EXP D Ste Rl OF VISED Warning The devices described in this manual are deadly explo- sives, and the procedures for their handling are extremely hazardous. Whenever dealing with explosive devices, spe- cial precautions must be followed in accordance with mili- tary and law enforcement standards. Failure to strictly follow such standards may result in harm to life or limb. This manu- al is in no way a substitute for certified and extensive train- ing in explosive ordnance disposal. Therefore, the author, publisher, and distributors of this manual disclaim any liability from any damage or injuries of any type that a reader or user of information contained with- in this manual may encounter from the use of said informa- tion. Use this manual at your own risk. For information pur- poses only. ▼ TERRORIST EXPLOSIVE BBBBBBBBBB COUNTERING TERRORIST USE OF IMPROVISED EXPLOSIVE DEVICES Stephen Turner Paladin Press » Boulder, Colorado UN HV GH3! rfss Terrorist Explosive Sourcebook: Countering Terrorist Use of Improvised Explosive Devices by Stephen Turner Copyright © 1994 by Stephen Turner ISBN 0-87364-772-6 Printed in the United States of America Published by Paladin Press, a division of Paladin Enterprises, Inc., P.O. Box 1307, Boulder, Colorado 80306, USA. (303) 443-7250 Direct inquiries and/or orders to the above address. All rights reserved. Except for use in a review, no portion of this book may be reproduced in any form without the express written permission of the publisher. Neither the author nor the publisher assumes any responsibility for the use or misuse of information contained in this book. (\tCr!5S.S psf ► ◄ Contents Introduction y 1 Chapter One The Technology ▼ 3 Chapter Two IED Construction Principles ▼ 1 1 Chapter Three Characteristics and Recognition Features of Explosive Materials y 41 Chapter Four Reaction Drills and Countermeasures y 51 Conclusion ▼ 89 Appendix A Letter/Package Bomb Precautions Flowchart ▼ 99 Appendix B IED Component Recognition Guide ▼ 101 Appendix C X-ray Detection and Analysis Quick Reference Chart y 107 Appendix D Threat Call Card ▼ 109 V Appendix E Hand Clearance Sequence Reference Chart ▼ 111 Appendix F Offensive Operations ▼ 115 Appendix G Sample Booby Trap Placement Record ▼ 119 Glossary ▼ 121 VI TERRORIST EXPLOSIVE SOURCEBOOK Introduction H ow are terrorist improvised explosive devices (IEDs) constructed? Why do they sometimes claim the lives of even well-trained and suspicious per- sonnel, and how can we avoid becoming a victim of them ourselves? These are among the questions most often asked by persons attending IED Awareness and Counterterrorist courses. In this manual, which was originally assembled for just such a course, you will find the answers. The purpose of this manual is to provide a source of easi- ly accessed reference material for both the professional and nonprofessional reader. Special Forces and contract military personnel, law enforcement officers, corporate security per- sonnel, and interested civilians alike will find the information here invaluable. The contents will impart to the reader a sound basic knowledge of the principles and techniques involved in the preparation of IEDs and booby traps, as well as appropriate counterbomb/counterterrorist measures. Several previously unpublished and original techniques are revealed here, not to further terrorist or criminal projects, but in the belief that a wider knowledge of such techniques will do much to improve existing counterterrorist measures. At the very least, any subsequent deployment of related sys- tems will lack the high surprise value which would other- wise be the case. This in itself will help save lives. Note that for obvious reasons no specific explosive manu- facturing details are included. 1 CHAPTER ONE The Technology WHAT IS AN IED? A n IED i s an e x p 1 o si ve assembly (a mine^bjomb or booby trap, for example) of a type other than those manufactured commercially for use By military per- sonnel. In other words, it is not one of the many standard explosive devices that may Be found in the armories of the world’s armed forces. This is not to say, of course, that an IED might not Be found in such an armory after its manufacture by military personnel for use in some specific project. Therefore, although reference to an IED is often interpreted as implying a device made by terrorists, this is not necessarily always the case. The entire IED (including the explosive material it con- tains) might be improvised, or the device might consist of an improvised actuating or firing assembly coupled to a commer- cial or military explosive charge. Improvisations for the actu- ating mechanisms themselves will vary in nature enormously from device to device. They might be as simple as stripped, looped-wire pieces formed so as to create a simple pull switch or they might be based on sophisticated electronic compo- nents such as transistors, integrated circuits, and multiple power sources connected so as to create a self-arming, delayed- action device with antihandling features. Between these levels of sophistication lie countless possibilities. The explosive charge proper, as already stated, might be of the commercial or military type, or it might be improvised from any number of commonly available chemicals and house- hold products. This brings us to our next important question. 3 WHAT IS AN EXPLOSIVE? An explosive is a material (either a single substance or a mix- ture of substances used or manufactured in order to create a practi- cal or useful effect by explosion), which, when suitably initiated (ignited) undergoes a rapid chemical decomposition with the evo- lution of enormous quantities of gas and heat* This produces a increase in volume and therefore pressure. Such materials ate are ^ own as chemical .explosives This term distinguishes explosives proper (i.e., chemical explosives) from other things that might explode due to a combination of other factors (for example, a car radiator or a pressure cooker). Both these objects might explode if the internal pressures (generated by the heat energy applied to the water) are not released by a thermostat or a safety valve. But this “explosion” is merely the effect of the sudden rupturing of the body of the item. Take the water out of the radiator and heat it to a simi- lar temperature unconfined and it will evaporate harmlessly. Explosions such as these may be termed physical explosions. It is important to remember, of course, that a physical explosion can be j ust as destructive as its chemical counterpart. A third type of explosion should perhaps be mentioned here, as it often causes confusion. This is a nuclear explosion as produced by a nuclear weapon. A nuclear explosion causes the sudden pro- duction of massive amounts of heat (and through this heat the expansion of the surrounding air with its attendant destructive effects) by the process of fission. 1 The radioactive elements, how- ever, are not themselves chemical explosives, although conven- tional chemical explosive material is used to trigger the reaction. WHAT IS AN EXPLOSION? An explosion is the sudden expansion of gases into a volume far greater than its initial one. It is this expanding, heated, high- pressure gas that works against its surroundings to create lifting, heaving or shattering effects, and the propulsion of fragments or Nuclear Fission: Splitting of the nuclei of certain heavy elements ( i.e., plutonium or uranium 235 ) into lighter nuclei by the impact of neutrons. Additional neutrons are released as a result of fission and can themselves induce further fissions, this effect being known as a chain reaction. TERRORIST EXPLOSIVE SOURCEBOOK debris. A given amount of explosive, then, can be looked upon as having many times that volume of stored energy available for (effectively) instantaneous release. Such commercial or military explosive material can be safely transported and handled. CATEGORIES OF EXPLOSIONS It used to be stated in most works on the subject that explo- sives could be divided into two convenient categories: ( 1 ) those that detonated, and (2) those that burned rapidly or deflagrated. These terms refer to the way in which the stored energy in an explosive is liberated when it is initiated. Nowadays, as the capa- bility of several explosives to function in either capacity is being exploited more frequently, qt i s per haps preferablejta divide the s, explosive process into these tjvo categ ories (detonatio n and defla- | gration), rather than the explosive material itself. Besides, many explosives will bum to detonation (on which, more later) when a sudden increase in the speed of the burn transforms it into a shock wave. At one time, explosives intended to function by detonation were invariably classified as high explosives while those designed to function by burning (deflagration) were termed low explosives. As the majority of materials falling into this latter category are propellants, they are now frequently referred to as propellant \ explosives or just propellants. Explosives vary in their sensitiveness (sensitivity) to initiation. Those which are readily initiated by a small stimulus are known as primary explosives ; those requiring a more severe stimulus are known as secondary explosives. Deflagration With the obvious exception of water-based slurries, most explosives will bum when ignited in an unconfined condition. As explosives do not rely on a supply of oxygen from the atmosphere to sustain their combustion, they can also burn when confined. Burning is essentially a series of chemical reactions (transforming solid material into a gas) occurring on or just above the surface of the material. When this occurs, the surface of the burning materi- al recedes at a rate determined by the velocity of heat transfer into THE TECHNOLOGY 4 5 the material. The primary condition affecting this velocity (the linear burning rate of a particular explosive) is the pressure at its surfaceTecause pressure will accelerate the flow of heat into the material. By confining a burning explosive, then, the gases pro- duced are unable to escape, and this increase of pressure at the burning surface thereby increases the linear burning rate still fur- ther. Such reactions can occur in literally millionths of a second and produce the explosive effect known as deflagration. Detonation Detonation of an explosive is achieved by means of a travel- ing shock wave rather than the transmission of heat. The veloci- ty of a shock wave in typical solid explosives is between 1800 and 9000 m s' 1 . This speed is one to three times faster than that of a deflagration. Detonation can be provoked in two ways: (1) shock to detonation, or (2) burning to detonation. Shock-to-Detonation This is the most usual way of initiating detonation in an explosive and requires the production of a sufficiently powerful shock wave. This is commonly supplied by a detonator. The deto- nator (known also as a blasting cap or simply cap ) usually takes the form of a metal cylinder 16mm to 55mm in length and 5mm to 7mm in diameter, although detonators as small as 10mm long and 5mm in diameter do exist. A typical detonator contains an ignition or flash charge, an intermediate or priming charge of com- pressed primary explosive, and a base charge of secondary explo- sive. However, this is not always the case. The ignition or flash charge in the detonator is initiated either electrically or via a length of safety fuse, depending on the type of detonator. In the case of electrical detonators, the firing current might cause a resistance bridge wire to heat instantly to incandescence, whereupon a heat/flash sensitive explosive (such as a lead azide compound) bums to detonation, detonating the base charge. Alternatively, the EBW (exploding bridge wire) technique might be used. In this technique, an instantaneous capacitive discharge (rather than a continuous DC current) causes the bridge wire itself to explode. This produces a shock wave of suffi- cient power to detonate a secondary high explosive (commonly PETN). This type of detonator negates the traditional dangers from Radhaz (radio frequency hazard) wherein the EED (electro- explosive device) is susceptible under certain circumstances to premature initiation through induced currents caused by emis- sions from nearby high-power radio transmitters, radar systems, or power-lines. Another type of detonator (known, because of the manner in which it functions, as a shipper detonator) is designed so that the energy generated by the exploding bridge wire propels a small piece of plastic at high speed into the secondary explosive, caus- ing it to detonate. Again, PETN or HNS (hexanitrostilbene) is typically used. Thus, when fired, the detonator produces an enor- mous localized shock or pressure wave which passes into the sur- rounding charge causing it to undergo compression and adiabatic heating *. Some of the chemical energy of the material is released, -accelerating the shock wave and increasing the pressure at the wave front. This releases still more energy from the explosive and the process continues until it reaches the speed of sound. When filmed with high-speed camera equipment, a burst of light indi- cates the commencement of detonation. Detonators of various powers and configurations are available: instantaneous or delay, electric or nonelectric, special, etc. The No. 6 and No. 8 commercial types are perhaps the most well known. The less sensitive the high explosive to be detonated, the more powerful the detonator required. Some commercial detona- tors are not powerful enough to initiate detonation in the more insensitive types of military or improvised secondary explosives. Because of this, special compound detonators are used, o r, a boaster cbargejc omprisi ng an explosive of an intermediate sensitiveness) is"placed between the detonator and the secondafycharge proper. An alternative uses the lower power detonators in pairs. Detonators may be improvised from, for example, used rifle cartridges or copper or aluminum tubing with one end soldered closed. They may be loaded with any number of improvised pri- mary and secondary explosive mixtures. Flying-model rocket engine igniters or pyrotechnic matches may be used to initiate ' Adiabatic: A temperature change in which no heat actually enters or leaves the system. 6 TERRORIST EXPLOSIVE SOURCEBOOK THE TECHNOLOGY 7 them electrically, as may modified flashlight or vehicle bulbs. (See Chapter Two for specific devices.) Commercial detonators can (using great care) be squashed slightly to reduce their characteristic cylindrical profile and so render them less easy to detect in mail bomb searches. The elec- tric types might also be disguised as various innocent electronic components and concealed inside electronic or electrical equip- ment. All-metal detonators will show up on an X-ray screen, but plastic and card-bodied detonators do exist and these will not show as well. Until ready for use, electric detonator leg wires are always shorted together to lessen the risk of premature firing due to induced electrical currents. Buming-to-Detonation Burning-to-detonation is an effect wherein the speed of bum of an explosive accelerates until it becomes transformed into a shock wave. The conditions required to bring about this transi- tion and the susceptibility of explosives to it vary considerably. Confinement and a high burning rate index or the presence of a critical amount of explosive material may cause the effect. For example, a single stick of dynamite might simply burn fiercely when ignited, whereas a pile of loose sticks of the same material might provide enough self-confinement to burn to detonation. In any event, the process accelerates the linear burning rate to the speed of sound, at which point a shock wave forms, causing ' the remainder of the explosive to detonate. EXPLOSIVE EFFECTS In the case of an explosive being detonated without confine- ment, much of the released energy is held in the shock wave pass- ing through the charge. The wave spreads into the surrounding atmosphere but slows quickly and is soon passed (within a few charge diameters) by the expanding gas wave. As it moves, the gas wave compresses the air in front of it and produces a powerful blast wave. This blast wave contains much of the intrinsic energy of the explosive. More force is produced here by the expanding v gases than the shock wave. If the same explosive is detonated against a dense object, the shock wave is transmitted more effectively and produces extreme compression for a very short period. Brittle materials will fail under this compression, and not-so-brittle material will fail in tension when the extreme compression is suddenly reversed by reflection. The shock wave forces which are produced cause dam- age to the strongest of materials, the resulting debris then being moved violently by the expanding gases following it. This divi- sion or partition of energy between shock and blast wave is pre- dictable for a given type of explosive detonated at a known velocity, and thus for commercial and military operations, specif- ic types of explosive are selected with a view to achieving a desired effect. EXPLOSIVE EFFECTIVENESS The overall effectiveness of a particular explosive depends upon the amount of energy it can produce and, more importantly, the speed at which that energy can be released. Various perfor- mance parameters are used to determine the effectiveness of the different explosives: • Detonation Pressure: the peak pressure in the shock front • Heat of Explosion: the heat released under adiabatic conditions • Temperature of Explosion: the maxi- mum temperature the gases produced by the explosion can reach if no heat is lost to the surroundings • Pressure of Explosion: the maximum static pressure achieved when a given weight of the explosive is burned in a closed container of fixed volume • Detonation Velocity: the speed at which the detonation wave moves through the explosive • Rate of Burning: the rate of consump- tion of a burning explosive in terms of mass per unit of time, or the rate of 8 TERRORIST EXPLOSIVE SOURCEBOOK THE TECHNOLOGY 9 regression of the burning surface in length per unit of time under a given pressure and temperature • Power Index: a comparative expression of \ the work capacity of the explosive against that of another standard explosive — ' In the United States military, the combined characteristics of a given high explosive are usually indicated by means of a relative effectiveness number. This parameter assumes the use of the explo- sive as a breaching charge and considers it in relation to the stan- dard: TNT (trinitrotoluene). TNT, being the benchmark, so to speak, has a relative effectiveness of 1. By way of comparison, C4 has a relative effectiveness of 1.34. At the other end of the scale, ammonium nitrate has a relative effectiveness of only 0.42. This is one reason why terrorist bombs based on this substance are so large. In the British army, for historical reasons the standard explo- sive is picric acid, which is assigned what is known as a power index value of 100. From this is calculated the relative power of other explosives, said relative power also being expressed in terms of a power index number. EGDN (nitroglycol) has a power index value of 170, PETN (Pentaerythritol Tetranitrate) a value of 161, and RDX (Cyclonite/Hexogen or trimethylen- etrinitramene) a value of 159. Having considered the basic principles of explosives, we will now move on to examine the various ways in which such materi- al might be configured into an IED by the terrorist. IED Construction Principles T his chapter covers the basic principles underlying electrical and nonelectrical IEDs. An understanding of these principles will enable the reader to visualize more clearly the specific device designs detailed in subse- quent chapters. EIJECTRICAL/ELECTRONIC IEDs In addition to the charge, all electrical/electronic IEDs comprise: (1) power source or sources (2) electrical detonator or initiator (improvised or commercial) (3) means for conducting current from the power source to the detonator/ initiator. This may be wire, printed circuit track, improvised circuit track created with the use of conductive sil- ver paint or metal foil, or a combina- tion of any of the above (4) trap switch or timer system (often both), activation of which causes cur- rent from the power source to flow to the detonator. Regardless of specific designs, this type of IED fires when current from the power source is caused or allowed to flow into the detonator. At this point the detonator explodes. The 11 10 TERRORIST EXPLOSIVE SOURCEBOOK ED Ilhi.s.1: Simple Series Circuit ED -Electric Detonator T-Trap Switch (firing contacts) PS-Power Source basic principles underlying all electrically fired IEDs are out- lined in the following pages. When the trap switch is caused to close, circuit continuity occurs and electrical current flows from the power source to the electric detonator, which fires. Firing Current As a specific, minimum amount of power is required to fire a given electric detonator, the power source must be able to supply at least this amount. The voltage and current (and therefore battery type) needed for a given device can be arrived at by using the basic laws of electricity. The rela- tionship between current, voltage, and resistance is known as Ohm’s Law and is expressed by the formula : Voltage (E) = Current (I) x Resistance (R) Current is expressed in amperes (amps), resistance in ohms, and the equation is usually written as E=IR. Thus it can be seen that via this equation, assuming knowledge of any two of the relevant values, the third (unknown) value can always be found. This formula is used to ensure that a particular power source is adequate for the job. An easy way to determine values is with the use of the diagram below. By covering up the symbol relating to the required value, the 12 TERRORIST EXPLOSIVE SOURCEBOOK appropriate equation through which it may be determined is revealed. If we cover E, we are left with IR. (According to the above formula, E does indeed equal I times R.) If we cover the R, we are left with E over I (E divided by I) and therefore resistance equals volt- age divided by current, and so on. Ulus. 2 : Ohm’s Law Typical commercial or military electrical detonators have an average resistance of between 1.5 and 2 ohms and a current require- ment of .5 to 1.5 amps. Typical EBW-type detonators require a capacitive discharge of around 700 amps, but only for a frac- tion of a microsecond. The resistance and current require- ments of specific IED detonators will, however, vary consider- ably depending on whether they are commercial, military, improvised, and so on. Assuming a simple series circuit, the resistance of the detonator must be added to any additional resistance introduced by interconnecting wires, switches, etc., when determining required power source values. In many devices in which size is not a constraint, any number of commercial batteries might be used. In small booby trap devices and especially in letter bombs and devices utilizing unusual conductive interconnections, the battery needs to be selected with more care. However, the availability nowadays of higher current alkaline cells and lithium coin-shaped cells means that this rarely presents a problem for the booby trapper. Many IEDs incorporate a separate (usually delayed) arm- ing system. The circuit principles underlying this type of device are identical to those in Illustration 1. The extra switch provides for an extra margin of safety when assem- bling and deploying the device. The Transistor as a Switch Many modern electronic IEDs incorporate a transistor, using it as a nonlatching electronic switch. Instead of the physical action required to operate a mechanical switch, the ri IED CONSTRUCTION PRINCIPLES 13 Ulus 3: Series Circuit with Delayed Arming Switch ED-Electric Detonator PS-Fower Source T-Trap Switch (firing contacts) DAS-Delayed Arming Switch transistor switching action is initiated by the appearance of a small current flow at its base. This small current flow switches a larger, battery-supplied current into a detonator or initiator. Basic transistors are composed of three separate layers of semiconducting material, each of which has a positive or negative characteristic. The order of these layers gives the transistor a type designation: PNP (indicating a positive-neg- ative-positive layering), or NPN (indicating a negative-posi- tive-negative layering). In an NPN-type transistor, for example, two layers of N- type material, known as the collector (C) and emitter (E), are separated by a thinner layer, the base (B), of P-type material. If the collector of such a transistor is connected to a positive battery terminal and the emitter to the negative, a current will try to flow. Electrons from the emitter pass through the thin base layer to the collector, but immediately upon this occurring, a small percentage of them become trapped in the base layer and build up a negative charge. This blocks the current. The switch is “off.” If, however, a small positive trig- gering current is now fed to the base of the transistor, the trapped electrons are neutralized and the main emitter-col- lector current starts again. The switch is “on.” ED Ulus 4 : Transistor and Electronic Travel Alarm EED ED-Electric Detonator TR-Translstor AOT-Alarm Output Terminals FS-Power Supply Ulus. 5a: PNP Transistor Ulus. 5b: NPN Transistor In an IED configuration, the smaller, triggering current might be supplied by the output from the sounder terminals of an electronic alarm clock. The positive alarm terminal would then be connected to the transistor base and the neg- ative alarm terminal to the emitter. A detonator would be connected in series between the transistor collector and the positive terminal of the firing supply (battery). The negative terminal of the firing supply would connect to the transistor emitter. When the alarm sounds, the small base current thus produced would allow the larger firing supply current to flow, and so the detonator would fire. In circuit diagrams and reference charts, the NPN or PNP status of a transistor can be determined by the direction in which the small arrow (indicating the emitter) points. IED CONSTRUCTION PRINCIPLES 14 TERRORIST EXPLOSIVE SOURCEBOOK 15 Other semiconductor devices may be used in place of the transistor to obtain a switching effect. The most likely are the thyristor (also known as a silicon controlled rectifier ox SCR), and a silicon-controlled switch (SCS). Both these devices have differently named connections/leads. Their operating principles are, however, similar to the transistor in that a change in current flow at one junction allows current to flow via another. OTHER LED SWITCHES Switches of a more conventional type are frequently used • in IEDs. Regardless of specific type, they have at least one common denominator in the form of connection possibilities. As the principles are similar, we can consider, by way of an example, the simple manual switch. It usually has two or three internal contacts and therefore two or three external /' connection terminals. One of these are the “common” and is j always used, hence its name. The remaining one or two ter- \ minals are normally open (NO) and/or normally closed (NC) types. It is the status of the internal contacts in relation to the common contact when the switch is inoperative (i.e., in its “normal” state) that determines the designation of the appro- priate terminal (and, in the case of two terminal switches, the switch itself). Thus, if a particular contact is open (not con- nected to the common) when at rest, it is referred to as the “normally open” contact. If it is in contact with the common, it is called a “normally closed” contact. When the switch is operated, the status of the contacts reverse, the NO contact closing, and the NC contact opening. These designations apply to magnetically-operated reed switches and also to relays. In one version of the former, a sprung contact arm (the common) is pulled away from the NC contact (and onto the NO contact) under the influence of the magnet. When the magnet is removed, the contact status | reverts to normal. In the case of the latter, a separate power supply is used to energize the relay contacts and achieve the | same effect, i.e., cause the common contact to leave the NC contact and touch the NO contact. When the power source is I 16 TERRORIST EXPLOSIVE SOURCEBOOK removed or runs down (known as the collapsing relay tech- nique), the relay contacts revert to their normal status. It can be seen from this that according to the selection of terminals (NO or NC) by which the firing power source and detonator/initiator are connected on a given switch, an IED can be constructed so as to activate in any number of differ- ent ways. Further, two or more relays can be connected in conjunction with independent power sources so as to render interruption of an operating circuit impossible without caus- ing them to operate (or cease to operate) and thereby allow firing current to pass to the detonator. NONELECTRICAiyNONELECTRONIC IEDs In addition to the explosive charge, nonelectrical/non- electronic IEDs incorporate: (1) a nonelectric detonator or initiator (2) a system for firing the detonator/ini- tiator (3) a trap switch or timer system (often both), activation of which causes the firing system to function The nonelectric detonator may be fired by flame and heat produced by either an attached length of commercial or impro- vised safety (time) fuse, an attached percussion cap (or some similar, striker-operated component), or a chemical reaction. A spring-loaded striker, which, when released, hits the'' percussion cap and causes it to fire, is easily improvised or obtained commercially in a variety of forms. Acids or reac- tive chemicals may be contained in a glass or metal housing which incorporates some barrier. The chemical eventually corrodes or soaks through this barrier and enters the detona- tor cavity, creating the required heat and/or flame. Acids and heat/flame-producing chemical mixes might instead be con- tained in glass, soft metal, or other types of housing, and iso- lated with a barrier of some kind in such a manner that when the housing is crushed or broken (by the target performing IED CONSTRUCTION PRINCIPLES 17 some apparently harmless action), the materials are caused to mix and react. Often the housing itself provides the barrier for an acid, the assembly simply being placed on (or in) an acid-reactive mixture. Nonelectric IEDs of the booby trap or antipersonnel type may be improvised entirely from nonmetallic components, making them extremely difficult to detect. Combination elec- trical and nonelectrical IEDs have also been deployed. DEA personnel engaged in drug lab raids have encoun- tered ultracrude (but very effective) explosive traps formed by placing containers of ether (an extremely volatile materi- al) close to hot plates or gas torches in such a manner that when a door or window is opened, the contents spill and ignite to cause an explosion. Other potential nonexplosive traps include: • fish hooks dangling at eye level • punji stick devices (sharpened, often poisoned or excrement-covered wooden sticks concealed in camou- flaged pits or assembled into falling, swinging, or spring-loaded systems) • vicious dogs • poisonous snakes ACTIVATION/TRIGGER MECHANISMS Included here are the mechanical, electromechanical, electric, or electronic mechanisms and systems that cause the IED to operate when some particular, predetermined condi- tions are met. In the U.S. and elsewhere these mechanisms are usually referred to as fuzes. This term is used to distin- guish such mechanisms from fuses, which are simply a means of communicating fire. In Britain and some other countries the distinction is not always made, and the term “fuze” is taken to mean either an actuating mechanism or a length of fuse proper, depending on context. It is in the area of activation that the ingenuity of the bomber or booby trapper comes into its own. Specific design 18 TERRORIST EXPLOSIVE SOURCEBOOK parameters are really only limited by the creativity of the designer. There are, however, three very broad categories of activation that we can use to define devices. These are action by the target, time-delay, and command-fired. The latter is any device that is fired remotely by the bomber at a specific moment. Action implies movement, either of the device itself (directly or indirectly) or of the target in close proximity to the device. Such devices may be designed so as to react to: • movement • vibration • a change in environmental conditions • physical properties of a nearby object • noise • pressure • release of pressure • etc. Time-delay involves the use of a mechanical, electrome- chanical, electronic, or chemical delay system (or a combina- tion of any or all of these). Time-delay might be used to (1) cause the device to explode immediately upon the expira- tion of the delay period, or (2) to arm the device upon expi- ration of the delay period, whereupon an action-dependent trigger system takes over. Both uses may be combined in one device. There a re f ew thingS-that-ca nn ot b& bo o by -trap- ped. Thus an initial suspicion of all ite ms. objeds~and..areas “^oDEi^mS S^afels thF requ i red mindset. Following are examples of specific mechanisms: Acid Delay: an improvised system in which a small quan- tity of acid gradually eats through a barrier of some type until it contacts a chemical mixture, causing a spurt of flame. This flame may be used to fire a detonator, light a length of time fuse, ignite incendiary material, or initiate certain types of explosive directly. Acid delays are commonly assembled into a stand-alone metal or glass cylinder. Anti-Prodder Trap: An improvised electrical device used as a trap for searchers looking for mines with a basic IED CONSTRUCTION PRINCIPLES metal prodder or bayonet. It consists of a waterproofed assembly containing two layers of foil or mesh which form the firing contacts, insulated with a thin sheet of foam or plastic. This assembly is buried just below the surface so that when a searcher inserts a prodder to locate a buried mine, the firing contacts short out, the circuit completes, and the device is caused to fire. Anti-Tripwire Feeler Trap: A system based around two extremely fine conductive wires which are connected together at intervals with an insulating material. Each of the wires is connected into an electrical firing circuit. When the two wires are shorted by a metallic tripwire feeler, circuit continuity occurs and the attached explosive device fires. Battery Run-Down/Relay Device (Collapsing Relay Device): An improvised time delay device in which two power sources are usually employed. One source provides the firing power and the other is used to hold open a relay. When the relay battery runs down (which can be a matter of hours, days, or even weeks or months, depending on the size of the battery and current drain of the relay), the relay closes and allows current from the firing battery to pass through it to the detonator. This device can also be used to delay the arming of a system. Barometric Switch: A commercial or improvised device which responds to air pressure changes. It may be impro- vised from an aircraft altimeter or coffee jar (which also con- tains the charge and firing supply), a piece of flexible rubber, and metal firing contacts. One contact is fixed a short dis- tance above the mouth of the jar, the other is fixed to the rubber piece, which is stretched and secured across the jar mouth so as to form an airtight seal. Being free to move under the influence of the rubber, this lower contact will (when the surrounding air pressure drops below a predeter- mined amount) eventually rise a sufficient amount to touch the fixed contact above it, thereby completing the electrical circuit. Commercial and improvised versions have been used in aircraft luggage hold bombs. Small electronic commercial types exist which may easily be concealed in electrical and electronic equipment. 20 TERRORIST EXPLOSIVE SOURCEBOOK Bathroom Scales Mine: Here mechanical scales are used. Firing contacts are affixed through the dial face and to the rotating scale itself. This device is installed in a box of some kind and buried just below the surface of the ground with a simple pressure plate laid over it. Then, when an indi- vidual of the selected weight (or heavier) walks on the pres- sure plate, the scale rotates and the contacts touch. This completes the circuit and the device explodes. It is easily set to fire under the weight of soldier carrying equipment (for example) but not if walked on by a nontarget individual such as a child. Biscuit (Cookie in U.S.) Bomb: A misnomer bestowed upon the device by the British press — this isn’t a bomb at all but an improvised grenade launcher. It is the device that has received much publicity recently when discovered in an IRA arms cache. The design details were restricted, and pictures of the device were never shown. It is actually a clever varia- tion of an old type of improvised recoilless “rifle” in which a central charge propels a warhead built into a large jam or margarine tin of the type used for military rations. The device is electrically fired from an onboard battery housed in a pis- tol-grip assembly, the trigger taking the form of a large long- actuator-arm-type of microswitch. Back pressure is absorbed by two packets of biscuits (cookies) wrapped in paper tow- els. The device incorporates a lamp holder arming switch and front and rear sights. Book Booby Trap: The book booby trap may take vari- ous forms. In the most common, the book is hollowed to conceal an explosive charge, firing circuit, and delay-to-arm system. Foil firing contacts are attached to opposing pages in such a manner that they touch with the book closed. Before deployment/dispatch, insulating material (typically in the form of a piece of paper currency) is placed between the foil contacts in the manner of a bookmark. When the finder or recipient removes the insulating piece, the contacts touch and the device fires. An alternate version uses a relay and additional power source. There is no insulator/lure. Here the foil contacts must touch to prevent the device from explod- ing. When they are separated, the relay closes and the circuit IED CONSTRUCTION PRINCIPLES 21 is completed. Books may also be booby-trapped with a sim- ple loop pull switch or any number of other commercial or improvised mechanisms. Burned Out Fuse Trap: An electrically operated IED based around a mercury switch (or improvised movement switch) deployed in a pipe or other container with a protrud- ing length of burned safety fuse. This gives the impression that the device has failed to detonate because the fuse went out. The unwary finder, believing it to be safe, moves the device and causes the real activation system to function. Cafetiere A/P Mine: The cafetiere (available in a variety of sizes) is disassembled as for cleaning and an explosive charge and firing components installed. Firing contacts take the form of two adhesive alarm foil strips applied horizontal- ly to the inside of the glass just above the level of the charge material. The lid and moveable insert assembly is then replaced and the lid itself secured with adhesive. Subsequent depression of the insert knob beyond a given point causes the metal filter/head assembly to short out the foil contacts and complete the circuit. The completed assembly might be housed in an improvised frame and buried or placed so as to operate in various other ways. Candle Delays: The humble candle can be used in a number of IED configurations. It can be installed upright in a pile of inflammable material which ignite when the candle burns down, or a tension-release device (electrical or mechanical) can be attached to a rigidly-mounted candle via a flammable cord which will burn through (thereby releasing the tension) at a predetermined point. A safety fuse, one end of which is crimped into a nonelectric detonator, can also be wrapped around the candle. In this case, the safety fuse would be split and matches inserted to catch the flame as the candle burns down. The reduction in weight as the candle burns down can also be used to cause a counterbalanced (by the candle) mechanism to fall and complete an electrical cir- cuit. The candle itself might also be hollowed internally and partially filled with a flame-sensitive explosive. There are dozens of other variations. Capacitor Substitute Device: An improvised device in 22 TERRORIST EXPLOSIVE SOURCEBOOK which the normal battery power supply is replaced with one or more capacitors. For most purposes the capacitor can be looked upon as a battery capable of instantly releasing its stored energy. Capacitors are easily installed in, for example, a tape-player bomb in such a manner that they are charged by the usual batteries. Because of this it is important to note that counterbomb measures involving the removal of batter- ies from tape players, etc., while offering some extra protec- 1 tion, will achieve nothing if a concealed power source exists. Further, a functional check (in which an item is tested for correct operation) does nothing to deter the professional bomb designer. Only complete disassembly of an item will $ provide total security. Capacitor/Low Current Device: An improvised system used when the power source batteries to be used must be Z extremely small (i.e., watch batteries) and/or when they are unlikely to have sufficient available current to fire the deto- nator directly. The technique involves connecting several such batteries in series and then connecting the stack to an electrolytic capacitor. The capacitor itself is connected to one side of the detonator circuit via any trigger switch. The bat- teries charge the capacitor, which, when the switch is activat- ed, releases all the stored energy instantly, thereby firing the detonator. Electrolytic capacitors can be squashed slightly to reduce/alter their profile. Capacitors can also be improvised from any number of common items, in which case they will not necessarily resemble the traditional commercial types. Cassette Incendiary Device: So-called because the device is traditionally deployed inside a plastic audiocassette case. Typically, the timer section will be based on a simple watch delay or Memopark system. Upon completion of the electrical circuit, current flows from a battery into a cutaway bulb containing black or smokeless powder, or into an elec- tronic gas stove lighter head. In either case, the resulting heat and flame ignites incendiary material such as pieces of fire- lighter. This type of device is always deployed among cloth- ing, bedding, or other flammable materials. Claymores: Any device loosely based on the original Claymore weapon. It is an antipersonnel device in which IED CONSTRUCTION PRINCIPLES 23 shrapnel material is embedded into (or placed upon) a con- cave-shaped explosive charge with a view to directing the blast in a specific direction. During the war in the Balkans, Bosnian irregular forces manufactured extremely large, crude (but devastatingly effective) improvised Claymores known, because of their shape, as “televisions.” The vast majority of claymore-type systems are command-detonated, but many tripwire variants have been deployed. Clothespin Switch: The clothespin may be used in con- junction with an electrical circuit as a pull switch, pressure switch, pressure release switch, time delay device, etc. The various actions are determined by varying the location of attached contacts and insulators. For example, with contacts on each jaw (and the jaws isolated with an insulator attached to a pull wire), a system suitable for trapping a door, box lid, buried mine (or for use with a tripwire) is created. If pin con- tacts are pressed through each jaw and a soft insulator insert- ed, a pressure-activated device is made. With the jaws instead held apart by a few turns of solder wrapped around the rear of the clothespin, a time-delay system of the materi- al-fatigue type is obtained. With contacts on both jaws and opening arms, and with the switch mounted via the spring center, a combination pull and tension-release device is made. With the versatile clothespin, the booby trapper can replicate every activation mode available from commercial military trap switches. Coffee Jar Grenade: An improvised antipersonnel grenade in which a glass jar is used to house an explosive charge, shrapnel material, and electrical firing circuit. A microswitch is installed in such a manner that its operating lever is held in the closed or “off’ position by the inner wall of the jar. When thrown, the glass jar shatters and releases the operating lever, allowing firing current to flow from a battery to the electrical detonator. Cornering Vehicle Device: A variation on the metal ball switch, used in vehicle bombs. The metal ball is contained in a flexible plastic tube. At either end of the tube are two firing contacts which connect to the bomb circuit. The ends of the tube are bent upward slightly to prevent the ball rolling 24 TERRORIST EXPLOSIVE SOURCEBOOK against them under normal conditions. The assembly is con- cealed beneath the target vehicle. When the vehicle turns a corner at any significant speed the ball is forced to the oppo- site end of the tube and the circuit is completed. Corrosive Chemical Delay Actions: These are any sys- tems based on the gradual decomposition or corrosion of some material by a chemical. This corrosive action may result ultimately in a hypergolic 1 reaction or may be used to release a mechanical striker or complete an electrical circuit. Common corrosive chemical systems include: • cardboard and glycerine • table tennis ball and acid • acid and asbestos wadding • waxed drink (milk) carton and acid • copper cylinder, rubber/waxed disk, and acid • glass tube, rubber/waxed card disk and acid • rubber band and gasoline (rubber band contracts when gasoline evapo- rates) • gelatin capsules (into which some reactive substance has been placed) and most liquids Door and Wedge Trap: In this trap (often used in a room that security force personnel can be expected to search), an electrically fired IED is concealed beneath the floor. The fir- ing contacts are likewise hidden beneath the floor and com- prise one fixed and one falling type. The falling contact is attached to a short length of wood that passes up through a small hole in the floor in front of the door. The top of this wood piece is secured with a small amount of adhesive to the underside of the door wedge. When the door is subse- quently opened beyond a given point it strikes the wedge, breaking it free and allowing the hidden contact to fall and complete the circuit. One aspect of this technique is that 1 Hypergolic: igniting upon contact of components without external aid (as a spark). IED CONSTRUCTION PRINCIPLES 25 even if suspicious personnel are able to examine the room before entering (via a window, for example), they are unlikely to give the wedge a second thought. Door and Reed Switch Trap: Here a magnet is con- cealed in (or simply attached to the bottom of) the door in such a manner that when opened (or closed) beyond a selected point it operates a reed switch-based IED hidden beneath the floor. Dried Seed or Bean Time Delay: Here a jar or some similar nonconducting container is equipped with a metal insert of such a diameter that it is free to move up and down within the jar. The jar lid is fitted with two firing contacts, one of which goes to the battery, the other to one of the det- onator wires. Dried seeds are poured into the bottom of the jar, water added, and the lid replaced. As the seeds expand, the insert rises until eventually it touches the firing contacts, thereby completing the circuit. Dripping Water Delays: These are improvised delay sys- tems in which water dripping slowly from an upper container (for example) gradually fills another container incorporating a pair of firing contacts. In one version, one contact takes the form of a metal plate or dish which floats on the slowly rising water. Eventually this plate reaches another contact that has been fixed through the wall of the container and the circuit is completed. This technique can be inverted and designed so that the lower contact (most of which is insulated) passes through a loop formed in the upper contact, which is fixed. The lower contact is mounted on a wooden or plastic insula- tor and floats in a container of water. If a small hole is made in the lower container, the floating block (and with it the lower contact) will gradually fall. Eventually the uninsulated end of the lower contact will touch the looped end of the upper contact and complete the circuit. Yet another variation uses the water itself to conduct cur- rent between two firing contacts when the water level reach- es a certain point. In a practical assembly, salt would have to be added to the lower container in order to create a saline solution (necessary to facilitate the passage of a DC current adequate to fire a detonator). This principle can be applied 26 TERRORIST EXPLOSIVE SOURCEBOOK to IEDs concealed in drains, sink waste pipes, water barrels and toilet cisterns as well as purpose-made containers. Electrochemical Cell (E Cell) Devices: These are com- mercial items. An E cell comprises two electrodes and elec- trolyte. One electrode is usually silver, the other gold. With a small constant current passing through the cell, silver is grad- ually plated onto, or removed from the gold electrode (according to the way the cell is connected). At a constant current flow, a specific, predictable amount of time is required for the transfer of silver to take place. In an IED, the cell will be used in conjunction with a fixed or variable resis- tor. The value of this resistor will determine the delay time. | Delays of a year are practicable. The voltage across the cell | will be very low until the transfer of silver is complete. When . this happens the voltage increases sharply. This sudden increase in voltage can be used to switch a transistor and | thereby complete the firing circuit. Such cells may be sal- ) vaged from high-quality vehicles in which they are used to trigger service-interval warning lights. Electronic Travel Alarm Device: This device is the modern version of the mechanical clock timer and is based on the small, watch battery-powered type of alarm. A transis- tor is connected to the alarm sounder outputs in such a man- ner that it will switch current from an external battery to a detonator when the sounder operates, the current available at the terminals being insufficient (despite what the movie makers might think) to fire a detonator directly. Delays of up to 24 hours are possible with this device, and the transistor f may be concealed inside the clock body. ! Explosive Powders and Dusts: Aside from the obvious commercial and military explosives proper that may take the form of a powder, there are many other substances which (depending on particle size, degree of confinement, and sat- I uration levels) can be initiated to create an explosive effect. J This principle can be exploited to destroy buildings using an f amount of explosive that by itself would be inadequate. I Carbonaceous materials are commonly used. The usual tech- nique is to provoke two separate but sequential explosions } by surrounding a base charge of an explosive that has a high I IED CONSTRUCTION PRINCIPLES 27 incendiary effect with the carbonaceous powder. When det- onated, the powder is both scattered (saturating the sur- rounding atmosphere) and then ignited. Wheat flour is an alternative, as are most metal dusts. With this principle in mind, crude experiments with improvised, grenade-type devices containing dried skimmed milk powder and smoke- less powder rifle propellant were made by certain foreign mercenary troops in Bosnia. It is unknown how effective (if at all) these devices would have been if deployed in anger. Explosive Round: In this simple trap, a standard rifle round is modified to hold a nonelectric detonator and small quantity of explosive. The bullet is replaced and the round(s) left where they are likely to be found and used by enemy personnel or tested for forensic compari- son purposes. When the round is fired, the primer flash fires the detonator. Falling Weight Devices: (1) This is an IED utilizing a vehicle or bicycle dynamo (generator) as the firing power source. The dynamo is secured to a ceiling, for example, and a weighted cord wrapped around the drive pulley. The weight is support- ed by a pole or some similar arrangement that is itself attached to, for example, a door. When the door is opened, the pole is dislodged and the weight falls. The cord rotates the drive pulley and the resulting electrical current fires the detonator. (2) Here an IED is concealed inside any item that is inverted during the course of its normal use, i.e., a salt or pepper shaker. One firing contact takes the