Mumbai bombings signal sustained rail terrorism

The bomb attacks on commuter trains in Mumbai, India, on 11 July are the most recent demonstration of the vulnerability of mass commuter rail transport to terrorism.

The co-ordinated attacks, in which multiple explosive devices detonated near-simultaneously, killing at least 183 people and injured hundreds more, further illustrated the clear interest among Islamist militant groups specifically in targeting rail transport to cause mass casualties.

However, other effects such as service degradation, long-term economic loss and a scare on the collective national and corporate psyche also combine to make rail networks attractive targets for such groups. Analysis of postings on prominent Islamist militant websites and forums indicates that the publicity generated by events such as the 2004 Madrid rail bombings and the 2005 attacks on London's transport network have not been lost on followers of the global jihad.

Japan, the UK, France, Spain, Italy, Russia, Germany, Pakistan, India, Philippines, Sri Lanka, Venezuela, Angola, South Korea and Colombia have all experienced terrorist attacks on their railway networks. When terrorists attacked the World Trade Center on 11 September 2001, they unintentionally caused severe damaged to parts of the New York subway. Nearly a quarter of a mile of tunnel was filled with debris from the collapsed towers, in addition to structural damage to three stations.

According to the events database of Jane's Terrorism and Insurgency Centre, between 1998 and July 2006 there were at least 74 separate terrorist attacks on railways worldwide, as represented by heavy rail, metro subway systems and light rail systems, and many more credible threats against trains and rail infrastructure.

Other data sets show a higher number of attacks, at almost double this figure - although these frequently include attacks by single-issue groups or individuals motivated by criminal intent.

Terrorists have targeted the full spectrum of the rail transport environment including trains, ticket halls, passenger stations, train depots, railway bridges, tracks and signalling. These attacks have approximately 1,000 deaths and over 5,000 injuries, and economic losses totalling hundreds of millions of euros. In particular, mass rapid transit rail systems (subways) and the urban commuter rail network have been the focus of the majority of terrorist attacks on soft targets.

Various groups and attack methods have been used on the railway environment. Al-Qaeda and affiliated groups, Algerian and Chechen militants, the Aum Shinrikyo doomsday cult, Kashmiri separatists, left wing guerrillas in South America, and Irish republican terrorists (particularly the Provisional IRA (PIRA)) have all targeted railways.

On 23 August 1973, PIRA made its first attempt to target the mainland UK rail system, with a bomb that was defused at Baker Street Underground station in central London. Since 1997, around half of all terrorist attacks on the UK mainland have been against rail targets.

The modus operandi illustrated by the examples below, have spanned the terrorist tactical spectrum: from suicide bombings and concealed improvised explosive devices (IEDs) to the release of a chemical agent. What can we discern from the character of the global threat from terrorism that is now specifically directed at subway systems and urban commuter rail networks worldwide?

Frequent modes of attack

The 11 March 2004 Madrid bombings remain one of the most sophisticated terrorist attacks on a rail target, involving the near simultaneous detonation of 10 devices comprising Goma-2 Eco plastic explosive triggered by mobile phone. The blasts killed 191 people. An unexploded device later recovered from one of the train carriages provided a crucial breakthrough in the post-incident investigation.

With hindsight, the Madrid rail attack proved to be strategic in its timing and choice of target, coming in the run-up to the Spanish general election - although whether the attack was deliberately timed to coincide with this event remains debatable. Regardless, it caused the incumbent administration to fall, accompanied by a swift reversal of foreign policy involving the new Socialist government's disengagement from Iraq. The success of the Madrid attack bequeathed what jihadists now regard as a potentially powerful operational template for future attacks elsewhere in Europe. The latest incarnation of the Madrid template was seen in Mumbai this year.

The method of attack did not involve suicide bombers. This was a salient lesson for public vigilance and awareness campaigns with respect to rail security. Such initiatives, co-opting the eyes and ears of the travelling public, are a key security strategy in places such as London and Paris. Despite the rail network in India having been targeted in the past by terrorism, no similar programme existed before the Mumbai rail bombings.

The 7 July 2005 bombings

The attacks on London's Underground rail and bus network on 7 July 2005 were the first suicide attacks in the UK and the most deadly act of terrorism in the country.

In this case, the attack was characterised by the co-ordinated detonation of four IEDs incorporating a peroxide-based home-made explosive. Three detonations occurred 50 seconds apart at around 0850 GMT on different Underground trains, and a fourth bomb detonated 57 minutes later on the top of a double-decker bus. The bus seems to have been a secondary or opportunistic target, chosen following the suspension of the Northern line, which frustrated the would-be suicide bomber's attempt to target an Underground train.

A decision to employ suicide bombing as a modus operandi is likely to have been driven by two key factors:

Ideology - Among extremists, suicide bombing can be perceived as the ultimate expression of faith. It is also a powerful means of attempting to rally fellow Muslims to the cause of global jihad. Furthermore, it demonstrates the impotence of existing security measures.

