Security Information Bulletin
Potential Indicators of Threats Involving Vehicle Borne
Improvised Explosive Devices (VBIEDs)
May 15, 2003
The following information is meant to advise the public as well
as people who own and operate facilities about possible indicators
of terrorist attack planning. DHS encourages individuals to report
information concerning suspicious or potential criminal activity
to law enforcement or a Homeland Security watch office. Individuals
also may report incidents to the Homeland Security Center (HSC)
at 202-282-1616, email to State.Local.HSCenter@dhs.gov.
The Department of Homeland Security (DHS) believes that a truck bombing
by terrorists may be preempted if the general public remains alert
for certain indicators. DHS has no specific information to indicate
that a truck bombing of any kind is currently being planned in
the United States.
This document is only intended to provide general information to assist
in efforts to recognize potential VBIED-related threats or incidents
based on the recent Riyadh bombings.
Current Tactics Used in the
Multiple vehicles per target
Assault/breaching cadre armed with small arms/weaponry
accompany the VBIED to clear security personnel and gain access
to the compound.
International terrorist groups have demonstrated the ability
to plan and conduct complex attacks, simultaneously, against multiple
targets. In the 11 May Riyadh attack terrorists, possibly Al-Qaida,
assaulted three compounds occupied by western guest workers using
multiple vehicles. At least one vehicle in each assault team
carried a large explosive charge which was detonated by a suicide
bomber. Media reports indicate that the attackers drove up to
each compound killing those guarding the compound gates with small
arms fire. Vehicles carrying the explosive charges were then
driven into each compound and detonated. In one instance it appears
that the terrorists attempted to breach the gate security check
point by ramming it with a sedan. It is likely that those involved
with executing these attacks conducted extensive preoperational
surveillance of the compounds selected. Meticulous planning,
to include preoperational surveillance, is a hallmark of Al-Qaida
the least amount of damage of the three targets. Initial attack
penetrated one Saudi Military Guard manning watch post at rear
corner of compound.
killed the guard and drove the explosive laden car up to the next
gate in the back of the compound, where it was detonated.
Of note, a safe house
probably used by these terrorists -- which was raided by Saudi
authorities on 6 May -- was only 400 meters from the Jedawal Compound
- CORDOVAL COMPOUND
- This compound was located on a Saudi National
Guard (SANG) controlled facility.
- Initial attack was conducted with a Ford
Crown Victoria sedan, which attempted to ram through the gate
of the compound.
- When the car became stuck, terrorists from
a pick-up truck dismounted and attacked the guard post.
- Firefight ensued, killing all SANG personnel.
- Terrorists forced open the gate, and drove
the pick-up on the compound.
- Truck was driven up to residence housing,
where it was detonated (initial estimate suggests 400-500
kilograms of High Explosives (HE) may have been used).
- AL-HAMRA COMPOUND -
- Toyota sedan pulled up to the gate, followed
by a GMC Suburban truck.
- An unknown number of terrorists dismounted
from the truck, shot and injured an unarmed guard, and forced
their way into the compound.
- Both vehicles drove toward the center of
the compound where the terrorists shot into buildings and
at moving objects.
- Upon reaching a housing area south of the
main recreation and sports complex, an explosive device in
the GMC Suburban was detonated by a suicide terrorist.
While the ability to conduct multiple, near simultaneous attacks
against several targets is not new for terrorist groups such as
Al-Qaida, the manner in which these attacks was conducted indicates
a more refined capability. In each attack a number of armed terrorists
was used to eliminate the security elements guarding the compounds
so suicide cadre could drive a vehicle borne improvised explosive
device to the desired location and detonate it. Media reports
suggest that the terrorist perpetrators may also have fired shots
in the air to lure victims out of their dwellings in order to
maximize casualties. The split second timing among the reported
three attacks -- while not unprecedented for accomplished terrorist
groups - indicates that a trained and dedicated cadre perpetrated
Potential VBIED Indicators
DHS has no specific information
to indicate that a truck bombing of any kind is currently being
planned in the United
existence of any one of the following indicators does not in and
of itself suggest terrorist activity. Each incident should be
carefully assessed together with other information present to
judge whether there is cause for further investigation:
- Theft of explosives, blasting caps, or fuses,
or certain chemicals used in the manufacture of explosives.
- Rental of self-storage space for the purpose
of storing chemicals or mixing apparatus.
- Delivery of chemicals directly from the manufacturer
to a self-storage facility or unusual deliveries of chemicals
to residential or rural addresses.
