Norway Attacks Oslo and Utoya Island, Norway Incident Date: July 22, 2011

Transcription

1 Incident Assessment Norway Attacks Oslo and Utoya Island, Norway Incident Date: July 22, 2011 NJ ROIC Analysis Element AE Information Cut-off Date: (U) INFORMATION NOTICE: This product contains unclassified information that is For Official Use Only (U//FOUO). Recipients should not release any portion of this product to the media, the public, or other personnel who do not have a valid need-to-know.

2 Incident Overview On July 22, 2011, Norwegian police arrested Anders Behring Breivik and charged him with two terrorist attacks the car bomb near government buildings in Oslo, and the shootings at a youth camp on Utoya Island, about 25 miles northwest of Oslo. The death toll has risen to at least 80, including numerous teenagers who were attending a Labor Party camp on Utoya. Breivik detonated a rented Volkswagen van parked between two government buildings. Before the van detonated, Breivik used another rental vehicle and drove to a dock in Tyrifjorden, near the island of Utoya. Wearing a home-made police uniform, Breivik convinced a boater to take him to Utoya Island, where the Norwegian Social Democratic Youth League retreat (ages 15-16) was taking place. Using three weapons registered in his name (a handgun, a shotgun, and a rifle) Breivik began randomly firing at individuals. Reports indicate that an additional 13 drowned in an attempt to swim to safety. This is the deadliest attack in Norway since World War II. UNCLASSIFIED//FOR OFFICIAL USE ONLY 2

3 Suspect Overview Anders Behring Breivik, a 32-year old Norwegian man, confessed to both attacks and is believed to have been planning the attacks for several years. Breivik stated the Labor Party was his enemy. He had a list of targets which included the Foreign Minster Jonas Store and other Labor Party members. Breivik also stated that he wants all foreigners out of Norway. Breivik s Web postings include racist rants against multiculturalism and immigration. Breivik Manifesto The European Declaration of Independence or the manifesto created by Breivik, detailed the planning of the events, in addition to personal details of his life. Breivik described himself as Justiciar Knight Commander for the Knights Templar Europe, a Christian order, fighting to rid the West of Islamic suppression. He discussed a European civil war taking place in three stages, and ending in 2083 with the removal of all Muslims. Breivik was in contact with a member of the Aryan Terror Brigade through Facebook (USBUS), but nothing materialized from that contact. According to the manifesto, Breivik considered contacting the Hells Angels to assist him in acquiring weapons and ammunition, but later decided against it. Breivik gave special instruction on how to research and order the materials needed to create a bomb. He created detailed cover stories as well as fictitious businesses. Breivik sent the manifesto to over 5,000 people the day of the attacks. He claimed his manifesto could be used as a how to book for other extremists. Analyst Comment: Breivik had a genuine dislike for Muslims and communicated with like-minded individuals on several social networking sites. Breivik discussed being the victim of several assaults by Muslims, which may have fueled his intolerance for Muslims. UNCLASSIFIED/FOR OFFICIAL USE ONLY 3

4 Pre-Operational Training Breivik was a member of a local gun club and received additional training with the intention of gaining experience using different weapons. He used the video game Modern Warfare2 (USBUS) as part of his training. Planning During the acquisition of supplies for the attack, Breivik used several cover stories to obtain the fertilizer, chemicals and ammunition, such as: Owning a mineral extracting company and a working farm (not to raise suspicions on his purchases of fertilizer and other chemicals.) When purchasing the ammunition, Breivik claimed he was a bird hunter. The majority of the purchases were completed online. Breivik leased a farm, Breivik Geofarm, in the municipality of Rena, approximately 100 miles from Oslo, and was able to procure approximately 6 tons of fertilizer, some of which was used in the Oslo vehicle-borne improvised explosive device (VBIED). The amount of fertilizer purchased by Breivik is a normal size order for a standard agricultural producer. Execution VBIED used in front of the federal building: According to the manifesto, Breivik detailed how to make the explosives and viewed videos on YouTube. It was also reported that Breivik was in contact with a Danish businessman who had knowledge of demolitions. It is unknown if Breivik used a remote control to detonate the explosives in the vehicle. The investigation is still under way. Tactics, Techniques and Procedures UNCLASSIFIED/FOR OFFICIAL USE ONLY Weapons used during the attack at Utoya Island: At the time of the arrest, Breivik had in his possession a handgun, rifle and a shot gun, which were legally purchased. The ammunition used are illegal and are similar to the expanding bullet or dumdum bullets, which explode inside the body. Reports indicate Breivik failed at an attempt to purchase weapons in the Czech Republic. He wanted to purchase an AK-47 assault rifle, a Glock pistol, fragmentation grenades, and armor piercing ammunition. Norwegian Gun Laws: Norway has a long hunting tradition and semiautomatic, bolt action guns, as well as shotguns, are common. Automatic weapons are banned, as are more powerful types of handguns. All firearms in Norway are regulated by the Firearms Weapons Act, which was strengthened in Civilians requesting to own a gun must make a written statement of the purpose for which it would be used. Impersonation of Law Enforcement: Breivik disguised himself as a police officer when he gained access to a boat to take him to Utoya Island. NJ Suspicious Activity Reporting System (NJSARS) noted eight incidents of lost/stolen uniforms or credentials of law enforcement/civil service in the past year. This tactic highlights the importance of reporting lost/stolen police uniforms and credentials. Incident highlights several vulnerabilities: Due to the crowded area, Breivik was able to randomly hit victims, resulting in multiple wounded as well as fatalities. Also, because Breivik was dressed as a police officer, the children were more likely to run towards him than away. Individuals disguised as first responders and police officers is a tactic used in countries such as Iraq and Afghanistan. Breivik used multiple attack points which slowed law enforcement response to the second incident. The most recent events in Mumbai highlight the success of such tactics. 4