form of a metal insert installed beneath the shaker mouth, and the other is attached to a small conductive weight. When the shaker is inverted, the weight falls against the insert and completes the circuit. With some of the original contents replaced (i.e., covering the conductive weight) the shak- er may be used for some time before continuity occurs. (3) This is an improvised igniter device that can be used to fire a variety of IEDs. A typical form comprises a tube, the lower half of which contains a collar of match- box striker material into which a heavy bolt has been 28 TERRORIST EXPLOSIVE SOURCEBOOK installed in such a manner that it is free to move up and down. Match heads are affixed to the lower section of the bolt with adhesive so that they will rub against the striker material. The bolt is suspended within the tube by means of a safety pin passing through it and a pullwire is | attached to the safety pin. When released, the bolt falls 1 and the match heads ignite. I Fan Action Trap: In this IED (which is typically deployed in known or likely helicopter landing zones), a fan assembly is connected to a small electrical generator I so that when rotated, an electrical current is produced. ( This system is emplaced in such a manner that the down- | draft from a landing helicopter causes the fan to rotate. I Because the actual charge need not be in exactly the same location as the fan/generator assembly, an upward I firing shaped charge could be used in the center of the ! LZ (Landing Zone) to destroy the helicopter itself. Or the | charge(s) might be placed in the surrounding area with a ' view to killing troops awaiting extraction, for example. Flashlight Booby Trap: Another simple device in ; which an electrical detonator is installed in place of the bulb. A colored filter is attached to the glass to conceal the modification. When the flashlight is operated as usual the device fires. A variation sees the explosive modifica- tions concealed inside the flashlight body. Fusible Wire Device: This type of IED uses a com- | mercial or improvised assembly based on a short piece of | fuse wire. The wire is used to hold down a sprung con- ’ tact, which, when released, completes an electrical cir- | cuit. The device is triggered by any switch system that I causes an excessive current to flow through the wire. It may be used as the primary trigger in a device or as an arming switch. Grenade/Light Bulb Bobby Trap: In this assembly the 1 grenade fuse and firing system is removed and an electrical detonator installed. The detonator is wired to a household light bulb base which itself is attached to the grenade neck. The assembly is installed in a light socket and explodes when the light switch is turned on. t. IED CONSTRUCTION PRINCIPLES 29 Grenade and Can Booby Trap: Here a grenade is placed part way into a can in such a manner that the can walls are holding the safety lever (spoon) in place. The grenade is attached to a pullwire and the pin removed. When the wire is tripped, the grenade is pulled free, thereby releasing the safe- ty lever. This device is often deployed in pairs across a track with one grenade on each side of the track connected with a tripwire. Grenade Delay Train Removal Trap: In this technique the delay train is removed from the grenade detonator so that it explodes immediately when the safety lever is released. Grenade/Plastic Tape Delay: Here the grenade lever is taped with insulating or packaging tape and the pin removed. The grenade is then dropped into a fuel storage tank (for example). The fuel gradually dissolves the tape adhesive, allowing it to unwrap and release the safety lever. Hacksaw Blade and Paraffin Wax Delay: This impro- vised switch exploits the springiness of the hacksaw blade and the temporary insulating/isolating properties of a materi- al (such as a lump of paraffin wax) to provide a delay. The blade forms one firing contact; the second may be a nail or anything similar. The blade is attached to an insulating base in such a manner that its tendency is to spring back against the second contact. It is prevented from doing so by the wax lump. In a warm environment the wax will gradually soften and allow the blade to contact the nail, thereby completing the circuit. An ice cube can be used instead of the wax. Holdall Bomb: An electrical IED built into the soft type of luggage such as a duffle bag. A length of very flexible tubing installed inside the holdall contains a metal ball bearing which is trapped at the upper end of the tube by a safety pin. Two firing contacts are attached to lower end of the tube. With the bag deployed on the ground, the upper part of the tube bends under the weight preventing the ball from moving. The safety pin is removed. When next the bag is lifted, the tube extends, the ball falls, and the firing circuit is completed. Improvised Fuses: These are used to communicate fire to a primary explosive or incendiary charge or detonator. Many versions exist, and a lighted cigarette has been used in 30 TERRORIST EXPLOSIVE SOURCEBOOK A this role on many occasions. Fuses can also be improvised by either soaking a suitable length of flammable cord, string, shoelace, etc., in some type of combustible or oxygenating substance (a solution of potassium nitrate and sugar, for example), or by using adhesive to stick substances such as black or smokeless powder to the outside of the material. An alternative is to contain the substance within an improvised fuse body. The burn rate of the fuse improvised in this man- ner will depend greatly upon the filler substance employed and the degree to which it is compressed. An example is the improvisation known in some places as the “JR Fuse,” which is made from a length of parachute cord. The central strength- ening lines are removed and one end of the remaining outer sleeve is knotted tightly. The sleeve is then filled with smoke- less powder. Twirling the sleeve periodically during the fill- ing process forces the powder to compress, ensuring a steady and extremely predictable burning rate. When almost full, the free end is knotted. Kitchen Scales Booby Trap: This is a variation on the bathroom scales device and has been used to booby trap “lure” items or items that must be moved by the target. The circuit construction is similar to the bathroom scales device except that the contacts will usually be attached to the scale face and a moving scale arm. The face contact will be installed after the scales have been compressed by the lure item (i.e., with the arm contact already past the face contact). Any subsequent attempt to move the lure will allow the arm to rotate back onto the face contact and complete the circuit. Knife Switch: An improvised device based on a metal knife (or some similar, flexible length of metal), secured edgewise to a wooden base. At either side of the blade are contacts. One wire from the firing circuit connects to the blade, the other to one or both of the contacts. The device may be designed so that tension on a pullwire causes the blade to be pulled against the contacts, or so that a release of tension causes the blade to spring back against one of the contacts, or both. Lamp Post Booby Trap: This is an IED installed in road- side lamp posts of the type that turn on automatically at I l i i i j M H i IED CONSTRUCTION PRINCIPLES 31 dusk. The technique would be particularly applicable to areas which are heavily patrolled by security force person- nel. The detonator wires are simply tapped into the bulb supply line using snap connectors. The device explodes when the lamp turns on. Light-Sensitive Booby Trap: Any device based on a sensor which reacts to an increase or decrease in light level. Sensors used in such devices include a light dependent resis- tor (LDR), a photo-transistor, or a photo-diode. Typical deployment locations include behind provocative wall posters, or in a culvert, tunnel, or drains. Infrared sensitive devices have been deployed. An improvised light-sensitive device can be made by cutting the top case section from a power transistor. Loop Switch: A simple but dangerous switch made by stripping and forming the ends of two insulated firing wires into loops. The wires are passed through each other so that each loop rests on the insulated section of the opposite wire. The wires are then connected into a firing circuit. Any subse- quent tension on or movement of either wire will cause the loops to touch and complete the circuit. The basic switch can be made safer by securing one or both of the wires with an elastic band. This requires a specific amount of tension to be applied in order to overcome the tension of the elastic band. Variations using stiffer wires, one of which is coiled into a spring shape, can be used. Here a small section of the sec- ond wire is stripped and positioned in the center of the coil. Subsequent compression of the coil will cause it to touch the inner wire and complete the circuit. Matchbox Switch: A simple pressure switch made by wrapping wire (or affixing foil) firing contacts around the lower portion of the inner section and the upper portion of the outer section of a matchbox, which is then deployed par- tially open. The switch may be deployed horizontally, for example, behind an open drawer (between the drawer prop- er and the inside rear of the drawer housing), or vertically in an expedient frame support. In either case, pressure on the inner section forces it back into the outer section and the fir- ing contacts touch. In a basic pressure-activated variation, J2 TERRORIST EXPLOSIVE SOURCEBOOK foil is applied to the inside base of the inner box section and to the underside of the top of the outer portion. Material Fatigue Time Delay System: Any convenient material (for example, solder, elastic band, or heat-shrink tubing) which will break, weaken, stretch, or deteriorate over a given period of time, and which may therefore be used to delay the closing or opening of an electrical circuit or the actuation of a mechanical system. A typical device uses * solder to hold apart the jaws of a clothespin switch. The sol- I der stretches over a period of time, eventually allowing the jaw contacts to close and complete a circuit. j Mechanical Alarm Clock Device: The traditional clock- ; work alarm may be used in an IED in several ways: (1) In the < first, a contact is fixed through the face of the clock in such a J manner that either the hour or the minute hand will touch it ’ at some predetermined time. For delays of up to one hour, ; the bomber will remove the hour hand; for delays of up to 12 j hours the minute hand will be removed. Another contact will ] be made to the clock winder or body. When the selected hand touches the face contact, the electrical circuit is com- pleted and the device explodes. This may also be used as a delayed arming system. (2) In the second technique, one of the ringer bells is covered with insulating tape. One firing contact is affixed to the tape. The other firing contact attaches to the striker. When the selected time is reached, the alarm activates as normal and the striker touches the bell contact, thereby completing the electrical circuit. (3) The rotating action of the alarm winder (as the alarm rings) may also be used to wind on a length of twine which is attached to a pull switch, or depress a microswitch. As with the mechanical watch system, both clock hands may be used to create a com- bination time delay/firing device. (4) The internal springs (which expand as they run down) might also be connected so as to form firing contacts or depress a small switch. Mechanical Watch Delay Device: A classic improvised delay system in which a mechanical watch is modified by removing either the hour hand (for delays of up to one hour) or the minute hand (for delays of up to 12 hours). One con- tact is fixed through the watch face and a second contact is IED CONSTRUCTION PRINCIPLES 33 J attached to the watch winder. These contacts lead to the fir- ing circuit. When the selected hand reaches the face contact, an electrical circuit is completed and the IED explodes. This device is also used as a delayed arming system. Both hands can be utilized to create a combination delayed arming and firing system. The sweep hand is always removed except in the case of trip or pullwire type devices in which a very short delay is required. Here the sweep hand would be used as one firing contact and its rotation temporarily stopped by inserting a substantial insulating piece into a hole drilled through the watch glass. When this stop piece is pulled free the hand continues its rotation, touching the face contact a matter of seconds later. In the case of watches having a hack- ing feature, the sweep hand rotation might instead be stopped by pulling the winder out as in time adjustment, assembling into the IED circuit, and deploying in such a manner that some action on the part of the target causes the winder to be depressed again, thereby restarting the sweep. “Memopark” Clockwork Device: The Memopark is a small, commercial timer used for alerting the carrier to the fact that his/her parking meter needs feeding, etc. The device is clockwork and is wound much like a kitchen timer. When the set time elapses, the front of the unit rotates and produces a buzzing sound. This rotating action can be used to trip a switch or make or break many other types of electrical con- tacts. In larger IEDs a kitchen timer proper may be used. Mercury (Tilt) Switch: A commercial or improvised device used in car bombs, booby traps of various types, and as an antihandling device in conjunction with other triggers or switches. The switch is connected in series with the firing circuit. No current passes until the switch body is moved beyond a certain position, whereupon a blob of mercury shorts out two internal contacts and completes the circuit. This type of switch can also be deployed in a fixed horizon- tal position in a vehicle so as to create an acceleration or deceleration triggered device. Here, sudden acceleration or deceleration (depending on which way the switch is posi- tioned) will cause the internal mercury blob to be thrown to the opposite end of its housing and short out the contacts. 34 TERRORIST EXPLOSIVE SOURCEBOOK Metal Ball Switch: An improvised mechanism found in two main forms. (1) In the first (which is often referred to as ! an always switch ), a metal ball rests in a shallow cavity cut ! from a wooden base. The cavity is caged by two inverted, metal “U” pieces which connect to the firing circuit. If the I base is moved beyond a certain point, the ball rolls out of : the cavity and onto the “U” piece uprights, shorting them out and completing the circuit. (2) In its second form, the metal ball is housed in a plastic or glass tube. At one end of the tube is a cork into which wires from the firing circuit have been pressed. When the tube is rotated, the ball rolls onto the wires. This type of device is frequently used to booby- trap door handles. A variation on this is to use a conductive I tube with an insulator (cork, for example) in the open end. One firing circuit wire connects directly to the tube, the other to a contact passing through the insulator. Metal Dish and Ball Device: Here two flat-bottomed shal- : low metal dishes are attached to each other via a narrow insu- lating ring of card, plastic, or rubber. Prior to securing, a small rubber ring is affixed to the center of one of the dishes and a metal ball of suitable diameter placed on it. Each dish con- nects to the firing circuit. When the assembly is moved with- out extreme care the ball rolls off the rubber ring and shorts out the two dishes, thereby completing the electrical circuit. Microswitches: These are commercial switches available in various forms. The subminiature type is about the size of a thumbnail. The actuating lever may be removed to reduce the profile of the switch. They may be connected in the Normally Open (NO) or Normally Closed (NC) configuration. Mousetrap Switch: These may be used as either pressure- activated, pressure-release, pull/tripwire, or time-delay switches. In an electrical configuration, one wire connects to the spring-loaded striker bar, the other to a contact on the wooden base. Circuit continuity occurs when the striker touches the base contact. In a purely mechanical configura- tion, an improvised firing pin may be attached to the striker bar in such a manner that when released it strikes a base- mounted percussion cap. A shotgun blank or rimfire cartridge is often used as an initiator in this type of device. A “Magicube” IED CONSTRUCTION PRINCIPLES 35 nonelectric flashcube bulb may be used instead. Here the bulb is mounted so that the released striker hits the single leg of the bulb, causing it to fire. The heat generated by the bulb is sufficient to ignite a flammable material such as smokeless powder or flash powder, and can therefore be used to initiate a nonelectric detonator (by forming a small tubular collar around the bulb with card and filling it and the detonator cavi- ty with such material). Mousetraps have frequently been used in combination electromechanical systems. Pendulum Switch: An improvised or commercial switch in which one of the firing circuit wires is connected to a hanging pendulum which itself is mounted inside a second, circular firing contact. Movement causes the pen- dulum to swing against the second contact and complete the circuit. Traffic cones may readily be booby trapped using this type of system. Piezoelectric Device: This is a device based upon a piezo- electric transducer of the type used as a sounder in many tele- phones. When used in “reverse,” so to speak, by applying direct or indirect pressure, or even by releasing an existing applied pressure, these transducers generate a tiny electrical current. This current is sufficient to switch a transistor or thyris- tor. If suitably mounted, it may also be used to detect changes in air pressure. Being extremely thin (typically less than 1mm), such devices may be deployed in areas where conventional pressure or pressure-release triggers would be too obvious. Pyrotechnic Actions and Initiators: These are any compounds, items, or products that burn and produce heat and light. They may be used to initiate incendiary devices, fire blasting caps, or initiate certain types of explosive direct- ly. They are also used as delay systems. Typical IED pyro- technic actions and initiators include: • candles • cloth wicks • electric bulbs surrounded with inflammable material • electric fuses (modified as per flash- light or vehicle bulbs) 36 TERRORIST EXPLOSIVE SOURCEBOOK • fireworks • flares • flashbulbs (electrical and mechanical) • flying model rocket engines and igniters • matches (and match scrapings) • safety fuse (commercial or improvised) • vehicle/flashlight bulbs (with the glass cut away, filament intact, filled with black or smokeless powder) RC (Resistor/ Capacitor) Time Delay: In this impro- vised delay system, a resistor is used to limit the amount of charge passing from a battery to a capacitor. The capacitor is connected to a transistor in such a manner that the transistor will not pass firing current to a detonator until the capacitor is fully charged. (See the earlier section on using the transis- tor as a switch.) The time it takes for the capacitor to charge can be varied from minutes to hours. Reed Switch and Lure Booby Trap: An IED based on a commercial reed switch and magnet. The reed switch-based IED is concealed in one item, the operating magnet in anoth- er. The two items are deployed together as in, for example, a valuable looking jewel box on top of a book, or a box of rifle ammunition on top of a rifle magazine. When the jewel box is lifted (thereby removing the reed switch from the influ- ence of the magnet), the device explodes. The reed switch may also be used as a concealed arming system. In this application, a boxed IED would contain a reed switch con- nected (in the NC configuration) in series with the primary firing system. With a magnet in the correct position (i.e., above the reed switch) on the outside of the IED housing, the switch would be pulled into the NO (or safe) position. Removing the magnet would allow the reed to close again and arm the device. Only the IED designer would know the required magnet-locating position. Safety Pin Booby Trap: Here a mechanical IED is rigged to incorporate a concealed electrical firing system. The elec- trical circuit is completed when a safety pin is replaced with IED CONSTRUCTION PRINCIPLES 37 a view to neutralizing the apparent mechanical action. In a plastic or wooden-bodied device, the firing contacts may take the form of two conductive silver paint tracks which almost meet in the center of the safety pin hole. Inserting a metal safety pin will short them out and cause the device to fire. The paint tracks may be painted over with normal paint for camouflage purposes. An alternative could employ a sub- miniature press-to-make switch concealed inside a hole apparently intended to take a safety pin. “Sparklets” Bulb Grenade (C0 2 Cartridge): A grenade based upon the type of carbon dioxide gas cartridge used in soda siphons or paintball guns. The bulb is discharged and the neck valve drilled out to facilitate installation of an explosive material and insertion of a length of safety fuse. The device is often deployed by catapult in which case a piece of wire coat hanger is attached to the cartridge in such a manner that the cartridge can be launched (base first) with the fuse burning. Stapler Booby Trap: An improvised device based on the larger type of office stapler. The lower rubber base is levered off to provide access to the inner cavity area. An electrical detonator and small charge is installed along with one or two lithium coin batteries. Interconnecting wires are attached to the lower and upper metal stapler faces, turning them into firing contacts. The base is replaced. When next the stapler is used, circuit continuity occurs and the device fires. Tape Player Booby Trap (Audio or Video): In this device, firing contacts are installed in the player in a manner that allows them to touch the tape of an installed cassette. A shorting contact is then affixed to the cassette tape material itself at some predetermined point. The tape will play quite normally until this section is reached, whereupon the electri- cal circuit is completed and the device explodes. Thermal Switch: Any commercial or improvised prod- uct which reacts to an increase or decrease in temperature and indicates the change via an electronic, mechanical, or electromechanical reaction. This reaction is used to operate an IED circuit or mechanism. For example, the different expansion rates of two dissimilar metals sandwiched togeth- er to form a bimetallic strip (as used in most thermostats) will cause it to bend when heated. This bending movement can be used to complete a circuit or operate a small switch. Tin lid Switch: An improvised switch made from two tin can lids. A wire from the firing circuit is affixed to each lid. A hole is punched (not drilled) through the center of each lid and the two lids then insulated from each other with a piece of writing paper. Subsequent pressure on the upper lid forces the rough edges of the punched hole through the paper, the lids touch and the electrical circuit is completed. Vehicle Battery/Lead Sheet Mine: This device is buried just below the surface of the ground and camouflaged. It is based around a vehicle battery, lead sheet, and insulator. The firing circuit is connected so as to be completed when one end of the lead sheet is depressed (by a walking man, for example) onto one of the battery terminals, one detona- tor wire being attached to the other terminal, the other to the lead sheet. The other terminal is insulated so that the sheet may rest on it without shorting. Foil-covered card and similar objects may be used in place of the lead sheet. Vibration Detector: A commercial or improvised device reacting to vibration rather than sustained movement proper and having a nonlatching action, i.e., if the vibration stops the current stops flowing. An improvised form could consist of, for example, a piece of clock spring to which a small weight is attached. This is used as a primary or secondary fir- ing mechanism, invariably with a delay arming system due to the sensitiveness of the assembly. VCR Alarm Trap: A device based on the type of VCR theft alarm built into a VHS cassette. A detonator is installed in place of the alarm sounder (using a transistor and addi- tional power source, if required) and placed in the VCR. Looting enemy personnel or any other target moving the VCR will cause the device to fire. Video Cassette/Slipcover Booby Trap: An improvised device in which a video cassette is disassembled and IED components installed. Firing contacts lead from the con- cealed device (one from the battery, the other to the detona- tor — the other detonator wire being attached directly to the 1 38 TERRORIST EXPLOSIVE SOURCEBOOK IED CONSTRUCTION PRINCIPLES 39 battery) to the outside of the cassette. A metal foil shorting strip is attached to the inside mouth of the cassette case. Insulating material is used to cover the strip while the cassette is replaced in the case. When the insulation is removed, any subsequent attempt to remove the cassette will cause the strip to short out the firing contacts and the device will explode. Vox Switch Trap: A device based on a commercial or improvised switch which operates when sound above a pre- determined level occurs. Commercial devices used to start tape recorders automatically can be modified to instead pass firing current to an electric detonator. The types designed to plug into the remote start socket of tape recorders need no modification, as they simply change from an NO to NC status when activated. Other types will be installed in conjunction with a transistor as described in earlier sections. 