in Section 18 of

the United States Code.
The term WMD is often used inappropriately to refer only to

chemical, biological, radiological, or nuclear devices or materials.
However, conventional explosive devices are also recognized as
destructive devices or WMDs. In fact, under the definitions of U.S.
Code Section 921 relating to 18 USC 2332 a(c), the minimum
amount of explosives needed to classify something as a destructive
device, as it relates to WMDs, is four ounces.
This course focuses on energetic materials or explosives. However,

it is important for first responders to remember that chemical,
biological, radiological, or nuclear weapons can also be
disseminated by conventional explosives. (See notes on “Potential
Explosive Dissemination of WMD Materials” on Slide 2-32 for a
discussion of this potential use of conventional explosives.)
While firearms are not necessarily categorized as weapons of mass

destruction, in some recent events, firearms have been used in
conjunction with explosive devices to carry out terrorist objectives
of mass casualties. These multiple-threat situations are discussed
in Module 7 “Responding to Special Situations.” Within the United

States, explosives have been used as weapons of mass

destruction more than all the other types of WMDs combined. A
2012 study by the National Consortium for the Study of Terrorism
and Responses to Terrorism (START Consortium) found that
explosives were used in 52.009% of all terrorist attacks from 1970-
2011.2
2
START Consortium, (2012). “Integrated United States Security Database (IUSSD): Data on the Terrorist Attacks in
the United States Homeland, 1970 to 2011. Final Report to Resilient Systems Division, DHS Science and
Technology Directorate.” http://www.start.umd.edu/sites/default/files/files/publications
/START_IUSSDDataTerroristAttacksUS_1970-2011.pdf

COMMON CHARACTERISTICS OF TERRORISTS
Slide 2-10 Common Characteristics of Terrorists
This slide contains a photo of Ramzi Yousef, the man responsible

for bombing the World Trade Center in 1993 (left). The slide also
contains a photo of Terry Loewen who was convicted for the
attempted bombing of the Wichita, Kansas airport in 2013.

Slide 2-11 Common Characteristics of Terrorists (cont.)
ELO 2-2
Identify common characteristics of terrorists
This slide shows photos of the known terrorists who hijacked four
airplanes and created fuel-air explosions by crashing them into the
World Trade Center, the Pentagon, and a field in Shanksville, PA,
on September 11, 2001.
What attracts someone to terrorist organizations? What makes

someone want to use violence and view it as acceptable? Multiple
government agencies and thousands of professional academics are
dedicated to observing and seeking to understand terrorism and its
manifestations. A growing body of research is helping mental health
professionals, national security experts, and law enforcement
personnel understand the causes of terrorism and develop potential
solutions to this type of terrorist violence. Every person who
engages in terrorist activity has a unique life story and specific
circumstances which led him or her toward the choice to engage in
violence. However, there are some common factors and basic
principles that can help first responders to evaluate threats and
respond more effectively to terrorist incidents.

A few key facts that can help first responders:

 Most terrorists are men. Although 15-24 year-old males
generally commit more crimes than any other age group, a
2015 report by the Southern Poverty Law Center found that
political “lone wolf” or small-cell terrorists are mostly older,
with 53% of these terrorists from 2009-2015 being between
30 and 59 years of age. The report’s findings suggest that
many domestic terrorists, especially right-wing domestic
terrorists (see definitions of these terms in the pages that
follow) may spend years on the radical right, absorbing
ideology, before they finally act out violently.3
 Most people who engage in terrorist acts are not
psychologically deranged, paranoid, or delusional. In
multiple studies psychologists have found that terrorists tend
to be stable individuals and have developed the ability to
“switch off” their sense of empathy in service to their beliefs
or goals.4 They do this in part by regarding people who do
not share their worldview as “other” and refusing to connect
with them or acknowledge commonalities.
 There is no statistical association between poverty and
militant radicalization; many modern terrorists come from
middle-class backgrounds and have university-level
educations.5
 In February 2015, the director of the U.S. National
Counterterrorism Center (NCTC) stated that “we might be
moving into a new era in which centralized leadership of a
terrorist organization matters less, group identity is more
fluid, and violent extremist narratives focus on a wider range
of alleged grievances and enemies.”6
One psychologist who conducted interviews with 60 former

terrorists found that people who are more open to terrorist
recruitment and radicalization tend to:
 Feel angry, alienated or disenfranchised.
3
Southern Povery Law Center (2015).“Age of the Wolf: A Study of the Rise of Lone Wolf and Leaderless Resistance
Terrorism,” p. 12.
4
S. Taylor (2014, Sept. .9). The Psycology of Terrorism; What Makes Young Men Prepare to Kill for a Cause?
[Blog}. Retrieved from https://www.psychologytoday.com/blog/out-the-darkness/201512/the-psychological-
roots-terrorism.
5
Baylouni, A. M., (2004). Emotion, Poverty, or Politics? Misconceptions About radical Islamist Movements.
Connections III, Vol. 4. pp. 41-47 Retrieved from
http://faculty.nps.edu/ambaylou/baylouny%20emotions%20poverty%20politics.PDF
6
Hearing Before the Sente Select Committee on Intelligence. (2015, Feb 12) Current Terrorist Threat to the United
States. Retrieved from: http://www.nctc.gov/docs/Current_Terrorist_Threat_to_the_United_States.pdf

 Believe that their current political involvement does not give

them the power to effect real change.
 Identify with perceived victims of the social injustice they are
fighting.
 Feel the need to take action rather than just talking about the
problem.
 Believe that engaging in violence against the state is not
immoral.
 Have friends or family sympathetic to the cause.
 Believe that joining a movement offers social and psychological
rewards such as adventure, camaraderie and a heightened
sense of identity.7,8
A study conducted by Sandia National Laboratory concluded that

gangs and terrorist organizations evolve around a similar
environment. The following was written about these similarities:
“lack of opportunity for self-realization, a search for structure and
moral order in what appears to be a chaotic world, and the
associated felt devaluation of self-identity. The groups become a
means to define that self, and to provide the resources and share
the responsibility for acts that will create a world within which these
individuals can see hope and opportunity. In order for that world to
be created, the creators (the groups) must speak to someone, must
have an audience for their cause. Hence, violence as theater.”9
7 Horgan, J. (2009). Walking Away from Terrorism Routledge, 23, 186. doi:10.1080/09546553.2011.533083.
8
DeAngelis, T. (2009). Understanding Terrorism. American Psychological Association, 40. 60. Retrieved from
http://www.apa.org/monitor/2009/11/terrorism.aspx.
9
Advanced Concepts Group: Sandia National Laboratories, (2002). Terrorist Organizations and Criminal Street
Gangs; An argument for an Analogy. Retrieved from
http://www.au.af.mil/au/awc/awcgate/sandia/terrorism_gang_analogy.pdf.

Slide 2-12 The Radicalization Process
This slide contains a picture of Neo Nazi in protest on the left. To

the right, a picture of young men at a rally held by members of the
Palestinian organization Hamas, which is designated as a terrorist
organization by the U.S. Department of State.
Radicalization is an important term used in discussing terrorism.

