On the morning of July 17, a guest at the JW Marriott hotel in Jakarta came down to the lobby and began walking toward the lounge with his roll-aboard suitcase in tow and a backpack slung across his chest. Sensing something odd about the fellow, alert security officers approached him and asked him if he required assistance. The guest responded that he needed to deliver the backpack to his boss and proceeded to the lounge, accompanied by one of the security guards.

Shortly after entering the lounge, the guest activated the improvised explosive device (IED) contained in the backpack, killing himself and five others. Minutes later, an accomplice detonated a second IED in a restaurant at the adjacent Ritz-Carlton hotel, killing himself and two other victims, bringing the death toll from the operation to nine — including six foreigners.

The twin bombings in Jakarta underscore two tactical trends that Stratfor has been following for several years now, namely, the targetting of hotels in terrorist attacks and the use of smaller suicide devices to circumvent physical security measures. The Jakarta attacks also highlight the challenges associated with protecting soft targets such as hotels against such attacks.

Hotels as Targets

During the 1970s the iconic terrorist target became the international airliner. But as airline security increased in response to terrorist incidents, it became more difficult to hijack or bomb aircraft, and this difficulty resulted in a shift in targetting. By the mid-1980s, while there were still some incidents involving aircraft, the iconic terrorist target had become the embassy.

But attacks against embassies have also provoked a security response, resulting in embassy security programs that have produced things like the American “Inman buildings”, which some have labeled “fortress America” buildings due to their foreboding presence and their robust construction designed to withstand rocket and large IED attacks. Due to these changes, it became far more difficult to attack embassies, many of which have become, for the most part in our post-9/11 world, hard targets. (This is certainly not universal, and there are still vulnerable embassies in many places. In fact, some countries locate their embassies inside commercial office buildings or hotels.)

Overall, however, this trend of making embassies hard targets has caused yet another shift in the terrorist paradigm. As Stratfor has noted since 2004, hotels have become the iconic terrorist target of the post-9/11 era. Indeed, by striking an international hotel in a capital city, militants can make the same type of statement against Western imperialism and decadence that they can make by striking an embassy. Hotels are often full of Western businessmen, diplomats and intelligence officers, providing militants with a target-rich environment where they can kill Westerners and gain international media attention without having to penetrate the extreme security of a modern embassy.

Our 2004 observation about the trend toward attacking hotels has been borne out since that time by attacks against hotels in several parts of the world, including Pakistan, Afghanistan, Iraq, Jordan, India and Egypt. In addition to attacks against single hotels, in the attacks in Mumbai, Amman, Sharm el-Sheikh — and now Jakarta — militants staged coordinated attacks in which they hit more than one hotel.

Hotels have taken measures to improve security, and hotel security overall is better today than it was in 2004. In fact, security measures in place at several hotels, such as the Marriott in Islamabad, have saved lives on more than one occasion. However, due to the very nature of hotels, they remain vulnerable to attacks.

Unlike an embassy, a hotel is a commercial venture and is intended to make money. In order to make money, the hotel needs to maintain a steady flow of customers who stay in its rooms; visitors who eat at its restaurants, drink at its bars and rent its banquet and conference facilities; and merchants who rent out its shop space. On any given day a large five-star hotel can have hundreds of guests staying there, hundreds of other visitors attending conferences or dinner events and scores of other people eating in the restaurants, using the health club or shopping at the luxury stores commonly found inside such hotels.

Such amenities are often difficult to find outside of such hotels in cities like Peshawar or Kabul, and therefore these hotels also become gathering places for foreign businessmen, diplomats and journalists residing in the city, as well as for wealthy natives. It is fairly easy for a militant operative to conduct surveillance of the inside of a hotel by posing as a restaurant patron or by shopping in its stores.

Of course, the staff required to run such a huge facility can also number in the hundreds, with clerks, cooks, housekeepers, waiters, bellboys, busboys, valets, florists, gardeners, maintenance men, security personnel, etc. These hotels are like little cities with activities that run 24 hours a day, with people, luggage, food and goods coming and going at all hours.

There are emerging reports that one of the suicide bombers in the Jakarta attack was a florist at one of the hotels and it is possible that he used his position to smuggle IED components into the facility among floral supplies. If true, the long-term placement of militant operatives within the hotel staff will pose daunting challenges to corporate security directors. Such an inside placement could also explain how the cell responsible for the attack was able to conduct the detailed surveillance required for the operation without being detected.

