Protective Intelligence Lessons From Egypt
By: George Friedman | Stratfor.comJuly 2, 2015
Archive
Comment
Email
Print
Share on Facebook
Share on Twitter
Protective Intelligence Lessons From Egypt

A typical Monday morning rush hour in Cairo's Heliopolis district, with commuters from the wealthy area struggling through the heavy traffic to get to work, was suddenly fractured at 9:30 when a large car bomb detonated at the intersection of Suleiman al-Farsi and Mostafa Mokhtar streets. The explosion ripped through cars at the intersection, heavily damaging several of them and setting them on fire. The blast also broke windows, damaged building facades and blew leaves from the trees. First responders rushed to the scene to extinguish the leaping flames from the white-hot car fires, treat the wounded and transport them to the hospital.

As the smoke began to clear, it was learned that the bomb had detonated just as the motorcade of Egyptian Prosecutor General Hisham Barakat was making a right turn off Suleiman al-Farsi on to Mostafa Mokhtar. It appears the bomb was remotely detonated, not activated by a suicide operative sitting inside the vehicle. The prosecutor general and some of his bodyguards were among those transported to the hospital. Barakat would later be declared dead, apparently from internal injuries he suffered as the blast wave ripped through his armored vehicle. Because of the terrorist threat in Egypt, including the capital, Cairo, Barakat had been provided with a protective detail and an armored limousine. But those security measures did not protect him from the well-planned and well-executed attack that claimed his life.

The past week saw several terrorist attacks, including quite deadly incidents in Kuwait City and Tunisia. It is important to recognize, however, that from a tactical perspective, these other incidents were all simple attacks directed against vulnerable targets. They did not require much in the way of terrorist tradecraft to plan and execute. The Barakat assassination stands in stark contrast: It was a precisely targeted attack directed against a hard target. Because of this, the attack has far more significance for security practitioners and other potential targets.

Lesson One: Constraints of Place

Operating in a congested residential and commercial area like Heliopolis presents many challenges to a protective security detail. The streets are narrow and often clogged with traffic and parked cars. Street vendors, motorcyclists, bicyclists and pedestrians all pose potential threats to a motorcade stopped in gridlocked traffic. One-way streets also limit route selection, as in the case of intersections allowing only right or left turns instead of offering a choice of turns in either direction. All these factors can work together to create choke points, or areas that a person or motorcade must pass through to get from point A to point B.

Having limited route options that result in choke points is bad when a protective detail is making just a one-off or even an occasional stop, but it is downright dangerous when it is part of a daily routine involving a known location associated with the protectee, such as a residence or an office. Choke points that present conditions conducive for an attack, or potential attack sites, are especially dangerous.

The mantra of protective details is that you need to vary your routes and times. But quite honestly, depending on the location and traffic patterns, it can be impossible to vary some portions of a route. This is particularly true close to the residence if it is in a gated community, where there may be only one entrance and exit, or in an urban area where you can go only one direction after picking the protectee up at the curb. (It is impossible to turn large armored vehicles around on some narrow urban streets.)

It appears that the protective detail that picked Barakat up at his home encountered this situation. It attempted to exit the residential area using Mostafa Mokhtar to get to the larger Ammar Ibn Yasser Boulevard, which is two lanes each way. One can turn right only on Mostafa Mokhtar from Suleiman al-Farsi, meaning that the intersection where the attack occurred was a choke point. Media reports indicate that Barakat's motorcade passed through that intersection every morning.

A map of the area and a look at the neighborhood on Google Earth indicates that even if Barakat lived on Suleiman al-Farsi Street, there were still other routes out of the neighborhood. While there may have been road construction or other factors that forced it to use Suleiman al-Farsi to Mostafa Mokhtar every day, the protective detail might have settled into a predictable routine for the morning home-to-office trip rather than varying its times and routes.

If you cannot alter a route and must pass through one or more potential attack sites every day, varying the time becomes even more important. A protective detail, however, can be constrained from doing this by the protectee. Without the protectee's buy-in, it is hard to alter the motorcade's patterns. In many cases, the protectee will simply refuse to alter his schedule so that movement times can be varied or longer alternate routes taken. When the protectee steps out of his door late and needs to be at an important meeting in short time, the protective detail has little choice but to take the quickest route to the destination. Protection agents have little ability to force a powerful protectee like a government minister or corporate CEO to follow their security advice.

Lesson Two: Armored Vehicles Are Not Attack-Proof

There are many things that can lead a protective detail or a person afforded protection to become complacent, including denial ("It can't happen to me"), alert fatigue and years of operation with no incidents or attacks. Another thing that can lead to complacency is a sense of overconfidence in security measures. In recent months in Egypt, most terrorist attacks have involved either small-arms fire — like the June 3 drive-by shooting that killed two tourist police officers in Giza, just outside Cairo — or the small pipe bomb explosive devices frequently used in attacks by Ajnad Misr in the Cairo area. An armored vehicle can be quite effective in protecting against such attacks, a fact that Barakat's assassins took into consideration while planning their attack. Instead of deploying a gunman at the intersection or a pipe bomb, they chose a large vehicle bomb capable of defeating the vehicle's armor. As Stratfor has noted for many years, armored vehicles are not attack-proof, and in some cases they can even be detrimental to security by causing protective details and protectees to develop a false sense of security.