Tactics - The bombers would almost certainly have been aware of the anti-terrorism measures on the Underground from examining open source material. These measures are intended largely to reduce the risk of emplaced IEDs. The London Underground is the largest area of controlled public space in Europe, with round-the-clock manned or monitored stations and tunnels. Therefore, a suicide operation would likely increase the impact and probability of success.

London Underground has spent much effort and resources in displacing or considerably reducing the risk from IEDs left on trains or in stations and the general Underground environment. Much of this expertise was developed in response to the threat from PIRA terrorism, which successfully mounted at least 19 attacks on targets on the Underground, British railway lines and stations during its 25-year campaign.

Surprisingly, only two people were killed in this time, but dozens were injured and networks were constantly disrupted. PIRA mounted a targeted campaign of mass disruption and economic haemorrhaging, as opposed to a campaign of mass fatalities. Attacks inflicting great loss of life were seen by PIRA decision-makers as being counter-productive.

Anti-terrorism measures

When disruption and economic loss, rather than mass casualties, is the aim, anti-terrorist measures on metro rail systems must be seen as a trade-off between operational or economic continuity and public safety. The rapid recovery of the rail and underground networks from disruption caused by a hoax or attack is crucial in negating this type of terrorism in the longer term.

Measures used in the UK have traditionally centred on establishing the credibility of a bomb threat when reported by the terrorist. A series of questions were devised to probe the would-be terrorist as he or she gave the bomb warning. A series of deduced patterns were extracted from the given bomb warning.

The UK transport network has adopted the following measures:

• removed bins
• seats are of a perforated metal design so as not to obscure visual checks and are also bolted to the wall
• vending machines are sloped to reduce the risk of objects being left on top
• the networks are completely monitored by CCTV
• the travelling public is co-opted by police and transport authorities running an aggressive advertising campaign of passenger vigilance and awareness. Travellers are asked to report any suspicious activities or unattended packages
• developing techniques for use by frontline staff to assess the danger posed by suspicious unattended packages or bags. London Undonground's technique for rapid assessment of suspicious items is known by the acronym 'HOT.' This stands for:
• H - Is it Hidden?
• O - Is it Obvious?
• T - Is it Typical?

More than 6,500 bomb threats were directed against the London Underground and British Railways passenger country wide passenger network between 1991 and 1997. Of these around 100 (fewer than 2 per cent) were considered serious. Of the 100 serious cases, evacuations or partial station evacuations or line disruption were ordered in 41 cases.

The Moscow underground

The Moscow Metro system has been targeted several times by suicide bombers allegedly members of Chechen rebel groups. On 31 August 2004, a female suicide bomber blew herself up outside the entrance to the Rizhshkaya subway station and the Krestovskiy shopping centre, killing 10 people and injuring a further 50. Authorities claimed the bomber intended to detonate herself either inside the station or on board one of the trains, but was deterred by police who were checking passenger identities and conducting searches. They estimated the suicide belt worn by the attacker created an explosion equivalent in force to the detonation of 2 kg of TNT.

The worst attack against the Moscow Metro killed 39 people and injured 134 at the height of morning rush hour on 6 February 2004. In this case the attacker was male and it appears that the explosive device was contained in an attaché case or rucksack placed on the floor. The detonation occurred in the tunnel while the train was in transit between Paveletskaya and Avtozavodskaya stations. The force of the explosion destroyed the interior of the targeted carriage, the adjoining second carriage of the train was set on fire and every window along the train was smashed or blown out. The bomb, made of a mixture of ammonium nitrate, TNT and RDX was believed to have had the explosive yield equivalent to 2.5 kg of TNT.

Threat dynamics

Why are rail networks so vulnerable to terrorist attack? Modern high density passenger rail transport is designed with one overarching intent: the rapid, unimpeded movement of high volumes of passengers through accessible and open architecture to facilitate leaving and boarding from trains within a minimum cost structure. Furthermore, rail transport systems cross some of the most densely populated urban landscapes in the developed and developing world. To terrorists, this represents a relatively low threshold of logistical planning and operational execution, accompanied by a high fatality and disruption ratio to the time and effort required to mount an attack. Attacks on the railway cause alarm, transport network paralysis, physiological and psychological trauma and economic loss, and long-term disruption. While the aftermath of the London and Mumbai attacks showed that some rail services can be restored quickly, full normal services can take weeks to restore. In the wake of the 7 July 2005 attacks, disruption to normal services on the London Underground was experienced until 4 August 2005.

