Security Weekly- .Al Qaeda Unlucky Again in Cargo Bombing Attempt November 2, 2010

By Scott Stewart

The Oct. 29 discovery of improvised explosive devices (IEDs) inside two packages shipped from Yemen launched a widespread search for other devices, and more than two dozen suspect packages have been tracked down so far. Some have been trailed in dramatic fashion, as when two U.S. F-15 fighter aircraft escorted an Emirates Air passenger jet Oct. 29 as it approached and landed at John F. Kennedy International Airport in New York. To date, however, no other parcels have been found to contain explosive devices.

The two parcels that did contain IEDs were found in East Midlands, England, and Dubai, United Arab Emirates, and both appear to have been sent by al Qaeda in the Arabian Peninsula (AQAP), al Qaeda’s jihadist franchise in Yemen. As we’ve long discussed, AQAP has demonstrated a degree of creativity in planning its attacks and an intent to attack the United States. It has also demonstrated the intent to attack aircraft, as evidenced by the failed Christmas Day bombing in 2009 involving Umar Farouk Abdulmutallab, who tried to detonate an explosive device concealed in his underwear on a flight from Amsterdam to Detroit.

A tactical analysis of the latest attempt suggests that the operation was not quite as creative as past attempts, though it did come very close to achieving its primary objective, which in this case (apparently) was to destroy aircraft. It does not appear that the devices ultimately were intended to be part of an attack against the Jewish institutions in the United States to which the parcels were addressed. Although the operation failed in its primary mission (taking down aircraft) it was successful in its secondary mission, which was to generate worldwide media coverage and sow fear and disruption in the West.

Tactical Details

The details that we have been able to collect so far concerning the configuration of the devices is that both were camouflaged in parcels and both contained a main charge of pentaerythritol tetranitrate (PETN) that was to be detonated by a primary explosive charge of lead azide. PETN is a military-grade explosive commonly found in detonating cord and some plastic explosives. PETN was also the primary explosive in the underwear bomb used in AQAP’s failed Christmas Day attack as well as its attempted assassination of Saudi Deputy Interior Minister Prince Mohammed bin Nayef using an IED concealed inside the attacker’s body. Lead azide is a common primary explosive used in detonators, and it can also be used to effectively detonate an explosive such as PETN. According to media reports, the two devices contained 10.58 ounces and 15.11 ounces of PETN, both of which are larger charges than the 2.8 ounces contained in the Christmas Day device and more than the amount believed to have been used in the attack on Prince Mohammed bin Nayef.

The device discovered in East Midlands appears to have been hidden inside an ink toner cartridge hidden inside a computer printer, and from photographs it appears to have been designed to be detonated by a cell-phone motherboard altered to serve as an initiator. Taking the cell-phone motherboard out of its case and affixing it to the body of the printer made it appear to be part of the printer itself if the device was scanned. The addition of the cell-phone motherboard indicates the device was likely intended to be detonated when a call or message was received by the phone. We are unsure if the phone was utilizing the GPS feature some phones have to track the location of the device, but it is a possibility.

Photos of the Dubai device suggest that, while it was also camouflaged inside the toner cartridge of a computer printer, it may have had a different design. It also appears to have included an appliance timer. (We have been unable to determine if there was a similar timer in the East Midlands device.) If both a cell phone and a timer were involved in the Dubai device (and possibly the East Midlands device), it is possible that the timer was intended to provide a secondary fail-safe firing chain to detonate the device in case the cell phone failed, or that it was added to provide a minimum arming time before the device could be detonated using the cell phone. A minimum arming time would prevent the device from detonating prematurely.


Either way, based upon this construction, the devices do not appear to have been intended to explode when the parcels they were contained in were being opened, like most parcel and letter bombs. This means that the two Chicago-area Jewish congregations the parcels were addressed to were not the true intended targets of the devices and that, in all likelihood, the devices were intended to target aircraft and not Jewish institutions. The devices were likely addressed to Jewish institutions because the bomb-makers needed some target inside the United States, and listing Jewish institutions would be sure to create panic and fear should the devices fail to function as designed or be discovered during a security check. The attackers probably intended to destroy the aircraft carrying the packages out over the Atlantic Ocean or perhaps over the U.S. coastline as the aircraft came into cell-phone range.

As would be expected, the two packages appear to have been shipped using a fraudulent identity. The person whose name was used, Hanan al-Samawi, a 22-year-old computer engineering student at Sana’a University, was arrested by Yemeni authorities Oct. 30 and released the next day after the shipping agent told authorities that she was not the woman who signed the shipping manifest.

Consistent Themes

As we’ve noted before, some jihadist groups have a fixation on attacking aviation targets. In response to this persistent threat, aviation security has changed dramatically in the post-9/11 era, and great effort has been made at considerable expense to increase the difficulty of attacking passenger aircraft. Changes made in the wake of the Christmas Day attempt in 2009 have made it even more difficult for AQAP to get a suicide operative on board an aircraft. The pressure the group is under in Yemen is also likely making it harder for it to interact directly with potential suicide bomber recruits who are able to travel, like Abdulmutallab. Indeed, AQAP has been telling aspiring jihadist operatives from the West not to try to travel to Yemen but to conduct simple attacks at home.

There has long been an evolving competition between airline security policies and terrorist tactics as both are adapted in response to the other. Because of recent developments in aviation security, AQAP apparently has tried again to re-shape the paradigm by moving away from suicide-bomber attacks against aircraft and back to a very old modus operandi — hiding explosive devices in packages and electronic devices.