Quite simply, it is extremely expensive to provide a hotel with the same level of physical security afforded to an embassy. Land to provide standoff distance is very expensive in many capital cities and heavy reinforced-concrete construction to withstand attacks is far more expensive than regular commercial construction. Such costs must be weighed against the corporate bottom line.

Moreover, security procedures at an embassy such as screening 100 percent of the visitors and their belongings are deemed far too intrusive by many hotel managers, and there is a constant tension between hotel security managers and hotel guest-relations managers over how much security is required in a particular hotel in a specific city.

In fact, this debate over security is very similar to the tension that exists between diplomats and security personnel at the US Department of State. And the longer the period between successful attacks (there had not been a successful terrorist attack in Jakarta since September 2004 and in Indonesia since October 2005), the harder it is to justify the added expense — and inconvenience — of security measures at hotels. (Of course, in very dangerous places such as Baghdad, Islamabad and Kabul heavy security is far easier to justify, and some hotels in such locations have been heavily fortified following attacks on other hotels in those cities.)

In many places, hotel guests are subjected to less security scrutiny than visitors to the hotel, as the hotel staff seeks to make them feel welcomed, and it is not surprising that militants in places like Mumbai (and perhaps Jakarta) have been able to smuggle weapons and IED components into a hotel concealed inside their luggage.

We have received a report from a credible source indicating that one of the Jakarta attackers had indeed been checked into the JW Marriott hotel. The source says the attacker, posing as a guest, was an Indonesian but was likely from a remote area because he did not appear to be familiar with how to use modern conveniences such as the room’s Western-style toilet. That the attackers were Indonesians supports the theory the attack was conducted by the Southeast Asian group Jemaah Islamiyah (JI) or a JI splinter group. JI has conducted (or is a suspect in) every high-profile terror attack in Indonesia in recent years.

Sources advise that significant similarities exist between the unexploded device discovered in the attacker’s hotel room in the JW Marriott and known JI explosive devices used in past attacks and recovered in police raids. This is another strong indication JI was involved.

One other important lesson that travellers should take from this string of hotel attacks is that, while they should pay attention to the level of security provided at hotels, and stay at hotels with better security, they should not rely exclusively on hotel security to keep them safe. There are some simple personal security measures that should also be taken to help mitigate the risk of staying at a hotel.

Size is not everything

As Stratfor has noted since 2005, the counterterrorism tactic of erecting barricades around particularly vulnerable targets — including government buildings such as embassies and softer targets such as hotels — has forced militants to rethink their attack strategies and adapt. Instead of building bigger and bigger bombs that could possibly penetrate more secure areas, operational planners are instead thinking small — and mobile. In fact it was the October 2005 triple-bomb attacks against restaurants in Bali, Indonesia, by JI and the November 2005 triple suicide-bombing attacks against three Western hotels in Amman, Jordan, that really focused our attention on this trend.

Like the July 7, 2005, London bombings, these two attacks in Jakarta and Amman used smaller-scale explosive devices to bypass security and target areas where people congregate. Such attacks demonstrated an evolution in militant tactics away from large and bulky explosives and toward smaller, more portable devices that can be used in a wider variety of situations.

Flexibility provides many options, and in the case of the operative who attacked the JW Marriott on July 17, it appears that he was able to approach a meeting of foreign businessmen being held in the lobby lounge and attack them as a target of opportunity. A vehicle-borne IED (VBIED) detonated in front of the hotel would not likely have been able to target such a group so selectively on the fly.

Of course, this trend does not mean that large VBIEDs will never again be employed any more than the trend to attack hotels means aircraft and embassies will never be attacked. Rather, the intent here is to point out that as security has been increased around targets, militants have adapted to security measures designed to stop them and they have changed their tactics.

At first glance, it would seem logical that the shift from large VBIEDs would cause casualty counts to drop, but in the case of JI attacks in Indonesia, the shift to smaller devices has, in fact, caused higher casualty counts. The August 2003 attack against the JW Marriott in Jakarta used a VBIED and left 12 people dead. Likewise, the September 2004 attack against the Australian embassy in Jakarta used a VBIED and killed 10 people.