This term has been defined as “the process of adopting an
extremist belief system, including the willingness to use, support, or
facilitate violence, as a method to effect societal change.”10 Use of
this term helps to differentiate between members of groups who
have no connection to terrorist methods and tactics, and those who
are willing to use violent methods and tactics.
It is important to note that almost all people who engage in terrorist

activities, regardless of their religion, nationality, or political
persuasion, seem to go through a generally similar process of
radicalization. According to the U.S. National Counterterrorism
Center, “the grievances that fuel radicalization are diverse and vary
10
Written Testimony of Charles E. Allen before the U. S. Senate Committee of Homeland Security and
Governmental Affairs. (2007, March 14). Threat of Islamic Radicalization to the Homeland. Pg 4 Retrieved
from http://www.investigativeproject.org/documents/testimony/270.pdf.

across locations and groups. Radicalization itself is frequently is

driven by personal concerns at the local level in addition to
frustration with international events.”11 Adept leaders in terrorist
groups skillfully lead recruits along the path of radicalization until
they are ready to take violent action on behalf of their new cause.
Stages of Radicalization12
Pre-radicalization - The first stage of the radicalization process is

where an individual finds his or her motivation and/or conversion
towards extremism. The individual may be influenced by internal
and external factors that heavily influence their decisions. The
opportunity for initial exposure to the new ideas may come at a
religious gathering, on the Internet, at school, a workplace, in
prison, or at conferences. At this stage, the person merely feels a
conversion or orientation toward the new ideas, or recognizes that
they are re-interpreting old ideas in a new way.
Identification - The second stage occurs when the individual

accepts the cause and makes it part of his or her personal identity.
The individual begins to isolate from his/her former life, and begins
to develop social bonds with their new group while forging a new
social identity. As the individual affiliates with more like-minded
individuals, his/her dedication to the cause is strengthened, as is a
desire to prove it. At this stage, the individual may participate in
domestic training, or pursue an overseas experience for religious
training, language training, or basic paramilitary activities. In short,
the individual is developing a propensity for action.
Indoctrination - The third stage, occurs when an individual is

convinced that action is required to support and further a cause but
is unsure or unfamiliar with how to participate. It usually includes
extensive vetting and operational tests to gauge the recruit’s
willingness to participate in an attack. This stage also allows the
recruit to test his/her own resolve.
Action - The fourth and final stage is when the individual commits
an act of terrorism, which can include any of the steps of facilitation,
11 U.S. National Counterterrorism Center. (2009). Radicalization: Myth and Reality. Counterterrorism Calendar, 2009,
132. Retrieved from http://library.uoregon.edu/ec/e-asia/reada/ct_calendar_2009.pdf.
12
Dyer, C., McCoy, R. E., Rodriguez, J., & Van Duyn, D. N. (2007). Countering Violent Islamic Extremism, A
Community Responsibility. FBI Law Enforcement Bulletin, 76 (12). Retrieved from https://leb.fbi.gov/2007-
pdfs/leb-december-2007

recruitment, or financing. This is the stage where an attack is

prepared, planned and executed.
Information was taken from The FBI Intelligence Assessment, “The

Radicalization Process: From Conversion to Jihad,” dated May 10,
2006. You can also find more information from the article
“Countering Violent Islamic Extremism: A Community
Responsibility” by Carol Dyer, Ryan E. McCoy, Joel Rodriquez, and
Donald N. Van Duyn, published in the FBI Law Enforcement
Bulletin December 2007, Volume 76 Number 12.

TERRORIST ORGANIZATIONS
Slide 2-13 Terrorist Organizations
ELO 2-3
Identify types of international and domestic terrorist
organizations and their goals.
Although terrorist groups can be categorized along a number of

different dimensions, the FBI separates terrorism into two broad
categories: domestic and international.
Domestic terrorism refers to activities that involve acts dangerous

to human life that are a violation of the criminal laws of the United
States or of any state; appear to be intended to intimidate or coerce
a civilian population; influence the policy of a government by mass
destruction, assassination, or kidnapping; and occur primarily within
the territorial jurisdiction of the United States [italics added].13
Domestic terrorist groups can be further subdivided into the
following categories: right-wing, left-wing, special interest, lone wolf,
and homegrown violent extremist.
13
18 U.S.C. § 2331(5).

International Terrorism refers to terrorist acts that “occur primarily

outside the territorial jurisdiction of the United States or transcend
national boundaries in terms of the means by which they are
accomplished, the persons they appear intended to intimidate or
coerce, or the locale in which their perpetrators operate or seek
asylum.”14 International terrorism can also be subdivided into two
categories: formal organizations and loosely affiliated.
The class will examine each of these domestic and international

terrorism subgroups, starting with the phenomenon of domestic
terrorism.
14
18 U.S.C. § 2331(1).

Slide 2-14 Domestic Terrorism: Right-Wing Terrorism
This slide contains photos of Terry Nichols (left) and Timothy

McVeigh, co-conspirators in the 1995 bombing of the Alfred P.
Murrah Federal Building in Oklahoma City, OK.
Right-wing Terrorism includes groups that generally adhere to an

anti-government or racist ideology that attracts supporters from
among the disaffected in the United States. These groups include
some so-called militia organizations that not only prepare to defend
themselves against perceived government overreach, but also plan
and attempt to execute offensive operations designed to disrupt the
function of government. White supremacy groups also fall into this
category. Right-wing terrorists typically target government
employees and/or facilities. Some examples of right-wing groups
include the following:
Anti-Government
• Sovereign Citizens
• Militias

Example: Sovereign Citizens Movement15

The sovereign citizen movement is a loose term for an informal
group who believe that they are answerable only to their particular
interpretation of the law. Furthermore, they believe that they are not
subject to any statutes or proceedings at the federal, state, or
municipal levels. Participants in the movement especially reject
taxation because they see it as illegitimate. Self-identified sovereign
citizens have been involved in many acts of violence and numerous
tax evasion/fraud schemes, as well as countless cases of “paper
terrorism” in which they attempt to clog and slow government
bureaucracies with false notices of liens or other fraudulent
paperwork; paper is the Sovereign Citizens’ weapon of choice. The
FBI classifies some sovereign citizen extremists as domestic
terrorists. The most notable is Timothy McVeigh and co-conspirator
Terry Nichols in the Oklahoma City bombing in 1995 (both are
pictured on the slide), who was a member of the movement and
had asserted individual sovereignty in at least three court cases.
Religious-oriented Extremists
• Phineas Priesthood
• Army of God
Racist/Hate Groups
• Ku Klux Klan (KKK)
• Neo-Nazis
• Skinheads
• National Alliance
Example: Dr. Martin Luther King Jr. (MLK) Parade Bombing

Plot16,17
On January 17, 2011, during the Dr. Martin Luther King Jr.
memorial parade in Spokane, WA, three contract city workers
spotted a backpack on a bench next to the parade route. The
workers looked into the backpack and observed wires. They called
the police who secured the area. The police immediately diverted
thousands of marchers to a safe route, and the bomb squad was
15
The Federal Bureau of Investigation. (2010). Domestic Terrorism, The Sovereign Citizens Movement. Retrieved
from https://archives.fbi.gov/archives/news/stories/2010/april/sovereigncitizens_041310/domestic-terrorism-
the-sovereign-citizen-movement.
16
Ryan, Jason, & Esposito, Richard. (2011, January 18). FBI: Pipe Bomb Found on MLK Parade Route. Retrieved
from http://abcnews.go.com.
17
Richey, Warren. (2011, December 20). Failed Martin Luther King Day parade bomber gets 32-year sentence.
Retrieved from http://www.csmonitor.com.

called to assess the backpack. Using a bomb robot, the bomb

squad rendered the backpack safe. The backpack contained a
radio-controlled pipe bomb. The backpack was “packed with 128
0.25-ounce fishing weights coated with the anticoagulant
brodifacoum, an active ingredient in rat poison”, 100 grams of black
powder, a model rocket igniter, and a remote-control triggering
system. On March 9, 2011, the FBI identified and arrested ex-army
soldier Kevin William Harpham. Harpham is believed to have acted
as a lone wolf and a member of the white supremacist organization,
National Alliance. As a participant in the parade, Harpham planned
to remotely detonate his device when he came within range on the
parade route. When the parade was diverted, he was never able to
get close enough to the backpack he planted to set off the remote
detonation device.18 Harpham eventually pled guilty and was
sentenced to 32 years in prison. This example demonstrates that
right wing domestic terrorists are active in the United States. First
responders should familiarize themselves with the active right wing
individuals and groups in their jurisdictions.
A 2014 report by the National Consortium for the Study of

