Hostile Reconnaissance - Aide Memoire

Hostile reconnaissance is used to provide information to operational planners on potential targets during the preparatory and operational phases of terrorist operations.

Primary Role of Reconnaissance.

• Obtain a profile of the target location.
• Determine the best method of attack.
• Determine the optimum time to conduct the attack.

Reconnaissance operatives may visit potential targets a number of times prior to the attack. Where pro-active security measures are in place, particular attension is paid to any variations in security patterns and  the flow of peaple in and out.

The ability to recognise those engaged in hostel reconnaissance could disrupt an attack and produce important intelligence leads. What to look for.

• Significant interest being taken in the outside of your event site including parking areas, delivery gates, doors and entrances.
• Groups or individuals taking significant interest in the locations of CCTV cameras and controlled arears.
• People taking pictures, filming, making notes or sketching of the security measures around events.
• Tourists should not necessarily be taken as such and should be treated sensitively , but with caution.
• Overt/covert photography, video cameras, possessions of photographs, maps, blueprints etc, of critical infrastructures, electricity transformers, gas piplines, telephone cables, etc.

Possession of maps, global positioning system (GPS), photographic equipment ( cameras, zoom lens and camcorders ). GPS will assist in the positioning and correct guidance of weapons such as mortars and Rocket Propelled Grenades (RPGs). In respect or homemade mortars, this should be considered a possibility up to one kilometre from any target.

• Vehicles parked outside buildings of other facilities, with one or more people remaining in the vehicle, for longer than would be considered usual.
• Parking, standing or loitering in the same area on numerous occasions with no apparent reasonable explanation.
• Prolonged static surveillance using operatives disguised as demonstrators, street sweepers, etc. or stopping and pretending to have car trouble to test response time for emergency services, car recovery companies, (AA,RAC etc.) or local Staff.
• Simple observations such as staring or quickly looking away.
• Activity inconsistent with the nature of the building or event.
• Unusual questions-number and routine staff/VIP’s visiting the site or event.
• Individuals that look out of place for any other reason.
• Individuals that appear to be loitering in public areas.
• Individuals asking questions regarding the identity or characteristics of individual visitors, groups of visitors, group, or the job or nationalities of visitors, that attend or may visit the event.
• Persons asking questions regarding security and evacuation measures.
• Persons asking questions regarding staff hangouts.
• Persons asking questions regarding VIP visits.
• Delivery vehicle in front of the event.
• Vehicles, packages, luggage left unattended.
• Vehicles appearing over weight.
• Persons appearing to count pedestrians/vehicles.
• Strangers walking around perimeters of the event.
• People ‘nursing’ drinks and being over attentive to surroundings.
• Persons loitering around an area for a prolonged amount of time.
• Persons attempting to access plant equipment or chemical areas.
• Delivery vehicles or other trucks attempting to access the main driveway to the event.
• Delivery vehicles arriving at the wrong time or outside of normal hours.
• Vehicles emitting suspicious odour e.g. fuel or gas.
• Vehicles looking out of place.
• Erratic driving.
• Questions regarding the event structure.
• Noted pattern or series of false alarms indicating possible testing of security systems and observations of response behaviour and procedures, (bomb threats, leaving hoax devices or packages).
• The same vehicle and different individuals or the same individuals in a different vehicle returning to a location.
• The same or similar individuals returning to carry out the same activity to establish the optimum time to conduct the operation.
• Unusual activity by contractor’s vehicles.
• Recent damage to perimeter security, breaches in fence lines or walls or the concealment in hides of mortar base plates or assault equipment, ie. Ropes, ladders, food, etc. regular perimeter patrols should be instigated months in advance of a high profile event to ensure this is not happening.
• Attempts to disguise identity -motorcycle helmets, hoodies, etc. or multiple sets of clothing to change appearance.
• Constant use of different paths, and/or access routes across a site. ‘Learning the route’ or foot surveillance involving a number of people who seem individual but are working together.
• Multiple identification documents - suspicious, counterfeit, altered documents etc.
• Non co-operative with  police or security personnel.
• Those engaged in reconnaissance will often attempt to enter premises to assess the internal layout and in doing so will alter their appearance and provide cover stories.
• In the past reconnaissance operatives have drawn attention to themselves by asking peculiar and in depth questions of employees or other more familiar with the environment.
• Sightings of suspicious activity should be passed immediately to security management for CCTV monitoring, active responses were possible and the event recorded for evidential purposes. All should be reported to police.

THE ROLE OF RECONNAISSANCE HAS BECOME INCREASINGLY IMPORTANT TO TERRORIST OPERATIONS.

Reconnaissance trips may be undertaken as a rehearsal to involve personnel  and equipment that will be used in the actual attack e.g. before the London attacks on 7th July 2005, the bombers staged a trail run nine days before the actual attack.