Security Weekly: A Serial Bomber in Phoenix, May 31, 2012

By Scott Stewart

A small improvised explosive device (IED) detonated at a Salvation Army distribution center in Phoenix, Ariz., on the afternoon of May 24. Two Salvation Army employees discovered the explosive device, which was concealed inside a yellow, hand-held 6-volt flashlight, as they were sorting through a box of donated items. The IED exploded when one of the employees picked up the flashlight and attempted to turn it on. The blast was not very powerful, and the two employees suffered only minor injuries.

This was the third incident in the Greater Phoenix area in recent weeks involving an IED concealed in a flashlight. Two explosive devices very similar to the May 24 IED exploded May 13 and May 14 in Glendale, Ariz., a city in the Greater Phoenix metropolitan area. Both devices were abandoned in public places. In the May 13 incident, a woman discovered a yellow, hand-held 6-volt flashlight next to a tree outside a Glendale business. When the woman picked up the flashlight and attempted to turn it on, it exploded, causing minor scratches and bruises to her face and hands. It also inflicted minor wounds to a woman beside her. The next day, a man found an identical flashlight in a ditch where he was working in another part of Glendale. He was lightly injured when the flashlight exploded as he attempted to turn it on.

So far, the explosive devices have failed to cause significant injury or death, but they do seem to indicate that there is a serial bombmaker operating in the Phoenix area. While it is not yet clear what the bombmaker's motives are, past cases of serial bombers suggest that the publicity he has received and the fear he has invoked will likely influence him to continue manufacturing explosive devices until he is captured. (Based on earlier cases involving serial bombers, it is also safe to assume that the culprit in the Phoenix area is a man.) The bombmaker's method of concealing his explosive devices may also change after gaining publicity for this wave of attacks. Finally, there is a chance that the destructive effect of the bombmaker's devices will increase as he becomes more proficient at building IEDs.

Serial Bombers

Serial bombmakers vary greatly in skill, motivation and affiliation. Most bombmakers involved with militant groups are, in effect, serial bombers, especially when they are exceptional bombmakers such as those we discussed in the May 17 Security Weekly. These include individuals such as Abu Ibrahim of the Black September Organization, Yahya Ayyash of Hamas or al Qaeda in the Arabian Peninsula's Ibrahim Hassan Tali al-Asiri. Such individuals typically create hundreds, if not thousands, of innovative explosive devices for their groups' terrorist operations over a span of many years.

However, not all serial bombmakers are associated with a militant group. There is a long history of individuals who have operated as serial bombers. From 1940 to 1956, George Metesky, who was known in the media as "The Mad Bomber," deployed 33 IEDs, 22 of which detonated, and injured 15 people. Metesky was angry after being denied disability pay following an injury he sustained while working for Consolidated Edison, Inc. After planting two explosive devices in 1940, Metesky observed a self-imposed moratorium on bombing attacks during World War II. He deployed the bulk of his devices -- pipe bombs -- from 1951 to 1956. He attacked not only Consolidated Edison, but also theaters, the New York subway system, the New York Public Library, Radio City Music Hall, Grand Central Station and other targets. Metesky was arrested after Consolidated Edison personnel managers identified him based on details he provided in threatening letters.

One of the most famous serial bombers in recent years was Theodore Kaczynski, also known as the "Unabomber." UNABomb was an FBI case name that stood for "University and Airline Bomber" -- Kaczynski's first targets. From May 1978 until April 1995, Kaczynski deployed 16 IEDs that killed a total of three people and injured 23 more. Like the Metesky case, it was Kaczynski's writings that allowed him to be identified, though it was Kaczynski's brother who identified him for authorities. As demonstrated in his manifesto, titled Industrial Society and Its Future (1995), Kaczynski was motivated by a fear of technology. He called for a revolution against modern society's "industrial-technological system."

Eric Rudolph first came onto the scene in July 1996 when a bomb he planted in Atlanta's Centennial Olympic Park detonated during the 1996 Summer Olympics. Rudolph also conducted IED attacks against abortion clinics in Atlanta in 1997 and in Birmingham, Ala., in 1998 and against a gay bar in Atlanta in 1997. Rudolph's IED attacks killed two and wounded more than 100. Rudolph was motivated by his extreme anti-abortion and anti-homosexual convictions.

Not all serial bombers have intended to kill their targets. From 1994 to 2006, an unidentified bombmaker known by the media as the "Italian Unabomber" planted dozens of small IEDs in various locations in Italy. While many of the IEDs were pipe bombs, the Italian bombmaker also concealed IEDs in cans of tomato paste, cigarette lighters, church votive candles and in items intended to target children, such as bottles of soap bubbles, colored markers and Kinder Eggs. The size of many of these devices suggests that the bombmaker hoped to maim and terrorize his victims but not kill them. A suspect was arrested in the Italian case but was later acquitted, and the case has never been officially solved. Since many serial bombmakers, such as Metesky and Kaczynski, go through periods when they suspend bombmaking activity, it is possible that the Italian bombmaker is still at large and will attack again.

