Hostile Reconnaissance: Learning the lessons

The information gathered and gained within the hostile reconnaissance (HR) process is the key to the success of a threat. We must apply a mix of knowledge, skill set, and professional bravery to understand, prevent and, most importantly, learn from those that carry out HR.

As a practitioner in all things ‘hostile’, I believe it’s important to separate the theoretical understanding of hostile reconnaissance (HR) and move it into the realm of reality.

It’s my view that we often fail to see the true reality of the ‘opposition’ threat and fail to prevent further actions or consequence. Hostile Reconnaissance is a live beast: it moulds to site and people vulnerabilities, and it has to be placed against the strong facts as we know them.

It about understanding the true threat is around our people and places at this exact moment.

How can we identify a true threat, if we don’t believe that?

When we review incidents of crime, terror and foreign state activity, we must not continue to strip out the HR as just a learning point: it must not be consigned to the bin of history and lost opportunities.

As a UK Government SME (subject matter expert) within the worlds of Hostile Activity, Detection and Threat Mitigation, I know that many mistakes have been made and many mistakes continue to be made. My concern is that we are blind to the threat. With this understanding, I recommend an approach that addresses these questions:

• How do we apply the clues and markers that readily identify hostile activity and the associated HR?
• How do we truly attempt to understand the motivation of the threat? Do we ever attempt to think like a hostile operator?
• How do we develop an understanding of the world around us in enough detail?

This is a world of varied threats: Foreign State Actors (FSA), Organised Crime Groups (often proxy for the FSA world), political protest, targeted high-value crime and conventional crime. All play by a similar set of rules – rules that we fail to fully understand.

What we know

Strong, but true assumptions remain the core of our baseline understanding. We know that all persons and groups carry out HR prior to the outcome they wish to achieve. These periods of hostile observations can be as compressed as multiple times over 20 minutes or stretched out over weeks or months and even revolving campaigns. Without the information that they gain within their activity, they can’t be successful. If we accept this, then we should also accept that we have all of the advantages against the ‘opposition’. We control the castle.

Mapping the threat

Threats to people and places takes many forms. From the physical – the targeting and attack of site users – to the more strategic cyber and organisational penetrations that see significant if not extreme organisational attack and everything in between. They can all have a tangible effect on business as usual.

Mapping the threat remains key to learning the lessons of the past. If we understand that a venue/person/event is potentially vulnerable to hostile activity, then it is possible to both identify with high certainty where this activity will take place and actually predict the ‘event’ itself. This mapping should happen, but often it doesn’t. Humans fear risk, we fear committing to a statement. I believe we should not miss this critical step. The mapping of the threat must include the possible related HR; it is a predictable process in all of its stages: on-line, physical and insider leakage. It’s also highly predictable that it won’t be seen. If we know where to look, why to look and when to look, we will see everything and we would stop most things happening. Significant hostile activity mapping has taken place over many of our private sector and governmental key sites, but in my view it is neither predictive nor anything more than a general cover-all.

Understanding the detail of the threat

The ability to understand the detail of the hostile activity threat and related HR is a critical part of effective hostile reconnaissance. What motivates a specific individual, group or country signposts both what their HR will look like and how it will materialise on the ground.

It is a game of detail – the clothing, the movement, the reaction, the appetite for risk: they all feed into how we perceive and deal with threat. No one group, one country or one person are the same – we are humans, our activity is unique and should be seen as such.

How we perceive the threat

Perception of threat remains the greatest of friends to the hostile operator – it is the cloak of invisibility that allows for constant, directed and highly effective HR against many people and places. Generally, we perceive threat based on gender, ethnicity and over-all appearance. We fail to understand the heuristics and biases of our own lives lived and the structure of our minds that this has created. Our opposition seeks to take advantage of this and nearly always places its appearance of hostile operator in direction contradiction of what we would expect to see as a threat. So most hostile activity is neither difficult nor ineffective, because we don’t see them in the first place.

Developing a skill set to prevent hostile reconnaissance

Skill set development is key in the ability to truly identify, pressurise and prevent those carrying out HR. It is an art to identify hostile threat, it is a constant process of mistakes made and a commitment to learning from those mistakes. Rather than the promotion of hostile activity after the fact (and many events fit this profile), we should be obsessed with countering this activity in the first place.

As we stand, we are losing against the opposition

Opposition is the true word that we must use. Rather than an obsession with good and evil (that always depends on individual perception), I believe we should see the countering of HR as a high-stakes game. Remove emotion, remove what we think we know and begin to apply the fundamentals of mapping, threat perception and skill set development – and we can start to begin to win. Because, if done right, this is both an achievable and highly actionable outcome. I’ve always believed that the motivation to protect is greater than the motivation to harm – that is our advantage if wish to counter HR in all of its forms… and the associated outcomes.

Simon Riley

CIS Security Specialist Trainer and UK Government SME