Mumbai Deconstructed

NJ ROIC Analysis Element Analysis of Terrorist TTPs used in Mumbai Attacks

Overview
•Terrorists were able to use a small number of attackers to achieve a spectacular event
•Used a new delivery method (arrive by hijacked boat, then press an attack until death)
•Use of guns and ammo as primary weapons, explosive use was secondary (this is similar to school shooting scenarios in the U.S.)
•Terrorists killed the head of the Counter Terrorist Police Force
•195 dead (including 6 Americans)
•325+ wounded
•Exploited media by targeting westerners

Tactic 1: Arrival
•Chartered cargo ship out of Karachi, Pakistan
•Vessel originated in Karachi en route to Vietnam
•Hijacked fishing trawler to avoid detection by Indian Coast Guard
•Trawler “Kuber”believed hijacked on 22 or 23 Nov
•Slit throat of captain and killed remaining crewmembers
•One of the terrorists, Ismail, was a trained sailor and took thehelm after the captain was killed
•Used inflatable dinghies to transport teams last few nautical miles to Sassoon Dock
•GPS device found on abandoned trawler was set for a route back to Karachi (indicating it was not meant to be a suicide attack)
•Two teams checked into the Oberoi and Taj Mahal hotels four days prior to the assaults to stash supplies and study the layout
•Others came by sea from Pakistan
•Intelligence sources reported two boatfuls of weapons and some 18-20 terrorists most likely came from Karachi in Pakistan
•Reached Mumbai 26 Nov and waited for evening
•The trawler’s Gemini dinghy was missing –located in Mumbai with all identifying marks including engine serial number obliterated
•About four liters of fuel was found to have been used in Gemini craft’s 20-litre tank
•Split into five* tactical groups:
–One group took a taxi to Chhatrapati Shivaji Terminus
–Group 2 headed to Oberoi Hotel
–Group 3 headed to Cafe Leopold
–Group 4 headed to NarimanHouse
–Group 5 went to Taj Hotel were they met by local contacts who provided logistics and food
•Mandate was to kill indiscriminately, particularly white foreigntourists, and spare Muslims
* Conflicting reporting on number of tactical groups. Some say four.

Tactic 2: Attack and Flee
•Used at the hospital, CST railway station and café
•Took taxis to destination
–Left grenades inside cabs after exiting
–Left 2 IEDs in cabs which later functioned killing both drivers and 3 passengers
•Quickly attacked with AK-47s, grenades
•Attacked large groups
•Retreated from Blue forces and moved on to other targets

Tactic 3: Hostage Taking and Standoff
•Knowledge of facility layout
–Taj Mahal Hotel had armed security guards at main entrance
–Gained entry through back alleys at hotel rear and then entered main lobby
–Checked into hotel rooms prior to attack to learn layout and security
–Pre-positioned supplies and weapons in rented rooms
–Rounded up hostages and forced them to defensible locations
•Room-to-room battles with security forces

Tactic 4: Use of Improvised Explosive Devices (IEDs)
•Five IEDs were employed during the four day siege
–Two in taxis placed on way to rail station
–One near entrance of the Oberoi Luxury hotel (detonated after bomb squad placed bomb blanket over device)
–One near the Taj Mahal Hotel (rendered safe)
–One near the Gokul restaurant located just behind hotel (rendered safe)
•Each device reportedly contained 17 pounds of RDX, ball bearings, a digital timer, and 9-volt battery. Devices were anti-personnel
•Each device was contained in a small metal box inside a backpack to thwart Render
Safe Procedures (RSP)
•Shot indiscriminately and quickly executed hostages

Tactic 5: Diversion
•Stole police van that had responded to CST terminal attack
•Continued to drive to hospital and a theater as possible “drive-by”targets while police pursued
•Indiscriminate firing and grenade lobbing caused panic and confusion that may have been a diversion to allow teams to move into hotels and Jewish Center

Operatives
•Aged between 18 and 25
•Dressed in black t-shirts, jeans, knapsacks; some with hooded sweatshirts
•Spoke Hindi, Urdu, and Punjab
•All of the terrorists were assigned code names

Training
•Apprehended terrorist admitted that he was trained, along with several others, at two separate camps in Pakistan
•The first camp lasted for close to three months and involved training in the use of firearms and explosives
•The second camp focused on marine drills which were used by the attackers to land on the city's shores
•During his training, he was also shown CDs with footage of different spots in Mumbai including some of the locations targeted
•Instructions given to fire on sight with orders that the maximumpossible number of people should die at their hands

Communications
•Terrorists maintained communications with base in Pakistan via satellite phones
•Carried Blackberry cell phones which enabled them to browse the internet for news updates as the assault progressed
–At least 5 Blackberry devices were recovered
•Browsing history showed a lot of content from the English media, not just in London but the Urdu and Arabic sites that arevery strong in Northern England
•Live telephone conversations of the militants on their mobile phones were monitored at NarimanHouse during the operation
•Conversations were about changing positions and exit routes

Implications for LE and EMS
•Attack of Hospitals–it is possible the timing was designed to hit the hospitals at the same time the first wave of casualties was arriving from the scene
•Response Vehicles Stolen-Terrorists stole emergency response vehicles at the scene; possibly to facilitate escape and / or to continue the attack at another location
•Warning–early reporting says that at least some of the locations had warning of the attack and had taken protective measures
•Terror Group-LeT, has been tied to various cases in the US, UK, Australia and other Western countries. In general these attacks show a high level of understanding by the terrorists; they seem to understand that confusion creates terror and they understood how First Responders operate