Terrorist Threats to Commercial Aviation: A Contemporary Assessment

Ten years ago, al-Qa`ida utilized four U.S. commercial airliners to destroy the World Trade Center’s towers, damage the Pentagon, and kill close to 3,000 people. This attack spurred the United States to convert its counterterrorism efforts into a sustained war on terrorism, resulting in the invasion of Afghanistan and Iraq, the capture or killing of hundreds of al-Qa`ida members, and the eventual death of al-Qa`ida chief Usama bin Ladin. There has been extensive reflection in recent months regarding the implications of Bin Ladin’s death and the Arab Spring to al-Qa`ida and its affiliated groups.

Two critical issues, however, have been partially sidelined as a result. How has the terrorist threat to commercial aviation evolved since the events of 9/11? How have actions by the U.S. and other governments worked to mitigate this threat?

This article offers a thorough review of recent aviation-related terrorist plots, subsequent mitigation strategies, and current terrorist intentions and capabilities dealing with commercial aviation. It concludes by offering three steps security experts can take to reduce the terrorist threat to commercial aviation.

Aviation-Related Plots Since 9/11 and the Regulatory Response
A number of al-Qa`ida-affiliated plots sought to target commercial aviation since 9/11. A sampling of these include the “shoe bomber” plot in December 2001, an attempt to shoot down an Israeli airliner in Kenya in 2002, the liquid explosives plot against transatlantic flights in 2006, the Christmas Day plot in 2009, and the cargo bomb plots in 2010. Other prominent operations attempted or executed by Islamist extremists during this period include a 2002 plot to hijack an airliner and crash it into Changi International Airport in Singapore, the 2002 El Al ticket counter shootings at Los Angeles International Airport, the 2004 bombings of two Russian airliners, the 2007 Glasgow airport attack, a 2007 plot against Frankfurt Airport by the Sauerland cell, a 2007 attempt by extremists to target fuel lines at JFK International Airport in New York, the 2011 suicide bombing at Moscow’s Domodedovo International Airport, and the 2011 shootings of U.S. military personnel at Frankfurt International Airport.

In response to these incidents, the U.S. government and many other countries have dramatically increased aviation security measures to prevent or deter future attacks. Many of these measures are well known to the public, including: the hardening of cockpit doors; federalization of airport security screening staff and the creation of the Transportation Security Administration (TSA); deployment of federal air marshals (FAMs) and federal flight deck officers (FFDOs) aboard aircraft; implementation of new detection equipment and methods, such as advanced imaging technology (AIT), often referred to as “body scanners”; increased amounts of screening for cargo; explosive trace detection (ETD), full body “patdowns,” and behavioral detection officers (BDOs); enhanced scrutiny for visa applicants wanting to travel to the United States; and the use of watch lists to screen for terrorists to prevent them from boarding flights or from gaining employment in airports or airlines.

Certain measures—such as invasive patdowns, AIT scanning, inducing passengers to remove jackets, belts, and shoes for inspection, and requiring them to travel with minimal amounts of liquid in their possession—have drawn widespread complaints regarding their inconvenience, as well as questions about their supposed efficacy. The reactive nature of many such measures has been widely noted as well, with some security practices designed to counter highly specific attack techniques utilized in past terrorist plots. Al-Qa`ida in the Arabian Peninsula (AQAP) sarcastically commented on this tendency in its online magazine Inspire, rhetorically asking the U.S. government whether it thought the group had no other way to conceal explosives after the TSA prohibited passengers from carrying printer cartridges.