It is also important to remember that the Barakat attack is not unprecedented. There have been several well-executed attacks against high-profile targets in Cairo in the past two years. In January 2014, Gen. Mohammed Said, an aide to the Egyptian interior minister, was gunned down during his commute to work. Said's assassination came four days after a large vehicle bomb attack against the Cairo Security Directorate. In September 2014, Egyptian Interior Minister Mohamed Ibrahim was nearly assassinated in an operation that was eerily similar to the Barakat assassination: A vehicle bomb was deployed on a corner at a choke point in a residential area near the minister's residence. In the Ibrahim case, it appeared the attack failed because either the attackers did not use sufficient explosives in their device to defeat the vehicle's armor, or they were slightly off on their timing and the device was not detonated at the optimal time. Barakat's assassins did not make the same error; their bomb was large enough and was detonated precisely and with deadly effect.

Lesson Three: Surveillance Must Be Countered

The hard reality in executive protection is that if a proficient attacker is permitted to conduct pre-operational surveillance at will, he will be able to assess security measures, observe travel patterns, note choke points and potential attack sites, and identify ways to attack the target at vulnerable times, either because of gaps in security coverage or by launching an attack powerful enough to defeat the security measures in place. This is what happened in the Barakat assassination (and in the Said and Ibrahim cases, for that matter). The attackers were obviously able to plan and execute their attack without being detected or pressured. Clearly, surveillants must not be given free rein to observe security measures and plan attacks.

As noted above, place constrains security details, but it also constrains would-be attackers. They must go into certain identifiable locations to observe the activities of protective details as they attempt to assess security operations and patterns. As hostile surveillants enter these predictable locations to observe a known place such as a residence or office, or a choke point or potential attack site, they make themselvesvulnerable to detection — if someone is looking for them.

In addition to the pre-operational surveillance required to plan an attack, the attack team in the Barakat assassination also needed to secure the specific parking space to place the bomb vehicle and then deploy the vehicle containing the bomb to the attack site. Some reports are suggesting that the vehicle bomb had been parked and was remotely activated. If this is correct, it means that there was probably someone watching the residence to notify the triggerman that the target had left the residence and was approaching the attack site. The triggerman also needed to have a clear view of the intersection to activate the bomb at the right moment. This is a lot of operational activity, and each of the actors deployed during the operation was vulnerable to detection before the attack.

The best way to detect surveillance directed against a protective detail is to deploy a dedicated countersurveillance team that can watch for watchers. They can also monitor for hostile surveillance outside known locations, publicized events, choke points and potential attack sites along routes that are frequently taken. But aside from professional countersurveillance teams, security forces can also make surveillants uncomfortable by "heating up" potential surveillance sites using police officers, security guards or obvious closed-circuit television camera coverage.

Lesson Four: Lingering Danger in Cairo

It is believed that members of Ansar Beit al-Maqdis were behind the assassination of Said and the failed attack on Ibrahim. As seen in those cases, these militants are capable and deadly. It was also believed that many of the Ansar Beit al-Maqdis cadre in Cairo had been killed or arrested, but those beliefs may have been mistaken and some of the planners behind the previous attacks could still be operating in Cairo. It is also possible that Ansar Beit al-Maqdis did not conduct the previous assassination operations, or that Ansar Beit al-Maqdis did the previous attacks and another group assassinated Barakat. The operational similarities between the failed Ibrahim attack and the Barakat assassination, however, are striking, as are the similarity in complexity and target set, suggesting a common author.

The terrorist tradecraft employed in the Barakat case also stands in contrast with the hybrid/guerrilla warfare tactics used by the Islamic State's Wilayat Sinai in the Sinai Peninsula, such as the large-scale attacks in Sheikh Zuweid on July 1, and Ajnad Misr's tactics of using smaller bombs against police targets. Three Ajnad Misr militants were killed while transporting smaller bombs in a car in Cairo's October 6 City on July 1; it is believed they were en route to target a police station.

Ansar Beit al-Maqdis elements in the Sinai Peninsula have broken from the al Qaeda orbit to declare fealty to the Islamic State, but it is not clear that the Ansar Beit al-Maqdis elements that claimed responsibility for the past attacks in Cairo followed suit. The Cairo-based Ansar Beit al-Maqdis elements are thought to have been closely aligned with the Mohammed Jamal Network, a group named after a former Egyptian Islamic Jihad leader arrested in 2012 who was close to current al Qaeda leader Ayman al-Zawahiri. It is also interesting to note that Wilayat Sinai quickly claimed responsibility for the Sheikh Zuwaid attack but has not yet claimed the Barakat assassination.

Whoever was responsible, the Barakat assassination proves that there is still a sophisticated terrorist actor in Cairo capable of planning and executing complex terrorist attacks against hard targets. Judging from the bomb deployed in this case, the group is not lacking for explosives (which is not surprising considering the amount of military-grade high-explosive material sitting around in anti-tank mines scattered all over the Sinai Peninsula, or available from al Qaeda and Islamic State militants in Libya). Such an actor is far more dangerous to potential high-profile targets in Cairo like government officials, diplomats and corporate executives than an actor conducting guerrilla warfare operations in the Sinai Peninsula or shooting random cops or tourists.