www.stratfor.comThe London Bombings: A Local Cell at Work?
Four bombs exploded in London's transportation system during the morning rush hour July 7, three striking the Underground commuter rail system and another tearing the top off of a double-decker bus. Scotland Yard has confirmed that 37 people died as a result of the blasts and that hundreds are injured, although estimates of the death toll reach higher than 50.
According to Scotland Yard, the first explosion occurred at 8:51 a.m. local time, 100 yards into the Underground tunnel from the Liverpool Street station, killing seven people. The second explosion occurred five minutes later on the Piccadilly Line heading north from Russell Square Station to King's Cross Station, killing 21 people. The third explosion took place at 9:17 a.m. as the train arrived at the Edgeware Road Station. That bomb exploded as two trains passed each other, blowing holes in both trains and at least one other train in the station. A total of five people died in that explosion. Half an hour later, a bomb detonated on the upper deck of the No. 205 bus near Upper Logan Square, killing perhaps 20 people.
Reports also circulated that several unexploded devices, or "duds," were found, including one at the Baker Street Station and another at Stockwell Square. Law enforcement sources said all but one of these were, in fact, only "suspicious items" that will be destroyed, though law enforcement personnel believe one is a real improvised explosive device.
The presence of decontamination tents and personnel wearing HazMat clothing at the bomb sites raised concerns that the attackers might have attempted to detonate a "dirty bomb," although these steps are taken as a precaution and are part of standard response procedures.
Given the number of devices involved in these attacks, British forensic investigators should be able to get to the bottom of the blasts, because each bomb -- exploded or not -- leaves valuable pieces of evidence. Forensic examination will also be important in this case to determine if there is any relation to the March 2004 Madrid train bombings. The sophistication of the bombmaker and the method of deployment also will come to light.
As of now, the kind of bombs used in the attacks is unclear, although the possibilities include command-detonated suicide bombers, command-detonated improvised explosive devices or timed explosive devices. We can assume, however, that we are dealing with devises -- and detonators -- rigged out of ingredients available on the open market, because the sale of bomb-making ingredients such as dynamite and gunpowder is tightly controlled in Britain, due to the country's history with the Irish Republican Army. The use of improvised detonators, which are not as reliable as industrially manufactured hardware, would explain the reports of multiple failures. Most improvised or homemade explosive mixtures would not be as powerful as the commercial-grade material used in the Madrid attacks.
Investigators will study the timing of the Underground blasts -- and reports that the explosions occurred as the trains pulled into stations -- as one method of determining the type of bombs used. The fact that the bombings appear to have been coordinated suggests that multiple perpetrators are involved -- mainly because it would have been impossible for one person to have planted all of the devices. It is possible that someone planted timed explosives on the trains, knowing the general time needed to travel between stations, though they risked having the bombs go off at the wrong time if a train was delayed.
The attackers could have used command-detonated bombs in order to guarantee a more precise detonation time and increase the number of casualties in the stations. If the devices were command-detonated, they probably did not use a cellular telephone as a trigger, because cellular phones typically do not work inside the London Underground system. Another possibility is that suicide bombers exploded their devices at predetermined times.
The attack likely was carried out by a cell of locals living in London and working with an operational planner and/or bombmaker from outside the country. The planner and/or bombmaker (one person often performs both jobs) probably arrived in Britain several weeks or a few months before the attack in order to plan the operation and manufacture the devices. After the attacks, this person most likely boarded a plane and left the country, ultimately to return to a location in the Middle East or South Asia. It is a practice of many jihadist organizations, al Qaeda in particular, to use mid-level operatives to set up cells throughout the world for the purpose of conducting attacks.
Within the context of the London Underground attacks, the bombing of the bus near Upper Logan Square is an anomaly, suggesting the bus was not originally a target. Compared to the other bombs, which detonated within a few minutes of one other, the device on the bus went off a half hour after the last explosion. One possible explanation for this is that it was a secondary bomb meant to cause casualties among people evacuating the Underground stations following the earlier explosions. Another possibility is that the bomber assigned to carry out one of the attacks got cold feet at the last minute or for some reason felt that his mission was compromised. Rather than risk capture, the bomber might have left the device on the bus that was taking him to his intended target. Left unattended, a failsafe timer on the device could have caused the detonation. It also is possible that a last-minute change of plans left the terrorists with an extra bomb, and it was decided just to leave it where it would cause casualties.
A group calling itself the Secret Organization of al Qaeda in Europe claimed responsibly for these attacks on a jihadist Web site July 7, although this claim obviously has not been verified. Because al Qaeda's ability to conduct major operations has been called into question in recent months, the leadership might have felt the need to conduct a large-scale attack in order to prove the network still is capable of causing harm to the West.