The Learning Curve

Of these historical examples, Rudolph stands out because from the beginning of his campaign he used relatively powerful devices that were constructed with a main charge of commercial dynamite and that contained nails as added shrapnel. From the outset, Rudolph appeared to have been bent on killing. This is different from the case of the Italian Unabomber. Rudolph's explosive devices also functioned as designed, and his first device proved deadly, an accomplishment aided by the fact that he was constructing them from stolen commercial explosive components rather than dealing with homemade bomb components and explosive mixtures.

However, all serial bombmakers must overcome a learning curve. A bombmaker's first explosive devices typically malfunction or only partially detonate until he perfects his craft. For example, the two devices Metesky deployed in 1940 failed to explode, but when he resumed his bombing campaign in 1951, his first device functioned as intended. Still, of the 33 devices Metesky planted, one-third of them did not function as designed. Likewise, Kaczynski's initial explosive devices caused only light injuries. It was not until the 1980s that his bombs began to cause significant injuries to their victims, and he did not kill his first victim until 1985. By the mid-1990s, Kaczynski had become very deadly. His last two bombing attacks, in December 1994 and April 1995, both proved fatal.

A malfunction is not uncommon when a self-taught bombmaker constructs an IED using a new design and does not have the time or the place to test it. Essentially testing the explosive device when he deploys it, the bombmaker applies lessons from one operation to the next to improve his devices. This progression of bombmaking competence has also been displayed in many cases involving militant groups. Based on these cases, we believe it is highly likely that if the Phoenix bombmaker is not identified and arrested, he will continue along the learning curve and eventually construct more powerful -- and thus more deadly -- IEDs.

At this point it is unclear what is motivating the serial bombmaker in Phoenix. Young men sometimes construct small IEDs for their own amusement -- and not necessarily for use in an attack -- but in such cases they usually want to watch their devices detonate, oftentimes even recording the detonations to post them online. They will sometimes use such devices in pranks, such as to blow up mailboxes, but again, they usually like to observe the results.

Abandoning IEDs in booby-trapped items for people to find and activate suggests a different motive. Reports suggest that there were ceramic shards and BBs added to the Phoenix devices. This indicates that the devices were intended to harm people rather than just scare them. There are reports that a pair of dice was found at the scene of one of the Glendale explosions, which has led some to speculate that the dice were left by the bomber as a calling card. Similarly, the box containing the booby-trapped flashlight in the Salvation Army attack also held books that were predominately concerned with murders and serial killers; this may also prove to be some sort of calling card.

A Bombmaker's Signature

Forensic science has come a long way since the days of Metesky. Urged along by international terrorism cases and cases like the Unabomber investigation, bomb investigators, chemists and forensic technicians are far more advanced in their craft than they were a few years ago.

In a bombing, the evidence is not completely vaporized as many people believe. Certainly, the explosive charge may be mostly or completely detonated, but it will still leave behind traces of chemical residue that allow the explosive to be identified. In addition, portions of the main charge often times will not be detonated, especially with homemade explosive mixtures. Although they are frequently shattered and scattered, significant portions of the device's firing chain often can be recovered in a careful bomb crime scene investigation. It is not unusual to find batteries, wires, switches or pieces of clock or circuit board during a post-blast investigation. Sometimes pieces of the aluminum body of a blasting cap can be found.

In the case of the Phoenix bombings, the fact that the flashlights did not explode with much force will likely assist the police in their post-blast investigation, since device components were probably not thrown very far or even that badly damaged. It is also possible that an identifiable fingerprint or trace DNA evidence can be recovered from the explosive device. If used in the construction of the device, electrical tape is often an excellent place to recover such evidence.

Like other craftsmen, bombmakers tend to do things a certain way and to repeat it from project to project. They also favor certain components and tend to string these components together in much the same way. They will often connect the wires together in the same manner, use the same type of solder, connectors or tape, and in many cases they will even use the same tools to cut wires or other items, leaving tool marks that can be compared microscopically. All these unique factors combine to form what is referred to as a bombmaker's "signature." In many cases this signature is as unique and personalized as an actual written signature.

According to reports, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) laboratory is working on the Phoenix case. The ATF lab has many decades of working post-blast investigations and, along with the FBI, has been heavily involved in maintaining something called the U.S. Bomb Data Center, which is a repository of data pertaining to bombing investigations that can be cross-referenced to uncover ties to past cases. The ATF lab, like the FBI lab's explosives section, also maintains an extensive database of bomb components and other signature items.

However, unless there is a bomb signature item, fingerprint or trace DNA evidence that can be readily connected to a suspect, or unless authorities are able to trace one of the components (such as the flashlight) back to the place of purchase, it is likely that the bombmaker will attack again -- serial bombers usually do. The next time, the devices may be disguised in a different manner and may be more powerful.

A Serial Bomber in Phoenix COPYRIGHT: STRATFOR.COM