Assessing the likelihood of different kinds of attacks taking place.
Preventing possible direct attacks against defenders.
Carrying out counter surveillance.
Violence is a process, as well as an act. A violent attack against a defender does not take place in a vacuum. Careful analysis of attacks often shows that they are the culmination of conflicts, disputes, threats and mistakes which have developed and can be traced over time.
Attacks against defenders are the product of at least three interacting factors:
1. The individual who takes violent action. Attacks on defenders are often the product of processes of thought and behaviour we can understand and learn from even if they are illegitimate.
2. Background and triggers which lead the attacker to see violence as an option. Most people who attack defenders see attacking as a way of reaching a goal or solving a personal problem.
3. A setting that facilitates the violence, allows it to take place or does not stop it.
Generally, anyone who thinks that attacking a defender is a desirable, acceptable, or potentially effective way to achieve a goal can be considered a potential attacker. The threat increases if s/he also has, or can develop, the capacity to attack a defender.
Some attacks are preceded by threats, and some are not. However, the behaviour of individuals planning a targeted violent attack often shows subtle signs, since they need to gather information about the right time to attack, plan how to get to their target, and how to escape.
The threat can decrease with changes in the potential attacker’s capacity to stage an attack, their attitude towards how acceptable an attack is, or how likely s/he is to be caught and punished.
It is therefore vital to detect and analyse any signs indicating a possible attack. This involves:
Security incidents which involve surveillance of defenders or their workplace are aimed at gathering information. This information isn’t always intended for use in an attack, but it is important to try and establish whether it is or not (see Chapter 4).
Surveillance of staff or offices is intended to acquire information about them and can be used for a number of purposes:
It is important to remember that surveillance is usually necessary in order to carry out an attack, but doesn’t in itself constitute an attack. Also, not all surveillance is followed by an attack. Targeted violence does sometimes occur in situations when an attacker suddenly sees an opportunity to strike, but even then some level of preparation has usually been carried out first.
There is little information available to help you recognise an attack being prepared. The absence of studies on this subject contrasts sharply with the large number of attacks against defenders. However, the studies which do exist offer some interesting insights .
Attacking a defender isn’t easy and requires resources. Surveillance is needed to establish an individual’s movements and the best location for attacking. Getting to the target and making an effective, quick escape is also vital. (However, if the environment is highly favourable to the attacker, attacks are easier to carry out.)
People who attack defenders usually show a degree of consistency. The majority of attacks are aimed at defenders who are heavily involved in issues affecting the attackers. In other words, usually attacks are not random or aimless, but respond to the interests of the attackers.
Geographical factors matter. For example, attacks on defenders in rural areas may be less public and therefore provoke less reaction at law enforcement level and political level than attacks in urban areas. Attacks against NGO headquarters or high profile organisations in urban areas generate an even greater reaction.
Choices and decisions are made before an attack. People who are considering an attack against a defenders’ organisation must decide whether to attack the leaders or grass-roots members, and choose between a single hit (against a key, possibly high profile person and therefore at an increased political cost) or a series of attacks (affecting the organisation’s membership). The few studies done on attacks against defenders suggest that both strategies are usually applied.
To find out how likely an attack is to happen, you need to analyse the relevant factors involved. To establish what those factors are, it is useful to differentiate between different kinds of attacks, i.e. common crime, indirect attacks (being in the wrong place at the wrong time) and direct attacks (targeting), using the three tables on the following pages.
Threat level for direct attacks (Targeting)
Note: PA = potential attackers
Factor: Capacity to attack Low Threat: PA have limited ability to act in the areas where you work. Medium threat:PA have operational capacity near the areas where you work. High threat: Zones where you work under the firm control of PA
Factor: Financial motive Low Threat: PA do not need your equipment or cash for their activities. Medium threat: Interest in your equipment, cash, or other forms of financial gain (ie. kidnapping) High threat: PA in clear need of equipment or cash.
Factor: Political and military motive Low Threat: None - your work has nothing to do with their objectives. Medium Threat: Partial intereat - your work limits their political and military objectives. High Threat: Your work clearly hampers their objectives, benefits their opponents, etc.
Factor: Record of previous attacks Low Threat: None or rare. Medium Threat: Occassional cases. High Threat: Many previous cases.
Factor: Attitudes or intentions Low Threat: Sympathetic or indifferent attitudes. Medium Threat: Indifferent, occasional threats, frequent warnings. High Threat: Aggressive, with clear and present threats.
Factor: Security forces capacity to deter attacks Low Threat: Existing. Medium Threat: Low. High Threat: None, or security forces collaborate with PA.
Factor: Your level of political clout against PA Low Threat: Good. Medium Threat: Medium to low. High Threat: Limited (depending on circumstances) or none. Example of the threat level for direct attacks (targeting):
The PA control the areas in which you work, but they do not have any financial motive for attacking you. Your work only partially limits their political and military objectives, and there are no precedents of similar attacks in the city. Their attitude is indifferent, and they do clearly not want to attract any national or international attention or pressure by attacking you. The threat level for direct attacks in this scenario is considered to be low to medium.
Level of threat for crime
Note: CO = criminal offenders
Factor: Mobility and location of CO Low Threat: CO usually stays in their own areas, away from NGO zones. Medium Threat: CO generally enter other areas at night (or operate close to NGO areas). High Threat:CO operate anywhere (day or night).
