Analysis: Attack on London

After reading Zawahiri's Knights Under the Prophet's Banner and the Al Qaida hand book and compared to time lines and map of blasts, including number of unexploded devices, similarities to previous attacks, my operation analysis would appear as following:

The Cell Make Up and Size

At least two members if not four who were responsible for carrying out the actual operations of setting bombs in place and setting timers/fuses. Probably been in country for several years, people that would not raise suspicion, but are probably known to hang out with or at more extremist locations either at mosque or a coffee house frequented by such (etc, probably mosque all things considered). Also, in the past year at least would have established a pattern of "going into the city" for business and staying gone from home for a day or two in order not to raise suspicion among their family members while giving them time to meet at the safe house where they planned the attack.

At least two members to have carried out surveilance. Possibly two of the operatives, but probably not the same members that carried out the attack. There are government cameras filming at all times in the area and it would be inappropriate to use the same men that might raise awareness. These are also locals that would have taken the transportation system regularly for a long period of time as not to raise suspicions either. With at least four, possibly five designated locations for attack, schedules, pictures, planning for maximum effect would have taken about a year and would have required close monitoring in case of changes caused by construction or other obstructions. Last monitoring and reconnaisance may have occured less than a week before execution.

A recruiter that met with the men in local mosques or other places where "Islamist" young men are known to hang out and put them in touch with a "spiritual guide". The recruiter would probably not even present them to the cell leader or discuss becoming involved in an operation until convinced the young men were suitably conditioned for the task.

At least one "spiritual guide" that would talk with the men probably at separate times and discuss how they could serve Islam. Despite discussions of a suicide bomber on the bus, based on the timers found in the subway, it is unlikely this was a suicide mission. If one of the operatives was killed on the bus, it is probably because the bomb went off too early considering there were two other bombs that were to explode and didn't. Thus, whoever the spiritual guide is or was did not have time to convince them of such an act or does not necessarily consider committing suicide the optimum plan for reaching paradise. Or, last but not least, the cell leader and members could have ruled out suicide bombing in favor of performing more "missions" later. Most likely not a high ranking and visible imam in the community that has previously expressed dislike of western values, but an aide or assistant at a local mosque. This person may not have even known they were motivating the men for attacks in country so much as cementing their faith and insuring that they understood the acceptance that Islam must be "protected" first and all other considerations are baseless. Once they were suitably conditioned, the recruiter/mentor may have begun many discussions about ways to serve Islam and to affect the "fight" without leaving home and traveling to Iraq (very difficult these days anyway).

A cell leader who would liaison with the recruiter, the Imam and other outside operatives in developing the plan, obtaining materials and finances, creating the bombs, alibis and safe house. Probably has extensive contacts within the Islamist movement, but not necessarily an "al Qaida" operative. As a matter of fact, it is very likely that the connections were third and fourth parties willing to subsidize the attacks and put the cell leader in contact with a procurer and bomb maker or organizations that would put him in touch with these separate individuals.

A relatively unknown and probably fairly uninformed person that would have rented an apartment in his name to give the cell a place to meet outside of their homes and away from family. House or apartment would have been in an area where they blended in and did not raise much attention. In this case, probably not far from areas of egress from the subway (which could be a large area and number of places considering the subway and transportation system in London). (eg, Egypt and Saudi operations)

The bomb maker. Most likely an outside source flown in specifically for the activity. One of the operatives may have created the bombs and could be the reason why several did not go off and one did go off pre-maturely (or possibly the last bomb on the bus had a secondary switch that could be pressed as a "panic" button; since the last explosion occured 30 mins after the one before and news of the bombing was starting to filtrate past the "electrical surge" nonsense, the operative may have paniced and decided to take action instead of being singled out/profiled by the passengers on the bus). However, it is likely that the operatives in question did not build their own bombs as its a bit risky to do so without prior experience. Also, the bomb maker would not have to be in country or on location for the purchase of the parts for the bomb. The coordinator would simply need a "shopping list". It would also be safer if the parts were assembled for bomb making over a long period of time since too much, too quickly would have raised red flags, even in the criminal community. The bomb maker probably arrived seven to ten days before the attack, assembled the bombs and egressed from the area or even country at least two days prior to the operation (see Kenyan, Nairobi, Morocco, Istanbul and other models).