5 Threat Overview NJ ROIC Threat Analysis currently has no information indicating a specific threat to New Jersey. There is currently no direct connection to New Jersey. It should be noted however, that New Jersey was mentioned in Breivik s manifesto as having strict polices on ammunition being sold overseas. Government buildings and facilities have been targeted in the US in recent history. This incident highlights the inherent vulnerability of attacks by lone offenders. Lone-offender spontaneous shooting attacks are extremely difficult to predict and defend against. This event highlights the importance of suspicious activity reporting in order to discover a potential plot prior to it being carried out. Implications for New Jersey The potential terrorist threat to the government sector in New Jersey is high and this incident illustrates the inherent vulnerability of soft targets throughout the state. Preventative measures for intercepting terrorist acquisition of explosive materials require coordination of various entities including private sector distributors and the public. The US Department of Homeland Security recommends using preventative measures to identify and report suspicious activity. The potential exists for actors to mirror or become inspired by previous events (copy-cat). Suspicious Activity Reporting Any suspicious activity with a potential terrorism nexus should be reported immediately, per existing protocols specific to respective counties. Activity can also be reported to the NJ Office of Homeland Security and Preparedness at (866) 4-SAFE-NJ ( ) or Tips@NJHomelandsecurity.gov Contact Information Any agency with comments or questions about this advisory should contact NJ ROIC Threat Analysis at (609) , ext. 6243, or njroicanalysis@gw.njsp.org. UNCLASSIFIED//FOR OFFICIAL USE ONLY 5

6 Protective Measures Private sector security and law enforcement agencies can use protective measures to help disrupt or mitigate a terrorist attack by a lone offender in multiple phases - during surveillance, target selection and infiltration, and engagement with security forces. Measures law enforcement and security personnel can take to reduce the risk or mitigate the impact of an attack: Alert and immediately report any suspicious or threatening situation. Institute visible security patrols varying in composition, timing, and routes. Deploy security parameters to detect indicators of pre-operations activity. Approach and remove unattended vehicles immediately. Examine possible attack scenarios and weaknesses in security. Review response plans and processes with local law enforcement, emergency, and facility personnel. Regularly train all staff, particularly security personnel, on threat awareness, surveillance detections, and recognition of suspicious behavior. Surveillance Train staff to be aware of unusual events or activities, such as individuals loitering, sketching, pace counting. Install and monitor CCTV cameras covering multiple angles and access points. When possible, establish random security patrols to disrupt potential efforts. Target Selection Establish security at facility access points and potential approach routes. Know a facility s vendors and, if possible, randomly alter delivery entrances to avoid developing discernable patterns. Avoid widely distributing site blueprints or schematics and ensure those documents are kept secured. Target Infiltration Establish an outer perimeter at target sites to deny access or intercept potential assailants, and ensure security personnel and security measures are in place at all access points. Establish a credentialing process for facilities. Conduct background checks on all employees. Engagement with Security Forces Encourage local law enforcement to meet with key facility staff to assist in the development and familiarization of emergency evacuation and lock down procedures. Conduct sweeps for explosive devices and increase security measures in zones that could be compromised. Local, state, and federal law enforcement entities should routinely conduct joint training and communication exercises to allow for effective deployment of multiple units in a crisis. UNCLASSIFIED//FOR OFFICIAL USE ONLY 6

7 Sources DHS. Norway: Multiple Attacks in Oslo Area. 22 July NYPD Shield. Terrorism Assessment: Suspect Charged in Norway Attacks. 23 July Asero Worldwide. Norwegian Terror Attacks: Initial Analysis and Insights. 22 July Fox News. Europol Plans Terrorism Task Force for Norway 23 July MSNBC. In Rural Town, Norway Attacker Seemed a City Loner 24 July Guardian Norway s Gun Laws Prove Easy to Ignore 24 July Department of Homeland Security and Preparedness: Norway: Multiple Attacks in Oslo Area 22 July A European Declaration of Independence Andrew Berwick. Guardian. Norway Attacks. US Department of Homeland Security Bomb Making Materials Awareness Program: Private Sector User Guide. NJ Suspicious Activity Reporting System (NJSARS). UNCLASSIFIED//FOR OFFICIAL USE ONLY 7