Schneier on Security
A blog covering security and security technology.
« Joke That'll Get You Arrested |
| 307-Digit Number Factored »
May 21, 2007
London's Dirty Bomb Tests
London is running a dirty-bomb drill. Mostly a movie-plot threat, but these sorts of drills are useful, regardless of the scenario.
I agree with this:
As ever, plain old explosives are the big worry. As for chemicals, compare the effects of the Tokyo subway gas attack (10 terrorists, five attacks each involving 1kg of hard-to-get sarin nerve gas, 12 dead total) with a typical backpack-bomb attack (London 7/7: four terrorists, four simple home made devices, 52 dead). Only a stupid attacker would bother with chemicals. Real pros like the IRA, for instance, never have.
Although with a dirty bomb, the media-inspired panic would certainly be a huge factor.
Posted on May 21, 2007 at 6:34 AM
• 27 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Even without the 'dirty' factor media are actually one of the most helpfull terrorists' tool. An excellent example can be seen in the first episode of the 5th season of 'Spooks' where (in this case deliberate) media reporting is a crucial ingredient in spreading fear.
This dies actually seem a pretty sensible test to carry out.
Rather than guess how far a gas could spread and remain harmfull, or, given a particular set of wind/weather how long/thin the lethal plume would be it seems more sensible to track a real life non toxic gas.
If in the unlikely event of a real toxic gas attack the police will have some hard data to base thier descision making on.
Incidently the rational approach " .. this type of attack a would be less effective than type b .." doesnt really hold here given that the potentail attackers are not behaving rationally. -- "I will blow up myself and several strangers because someone with an ungroomed breard and a mad glint in his eye says god wants me too. "
"The trials will improve our understanding of the movement of air-borne material in the urban environment and will enable enhancements in public protection to be developed," he said.
This seems useful in the case of industrial accident, too.
dirty bombs are really hard to do well. Spreding the poision is not nearly as easy as people think. Explosivies tend to burn most of it. Depending on what it is, its hard to get right.
Both the Tokyo subway gas attack and London 7/7 or even 11/09 all had surprising low death tolls.
The london underground is very busy at that time, I'm amazed that only 52 were killed. When I was on the london underground I asked what the procedure in the event of a fire. Most folk told me that there was nothing you could do..... fire exits etc just are not there.
The Tokyo ones are even more amazing (Now thats a busy underground). Even the twin trade towers had a low toll compared to what what it could have been.
The IRA death rates were also pretty low considering.
All in All, even if you are at the scene of a "attack" you still have good odds of survial if you keep your head.
Drills help people (officals and the public) keep their head.
As a scenario (root cause) this is useless, but everyone on the inside knows that as Bruce alluded to.
As a training exercise these kind of things are always helpful. Emergency services people don't tend to care whether weapons are dirty or clean, large or small, how many people were involved, whether the cause was people or 'god', intentional or unintentional, etc - what they care about is being able to cope, being orderly, rational, measured, prompt, coordinated, being able to adapt, etc - whether engaged in a fight (people, fire, hazmat, etc), a rescue, or an individual medical situation.
These exercises test readiness, coordination, communication, attitude, and many other things at multiple levels. They only pick 'serious sounding' scenarios to justify the cost to a cynical public and political opposition - the exercise could be a response to killer tomatoes and they'd take it just as seriously and learn just as much from it.
Regular drills for emergency responders are necessary and useful, and the scenarios have to be changed to keep things interesting for the participants. Skill focus is on those things that are needed regardless of the actual event.
The numbers of terror don't always add up. In the Maryland suburbs of the District of Columbia, the 2002 "Beltway sniper attacks" gripped us with an amazing amount of fear. Constant media reports and opinions, including suggestions on whether it's best to walk quickly to your car in a straight line or to zig-zag, fueled the flame. (And no, I don't remember any of them mentioning that an automobile makes lousy cover.)
> The IRA death rates were also pretty low considering.