Terrorism and Response to Terrorism found that law enforcement
officials and agencies across the United States concluded that
domestic terrorism was the single greatest threat to their
communities, ranking above Islamic terrorists and jihadists.19
The report states that “There’s no question that the jihadist threat is
a tremendous one. Close to 3,000 Americans were murdered by al-
Qaeda on September 11, 2001, far more than the number killed by
any other form of terrorism. And officials are now warning that the
Islamic State, known for its barbaric beheadings and the burning
alive of a Jordanian pilot, may be plotting to kidnap Americans
abroad in a slew of other countries. But that is not the only terrorist
threat facing Americans today. A large number of independent
studies have agreed that since the 9/11 mass murder, more people
have been killed in America by non-Islamic domestic terrorists than
jihadists. That fact is also apparent in the new Southern Poverty
18
Cuniff, M.M. (2012, January 11). Police step up march presence. The Spokesman—Review. Retrieved from
http://www.spokesman.com/stories/2012/jan/11/police-step-up-march-presence/
19
Carter, D., Chermak, S., Carter, J. & Drew, J. (2014). Understanding Law Enforcement Intelligence Processes:
Report to the Office of University Programs, Science and Technology Directorate, U.S. Department of
Homeland Security, National Consortium for the Study of Terrorism and Responses to Terrorism Retrieved
from https://www.start.umd.edu/pubs/START_UnderstandingLawEnforcementIntelligenceProcesses
July2014.pdf

Law Center (SPLC) study of the 2009-2015 period. The report can
be viewed or downloaded at
https://www.splcenter.org/sites/default/files/d6_legacy_files/downlo
ads/publication/lone_wolf_special_report_0.pdf.”20
20
Rivinius, J. (2014). Sovereign Citizen Movement Perceived as Top Terrorist Threat. National Consortium for the
Study of Terrorism and Responses to Terrorism, Retrieved from
http://www.start.umd.edu/news/sovereign-citizen-movement-perceived-top-terrorist-threat

Slide 2-15 Domestic Terrorism: Left-Wing Terrorism
This slide contains a logo for the Armed Forces for National
Liberation of Puerto Rico (FALN), a formerly active left-wing
terrorism group.
Left-wing Terrorism includes groups that generally adhere to a

communist or socialist ideology. During the period 1950–1980, left-
wing groups posed the dominant domestic threat in the United
States. However, with the disintegration of the former Soviet Union,
many of these groups have been deprived of a coherent ideology or
a spiritual patron. As a result, membership and support for these
groups has waned.
Left-wing terrorists such as the Anarchist Extremists may target

government individuals and facilities; they are also likely to target
symbols of American industry, commerce, and culture, such as
historic sites and monuments.

Slide 2-16 Domestic Terrorism: Special Interest
This slide contains pictures of bomber Eric Robert Rudolph (left)

and a cover of the “Liberator” magazine of the Animal Liberation
Front.
Special Interest Terrorism is characterized by activities directed for

or against a specific cause. Special interest terrorists use violence
to express objections to abortion, and in support of radical
environmentalism and animal-rights causes. Potential targets of
special interest terrorists include abortion clinics, animal-research
laboratories, fur dealers, automobile dealerships, restaurants that
serve beef and other animal products, animal-processing plants,
vacation resorts located in undeveloped areas, and housing
developments that extend built-up areas into previously natural
areas. There is also potential for attacks on oil refineries and other
locations that process raw materials into products for human use.
Some examples of special interest terrorist groups include the
following:
Animal Rights
• Animal Liberation Front (ALF)
Environmental Issues
• Earth Liberation Front (ELF)

Abortion Issues
 Anti-Abortion extremists
Examples of special interest terrorism include:

 Bombings attributed to Eric Robert Rudolph
o 1996 Centennial Olympic Park bombing in Atlanta,
GA during the Summer Olympics (killing one and
wounding 111)
o Bombing of an abortion clinic in Sandy Springs, GA
on January 16, 1997
o Bombing of the Otherside Lounge, an Atlanta gay bar,
on February 21, 1997
o Bombing of an abortion clinic in Birmingham,
Alabama on January 29, 1998, killing Robert
Sanderson (an off-duty police officer who was working
as a security guard) and critically injuring nurse Emily
Lyons
 Attacks on animal research facilities and stores selling

animal products, attributed to the extremist animal-rights
group, Animal Liberation Front (ALF) from the 1970s to the
present. ALF tactics have included explosives, incendiary
devices, arson, property destruction, and setting animals
free. ALF used explosives to destroy three night-deposit
boxes at three separate Wachovia banks in 2007. Wachovia
bank was the largest shareholder of the Huntington Life
Sciences which ALF opposes for the testing of products on
animals at its laboratories in England and the United States.
In 2006, ALF also placed hoax explosives at the homes of
five senior staff members linked to Huntington Life Sciences.
ALF is active in the United States and has proved they have
the capability and the desire to use explosives.
 Attacks attributed to members of a radical environmental

group called the Earth Liberation Front (ELF) which was
founded in England in 1992, including an attack on an
automobile dealership in 2001 to express objections to the
use of natural resources in support of modern society. ELF
has also attacked housing developments and ski areas. ELF
has not claimed any major terrorist acts since 2009;
however, they are still an active organization and have
supporters in the United States. The only reported use of

explosives by the ELF was in 2008 when explosives were

used to set fire to four multimillion dollar homes which
caused seven million dollars’ worth of damage.

Slide 2-17 Lone Wolf Terrorists and Homegrown Violent

Extremists
This slide contains pictures of Tamerlan (left) and Dzokhar

Tsarnaev (right), the brothers who planned and carried out the
Boston Marathon bombings on April 15, 2013.
Two other types of terrorists are recognized by U.S.

counterterrorism organizations and are becoming increasingly
problematic: Homegrown Violent Extremists (HVE) and the Lone
Wolf.
The term “Lone Wolf”21 is used to describe a single person who

commits violent acts in support of a group, movement, or ideology,
but who does so alone, outside of any command structure and
without material assistance from any group. Although the lone wolf
terrorist acts independently, he or she may be influenced or
indoctrinated by the ideology or beliefs of a more formal group,
often through social media and Internet communications. Lone wolf
terrorists may be international or domestic, and could be motivated
by any type of political philosophy.
21
Dyson, W. E. (2016). Terrorism, An Investigator’s Handbook (4th ed.). Content Technologies, Inc.