Current Threats to Aviation
Despite the strenuous efforts by governments to harden commercial aviation in the post-9/11 era, the number of plots illustrates that al-Qa`ida core, its affiliates, and numerous other Islamist extremist groups and self-radicalized individuals maintain a high level of interest in attacking aviation. Despite the organizational disruptions caused by the deaths of numerous senior al-Qa`ida leaders in 2011, and the current preoccupation of several al-Qa`ida affiliates with local conflicts, this ongoing interest in attacking aviation is unlikely to dissipate in the long-term. Furthermore, the evolving tactics utilized in these various plots lend weight to AQAP’s contention that government regulators suffer from a lack of imagination in anticipating and mitigating emergent and existing threats. As indicated by numerous accounts, including the description of the cargo plot contained in Inspire, terrorists constantly seek to analyze existing aviation security measures to probe for weaknesses and develop countermeasures. Terrorists’ ongoing efforts to study and defeat security are further exemplified by the arrest of Rajib Karim, a former information technology employee at British Airways; prior to his arrest, Karim maintained an ongoing dialogue with AQAP operative Anwar al-`Awlaqi and attempted to provide al-`Awlaqi with information on aviation security procedures.

Therefore, despite government efforts to improve aviation security, a number of critical tactical threats remain.

Insider Threats
Rajib Karim sought to stage a terrorist attack on behalf of AQAP, seeking to become a flight attendant for British Airways to stage a suicide attack. He also attempted to recruit fellow Muslims (including a baggage handler at Heathrow Airport and an employee of airport security) to stage an attack. Coupled with the aforementioned 2007 JFK airport plot, which involved at least one airport employee, and a reported 2009 plot by Indonesian terrorist Noordin Top to target commercial aviation at Jakarta’s main airport, which included assistance from a former mechanic for Garuda Indonesia, this illustrates the primacy of the so-called “insider threat” to aviation.

Although TSA and U.S. airports currently conduct criminal and terrorist database checks on potential airport, airline, and vendor employees who are to be granted access to secure areas, there are significant vulnerabilities in this approach, which has proven notably unsuccessful at stopping members of street gangs from gaining employment and carrying out criminal activities such as narcotrafficking, baggage theft, and prostitution at airports nationwide. In 2010, an individual named Takuma Owuo-Hagood obtained employment as a baggage handler for Delta Airlines, then promptly traveled to Afghanistan where he made contact with the Taliban, reportedly providing advice on how to effectively engage U.S. troops.

The magnitude of this vulnerability is compounded because most airport employees working in secure areas do not undergo security screening prior to entering their workspace due to practical constraints. Additional measures, such as random screening and security probes, are unable to effectively mitigate this threat. The insider threat becomes markedly worse at non-Western airports in regions such as West Africa or South Asia, where local authorities’ ability to effectively screen prospective airport employees is frequently negligible due to incomplete or poorly structured terrorist and criminal intelligence databases.

Threats from Ranged Weapons
MANPADS, or man-portable air defense systems, have been described as a growing threat to commercial aviation following the outbreak of Libya’s civil war in early 2011 and subsequent news reports claiming that al-Qa`ida in the Islamic Maghreb (AQIM) has obtained surface-to-air missiles. Some reports suggest that missiles stolen from Libyan arsenals have spread as far as Niger, the Gaza Strip, and the Sinai Peninsula. In addition to AQIM, al-Shabab has been known to possess advanced MANPADS, allegedly provided by Eritrea. Given that AQAP maintains ties to al-Shabab and has reportedly taken over multiple military depots in Yemen following the outbreak of civil unrest there, it is not implausible to assume that AQAP could acquire additional MANPADS. There are also reports that the Taliban acquired MANPADS from Iran, making it conceivable that elements of the group sympathetic to al-Qa`ida’s aims could provide al-Qa`ida with MANPADS for a future attack.

Although MANPADS are unable to target aircraft at cruising altitudes, commercial aircraft would become vulnerable for several miles while ascending and descending, particularly due to their lack of countermeasure systems.

In addition to the MANPAD threat, a significant variety of ranged weapons could be used to target commercial aircraft, particularly when taxiing prior to takeoff or after landing. Rocket-propelled grenades (RPGs), for example, are inaccurate at extended ranges; however, they have been used to shoot down rotary wing aircraft in combat zones, and have been used in at least one plot against El Al aircraft. The Irish Republican Army (IRA) used homemade mortars to attack Heathrow Airport in the 1990s, while heavy anti-material sniper rifles such as the Barrett M82 fire .50 caliber rounds to a range of more than one mile and have been previously used by non-state actors, such as the IRA and the Los Zetas drug cartel.

