As protective officers, we try to use preventative strategies to protect our clients based on the tenets of Detect, Deter, and Defend.
The first two of these tenets involve soft skills which are sometimes referred to as Protective Intelligence (PI) and include situational and tactical awareness skills (route analysis and surveillance detection). The third tenet, Defend, requires hard skills such as the use of firearms and security driving. These hard skills may be required if we were unable to prevent or avoid an attack, and we end up in a situation where we have to survive an ambush. Continuing where we left off in Part One, we will finish covering some of the soft skills involved in Protective Intelligence and then move on to discuss the hard skills.
Counter-Surveillance vs Surveillance Detection
In the 90’s, several elements within the US government began to deploy specialized units to specifically augment the Surveillance Detection (SD) activities performed by the protective details. These units were called Counter Surveillance (CS) Teams. There are some subtle differences between SD and CS.
In the intelligence community, SD is conducted by the target of the surveillance while CS is done by other elements that are not part of the protectee’s security package. Additionally, CS may be used to actively investigate the surveillance activity.
While most protective teams do not have the luxury of having a dedicated CS team there are low budget methods which provide a similar effect. One method is to assign one or more protective personnel to conduct targeted sweeps through the neighborhood where the protectee lives, through likely ambush sites, and near all established chokepoints. These activities are done separately from any of the protectee’s movements. When we do these types of sweeps prior to the protectee’s movements we call them “Advances” and any surveillance detection done under these circumstances falls under the SD category. Advances are especially useful for detecting deployed attack teams.
When conducting both SD and CS type sweeps we are looking for signs of surveillance which are part of the attack cycle. By honing-in on specific areas where surveillance is likely to be conducted, we can reduce the number of areas we need to cover, thereby allowing us to increase our accuracy. When we observe any specific suspicious activity in these critical areas we need to investigate using in-house capabilities as well as any law enforcement liaison.
Of course, the CS team members and advance elements preceding the protectees motorcade also need to be looking for potential deployed attack teams in all likely ambush and chokepoint locations. These two elements give us the best chance to avoid an ambush that has moved to the final stages of the attack cycle.
We need to use the same skills we use when we are performing surveillance detection when we are looking for signs of a possible attack. We must be aware of our environment, looking ahead, “anticipating” problems or threats, and mentally preparing for a potential threat by playing the “What If” game (i.e. mentally asking ourselves what we will do if we see a situation developing). We also need to be ready to increase our awareness level if we notice anything unusual. This is especially critical in chokepoints and potential ambush sites. Specifically, we are looking for unusual interest in our movements (on foot or in a vehicle), anything which slows or stops our movement, any unusual activities by pedestrians or vehicles, and of course, we are looking for any visibly deployed attack elements and/or vehicles. In a nutshell, we are looking for anything which causes us to feel that “something is wrong”. If anything unusual is observed, we must immediately raise our awareness level, find the problem, and mentally prepare to react to the environment by thinking of possible options.
Countering the Surprise Factor
The assailants do everything they can to capitalize on the element of surprise as this factor directly contributes to their ability to execute their attack with maximum effect. If we did not/could not avoid the attack by recognizing the pre-attack surveillance/ambush team deployment phase we must try to avoid the “surprise factor” (attack recognition) and implement our pre-planned evasive action.
If we “anticipate” and mentally prepare we will not be surprised and therefore we will not go into “SHOCK” if an attack occurs. Shock is a condition when the body reacts to great stress, releasing chemicals into the muscles at such a rate that the muscles are overloaded, interfering with their normal functioning, to include possibly freezing up. This reaction can last three seconds or more. Shock can dramatically affect our ability to think and to act in an emergency, when three seconds may be all the time we have to act and save ourselves.
Avoiding being surprised directly affects the lethality of the attack and increases survivability by the target. Some statistics cited say that the assailant has a 91% chance for success if the target (and the security elements) are caught by surprise. This percentage is dramatically reduced if the target/security element recognizes the attack any time prior to the moment that the target reaches the planned attack site – the “X”. If victims have had less than a 10 percent chance of survival when they are caught by surprise on the “X”, then a key element in our defense is to avoid being “Surprised” by an attack. We have to recognize the attack before it happens. This pre-attack recognition factor cannot be over-emphasized.
In an ambush situation, the attacker has the following advantages: the element of “surprise”, knowledge of the area/terrain, greater speed and mobility, and they can easily establish total command and control of the ambush site. Security elements must understand the potential Tactics, Techniques, and Procedures (TTPs) of the assailants, predict the likely attack sites, and develop attack reaction tactics, both evasive and defensive. Historically, in assassination type attacks, 85% of these attacks occur near the residence and in or near the vehicle. If we can anticipate an attack, even for a few seconds, we have a much better chance to execute specific pre-planned maneuvers to defeat an ambush.
Immediate Action Drills: For security professionals, the immediate action drills we do in training prepare us to react to a potential attack when we are caught near or on the “X”. Security teams should have planned and rehearsed these procedures until they can be done without hesitation. This includes observation and initiation (“Contact Right” or “Gun Left”) and then the appropriate tactical response by the security elements (especially the driver if the situation involves an ambush on the motorcade).
Depending upon the terrain, the type of ambush, the vehicles being used, etc. the specific immediate actions may differ but, in general, the best reaction to a threat is to move (preferably away from the attackers). Any efforts which result in our movement off of, and away from, the “X” is better than sitting still. By moving we gain options and increase our survivability. Almost every study on ambushes have shown that any actions that gets the targets off the “X” (the attack site) increases the targets chances for survival. We also need to ensure our actions/responses to an attack does not lead us into a secondary ambush.
As security professionals, we spend a lot of time with our protectees in or near our vehicles and, as noted, a significant amount of attacks on protectees occur around the vehicle. We stand a much better chance of survival if we take any type of action during an attack. While there are a wide variety of actions we can take during an ambush, we can still be highly effective if we reduce this aspect down to one word – “MOVE”!
As security professionals, we must use all the tools available to protect our clients. We need to understand and counter the assailant’s attack cycle. “Protective Intelligence” activities and strategies (route planning and analysis, surveillance detection and counter-surveillance) will help us to recognize hostile surveillance and potential danger areas. Additionally, we must prepare for the worst-case scenario – an ambush.
By using pre-attack recognition skills, we avoid being caught by surprise, so we can use our hard skills (firearms and security driving) and implement our Immediate Action tactics (“MOVE”). Preparation is critical. The US Secret Service lives by the mantra that the overall protective capability of a protection detail never exceeds the level of preparation conducted by the security elements. In other words, if you fail to prepare, prepare to fail!
Counter-Ambush Tactics for Security Professionals – Part 2
By: Thomas Pecora
Thomas (Tom) Pecora is a former CIA Senior Security Officer who retired after 24 years of service protecting Agency personnel. He managed large security programs and operations in Africa, Latin America, Southeast Asia, Europe, the Middle East and in the war zones. He has over 29 years of experience in protective operations, crisis management, personnel/physical security, and counter-terrorism. As Director of Pecora Consulting Services, he provides security vulnerability and threat assessments, as well as personal safety and crime prevention/avoidance skills training.