DHS defines a “Homegrown Violent Extremist” as a person of

any citizenship who has lived and/or operated primarily in the
United States or its territories who advocates, is engaged in, or is
preparing to engage in ideologically-motivated terrorist activities
(including providing support to terrorism) in furtherance of political
or social objectives promoted by a foreign terrorist organization, but
is acting independently of direction by a foreign terrorist
organization.22
Recent examples of lone wolf terrorist events include:

 December 2, 2015 -- San Bernardino terrorist attack by
husband and wife Syed Farook and Tashfeen Malik.
Firearms were used, however they attempted to set off an
explosive device and possessed other IED explosives.
 November 28, 2014 – Attack on Austin, Texas police
headquarters and Federal Courthouse by a self-proclaimed
member of the Phineas Priesthood, Larry Steve
McQuilliams, using firebombs, improvised explosive devices,
and guns.
 April 15, 2013 – Boston Marathon bombing by Dzhokhar and
Tamerlan Tsarnaev, using pressure cooker bombs they built
following instructions from the al-Qaeda Inspire magazine.
A 2015 report23 by the Southern Poverty Law Center found that

74% of domestic terrorism events over the years from 2009-2015
were carried out or planned by a “lone wolf,” a single person
operating entirely alone. The study found that a total of 90% of the
domestic terrorism incidents in that time were the work of just one
or two persons.
22
Department of Homeland Security. (2016) Countering Violent Extremism. Retrieved from
http://www.dhs.gov/topic/countering-violent-extremism.
23
Southern Povery Law Center (2015).“Age of the Wolf: A Study of the Rise of Lone Wolf and Leaderless
Resistance Terrorism,” p. 4.

Slide 2-18 International Terrorism
This slide contains a photo of the World Trade Center towers in

New York City on September 11, 2001 during the attacks planned
by al-Qaeda.
International Terrorism24 involves violent acts or acts dangerous to

human life that are a violation of the criminal laws of the U.S. or any
state, or that would be a criminal violation if committed within the
jurisdiction of the U.S. or any state. These acts appear to be
intended to intimidate or coerce a civilian population; influence the
policy of a government by intimidation or coercion; or affect the
conduct of a government by mass destruction, assassination, or
kidnapping. Targets are often symbolic (such as the World Trade
Center) or locations that offer the opportunity to cause mass
destruction, mass casualties, negative financial impact, or all of the
above.
The U.S. Code definition states that acts of international terrorism

“occur primarily outside the territorial jurisdiction of the United
States or transcend national boundaries in terms of the means by
24
18 U.S. Code § 2331 (1).

which they are accomplished, the persons they appear intended to

intimidate or coerce, or the locale in which their perpetrators
operate or seek asylum [italics added].”25
The 1993 and 2001 World Trade Center attacks are examples of
international terrorism. These attacks clearly transcended national
boundaries. Terrorists from foreign countries, supported by foreign
sources, crossed an international boundary to attack targets in the
U.S.
It should be noted that international terrorists can receive direct

sponsorship from a foreign government or operate in a largely
autonomous fashion, sometimes with limited, indirect support from
foreign governments.
25
18 U.S.C. § 2331(1).

Slide 2-19 International Terrorism: Formal Groups
This slide contains a photo from Islamic State video, depicting

Islamic State militants preparing for a mass beheading of captured
Syrian military personnel in 2015.
Formal groups have their own infrastructures, personnel, financial

arrangements, and training facilities. In some cases, these groups
receive funding support from foreign governments, but the groups
direct their own operations. They can plan and execute terrorist
campaigns overseas and support terrorist operations inside the
United States. Extremist groups such as the Lebanese Hizballah,
the Egyptian al-Gama’a al-Islamiyya, and the Palestinian HAMAS
have supporters inside the U.S. who could act in support of
terrorism here.
The Islamic State of Iraq and Syria (ISIS, also known as the Islamic
State of Iraq and the Levant (ISIL) as well as Daesh) is another
formal terrorist group that has rapidly gained power in the Middle
East and parts of Africa since proclaiming itself to be a worldwide
caliphate on June 29, 2014. Islamic State followers have claimed
responsibility for a number of terrorist activities worldwide, including
inside the United States. Major Islamic State-sponsored terror
events include:

 The January 2015 attack on French magazine Charlie

Hebdo headquarters (killing 12)
 The bomb that brought down Russian airliner Metrojet
Flight 9268 in the Sinai peninsula on October 31, 2015
(killing 224)
 Two suicide bombings near Beirut, Lebanon on
November 12, 2015 (killing 43)
 The coordinated attacks in Paris on November 13, 2015
(killing 129 and injuring 352)
 The attacks in Brussels, Belgium on March 22, 2016
(killing 35 and injuring over 300)

Slide 2-20 International Terrorism: Loosely-Affiliated
This slide contains a photograph of an Al-shabab group in Somalia

warning Kenya to pull out its troops from the country.
Loosely-affiliated international radical extremists, such as Ramzi

Ahmed Yousef, and the other 1993 World Trade Center bombers,
also present a threat to U.S. interests. These extremists are neither
surrogates of, nor strongly influenced by, any one nation; however,
they have the ability to access a variety of official and private
resource bases to facilitate terrorist acts. Loosely-affiliated radical
terrorist groups are well-organized and well-financed, but typically
operate in structured, hierarchical cells in numerous countries
throughout the world. Within this category, extremists have
demonstrated a willingness and capability to carry out attacks
resulting in large-scale casualties and destruction against U.S.
citizens, facilities, and interests.
The al-Qaeda network is perhaps the most well-known example of

a loosely-affiliated terrorism group. Their network is known to be
adaptive, complex, and resilient, taking strength from its formal
organization structure with a core group of leaders providing overall
direction. They also have a network of informal relationships
creating an underlying latticed structure that connects network
operatives across the world. Since the 2011 death of Osama bin

Laden, the group has adapted, and local franchises in Pakistan,

Iraq, and the Maghreb area of northern Africa have gained strength.

TERRORISM AND ENERGETIC MATERIALS IN HISTORY
Slide 2-21 Why Energetic Materials?
ELO 2-4
Identify reasons why terrorists often select energetic materials
for use in their attacks.
Terrorists often use energetic materials because they provide a

dramatic, low-risk, low-cost, yet high-yield tool for making a public
statement. Chemical precursors of explosives and device
components are readily available and their use leaves an obvious
and often long-lasting record of the event. Explosives have proven
to be an effective means of achieving the terrorist intent.
In addition, a lone terrorist or small group with limited skills and

resources can prepare and deliver explosive or incendiary devices.
This opportunity complicates attempts to detect and deter attacks
as well as identify the sponsors of such terrorism. Furthermore, with
the exception of suicide bombers, use of explosives and incendiary
devices permits an attacker to leave the targeted location, thus
protecting him or her from harm, identification, and apprehension.

A successful bomb attack receives substantial media attention;

large or small attacks focus the attention of the world and local
communities on the incident location of the “successful” terrorist
operation. These events suggest that governments cannot protect
their citizens. When a group claims credit for an attack or attacks,
such as those of September 11, 2001, the bombing draws attention
to the interests of the responsible terrorist group.
The use of suicide bombers raises fear and apprehension among

members of the public. The fanaticism associated with such attacks
makes early detection and interdiction extremely difficult.
The use of explosives devices by terrorist groups is reported

annually by the National Consortium for the Study of Terrorism and
Responses to Terrorism to the U.S. Department of State. Explosive
devices are the most common weapons used in terrorist attacks
worldwide and cause the greatest number of deaths and injuries.26
26
START Consortium, (2016). “Annex of Statistical Information: Country Reports on Terrorism 2015.” Retrieved from
http://www.state.gov/documents/organization/257738.pdf.

Slide 2-22 Significant Bombing Incidents in the United

States
The slide contains pictures of a newspaper from December 1951

about the racially-motivated bombing of a prominent black leader’s
home, a picture of the Los Angeles Times building after a bombing
in October 1910, and a picture of a newspaper from November
1917 about a bombing at a Milwaukee police station that killed 11
people.
Terrorists have been using explosives to accomplish their

objectives in the United States for many years, with an increasing
frequency in recent decades. The following list, taken from a
timeline entitled Terrorist attacks and related incidents in the United
States27, summarizes some of the significant bombing incidents in
U.S. history.
October 1, 1910 Bombing - LA Times building, 21 deaths
July 22, 1916 Bombing - Preparedness Day parade,

San Francisco, 10 deaths
27
Johnston, Wm. Robert. (2016, February 16). Terrorist attacks and related incidents in the United States.
Retrieved from http://www.johnstonsarchive.net/terrorism/wrjp255a.html.