40 TERRORIST EXPLOSIVE SOURCEBOOK CHAPTER THREE Characteristics and Recognition Features of Explosive Materials IED EXPLOSIVE AND INCENDIARY MATERIALS T he following chemicals and materials are readily available from a variety of sources. Given an appro- priate context, the validity of “usage claims” made with regard to any such chemicals discovered during a secu- rity search should be carefully investigated. Hazard Limitation : As a matter of prudence, always wear protective clothing (goggles, gloves, dust mask as a min- imum) when initially investigating any unknown material. The popular television techniques of identifying a chemical by sniffing it or rubbing it between the fingers are extremely dangerous. Even common household products and chemi- cals can cause sickness, nausea, or headaches if inhaled or allowed to contact the skin. Personnel likely to be charged with the removal of chemicals or chemical residues should have access to fireproof overalls and gloves, acid-proof safety goggles, and self-contained breathing apparatus. Suitable containers should be available in which to transport unknown chemicals. Oxidizers must be kept isolated from fueling agents, and adequate fire fighting equipment should be on hand. Aluminum Powder: A gray or silvery metallic dust which forms an explosive mixture in air and reacts with cer- tain acids and caustic solutions to produce hydrogen. It is a material found in various improvised explosive and incendi- ary mixes and is added to certain explosive mixtures to increase the heat of explosion and thus the work capacity of 41 the charge. Typical legitimate uses include cold-cast model making and paint manufacture. Ammonium Nitrate Fertilizer: White buff crystals, prills (pellets), or powder. It can be sensitized by combining with fuel oil or certain other liquids to produce an explosive (ANFO) or mixed with TNT to produce AMATOL explosive. Ammonium nitrate is a powerful oxidizer. “Anal” Explosive Mix: An improvised powder explosive made from ammonium nitrate and aluminum powder. It is usually deployed in a tightly sealed, taped plastic bag. “Annie” Explosive Mix: An extremely toxic improvised explosive mixture made from ammonium nitrate and nitrobenzene. Its color is dark yellow-brown and it has an almond-like odor. Search personnel should be aware that the vapor from nitrobenzene is toxic and the material is readily absorbed through the skin. It is usually deployed in sealed plastic containers, often with a booster charge. Aqueous Ammonia: A clear liquid, readily available in the form of household glass cleaner. It is used as a sensitizer with nitromethane. “Backarock” Explosive Mix: An extremely toxic impro- vised explosive manufactured from potassium chlorate and nitrobenzene. It is yellow-brown in color and has an almond- like odor. Note previous warnings about nitrobenzene. Black Powder: Recoverable from fireworks or easily manufactured from potassium nitrate, charcoal, and sulfur. It is used for fuses, incendiary devices, or, if tightly confined, as an explosive. Its burn rate is increased enormously if con- fined. Black powder is available in granular and pellet form — the finer the granulation, the faster the burn. Butter: Used in the manufacture of certain chlorate-based improvised plastic explosives. Alternatives include lard, hair cream, corn oil, Vaseline, and margarine. Calcium Carbide: Available in dark gray-black chunks. It reacts with water to produce highly flammable/explosive acetylene gas. Typical legitimate uses include a fuel in some types of lighting, and model “novelty cannons.” Calcium Hypochlorite: A white powder or tablet with a powerful smell of chlorine. It reacts with moisture or acids to 42 TERRORIST EXPLOSIVE SOURCEBOOK produce chlorine gas and will ignite when in contact with combustible and organic materials. Typical legitimate use is as a bleaching agent. Carbon Disulfide: A colorless liquid with a smell like rotting radishes, poisonous and very inflammable. It is used as a solvent for yellow phosphorous in self-igniting Molotov cocktails, in industry in rubber vulcanizing and viscose rayon manufacturing processes, and as a fumigant. “Co-Op” Explosive Mix: (Sodium chlorate/ nitroben- zene improvised explosive). Has an almond-like smell and is yellow-brown in color. “Cool Burner” Incendiary: An improvised incendiary made from potassium permanganate and granulated sugar. It is pink-red in color. Copper Sulfate: Large blue crystals or greenish-white powder. Used with sodium chlorate, liquid ammonia, and alcohol to make TACC (tetramminecopper (II) chlorate) improvised primary explosive. Typical legitimate uses include insecticide, water purification, and coloring of lead to resemble copper. Diesel Oil: Can be used to sensitize ammonium nitrate fertil- izer to produce an explosive with a variable detonating velocity. “Fairy Liquid”: A British brand, greenish hand-washing liquid boiled and added to gasoline to make a type of impro- vised napalm. Ferric Oxide (Iron rust): Used with aluminum powder and magnesium turnings/ shavings to create improvised thermite. “Fire Icing” Incendiary: A disguised improvised incen- diary made from boiled sugar, water, and potassium chlorate. It is molded into the shape of cakes or sweets and colored with poster paint. Flash Incendiary Mix: Composed of potassium perman- ganate and aluminum powder. It is silvery-pink in color. Gasoline: The color of gasoline may vary from the norm if dyes are added. Liquid and vapors are both sensitive to heat, flame, sparks, and static electricity. It is used with vari- ous additives (soap or polystyrene chips, for example) to create a jelly (improvised napalm). Glycerine: A clear, sticky, heavy liquid. It reacts with cal- 43 EXPLOSIVE MATERIALS cium hypochlorite or potassium permanganate to produce heat and flame and is used as a sore throat treatment. Harpic (Brand) Toilet Cleaner: This commercial prod- uct can be mixed with aluminum powder to produce a gen- eral purpose explosive. Hexamine: A white, salt-like material which can be used to make RDX explosive. It is used in compressed block form as a fuel for camping stoves and model steam engines. Hydrogen Peroxide: This familiar product is used as a hair bleach. A 60-percent-plus concentration can be detonated. Iodine Crystals: Dark bluish-red crystals with metallic sheen. It will react with water to generate enough heat to cause combustion of certain materials and can be used with ammonia to create an extremely sensitive explosive (ammo- nia tri-iodide). Crystals are recoverable (by evaporation) from tincture of iodine, which is legitimately available for use as a microbicide. This material is toxic if swallowed, inhaled, or absorbed through the skin. Lead: A dark gray, soft metal. Small pieces of this material are used in conjunction with sodium or potassium nitrate and wood alcohol to produce improvised lead monoxide and sodium or potassium nitrite. Lead monoxide is a dark brown-orange colored solid used in the preparation of improvised lead picrate Magnesium: A silvery metal found in powdered form or in narrow, solid strips. This is a combustible substance form- ing explosive mixtures with air. In powdered form it will react with water and acids to produce hydrogen. Magnesium turnings can be reworked into powder. Moth Balls (Naphthalene): Can be crushed and mixed with potassium dichromate and ammonium nitrate to create an explosive with a detonating velocity of around 2,500 meters per second. When heated, it will produce an explo- sive/inflammable vapor. Nitric Acid: A clear, colorless liquid producing reddish- yellow fumes. It causes severe skin burns and forms a dan- gerous reaction with many materials. An explosive reaction is obtained with metallic powders, carbides, turpentine, hydrogen sulfides, and cyanide. 44 TERRORIST EXPLOSIVE SOURCEBOOK Nitrobenzene: A yellow liquid with the odor of almonds. The liquid is poisonous, easily absorbed through the skin, and the vapor toxic. It is used with sodium or potassium chlorate to make explosives and incendiaries. A popular Provisional Irish Republican Army chemical. Nitromethane (impure): A model-racing fuel available from hobby stores. It forms a powerful liquid explosive when mixed with aqueous ammonia and may also be used to sensitize other materials for use as improvised explosives. Paraffin Oil (aka “Baby Oil”): Used with gasoline and con- centrated sulfuric acid in the manufacture of sustained-burn, self-igniting Molotov cocktails. An igniter mix of sugar and chlo- rate is attached to the outside of the bottle so that, upon break- ing, the acid contacts this mix and the chemicals ignite. Paraffin Wax: Used in the manufacture of chlorate-based improvised cast and shaped charges. Petroleum Jelly (Vaseline): Used as a binder with potassi- um chlorate to make a homemade plasticized explosive. Picric Acid (TNP/Trinitrophenol): An explosive hav- ing similar relative effectiveness to TNT. It is used as a boost- er explosive or to manufacture lead picrate primary explo- sive. The color is lemon yellow. It combines readily with some metals to form explosive picrate salts, which are very sensitive to heat, shock and friction, and can be improvised from aspirin. Plaster of Paris: Can be mixed with aluminum powder to form an incendiary material. Polystyrene (Styrofoam): This is the familiar packing material. It can be added to gasoline to create a type of improvised napalm. Potassium: A soft, white reactive metal stored under oil and reacting violently with water. Cut faces oxidize immedi- ately on contact with air to create a gray color. Potassium Chlorate: Available as white crystals or pow- der (if crushed). It is recoverable (in impure form) from matches. This is a powerful oxidizer and will generate heat/flame with sulfuric acid and organic materials. Potassium chlorate is used with a variety of fueling agents to produce improvised explosives. EXPLOSIVE MATERIALS 45 Potassium Dichromate: Used in photographic process- ing and in some types of polish stain. It can be combined with various other chemicals (i.e., charcoal, ammonium nitrate, and aluminum powder) to form a powerful explosive. Potassium Perchlorate: These are white crystals and are more stable than chlorate. Produces an explosive mixture with red phosphorous. (Red phosphorous does not ignite with air, although yellow and white phosphorous do.) Potassium Permanganate: Consists of very dark purple (almost black) crystals. It is an extremely powerful oxidizer and will react with glycerine to produce heat and flame. It is explosive when in contact with hydrogen peroxide or sulfuric acid. Common uses are as a sterilizing agent and an antiseptic. Sawdust: Used in powder form in place of charcoal in some (especially potassium chlorate-based) improvised explosives. Smokeless Power: The propellant in small arms car- tridges. Nitro-based smokeless powders are frequently used as explosive fillings in pipe bombs and the like. In such cases the material may be detonated or ignited with a safety fuse. Soap Flakes ( pure soap, not detergent): Used with gaso- line to make improvised napalm. Sodium Chlorate: Appears as whitish crystals and is used with nitrobenzene to make an explosive. It is also used in the manufacture of TACC improvised explosive and with sugar in various other explosive/incendiary mixes. It is com- monly available as a weed killer or defoliant. Sodium Peroxide: A yellowish-white powder turning yellowish-brown when heated. It reacts violently with water. Mixtures of sodium peroxide and combustible, organic, or easily oxidizable materials are explosive and easily ignited upon contact with water or by friction. Sodium: A silvery, waxy metal. Exposed surfaces turn gray on contact with air. It is supplied submerged in mineral oil. Sodium is extremely dangerous and causes skin burns. It causes an extremely violent reaction with water or moisture, producing sufficient heat to cause ignition or explosion. Sugar: Used as a fueling agent in various improvised incendiary and explosive mixes, both in granulated and fine (powder) form. 46 TERRORIST EXPLOSIVE SOURCEBOOK Sulfur: A yellow powder. It is an ingredient in the manu- facture of improvised black powder and is mixed with potas- sium chlorate and other chemicals to make various types of explosive. It is sold as a laxative. Sulfuric Acid: An oily, colorless liquid that causes severe skin burns. It is explosive when mixed with potassium per- manganate or incendiary when mixed with black powder, potassium chlorate, match heads, sodium peroxide, and calci- um hypochlorite. It is used in the manufacture of improvised picric acid. Concentrated sulfuric acid is itself improvised by boiling vehicle battery acid until white fumes appear. Trichloroethane: A nonreacting hydrocarbon used with impure nitromethane (model racing fuel) to sensitize ammo- nium nitrate. The use of additives such as trichloroethane has been provoked by stricter controls in certain quarters on the availability of technical grade nitromethane. It is avail- able for use as a cleaning solvent. COMMERCIAL AND MILITARY EXPLOSIVES The detonating velocities given here can be assumed to be typical of those attainable with optimum values for all variables such as density of loading, diameter of charge, type of detonator, etc. Ammonium Nitrate: A powerful oxidizer. It comes as white-buff crystals, prills (pellets), or powder, and is extremely hygroscopic. Commercially, it is used where a pushing, rather than shattering, explosive effect is required, and also as an additive with other compounds. When used alone, it is usually initiated with a booster charge of TNT. The confined material is capable of cooking-off if exposed to fire. Detonating velocity is approximately 8,900 fps, relative effectiveness factor (RE) 0.42. Ammonium nitrate must not be stored in copper or brass containers because of danger- ous chemical reactions. Its principal uses are as a cratering charge and in quarrying. Amatol 80/20: A mixture of ammonium nitrate and TNT. It typically appears as buff-brown blocks or pressings, and has a detonating velocity of approximately 16,000 fps, RE of 1.17. EXPLOSIVE MATERIALS 47 Blasting Gelatin: A translucent, elastic, jelly-like sub- stance, appearing in various colors. It has characteristics similar to gelatin dynamite but has a greater water resis- tance. It is used principally in commercial blasting projects. C4/PE4: The standard plastic explosive in use by the British and U.S. armies. It is very stable, white, and putty- like. It is available in sheet form, and, is made from 91 per- cent RDX and 9 percent inert plasticizer: Other plastic explo- sives may vary in color (black, dirty gray, light blue, yellow, dark green, etc.) and may be more or less malleable. The detonating velocity of C4 is approximately 26,400 fps, RE of 1.34. It is. principally used by the military as a cutting and breac hing c harge. Detonating Cord (Det Cord): A white, flexible cord, approximately .25” in diameter (available in larger diameters for specialist uses), filled with PETN. The ends are often sealed with tape in terrorist IEDs to prevent the filling from falling out. Detonating velocity is approximately 20,000 to 24,000 fps. It is used principally in explosive ring mains as a means of simultaneously detonating several charges. Dynamite Explosives: Standard, ammonia, and gelatin (Gelignite) dynamites exist. It is granular (commonly green or brown and rubber-like in appearance), although solid types are available. Military dynamite (typically issued in .51b, 8” x 1.25” diameter cartridges) doesn’t contain nitro- glycerine and is therefore far safer to handle and store than commercial types. Old commercial dynamites will sweat nitroglycerine, causing oily stains on wrappers and storage cases. In this condition it is extremely dangerous. Detonating velocity is: (1) Military: approximately 20,000 fps, RE of 0.92 (2) Commercial: from 7,900 to 19,000 fps (depending on type), RE of 0.41 to 0.83. Dynamite explosives are princi- pally used as a general demolition charge and for quarrying and ditching. 48 TERRORIST EXPLOSIVE SOURCEBOOK i \ EGDN (Nitroglycol) : Ethylene dinitrate, also known as nitroglycol and ethylene dinitrate. This is a colorless liquid manufactured in a similar fashion to nitroglycerin(e) but is less susceptible to mechanical shock. It is used in the manu- facture of various gelatinous and solid explosives. HMX: A marginally more powerful variant of RDX. It is a'' white solid with a powerful shattering effect. Kinepouch/Kinestik: A commercial explosive system comprising premeasured quantities of ammonium nitrate and nitromethane. Five minutes or so before use, the liquid nitromethane is added to the ammonium nitrate to sensitize it. Lead Azide: A primary explosive taking the form of a whitish-buff crystalline substance. It is sensitive to flame and impact and is used with lead styphnate in many types of alu- minum detonators. It forms dangerous and sensitive copper azide in the presence of moisture and copper or brass. Lead Styphnate: A primary explosive usually taking the form of orange or brown crystals. It is used in detonators and primers and is easily ignited by heat and static discharges. Mercury Fulminate: A primary explosive taking the form of gray or white crystals. It is very sensitive to friction, flame, heat, and impact and is used in detonators. Nitroglycerine: A thick, clear to yellow-brown liquid. Extremely powerful and shock-sensitive. It freezes at 56°F and is far less shock-sensitive when frozen. Pentolite.- A high-explosive made from equal amounts of TNT and PETN. Its color is light yellow. It is frequently used as the filling in grenades. Picric Acid: A yellow, crystalline high explosive. It is similar in power/ effectiveness to TNT and forms dangerous and extremely sensitive lead pictrate explosive if allowed to come into contact with lead. RDX (Cyclonite): A white crystalline solid used as the base charge in several detonators. Its detonating velocity is around 27,440 fps. It is used as a general demolition charge and in detonators. Semtex: A Czechoslovakian plastic explosive deriving its < power from a 50/50 mixture of RDX and PETN. It is of a similar power to C4 but more prone to sweating or bleeding its plasticizer. EXPLOSIVE MATERIALS 49 Tetryl: A fine, yellow, crystalline material used in detona- tors and as a booster explosive. Its detonating velocity is approximately 23,300 fps, RE of 1.25. Tetrytol: A high-explosive manufactured from 75% tetryl and 25% TNT. It is used as a bursting charge in certain muni- tions and as a general demolition explosive. Its detonating velocity is approximately 23,000 fps, RE of 1.20. TNT (Trinitrotoluene) : Is usually formed into cylindrical or rectangular blocks, typically .25 pounds, .5 pounds, or 1 pound in weight. There are various colors and wrappings, including paper, plastic, and card with metal ends. Detonating velocity is 22,600 fps, RE of 1. It is used by the military as a breaching charge and in composition explosives. FLAMELESS PYROTECHNIC ACTIVATION SYSTEMS These are systems in which a simple (often binary) chem- ical mix (as opposed to a flame source) is used to produce heat and flame with a view to starting a fire, firing a nonelec- tric detonator, or initiating primary explosives. They are also known as hypergolic activation systems. Typical mixes are shown below: • Calcium hypochlorite (HTH), brake fluid, glycerine, and certain types of hair cream • Iodine crystals, aluminum powder, and water • Nitric acid and metal powders • Potassium permanganate and glycerine • Sodium peroxide, powdered metals or sugar, and water • Sulfuric acid, chlorates, and sugar SO TERRORIST EXPLOSIVE SOURCEBOOK ►Bunn Reaction Drills and Countermeasures H aving considered the technology of the IED, we will now look at some of the reasons such devices are deployed, likely deployment locations, and defen- sive measures that can be taken against them and related ter- rorist attacks. WHY ARE IEDs USED? IEDs have been used in the furtherance of many criminal, political, or ideologically motivated crimes. In the case of ter- rorist attacks proper, they are used as both strategic (part of an overall campaign) and tactical (having a specific purpose within that campaign) weapons. Some of the reasons they might be deployed are to: • generate publicity • reduce the morale of a target group • deny the security forces or other tar- get personnel the use of terrain, buildings, equipment, etc. • force the target into specific areas where they can be killed by other means • hinder police and security force reconnaissance operations • delay IED-clearing operations • give warning of police or security force patrols • deter police or security force searches 51 • deter police or security force patrols • cause fear and confusion among the civilian population with a view to provoking the populace into demand- ing that the government change or reconsider some existing policy • destabilize a target regime • force a change in the operating tech- niques of a target organization • avenge some historical defeat or mark some important (to the group) histori- cal event • kill a specific individual • destroy a specific industrial or com- mercial complex or center • intimidate a target group into sup- porting the movement or ceasing active resistance against it ^ The use of IEDs allows a terrorist or extremist group to injure, kill, or cause damage with little risk of detection or capture. The publicity generated is disproportionate to the effort involved and often to the size of the group in question. Justification for attacks on soft targets can be found in an oft- quoted terrorist adage which reads, “When hungry, why hunt for a tiger when there are plenty of sheep around?” This can be expressed in less colorful terms as, “When hungry for publicity, notoriety, or revenge, why attack a hard target (with the attendant high risk of failure, capture, or death) when there are plenty of soft or undefended targets around that can be attacked with relative impunity?” WHAT ARE THE PRINCIPLES OF BOOBY-TRAPPING? The majority of terrorist IEDs can be classified as booby traps. In other words, they are designed to actuate when the target undertakes some apparently harmless action such as lifting a briefcase or opening a car door. The psychology of booby-trapping is worthy of consideration. Several basic TERRORIST EXPLOSIVE SOURCEBOOK principles are always used by successful booby trappers. They are: Surroundings: The surroundings will appear undis- turbed, and no clues (such as bits of wire, wrappers from explosives, signs of forced entry, etc.) will be left behind. Mechanisms will be concealed, camouflaged, or designed so as to resemble some innocent item. Obstacles: All man-made obstacles are ideal from the viewpoint of the booby trapper because sooner or later they will have to be removed. In the interim they will be bypassed and so any obvious bypass routes will be trapped also. Lures (Bait): It is not just cats that curiosity kills. Traps will be set in obvious locations to trick the inquisitive, attached to souvenirs or items of value, and disguised as apparently mislaid or abandoned items to catch the unwary. Attraction: An interesting, useful, or much-frequented area or location (e.g., a shady spot, a natural washing/ bathing pool, a public display area, a bandstand, or a place of cover likely to be adopted by security force patrol mem- bers, etc.) will often be trapped. Bluff and Double Bluff: Dummy traps will be used to induce carelessness in finders. Obvious trap mechanisms will be used to conceal more clever, dangerous ones. Having deployed one real device, hoax warnings will often be issued about other devices. This combination of real devices and hoaxes causes as many problems for the security forces as would the continual deployment of real devices. Variety: Many different types of trap will be used in the same locality to cause confusion, delay incident and emer- gency response teams, and delay or negate the development of a standard neutralization technique (which would speed up subsequent trap neutralization operations). HOW ARE BOOBY TRAPS DETECTED? The vast majority of booby traps can be detected only by the extremely careful search of all suspicious areas and objects. All personnel likely to encounter such devices must be constantly aware of the threat when occupying contested REACTION DRILLS AND COUNTERMEASURES 52 53 areas, undertaking searches, responding to calls for assis- tance, returning to parked vehicles, performing routine patrols, etc. “Trap sense” will come with practice. Constant vigilance is extremely important. What Specific Locations and Objects Should Be Suspected? Given an appropriate context, the following are all poten- tial trap locations and objects: (1) Abandoned (or apparently lost) items of souvenir and/or financial or mili- tary value to the finder, and apparent- ly lost items which can be relied upon to provoke their recovery or removal with a view to determining the legiti- mate owner. (2) Items and obstacles that must be moved before a unit or patrol or other target can enter an area or pass some point. This includes natural and man- made objects, vehicles, and so on. (3) Obvious access points such as build- ing entrances, gates, tracks, fences, windows, etc. (4) Installations. This includes any instal- lation (building, bunker, storage facil- ity, office, production plant, etc.) of strategic, tactical, political, or psycho- logical value to the target authority. Also any installation that is likely to be searched by target personnel as a matter of course or because of a provocative phone call or tip-off. Objects within such locations should also be suspected. (5) Open country, locations of natural cover, areas of scrub likely to be used for camouflage, shady areas, obvious 54 TERRORIST EXPLOSIVE SOURCEBOOK landmarks, and known patrol routes. Also consider the most obvious alter- natives to locations in the above cate- gories (which may be trapped in order to catch the more wary). (6) Lines of communication: roads, rail- way lines, culverts, bridges, embank- ments, road cuts, junctions, check- points, telephone and radio links, the postal service, known/likely security force LZs, DZs, FUPs, RVs. (7) Events/Gatherings: shows, displays, political meetings, apparent vehicle accidents, training areas, etc. (8) The personal property and belong- ings (including vehicles) of specific (tactical) target individuals. What Are the Warning Signs to Look For? Anything that is out of the ordinary, unusual, or out of place may indicate a booby trap or a nearby command-fired device. As with all security related matters, context is impor- tant. Bearing this in mind (and remembering also that more often than not no clues will be evident), some examples are: (1) signs of digging or repair work (2) abandoned items that have an obvi- ous cash or souvenir value (3) disturbed ground and minor ground subsidence (especially after rain) (4) spoil and debris from digging (5) unusual marks on walls, footpaths, roads, roadside lamps, etc. (used as a warning indicator to friendly forces and sympathizers or as a timing/aim- ing