The use of three smaller IEDs in the 2005 Bali attacks killed 23, more than JI’s 2003 and 2004 VBIED attacks combined. Additionally, the 2005 attacks killed five foreigners as opposed to only one in the 2003 attack and none in the 2004 attacks. The operatives behind the July 17 attacks surpassed the 2005 Bali attacks by managing to kill six foreigners.

The reason that smaller is proving to be more effective at killing foreigners is that the rule for explosives is much like real estate — the three most important factors are location, location and location. Though a larger quantity of explosives will create a larger explosion, the impact of an explosion is determined solely by placement.

If a bomber can carry a smaller explosive into the center of a heavily packed crowd — such as a wedding reception or hotel lobby — it will cause more damage than a larger device detonated farther away from its intended target. These smaller devices can also be used to target a specific person, as seen in the December 2007 assassination of former Pakistani Prime Minister Benazir Bhutto .

A person carrying explosives in a bag or concealed under clothing is much more fluid and can thus manoeuver into the best possible position before detonating. In essence, a suicide bomber is a very sophisticated form of “smart” munition that can work its way through gaps in security and successfully seek its target. This type of guidance appears to have worked very effectively in the July 17 Jakarta attacks. As noted above, of the seven victims in this attack (the nine total deaths included the bombers), six were foreigners. JI has received criticism from the Islamist community in Indonesia for killing innocent bystanders (and Muslims) and such targeted attacks will help mute such criticism.

In addition to being more efficient, smaller IEDs also are cheaper to make. In an environment where explosive material is difficult to obtain, it is far easier to assemble the material for two or three small devices than the hundreds of pounds required for a large VBIED. An attack like the July 17 Jakarta attack could have been conducted at a very low cost, probably not more than a few thousand dollars. The three devices employed in that attack (as noted above, there was a third device left in the hotel room that did not explode) likely did not require much more than 60 pounds of explosive material.

This economical approach to terrorism is a distinct advantage for a militant group like Noordin Mohammad Top’s faction of JI, Tanzim Qaedat al-Jihad. Due to the Indonesian government’s crackdown on JI and its factions, the Indonesian militants simply do not have the external funding and freedom of action they enjoyed prior to the October 2002 Bali attack. This means that, at the present time, it would be very difficult for JI to purchase or otherwise procure the hundreds of pounds of explosive material required for a large VBIED — coming up with 60 pounds is far easier.

Even though JI is fragmented and its abilities have been degraded since the 2002 Bali attack, a cell like the one headed by Top certainly maintains the ability and the expertise to conduct low-cost, carefully targetted attacks like the July 17 Jakarta bombings. Such attacks are easily sustainable, and the only real limiter on the group’s ability to conduct similar attacks in the future is finding attackers willing to kill themselves in the process.

Perhaps a more significant limiter on their operational tempo will be the law enforcement response to the attack, which could force the cell to go underground until the heat is off. It might also be difficult to move operatives and IEDs from safe houses to targets when there is more scrutiny of potential JI militants.

Increased security at potential targets could also cause the cell to wait until complacency sets in before attacking a less wary — and softer — target. Of course, the group’s operational ability will also be affected should the Indonesian government capture or kill key operatives like Top and his lieutenants.

From the standpoint of security, the challenges of balancing security with guest comfort and customer service at large hotels will continue to be a vexing problem, though certainly it would not be surprising to see an increase in the use of magnetometers and X-ray machines to screen guests and visitors at vulnerable facilities. This may also include such measures as random bomb-dog searches and sweeps in areas where dogs are not a cultural taboo.

Additionally, in light of the threat of suicide bombers using smaller devices or posing as guests, or even placing operatives on the hotel staff, much more effort will be made to implement proactive security measures such as protective intelligence and counter-surveillance, which focus more on identifying potential attackers than on his or her weapons.

Hotel staff members also need to be taught that security is not just the role of the designated security department. Security officers are not omnipresent; they require other people on the hotel staff who have interactions with the guests and visitors to be their eyes and ears and to alert them to individuals who have made it through security and into the hotel and appear to be potential threats. Of course, the travelling public also has a responsibility not only to look out for their own personal security but to maintain a heightened state of situational awareness and notify hotel security of any unusual activity.

Courtesy www.stratfor.com