Procurer of materials. As noted, this was probably accomplished over a long period of time considering the amount of explosives and devices required to manifest the plan. The procurer is also local with local or inter-country connections with criminal organizations. However, devices and explosives were probably not obtained in first person, but probably had changed hands many times from the original person who purchased or stole it.

Finance. This may have been local and in the guise of raising money for a charity. Could also have been relatively small amounts of money transfered via the hawala system (Muslim "western union") from multiple "sources" to multiple "persons" in different locations. This makes the money difficult to trace.

Multiple outside sources that acted as information, finance or message conduits. Some of which may have been unwittingly providing assistance. This is unknown number and is not necessarily within Britain proper.

The Bomb

There is much speculation about the bomb and it's type of detonator. The police indicate that the bombs had each less than 10 lbs of explosives. Given the damage, it was most likely a high explosive and light weight. Probably stolen from a specific construction site, but not recently. The detonators were most likely timers and not cell phones as some have speculated for several reasons:

1) Using a cell phone on the underground or trying to reach someone on their cell phone on the underground is very unreliable and risks the bomb going off prematurely. (I imagine part of the surveillance for this activity included checking how cell phone or radio frequency worked inside the location)
2) Timers allow the operative to ditch their product and egress in a sufficient amount of time.
3) Timers allow for the spaced amount of time between the explosions and distance.

Based on time and detonation, includng the bus bombing that is being held as "premature", the timers were most likely set to explode prior to getting on the transportation and were set to explode shortly after being left on the train in order to avoid detection too soon.

These were simple bombs without shrapnel according to the police briefing. The explosions within contained areas with many parts caused the "shrapnel" to be created from existing, local materials.

Entry and Egress from the Sites

Entry

The "tubes". Operatives probably took public transportation to distant stations, took the "tubes" to those sites just prior to blast, set down the product and left the train at that station prior to the trains leaving. (the explosions occured on the trains leaving the stations, not arriving). They would probably not have arrived together at any of these sites.

The bus. This appears to be the method that the bombers were using to move from and too locations. Public transportation with many passengers to blend in with. The bus appears to have been in route to Kings Crossing or Russel Square station. The "premature" or accidental explosion of the bomb may have occured because the person was unable to get to the final site in time. Others noted that, after the first explosion, the tube began to experience power surges that made travel irratic and possibly threw off the time. Also the reason why the bomb maker was probably a separate person as this person did not know how or attempt to reset the timer.

Egress.

These men simply walked away (except the unlucky bus rider) with the other passengers into the city. Most likely went to a pub, shopping center or some other public place where they would not stand out or be noted. Unlikely they would have taken a taxi or other public or individual transportation any time soon after the explosions. It would also be impractical to have expected a car to arrive at any or multiple locations to pick them up considering the road jams that would have been expected. After remaining in the city for most of the day with other commuters, they would have simply took a taxi to their individual homes or walked.

As Sir Ian Blair indicated, the cell (most of them) are still out there.

If they are well organized, they will not attempt to leave England immediately or in any time frame that would put them close to each other. Each man probably does not know the real name or home address of the others and has a separate route for egress from the country if necessary and separate funds. These men are probably still in their regular community and with their families. Probably even returned to work and used the previous day's terror attacks as an excuse as to why they could not make it into work or they are unemployed or in professions that allows them to be gone several days with minimal contact.

These men may leave the country within the next 30 to 60 days. They will most likely leave by themselves, first and then bring their families once the security situation has calmed down.

The bomb maker left well prior the operation. The cell leader may have left early that morning for another location inside England or on a plane or chunnel to another country after having set the operation in motion.

No one will go back to the safe house and risk being seen together.

The procurer is still out there, most likely within England and appears as the other men, young, clean cut, blends in, possibly married and appears to have a regular stable life.

Profile of Bombers

Intelligence agencies mention the possibility of "North African" cell meaning that these men are Arab looking, possibly Egyptian, Tunisian, Algerian or even Moroccan descendency or nationality.

The men were most likely between the ages of 25 and 35, still young enough to be influenced but old enough to be considered "stable" and well versed in their faith.

The men were most likely dressed in western business or business casual clothes in order to blend in with the other rush hour commuters.

The men were most likely clean cut and clean shaven.

The men were well educated, could read and speak English well (they'd need to in order to read the signs and know what train/bus to take and the time tables). Possibly have degrees in engineering or architecture to lend to operational planning.

The men were most likely married mainly because these men usually marry young and "married" gives the appearance of stability. This would also allow them to live "away from home" where they might otherwise be under closer observation from parents, siblings or other extended family members. Their wives are probably traditional and would not question who, what, when or where the husbands were at any given time.