Explosive devices concealed in electronic items designed to be loaded or carried aboard aircraft go back to Palestinian groups in the 1980s such as the Popular Front for the Liberation of Palestine-General Command and, of course, to the Libyan operatives behind the Pan Am Flight 103 bombing. With measures to track luggage with passengers instituted in the wake of Pan Am Flight 103, terrorist planners changed their tactics and began utilizing modular IED designs that could be carried on board aircraft and left behind or initiated by suicide operatives. They also began to explore the use of cargo carried on board passenger airplanes as an alternative.

After the original Operation Bojinka was derailed by an apartment fire in Manila that exposed the plan and caused operational planner Abdel Basit to flee the country, Basit (commonly known as Ramzi Yousef) returned to Pakistan and began plotting again. Since word of his modular baby-doll devices had leaked out to airline security personnel, he decided instead to use air cargo carried aboard passenger aircraft as a way to destroy them.

As in the attack against Philippines Airlines Flight 434 in December 1994, Basit wanted to conduct a test run of his parcel-bomb plot. He constructed a parcel-bomb package that contained cutlery as well as liquid explosives in order to confuse X-ray screeners. He also instructed one of his followers, Istaique Parker, to ship the package from Bangkok aboard an American airliner to the United States. Basit’s plan failed when Parker got cold feet. Instead of carrying out the assignment, he gave Basit a bogus excuse about needing an exporter’s license that would require a photograph and fingerprints to ship items to the United States. Basit and Parker returned to Pakistan where, motivated by greed, Parker turned Basit in for the reward money, and U.S. agents then moved in for the arrest. Had Basit not been arrested, there is very little question that he eventually would have tried to set his parcel-bomb plan in motion. At the time of his arrest he had several wristwatches in his possession that had been altered to function as IED timers.

All of which is to say that, even though this latest parcel-bomb plot was foiled, militants will continue to seek alternate ways to smuggle IEDs and IED components aboard aircraft. AQAP in particular has demonstrated that its operational planners carefully study security measures and then plan the type of IED to employ in an attack based upon those measures.

In an article posted in February in the group’s online magazine Sada al-Malahim, titled “Secrets of the Innovative Bomb,” the AQAP author noted that the group pays attention to X-ray machines, metal detectors and detection equipment intended to pick up explosive residue and odors and then seeks vulnerabilities in the system that it can exploit. Camouflaging an IED inside a computer printer was apparently successful in bypassing screening measures, though it is interesting that nobody seems to have asked why such an item was being shipped from Yemen to the United States instead of the other way around, or why someone in Yemen was shipping such items to Jewish institutions in the United States. It appears that even after the initial alert went out, authorities in the United Kingdom missed the device the first time they inspected the parcel, highlighting the effectiveness of the AQAP camouflage job.

Like the Bojinka plot, the latest AQAP parcel-bomb operation may have included a proof-of-mission trial run. There was a crash of a UPS flight in Dubai on Sept. 3 that stands out as suspicious, given the circumstances surrounding the crash and in light of these recently recovered IEDs. UAE authorities said Nov. 1 that there was no sign of an explosion in that accident, although the damage done as a result of the crash and subsequent fire may have made it difficult to uncover such evidence. Undoubtedly, U.S. and UAE authorities will be taking another careful look at the incident in light of the Oct. 29 case. Other recent cargo-aircraft accidents in the region will likely be re-examined as well.

Also like the 1995 Bangkok plot, this recent attempt may have been thwarted by an insider. There have been several recent defections of AQAP personnel to law enforcement authorities, such as Jabir Jubran al-Fayfi, who recently turned himself in to Saudi authorities (although AQAP claims he was arrested in Yemen). If al-Fayfi did indeed surrender, he might be cooperating with the Saudis and may have been able to provide the actionable intelligence authorities used to identify and thwart this plot, though it is unlikely that he provided the exact tracking numbers, as noted in some media reports, since the packages were shipped after he surrendered. If the Saudis did indeed provide the exact tracking numbers to their American counterparts, the intelligence had to have come from another source.

In the end, this AQAP attack failed to achieve its immediate objective of destroying aircraft. The planners of the attack probably hoped that the parcels would be shipped on passenger aircraft, and it appears that they were aboard passenger aircraft for at least some of their journey. However, like the failed assassination of Prince Mohammed bin Nayef and the Christmas Day attack, this attempt was successful only in its secondary objective, which was to generate global media coverage and sow fear in the West. Given the low cost and low risk associated with such an attack, this is quite an accomplishment — although the failed attack will certainly cause the U.S. government to turn up the heat on Yemeni President Ali Abdullah Saleh to do something about AQAP. Saleh has long played a delicate balancing act of using the jihadists as allies against his enemies in the country’s north and south and has resisted launching an all-out offensive against AQAP. The U.S. government may also expand its unilateral operations against the group.

As long as AQAP’s operational leaders and its bombmakers — like Ibrahim Hassan Tali al Asiri, brother of the suicide bomber in the Prince Mohammed bin Nayef attack — remain free, they will continue trying to exploit security vulnerabilities and attack U.S. and Saudi targets. So far, the group has come close to pulling off several spectacular attacks but has suffered unlucky breaks that have caused each attack to fail. However, to paraphrase an old Irish Republican Army taunt, they only have to get lucky once.

Al Qaeda Unlucky Again in Cargo Bombing Attempt is republished with permission of STRATFOR.