Evolving Threats from Explosive Devices
Terrorist groups, particularly AQAP, have continuously refined their ability to conceal improvised explosive devices (IEDs) from security screening equipment, as shown by the 2009 Christmas Day plot, where a would-be suicide bomber concealed explosives in his underwear, and the 2010 cargo bomb plot, where bombmakers hid explosives in printer cartridges.

Following the 2009 plot in particular, TSA, foreign regulatory agencies, and some airlines sought to increase safeguards against passenger- or cargo-borne IEDs by the deployment of AIT and ETD equipment. IEDs, however, are likely to remain a significant threat to commercial aviation due to limitations in current screening technology. AIT can be defeated by concealing IEDs internally, either by the frequently discussed stratagem of surgically implanting devices in a would-be suicide bomber or by the simpler route of secreting the device within a body cavity. Alternately, IEDs concealed within complex electronic devices are likely to defeat all but the most thorough visual inspection, as illustrated by explosives experts’ initial failure to detect the devices used in the 2010 cargo plot. AQAP has shown itself to be particularly adept at concealing IEDs within electronic devices such as printers and radios, which it will likely continue to use in the future.

ETDs and explosives detection dogs, meanwhile, can be defeated by numerous countermeasures. For example, many (though not all) ETD devices detect only two popular explosive compounds. ETD equipment is also not designed to detect the components of improvised incendiary devices (IIDs), making the use of these correspondingly attractive to terrorists. Lastly, IEDs can be sealed and cleaned to degrade the ability of ETD equipment to detect explosive vapors or particles.

Nor is behavioral profiling likely to provide the solution to passenger-borne IEDs and IIDs. Umar Farouk Abdulmutallab underwent two interviews by security staff prior to staging his attack on Northwest Airlines Flight 253 in 2009. Similarly, a GAO report examining the TSA’s use of BDOs noted that the scientific community is divided as to whether behavioral detection of terrorists is viable.

Threats Against Airline Facilities and Airports
One aspect of aviation security that is not frequently addressed is the potential for terrorists to strike other aspects of aviation infrastructure beyond aircraft. Commercial airlines are highly reliant upon information technology systems to handle critical functions such as reservations and crew check-in, a fact not lost upon Rajib Karim when he suggested in correspondence with Anwar al-`Awlaqi that he could erase data from British Airways’ servers, thus disabling the airline’s website. Such an approach would mesh closely with al-Qa`ida core’s and AQAP’s stated aims of waging economic jihad against the West. The operational control centers operated by air carriers are another significant point of vulnerability, which conduct the airlines’ flight control, meteorology, and emergency management functions. Despite their criticality to flight operations, these control centers are rarely heavily guarded, meaning that a team of attackers equipped with inside knowledge could temporarily shut down the global operations of a major air carrier, particularly if backup facilities were to be targeted as well.

Another threat to commercial aviation is the increasing number of plots and attacks targeting airports themselves rather than aircraft. There have been two significant attacks staged at international airports thus far in 2011 in Frankfurt and Moscow. Attacks against airports have been planned or executed using a variety of tactics, such as firearms, car bombs, suicide bombers, and hijacked aircraft. The targets have included airport facilities such as fuel lines, arrival halls, and curbside drop-off points. Terrorists could also breach perimeter fencing and assault aircraft on runways, taxiing areas, and at gates. This tactic was used during the 2001 Bandaranaike airport attack in Sri Lanka, when a team of Black Tigers used rocket-propelled grenades and antitank weapons to destroy half of Sri Lankan Airlines’ fleet of aircraft. More recently, Afghan authorities announced the discovery of arms caches belonging to the Haqqani network near Kabul Airport and claimed that the group had planned to use the caches to stage an assault on the airport. The actions of activist groups—such as Plane Stupid, which has breached perimeter fencing at UK airports so that activists could handcuff themselves to aircraft in a protest against the airline industry’s carbon emissions—demonstrate the viability of such an attack in the West as well.