mark for a command-fired device) (6) unnatural marks on trees or vegeta- tion, or branches bent or broken, etc., as above is t ■f i •Cl i REACTION DRILLS AND COUNTERMEASURES 55 (7) minor obstructions of all types, includ- ing vehicles, especially if blocking the only obvious access/approach route (8) marks in surface dust or grime (9) continuity breaks in paint work, sur- face grime, or vegetation (10) patches of dead or dying (discolored) grass or vegetation (11) open doors that one would expect to be closed (12) closed doors that one would expect to be open (13) the presence of wire, cord, nails, pegs, etc., that have no apparent function (14) vehicles left unattended in unusual locations (15) unattended luggage in likely target areas (16) the discovery in nearby areas of chemicals and equipment of use in IED construction projects (17) closed curtains or blinds during day- light hours in a house to which secu- rity force personnel have been called in order to investigate some alleged incident or problem (18) single, anonymous calls to security force personnel to attend some al- legedly serious incident (19) blocked drains and drainpipes (20) single access points, which the other side of (or the area beyond) cannot be seen (21) an unusual absence of vehicles in a terrorist-sympathetic area (22) all windows open in houses in a ter- rorist-sympathetic area (23) an unusual absence of street trouble- makers in a terrorist-sympathetic area (24) the detection of an observers) (25) the arrival of an unexpected parcel or package WHAT SHOULD BE DONE IF A BOMB THREAT CALL IS RECEIVED? In many attacks against civilian targets, where the main object of the exercise is publicity, a warning will often be given by phone. Ideally, the warning will be received early enough to enable evacuation of the building or area in ques- tion but too late for the security forces to disarm the device. Codes are arranged between the security forces and vari- ous terrorist organizations in order that a genuine threat call can be quickly identified as such. This is one of the reasons why the exact wording of any threat calls received should be noted accurately on a Threat Call Card and/or electronically recorded. Such cards also have spaces for the recording of related information which will be of great value during subse- quent criminal investigations. Sometimes the caller will say nothing other than the time the device is set to explode. An initial attempt should be made, however, to elicit as much related information as possible. Of course, the most important pieces of information that must be accurately recorded are: • When will the device explode? • Where is it? A Threat Call Card is supplied (Appendix D) in a form suitable for copying. Copies should be attached to a clip- board and placed close to all outside-line phones. A simple, release-to-make switch system (which operates when the clipboard is lifted from its usual resting place) coupled to a cassette recorder (itself connected to the phone) of the type that has a remote start facility will enable automatic record- ing of all conversations provoking use of the Threat Call Card. The switch might also trigger an auto-dialer pro- grammed to call a specific professional reaction agency. In the event such a call is received, a prearranged and prac- TERRORIST EXPLOSIVE SOURCEBOOK REACTION DRILLS AND COUNTERMEASURES 57 ticed reaction drill should be implemented. This drill will be designed so as to achieve several objectives simultaneously: • the safe evacuation of all at-risk per- sonnel • the summoning of professional assis- tance (police and military) • the limitation of damage In the case of a threat call being received at commercial or business premises, for example, the call recipient should (in addition to commencing filling in the Threat Call Card immediately give some signal that alerts the appropriate security personnel to the situation. With multiline phone sys- tems, this again could be achieved via use of an auto-dialer. The security personnel will then initiate the evacuation and alert the police and/or security forces. Often, the easiest way to achieve a calm and controlled evacuation is to initiate an existing fire drill procedure. It is important, of course, that security personnel and senior staff members be aware of the real purpose of the evacuation. Further, personnel should not be allowed to ignore practice fire drills by virtue of their status or position. Emergency exits and stairways, elevators, etc., are ideal bomb placement locations. Thus, when evacuating as the result of a bomb threat (and assuming that the precise location of the device is unknown) a pre-evacuation check of exit routes should be made prior to the arrival of evacuees proper. This technique should be employed even if the exit route is currently in use. Should anything suspi- cious be discovered, personnel will be diverted to an alternate route. As each area is evacuated, all windows and doors should be opened unless air-conditioning or existing security measures prevent this. Doing so will reduce somewhat any subsequent blast damage should a device explode. Similarly, when all per- sons are clear of the building, mains electricity and gas supplies should be turned off also (if practicable). Safety Perimeter Due to the danger of injury from outward flying and 58 TERRORIST EXPLOSIVE SOURCEBOOK falling glass and debris caused by an explosion inside a building, evacuated personnel should be moved away from the area immediately outside the building to a safety perime- ter some 100 meters distant. If the area outside the building is a public street, the police will take control of this side of the operation upon their arrival. Nominated employees should take a roll call of evacuated persons to confirm that the building is clear and all personnel accounted for. Searches If in-house security or threat reaction personnel are to search for IEDs or IIDs, such searches must be planned, rehearsed, and undertaken in a manner that reduces to a minimum the risk to search team members. Search areas should be given a priority rating based on the ease with which a bomber could gain access to them, public access areas obviously having the highest rating. With a view to limiting injuries or loss of life in the event a device should explode while a search is in progress, the principle of maximum separation is always applied. This means that searches are arranged so as to maximize the dis- tance between teams, and (if two-man teams are used) between each team member within a given area. Ideally, a search team will comprise just a single individual. In an effort to reduce search time, however, two-man teams will sometimes be employed, but under no circumstances will a team ever consist of more than two people. A room search technique suitable for use by a two-man team sees the area divided into three visual segments: (1) floor to waist level (2) waist to eye level (3) eye level to ceiling The room itself is divided into two triangles created by drawing an imaginary line through the center of the room from corner to corner. Searcher 1 goes directly to the farthest corner of the room and searches in a gradually reducing tri- angular pattern, working from the walls inward to the center REACTION DRILLS AND COUNTERMEASURES 59 of the room. Searcher 2 starts at the center of the room and works outward in a gradually expanding triangular pattern. WHAT SHOULD BE DONE IF A SUSPECTED IED IS DISCOVERED? If anything suspicious is found, it must not be touched, moved, or interfered with in any way. There is NO action that an untrained individual can take to make a device safer. If trained to do so by professionals, a bomb blanket assembly or suitcase safety circle could be placed over or around the suspect package providing, again, that this can be achieved without actually touching or moving the item. The location of any suspicious item discovered by security personnel should be accurately recorded on an incident report (at right) and the area cleared (if not already done) pending the arrival of military or police EOD personnel. Nonsecurity per- sonnel finding a suspect item should alert the nearest securi- ty professional and follow their instructions. If there is no one else around to take charge, then clear the immediate area and prevent persons from entering. Call the police or security forces or assign someone to do so. Communications Safety Security personnel communicating via radio should be aware of the fact that an IED based around an electrical deto- nator will, under certain circumstances, be susceptible to premature detonation caused by induced currents from near- by radio frequency (RF) signals. In many military publica- tions a minimum safe distance of 100 feet is advised between an electrical detonator and a radio operating at between 5 and 25 watts. In reality, the actual risk will vary from zero to very high depending upon a number of related factors other than simply the power of the radio. These include the specif- ic length and orientation of the detonator firing wires, the resistance of the IED firing circuit, the frequency, modulation mode, and power output of the radio set, the type of con- tainer housing the IED firing circuit, and the distance between the set and the IED. SAMPLE INCIDENT REPORT TED INCIDENT REPORT - 01/05/9 (dav. month, year) Operative name: J. Green Time: 0950 hrs. Location: Postal sorting room, on table in front of X-ray machine How Discovered: Visual search provoked by anonymous call Description: Brown envelope, Northern Ireland postmark. Large green felt pen address Additional Useful Information: Same as device shown on news program in February Action Taken: Area cleared, device left in situ., EOD and civil police notified 60 TERRORIST EXPLOSIVE SOURCEBOOK REACTION DRILLS AND COUNTERMEASURES 61 Perhaps a greater risk is that the device incorporates cir- cuitry specifically designed to react to close-proximity radio signals. A practical safety measure, then, is to avoid transmit- ting from within any unsearched room, and never report an actual discovery from the immediate vicinity of the find. This latter warning should take priority over requests from search controllers for an immediate description of the item or its location to be transmitted. SPECIFIC COUNTERMEASURES An established reaction drill is important. More important still, however, is to try and deny the terrorist an opportunity to perpetrate a successful attack in the first place. In this section, then, we will discuss specific possible countermeasures. For a given security problem, the level of risk can be determined via the following equation: RISK LEVEL = V FACTOR divided by COUNTERMEASURES Here, V Factor equals the value (in terms of financial reward, publicity, prestige, overall effect, importance, significance, etc.) to the likely perpetrator(s) of a successful operation. We can see from the above equation that step one in a good security program is to identify the specific source of the threat such as a small extremist group with limited resources or an international terrorist group with foreign government support. This being done, suitable countermeasures can be implement- ed. If we have correctly estimated the V Factor, the selected countermeasure will have the desired effect or, at the least, will be the best countermeasure we can offer. It will be noticed, of course, that the V Factor is a variable: its value changes con- stantly. The terrorist group that has recently lost several opera- tives to security force initiatives, for example, is very likely to re- evaluate the worth of a given operation in the light of those loss- es (and feeling the need to restore its status) and might accept a higher level of risk than usual. General security measures implemented without any consid- eration having first been given to the specifics of the threat will frequently achieve little other than to waste time and annoy people. Countermeasures should be re-evaluated, altered, updated, changed, introduced, discontinued, and replaced on a regular basis. If they are not, it is simply a matter of time before the terrorist notices an oversight or loophole, or learns a routine and exploits it. The following countermeasures include techniques applica- ble to low-, medium-, and high-level corporate or private situa- tions and do not appear in any specific order of importance. Implementation of a given countermeasure will depend, of course, upon it being deemed contextually appropriate. The Very First Question to Ask, Then, Is “Am I A Target?” The answer is definitely “Yes.” Given the right (or wrong) set of circumstances, someone, somewhere will contemplate killing or kidnapping you. This is not necessarily because you are you, but because you have been perceived by the would- be perpetrator as being supportive of some religious, politi- cal, philosophical, or ideological movement or organization to which he is opposed. The odds of you actually becoming a victim, however, will vary enormously according to where exactly in the world you happen to be and the amount of attention you draw to yourself (or have drawn to you) as compared to other potential targets of a similar value. In any threat assessment program it is important to remember that it is not how you see yourself, but how the likely perpetrator(s) see you. For example, you might con- sider the claim that you are supportive of American foreign policy to be ridiculous, but by traveling overseas on an American airline you are in fact indicating such support to many extremist groups. Similarly, although you might actual- ly think that the “Winbani” government should “give back” the occupied territories to the “Remolinians” and grant them an independent homeland, by using the services of a “Winbani” owned financial group you are sending out exact- ly the opposite message. Indeed, in the eyes of many terror- ist group operatives, simply drinking at a bar that is also used by off-duty military personnel is enough of a sign of your REACTION DRILLS AND COUNTERMEASURES 62 TERRORIST EXPLOSIVE SOURCEBOOK 63 support for the soldiers (and therefore the policies of the regime that employs them) to justify your death. In the case of kidnap for ransom, remember that “rich” is a subjective term. Besides, it will not usually be your appar- ent personal worth that attracts such an attack but the funds or concessions likely to be forthcoming from your employer or government in order to secure your safe return. Threat Assessment Questions To assess the threat level attendant to a specific situation many questions will need to be asked. Typical, sample ques- tions include: (1) Have other individuals in my position been victims of terrorist attacks recently? If so, what form did the attacks take, where and when were they perpetrated, and was there any prior warning or threat? (2) Is the company I work for one of a group that has been attacked previ- ously by virtue of its involvement with some controversial product, resource, or technique? (3) Does that provocative involvement still exist? (4) What form did the attack(s) take? How and when were they perpetrat- ed? Was a warning or threat issued prior to the attack? (5) Does the date of my impending busi- ness trip abroad coincide with any terrorist-significant anniversary? (6) Has the airline I intend to use been attacked before? (7) How good are the security forces in the country in question? What is the attitude of the government in that country toward foreign nationals? 64 TERRORIST EXPLOSIVE SOURCEBOOK (8) If a firebomb were planted in one of our stores, how long could it remain undiscovered? (9) Do we have adequate fire-fighting equipment on hand in the store to control a fire that broke out during opening hours? And so on. During the assessment, if any questions set the alarm bells ringing, then refine the exercise by determining what options are available by way of a countermeasure. Implement those that are the most practicable for your situation. ACCESS SECURITY Good access security will not only deny the terrorist the opportunity to enter a given area and actually plant a device successfully but will also prevent the theft of uniforms, equipment, identification papers, or information, etc., that would be of use to him in subsequent operations. The fol- lowing measures are possible: High-quality locks installed and updated regularly: Technology advances at an alarming rate, and a high- tech lock today may turn out to be a low-tech risk in twelve months’ time. Many books are published on lock picking/lock defeat techniques. The launch of a new lock system is invariably followed by a new tech- nique to defeat it. High-quality alarm system installed and tested regularly: Like locks, alarm technology is constantly updated, but like locks, many alarms are simply installed and then forgotten. Stay abreast of current technology. Locks (especially padlocks in little-used areas) checked regularly: This is done to confirm that they are, indeed, the origi- nal and not a substitute. REACTION DRILLS AND COUNTERMEASURES 65 Roof and wall areas ( especially in little-used areas and loca- tions in which stored goods/equipment would provide cam- ouflage) checked regularly for surreptitious entries or entry attempts: Anti-climb paint should be used on drainpipes and other roof-access points. Only security personnel with proven track records employed; references required and checked Random spot checks made to confirm continued efficiency/ loyalty/integrity of employed security personnel Personnel access security measures employed, both for employees entering unauthorized areas and nonemployees entering the premises: Note that many electronic access cards on which the relevant information is recorded on a magnetic strip can be electronically copied. Check that this is not the case with the cards you use. Likewise, although infinitely more difficult, the so called “Smart Card” can also be duplicated/copied/read. Noncounterfeitable photo ID cards/badges used: Given the motivation, resources, and time, there are few things that cannot be counterfeited. ID cards and badges most certainly can. Use only cards or badges that will require some considerable amount of time and effort to be put into its illegal reproduction. Many pass- es and ID cards in use today are so basic that they could be counterfeited by a child in minutes. Many aircraft transit passenger boarding passes fall into this category, as do the visitor passes issued at several military bases. Carrying/wearing of cards/badges enforced rigidly: This requirement must extend to the most senior per- sonnel. Security staff are doing no one a favor by over- looking a “forgotten” card. The mindset established must be such that a person seen without a badge or 66 TERRORIST EXPLOSIVE SOURCEBOOK card immediately sets the metaphorical alarm bells ringing. It cannot be overemphasized that asking someone you know to show an ID card is important. The object here, however, is not to prove who they are, but to prove that the card itself is safe. One combined access/exit point only for highly restricted areas: Quite simply, it must not be possible for the situation to arise where someone can enter or exit a secure area without the designated security officer knowing and/or the event being recorded manually or electron- ically. This is most easily accomplished by having only one entrance/exit. Area purpose signs nonspecific and unlikely to be deduced by unauthorized personnel: This is an excellent way of defeating the efforts of an intruder as, even assuming they can obtain access, they are immediately faced with the problem of where to go to find material/information/data of value. This is of use during working hours (when any employees approached and asked directions would immediately become suspicious) and out of hours (when the intruder would be required to spend an inordinate amount of time inside the premises, thereby risking capture by police/security personnel alerted by a silent alarm). Vehicles unable to enter underground/roof car park areas without being subjected to search/driver check Pedestrians unable to access car parking areas without pass- ing ID check In outside storage areas, least valuable products/materials stored nearest to perimeter walls or fences and most valuable nearest to center REACTION DRILLS AND COUNTERMEASURES 67 In high-risk situations, valuable materials should be stored inside additional, central compound Such areas well illuminated at night and video observation and recording equipment (producing high -quality images!) in use. Video observation system installed at home. Dummy cameras not used: The electronic emanations from genuine, working video cameras are readily detectable on commercial or expedient equipment (an FM radio, for example). The professional criminal or terrorist will always test for this type of bluff. Vehicle parking immediately outside building prohibited and prevented by use of barriers Outside rubbish bins and dumpsters not located close to building walls. Bins emptied frequently and overspill not allowed. In domestic situations, rubbish bin(s) stored in locked cupboard or located away from property: Such areas are ideal bomb concealment locations. In shopping precincts, reception areas and public rest areas, etc., litter bins are of the transparent type (wire mesh or clear plastic) and emptied frequently. Overspill is not allowed to accumulate In such areas seats, display plants, advertising displays, etc., of such a type as to prevent the concealment of a device. Checks made frequently to confirm “clean ” status Washroom towel dispensers, toilet cisterns (tanks) and supply storage cupboards sealed or locked and checked frequently to confirm secure status Additional security measures applied to fuel or material stor- age containers that are likely to amplify the effects of any nearby explosion or fire 68 TERRORIST EXPLOSIVE SOURCEBOOK Legitimacy codes used on all mail: These are prearranged letter or number sequences (used on the outside of mail items as an identifier) which are known only to the sender and recipient. Such codes are changed frequently. Letterbox flaps are sealed and mail collected in person (or by third party) from sorting office rather than being delivered to home or office: All major sorting offices will have equipment on hand for the checking of suspicious parcels and letters. It is far safer for any such items to be discovered at the sorting office than at your home. This technique also denies the terrorist the opportunity to introduce mail into your home under the guise of a genuine postal delivery. Incoming deliveries from company suppliers checked against invoices/orders during the initial delivery (unloading) process No unattended deliveries (i.e., groceries) allowed at home Childrens’ toys and garden furniture or equipment not left out overnight Vehicle always parked in a secure area Parking of unknown vehicles outside home not allowed No untidy vegetation or hedges permitted to grow immediate- ly next to outside walls business and domestic premises Window boxes not used No wall-climbing vines or trellis work for other plants Descriptions/photographs of temporary employees or contract personnel (including those arriving for home-based improve- ment or construction work, etc.) obtained prior to arrival of said personnel REACTION DRILLS AND COUNTERMEASURES 69 ELECTRONIC AND PHYSICAL COUNTERSURVEILLANCE The vast majority of terrorist attacks are preceded by a prolonged period of observation, undertaken with a view to determining target habits and likely attack locations, etc. Good electronic and physical countersurveillance, then, will defeat these efforts and make it extremely hard for the would-be perpetrator to plan attacks or IED deployment pro- jects based on accurate target movement and security mea- sure details. The following measures should be implemented: Regular but random countersurveillance sweeps undertaken with only need-to-know personnel aware of dates and times If in-house sweep team not employed, supervising personnel familiar with current techniques and equipment: The supervising personnel must be at least as knowl- edgeable as the employed team, preferably more. Where this is not the case the whole exercise is point- less, as the quality of work cannot even be determined, let alone relied upon. If in-house team not employed, only reputable group with proven track record used: Again, as with many security companies, far too many countersurveillance agencies employ operatives who have little, if any training. Beware of “one man and his dog” operations. Adequate access security techniques initiated immediately subsequent to sweep: Much like a balance sheet, a countersurveillance report reflects a given moment in time. Good access security will delay, if not negate totally, successful subsequent electronic intrusion. Telephone instruments, wall socket covers, line junction box covers, fuse box covers, adapter plugs, and all similar items TERRORIST EXPLOSIVE SOURCEBOOK secured against tampering/substitution (subsequent to sweep) with noncounterfeitable tamper indicator seals of the type used on video cassettes: In combination with other techniques, this is one of the most effective (and certainly the most cost effi- cient) methods of deflecting attempted in-house elec- tronic penetration. Seals described above regularly checked for signs of tampering: This is important because it will alert you quickly to an attempted disassembly, and also because the seals will not deter a professional violator if he knows that break- ing them will give him access to valuable information for even a short but determinable length of time. During sensitive discussions/meetings at which teleconfer- ence facilities are not required, all telephones, FAX machines, and MODEMS unplugged from wall sockets for duration of meeting: Doing this renders any instrument-emplaced devices carrying audio down the line totally inoperative. No sensitive material ever sent via the phone lines in clear (i.e., unscrambled) form: Many cable and satellite television companies consid- er their programs valuable enough to scramble in order that they may not be received (without great effort) by nonauthorized viewer. Is your information of any less value? Anti TEMPEST measures implemented: TEMPEST (referring here to the reception, recombin- ing, and decoding of information-carrying and related radio frequency signals emanating from computer VDUs, etc.) surveillance techniques can be defeated by purchasing only