Following the attacks, U.S. authorities tightened security in the New York and Washington, D.C., subway systems, while the Department of Homeland Security raised the threat level for transportation from Yellow to Orange. If al Qaeda carried out the London attacks, the network is probably incapable of conducting similar operations in the near future, given its diminished capability. By the time the terrorists are ready to strike again, security will likely have relaxed.
---------------------------------------------------------------------------
The London Bombings: Who, Why, and What Happens Next
Summary
The July 7 bombings in London were likely carried out by an al Qaeda cell hoping to draw attention and credibility back to the jihadist organization. British Prime Minister Tony Blair will face increasing pressure after the attacks, particularly regarding his Iraq policy, and relations between U.K. internal security and "Londonistan" are likely to change in coming days.
Analysis
A series of bomb attacks severely disrupted the London and southeast England transport network during midmorning rush hour July 7. At least 37 people died and hundreds were injured during the attacks. A previously unheard-of group calling itself "Secret Organization of al Qaeda in Europe" claimed responsibility for the bombings on its Web site, but Stratfor and Western intelligence agencies consider that claim to be dubious at best. However, the scale and nature of the attacks -- targeting crowded trains and the bus system -- indicates that a group with significant preparations is responsible, and Stratfor believes al Qaeda itself, and not the previously unknown group, carried out the bombings. The attacks are similar to the 2004 Madrid train bombings, which al Qaeda was found to be behind.
If al Qaeda did in fact carry out the London attacks, it adds to the organization's credibility as a still-functioning force able to make its presence known in the major capitals of the world. Striking London while the Group of Eight (G-8) summit has the world focused on the United Kingdom takes not only operational security and organization but also a fair amount of impudence. The relationship between U.K. internal security services and London's often-radical Muslim community is likely to change, and British Prime Minister Tony Blair can expect to face intensifying public pressure.
Four confirmed attacks took place in London. The first explosion occurred at 8:51 a.m. London time on a Circle Line train traveling westbound from Aldgate Station, when the train was 100 yards away from its destination at Liverpool Street Station. Liverpool Street is a major local transport hub that contains a National Rail station serving southeast England. The Circle Line is a shallow "cut-and-cover" line, on which it could be possible to receive a cellular phone signal -- a common method of detonating improvised explosive devices (IEDs) -- since the top part of the tunnel is above ground level. However, it is unclear whether mobile communication signal reception is reliable anywhere in the train system.
The second explosion took place five minutes later on a Piccadilly Line train heading north from Russell Square to King's Cross Station. King's Cross is a vital National Rail hub for trains going to northern and eastern Britain and is also a major Underground and local transport interchange. The Piccadilly Line is a deep-tunnel subway route, where it would be more difficult to send or receive mobile communications -- indicating that the bomb on this train was detonated by a timer.
The third blast, at 9:17 a.m. London time, occurred on the Hammersmith and City Line coming from Edgware Road toward Paddington Station. The bomb exploded as trains passed, blasting a hole in a wall and damaging at least one and possibly two other trains. Paddington is a major National Rail station serving southwestern England and Wales, and the Edgware Road station area contains London's high-security Paddington Green police station and a large Muslim population. The Hammersmith and City Line is another shallow "cut-and-cover" line, where mobile communications could be possible.
The upper deck of a double-decker bus running Route No. 205 near Tavistock Square, near the Russell Street underground station, was hit in the fourth explosion, which took place at 9:47 a.m. London time. Scotland Yard initially reported an unknown number of fatalities in this blast.
Following the blasts, U.K. mobile network operators reported problems related to high call volume but denied that the government had asked them to discontinue service; such a request would have indicated that authorities thought command-detonated devices were used. Some calls placed to London mobile numbers were successful by 3:30 p.m. London time. Bus services in the London area were set to resume by 4 p.m., though the Underground is scheduled to remain closed until the morning of July 8. National Rail services, excepting King's Cross, resumed.
Security alerts went out in other countries shortly after the bombings. Germany's Deutsche Bahn AG upped security on all its trains and stations, and the U.S. Department of Homeland Security raised the national security threat level to orange for all mass transit facilities in the country. Both of these alerts were meant to give a sense of action, but were equivalent to closing the barn door after the horses have escaped. There was no credible intelligence that follow-on attacks were imminent, but the alerts went out to make people feel that something had been done to ensure their safety. Meanwhile, in the world markets, crude oil prices dropped because of the prospect of an economic slowdown brought about by the attacks.
