Security Weekly: Awareness Can Short-Circuit a Bomb Attack, March 31. 2016

By Scott Stewart

Bombs used in the March 22 attacks in Brussels displayed a degree of tradecraft not before shown by the Islamic State outside its core areas of operation. The bombings at the Zaventem airport and at a metro station in Brussels killed 35 and wounded more than 300, making them the deadliest jihadist bombing attack in the West in more than a decade.

The Brussels attacks broke the recent trend of moving toward armed assaults from bombings. The Brussels cell was able to conduct such a large bombing operation because one of its key members, identified by Belgian authorities as Najim Laachraoui, possessed advanced bombmaking tradecraft acquired from Islamic State trainers while he was in Syria. Laachraoui is also thought to have constructed the bombs used in the November 2015 Paris attacks.

Strangely, Laachraoui has been identified as one of the suicide bombers who attacked the airport in Brussels. It is rare for an organization's bombmaker to participate in a suicide attack — they are simply too valuable to waste — but it appears as if Laachraoui, under heavy police pressure, chose to go out intentionally rather than to risk being captured like his fellow conspirator, Saleh Abdesalam, who was arrested March 18. No matter Laachraoui's motive, it is good news that a well-trained bombmaker is out of the picture. However, the threat of jihadist bomb attacks against targets in Europe and elsewhere in the West did not die with Laachraoui, and authorities and citizens alike are left to wonder: How many other trained Islamic State bombmakers remain at large?

I've recently seen a reputable company write that if a terrorist plot gets to the bombmaking stage, it is too late to avert an attack. However, I strongly disagree with this claim. Even in the weapons acquisition or bombmaking stage of the terrorist attack cycle, terrorist operatives remain vulnerable, and plots can be thwarted if bombmaking activity is noticed and reported to authorities.

Indeed, unusual activity was noticed in the Brussels case, according to a March 26 story in The New York Times. The story noted that an overpowering chemical odor coming from Laachraoui's sixth floor apartment made the building's owner gag — and odd happenings at the apartment prompted another neighbor to call the police, but those reports were not investigated. The taxi driver who drove three of the attackers to the airport also noticed that his passengers acted strangely and refused to let him touch their suitcases, which reeked strongly of chemicals, but he did not take action until after the attacks.

These were all indications that very well could have resulted in the attacks being disrupted, but unfortunately, they did not. However, that does not mean that the next bombing cannot be thwarted by the telltale signs of bombmaking activity. Let's examine some of those indicators in more detail.

Beyond a Bleach Blonde

As al Qaeda in the Arabian Peninsula's Inspire magazine so famously stated, you can indeed "make a bomb in the kitchen of your mom." It truly is not difficult for a knowledgeable individual to mix up improvised explosives using a wide range of common household chemicals, including peroxide, acetone, chlorine and brake fluid.

It is important to recognize that when we say an explosive mixture or an explosive device is "improvised," that does not automatically mean the end product is going to be ineffective or amateurish. Like an improvised John Coltrane saxophone solo, some improvised explosive devices can be highly crafted, albeit deadly, works of art. That said, certain activities necessary to make bombs leave even proficient bombmakers open to detection by outside observers — and amateur bombmakers are even easier to spot if one knows what to look for.

To obscure bombmaking activity, explosive mixtures and device components are often manufactured in rented houses, apartments or hotel rooms. We have seen this in past cases, such as the December 1999 "millennium bomb" plot in which Ahmed Ressam and an accomplice set up a crude bombmaking factory in a hotel room in Vancouver, British Columbia. More recently, Najibullah Zazi was arrested in September 2009 and charged with attempting to manufacture the improvised explosive mixture triacetone triperoxide (TATP) in a Denver hotel room. In September 2010, a suspected lone assailant in Copenhagen accidentally detonated an explosive device he was constructing in a hotel.

Similar to clandestine methamphetamine labs, which are also frequently set up in rental properties or hotel rooms, makeshift bombmaking operations frequently use everyday volatile substances. Chemicals such as acetone, a common nail-polish remover, and peroxide, commonly used to bleach hair, can easily be found in stores. Fertilizers, the main component of the bombs used in the 1995 Oklahoma City bombing and the 1993 World Trade Center attack, are present in large volumes on farms or in farm-supply stores in rural communities. Hardware and paint stores sell acids and powdered metals.