November 24, 1917 Bombing - Milwaukee Police station, 10

deaths
September 16, 1920 Bombing - Wall Street by horse drawn

carriage, 38 deaths
May 18, 1927 Bombing - Bath Michigan school, 48

deaths
October 10, 1933 Bombing - United Airlines Boeing 247

thought to be the first aircraft act of
sabotage in commercial aviation, 7
deaths
December 21, 1951 Bombing - NAACP president’s home in

Florida. First NAACP civil rights leader
to be murdered, 2 deaths
August 7, 1969 Bombing - Marine Midland Building,

New York City by anti-government, anti-
Vietnam war activist, 20 injured
August 24, 1970 Bombing - Sterling Hall at the University

of Wisconsin Anti-Vietnam war activist,
1 death
December 29, 1975 Bombing - Locker at La Guardia Airport,

New York, 11 deaths
May 25, 1978 Bombing - Mail bomb slightly injures

campus police officer at Northwestern
University. Unabomber’s first bomb
November 7, 1983 Bombing - U.S Capitol building, no

injuries
December 11, 1985 Bombing - Hugh Scrutton, computer

storeowner, Sacramento, California.
First death from a Unabomber explosive
device
February 26, 1993 Bombing - Truck Bomb World Trade

Center, New York, 6 deaths

April 19, 1995 Bombing - Truck Bomb, Oklahoma City,

Alfred P. Murrah Federal Building, 169
deaths
July 27, 1996 Bombing - Centennial Olympic Park,

Atlanta summer Olympic Games, 2
deaths. Fist bombing for Eric Robert
Rudolph
July 16, 1997 Bombing - Abortion clinic in Sandy

Spring, Georgia. Secondary device used
to injure first responders, no deaths. Eric
Robert Rudolph
January 29, 1998 Bombing - Abortion clinic in

Birmingham, Alabama. Birmingham
police officer was killed. Eric Robert
Rudolph
September 11, 2001 Crashed 2 hijacked airplanes into the

World Trade Center buildings, 2759
deaths
Crashed a hijacked airplane into

Pentagon, 189 deaths
Crashed a hijacked airplane into the

ground at Somerset County,
Pennsylvania, 45 deaths
April 15, 2013 Bombing - During the Boston Marathon,

3 deaths

TERRORIST TARGETS, PLANNING, AND EXECUTION
Slide 2-23 Terrorism Affects the Entire U.S.
The map on this slide depicts IED attacks in the United States from
2010 through 2016, demonstrating that terrorist bombings have
touched communities throughout the country. This graphic was
developed for the DHS website TRIPwire (Technical Resource for
Incident Prevention).
ELO 2-5
Identify characteristics of potential targets for a terrorist
attack.
Although many previous attacks have occurred in large cities,

terrorist attacks can occur at any location where there is an
attractive target. The ability of electronic media to transmit
photographs and video sequences worldwide makes any location
an appropriate venue for internationalizing a terrorist cause.
No part of the U.S. has been immune to terrorist activity. Even

remote, isolated rural areas have been targeted by terrorists with
specialized causes and messages. The selection of potential
targets for terrorist attacks is largely a function of a particular

terrorist group’s objectives and capabilities. Although it is beyond

the scope of this course to address all groups that pose a potential
threat to the U.S., it is important to understand how various groups
of terrorists view the world and their role in it.

Slide 2-23 Potential Targets
Terrorists have targeted a wide range of individuals and structures

in their attacks. History shows that government personnel and
government structures are frequent terrorist targets, as are other
locations where terrorists can cause extensive damage and
casualties.
Some terrorists focus on physical symbols such as the World Trade

Center. Others want to intensify the terror aspect by focusing on
human targets, based on the belief that the greater the number of
casualties, the greater the impact of an attack. While attacks may
appear to be isolated events, they sometimes are part of an overall
plan that includes multiple targets. Sometimes, terrorists engage in
common criminal acts, such as bank robberies or extortion, to
obtain funds to continue their campaigns.
First responders may be primary or secondary targets. Terrorists

can directly target law enforcement officers, firefighters, and other
responders. They can also employ secondary devices to attack
emergency responders when they are operating in response to an
initial improvised explosive device (IED) attack.
Experienced first responders recognize that it is not possible to plan

for every eventuality or potential target; however, identification and

prioritization of potential targets for terrorists is an important task

early in response planning.
Response uses a reverse process to identify those targets at home

that have a greater likelihood of being selected by a terrorist. By
identifying and prioritizing the attractiveness of potential targets,
one can focus and prioritize efforts in planning, equipping, training,
and exercising (PETE) response alternatives. Determining who is at
risk and what the targets are depends on several factors. A key
element for a terrorist is symbolism. An adjunct of this element is
the visibility of a target—the higher the profile, the better the target.
Some examples of critical infrastructure and high-profile, potential
terrorist targets include:
• Federal, state, and local government buildings.
• Mass transit facilities (subways, airports, and train stations, as
well as conveyances, support equipment, and utility
connections. Note that the definition of “mass transit” varies for
each community).
• Landmark structures, public buildings, and assembly areas
(shopping malls, sports complexes, theaters).
• Controversial businesses (abortion clinics, fur stores, research
laboratories, military contractors).
• Religious institutions
• Communication and utility facilities (fuel depots, gas lines,
nuclear power plants, electrical distribution centers, waste
disposal).
• Research laboratories (those engaged in military research or
research involving laboratory animals).
• Other locations where masses of people congregate or that
serve masses of people (including churches)
• Locations hosting symbolically significant events, including on
significant dates (such as the Boston Marathon or the Garland,
Texas shooting)
• Local response assets (including police stations, fire stations, or
hospitals).
• Other critical infrastructure (financial centers, medical facilities,
dams, waterways, bridges, tunnels).
Terrorists have also been known to plan attacks for a specific,

significant date or the anniversary of a significant event. The
National Counterterrorism Center publishes an annually-updated
calendar listing dates that terrorists may believe are important if
planning attacks to commemorate certain events. This valuable
resource contains many features across the full range of issues

pertaining to international terrorism, including terrorist groups,

wanted terrorists, and technical pages on various threats. This list
of dates can be downloaded at:
http://www.nctc.gov/site/pdfs/ct_calendar_2015.pdf
High-priority targets can include locations where bomb squads,

hazardous materials (HazMat) teams, and other specialized units
are housed or trained. Loss of equipment used by these units can
place the community at additional risk in the event of an attack.
Other considerations when analyzing potential terrorist targets
include:
1. The number of personnel present at the time of an attack.
2. The proximity of activities, equipment, and materials that
may amplify the effects of an explosion, such as a tank farm
or chemical plant.

Slide 2-25 Pod Discussion: Local Threats
Different regions of the U.S. face different terrorist threats. Within

your table seating arrangements, discuss the terrorist organizations
and threats unique to each participant’s area of service. Discuss:
• What are some specific terrorist organizations and threats in
your region or jurisdiction?
• What are some potential terrorist targets in your area?
• Has your agency/department/community made preparations
or established procedures to protect those potential targets?
If so, what are they?

