From New Zealand to New York: Understanding Behavioral Indicators & the Hostile Events Attack Cycle

By David Pounder & Brett Zupan

TL;DR

• After the New Zealand attacks, FB-ISAO shared a TLP AMBER report with members relating the attack to the Hostile Events Attack Cycle (HEAC).
• A recent incident in New York underscores the potential of inspired, copycat, and retaliatory incidents after significant attacks and around notable anniversaries and special events.
• For security leaders, it is important to understand the HEAC and behavioral indicators of potential violence.

On 15 March, at approximately 1:40 pm local time, an armed shooter dressed in military attire entered the Al Noor Mosque in Christchurch, New Zealand and began a shooting rampage spread across two mosques. By the end of the day, the attacker killed 50 people and wounded 50 more. The attacker in this deliberate action was identified as Brenton Tarrant, a 28-year-old Australian. The attack clearly followed many of the phases of the Hostile Events Attack Cycle (HEAC). HEAC is an 8-phased cycle which can define the process attackers go through before conducting an attack, whether this is formal or informal, or whether they know it or not. There is no doubt, based on the jumbled, 74-page manifesto Tarrant posted on social media, the social media posts, and the Facebook Live stream he aired during the attack, that Tarrant carefully planned and orchestrated the attack. 

Following this attack, and after the much-publicized fire at the Notre Dame Cathedral in Paris, in the run-up to Easter weekend, a 37-year-old philosophy professor is suspected to have aspired to set fire to the iconic St. Patrick’s Cathedral in New York City. As the investigation into that incident continues, some interesting details are beginning to come to light. Among those is another incident the suspect was involved in at Cathedral Basilica of the Sacred Heart in Newark, and his purchased of a one-way ticket to Italy, scheduled for shortly after the New York arrest.

• HS Today: Man Arrested After Trying to Enter St. Patrick’s Cathedral with Gas, Lighter Fluid, Lighters
• The Daily Beast: Man Charged With Trying to Set St. Patrick’s on Fire Was Arrested at Newark Cathedral Days Earlier

This blog focuses on the New Zealand attack and aligns the details of the attack as they are currently known against the eight phases of the HEAC:

Phase 1 – Initial Target Consideration. Tarrant gave insightinto his motivation behind the attack. In his manifesto he “identified himself by name and said he was a white supremacist who was out to avenge attacks in Europe perpetrated by Muslims.” Tarrant began “planning an attack roughly two years in advance and an attack at the location in Christchurch three months in advance… The attack was planned to allow enough time to train, form a plan, settle my affairs, write down my views, then enact the attack.” New Zealand was not the original choice for the attack, as he “only arrived to New Zealand to live temporarily whilst [he] planned and trained,” but he soon changed his mind and believed New Zealand would show that nowhere in the West was safe for Muslims, and that “the invaders were in all of our lands, even in the remotest areas of the world.”

Phase 2 – Initial Surveillance. In the manifesto, it was clear that Tarrant conducted online surveillance to find the right target. Christchurch only has three mosques. Originally the mosque in Dunedin was the main target because of a video on their Facebook page that said it was “only for Muslims”, which Tarrant viewed as an admission of some sort of guilt. However, he visited the mosques in both Christchurch and Linwood, causing him to re-evaluate his target and ultimately change his mind. Initial surveillance also identifies opportunities of when to strike. In Islam, Friday is the day of gathering and followers are encouraged to take time away from their activities to attend prayers. Tarrant would have understood that this was the time to strike in order to inflict as many casualties as possible.

Phase 3 – Target Selection.When he visited the mosques in Christchurch and Linwood, he decided to change his plans. “The Christchurch and Linwood mosques had far more invaders, in a more prominent and optically foreign building, with less students, more adults and a prior history of extremism.“  The third mosque on his list was in Ashburton where the mosque was a converted church which he viewed as “the desecration of the church.” When Tarrant was ultimately stopped by police, it is believed he was on his way to continue his attack there, which is an hour’s drive from Linwood.

Phase 4 – Intense Surveillance.Phase 4 is designed to help build out target selection and validate the information already collected by having a direct “eyes-on” view, the attacker can get a first-hand look at the outward facing security such as guard posts, security patrols, or counter-measures such as identification card checks, bag checks or other screening measures. The period of intense surveillance will go into much more detail and will involve a lot more “time on target,” or time that is spent observing and getting to know the target in-depth. While we know Tarrant visited the mosques, we do not know at this time if he visited on more than one occasion to assist in the plan, or if he had any interactions with members of the mosque to understand the security situation, and any police response.

Phase 5 – Planning and Rehearsals. This is another area that has not been fully revealed, though there are some indicators in Tarrant’s manifesto and in how he carried out the attack:

• In the first attack, extra ammunition and weapons were stored in his vehicle which he parked next to the mosque.
• He envisioned / planned for a possible confrontation with New Zealand police which he hoped to avoid unless that police officer was part of “an invaders background”.

Phase 6 – Pre-Attack Operations. This is one of the less defined and more flexible elements of the Attack Cycle in that the attacker will need to do their pre-attack checks and inspections to ensure all the pieces of the attack are accounted for, are functioning, and ready for the attack. A few areas give some insight into this:

• He was prepared on social media and had a camera affixed to his helmet in order to live stream the attack.
• The explosive device on his vehicle had to be attached and prepared.
• While his manifesto clearly was a running collection of thoughts over a period of time, he had to have it ready to publish prior to the attack.

Phase 7 – Attack. This phase has been well documented by media.

Phase 8 – Escape.Tarrant considered that death was a possibility, but he had hoped to survive as it would allow him to “further spread my ideals by media coverage and to deplete resources from the state by my own imprisonment.” 

The below areas are strategies for helping faith based organizations plan for hostile events and disrupting the HEAC.

1. Know the Threat. 
2. Security Briefings / Information Sharing. 
3. Formalize the Security and Incident Response Plan.
4. Training / Rehearsals / Exercises.
5. Employ Random Active Measures. 

Additional resources include:

• Homegrown Violent Extremist Mobilization Indicators 2019
• U.S. Justice Department Launches New Hate Crimes Website
• FBI’s 2017 Hate Crime Statistics
• See our Resources page for more.

Consider joining FB-ISAO! Read more on membership from the link at left and below.

• Learn about our Membership Programs
• Learn why your FBO should join FB-ISAO
• About our Vetting Policy
• About the Traffic Light Protocol

David Pounder is the Director for Intelligence and Analysis at Gate 15, supporting FB-ISAO. Dave provides expert threat and risk analysis, assessments and special project support for internal activities and client needs.

Brett Zupan is a Risk Analyst at Gate 15, supporting FB-ISAO, with experience in all-hazards analysis, exercise development, and information sharing. He has supported analysis, preparedness and operations for a number of critical infrastructure communities.