The specter of terrorism has emerged once again accentuating the vulnerabilities of soft targets in open and free society. This time the events unfolded in the Catalonia region of Spain. First was an explosion in the town of Alcanar, and next was the attack in Barcelona, followed by the attack in Cambrils.
I have written articles or assessments about major terrorist attacks all too often. ACAMS has been a great advocate for publishing these articles and providing visibility into the importance of financial intelligence in responding to terrorist events. I have frequently stated, and will continue to emphasize, that finance and communications are the greatest vulnerability to terrorists. We in the financial services industry are the key to the financial vulnerability to terrorists. Financial institutions are the repository of the financial intelligence needed to disrupt terrorism.
I plan to continue providing my perspective and preparing these analyses. Going forward, and regrettably so, there will be an ongoing stream of periodic attacks like this or worse. I will provide my assessment of the event, and I will endeavor to place it in an anti-money laundering (AML) and financial institution perspective. In that context, there will be repetitive themes. The repetitive themes are necessary and reinforce the importance of financial intelligence and the “urgent” reactive responsiveness required to facilitate the law enforcement response to these horrendous events.
Common Themes with Manchester and Other Cell or Group Attacks
There were a number of common themes in the aftermath of the attacks in Spain, when compared to the cell or group attacks of those in France, Belgium, Germany and the U.K that both the public and private sectors can learn from to detect and disrupt future attacks. Also, from a standpoint of lessons learned, law enforcement and intelligence agencies around the world should be able to develop enhanced best practices for responding to and investigating these incidents in a time-sensitive manner. From an AML perspective, by assessing the common threads of terrorist attacks, financial institutions should be able to identify funding flows and fragments of financial intelligence in the use of financial mechanisms and spending patterns needed to facilitate such activity.
Commonality in these attacks start with the terrorist attack cycle. Stratfor, a geopolitical intelligence platform, describes the terrorist attack cycle as a six-step process including target selection, planning, deployment, attack, escape and exploitation. Invariably, cell or group attacks will follow a variation of the terrorist attack cycle. Target selection is not random. Targets are carefully chosen and require surveillance on the part of the terrorist cell members. Terrorists prefer soft targets open to the public that are easily accessible. The targets are carefully chosen to inflict maximum casualties and to project a symbolism to promote a greater sense of fear and accomplishment. In planning their attacks, terrorists will acquire their weapons. Weapons will range from bombs, to firearms, to knives to vehicles. Weapons will likely be purchased or procured in another fashion during the planning phase. Vehicles are either already owned or will be purchased, rented or stolen for the attack. During the planning cycle, other logistical needs such as safe houses, apartments and/or hotels will be rented, purchased or taken over. Other expenses might include communications equipment, food and other subsistence necessities. The next step in the cycle is deployment. At this point, those members of the cell who comprise the attack team deploy to commit the terrorist act.
In each attack, the terrorist cell or individual operative and their support network operated in plain sight, and yet, they avoided detection. This is the aspect where public and private sector awareness and recognition of commonalities and warning signs, consistent with the terrorist attack cycle, can be used as lessons learned to develop best practices to identify suspicious activity and behavior. In these scenarios, terrorist operatives and cells are most vulnerable to detection during target selection surveillance. They are also very vulnerable during the deployment stage. They are less vulnerable during the planning phase.
Target selection, planning and deployment are the points in the terrorist attack cycle we must focus on to detect, disrupt and prevent attacks from occurring. This requires situational awareness. Situational awareness is being aware of one’s physical surroundings for safety and security and signs of danger or suspicion. The concept of situational awareness can, and should, be applied to financial information as well. Being aware of and understanding the financial flows that support terrorist attacks can lead to the identification of suspicious activity and the disruption of the funding flow. The disruption of funding could help prevent a potential terrorist attack from succeeding. Situational awareness, both physical and financial, can be enhanced through lessons learned from prior attacks.