- Chemical fires, toxic odors, brightly colored
stains, or rusted metal fixtures in apartments, hotel/motel
rooms, or self-storage units.
- Modification of truck or van with heavy duty
springs to handle heavier loads.
- Small test explosions in rural wooded areas.
- Treatment of chemical burns or missing hands/fingers.
- Untreated chemical burns or missing hands/fingers.
Purchase or theft of explosives or chemicals may be
a precursor to terrorist attacks -Ramsi Yousef--the mastermind
behind the 1993 World Trade Center (WTC) attack--purchased the
required chemicals directly from a chemical manufacturer. Timothy
McVeigh--the perpetrator of the attack on the Murrah Federal Building--used
a combination of theft and small purchases over a six (6) week
period to amass the necessary ingredients used to assemble his
Rental of self-storage units and the delivery of chemicals
to such units - Both Ramsi Yousef and Timothy McVeigh rented
self-storage units in order to store chemicals. Ramsi Yousef had
the chemical manufacturer deliver $3,400 in chemicals directly
to his self-storage unit.
Chemical fires, toxic odors, brightly colored stains, or rusted
metal fixtures in apartments, hotels rooms, or self-storage units
- Self-storage site managers, motel/hotel staff, and apartment
superintendents may wish to be sensitive to any fires, toxic odors,
bright stains, or rusted metal fixtures within their facilities.
In attempting to prepare an improvised explosive device in the
Philippines following the 1993 WTC attack, Ramsi Yousef caused
a violent chemical fire to break out in the kitchen where he was
preparing his device. Subsequent investigation of this apartment
revealed bright stains and rusted metal fixtures (i.e., door hinges,
window locks, etc.) throughout the apartment.
Theft of truck or van with minimum one (1) ton carrying capacity
- The 1993 WTC attack and 1995 bombing of the Murrah Federal Building
were carried out with rented vehicles. However, terrorists may
use a stolen vehicle in order to impede subsequent investigation.
Moreover, most VBIEDs used in recent years have carried large
explosive charge that weighed in excess of 2,000 pounds suggesting
that continued use of large vans, SUVs or trucks for this purpose
Modification of smaller capacity vehicles to accept a minimum
one (1) ton load - The two vehicles used in the 1998 East
Africa bombings were imported into the target country and then
locally modified with heavier springs in order to accommodate
the weight of the explosive. Local law enforcement may wish to
coordinate with appropriate garages or auto mechanic trade associations
in their jurisdictions to sensitize them to this indicator.
Small test explosions in rural or wooded areas - Timothy
McVeigh detonated at least one small explosive device in a wooded
area near his residence in order to test his chemical mixture.
Local law enforcement, as well as fire and rescue departments,
may be in the best position to report this indicator to the FBI.
Treated/untreated chemical burns or missing hands and/or fingers
- Terrorists may seriously injure themselves while manufacturing
their bomb that they require immediate and substantial medical
and out-patient clinics should therefore be requested to report
Physical surveillance - Nearly every major terrorist attack
is preceded by a thorough surveillance of the targeted facility.
It is likely that similar activity preceded
the Riyadh compound bombings.
Purchase of, or illicit access to, blue prints
of the targeted facility - In a failed 1996 attempt to destroy
the FBI's fingerprint facility in Clarksburg, WV, a domestic anti-government
group attempted to acquire the facility's blue prints from a local
emergency services worker.
- Receiving offices may wish to sensitize local
fire and rescue departments, and architectural firms, to the
possibility that terrorists may attempt to acquire a targeted
facility's blue prints from local emergency services worker.
General Characteristics of Terrorist Surveillance:
Terrorist surveillance may be either fixed or
- Fixed surveillance is done from a static position,
possibly an adjacent building, business, or other facility.
In fixed surveillance scenarios, terrorists may establish themselves
in a public location over an extended period of time or choose
disguises or occupations such as street vendors, tourists, repair
or deliverymen, photographers or even demonstrators.
- Mobile surveillance usually entails observing
and following persons or individual human targets, although
it can be conducted against non-mobile facilities (i.e. driving
by an embassy to observe the building or compound). To enhance
mobile surveillance, many terrorists have become more adept
at progressive surveillance.
- Progressive surveillance is a technique whereby
the terrorist will follow a target for a short period of time
from point A to point B, withdraw for a time, possibly days
or even weeks, and then resume surveillance from point B to
point C. This will continue until the terrorist develops target
suitability and/or noticeable patterns in the targets movements.