As one of the comments on the Reg article notes, the IRA generally phoned in warnings, they weren't trying to kill as many people as possible.
See http://news.bbc.co.uk/onthisday/hi/dates/stories/... for example.
There have been numerous trials over the years to investigate dispersal of airborne materials in different environments. Do we really need any more?
As has been pointed out, the IRA generally phoned-in warnings. They learned early on that you could achieve maximal panic- and fear-effects through use of numerous hoaxes interspersed with an occasional actual bomb.
This is .. very odd. Whatever your opinion of the risk of CBW attack by terrorists, or of the value in hazardous chemical accidents.
The mechanisms, equations, and hard data governing the spread of gases released in various environments have been very, very well known for decades. The earliest detailed studies of this type that I have heard of occurred just before World War II, although I have seen a reference to limited testing in 1917. Since then it has expanded into an entire discipline of environmental science. I cannot see how this trial is supposed to expand the already considerable -- nay, immense -- knowledge in this field.
And the knowledge is both deep and wide: as long ago as the 1920s, trials like this were conducted with mocked-up villages and real chemical weapons, while today LIDAR systems are used to minutely map contamination plumes from industrial pollutants, every day, for any of tens of thousands of pollutants and hundreds of thousands of potantial sources.
The only fallout from America's dirty bomber in custody is that the Bush Administration can not seem to get a conviction (of Padilla).
"There have been numerous trials over the years to investigate dispersal of airborne materials in different environments. Do we really need any more?"
I care less about the dispersal of airborne materials and more about the various response teams, and how they act and interact.
Lots of improvements along those lines can be uncovered by these drills.
Panic has a very large impact. See the Stimson Ataxia report for details, but in Tokyo the casualty ratio was: 12 dead, about 150 injured (more than 24hr hospitalization), and over 5,000 panic related emergency room treatments. That was without a media contribution. When you add media and government hysteria (as with the Boston Moonite fiasco), panic management becomes the primary issue with non-traditional attacks.
So far, non-panic casualties from both military and non-military CBW fall in line with the predictions of models and experience.
As we all know the goal of terrorists is to spread terror and fear. A backpack bomb that kills 50 people isn't as terrible as a gas attack killing 20 people. Bombs are "conventional" attack weapons and people are used to their existence. A gas attack, on the other hand, takes the terror to a higher level because people have not grown accustomed to them and fear them a lot more.
Perhaps this is answered elsewhere... What would be a better alternative to information distribution than the typical media coverage of events? It makes sense to me that the media would give sensational coverage of something like an unconventional bomb and it also makes sense that the general public would be scared of new attacks. It's been the case through most of history that "new things", especially new attacks, are scary.
@greg , Alan Braggins
"The IRA death rates were also pretty low considering."
On one occasion they where not.
What the bombers did was to place a large bomb at the point people where most likley to be evacuated to the result was a horific death rate.
THis was repeated with the Bali bombing where 1Kg of plastic was used to scare people and a 150K Amonium NItrate bomb was waiting in a vehical and killed 202 people...
By the way, this rationale is partially bogus.
People were a bit lucky in the Tokyo poison gas attacks that the terrorists used a bad methodology. Sarin isnt that volatile and they just spilled it on the ground. Had they managed to get it into aerosol form, the death-count would be remarkably higher.
I do agree however that such a poison gas attack takes a lot more sophistication and competence compared to classic bomb attacks, so the overall conclusion isn't wrong. Just some of the rationale isnt right.
> I do agree however that such a poison
> gas attack takes a lot more sophistication
> and competence compared to classic bomb attacks
No it doesn't. An explosion would have been a suitable way to disperse the sarin.
BTW, any comments regarding ANTHRAX, anyone? Manufactured according to secret US gov procedures, spread in a way that would cause very few casualties but maximises media coverage, just at the right time to scare the shit out of the population? Nobody? Hello?
