During last September’s ferocious and murderous attack on the Westgate Shopping Mall in Kenya, the terrorists involved routinely turned to social media to report their activities. It was, in essence, a real-time documentary of what the terrorists had achieved and why they had conducted the attack, and it was enabled by local wireless networks.
Al Shabab, who later claimed to be responsible for the attack, also made extensive use of social media to provide a complementary narrative of the episode as it unfolded. As their various social media accounts were identified and removed so they quickly moved onto another account. Throughout the attack they maintained their service to anybody wishing to listen in to their account of the events.
Benefits v drawbacks
This tactic of using social media sets a new paradigm for terrorism and one that poses some challenges for the emergency services, in contrast with what has gone before. As a terrorist attack unfolds should they also disable wireless networks in the local area or should they let them continue to function? What are the potential benefits and drawbacks of allowing wireless networks to operate in the middle of a terrorist attack?
Perhaps one of the earliest examples of the challenge was seen in the immediate aftermath of the terrorist attack on London on 7 July 2005. Grainy images taken by people who had escaped from the trains did eventually appear in the media. But their appearance was delayed by a lack of underground communications capability.
The rapid overload that occurred in many of the mobile phone networks that day also hampered the movement of any imagery collected by those involved. Since then the network capacity in and around London has grown exponentially with important implications if a re-run of 7 July or a more general marauding firearms attack were to occur.
The situation in the Mumbai terrorist incident in 2008 was different. In Mumbai the terrorists had used mobile phones taken from those they killed to access the internet and see how their activities were being reported. They made no effort to post images or to try and use social media to defend their actions.
The production of the most graphic images arose from so-called citizen journalists who quickly rushed to the scene to obtain the images in the immediate aftermath of the attack. Images of people dying at the main railway terminus in Mumbai were available online within minutes of the attack starting.
The situation at Westgate, Kenya however was again slightly different, showing how terrorists are evolving their tactics when it comes to the use of social media. The terrorists had come with a specific agenda to use social media and not rely on reporting from either the mainstream media or any citizen journalists. But they were not the only ones to make use of social media during the attack.
The survivors were also tuning into social media as they tried to hide inside the mall from the terrorists. Through social media many who survived the initial onslaught of the attack were able, as the gunmen moved quickly through the centre not checking on who had died, to provide insights into what they had observed: people had been tortured; others had been asked specific questions to determine if they were a Muslim.
Rumours concerning this behaviour quickly spread throughout those concealed in the mall through access to social media, and many turned to a number of well-known search engines looking for answers to these questions in case they too were challenged by the gunmen.
Had the wireless networks underpinning this been deactivated to try and prevent the terrorists from spreading their own propaganda it may have cost some people their lives.
The survivors also used social media to provide a running commentary of what they were observing as the attack developed. Inevitably through the confusion that arises in such situations their reporting was highly variable. For the authorities trying to gain some situational awareness of the number of people involved in the storming of the mall the information was uncertain.
At one point it was estimated that up to sixteen gunmen were rampaging through the mall. While some uncertainty still exists over the precise number involved, recent imagery from the attack suggests that the whole episode was conducted by as few as four men.
For the emergency services the problem of how terrorists use social media is important. In both Mumbai and at Westgate the terrorists were able to find out how the authorities were responding to their actions. Public statements in both events by leading political leaders had a material bearing on what the terrorists did next.
The benefits of cutting off wireless networks in the vicinity of an incident include denying the terrorists an outlet for their ideology and intelligence on how the authorities are gaining control of the situation. What the wider media think is information that the public at large needs is in fact valuable intelligence for the perpetrators of the attack.
Yet looked at from a different viewpoint the benefits of maintaining the wireless networks can outweigh the downsides. Any survivors of the attack are able to provide some information, albeit confused, to the emergency services. This may help define the rate of movement of what might be called the hot-spot or active killing zone.
Are the terrorists mobile or have they secured a stronghold, in which case the definition of the active killing-zone becomes very straightforward. If the terrorists are on the move then the situation will be very dynamic, complicating the risk assessment procedures that underpin decisions to commit members of the emergency services into the incident.
With the emergency services now expected to go into harm’s way and evacuate those wounded in the course of the attack, any information of where the terrorists are currently deployed on the ground is useful.
In Cumbria in 2010, when Derrick Bird embarked upon his shooting spree that saw 12 people die, interventions by the emergency services were restricted by what was at the time accepted operational procedures. Until the police confirmed an area was clear the fire and ambulance services had to remain clear.
That is no longer an acceptable way of working and emergency services crews are now expected to operate close to the area where the terrorists or gunmen are active. As they enter such an area they too may wish to use their own personal mobile phones to send imagery to the command teams in control of the incident.
They can become a valuable source of real-time intelligence information. Disabling wireless networks would eliminate this potential source of what might be very valuable information concerning the way the event is unfolding. As ever with the kind of problems that can be referred to as ‘wicked’ (ones that have no perfect outcome whatever the course of action taken) the arguments for and against switching off wireless services and mobile phone services are complex.
Who is to say, for example, that terrorists might also use wireless networks to detonate bombs they have left behind in the wake of the initial assault? Might they even go to a new level of capability and try to launch cyber-attacks using their wireless access – perhaps choosing to post graphic imagery on main government websites as a way of getting their message out to the widest possible audience.
These points will have to be considered in real-time by the command team charged with responding to the attack. What is also clear is that in such dynamic and rapidly unfolding situations it is very difficult to prescript the response.
The default assumption must therefore be that initially any wireless networks in the vicinity of an attack will remain enabled. As the emergency services consider how they might contain such an event they would do well to reflect upon the implications of such a working assumption and look carefully at what that means for their own operating procedures.