Slide 2-26 Terrorist Planning and Execution
ELO 2-6
Order the steps in terrorist planning and execution for a
bombing attack.
This slide shows a photograph of masked terrorists training near

Afghanistan’s mountainous border with Pakistan.
No matter the type of terrorist or type of attack, the steps to

planning and executing a terrorist attack are roughly the same. The
steps proceed from less dangerous to more dangerous, and at
each point in this process there may be opportunities for law
enforcement to observe suspicious activity and stop the process
before it proceeds to completion. First responders’ work in
communities, public buildings, and homes often provides unique
chances to observe and identify problems.
The observable actions that occur within each of these phases may
be “pre-attack indicators.” They include the following:
1. Obtaining funding
2. Acquiring information
3. Training personnel
4. Moving personnel to targeted country or area

5. Conducting preoperational surveillance

6. Gathering materials
7. Constructing devices
8. Rehearsing the attack
Terrorists often do reconnaissance on first responders as part of

their planning and preparation. For example, terrorists may observe
first responders at work in order to understand how many officers
will respond to a particular kind of call, how long it will take them to
respond, and what routes they will take. Some terror attacks are
deliberately planned to injure or disable first responders, as in the
case of Eric Robert Rudolph’s bombing at a Sandy Springs, GA
abortion clinic in 1997. Roberts planted a secondary device near a
dumpster, with the plan that it would detonate while police and fire
were searching the area following an initial bomb blast. First
responders must be aware of these risks and avoid creating
vulnerabilities.
Example of a plot stopped during the planning of a terrorist

attack: 2015 West Virginia federal court and festival bombing
plot
On February 14, 2015, the FBI arrested Jonathan Leo Schrader of
West Virginia for planning to bomb a federal courthouse and a local
festival.28 A witness approached the Randolph County Sheriff’s
Department and informed them that Schrader was planning to
bomb the Mountain State Forest Festival, a bank, and the Jennings
Randolph Federal Center. He also planned on shooting at first
responders when they arrived at the bombing scenes. Schrader
had obtained an AK-47 and C-4 explosives from a juvenile in
exchange for drugs. Officials say Schrader regularly espoused
“venomous anti-government, anti-law enforcement rhetoric.” The
FBI obtained a search warrant and a search was conducted on
Schrader’s property and C-4 explosives were located. Schrader
pled guilty to possession of stolen explosives and faces up to 10
years in prison.
28
(2015, February 18). Investigations uncover Randolph County man’s alleged plot to attack federal courthouse.
Retrieved from http://wvmetronews.com.

Slide 2-27 Acquiring Information
This slide contains pictures of two examples of information

terrorists might access to learn how to construct explosives: The
Poor Man’s James Bond, Volume 2, and Inspire magazine, Issue
11 (May 2013), published by al-Qaeda in the Arabian Peninsula for
propaganda and recruitment.
ELO 2-7
Identify sources where terrorists acquire information and
explosive and incendiary material, devices, and device
components.
Acquiring information to build explosive devices is one of the first

steps a terrorist must take. A determined terrorist can obtain
information concerning potential targets with little difficulty. Major
terrorist attacks are normally preceded by a lengthy period of
preparation that includes collection of detailed information
concerning a potential target. The initiative rests with the terrorist,
unless law enforcement has timely access to current intelligence
and is proactive in pursuing the terrorists. Terrorists have all the
time they need unless they are disrupted. The attacks of
September 11, 2001 involved several years of preparation.

Once terrorists have identified a potential target, they can access

information concerning the target from a variety of sources:
government agencies, libraries, fire-evacuation diagrams, public
records, and Internet sites. For facilities open to the public, the
terrorist can visit the site, assuming the role of a tourist, customer,
delivery person, or employee. For example, prior to the attacks of
September 11, 2001, several terrorists actually were passengers on
the flights they were to hijack. Extensive photographs of the World
Trade Center’s Twin Towers were found among the possessions of
participants in the September 11, 2001 attacks. Terrorists can now
also obtain a great deal of free geographical data using Google
Earth, Google Streetview, and other map programs.
Today, techniques for making energetic materials and constructing

explosive and incendiary devices are readily available from sources
on the Internet, CDs, libraries, and bookstores. Books such as the
Anarchist’s Cookbook provide detailed procedures to formulate
explosive mixtures and can be purchased at many bookstores.
Military training and technical manuals, found in military surplus
stores, are also sources for similar information. Setting Fires with
Electrical Timers, a guide produced by ELF, is also a source of
detailed yet simple instructions on fabricating incendiary devices
and can be obtained on the Internet.
Inspire magazine is an English language online magazine, reported

to be published by al-Qaeda in the Arabian Peninsula (AQAP). This
monthly magazine has motivated numerous international and
domestic extremists to adopt radical interpretations of Islam and, in
some cases, to follow the magazine’s instructions in planning or
carrying out attacks. The Boston Marathon bombers followed
instructions in an article titled “Make a Bomb in the Kitchen of Your
Mom” from the summer 2010 issue of Inspire to construct their
pressure cooker bombs. ISIS also publishes a monthly online
magazine called Dabiq, and has social media operatives actively
posting to and recruiting from Twitter as well as other social media
sites.

Slide 2-28 Video: Inspire Magazine
This slide contains a short video about al-Qaeda’s Inspire

magazine. This video serves as an example of the type of
information that is available on the internet.

Slide 2-29 Acquiring Terrorist Materials
Knowledge of how to construct explosive and incendiary devices is

valuable only if terrorists can obtain the materials necessary for
their construction. Unfortunately, those materials are also easily
accessed. Energetic materials and device components can be
obtained from sponsors or supporters of the terrorist cause or
legally purchased from commercial sources. In addition, terrorists
can use otherwise benign materials to assemble a device,
purchase the device or materials from black market sources, or
steal components. Data maintained by the Bureau of Alcohol,
Tobacco, Firearms and Explosives (BATFE) reveals that a
considerable quantity of explosives and a large number of
detonators are stolen each year.29 Although some explosives and
detonators are recovered, many thefts remain unresolved. In many
cases, thefts are not reported.
Legal purchases of black powder, chemicals, and other bomb

making components can be obtained over the counter or through
the internet. This is why it is important to educate first responders
29
United States Bomb Data Center. (2014). United States Bomb Data Center (USBDC) Explosives Incident Report
(EIR). Retrieved from https://www.atf.gov/explosives/docs/report/2014-usbdc-explosive-incident-
report/download.

and citizens in your jurisdiction about what items terrorist could

obtain legally or illegally.
Over the past few years, federal, state, and local governments have
implemented a variety of controls to reduce the availability of
explosives to potential terrorists and other criminals. The
government’s role is vital in regulating and educating the explosives
industry and in protecting the public from inadequate storage and
security. The government has moved to establish mechanisms to
identify the origin of explosives used in terrorist attacks. These
regulations will reduce the availability of explosive materials on the
open market, but will have limited impact on black market sources
and potential theft of these materials. The ATF Federal Explosives
Law and Regulations 2012 is provided as a PDF on the participant
thumb drive. First responders can also go to the ATF’s website at
https://www.atf.gov/explosives/tools-services-law-enforcement for
more information on explosive laws and regulations.

Slide 2-30 Terrorist Methods: Packaging
This slide illustrates three types of packaging that could be used by

a terrorist, including a shoe bomb, a briefcase bomb, and a
backpack bomb.
ELO 2-8
Identify common terrorist methods for packaging and delivery
of explosive and incendiary devices.
The form that an explosive or incendiary device takes is limited only

by the imagination, skills, and resources available to the terrorist.
Although many bombs are enclosed in metal or PVC pipe, virtually
any container can be used to hide a device.
This slide illustrates three types of packaging that could be used by

a terrorist, including a shoe bomb, a briefcase bomb, and a
backpack bomb.