So where can I buy small hardened steel ball bearing balls by the pound? I guess that's too suspicious these days, I think I'm going to buy some regular nuts and bolts instead to manufacture a "weight vest"...
It seems to me that the objective of a "terrorist" attack has nothing to do with the number of people harmed, but more so the reaction it brings as a result. The more media coverage, the more shocking, the more the fear aspect can be hyped, the more effective. If people die, particularly innocent people who didn't see it coming -- well that just adds dramatic effect. The actual killing is not part of the objective.
Look at how effective Al Qaeda has been. They've cost the US economy trillions of dollars, dramatically lessened the US' international international standing, killed thousands of US troops and shi'a, gotten rid of Saddam Hussein, dominated the press, caused every man woman and child inconvenience and prompted an abrupt withdrawl of civil rights world-wide. All that for the cost of a two-dozen plane tickets, some box cutters, and eternal damnation of some dispensible zealots. That, and that they seem to be able to play the US government like a finely tuned fiddle.
Even if it killed no more than a handful of people, a dirty bomb would blow up a thousand times over on TV.
The poster "Clive Robinson" is thinking of the Omagh bomb, the biggest single loss of life in the troubles.
I dont think he is correct in saying that they deliberately directed people towards a second device.
What happened was that the Real IRA, a splinter group, mainly comprimised the Provo´s backroom boys.
Their expertise was inmaking bombs, they were not used of the "on the day" logistics like phoning in warnings.
The warning was said "there's a bomb in Omagh main street near the courthouse, a 500lb bomb. It's going to go off in 30 minutes"
Excepth that Omagh does not have "Main Street" so the police cordoned off High Street (the biggest street) and directed then towards the supposed safety of Market Street.
These inaccurate warnings effectively doubled the number of people in the vicinity of the car-bomb.
The Real IRA were not trying to kill as many people as possible. They knew a attrocity woukd mean the police would get the resources to really go after the commanders.
Which is what happened.
So, do any of the analysis include the cost (and effective denial of service) resulting from the cleanup subsequent to a well-placed dirty bomb?
(Decontamination isn't as much of a factor for conventional explosives)
to M. McKevitt
that is NOT the bomb that Clive is thinking of. I remember the incident, although am too lazy to search the web to find it. The IRA planted 2 bombs, timed x minutes apart, with the 2nd bomb being at the end of the street.
Somewhere in the past few years the IRA have become these "considerate" bombers, not like those dirty Al'Queida(?spelling) lot.
Take this amusing thought: Do a media FUD drill. Do a massive notification 2 weeks in advance that a deliberate false news event will be broadcast in the city listing the details such as airplane crashing at the airport with plutonium payload and then run the full media drill as if it was real for four hours with realistic hype. Watch the people who recalled the drill notice react and interact with the uninformed/easily manipulated population. Do a media follow up (preferably national audience like 20/20) to point out the lessons learned along with common-sense process to evaluate what to really do.
This will probably have to be computer sim, not a real city, but it's something to think about.
And think about this: how can we statistically evaluate how easily a populace is terrorized and what tactic would be most effective? This information would be useful for offensive and defensive planning.
A final thought: how to use a panic situation to social-engineer an environment to "fail open", that is, the response actually dramatically increases security vulnerability.
"dirty bombs are really hard to do well. Spreding the poision is not nearly as easy as people think. Explosivies tend to burn most of it."
That's an issue with organic poisons such as nerve gas, but not with radioactives - chemical recombination doesn't affect radioactivity.
The War Nerd had a good analysis of the IRA campaign (http://www.exile.ru/2005-July-15/nerf_war_and_real_war_ira_vs_al_qaeda.html). The takeaway was that the IRA realized that killing Brits just p*ssed them off; damaging extremely high-value property with no casualties applied much pain, with no side effects.
Mobile, Networked Radiation Detectors Help the Law Find Dirty Bombs, another nice example of cheap equipment to use when doing a drill, and its only 250000usd
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.