On Oct. 19, Lebanese Brig. Gen. Wissam al-Hassan was assassinated on a narrow side street near Sassine Square in downtown Beirut. The attack involved the detonation of a moderately sized vehicle-borne improvised explosive device as al-Hassan's car passed by the vehicle in which the device was hidden. The explosion killed not only al-Hassan and his driver but also six other people and wounded about 90 more.
Al-Hassan, the intelligence chief for Lebanon's Internal Security Forces, had been a marked man for some time prior to his death. He was the security chief for former Lebanese Prime Minister Rafik al-Hariri, who was assassinated in February 2005 in an attack that most believe was conducted by the Syrian regime and its allies in Lebanon.
But more recently, as Stratfor noted in February 2012, al-Hassan played a critical role channeling support from the Gulf states and the West to the Syrian rebels through Lebanon. This involved smuggling arms from Lebanon to Syria destined for opposition forces, providing a haven for Syrian defectors in Lebanon and allowing Syrian rebels to use Lebanese territory as a staging ground for attacks in Syria. His part in the Syrian opposition movement clearly made him a prime target for Syrian intelligence and indeed the Syrian regime had previously attempted to assassinate al-Hassan -- one such plot was thwarted in early 2012 by Jordanian intelligence, which caught wind of the plot and passed a warning to Lebanese authorities.
Al-Hassan was doing dangerous work in a dangerous place, and he knew he was a marked man. His former boss had been assassinated and there were plots afoot to kill him, too. Due to the manner in which al-Hariri was assassinated, al-Hassan decided to employ a very different style of security -- low-profile security instead of the high-profile measures employed by al-Hariri -- and yet he was killed despite his different approach.
This failure does not mean that protective security measures are useless in an environment such as Lebanon or fatalistically suggest that it is impossible to keep a high-value target alive in the country. Rather, an examination of the al-Hariri and al-Hassan assassinations provides an important lesson to security practitioners everywhere -- that protective security measures alone are not enough to keep a marked target alive in such a hostile environment. Whatever security strategy is employed, whether high-profile or low-profile, it must be accompanied by a robust protective intelligence program. If potential attackers are given free rein to conduct surveillance and plan attacks, they will eventually succeed.
Details on Protective Details
As noted above, Rafik al-Hariri's protective detail utilized a heavy motorcade to travel in Lebanon. On the day he was assassinated, he was traveling in a six-car motorcade. In addition to a fully armored Mercedes-Benz limousine, this security detail also employed two lead cars and two follow cars along with an ambulance staffed by trained medics bringing up the rear of the motorcade. The motorcade used three sophisticated electronics countermeasure sets in an attempt to jam any remotely detonated improvised explosive devices, or IEDs, that might lay along the motorcade's route. Reports at the time indicated that these countermeasure sets interfered with cell phone, radio and television reception as the motorcade passed through an area.
The solution for assassinating al-Hariri despite this heavy security detail was not elegant, but it was effective. The attackers used a very large suicide vehicle-borne IED that international investigators estimated contained approximately 1 metric ton of military-grade explosives believed to be TNT. As the motorcade passed a Mitsubishi van containing the explosive device, a suicide operative initiated it, causing considerable damage to the vehicles in the motorcade and the surrounding neighborhood. The massive explosion left a 30-foot crater in the road at the seat of the blast and killed al-Hariri and 21 others while wounding another 231 people.
The van carrying the device was seen driving slowly toward the attack site just before the device was detonated. By using a mobile device, the attackers mitigated the possibility of the device being noticed at the attack site by security vehicles sweeping the route ahead of the motorcade. By using a suicide operative to activate the command-detonated device, the attackers bypassed the motorcade's electronic IED countermeasures and ensured that the device detonated when the limousine was close to the van carring the bomb.
By using a huge charge, the attackers ensured that their device would be potent enough to defeat the fully armored limousine, and they ensured that the attack would be successful even if the device were not triggered at precisely the ideal moment. Even the most sophisticated fully armored vehicle cannot survive the detonation of a 1 metric ton VBIED at close range. On Oct. 1, 2004, an attempt to kill Lebanese opposition lawmaker Marwan Hamadeh using a smaller VBIED failed; al-Hariri's attackers did not want to replicate that failure.
Al-Hariri's assassination occurred after he left the parliament building to return to a lunch he was hosting at his home with a number of people. This meant his location and destination were both likely known by his attackers. There were three different routes the motorcade could have taken to travel from the parliament to his residence. The U.N. investigation into the assassination noted that al-Hariri had appeared in public on less than 10 occasions in the three months prior to the attack but that his motorcade had taken the Maritime Road route, the one on which the attack occurred, on six of those occasions. By establishing such a clearly observable routine, al-Hariri's killers could have a fairly high degree of confidence that the motorcade would take that route on the day of the attack.