However, the quantities of chemicals required to manufacture explosives far exceeds those required for most legitimate purposes. Because of this, hotel staff, landlords and neighbors can fairly easily notice signs that someone in their midst is operating a makeshift bombmaking laboratory. Obvious suspicions should be raised if, for example, a new tenant moves several bags of fertilizer into an apartment in the middle of a city, or if a person brings in gallons of acetone, peroxide or sulfuric or nitric acid. Furthermore, bombmakers use laboratory implements, such as beakers, scales, protective gloves and masks, not normally found in a hotel room or residence.

Additionally, although electronic devices like cellphones or wristwatches may not seem unusual in the context of a hotel room or apartment, signs that such devices have been disassembled or modified to have wires protruding should raise a red flag, as these altered devices are commonly used as initiators for improvised explosive devices.

Certain items that are less commonly used in household applications but that are frequently used in bombmaking include nitric or sulfuric acid; metal powders such as aluminum, magnesium and ferric oxide; and large quantities of sodium carbonate, commonly sold in 25-pound bags. Large containers of methyl alcohol, which can be used to stabilize nitroglycerine, are another indicator that a bombmaker may be present.

Fumes from chemical reactions are another sign of bombmaking activity. Depending on the size of the batch being concocted, the noxious fumes from an improvised explosive mixture can bleach walls and curtains and, as was the case for the July 2005 London attackers, even the bombmakers' hair. The fumes can even waft outside of the lab and be detected by neighbors, as they were in the Brussels case. Spatters from the mixing of ingredients such as nitric acid leave distinctive marks, which are another way for hotel staff or landlords to recognize that something is amiss. Additionally, rented properties used for bombmaking activity rarely look occupied. They frequently lack furniture and have makeshift window coverings instead of drapes. Properties where bomb laboratories are found also usually have no mail delivery, sit vacant for long periods and are occupied by people who come and go at odd hours and who are often seen carrying strange things — such as containers of chemicals or large quantities of ice, which is used to keep chemical reactions such as those used to synthesize TATP under control.

The components for the truck bomb used in the 1993 World Trade Center bombing were manufactured in a rented apartment in Jersey City. The process of cooking the nitroglycerine used in the booster charges and the urea nitrate used in the main explosive charge created strong chemical fumes that changed the wall paint color and corroded metal doorknobs and hinges. The bombmakers also spilled chemicals on the floor, the walls, their clothing and other places, leaving plenty of trace evidence for investigators to find after the attack.

More Clues to Spot Bombmakers

Given the caustic nature of the ingredients used to make homemade explosive mixtures and the volatile chemical reactions required to make things like nitroglycerin and TATP, creating the explosive can be one of the most dangerous aspects of planning a bombing attack. Indeed, Hamas militants refer to TATP as "the mother of Satan" because of its volatility and propensity to severely burn or kill bombmakers if they lose control of the chemical reaction required to synthesize it.

Because of this, it is important for medical personnel to pay attention to emergency room walk-ins with thermal or chemical burns who smell of chemicals and to report them to authorities in much the same way they do patients who appear to have been injured in meth lab accidents.

In January 1995, an apartment in Manila, Philippines, caught fire when the bombmaker in the 1993 World Trade Center attack, Abdel Basit (aka Ramzi Yousef), lost control of the reaction in a batch of TATP he was brewing for his planned attack against a number of U.S. airliners flying over the Pacific Ocean — an operation he had nicknamed Bojinka. Because of the fire, authorities were able to arrest two of Basit's co-conspirators and to unravel Bojinka and other plots against targets including Pope John Paul II and U.S. President Bill Clinton. Basit fled to Pakistan, where he was apprehended a short time later. This case serves to highlight the dangers presented by these labs to people in the vicinity — especially in a hotel or apartment building.

Another behavior that provides an opportunity to spot a bombmaker is testing. A professional bombmaker will try out improvised mixtures and components, like improvised blasting caps, to ensure that they are functioning properly and that the completed device will therefore be viable. Such testing may involve burning or detonating small quantities of the explosive mixture, or actually exploding the blasting cap or booster charge. The testing of small components may happen in a backyard, but the testing of larger quantities will often be done at a more remote place. In his diary, Norway bomber Anders Breivik noted how he had taken his bomb components to a remote location a good distance from the rented farmhouse where he built his bomb to test them. Therefore, any signs of explosions in remote places like parks and national forests should be immediately reported to authorities.

Obviously, not every container of nitric acid spotted or small explosion heard will be absolute confirmation of bombmaking activity, but reporting such incidents to the authorities will give them an opportunity to investigate. In an era when the threat of attack comes from increasingly diffuse sources, a good defense requires more eyes and ears than the authorities possess.

Awareness Can Short-Circuit a Bomb Attack COPYRIGHT: STRATFOR.COM