Since 2001, the clear intent behind targeting railways has been to achieve an order of magnitude of death. Data from the RAND Corporation highlight that 80 per cent of attacks have resulted in multiple fatalities of 10 or more. To characterise the threat, it must be discerned through the operational eye of terrorism itself. If we take 7 July 2005 London Underground bombings as an object lesson, this presents terrorists with a composite choice of permutations; from which a 'kill matrix' could be produced.

The majority of terrorist attacks against the railway environment have disproportionately targeted urban commuter train networks and metro subway systems. This is in contrast to tracks or the station, which are targeted much less frequently in both the urban commuter train network and metro subway system.

The propensity toward targeting the train as opposed to station and tracks is one of probability, logistical constraints and the desire to cause maximum disruption, as well as death. There is a higher probability of a device being detected when planted on the track or station.

The ability to plant a device on the track is restricted by the logistics of having to trespass on open tracks and the limitation of time intervals between individual trains, known as the 'headway'. On urban commuter rail networks this can be a matter of one or two minutes at peak times, thereby restricting the opportunity to physically get on and off the tracks safely. It also narrows the target selection to long-distance, high-speed networks, with much longer headway between trains.

It is interesting to note that a common feature of rail terrorism has been the extensive reconnaissance conducted and meticulous attention to detail in the planning process, as shown in the cases of the Madrid rail bombings, the London attacks, and from what is presently known about the 11 July 2006 Mumbai blasts.

Spanish authorities investigating the Madrid attacks unearthed drawings, photographs and details of reconnaissance activities carried out by the perpetrators, who visited stations and travelled on trains to make notes on their routes and timings. Similarly, three of the 7 July bombers were captured conducting reconnaissance activities on CCTV systems on the London Underground.

A terrorist attack in Ahmedabad, India, on 19 February 2006 might also be seen as a 'dry run' for the Mumbai bombings. The railway station was targeted with an IED hidden in an unclaimed suitcase and left in an compartment on the Ahmedabad-bound Karnavati Express from Mumbai.

Trends in rail terrorism

The clearest trend in rail terrorism appears to be toward mass casualty terrorist attacks using conventional weapons, principally the use of IEDs to target train carriages.

The future trajectory of the rail terrorism threat will seek to replicate the Madrid rail bombings, the aim being to create mass casualties and major service disruption in a multiple, simultaneous or sequential IED attack during peak commuter travel times.

Despite the pre-eminence of IEDs as the weapon of choice against the rail environment, the fear of terrorists using weapons of mass destruction occupies an exaggerated position in the threat matrix.

Universally, hundreds of millions of US dollars have been spent and are allocated to mitigate the threat of a chemical, biological and radiological (CBR) attack, particularly on metro systems. Measures including bio-detectors and provision of gas masks on trains have been implemented. For example, the metro in Washington DC has one of the most evolved early warning chem-bio detection systems currently deployed on a metro rail network.

The system consists of a series of linked sensors which constantly take samples for automatic analysis. These sensors feed into a command and control centre which co-ordinates CCTV coverage and the activities of first responders in the event of an attack. All front-line staff have been issued with gas masks. Washington DC Metro has spent up to USD15 million of federal funds on the project so far, and in 2005 asked Congress for a further USD20 million to extend the scheme and install chemical sensors in 15 underground stations. To install sensors and other measures in all 47 underground stations would cost in the region of USD63 million. This does not include biological or radiological detectors.

The focus on chem-bio terrorism is partially politically and risk-perception driven and a result of what is known as a 'high consequence aversion'; in other words, a willingness to spend a disproportionate amount of money and effort to avoid a 'worst case scenario' because of the grievous consequences were such an event to occur. Expenditure in this area is disproportionate to the threat faced by such devices. Diverting funding away from more conventional threats could increase the vulnerability of rail networks.

An objective interpretation of the facts suggests that the CBR terrorism risk in the short to medium term is still very low. In the unlikely event that such an attack occurs in the railway environment, it will cause significant disruption but relatively small-scale fatalities. This is not the imminent Armageddon of our worst nightmares.

Countering the threat

A comprehensive suite of counter-measures, spanning intelligence, technologyand procedures, must seek not to defeat terrorism but to displace it from the railway environment. Such methods of displacement include:

• intelligent CCTV, comprised of multimedia video-based surveillance systems that transmit, record and store captured CCTV digital images over fibre-optic or wireless networks and servers. The process is further enhanced by the application of intelligent software engines. This will facilitate the use of anomaly algorithms, for the identification or the seeking out of unusual or suspicious behaviour patterns.
• explosive detection sensors at portals, for entry and exit points to the metro system. For example, explosive sensors could be incorporated into passenger ticket gates.
• millimetre wave imagers provide the prospect of mass rapid scanning of passengers and their baggage, presenting high quality video images in real time.

Railway networks must make themselves a less attractive proposition in the target selection process of terrorism. This can be significantly aided by learning the lessons from each terrorist incident in the railway environment, regardless of where in the world it may have occurred.