Unless the terrorist cell or operative is stopped prior to or during deployment, the attack will most likely occur. Once an attack begins, there will be a great deal of chaos. For people caught in the attack zone or within the vicinity, they should try to run. If they cannot run, they should hide. If they cannot hide, they should fight. Once the police have responded, everyone should follow police instructions. Because of the expected continued recurrence of these attacks, police departments have become better prepared to expeditiously respond to terrorist events. One common theme after attacks has been the excellence of the post-incident investigation, especially in identifying cell members or supporters of the attackers. A critically important investigative technique in all terrorist incidents has been the exploitation of financial intelligence.
Once the attack unfolds, the next step in the terrorist attack cycle is escape. In many, if not most situations, the terrorists are suicide attackers. Accordingly, escape has evolved into less of a factor in the planning cycle. However, some attackers have initially escaped. In addition, non-attack cell members or supporters remain at large. They are a cause for ongoing security concerns and must be identified and accounted for. This has been where law enforcement has excelled in these situations. They have succeeded in identifying and arresting the terrorist cell or network, preventing their escape. The final step in the cycle is exploitation. Shortly after an attack takes place, a core terrorist organization will publically claim responsibility. In most recent attacks, the Islamic State has claimed responsibility.
The Landscape in Catalonia
Catalonia is an autonomous region in Spain. It is located in the northeastern end of the Iberian Peninsula. Catalonia consists of four provinces, which include Barcelona, Girona, Lleida and Tarragona. Barcelona is the capital and largest city in Catalonia. In June 2017, a referendum on Catalan independence was announced by the Government of Catalonia for October 1, 2017. After the terrorist attack in Berlin in December 2016, where a jihadist drove a truck into a Christmas market killing 12 people and injuring 56, the Spanish National Police issued a circular ordering all police departments in Spain to implement safety procedures to include installing barriers at entrances to public spaces. The measures were not implemented in Barcelona. The leaders of the Catalan independence movement did not want to be seen as taking orders from the central government in Madrid. This is not intended to be a criticism. Rather, it is meant to demonstrate how terrorists planning an attack meticulously focus on target selection and identifying security vulnerabilities to identify soft target points easier to exploit.
Catalonia has a large Muslim population with many immigrants coming from the Northern African countries of Morocco, Tunisia and Algeria, as well as coming from Pakistan and Bangladesh. The terrorist cell that was responsible for the attacks on August 17, 2017, was mostly Spanish Moroccans from the Catalonian town of Ripoll. Neighbors, friends and residents in Ripoll were quite surprised and had no idea when or how the group of young men was radicalized.
Based on the initial investigation, the attack was in the planning stage for about six months. It appears that for at least a few months, the cell used a vacant house in the Catalonian town of Alcanar as a safe house and bomb factory. Over 100 canisters of gas were delivered to the house in Alcanar.
From a situational awareness perspective, in terms of the radicalization process of cell members, the target selection, pre-attack surveillance and attempted bomb-making activity, it is very likely that warning signs were either not recognized, ignored or observed, but not reported. One of the telling lessons learned from prior terrorist attacks is that people did observe signs of radicalization, behavior changes and other warning signs and, for whatever reason, did not report them.
Summary of Events in Catalonia
It is believed that the terrorist cell was comprised of 12 individuals, mostly Spanish Moroccans from the town of Ripoll. Investigators believe that Abdelbaki Es Satty, a 44-year-old imam, was the cell leader. It was also believed that Es Satty radicalized and recruited the other cell members who appeared to range in age from 17 to 28.
The chronology of events leading to the attacks in Barcelona and Cambrils began the night of August 16, 2017, when the house in Alcanar exploded. Initially, police thought the explosion was an accidental gas explosion. Subsequently, it was determined that the house was being used as a bomb-making facility. About 120 canisters of butane and propane gas were recovered at the site. Also recovered was the explosive TATP. TATP is a substance used frequently by the Islamic State in making bombs. Es Satty and another cell member were killed in the explosion while they built bombs.