Slide 2-31 Terrorist Methods: Delivery
This slide contains photos of different device delivery options,

including the Nissan Pathfinder containing explosive devices left in
Times Square in May 2010, and one of the backpacks used in the
Boston Marathon bombings on April 15, 2013.
As with packaging, the only limiting factor for delivery of an

explosive or incendiary device is the imagination, skills, and
resources of the terrorist and the availability of the conveyance.
Terrorists have delivered devices by:
• Placing them in containers (letter or package, pipe bomb, trash
can, mailbox, buried device)
• Throwing or otherwise projecting the device (pipe bomb, mortar,
rocket)
• Operating a vehicle (car, truck, remote-controlled aircraft, ultra-
lite, blimp, aircraft, railcar, seagoing vessel)
• Personal introduction (suicide vest, shoe bomb, underwear
bomb).
Devices can be delivered on the person of a bomber or by using a

vehicle—anything from a bicycle or handcart to an airplane. While a
panel van or delivery truck may serve as a common image of a
potential explosive-delivery vehicle for some, a standard size four-
door vehicle can hold 1,500 pounds of explosives in the trunk. The

World Trade Center attack in 1993 involved only 1,200 pounds of

explosives. The type of target and the perceived effectiveness of
the countermeasures associated with the target will determine the
delivery methodology. In the Boston Marathon bombings, the
bombers chose to carry pressure cooker bombs in backpacks,
knowing that many people in the crowd would be wearing or
standing near backpacks and that unattended bags could easily go
unnoticed. Sometimes a terrorist cannot deliver an explosive device
to the target. In such cases, the objective is to get the target to the
device. An example would be placing an explosive device along the
road and detonating it as a target passes, either on foot or in a
vehicle.
The ability of terrorists to disguise explosive devices in otherwise

innocent-looking containers makes it critically important that
responders remain observant for additional devices at bombing-
incident scenes.
There are multiple cases of flashlights being converted into

explosive devices, then left in locations where a first
responder might be likely to pick it up to use while conducting
a search.30 First responders should avoid using any flashlight
or other device that is not their own.
30
Thomas, P. and Wilson, Toni. (2012, June 11). Police Seek Phoenix-Area Flashlight Bomber. ABC News.
Retrieved from http://abcnews.go.com/blogs/headlines/2012/06/police-seek-phoenix-area-flashlight-
bomber/.

Slide 2-32 EMRTC: Suicide Vest
This slide contains a video of an experiment conducted at EMRTC

with four pounds of C-4 explosive detonated in an urban arena
setting.
Suicide bombers pose an increased risk because of their

willingness to die during the execution of their attack. An individual
who is prepared to die is a far more difficult adversary than one
who wants to survive. Suicide bombers, such as those who have
executed attacks in the Middle East, Russia, Indonesia, and Sri
Lanka, are likely to emerge on the domestic scene as the
effectiveness of countermeasures improves against alternative
modes of attack.

Slide 2-33 Potential Explosive Dissemination of WMD

Materials
ELO 2-9
Identify types of WMD materials (including chemical,
biological, and radiological) that can be disseminated using
conventional explosives.
First responders should be aware that when an explosion

occurs, it is possible that other types of dangerous
substances could be present. Other WMD agents could be
dispersed or disseminated with explosives, and first
responders should respond to bombing events with the
appropriate safety awareness.
The IRTB course is designed to focus on energetic materials, but

participants who are interested in learning more about the risk for
explosive dissemination of other WMDs should look into additional
NDPC courses on the subject.

Slide 2-34 Radiological Dispersal Device
This slide depicts (clockwise from upper left): Hazmat experts

removing radioactive materials from the Michigan shed where 17-
year-old David Hahn, “the Radioactive Boy Scout” was attempting
to build a homemade nuclear reactor in 1995; a graphic explaining
the construction of a “dirty bomb” or radiological dispersal device;
and a tube of cesium seized in a sting operation in October 2015
where Moldovan police coordinated with the FBI to prevent gangs
from the former Soviet Republic from selling radioactive material to
Islamic terrorist organizations, including the Islamic State.
When combined with a conventional explosive device, radiological

materials are less likely to be affected by the explosion than the
other WMD combinations. This combination produces a so-called
dirty bomb or radiological dispersal device (RDD). This slide
displays a cutaway version of what a dirty bomb could look like.
Radiological materials, often taken from power stations or hospitals,
could be spread over large areas using conventional explosives.
The heat and pressure generated by a conventional explosion does
not change the characteristics of a radiological material, some of
which could be extremely dangerous to humans.
Conventional explosives can also disseminate chemical WMDs

(consider, for example, the artillery shells used to disseminate

chemical weapons during World War I.) However, intense heat from
a conventional explosion can change the properties of a chemical
substance in a manner that reduces its potential lethality.
In many cases, the heat and pressure of a conventional explosion

will destroy biological material, including living organisms and their
lethal byproducts (toxins). First responders should consider the
potential for the presence of other WMDs at bombing incidents.
Monitoring of radiological, chemical, and biological materials should
always be implemented at incident scenes where explosives
appear to be the primary weapon, as a matter of standard operating
procedure (SOP).
Example: The Radioactive Boy Scout, 199431,32

In 1994, David Hahn, who is also known as the “Radioactive Boy
Scout”, attempted to build a nuclear reactor in his backyard. Police
stopped Hahn for an unrelated reason and discovered he had
radioactive material in his car and at his home. The radioactive
material at his home became a Superfund site and had to be
cleaned up by the federal government because of the amount of
radioactive material. In 2007, Hahn was arrested for larceny of
smoke detectors. He was attempting to recover radioactive
isotopes, which can be recovered in small amounts from the smoke
detectors. He was sentenced to 90 days in jail for attempted
larceny and was treated at a mental health facility.
Example: Moldovan Cesium Smuggling Sting, 201533

In October of 2015, Moldovan police working with the FBI
prevented several gangs from the former Soviet republic from
selling radioactive material to several Islamic terrorist organizations,
including the Islamic State. The gangs had enough Cesium to
contaminate several city blocks. Cesium is radioactive and the
International Atomic Energy Agency has warned it could be used in
a dirty bomb. Incidents like this one show that a Dirty Bomb is still a
threat to the United States and the world.
31 Silverstein, K. (1998). The Radioactive Boy Scout: When a teenager attempts to build a breeder reactor. Harpers
Magazine. Retrieved from http://harpers.org/archive/1998/11/the-radioactive-boy-scout/.
32 Associated Press. (2007, October 4). ‘Radioactive Boy Scout’ Sentenced to 90 Days for Stealing Smoke Detectors.
Fox News. Retrieved from http://www.foxnews.com/story/2007/10/04/radioactive-boy-scout-sentenced-to-0-

days-for-stealing-smoke-detectors.html.
33 Oliphant, R. (2015, October 7). Russian gangs trying to sell radioactive material to Isil terrorists in Moldova. The
Telegraph. Retrieved from http://www.telegraph.co.uk/news/worldnews/islamic-state/11916040/Criminal-

gangs-attempting-to-sell-nuclear-material-to-Islamic-State.html.

The sound at the time of explosion can provide important

information for first responders. At incident scenes where
explosions were limited in power — for example, where the
device went “poof” instead of “boom” — responders should
be particularly wary of chemical or biological material in the
immediate area surrounding the seat of the explosion.

PRE-ATTACK INDICATORS AND COUNTERMEASURES
Slide 2-35 Preoperational Surveillance Indicators
ELO 2-10
Identify common indicators of terrorist preoperational
surveillance and basic first responder countermeasures.
Interrupting terrorist planning during the preoperational surveillance

phase is one of the best ways to prevent or deter an attack. First
responders should be suspicious of any of these observed
behaviors that could indicate preoperational surveillance against a
target.
 Repetitive or extended presence of an individual or group at a

location where there is no logical explanation. For example,
most tourist destinations attract visitors for a day or two. The
presence of an individual over an extended period should be
viewed as suspicious. Likewise, someone who lingers at a
location for no apparent reason should be viewed as suspicious.
Although such behavior may be innocent, it should be subjected
to counter surveillance and analysis by emergency response
agencies.