These men may hold dual citizenship and have visas/passports to one or two other countries to which they could eventually egress.

Investigation

These will most likely go on simultaneously:

1) Identify bomb materials and research their origination. Back track from there where, when and who access may have been granted if from an internal source. If it has relationship to the bombings in Madrid then a search will be on for suspects from that bombing and their travel routes. May also review the shape or design of the bombs to see if they match any other known terrorist attacks around Europe and who the "prime suspects" were, if they are still free and ascertain their location in the past few months.

2) Look at bus security tape first. This is the last explosion and most likely would be the easiest to identify a person arriving with a bag within a half hour or less of the explosion, where the explosion took place and if they could relate that to a specific passenger who was on or had gotten off without their bag within that time or had been sitting in that area. From there, they will attempt to find that person in any databases, foot work within certain communities (sadly, based on his possible ethnicity) showing the picture and looking for people that know him, begin researching his possible acquaintances.

3) Review the "tube" tapes within a half hour prior to explosion or just after, looking for individuals that match expected profile that entered with a bag and left without. Will also look at area of explosion and attempt to identify any passengers that were in that area.

4) Review flight manifests or other travel purchases to identify any possibly known suspect with Islamist connections arriving and leaving England within the last 30 days. Starting backwards, I would look for those leaving in the last week prior to the operation in question and then work backwards.

5) Canvas known areas and work with community leaders to get the word out that these men also attacked the citizens and residents of these communities. Ask for information about anyone known to have fit the pattern and description of the operatives, anyone that was talking about blowing up anything, wanting to harm other citizens or praising any recent activity by the jihadists in other areas. This is the most difficult part as the communities will attempt to shut down or become introverted in an attempt to protect themselves from what they will see as persecution. This will take a lot of work with community leaders and organizations to convince these communities that their own safety is at risk as long as these men are free.

6) If pictures can be taken from the bus and trains that can identify suspects, I would expect, if the persons could not be quickly identified by any database of known criminals or extremists that the pictures will go up on the tellie, papers and websites asking for any information on the subjects. It may even be couched in terms asking some one to identify an injured or dead person or asking them for information about anything that they've seen as a "material witness".

7) Review security cameras in the area for film directly after the explosions. As much as these men may have walked away prior to the explosion, it's possible that one of them or a secondary operative, such as a planner or logistics person, was near by one of the locations filming or photographing the activity in order to use as propaganda film for others. This will be difficult undertaking since so many news stations and independents were on the site, but they may be able to narrow it down by asking news agencies to identify anyone that works for them.

8) Forensics including biometrics such as fingerprints. if there were unexploded devices or parts of devices that were largely intact, I expect that the law enforcement would be attempting to obtain fingerprints and compare them to all known databases including interpol, national immigration and local law enforcement (not to mention known terrorists data bases from other activities) to fix the fingerprints and person. Possibly even looking at DNA.

9) Review list of "missing persons" within the next 48 hours for any person fitting the profile of the possible bomber. Begin canvassing their family and neighbors for information on the subject to validate they were an innocent bystander and not a perpetrator.

10) Obtain list of any wounded treated at the hospital to look for any person that fits the profile and investigate their activities, family, relatives, friends, work, etc to verify their situation. Interview them and verify information against research.

11) Canvas all wounded that were near or in the cars that exploded and ask them for any info that they can remember leading up to the time of explosion. This may give a solid clue or at least narrow down the time to be searched on the security tapes.

Time

As always, it is time that is of the essence. The remaining parts of this cell only have two choices: leave the country ASAP or, deciding they are cornered (like the Madrid bombers) go out in a blaze of glory. They will most likely try to sweat it out for awhile in order to alay suspicion, but, if they cannot leave the country within the next few weeks, they may consider themselves stuck and go for broke. So, the sooner identification can be made, the more likely they will be stuck in England and easier to round up (barring suicidal last stands).

If the investigators are lucky, before the operators can get too antsy and with a minimum of fanfare, they may identify and locate suspects before they can leave or decide to go "final solution".

I'm sure I may have missed some aspects of this case but I wanted to put together my thoughts on what was most likley occuring in reviewing the situation from an investigation point of view. I am also sure that there are others better versed in counter terrorism and investigations than I am. Feel free to add any thoughts on this subject. Maybe we can flesh it out.