internally screened electronic equipment or by retro-fitting screening material to existing equipment. In cases involving highly restrict- ed information, a TEMPEST-proof room or area con- REACTION DRILLS AND COUNTERMEASURES 70 71 sisting of a metal screened operating area may be established, all incoming and outgoing cables and line wires being screened also. Computer and related equipment for use in sensitive or valuable projects should conform to British Government standard NAC- SIM 5100A or NATO standard AMSG 720. Computer passwords of adequate complexity: Many, many publications exist which list thousands of common passwords. Similarly, software is readily avail- able which will actually test the password barrier against often-used passwords. A two-tier password system should be used whenever the system permits. Passwords should never be proper names, nicknames, Social Security or phone numbers. The password(s) must have no logical, sensible, or determinable relationship to any other existing name, letter or number sequence, or the position of keys on a standard QWERTY keyboard, regardless of how remote the chances of some unautho- rized person determining that sequence might appear. Passwords should always comprise the maximum allow- able number of alphanumeric characters allowed by the system, and this total should ideally be at least eight char- acters long. None of these numbers or letters should be sequential. The system should not display the entered password on screen. Only two attempts at entering a valid password should be allowed by the system before an automatic shut out. In high-security scenarios the sys- tem will be monitored 24 hours a day. Modem links will be kept to an essential minimum, and calls to the system from remote modems will be allowed only from nomi- nated telephone numbers. A requirement that the calling number be entered (which will be checked by the sys- tem prior to log on proper) should be implemented. Computer passwords not scribbled on notepads or inside drawers/cupboards: A mindset which equates a computer password with the keys to the safe or armory should be instilled amongst i b personnel. It is within the ability of all but those with learning difficulties (which should preclude them from such positions anyway) to learn and remember an eight character alphanumeric sequence in a day or two. Computer passwords changed frequently: This is added insurance against unauthorized access. No user logs or other computer-related material thrown into trash bins in unshredded form: Your trash is the surveillance operative’s filing cabinet. Material that has been thrown away is a popular source of information relating to computer passwords, log-on sequences, counterterrorist intelligence, infor- mant identity, and so on. Shred such material and dis- pose of in two separate containers at the least. Shred using a cross cutting type of shredder to negate the risk of reassembly. Incinerate in-house where practi- cable and certainly in high-risk situations. No sensitive material left out or in unlocked desks overnight: Discourage personnel from looking upon the official end of their working day as a signal to abandon whatever they were doing in mid-stream. Instead, encourage them to see it as the point at which they replace and resecure all sensitive or valuable material. If necessary, allow per- sonnel to finish 15 minutes or so earlier to accomplish the securing process. Existing material of a high commercial or security value should carry a signature requirement anyway. This means that such material is signed for when withdrawn for examination and returned to its place of safekeeping before the end of the working day. Material actually generated during the day should be handed in for safekeeping in a designated area and a signature (this time from the receiving officer) obtained. References required from contract cleaning, repair, catering personnel, etc., and said references checked: The infiltration of contract cleaning, repair, and cater- 72 TERRORIST EXPLOSIVE SOURCEBOOK REACTION DRILLS AND COUNTERMEASURES 73 ing teams by surveillance and terrorist operatives or the bribing of cleaning team personnel to secure cer- tain items or plant certain devices are popular tech- niques. No contract personnel (in previous item) allowed to work without supervision from in-house personnel Control or monitoring of construction projects maintained with a view to defeating attempts to actually install devices in structure of building: In high-level operations an attempt will be made to either emplace surveillance devices during construc- tion or litter the structure with passive devices (i.e., diodes) which will trigger/confuse detection equip- ment used subsequently. It is also possible that a long term delay IED (or IEDs) may be concealed within the fabric of a new structure. Restaurants and clubs, etc., visited on an irregular, unpre- dictable basis No unique clothing worn or luggage carried habitually Routes to and from often-visited locations varied frequently Times of departure from, and arrival at, often-visited loca- tions varied frequently Close family members or trusted business associates told of the estimated time of arrival at a given location with a view to them initiating an emergency reaction program if arrival is delayed significantly without explanation No political or religious slogans displayed on clothing or vehi- cle bumper stickers Business trips overseas booked in alternate name Times and dates of impending trips told only to those with a definite need to know When driving, no stops made to help apparently stranded motorists or to pick up hitch hikers When traveling by train, empty compartments avoided No political or religious comments or views offered to strangers during the course of casual conversation Telephone answered in noninformative manner such as, “Hello, ” rather than with name or position, i.e., “Mr. Smith, Head of Marketing” In restaurants, broadcast calls to come to the phone or move a car ignored: These are common techniques used to confirm the identity of a target and/or place him in a more vulner- able position for attack. No overt signs of wealth worn when traveling overseas Internally-opaqued envelopes of the type incorporating secu- rity slits (to indicate signs of tampering or opening) used for all mail VEHICLE SEARCHES (SECURITY CHECKPOINTS) Search area designed so as to prevent successful crash through: Symbolic road blocks (such as empty oil drums or sim- ply a sign) are only of use where a temporary VCP (Vehicle Checkpoint) is to be established immediately without warning, and even here road spike strips should be employed as a minimum whenever possible. For per- manent checkpoints, barriers which channel the vehicle into a specific point should be of such a type that to drive into them at speed would disable the vehicle. TERRORIST EXPLOSIVE SOURCEBOOK V REACTION DRILLS AND COUNTERMEASURES 74 75 Two person search team employed: This saves time and (by virtue of the fact that the amount of vehicle to be covered by each person is reduced) lessens the likelihood of areas being over- looked or examined carelessly. Search team rotated frequently: Boredom will cause the search team members to become complacent if a shift is overly long. Frequent rotation ensures fresh and alert personnel. Concealed support personnel covering search area in the event occupants of stopped vehicle attempt to use weapons and/or crash through: Where contextually appropriate, this gives the search team members proper greater confidence and allows them to concentrate on the job in hand. Driver required to turn off engine and exit vehicle: In high-risk areas, both driver and passengers will be separated and, while covered by armed support per- sonnel, questioned as to the purpose of the journey. Each search team member allocated one half of vehicle- each half resulting from an imaginary line drawn lengthwise through the vehicle from front to rear: This guarantees that each team member knows exactly which component parts and areas he is responsible for and negates the risk of one man assuming another had checked “such and such.” Each search team member dressed appropriately for under- body searches: Underbody searches cannot be conducted properly without search personnel actually “getting their hands dirty. The natural desire not to ruin a smart uniform will, although on a subconscious level, cause a searcher to back off from the task at hand. Overalls and gloves must, at least, be available, even if not 76 TERRORIST EXPLOSIVE SOURCEBOOK worn all the time. Use wheeled mirrors for initial or cursory underbody checks only. I Portable explosive sniffing equipment employed during search: Although such equipment may not sniff out all types of explosives or explosives which have been particu- larly well concealed, such devices will facilitate exami- nation of many areas which are inaccessible (short of mechanical disassembly). Detectors are available which will detect hydrogenous material through the metal bodywork of a vehicle. Disassembly bay/area available into which vehicle may be driven for partial disassembly if the initial search provokes suspicion or if intelligence reports have identified a specific vehicle as being worthy of special attention: Many vehicular hiding places can be accessed only via disassembly. As this is time consuming, a dedicated search area ensures that the primary VCP does not become logjammed. External vehicle search commenced with a hands-off check, supported by mirrors, for: % • obvious signs of tampering • hanging or attached wires or packages • items on, behind, or in front of wheels • items resting on exhaust components • items inside the vehicle Security check search then continued to include: • rear of bumper • rear of radiator grill • rear of headlights • engine compartment • windshield washer fluid reservoir • air filter housing • firewall area • exhaust manifold area REACTION DRILLS AND COUNTERMEASURES 77 • front and rear axles • steering, suspension, and braking linkage areas • wheel wells (remove hubcaps) • exhaust pipe/front muffler area • rocker panels • central muffler box • rear suspension/braking component area • rear wheel arch area • gas tank area • valance areas (underbody area be- neath bumpers) • rear wheel trims (to be removed) • inside of rear bumper • trunk • spare wheel to be removed (whether trunk or underside mounted) Internal search areas include: • glovebox • steering wheel and column • under-dashboard area • pedal area and carpets • under-seat area • transmission tunnel area • rear seat cushion lifted out, folded down; rear seats in station wagons raised • space between rear seat upright and trunk area • headlining • interior lights and ashtrays • seat backs, cushions, and covers • door panels popped off studs at bot- tom and lifted to facilitate examina- tion of internal door area VCP cards issued to all cleared motorists, explaining the need for such security measures and apologizing for the inconvenience: These cards should carry a telephone number (answered by machine) which may be called anony- mously to report suspected terrorist/criminal activity. The issuing of such cards goes some way toward reassuring the drivers of stopped vehicles that the searches are necessary and not simply a display or abuse of authority. If only one person out of a thou- sand actually calls the number and reports an inci- dent, the effort is justified. Nearby blast ditch or sandbag shelter available (permanent- entry vehicle checkpoints) in the event a proxy ' or suicide bombing attack is made If random vehicle checks are being made with a view to defeating vehicle bombs, vehicles are selected on the basis of some (although rule-of-thumb) predetermined factor rather than entirely at random: For example, given two identical vehicles, it might make sense to stop the one which (by virtue of its ride height and tire appearance) seems to be the most heav- ily loaded. Likewise, the vehicle containing a female and child can be considered in most situations less of a threat than the one containing two adult males. PERSONAL VEHICULAR SECURITY High-quality alarm should be fitted Vehicle always parked in secure area Garage alarmed to same standard as house Search always undertaken in the event vehicle has been left unattended in insecure area: As an expedient, the security stickers described in the 1 Technique in which an innocent motorist is forced to drive a bomb-rigged vehicle into a checkpoint, having time only to shout a warning and run short distance from vehicle before device explodes. 78 TERRORIST EXPLOSIVE SOURCEBOOK REACTION DRILLS AND COUNTERMEASURES 79 section on access security can be used to seal door, hood, and hood joints. Such tell-tales will alert you to the fact that an attempt to access the vehicle has been made. Photographs of engine compartment and vehicle underside taken for subsequent comparison purposes by security-force personnel not familiar unth the layout (called in the event an initial personal check causes suspicion ) Interior of vehicle kept free of litter, papers, boxes, and other items that might be used to conceal a device LUGGAGE SCREENING Screening machine manned only by skilled operators and test- ed regularly to confirm its ability to identify the likely nature of the items revealed on the screen by virtue of their color Machine regularly tested to confirm continued full-specifica- tion operation and continued operation of any auto alarm Operators rotated frequently to avoid fatigue. Antidistraction technique measures implemented: Typical primary luggage screening methods at the majority of international airports (at which friends and relatives of departing travelers are separated from the screening machine by only a token barrier) are vulnera- ble to distraction techniques initiated by nearby per- sons. Usually, causing the screen watcher(s) to turn away for even a couple of seconds will, by virtue of the quantity of luggage passing through the tunnel at any one time, cause the contents of a bag to be overlooked. Flow of luggage controlled to enable operator to absorb image adequately LUGGAGE STATUS INDICATORS Indicators used to enable other personnel to determine imme- TERRORIST EXPLOSIVE SOURCEBOOK diately traveler/visitor status (searched, unsearched, carrying potential risk items) Indicators noncounterfeitable Status indicator duplicated on traveler’s/visitor’s ticket/pass Checks made on aircraft prior to boarding that status indica- tors match LUGGAGE-EMPLACED IED ISOLATION FLOW CHART Luggage and traveler/visitor physically checked? Yes: proceed No: risk exists; initiate physical search program Electronic/electrical or other risk items discovered? No: luggage allowed to enter system Yes: passenger and luggage isolated for special search Explosive vapor/hydrogenous material or X-ray checks made? Yes: proceed No: risk exists; initiate checks Test negative/suspicions not aroused? Yes: proceed No: summon support personnel Traveler/visitor interviewed by experienced personnel to confirm level of threat, if any? Yes: proceed No: risk exists; initiate interview procedure Still suspicious? No: proceed Yes: disassemble suspect items/hold for further interview REACTION DRILLS AND COUNTERMEASURES 81 Internal components checked by qualified personnel for con- cealed/disguised explosive charge and/or firing chain compo- nents. Still suspicious? Yes: initiate usual detention procedures and investigate further No: luggage allowed to enter system Number of bags checked-in on aircraft cross referenced against number actually loaded, and running total maintained (by for- warding totals to personnel at next leg) through various stages of multi-legflights? Yes: proceed No: risk exists Passengers required to identify luggage on ramp prior to loading OR bag/passenger reconciliations made prior to bags being load- ed ina barcode tagging system or similar proven method? Confirmation made that bag owner actually boards aircraft? Yes: proceed No: risk exists Reaction program prepared for implementation in the event a passenger/luggage discrepancy occurs at any leg? Yes: proceed No: risk exists PHYSICAL EXAMINATIONS OF ELECTRONIC AND ELECTRICAL EQUIPMENT Trained personnel only engaged on such searches Personnel tested regularly to confirm continued ability to locate concealed devices and notice unusual modifications Disassembly team available in the event an external exami- nation provokes suspicion Noncounterfeitable security stickers used to seal disassembled items: This technique should be followed by later external examination of disassembled items (to prevent the subsequent insertion of explosives and/or firing chain components). Items internally sniffed with hand unit for presence of explo- sive-suggestive vapors: A probe head should be available which facilitates at least partial access into small areas. Sniffer unit tested regularly to confirm continued sensitivity to manufacturer’s specifications Specifications of newly available machines obtained and compared with those of existing equipment with a view to upgrading Search area covered by armed personnel armed with weapons suitable for use in crowded areas Damage limitation measures (with a view to rapid, safe con- tainment of a carrier with little or no risk to other passengers) implemented and rehearsed in the event explosive material/ weapons detected Examiner able to identify electronic components correctly Examiner able to distinguish nonstandard and nonoriginal component additions to standard radio/cassette/camera circuits Examiner aware that a function test does not in itself prove or achieve anything: It should be remembered that the mere fact that a radio, cassette player, razor, camera, or similar item appears to operate normally when tested is no guarantee that it is not concealing a terrorist IED. Conversely, an item that doesn’t work deserves no more attention than one that does. Terrorist devices have been deployed housed in (for example) calculators and Walkman radios, which 82 TERRORIST EXPLOSIVE SOURCEBOOK REACTION DRILLS AND COUNTERMEASURES 83 continued to work even when the batteries were removed. This was because concealed batteries (part of the timing/firing circuit) had been installed. A check resulting in the discovery of this type of device would, obviously, be cause for alarm. Overconfidence in devices that do not exhibit these qualities, however, will lead only to a sense of false security. Assume a given item doesn’t function. The owner offers, quite reasonably, the most likely cause as being dead batter- ies. Are suitable replacement batteries or a PSU (power supply unit) available with which the unit can be retest- ed, and does such a retest policy exist in the first place? Even if these questions can be answered in the affirma- tive and the item is retested, what if it still doesn’t func- tion? The owner now suggests (again, quite reasonably) that an internal electronic fault must have developed. Are qualified personnel on hand to disassemble and check the item and locate a legitimate fault? Examiner able to identify improvised batteries Examiner able to identify improvised capacitors: These may be used in place of batteries to provide tim- ing and/or firing power for an IED. I through the frame. Do not rely solely on self-test facilities built in to a machine, as these can also develop faults. Operators trained in use of detector equipment to high stan- dard Unit sensitivity not reduced to increase volume at times of high-traffic density: Doing so is an admission that security is of less impor- tance than profit and/or convenience. Persons passing through search frame required to do so at a speed and frequency within the parameters recommended by the manufacturers: Rushing people through search frames may earn you the thanks of management personnel and alleviate complaints of delays from passengers or visitors, but it will also give the terrorist or criminal a window of opportunity through which those same staff members, travelers, or visitors might be killed. Area covered by suitably armed support personnel in case the carrier of a detected weapon or explosive device attempts to employ it as a means of escape METAL DETECTOR SEARCHES (WHOLE BODY UNITS) High-quality, state of the art unit employed: Sensitivity specifications should be regularly com- pared with that of newly available equipment with a view to upgrading. Unit regularly (30 minute minimum) checked to confirm continued full specification operation: Implementing this degree of checking adds only seconds to the hourly workload of operators or other staff mem- bers. It can easily be accomplished simply by having an operator in possession of a suitable test item pass ALL items removed from pockets of persons triggering the alarm: Objects calculated to trigger the detector may be used deliberately to divert attention away from other pro- hibited items. ALL such items physically checked: The practice of having the searchee place items in a tray, and then retake the metal test, without checking exactly what items were removed, is dangerous, although quite common. It renders the whole exercise redundant. Assign an additional person to check removed pocket contents, if required. 84 TERRORIST EXPLOSIVE SOURCEBOOK REACTION DRILLS AND COUNTERMEASURES Passenger now subjected to a localized (hand held) metal detector check Such persons then required to clear whole body scan again before retrieving pocket contents: This is simply insurance against an operative missing some concealed item with the hand-held check. “Sorry for the inconvenience” cards issued: Such cards (carrying a simple apology for any delays and an explanation of why searches are necessary) real- ly do help with public relations. A telephone number may be included which passengers may call with sug- gestions for improvements in the security arrangements. METAL DETECTOR SEARCHES (LOCAOZED/HAND-HELD UMTS) Unit employed of a high quality, and its specification regular- ly compared to that of newly available units with a view to upgrading Operator highly trained in use of unit Search encompasses all of search ee’s body and (as applica- ble) possessions: Body searches to include footwear and crotch area. Not searching an area of the body thoroughly for fear of causing embarrassment gives yet another window of opportunity to the terrorist who will play on this understandable concern to avoid annoying travelers. Similarly, not searching areas which have proven in the past to provoke detection signals by virtue of their legitimate construction is dangerous. In the case of footwear, for example, it may well be the metal nails and (especially in the case of women’s high-heeled shoes) internal support rods that are triggering the unit, or it could just as easily be a concealed detonator. Thus all such signals should be investigated. Searchee possessions which are obviously metallic or have some metallic content are physically checked: Innocent metal/metallic items can be used as a cover for various explosive components and other contra- band items. The foil insert and metalized boxes of cigarette packets are just two common examples. These items are hardly ever physically examined by detector operators after they have been isolated as the source of a signal. New, unopened cigarette packets are never, to the best of my knowledge, opened. Doing so would, of course, provoke no end of passen- ger/visitor complaints. Search speed and distance from searchee ’s body are within the parameters specified by the manufacturer: The recommended operating technique for all detec- tion equipment must be followed in order that the equipment can perform properly. Unit checked regularly to confirm continued sensitivity Facilities on hand for physical examination of persons trigger- ing detector circuit by virtue of metallic surgical implants Facilities on hand for the X-ray of plaster-casted limbs trig- gering the detector circuit due to concealed metallic splints/pins, etc. ADDITIONAL STORE/SHOP SECURITY (ANTI-WEAPON DEPLOYMENT/ANTI-BOMB EMPLACEMENT) Initial search of shopper and bags at entrance includes use of hand-held metal detectors Customers’ existing shopping bags labeled and left in secure, blast-proofed area close to entrance Thorough search of nonsurrenderable bags (i.e., handbags containing money, purses) TERRORIST EXPLOSIVE SOURCEBOOK REACTION DRILLS AND COUNTERMEASURES 86 87 Customers issued identification tag keyed to surrendered bags which must itself be surrendered upon reclaiming bags upon leaving the store Baskets/carts provided for carrying of in-store purchases Video observation/recording in use Separated entrance and exit points Bomb blankets available to contain discovered devices Adequate fire-fighting equipment on hand Antiblast curtains or shatter-resistant film in front of (or attached to) windows One or two example display items left open and remainder of the displayed stock kept sealed: This enables rapid and simple checking for concealed devices to be made. Pre-closing search for concealed devices undertaken TERRORIST EXPLOSIVE SOURCEBOOK Conclusion D espite the publicity (which is, after all, the main rea- son why many terrorist IEDs are deployed), the dan- gers posed by acts of terrorism to the average American citizen are small. Even in the U.K., with its history j of IRA/PIRA/INLA bombings and attacks, the number of yearly suicides exceeds that of the number of people — civil- ians, police, or soldiers — that are killed by terrorists. Once we start looking at statistics involving the number of deaths ; in (for example) car accidents compared to the number of ' deaths at the hands of terrorists, the odds of anyone not ; obviously involved in a particular confrontation becoming ■ the victim of a terrorist attack pale into insignificance. The fact that the risk is small, however, does not mean it should be discounted. Who knows what new extremist ! groups will emerge in the future, and who can guess what their motivations and therefore their targets might be? Further, it is surprisingly easy to find oneself suddenly bumped up into a much higher risk group than the average citizen by virtue of a job change, a marriage, a house move, a poorly timed visit to some other country, or an unexpected govern- | ment decision to apply sanctions or military pressure to some f foreign regime which has sympathizers here at home. The most likely exposure to terrorism is via an IED. The , terrorist IED (wKfiSh, ' if we are honest, can be defined as any | IED which has not been planted