 Video recording or photographing of unusual locations or

structures (potential terrorist targets). Recently, it was reported
that a terrorist cell had videotape recordings of the Golden Gate
Bridge; the recordings included extensive, close-up views of
structural components that would be of little interest to the
average tourist, but of potential interest to someone interested
in destroying the bridge.
 Any questioning about security practices or procedures. Most

tourists or other visitors are only interested in security measures
that have an impact on their access or movement. Detailed
questions such as, “What type of security systems are
present?”, “How many officers work there?”, or “How many
cameras are there?” should be viewed as suspicious.
 Presence of an individual or group in a restricted location that is

clearly marked. Anyone who ignores posted signs should be
viewed as suspicious. Interference with attempts by terrorist
groups to conduct preoperational surveillance increases the
likelihood that terrorists will target another location.
 Dry Runs. Terrorists have proven in the past that they will
conduct dry runs to determine if an attack will be successful.
Several of the July 7, 2005 London suicide bombers conducted
a dry run less than two weeks before the actual attacks.34
34 (2005, September 20). Bombers staged dry run before London attacks. Retrieved from
http://www.telegraph.co.uk/news/1498782/Bombers-staged-dry-run-before-London-attacks.html.

Slide 2-36 Countermeasures for Prevention and Deterrence
This slide displays a picture of a security camera and a water-filled

Jersey barrier.
Awareness. First responders must be alert to pre-attack

indicators when they come into contact with the public during
routine, normal operations. Whether during a traffic stop, a fire
marshal inspection, or a fire call-out, alert responders should
judiciously follow up on unusual or suspicious activity
(normally, by reporting it to an appropriate authority). Being
proactive is better than being reactive. First responders
should build collaborative relationships with the local medical
community, to encourage them to report suspicious injuries or
stories that are inconsistent with injuries.
Surveillance detection. Preoperational surveillance involves

answering two important questions:
1. Is the target vulnerable to attack?
2. What tactics appear to offer the greatest opportunity for
success?
First responders should ask themselves, “Why is someone taking

special interest in a facility or activity? Is someone looking for an
opportunity to strike?” Assessing pre-attack indicators is not easy.

Surveillance of an intended target may occur over many weeks,

months, or even years so as to not draw unwarranted attention.
First responders must be vigilant and evaluate incidents to see if a
pattern, or mosaic, is developing.
Deterrence is associated with the first question and involves

presenting a security posture that discourages initial targeting. It is
important that terrorists perceive potential targets as relatively
invulnerable to attack. Surveillance of areas surrounding a potential
target may not only deter attacks but may also prevent the
successful execution of an attack (in this case, successful means
detonation of an explosive device at the intended location with the
intended consequences).
Intelligence. Good intelligence is among the best weapons against

terrorism. Generating useful intelligence includes not just gathering
the information, but also analyzing and distributing it to agencies
with a need to know. Intelligence concerning a possible or imminent
attack is worthless if it is only known to the intelligence community
or a specific analyst. First responders must share information about
potential terrorist or criminal activity in their communities.
The National Incident Management System (NIMS) was designed

to use the best and most effective processes available in currently
existing protocols and to integrate them into a nationwide system
that maximizes interoperability to coordinate emergency response
teams at the federal, state, and local agency levels in the event of a
crisis. In addition, many states and larger cities have created state
and local fusion centers to share information and intelligence within
their jurisdictions as well as with the federal government. DHS,
through the Office of Intelligence and Analysis, provides personnel
with operational and intelligence skills to the fusion centers.
Structural Barriers. Structural features can reduce the

effectiveness of a blast and can discourage terrorists from targeting
a location. In many instances, barriers are more effective than
procedures in preventing a successful attack.

Slide 2-37 Staying Informed about Terrorist Threats
First responders should work to maintain a current understanding of

the kinds of information that terrorists can obtain from the Internet,
in order to understand the threat landscape and be able to
recognize precursor behaviors and materials.

SUMMARY
Slide 2-38 Summary
This slide is an opportunity for instructors to summarize the key

points in the module and for participants to ask questions.


IRTB Module 02 PG 01.2017

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

IRTB Module 02 PG 01.2017

Hochgeladen von

Copyright:

Verfügbare Formate

Incident Response to Terrorist Bombings

Training Support Package Participant Guide

January 2017 Version 01.2017 Page 2-1

MODULE 2 UNDERSTANDING TERRORIST BOMBING

January 2017 Version 01.2017 Page 2-2

January 2017 Version 01.2017 Page 2-3

Key Points/Learning Objectives: Used to highlight each time lesson content is

January 2017 Version 01.2017 Page 2-4

Slide 2-1 IRTB Module 2

Terrorist groups have the capability to strike U.S. targets using

To prepare for potential terrorist attacks, managers in emergency

January 2017 Version 01.2017 Page 2-5

Slide 2-2 Terminal Learning Objective

At the conclusion of this module, participants will be able to identify

January 2017 Version 01.2017 Page 2-6

Slide 2-3 Enabling Learning Objectives

January 2017 Version 01.2017 Page 2-7

Incident Response to Terrorist Bombings

Enabling Learning Objectives (cont.)

Slide 2-4 ELOs (cont.)

2-1 Define the terms energetic material, terrorism, and weapons

January 2017 Version 01.2017 Page 2-8

Slide 2-5 Course Map

Module 2 is the first module focusing on background knowledge of

January 2017 Version 01.2017 Page 2-9

Slide 2-6 Energetic Material

This slide contains two photographs of energetic materials

An energetic material is one that can undergo rapid chemical

January 2017 Version 01.2017 Page 2-10

Slide 2-7 Definitions of Terrorism

This slide contains an image of armed terrorists displaying their

There is no single, universally accepted, definition of terrorism.

“The unlawful use of force or violence against persons or property

Most definitions of terrorism share common components. Terrorist

January 2017 Version 01.2017 Page 2-11

objectives lack support from the government and the people.

For purposes of this definition, the term “civilian” includes military

January 2017 Version 01.2017 Page 2-12

Slide 2-8 Weapon of Mass Destruction 18 USC 2332 a

This slide presents the definition of WMDs as found in Title 18 of

January 2017 Version 01.2017 Page 2-13

Slide 2-9 WMD 18 USC Section 921(a)(4)

This slide presents definitions of WMDs as found in Section 18 of

The term WMD is often used inappropriately to refer only to

This course focuses on energetic materials or explosives. However,

While firearms are not necessarily categorized as weapons of mass

January 2017 Version 01.2017 Page 2-14

States, explosives have been used as weapons of mass

January 2017 Version 01.2017 Page 2-15

COMMON CHARACTERISTICS OF TERRORISTS

Slide 2-10 Common Characteristics of Terrorists

This slide contains a photo of Ramzi Yousef, the man responsible

January 2017 Version 01.2017 Page 2-16

Slide 2-11 Common Characteristics of Terrorists (cont.)

What attracts someone to terrorist organizations? What makes

January 2017 Version 01.2017 Page 2-17

A few key facts that can help first responders:

One psychologist who conducted interviews with 60 former

January 2017 Version 01.2017 Page 2-18

 Believe that their current political involvement does not give

A study conducted by Sandia National Laboratory concluded that

January 2017 Version 01.2017 Page 2-19

Slide 2-12 The Radicalization Process