On August 17, 2017, cell member Younes Abouyaaqoub drove a Fiat Talento van onto the pavement of a pedestrian promenade in Barelona (La Rambla) that was a tourist location. Abouyaaqoub weaved the van through pedestrians at high speed, hitting as many as he could. Fourteen people were killed and at least 100 were injured in the carnage. In the chaos, Abouyaaqoub escaped from the van, hijacked a car and killed the driver by stabbing him. Approximately two hours after the attack, Abouyaaqoub rammed a police barricade and got away. He abandoned the car which was subsequently found with the dead owner in the back seat. After several days as a fugitive on the run, Abouyaaqoub was shot and killed in the town of Subirats. Subirats is near Barcelona. Abouyaaqoub was killed wearing a fake bomb vest.
At approximately 1 a.m., five cell members driving an Audi A3, drove into a crowd of pedestrians in the town of Cambrils. Cambrils is about 200 miles south of Barcelona. The Audi turned over. The five cell members exited the vehicle and began stabbing pedestrians. Police quickly killed the five attackers. One female victim died from knife wounds. The five attackers were all wearing fake bomb vests. On August 17, 2017, prior to the Cambrils attack, the five cell members were seen on a security camera at a local shop. The group was seen on video purchasing four knives and an axe.
In the aftermath of the attacks, the other four cell members were arrested. One, Mohamed Houli Chemlal, was injured in the house explosion in Alcanar. In a court appearance, Chemlal stated that the attacks were intended to be more extensive. The cell intended to bomb monuments and a famous church in Barcelona. The explosion of the bombs at the house in Alcanar triggered the attacks in Barcelona and Cambrils that were more limited than intended.
Assessment
- The attacks in Barcelona and Cambrils were traumatic and another example of how vulnerable soft targets are to terrorists. As devastating as the attacks were, Spain was extremely lucky because they were intended to be much worse. Thankfully, in this case, bomb-making materials were detonated before they were converted into usable bombs. The explosion killed two cell members instead of innocent victims.
- It is concerning that over at least a six-month period, a group of 12 individuals could be radicalized and plan an attack without warning signs being recognized. This becomes more concerning because the international intelligence community developed information about a potential attack that was shared with Spanish authorities.
- The combination of the above two bullets reinforce the importance of public and private sector situational awareness, partnership and information sharing.
- The political friction between the government of Spain and officials in Catalonia was exploited by the terrorist cell either wittingly or unwittingly. This should be an important investigative consideration, as the investigation progresses. Investigators must determine if this was a motivational consideration by the terrorist cell. The last major terrorist attack in Spain took place in Madrid in 2004, when bombs were detonated on commuter trains, killing 142 people and injuring 1,800 more. The Madrid bombings took place a few days before the national elections. The attacks had an impact on the outcome of the election. It has been reported that cell leader Es Satty served time in jail for drug trafficking. While in prison, he and one of the leaders of the Madrid attacks Rachid Aglif, known as “The Rabbit” were reportedly good friends.
- A terrorist cell involving 12 members of Spanish Moroccan decent were identified and killed or captured within days following the attacks in Barcelona and Cambrils. This is reflective of outstanding police work by the Spanish national police and the police in Catalonia. Key to the ongoing investigation will be to identify any additional supporters, links to the Islamic State and answering the troubling question of how a cell of 12 individuals could have become radicalized, planned, and then, executed an attack in a period ranging from two to six months without raising any public and private sector detection.
- Es Satty traveled to Brussells and other European locations. Police are investigating potential links between Es Satty and the Brussels Islamic State cell that detonated bombs at the airport and on a subway train in 2016. Other cell members traveled to Europe, including a trip to Paris shortly before the Catalonia attacks.
- The Catalonian cell appears to have been inspired by the Islamic State. It does not appear that the attack was directed by the Islamic State. The Islamic State has taken credit for being responsible for the attack.
- The Barcelona attacker, Abouyaaqoub, rented two Fiat Talento vans. One was used in the attack. Had bombs been successfully made, they would likely have been transported in the vans. Abouyaaqoub paid for the rentals with a credit card he owned.
