What is Hostile reconnaissance?
What is Hostile reconnaissance?
Hostile reconnaissance is the term given to the information-gathering phase conducted by those individuals or groups with malicious intent. It is a vital component of the terrorist attack planning process. Terrorism may not, however, be the only threat a site faces. It could be industrial espionage, for example, so this guidance uses the term ‘hostile’ to refer to the individual or group conducting the reconnaissance.
Hostile reconnaissance is defined as “Purposeful observation with the intention of collecting information to inform the planning of a hostile act against a specific target.” Generally, the more sophisticated the attack, the more complex the attack planning, and consequently, the greater the information requirement and reconnaissance need.
The information gathered is typically used by hostiles to assess security and likelihood of detection, to assess vulnerabilities in security and the likelihood of success. Information about a site or event may be gained through online research, conducting on-site visits and, where possible, through insider knowledge. The hostile will try to obtain detailed information to sufficiently inform their method of attack and increase the likelihood of success.
The objectives of Hostile Reconnaissance are to:
Identify a target
Discover weak spots (vulnerabilities)
Assess the level and type of security
Consider the best method of attack
Inform the best time to conduct the attack
Assess the likelihood of success
What is suspicious behaviour?
Ask yourself:
Is that person really taking a selfie or a photograph of something else?
Why are they loitering in restricted or non-public areas?
Why are they paying significant interest to entrances, exits, CCTV cameras or security features or staff?
Why are they asking unusual questions or asking about security?
Are they concealing their face(s) or using a disguise?
Vehicles are often used by hostiles planning attacks. Be aware of vehicles parked out of place, abandoned, or a vehicle retracing the same route and stopping unnecessarily.
Challenging and reporting suspicious behaviour
After conducting a dynamic risk assessment: You should approach a person that has been acting in a suspicious manner and politely ask them to account for their actions. If you are not content with their explanation, call the police and mention hostile recognisance or operation lightning.
So what are you trying to achieve?
Deny the hostile the opportunity to gain information.
Detect the hostile when they are conducting their reconnaissance.
Deter the hostile by conveying their plans will fail through messaging and the physical demonstration of the effectiveness of your security regime.
This approach will play on their concerns of failure and detection.
The key to disruption comes from understanding the information the hostile needs, where they are going to have to go to get this, and the hostile’s mindset, i.e. how far they will go to get the information they need. Once this is understood, an organisation can shape its protective security and other resources, such as corporate communications and employee behaviours, to help disrupt hostile reconnaissance.
Denying the hostile the information they need to fulfil their information requirements is the first step an organisation can take in forcing the hostile to either disregard its site as a target or by ensuring that they have to undertake further, potentially detectable, reconnaissance.
Denying the hostile the information they need can also mean creating uncertainty and unpredictability about security arrangements at a site.
Remember hostiles know they are on-site for nefarious reasons and that their behaviour might appear unusual. This makes them more anxious or paranoid and, therefore, potentially susceptible to detection. This natural anxiety can be amplified by communicating and demonstrating an effective range of detection capabilities at the site. Vigilant and engaged security officers with timely and appropriate interventions can be particularly powerful in addition to well-sited CCTV and control rooms with proactive operators looking for suspicious activity.