Several unexploded or non-functional IEDs reportedly were found in the London Underground shortly after the blasts, but authorities said later that the suspected IEDs were only suspicious objects that would be detonated. One suspicious item was reportedly found at Baker Street, and another at Stockwell Square. Authorities are treating suspicious packages with extreme caution, and it is unclear how many -- if any -- were actually explosive. Though reports of undetonated IEDs could be false alarms, the discovery of unexploded devices would be a boon to understanding the anatomy of the attacks. Analysts could see what type of explosives were used -- and possibly figure out where the explosives might have been acquired -- and see what kind of detonator was used. Tracing the elements of an unexploded IED would take much less time than sifting through the remains of an exploded device. After the Madrid 2004 train bombings, Spanish authorities were able to identify the terrorists based on the cell phone they found attached to an unexploded bomb.
Multiple people would have to have been involved in planting bombs on the Underground lines, if indeed the bombs were either timer- or remote-detonated. Based on the bombs' locations and the directions in which they were traveling, it is unlikely that all of the attackers entered the Underground system from a central location near Russell Square or King's Cross. The attackers instead likely coordinated their bombings from different points in the city. If the attacks follow the Madrid model, the perpetrators planted the bombs on the trains and fled the scene. However, U.K. authorities have not yet ruled out the possibility that the attacks were suicide bombings, though this seems less likely.
It seems that only a well-prepared group with significant operational security would be able to carry out citywide attacks in short succession on infrastructure that could have a serious economic impact and a high casualty rate. Because London has been the recent hub of al Qaeda cell operations in Europe, Stratfor believes that the strikes were likely perpetrated by an al Qaeda cell, using either recruits from the local Islamist community or recent immigrants taking advantage of central London's large Muslim population. There have been recent reports of internal debates among London's Muslim clerics about whether or not U.K. residents should be allowed to stage attacks in the country. That the methods used in the attacks are similar to standard al Qaeda methods suggests that a ringleader or bomb maker -- perhaps one person serving in both capacities -- was brought in to coordinate the attacks.
Al Qaeda would have sufficient motive to carry out such an attack. As U.S. and coalition forces continue battling jihadist insurgents in Iraq and Afghanistan, al Qaeda appears to have become less effective. Periodic major attacks -- such as the Sept. 11, 2001, attacks in New York City and the March 11, 2004, train bombings in Madrid -- help the jihadist network reassert itself and lend it a certain measure of credibility. Such credibility is necessary for its continued survival and for its recruiting operations. Ultimately, al Qaeda seeks to show the power of the Islamic world and the vulnerability of the United States and its allies. The audacious timing of the attacks -- during the G-8 summit -- brings this point home. Furthermore, the timing of the London bombings matches the 18- to 24-month operational cycle for major al Qaeda attacks.
Attacking during the G-8 summit will certainly draw attention to al Qaeda, if the organization did indeed carry out the London bombings. Still, the scale of the attacks represents a diminished power, and it could indicate that al Qaeda is in decline.
But whatever the implications for al Qaeda, the political timing for the attacks puts pressure on both the British government and its security infrastructure. Security attention had been focused well north of London this week in coordination with the G-8 summit, where Blair was pushing debt relief and climate-change action. Blair has faced ferocious domestic opposition, especially from the left and from Muslim communities, over his support for the Iraq war. This opposition is likely to increase after the London bombings, especially because of one piece of information: Unconfirmed rumors in intelligence circles indicate that Israel had warned the U.K. government several days prior to the bombings that such an attack was imminent. Not wishing to disrupt the G-8 summit or spoil celebrations over London's successful bid for the 2012 Olympics, the British government sat on the information and hoped it was a false alarm.
The short-term U.K. response to the attacks will almost certainly involve a shift in relations between British internal security services and London's sizeable -- and often radical -- Muslim population, which was subject to intense racial tensions during the last U.K. election cycle. MI5 has taken a light hand with "Londonistan," believing for the most part that local clerics had no significantly threatening connections with international terrorist organizations. That approach is likely to change. The response in the United Kingdom in coming days could set the tone for the larger European debate over Muslim immigration as both a security and cultural threat. Possibly hoping to head off the worst of a backlash, the Muslim Council of Great Britain has already issued a statement condemning the "evil" London attacks.
In the meantime, Blair will face continuing and intensifying questions about the future of his tenure, with Labor backbenchers increasingly willing to demand that he hand over power to popular Chancellor of the Exchequer Gordon Brown. Blair will have to make some visible change to his Iraq policy in response to these events -- though that does not necessarily mean an actual weakening of the British presence in Iraq. It is unclear whether or not the British public will offer an anti-government, anti-war backlash such as that in Spain after the Madrid attacks; it is not out of the question that the London attacks could simply strengthen the U.K. government's resolve on the Iraq issue.