by the guys on our side) 1 might be found almost anywhere: under or in your car, in your garden, or on the shelves of a shop. It might come through the mail or be left on your doorstep. It might be left in a phone booth, in a trash can, in a drain, a culvert, or in an 89 abandoned briefcase, and so on. A device is likely to be camouflaged and/or concealed so that, except in very rare instances, you will not immediately know what it is. In 19th century London you may have come across a large round object with a burning fuse sticking out of it: the classic anarchist’s bomb. Leaflets were issued during the period telling people not to touch such objects if they found them. Obviously an inquisitive lot, the Victorians. You might, instead, have found a stack of small barrels of gunpowder or a more sophisticated device based around a clockwork mechanism. In any event, it would be apparent to all finders just what the objects were. From the terrorist/anarchist point of view, early IEDs were difficult to move and deploy without causing suspi- cion. Even the development of dynamite didn’t really facili- tate the construction of particularly small or easily concealed devices. This is not to say that the terrorist/anarchist of those days was without ingenuity or cunning, or was any less cal- lous about killing or injuring persons unrelated in any real way to the source of his grievance. It was simply that the technology available at that time was limited. Today, however, with a wealth of sophisticated electronic circuitry and powerful explosives like C4 (PE4) and the famous SEMTEX available, extremely small, silent, inconspic- uous, yet very deadly devices can be constructed with ease. SEMTEX, by the way, is not the super explosive that the media claim it to be. It is powerful all right, but no more so than the standard British or American military plastic explo- sives. SEMTEX is actually a mix of two other explosives: PETN (pentaerythrite tetranitrate) and RDX (cyclotrimethy- lene or cyclonite). PETN is the usual filling in British and U.S. army det cord, and RDX is really PE4 or C4 without the plasti- cizer. In C4 the RDX is mixed with about 9 percent inert plas- ticizing material. The relative effectiveness of PE4 and SEM- TEX is similar (see Chapter 3), but SEMTEX tends to bleed more. In other words, it sweats its plasticizers, thereby losing some of its plastic quality. C4, on the other hand, bleeds hard- ly at all, even under poor conditions. Thus, in reality, C4 is preferable to SEMTEX. The reason that many terrorists have Vf > fe ' H; used SEMTEX is because it was manufactured in Czechoslovakia in vast quantities and distributed to ifiterna- tional ter rorist groups via the old S ovic t/Eastem Bloc regime. It is often asked why, if SEMTEX is so powerful, do the IRA (for example) use bombs weighing literally thousands of pounds? Firstly, the really huge bombs referred to in media reports are based on improvised explosives rather than SEM- TEX or its equivalent. For example, a pop ular imp rovised explosive in Ireland, is made from nitrate-rich fertilizer sensi- tized with fuel oil, known as ANFO explosive. In a highly rural area such as Ireland, both of these components are plentiful and can be obtained, stored, and moved quite legal- ly. Moves were made to more rigorously control the sale of ammonium nitrate fertilizer in Northern Ireland, and at the time of this writing, a small but vociferous lobby in England is calling for ammonium nitrate fertilizer to be made subject to the same controls as explosives proper. As there are some 4,000 other readily available products and materials from which an explosive may be improvised (most of which can be purchased from the local variety store, hardware store, or gardening center), it is open to debate how effective in curb- ing the deployment of IEDs any such legislation would be. By using material such as ammonium nitrate or any num- ber of other “nonexplosives,” the terrorist is able to create large bombs very cheaply and with little, if any, risk of arous- ing suspicion. However, as the power available from such material is but a small percentage of that available from com- mercial or military high explosives proper, it must be used in far greater quantities to achieve a given effect. This places some constraints on just where such devices can be deployed and (in the case of any bomb weighing more than several scores of pounds) usually means a vehicle bomb of some description. As the terrorist will have to deploy this vehicle bomb far enough away from the target to avoid being detect- ed while still having a hope of achieving the desired effect, the weight of such devices is invariably huge. If security mea- sures prevent an operative deploying a carefully placed 1- pound charge inside a target building, a 100-pound device in a vehicle in the street outside will be the obvious alternative. 90 TERRORIST EXPLOSIVE SOURCEBOOK CONCLUSION 91 Seemingly excessive amounts of explosive will also be used in a particular attack if (1) the explosive material itself is starting to deteriorate because of prolonged storage and must be used or abandoned, or (2) simply because the attack is being perpetrated with a view toward publicity only, rather than with the intention of destroying some particular tactical target, i.e., a strategic rather than a tactical device. As an indicator of the power of C4/PE4/SEMTEX, a quar- ter-pound charge of such an explosive will completely destroy a typical large car or destroy (or at least render structurally unsafe, depending on its placement) the average brick house. A2-ounce charge will prove more than adequate for the majority of antipersonnel booby trap devices. The power of commercial or military plastic explosives, then, being such that even a very small quantity will kill or cripple, means that modern IEDs may be camouflaged as almost any innocent looking object and concealed in the most unlikely of loca- tions. This is why they are often overlooked. They are also overlooked because the searcher or searchers haven’t got a clue what they’re doing, are poorly trained, or are careless. Devices, as we have seen, may be designed to fire in any number of ways. Although not discussed in detail in earlier chapters by virtue of its unique status, the most obvious tech- nique is command detonation. This means that the device is actually fired by the terrorist himself, often upon receipt of a signal from an observer (or series of observers, if the distances involved are great) when the target reaches a predetermined point. When this happens, a signal is given and the switch thrown. The explosion is instantaneous. Such a bomb may be connected to the firing switch by wire or it may operate by radio control. Simple radio-controlled bombs are easy to make but dangerous to deploy because of the risk from stray radio signals. Such signals may cause the device to fire prematurely. Equipment is also available to security force personnel (and to the public, via certain outlets) which sets up block- ing radio signals to prevent those from the bomber’s trans- mitter getting through or cause the device to fire prematurely (in some case while it is still in the hands of the bomber). An improvised version of such equipment takes the form of a radio-alarm pager and a high-power RF amplifier. The princi- ple of operation here is that an attempt to attach an electrical detonator-based IED to a vehicle thus equipped will trigger the pager alarm and cause the amplified radio signal to be transmitted. At such close range and with a high power sig- nal, the RF currents induced into the detonator are sufficient to cause it to fire prematurely. However, because various measures can be taken by the experienced bomb designer to lessen (or negate totally in most circumstances) the risk of premature detonation due to induced currents, total reliance must never be placed in such systems. So, having seen that IEDs may be concealed in almost any innocent-looking object, any or all of which may be designed to explode at a given time and/or when moved in some manner or when activated by the bomber himself, how do we recognize them? And what do we do if we find one? The answer to the first question is that we probably won’t recognize a device for what it is immediately. An exception would be the cassette incendiary that we might find concealed among clothing in a shop, or a vehicle bomb that we might find in a small plastic box secured with magnets to the bottom of our car. For the most part, though, all that we will have to go on is suspicion. Suspicion is a double-edged weapon. Used intelligently it saves lives. Used indiscriminately and with poor judgment it wastes time and can provoke the “boy who cried wolf’ syndrome. Context, then, is all important. Don’t assume every unidentified item you come across is an IED. On the other hand, don’t ignore anything that could be a device. A middle ground between paranoia and complacency needs to be found. Intelligent, contextually-appropriate decisions will need to be made on the basis of your suspicions. So, you open a phone booth door and find a shopping bag sitting there. Do you automatically assume it is a terrorist bomb? No. Do you discount the possibility totally and kick the bag aside or rifle through it for valuables with the inten- tion of finding some ID (so you can return the bag to the owner, of course)? No. Does the thought that it might be a bomb cross your mind and start you thinking about your best course of action? Yes. 92 TERRORIST EXPLOSIVE SOURCEBOOK CONCLUSION 93 You might think this is obvious, but watch the TV next time the cops are searching for a bomb. Watch how some guy’s search technique seems to be based on the theory that all bombs sport a sign to that effect written in big fluorescent letters. Pray they never actually find a booby trapped device. It’s almost as if they know there is no pull wire, pressure- release switch, light-activated system or other trap mecha- nism attached to the bomb they’re looking for. This suggests one of two things: (1) either they planted it, or (2) they don t expect to find a bomb anyway. The latter being the most likely, why bother looking in the first place? Successfully dealing with IEDs and related acts of terrorism calls for an all-or-nothing approach. There’s no such thing as being a bit careful.” You either are or you aren’t. So, you’ve started thinking. But on what are you going to base your decisions and actions? Well, all we can really consid- er at this stage is the context of your discovery. For example: • Is the phone booth (or wherever you find a suspicious item) near a govern- ment building? • Is it near a military base? • Is it near any other place that could conceivably be a terrorist target? • Have the press been reporting other incidents recently in which bombs were planted in the same sorts of places? • Are there people nearby to whom the bag might belong? Now, this doesn’t mean that a terrorist taking the shop- ping-bag bomb somewhere else has not had a change of heart or spotted a nearby policeman and abandoned the bag in a hurry so that it ends up in place that cannot be sensibly linked to any logical target. Such bombs have been found in the past in very unlikely places. As a basis for suspicion, however, and in the absence of other indicators, context is a good place to start. 94 TERRORIST EXPLOSIVE SOURCEBOOK Okay, another example. You’re visiting the local shop- ping center at mid day and you see an abandoned shopping bag under a seat. Would it be reasonable to automatically assume that it is concealing a terrorist device? No. Although without actually checking, it cannot be said that the bag doesn’t contain an IED, nevertheless (in the absence of other indicators), how likely is that to be the case? It is more prob- able that some innocent shopper has mislaid it. We can turn that around, of course, and say that you now recall the newspapers’ report of an incident last month in which a bomb was discovered in similar circumstances. An aggrieved ex-employee of the center had apparently sent a warning letter. Yes, now that you think about it, the type of bag does seem familiar. So, what about your level of suspi- cion now? It’s increased, right? Right. But wait a minute. If anything was wrong, surely someone else would have ‘ noticed it and done something, right? Wrong. Instead of thinking along those lines, try: i • What if you are the first person on the scene after the bomb was planted? • What if everyone else who noticed it and related it to the newspaper re- ports thought the same thing? • What if while you’re walking away and justifying your lack of action, the onboard delay system is eating away at the time the EOD team could have been using to contain the device or I clear the center? i i' In the absence of other information or indicators, then, intelligent, contextually appropriate reasoning is the only thing that can shape your decision. Factors to be considered will include things like: How long has the package been there? If practicable and applicable, make a few quick inquiries of nearby shop staff or other people in the center. Had they noticed the bag? Did they see anyone leave it there? If during the course of these inquiries someone comes CONCLUSION 95 and claims the bag or even steals it — so be it, it’s not your problem. If you are a civilian and can attract the attention of a nearby policeman or security officer, do so. Let him have the responsibility for subsequent measures. It’s partly what he gets paid for. So, now we’ve arrived at, “I really think it might it be a bomb. What should I do?” The bottom line here is that if you really (after consideration of all factors) suspect that some item might be a bomb and you cannot quickly make your concerns known to a police officer or other security profes- sional, then use the nearest phone to call the police or your local army base or ask someone else to do so. If you are the security professional, take charge: clear the area, assign oth- ers to keep the area clear, and notify the authorities. The police or army will not be angry with you if it turns out to be an innocent item. You can probably, however, expect a degree of investigation, as there are, sadly, a few lunatics out there who like to make hoax calls. In any event, a few very basic rules should be remembered: • Never touch or move an item you suspect • If practicable, prevent others from moving the object • If practicable, clear and cordon off the area • If the item has been discovered at your place of work, take control and prevent others from entering the area. Assign someone to get the manager or senior staff member, but don’t wait for his/her arrival before implement- ing initial damage limitation measures • Call the police or assign someone else to call them • If you feel genuinely worried, or find an item so obviously a terrorist device that there can be no doubt, hit the nearest fire alarm button % TERRORIST EXPLOSIVE SOURCEBOOK Now, if you find a device stuck to the bottom of your car or a suspicious package hidden among clothing in a shop, it will not be hard to take control and initiate the required mea- sures. If you find a device in a public place, however, it will obviously be harder. Hence the “ if practicable clause. If try- ing to clear or cordon off an area is likely to provoke panic or encourage the usual idiots to mess with the suspect item (in other words, do more harm than good), walk away and explain your concerns to the nearest police officer or securi- ty guard. You can do no more. I CONCLUSION 97 APPENDIX A ► ◄ Letter/Package Bomb Precautions Flowchart A ssuming the letter/parcel is not expected and X-ray or explosive scanning facilities are not available, fol- low this procedure: (1) Check postmark and external details. Suspicions aroused? No: continue Yes: call police (2) Check gently for elasticity and/or the presence of sprung components. If the size and shape of the package implies a book or papers, but a gentle bending test indicates a lack of springiness or (in the case of a simple envelope) the presence of a sprung bar or such is felt, treat the package with caution. Suspicious? No: continue Yes: call police (3) Check the envelope carefully for greasy marks and odors. Suspicious? No: proceed Yes: call police (4) Check letter/package with small metal detector. Suspicious? No: proceed Yes: call police (5) Spray envelope with X-ray spray (electronic component freezer spray 99 will suffice as an expedient). Anything unusual rendered visible? No: proceed Yes: call police Note that the use of this spray is dis- couraged by some people due to con- cerns that the spray liquid might reduce the tensile strength of the envelope sufficiently to allow the internal firing components to func- tion. I am of the opinion that if the envelope material were so thin, and/or the actuating mechanism so designed to be held only by the enve- lope itself, then the presence of the mechanism would be readily deter- minable by an external physical check of the envelope anyway. (6) Open letter/package carefully by cut- ting off a thin strip from the top. Try to get an idea of the contents before pulling them free. Suspicious? No: continue Yes: call police (7) Carefully withdraw the contents part way. If the contents are of such a type that withdrawing them completely will allow covers or flaps to spring open, abandon and call the police. (8) If, while attempting to withdraw the contents, resistance is felt, stop, aban- don, and call the police. Remember that intelligent, context- sensitive interpretation of these and all security measures is essential. too TERRORIST EXPLOSIVE SOURCEBOOK APPENDIX B IED Component Recognition Guide POWER SOURCES (1) Batteries may or may not have an external wrapper, label, or printed legend that indicates their purpose. (2) NiCad battery packs of the type used in portable telephones, computers, radio-controlled models, and video cameras frequently do not have any external indicators of their presence. Similarly, standard-looking (cylindri- cal, flashlight-type batteries, etc.) are available in a plain case. (3) The battery terminals will not always be readily apparent. Terminals may sometimes take the form of a small socket or a small plug. (4) Most batteries can be disassembled and the internal cells removed and dis- guised. Flat, circular lithium batteries may be disguised as a stack of coins. (5) The internal picture (when viewed with an X-ray system) of a battery pack will comprise a series of closely interconnected cells. These may be square, rectangular, or circular. In the case of some NiCad packs, a small current-limiting resistor may also be present. Single-cell batteries and flat- 101 pack batteries of the type used in Polaroid cameras may be easily dis- guised and may present a confusing X-ray image. (6) Capacitors (especially electrolytic capacitors) are easily used in place of batteries proper in the firing circuit of an IED. Removing a battery pack power source from electrical or elec- tronic equipment is not, therefore, any guarantee that a potential terrorist device has been rendered safe. (7) Batteries and capacitors may be easily improvised. Improvised batteries may consist of any number of small or large plates or disks of dissimilar met- als, separated by an electrolyte- impregnated substance. Connection to the circuit is by the first and last plates of the stack. An alternative design uses the plates of dissimilar metals suspended in an insulating container which contains the elec- trolyte in solution. Improvised capaci- tors may be made from plates or sheets of conductive material (cop- per, foil, etc.) sandwiched between plates or sheets of nonconducting material (glass, plastic, etc.). The ulti- mate value of the capacitor can be calculated by means of an equation relating to the size, type, and number of the conductive material and the size, type and dielectric strength of the nonconducting material. (8) Several metal-cased batteries may be compressed in a vice to two-thirds or even half their original width or thick- ness without affecting their perfor- 102 TERRORIST EXPLOSIVE SOURCEBOOK mance. This makes it possible for the terrorist to conceal such power sources in areas that would otherwise be too small. TIMING DEVICES (1) Timing devices may take many forms. They may be electrical, mechanical, electronic, chemical, electrochemical, electromechanical, and so on. Of the integrated circuit family, the 555-type timer is the one most often found. (2) Extremely small integrated circuit (IC) devices exist which (if cleverly con- cealed among the usual circuitry of an item of electronic/electrical equip- ment) will only be located through a careful physical check. (3) Electrochemical timers may take the form of a small button-shaped com- ponent similar to a watch or hearing aid battery. SWITCHES AND SENSORS (1) IED switches may be extremely sophisticated or unbelievably crude. The crudity or sophistication of a switch, however, is no indicator of its effectiveness. (2) The switches that are difficult for even the practiced professional to locate are, again, those which take the form of commercial electronic devices. This is because they are easy to conceal among the legitimate cir- cuitry of commercial equipment. i IED COMPONENT RECOGNITION GUIDE 103 DETONATORS (1) Detonators (blasting caps) may be electrical or nonelectrical. The only real difference between the two is the presence of two connecting wires exiting the detonator at its top. (2) Detonators may be metal, card, plas- tic, or even glass-bodied. (3) Typical (average) detonator dimen- sions are .25” x 2.25”, but detonators as small as 10mm long and 5mm in diameter do exist. (4) Detonators may also be compressed slightly to reduce/alter their profile. (5) Detonators may also be improvised. In this case they may not, necessarily, be cylindrical. (6) In an IED configuration, nonelectrical detonators may be crimped to a short length of time fuse or have some type of spark/flame-producing device or mechanism attached to the open end. Nonelectric detonators may also be modified to operate electrically through the attachment of a smoke- less/black powder-filled bulb or fly- ing model rocket engine igniter. (7) Electrical detonators will be attached indirectly to a power source. Typi- cally, one of the detonator wires will connect directly to the power source, the other to some switch, sensor, tim- ing device, or relay. (8) Electrical detonators (or nonelectrical detonators modified so as to fire elec- trically) can easily be installed in an IED so as to fire if any interconnect- ing wire is cut. (9) Detonators may be easily concealed inside metal pens, for example, or disguised as legitimate circuit compo- nents. (10) A detonator and very small booster charge of explosive may be hidden in one object, the main explosive charge in another. The close proximity of the two items will be sufficient to deto- nate the main charge. In other words, the detonator may not always be physically connected to the main charge. CIRCUIT INTERCONNECTIONS IED circuit interconnections may be accomplished by means other than traditional hard-wiring. The most li kel y alternative i&«>ndqctive silver paint. This is a solution of pure silver which may be painted onto a surface with a fine brush or drawing pen. When dry, the resulting track may be painted over for concealment purposes. Interconnections might also be made by foil of the type used in window alarm circuits. IMPROVISED EXPLOSIVES (1) Explosives may be improvised from many commonly available materials. Many books exist which detail manu- facturing processes. (2) Many commercial explosives, or their improvised equivalents, may be dis- guised to defeat searches. Certain types of explosive can be rolled so thin that they resemble filo pastry. This makes them extremely difficult to detect. (3) On the subject of pastry, certain explosives can actually be mixed with 104 TERRORIST EXPLOSIVE SOURCEBOOK ED COMPONENT RECOGNITION GUIDE 105 eggs and flour and cooked into forms resembling innocent foodstuffs. (4) Explosive material may also be cast into decorative objects (statuettes or wall masks, for example). Such items may also be painted and glazed. v (5) Other types of explosive may be made into a solution. Many items, especially rolled up newspapers, may then be soaked in the solution. Upon drying, the newspaper can be detonated with a standard cap. (6) Several types of explosive-making chemical may be transported separately and recombined on site, as it were, to produce the explosive proper. Opera- tives should be aware of the relevant chemicals (see Chapter 3), especially those which are in common use for quite legitimate purposes, and note their presence during searches. The subse- quent arrival (in the luggage of a com- pletely different passenger, for example) of related chemical products should provoke additional investigation. (7) Certain truly liquid explosives exist, which, being cap-sensitive (i.e., they will detonate only when initiated with a detonator), may be transported safely in, for example, a beer or medicine bottle. (8) Flexible, solid, explosive foams (FSEFs) exist that may take various forms. Broadly speaking, any shape that might be produced by aerosol shaving foam is possible. A physical appearance similar to expanded is typical. 106 TERRORIST EXPLOSIVE SOURCEBOOK APPENDIX C ► ◄ X-Ray Detection and Analysis Quick Reference Chart MONOCHROME/GRAY-SCALE MONITOR (1) Is there a slim mid-gray or black cylin- drical or oval tube shape visible? 1 (2) Are there any dark blobs or patches visible on the tube? (3) Are there thin mid-gray or black lines, narrow strips, or lines of a varying , thickness connecting to it? 2 (4) “ Aside from the cylinder, are there any indistinct or fuzzy areas of a pale gray or mid-gray color? 3 (5) Are there any small rectangular, round, or cylindrical shapes (singly or in small groups or stacks) which are mid-gray with black or darker out- lines, centers, or patches? 4 If suspicious, isolate the package, clear and cordon off the area, and notify the police or security forces. 1 Possibly indicating a detonator. ' 1 Possibly indicating wire, foil, or conductive metal paint interconnections. 