This type of transient presence makes the surveillance much
more difficult to detect or predict.
- More sophisticated surveillance is likely
to be accomplished over a long period of time. This tends to
disrupt detection techniques and improve the quality of gathered
information. Some terrorists are noted to perform surveillance
of a target or target area over a period of months or even years.
- Terrorists are known to use advances in technology
such as modern optoelectronics, communications equipment, video
cameras, and other electronic equipment. Such advances include
commercial and military night-vision devices, GPS systems, and
cellular phones. It should be assumed that many terrorists have
access to high-dollar technological equipment.
to select soft targets for attack -- particularly those that will
yield a high casualty count. Some examples, though not all inclusive,
are: residences, recreational and shopping venues, and business
buildings and complexes. All available antiterrorism measures
should be rigorously reexamined - to include: physical security
perimeters set back distances between security fences and key
buildings, and barricades.
- Maintain situational awareness
of world events and ongoing threats.
- Ensure all levels of personnel
are notified via briefings, email, voice mail and signage of
any changes in threat conditions and protective measures.
- Encourage personnel to
be alert and immediately report any situation that appear to
constitute a threat or suspicious activity.
- Encourage personnel to
avoid routines, vary times and routes, pre-plan, and keep a
low profile, especially during periods of high threat.
- Encourage personnel to
take notice and report suspicious packages, devices, unattended
briefcases, or other unusual materials immediately; inform them
not to handle or attempt to move any such object.
- Encourage personnel to
keep their family members and supervisors apprised of their
- Encourage personnel to
know emergency exits and stairwells and the locations of rally
points to ensure the safe egress of all employees.
- Increase the number of
visible security personnel wherever possible.
- Rearrange exterior vehicle
barriers, traffic cones, and road blocks to alter traffic patterns
near facilities and cover by alert security forces.
- Institute/increase vehicle,
foot and roving security patrols varying in size, timing and
- Implement random security
guard shift changes.
- Arrange for law enforcement
vehicles to be parked randomly near entrances and exits.
- Review current contingency
plans and, if not already in place, develop and implement procedures
for receiving and acting on threat information, alert notification
procedures, terrorist incident response procedures, evacuation
procedures, bomb threat procedures, hostage and barricade procedures,
chemical, biological, radiological and nuclear (CBRN) procedures,
consequence and crisis management procedures, accountability
procedures, and media procedures.
- When the aforementioned
plans and procedures have been implemented, conduct internal
training exercises and invite local emergency responders (fire,
rescue, medical and bomb squads) to participate in joint exercises.
- Coordinate and establish
partnerships with local authorities to develop intelligence
and information sharing relationships.
- Place personnel on standby
for contingency planning.
- Limit the number of access
points and strictly enforce access control procedures.
- Approach all illegally
parked vehicles in and around facilities, question drivers and
direct them to move immediately, if owner can not be identified,
have vehicle towed by law enforcement.
- Consider installing telephone
caller I.D., record phone calls, if necessary.
- Increase perimeter lighting.
- Deploy visible security
cameras and motion sensors.
- Remove vegetation in and
around perimeters, maintain regularly.
- Institute a robust vehicle
inspection program to include checking under the undercarriage
of vehicles, under the hood, and in the trunk. Provide vehicle
inspection training to security personnel.
- Deploy explosive detection
devices and explosive detection canine teams.
- Conduct vulnerability
studies focusing on physical security, structural engineering,
infrastructure engineering, power, water, and air infiltration,
- Initiate a system to enhance
mail and package screening procedures (both announced and unannounced).
- Install special locking
devices on manhole covers in and around facilities.
Table 1 - Chemicals
and Other Demolitions Paraphernalia Used in Recent Truck Bomb
Attacks Against US Government Facilities
1,000 lbs. (47% purity)1
60 Gals. (93% purity)1
Ammonium Nitrate (fertilizer)
108 bags (50 lbs. each)2
Potassium Nitrate 1
4 Bottles (4 feet long)1
Sodium Azide 1
Magnesium Azide 1
Aniline Reagent 1
18 liters 3
Liquid Nitromethane (racing fuel)
3 drums (50 gals. each)2
Tovex blasting gelatine 2
Shock Tube 2
Anhydrous Hydrazine (boiler cleaner) 2
Note: Substances and Amounts compiled from publicly available
Prepared by: Risk Assessment Division, Information Analysis
Directorate, Department of Homeland Security.