- Determining who paid for the butane and propane gas canisters, other bomb-making material, the knives and axe, the travel of cell members and other financial necessities will be a critically important investigative priority.
- As with the Manchester bombing investigation and other similar investigations, investigative direction will be influenced greatly by financial intelligence.
- Since it appears that the entire cell has been identified and accounted for (eight dead and four in custody), the post-incident investigation should focus on identifying when cell members were recruited and radicalized; when and how they planned the attacks; how the attacks were financed; and if there were contacts with a terrorist organization. A timeline should be developed from the point of death or arrest of each cell member back to at least the point of radicalization. The time line should account for every day between the end point and at least the point of radicalization. Finance and communications will be the two primary keys toward developing a comprehensive timeline. Financial tracing and linking with communications tracing and linking of phone calls and emails, as well as social media posts will be germane to this effort.
Investigative Response
As set forth in the assessment, national and regional police agencies deserve credit for their post-incident responsiveness to the attacks in Barcelona and Cambrils. Twelve cell members were identified as being engaged in these terrorist attacks and 12 cell members have been killed or arrested. Undoubtedly, financial intelligence has been a significant part of the investigation. Going forward, financial intelligence will be extremely important in establishing timelines from the point of death or arrest of cell members back at least to the point of radicalization.
As noted in the above assessment, the post-incident investigation should focus on identifying when cell members were recruited and radicalized, when and how they planned the attacks, how the attacks were financed and if there were contacts with a terrorist organization..
Most importantly, law enforcement investigators from around the world, as well as those in Spain, must critique the attacks from a standpoint of lessons learned and apply the lessons learned to their risk environment and develop or enhance best practices to reduce the chance of future similar attacks.
AML Context and Response
As I have articulated in other attack assessments, there is little likelihood these attacks could be identified beforehand by financial institutions through transaction monitoring or other alerting mechanisms. It is more likely and probable that once the attack has taken place and the names of those individuals responsible are reported in the media that financial institutions will be alerted through negative news reporting.
It is essential that financial institutions respond to these reactive situations with a sense of “urgency.” As the facts surrounding the Catalonian attacks and investigative developments become known, as is typically the case, it will be determined that financial institutions played a key role in the short- and long-term investigations. Financial institutions have and will continue to provide valuable actionable and timely financial intelligence to police investigators. There are a number of financial leads in this case that were mentioned in the above assessment
With regard to the ever-looming threat of terrorist attacks, financial institutions should establish Critical Incident Response Teams to deal with terrorist and other critical incidents where financial intelligence is needed to support the law enforcement response. Regardless of the size and capacity of the financial institution, the institution should establish a critical incident response capability. Some financial institutions have formed Critical Incident Response Teams that have greatly assisted law enforcement from the outset of their investigations.
Conclusion
Commonalities in different terrorist attacks can be assessed by following the six-step terrorist attack cycle. Law enforcement and investigative agencies around the world should be able to develop enhanced best practices for responding to and investigating these incidents in a time-sensitive manner.
From an AML perspective, by assessing the common threads of terrorist attacks consistent with the terrorist attack cycle, financial institutions should be able to identify funding flows and fragments of financial intelligence in the use of financial mechanisms and spending patterns needed to facilitate such activity. I have espoused the development of Critical Incident Response Teams to assess and potentially identify terrorist financing. As set forth in the above assessment of the Catalonian attacks, there were numerous fragments of financial intelligence leads that could be assessed in comparison with leads in other attacks.
As I stated in my Manchester bombing assessment, finance and communications present the biggest vulnerabilities for terrorists. By responding to terrorist attacks in an “urgent” reactive manner, financial institutions play a significant role with law enforcement in their immediate investigative response to a terrorist event. In addition to being “urgently” reactive, anything a financial institution can do to be proactive would greatly facilitate law enforcement initiatives. Financial institution Critical Incident Response Teams are one example of how important public-private partnerships are in the fight against terrorism and other significant threats to national security and the economy.
For more information on how to identify and mitigate terrorist financing, please visit http://www.acams.org/counter-terrorist-financing-training/.