5 Possibly indicating explosive. ' Possibly indicating a battery or batteries COLOR X-RAY INDICATORS Typical color X-ray systems will give the following indica- tions: (1) Low-density organic materials (such as drugs, explosives, liquids, plastics, fabrics, paper, foodstuffs) will display as shades of orange. (2) Medium-density organic and inorgan- ic materials (such as dense plastics and light metal alloys) will display as shades of green. (3) Dense inorganic materials (such as dense metals and glass) will display as shades of blue to black Operators should be aware that “cam- ouflage” techniques exist which will defeat color X-ray systems, and many innocent items resemble in form and color potential threat items. 108 TERRORIST EXPLOSIVE SOURCEBOOK APPENDIX D Threat Call Card KEEP NEAR TELEPHONE QUESTIONS TO ASK When will the bomb explode? What will make it explode? Where is it?. What does it look like? What sort of bomb is it? Did you plant it? Why? Code word given by caller: Wording of threat (if not tape recorded): 109 Time: Date: Voice Features and Language (Circle as appropriate) Male Female Accent Muffled Familiar* Definitely Known* Disguised Calm Angry Whispered Slurred Crying Laughing Nasal Stuttering Lisping Rapid Slow Soft Loud Coughing Educated Obscene Taped Message Incoherent Cracking Raspy Excited Young Old Other* Obviously Disguised Electronically Reading from script. Obviously ‘Details: Background Sounds and Noises (Circle as appropriate) Factory/Office/Traffic/Voices/Music/Restaurant/Farm/ Plant/Aircraft/Trains/Static/Sports/Children/P.A./Other* •Details: Threat Reported to: _ Your Name: Your Position/Rank: . Your Phone Number: 110 TERRORIST EXPLOSIVE SOURCEBOOK Hand Clearance Sequence Reference Chart r he following information is only for the benefit of con- tract military personnel or for security personnel oper- ating in a paramilitary role. Such personnel, by virtue of the environment in which they are operating, may occa- sionally be unable to exercise the infinitely more preferable “don’t touch, call the security forces” principles applicable elsewhere. This is because such personnel themselves will actually be part of what passes for security forces. This state of affairs was found by the author to be preva- lent in certain areas of the former Yugoslavia during a period of employment there as an instructor/advisor in 1993. Foreign volunteers and conscript indigenous personnel alike frequently found themselves in mined and booby trapped areas that had to be cleared before operations could contin- ue. With no prior exposure to such devices, a trial and error system of disarming or neutralizing was the only available option. Needless to say, casualties were high. Casualties among friendly forces were also caused because of a failure on the part of the more inexperienced personnel engaged in offensive booby trap and mine opera- tions to accurately (or even inaccurately!) record the loca- tion of emplaced traps and the applicable technique(s) for neutralizing or disarming them. An absence of such infor- mation also renders post-war clearance by international government or government-sponsored agencies more haz- ardous. With these factors in mind, Appendix F briefly cov- ers offensive operations. Hand clearance involves the location, neutralizing, removal, and disposal of traps without damage. All sequences in start with an examination of the device from all possible angles with a view to determining the type of firing device(s) present. Likely sequences include: Traps with an accessible firing device connected by fuse or det cord to the charge: (1) cut or disconnect fuse or det cord between the device and the charge, then (2) remove the charge a sufficient dis- tance away to negate risk of sympa- thetic detonation, then (3) neutralize the device proper, remove it, and remove any detonator firing assembly, then (4) remove any detonators from the charge, dispose of charge and device Traps with an accessible firing device connected direct- ly to the charge: (1) neutralize the device, then (2) remove the device from the charge, then (3) remove any detonator, dispose of device and charge Traps with accessible fuse or det cord connections but with inaccessible firing devices or firing devices with- out obvious safety features: (1) cut or disconnect fuse or det cord between charge and device, then (2) remove charge to sufficient distance to negate risk of sympathetic detona- tion, then (3) activate the device remotely, then (4) remove any detonator from charge, dispose of charge and detonator Completely inaccessible traps will be marked and dis- posed of by other means. 112 TERRORIST EXPLOSIVE SOURCEBOOK No traps will be hand cleared when other options can be selected. IMPORTANT HAND CLEARANCE NOTES (1) Always check for possible electrical initiation before cutting a slack trip- wire. Remember, monofilament wires can be used to hold open an electri- cal circuit. (2) Never cut a taut tripwire. Use non- conductive cutters when cutting any wire to negate the risk of momentari- ly completing an electrical circuit. (3) When pulling a tripwire device, place the grapnel behind and close to the wire, but do not allow it to actually touch the wire until you are behind cover. (4) Be aware that alternate firing devices may be concealed inside explosive charges. (3) Treat individual sections of a trap/IED with care, as any or all of them may incorporate separate firing or actua- tion systems. (6) Replace each safety device (or insert/ apply an expedient safety device) in every apparent mechanism. (7) Disconnect a battery before replacing a safety pin. Devices may easily be set to operate when a metal pin com- pletes an electrical circuit. Non- conductive pins will negate this risk. (8) When presented with a clear choice, cut det cord or safety fuse connec- tions in preference to power supply connections. But note warnings in numbers ten and eleven, below. HAND CLEARANCE SEQUENCE REFERENCE CHART 113 (9) When severing electrical leads (which will only be done when it has been established beyond a doubt that it is safe to do so), always remove a sec- tion rather than just make a cut. (10) Be aware that a taut length of det cord might be connected to a pull or tension release switch (as per a taut tripwire). (11) Be aware that a length of det cord or safety fuse may be a dummy conceal- ing an electric wire. Test det cord or safety fuse for metal content before cutting (if suspicious). (12) After initial pulling of device (per- formed with a view to avoid trigger- ing antihandling circuitry, etc.), incor- porate as many periods of unattended observation as possible into the sub- sequent disarming procedure. 114 TERRORIST EXPLOSIVE SOURCEBOOK Offensive Operations The following operations are for the benefit of contract military personnel only. PLANNING BOOBY TRAP OPERATIONS Before implementing a booby trap operation, an outline plan will be made based on: (1) what is to be done, when, where (2) by whom (3) coordination of the booby trap opera- tion(s) with the overall tactical plan (4) effects required (i.e., enemy morale re- duction, destruction of equipment, media publicity but no loss of life, etc.) (5) availability of resources (6) known habits of enemy/target (7) enemy security measures likely to be encountered (8) enemy ability to deal with traps PRE OP BRIEFING A preoperation briefing (based on the outline plan) will be given to all involved personnel. The briefing will specify: (1) the purpose of the operation (2) its starting and finishing times (3) control measures and safety precautions 115 (4) organization of teams and allocation of specific tasks (5) materials and tools available (6) who is to record the location of the traps (7) who is to arm the traps (8) what action will be taken in the event of enemy contact (9) marking and protection of traps while friendly troops are still in the area (10) known enemy policies and habits REHEARSAL Whenever practicable, a rehearsal will be undertaken before the operation proper with a view to revealing poten- tial problems and familiarizing personnel with equipment, devices, and control and safety measures. INSPECTION OF MECHANISMS Firing devices, circuits, and all related equipment must be checked and tested for correct functioning before use. Electrical detonators must be tested by removing the shunt (or untwisting the wire ends) and attaching to a blasting con- tinuity meter or similar low-voltage tester. Testing electric detonators with improvised testers based on higher powered batteries may cause a detonator to fire. SETTING TRAPS Mechanical Traps will be set in the following manner: (1) Lay the charge (2) Fix the firing device in place (3) Prepare for the connection of the charge to the firing device by either: a) fixing a coupling base assembly to the detonator, or b) connecting the fuse to the firing device and crimping a detonator to the other end (detonator and charge kept separated), or c) connecting a length of det cord to the firing device detonator and another length to the charge (both lengths to be kept separat- ed until arming is required) Electrical Traps (1) Lay the charge (2) Check nonexplosive circuit operation to confirm that no current flows when the arming switch and trap switch are in the “off’ state, and that no current flows when the arming switch alone is then moved to “on.” Confirm that current does flow with the arming switch on and the trap switch activated. This is most easily achieved by connecting a bulb (of a type that has similar current/voltage requirements to the detonator) in place of the detonator and activating the trap momentarily. Return any arming switches and the trap switch proper to off, reset any timer system, remove battery(ies), and discharge any capacitors. (3) Prepare for the connection of the charge to the firing device by replac- ing the bulb with a detonator, or (4) Replace the bulb with a detonator and attach a length of det cord to it, then install the knotted end of anoth- er length of det cord in the charge. Both lengths should be kept separate. 116 TERRORIST EXPLOSIVE SOURCEBOOK IED CONSTRUCTION PRINCIPLES 117 ARMING TRAPS Mechanical Action (1) Remove safety devices 1 (2) Insert the detonator into the charge or connect the two lengths of det cord with tape or det clips (3) Camouflage the fuse or det cord as required Electrical Action 2 (1) Install battery(ies) (2) Place arming switch (if used) in “on” position. (3) Insert detonator into charge or con- nect two lengths of det cord. MARKING If friendly personnel are likely to encounter the booby traps, they will be marked in some covert manner. A small pile of stones, a certain piece of graffiti on a nearby wall, a tree branch bent in a certain way, etc., can all be used as expedient markers. RECORDING The precise location and actuating principles of all traps will be recorded. A suitable form for these records follows in Appendix G. 1 Note that when using detonation cord or fuse interconnections, the safety devices should be removed last. There may be other situations in which it is safer to remove a safety device first. The individual will decide which technique he feels affords him the greatest margin of safety. 'The laying and arming of electrical devices will often be combined into a sin- gle process in which the trap is assembled in its entirety less the batteries. A check is then made with a low voltage (blasting) continuity meter to ensure that no continu- ity exists. The batteries are then installed. 118 TERRORIST EXPLOSIVE SOURCEBOOK APPENDIX G Sample Booby Trap Placement Record Page 1 of (No.) TECHNICAL RECORD OF TRAPS LAID AT (LOCATION) MAPS: (identify map(s) from which following information is drawn). GENERAL DETAILS (1) Boundaries of Area Trapped (map references): (2) Laying Team: (3) Authority: (4) Laying Started: (5) Laying Completed: (6) Total Number of Traps: (7) Trap Positions: a) b) c) d) e) SPECIFIC DETAILS (1) Position (marked as “A” in appendied diagram) a) firing device (type) b) set for (type of actuation) c) location and type of charge (2) Triggered by (specific details on how device is triggered) (3) Neutralized by (specific details of how to neutralize the device, or, if no facility for neutralization exists, how the device should be dealt with in the event it has to be recovered or rendered safe by friendly personnel: (Appended diagram will take the form of a simple sketch, as viewed from above, of the location of the trap(s) in relation to its surroundings.) 119 Actuate: To cause a device to function as designed. Activation Energy: The minimum amount of energy required to initiate a reaction in a chemical system. Adiabatic Heating: In thermodynamics, an effect in which no heat enters or leaves the system. Adiabatic compres- sion of a gas causes heating, adiabatic expansion causes cooling. Ampoule: A small glass container holding (in this context) acid or a liquid chemical. AN: Ammonium nitrate. AP: Ammonium perchlorate. Arming: The changing from a safe condition to a state of readiness for initiation. Base Charge: In a compound (composite) detonator, the amount of secondary high explosive present. Battery: A cell or series of cells supplying direct electrical current. Blasting Cap: Known also as a detonator or cap. A small explosive device used to initiate detonation in explosive charges. 121 Blasting Machine: A handle-operated, impulse-type gener- ator-based device used to fire electrical detonators. Booster: Explosive material placed between the initiator and final (main) charge. Bridge wire: The electrical filament inside an electric deto- nator which heats to incandescence when a current is passed through it, thereby initiating a primary explosive in contact with it. Brisance: From the French word “brisor.” The shattering capability of an explosive. Cap: (1) Another name for a detonator. (2) Another name for a primer. Crimper: A hand tool used to attach nonelectric detonators to a safety fuse. DATB: A military high explosive having a calculated Power Index Rating of 132 and an ignition temperature of 305°C. Dautriche Test: An old (but still used) test technique for deter- mining the detonation velocity of an explosive. The explosive is packed at the required density of loading in a steel tube and a firing detonator installed. Two additional detonators are positioned in the tube at right angles to the firing detona- tor. These detonators are a measured distance apart and are connected by a length of det cord with a known velocity of detonation. The central area of the cord is positioned on a plastic plate and the exact center of the cord marked thereon. When the explosive is detonated, the detonation wave fires each detonator in turn, thereby detonating the cord from opposite directions. Where the two waves meet, an indenta- tion is made in the plastic plate and the distance between the center of the cord (E) and the indentation (F) is measured. The time taken for the detonating wave to travel from the first horizontal detonator (A) via the cord to F must be equal to the time taken for the wave to travel from A to the second detonator (B) via the explosive under test, and then from B to F via the cord. The velocity of the explosive is thus given as: Dj - D 2 l 2EF Deflagration: An ultrafast burning phenomenon. Detonator: See Blasting Cap. Capacitor: A component from which a stored electrical charge can be released instantly. CC: Conducting Composition. An explosive or ignitable material capable of conducting electricity in such a man- ner that the passage of current causes it to heat and ignite/initiate, thereby rendering the use of a bridge wire unnecessary. Combustion: Exothermic oxidation reaction, the combina- tion of substances with oxygen (usually accompanied by flame, smoke, or sparks), with the oxygen being supplied by the atmosphere or from within the material itself. Continuity (as in electrical continuity): An unbroken path or route along which current can flow. Coupling Base: A commercial military attachment contain- ing a percussion cap that is screwed to, or permanently attached to, a switch to activate a fuse or detonator. Known variously as a fixed base, standard base, or some- times just “base.” 122 TERRORIST EXPLOSIVE SOURCEBOOK Detonation: An ultrafast explosive decomposition wherein a heat-liberating chemical reaction maintains a shock front in the explosive material. Delay: Any device designed to produce a time lag between initial actuation and the arming of a device or detonation of the main charge. GLOSSARY 123 Disarming: Making an IED completely safe by removing or disconnecting the component parts. Double-Base (propellant): A propellant containing nitro- glycerine as well as nitrocellulose. EBC: Electric Blasting Cap (electric detonator). EBW: Exploding Bridge Wire. A detonator design wherein a short-duration high-tension pulse causes the bridge wire to vaporize, thereby creating a shock wave which directly det- onates a surrounding charge of secondary high explosive. No primary explosive is therefore needed in the detonator. EED: Electro-Explosive Device. Energized Propellants: Propellants containing a significant amount of RDX. EOD: Explosive Ordnance Disposal. Exothermic: An exothermic reaction is a chemical reaction in which heat is liberated, the products being known as exothermic compounds. Exploder: A button- or switch-operated battery and capaci- tor-based device used to fire electrical detonators. Explosiveness: The speed and/or the extent to which an explosive releases its energy when subjected to a specific stimulus. Explosive Power: The work capacity of a high explosive calculated on the basis of the heat and gas generated compared to that of a standard explosive or by tests such as the lead block test. FAE: Fuel Air Explosive. A powerful implosion type of device in which the effects of an external (in relation to the fuel) 124 TERRORIST EXPLOSIVE SOURCEBOOK explosive charge and internal (in relation to the fuel) igniter mixture combine to distribute and then initiate a combustible substance. The fuels used in such devices include gasoline, other liquid hydrocarbons, and naphtha- lene, and gases such as acetylene and ethylene oxide. Fallhammer Test: A test used to establish the relative sensi- tivity of an explosive to mechanical impact. Firing Device: A device designed to actuate a fuse or deto- nator and thereby the main charge. First Fire: An incendiary/pyrotechnic composition used to ignite a subsequent charge itself or the main charge. Flash: A flame of short duration used to ignite or initiate a flash-sensitive charge or material. Grain: In the context of propellants, a piece of the propellant material itself, often of a specific geometric shape regard- less of its size. Thus, one stick of solid propellant of the type used in an anti-tank rocket would be termed a grain. HE: High Explosive. HMX: Tetramethylene tetranitramine or Octogen. A higher performance variant of the secondary high explosive RDX. HNS: Hexanitrostilbene — a military secondary high explosive. EED: Improvised Explosive Device. ED: Improvised Incendiary Device. Lead Block Test: Also known as the Trauzl Test. A test to determine the power of an explosive involving a 20cm x 20cm diameter lead block in which there is a 2.5cm wide axial hole. A lOg charge of test explosive with a specified detonator installed is inserted in the hole and the hole GLOSSARY 12S w sealed with sand. When the charge is detonated, the net increase in the diameter of the hole is taken as the mea- sure of explosive power. Letter Bomb: An IED designed to be sent through the mail and activate when opened by the recipient. Mechanical, electrical, and chemical letter bombs have been deployed! Munroe Effect: A localized concentration of shock wave energy at the target, achieved by specific charge shape and/or distance of the charge at point of detonation from the target. Neutralizing: Rendering a device safe to handle. Not to be confused with disarming. Normally Open (as in a normally open switch or circuit): Indicating the status of the switch or circuit before it is activated, i.e., a normally open switch will close when activated, and conversely, a normally closed switch will open when activated. Most switches may be connected in either configuration. Oxidation: The combination of an element with oxygen. PETN (Pentaerythritol Tetranitrate): A secondary high explo- sive commonly used in detonating cord. (Plastic Bonded Explosive): Explosive material mixed with a plastic bonding agent and thus forming both (1) the body (and often other component parts), and (2) the explosive charge in a given explosive device (typically a mine). This technique renders the device difficult (impos- sible if no other metal components are used) to detect with a conventional mine (metal) detector. PBX devices can be improvised with relative ease. Pipe Bomb: A basic terrorist IED (Improvised Explosive Device) made from commercial or improvised explosive 126 TERRORIST EXPLOSIVE SOURCEBOOK material (sometimes match heads) packed inside a length of gas or water pipe and sealed with screw-on end caps. It is activated by a time fuse or an electrical detonator or initiator. Radio-controlled pipe bombs have been deployed. Primer: A small (usually metal) housing filled with impact/stab-sensitive and flame-producing chemicals used to ignite the propellant in (for example) small arms cartridges. Also called a cap. Primary Explosive: An explosive easily initiated by a small stimulus. Propellant: An explosive intended to propel a projectile or do other work by burning and thereby producing expanding high-pressure gases. RADHAZ (Radio Frequency Hazard): The risk of premature initiation of an EED by radio frequency radiation. RCED: Radio-Controlled Explosive Device. RDX: Also known as Cyclonite and trimethylenetrinitramine. Extremely widely used secondary high explosive both by itself and mixed with other explosives. Relay: An electronic or electromechanical switch. Resistor: A semiconductor used to limit current flow in sev- eral types of electronic IEDs. Ring Mains: A military term referring to a main, or primary ring of det cord, linking together other det cord-connect- ed explosive charges in a manner that enables them to be fired simultaneously and with a high degree of reliability. Rotter Test: An English variation of the Fallhammer test. GLOSSARY 127 RSP: Render Safe Procedure. Secondary Explosive: An explosive requiring a substantial stimulus to detonate (i.e., when struck by a detonating wave) but not when ignited or heated. Sensitiveness: Sensitivity. An indication of the ease (relative to a standard) with which a given explosive can be initiat- ed or ignited with a particular stimulus. Shaped Charge: Any type of explosive charge formed or cast into a specific shape to obtain a localized concentra- tion of shock-wave energy. Shock Front: In this context, an explosion-provoked change, at supersonic speed, in the pressure and other parameters of a given medium. Shock Wave: A term used to describe a shock front and its related phenomenon. Single-Base (propellant): A propellant in which nitrocellu- lose is the only explosive ingredient. Slack (as in slack tripwire): A wire completely without ten- sion that can be cut without causing any movement at either end. Spall(ing): Debris or fragments thrown from the rear of a solid object when the front of it is subjected to a detona- tion shock wave or impact. Spark Test: A test used to determine an explosive’s suscepti- bility to initiation by electrical discharge. Stabilizer: A material or substance added to reduce (some- times prevent completely) auto catalytic decomposition of an explosive. Standoff: The distance between a target and the explosive charge at the point of detonation. Frequently there is an optimum distance for a desired effect. Stoichiometric: In this context, a reactive chemical com- pound in which the balance of the reactive chemicals is calculated to be such that they all react. Switch: A mechanical, electronic, or electromechanical assembly incorporating components which change posi- tion or status when activated. It is not necessarily a com- mercial product. TAAC: Tetrammine copper (II) chlorate, an improvised pri- mary explosive. Taut (as in taut tripwire): A tripwire that is under a degree of tension so that it cannot be cut or touched without caus- ing some movement at either end. Temperature of Ignition: The temperature required to ignite an explosive under specific conditions. Tetryl: A secondary high explosive often used as a booster charge. Thermate: A term often used to describe any of the fillings in an incendiary bomb. Thermite: A mix of powdered metal (usually aluminum) and a metal oxide (usually iron oxide), which provides an intensely hot, gasless reaction. Thyristor: Also called a Silicon Controlled Rectifier (SCR). It is a semiconductor device which may be used in IEDs in place of the transistor. TNT: Trinitrotoluene. A secondary high explosive. 128 TERRORIST EXPLOSIVE SOURCEBOOK GLOSSARY 129 TFU: Timer Power Unit. The term given to a (usually) impro- vised bomb initiation system incorporating both timing and firing current capabilities. Transistor: A semiconductor component available in many different forms and used in many IEDs as an electronic switch. Triple-Base (propellant): A propellant containing nitrocellu- lose, nitroglycerine, and (usually in large measure) nitroguanidine. VCP: Vehicle Check Point. Velocity of Detonation: The speed that a detonation wave travels through the explosive. 130 TERRORIST EXPLOSIVE SOURCEBOOK , , , 3 1234 01150215 There are no longer any safe havens from terronsis. From Northern Ireland to the Middle East, in Europe, Asia, and now increasingly in the United States, numerous groups are resorting to violence to make their aims known. And their medium of expression is often the Improvised Explosive Device (IED). That is why it is imperative for Special Forces, contract military personnel, law enforcement officers, corporate security personnel, and interested civilians to have the information presented in this book. The Terrorist Explosive Sourcebook explains in detail the ingredients and techniques involved in the prepara- tion and deployment of IEDs and booby traps, as well as appropriate counterbomb and counterterrorist measures. Also included are these invaluable chans and guides: • Letter/Package Bomb Precautions Flowchart • IED Component Recognition Guide • X-ray Detection/Analysis Quick Reference Chart • Threat Call Card • Hand Clearance Sequence Reference Chart • Offensive Operations • Sample Booby Trap Placement Record Stephen Turner is a counterterrorism expert with real- world experience with improvised explosive devices. He teaches courses on counterterrorism and IED awareness. This book is for information purposes only. A PALADIN PRESS BOOK ISBN 0-87364-772-6 ISBN D-fl73b4-772-b 9 780873 647724 *