The trend toward attacking airports rather than aircraft has likely been driven by a number of factors, particularly increased checkpoint screening measures and terrorists’ growing emphasis on decentralized, small-scale attacks on targets of opportunity. Firearms will likely prove to be a key component of future attacks, given their relative ease of use compared to explosives, as well as their wide availability in the United States and many other countries. This trend was exemplified by the 2011 Frankfurt attack, which was conducted by Arid Uka, an employee at the airport’s postal facility, who shot and killed two U.S. soldiers at a bus at the terminal. Although deployment of plainclothes security personnel and quick reaction teams can help ameliorate the impact of attacks on airports, their ease of execution and the impossibility of eliminating all airport queues (be they for drop-off, check-in, security screening, baggage claim, or car rentals) make this tactic a persistent threat.

Required Steps to Improve Aviation Security
Given the breadth and complexity of threats to commercial aviation, those who criticize the TSA and other aviation security regulatory agencies for reactive policies and overly narrow focus appear to have substantial grounding. Three particularly serious charges can be levied against the TSA: it overemphasizes defending against specific attack vectors (such as hijackings or passenger-borne IEDs) at the expense of others (such as insider threats or attacks on airports); it overemphasizes securing U.S. airports while failing to acknowledge the significantly greater threat posed to flights arriving or departing from foreign airports; and it has failed to be transparent with the American people that certain threats are either extremely difficult or beyond the TSA’s ability to control. Furthermore, the adoption of cumbersome aviation security measures in the wake of failed attacks entails a financial burden on both governments and the airline industry, which has not gone unnoticed by jihadist propagandists and strategists. While the U.S. government has spent some $56 billion on aviation security measures since 9/11, AQAP prominently noted that its 2010 cargo plot cost a total of $4,900.

With this in mind, there are several measures that could be undertaken to improve U.S. aviation security. First, policymakers must recognize the timely collection and exploitation of intelligence will always be the most effective means of interdicting terrorist threats to aviation, whether by disrupting terrorist leadership in safe havens, breaking up nascent plots, or preventing would-be terrorists from boarding aircraft. The successful exploitation of intelligence gathered from the Bin Ladin raid in May 2011 has likely done far more to defend commercial aviation from al-Qa`ida than the use of advanced imaging equipment and patdowns.

Second, the TSA and other aviation security regulators must increase their liaison with the airline industry regarding the development of risk mitigation strategies, as airlines are far more aware of the vulnerabilities inherent to commercial aviation, as well as the practical constraints on proposed security measures.

Third, rather than increasing spending on screening equipment and employees deployed in the United States, the TSA and other regulators should instead provide financial support for airlines attempting to improve security for their overseas operations. This could include subsidizing background checks on airlines’ international employees and vendors, paying for armed guards at ticket counters, helping upgrade security for airlines’ computer networks and control centers, and paying for the deployment of ETD screening equipment. Aviation security regulators should also work to improve the quality of threat information shared with airlines, which is frequently dated, irrelevant, or inaccurate.

Most importantly, the TSA and policymakers must publicly acknowledge that it is impossible to successfully protect every aspect of commercial aviation at all times. Intelligence gaps will occur, watch lists will not always be updated, scanners will fail to detect concealed items, and employees will become corrupt or radicalized. As politically painful as such an admission may be, it is essential to scale back bloated security measures that add significant expense and inconvenience to commercial aviation without materially reducing risk. The TSA’s leadership has begun to take small steps in this direction, such as a current pilot program designed to prescreen travelers to facilitate expedited screening, but more must be done to ensure that commercial aviation remains both secure and commercially viable.

Source:  https://www.ctc.usma.edu/posts/terrorist-threats-to-commercial-aviation-a-contemporary-assessment