Wissam al-Hassan was intimately familiar with the security measures employed by the al-Hariri protective detail. Indeed, according to the U.N. investigation of the al-Hariri murder, a few months prior to the attack, al-Hassan and others had met with al-Hariri and urged him to increase his security due to the perceived threat from Syria and its Lebanese allies.
When al-Hassan found himself in a similar threat situation in recent months, he recognized that a high-profile detail alone could not protect him from those who would do him harm. He also lacked the resources of the wealthy al-Hariri family. He therefore decided to adopt a different form of security: keeping a low profile. The idea was to use nondescript rental cars that would be changed frequently in an attempt to blend in with other travelers on Beirut's busy streets. Al-Hassan also reportedly used a series of clandestine residences, unlike al-Hariri's well-known home, the Kuraytem Palace.
However, it appears that there were some obstacles that kept al-Hassan from maintaining a truly low profile. The night before his death, he returned to Beirut from a trip to Europe. But rather than deplaning like a normal passenger and passing through immigration and customs like an ordinary traveler, he was met planeside by the rental car that would take him to his residence for the night. Such an arrival draws attention.
Hezbollah has long controlled security at the Beirut airport. When the Western-backed government of former Lebanese Prime Minister Fouad Siniora attempted to remove Maj. Gen. Wafik Shuqayr, one of Hezbollah's fellow Shia, from his post as the director of security at the airport, Hezbollah resorted to violent protests to ensure he remained in his post.
This meant that Hezbollah was in a prime position to initiate surveillance on al-Hassan upon his arrival at the airport, or to help others pick up surveillance on him. Once it was established that al-Hassan was back in Lebanon, all that remained was to follow al-Hassan's vehicle to the residence he was using that night and then set up a VBIED along the route he would have to take to get to his office at the Lebanese Internal Security Forces headquarters building. Since the attackers knew that al-Hassan was in an unarmored rental car rather than a fully armored limousine, they were able to use a smaller explosive device than the one used in the attack on al-Hariri.
They also knew al-Hassan did not have IED countermeasure sets in his vehicle, so they could use a remotely detonated device rather than a suicide operative. However, like al-Hariri's assassination, the attack was quite inelegant. The attackers still used a larger device than required to ensure that the attack succeeded. The larger device also provided a margin of error in case it was not detonated precisely on time. Like in the al-Hariri attack, this larger-than-needed device produced quite a bit of unnecessary collateral damage, which the attackers didn't take any steps to avoid.
The Importance of Protective Intelligence
Despite using a different security concept than al-Hariri, the end result was the same -- al-Hassan was murdered, most likely by the Syrian regime and their allies in Lebanon. The Syrian military occupied Lebanon in 1976 and maintained control of the country until it withdrew in 2005. During this time, the Syrians developed a robust intelligence network in Lebanon, a network that remained largely in place after the withdrawal of Syrian forces. They also maintain close allies in various Lebanese political parties and militias, most notably Hezbollah. As noted in the U.N. investigation of the al-Hariri assassination, this intelligence network can be used to conduct surveillance that is used to plan and execute attacks against enemies of the Syrian regime.
However, that does not mean that the Syrian hand in Lebanon can move without detection. Even a sophisticated, professional intelligence network is bound by the requirements of the attack planning cycle. Their efforts are also vulnerable to detection during certain phases of that planning cycle, especially the surveillance phase.
While the Syrians and their allies have the ability to tap phones in Lebanon at will and Hezbollah controls security at the Beirut airport, these advantages do not remove the necessity for the Syrians to conduct physical surveillance in order to plan and execute attacks like those directed against al-Hariri and al-Hassan. It is therefore possible to detect such attack planning as it occurs. Indeed, it is not only possible, but essential, to detect the attack planning if protective security elements are to have any hope of keeping their principal alive in an environment like Beirut.
If attackers can freely surveil the operations of a protection detail, over time they will be able to identify the personnel, equipment and tactics employed by the security team and design ways to defeat them. A robust protective intelligence program that employs surveillance detection and countersurveillance capabilities, and that actively investigates suspicious activity, can help restrict the ability of potential attackers to gauge protective measures. Protective intelligence elements can also warn the protective detail that it needs to change tactical operations when those operations have been compromised by hostile surveillance efforts.
Unlike traditional security measures that react to threats, protective intelligence teams proactively search for evidence of hostile activity before an attack can be planned and launched. This allows the protective security team to keep on the positive side of the action/reaction equation and avoid potential problems. Certainly, protective intelligence efforts are complicated in a very busy urban environment such as Beirut, but a high level of activity on the street also complicates the operations of surveillance teams. Protective intelligence efforts such as countersurveillance teams can effectively detect and frustrate hostile activity in such places if they are properly deployed.
As evidenced by the assassinations in Beirut, any type of protective security program can be defeated if it allows potential attackers to operate freely against it. The solution lies in denying potential attackers that advantage.
Join the conversation as a VIP Member