Factor: Aggressiveness of CO Low Threat: CO avoid confrontation (predominantly commit crime where there is no NGO presence). Medium Threat: CO commit crime in the street (but not in staffed offices). High Threat: CO openly commit street robberies and enter premises to commit crime.
Factor: Access to / Use of weapons Low Threat: Unarmed, or use non-lethal arms. Medium Threat: Crude weapons, including machetes. High Threat: firearms, sometimes powerful.
Factor: Size and organisation Low Threat: Operate individually, or in pairs. Medium Threat: 2 - 4 people operate together. High Threat: Operate in groups.
Factor: Police responce and deterrence. Low Threat: Rapid response capable of detterence. Medium Threat: Slow responce, little success capturing criminals in the act. High Threat: Police do not usually respond with even a minimum degree of effectiveness.
Factor: Training and professionalism of security forces Low Threat: Well trained and professional, but lacking resources. Medium Threat: regular training, low pay, limited resources. High Threat: Police are either non-existent or corrupt (cooperate with offenders).
Factor: General security situation Low Threat: There is lawlessness but the situation is relatively secure. Medium Threat: Lack of security. High Threat: Rights not observed, absolute impunity. Example of an assessment of the threat level for crime:
In this city, criminals operate in different areas in pairs or small groups, sometimes during the day. They are often aggressive and often carry guns. The police does respond, but slowly and ineffectively, and the police force is unprofessional and under-resourced. However, the police leadership is well disciplined. There is a clear lack of security, and if applied to the marginal neighbourhoods of the city, the threat of crime is at its highest given that all the indicators are at high level. The likelihood of a criminal attack in the centre of a city like this is at a high to medium level.
Level of threat for indirect attaks
Note: PA = potential attackers
Factor: Your knowledge of conflict areas Low Threat: Good. Medium Threat: Approximate. High Threat: You know very little about where conflict zones are located.
Factor: Distance to conflict areas Low Threat: Your work is far away from these areas. Medium Threat: Your work is close to these areas and you occassionally enter them. High Threat: Your work is carried out in combat zones.
Factor: Movement of conflict areas Low Threat: Conflicts are static, or change slowly and verifiably. Medium Threat: They change relatively often. High Threat: They change continually, making them unpredicatable.
Factor: Your knowledge of location of areas with landmines Low Threat: You have good knowledge, or there are no mined areas. Medium Threat: Approximate knowledge. High Threat: Unknown.
Factor: Distance between your workplace and areas with landmines Low Threat: Your work takes place far away from these areas, or there are none. Medium Threat: Your work is close to these areas and you occassionally enter them. High Threat: Your work takes place in mined areas.
Factor: Combat tactics and arms Low Threat: Discriminate. Medium Threat: Discriminate, with occassional use of artillery, ambushes and snippers. High Threat: Indiscriminate - bombardment, heavy artillery, terrorist or bomb attacks. Example of an assessment of the threat level for indirect attacks:
In this area, you are familiar with the combat zones, which change slowly and verifiably. Your work is close to the areas where the fighting takes place and you occasionally visit or stay in the combat zones. You are not close to mined areas. The combat tactics used are discriminate and therefore do not affect civilians very often. Work in this zone carries a low level of risk of indirect attack.
You now know that a threat can decrease with changes in the potential attacker’s capacity to stage an attack, their attitude towards how acceptable an attack is, or how likely s/he is to be caught and punished.
To prevent an attack it is therefore necessary to:
This type of attack prevention is similar to the analysis covered in Chapter 2, which says that risk is dependent on the defenders’ vulnerabilities and capacities. It also said that in order to protect yourselves and reduce risk, you need to take action against the threat, reduce your vulnerabilities and enhance your capacities.
Preventing a direct attack: Different protection outcomes
1. Changes in the perpetrator's behaviour: Deterring attackers by increasing the potential costs of an attack 2. Confronting and reducing threats (by acting direstly against the source, or against any action taken by the source) Changes in duty-bearer stakeholdsers' compliance with the UNDeclaration on HRD: Dissuading attackers by improving the liklihood of authorities taking action to protect defenders or to punish the perpetartors of an attack 3. Confronting and reducing threats (by acting direstly against the source, or against any action taken by the source) Reducing the feasibility of the attack: Reducing defenders' exposure, improving your working environment, managing fear and stress properly, developing security plans, etc. Reducing vulnerabilities, enhancing capacities
When a threat is made and you want to reduce the risk associated with it, it is important to act - not just against the threat itself, but also on the vulnerabilities and capacities most closely linked to the threat. At times of great pressure, when you want to react as quickly as possible, you often act on the vulnerabilities which are easiest to deal with or closest to hand instead of those which are most relevant to the threat.
Be careful: If the risk of attack is high (that is, if the threat is strong and real, and there are several vulnerabilities and fewer capacities), working on vulnerabilities or capacities to reduce the risk makes little sense, because these require time to change and become functional. If the risk is very high (a direct and severe attack is imminent) you can only do three things to avoid it:
1. Immediately and effectively confront the threat, knowing that you can achieve an immediate and specific result which will prevent the attack (Usually it is very difficult to be sure that there will be an immediate and effective result, because reactions take time, and time is precious in this situation)
2. Reduce your exposure to as close to zero as possible, by going into hiding or leaving the area.
3. Another option might be seeking armed protection, assuming that armed protection is close at hand (immediate), can deter the potential attacker and does not put the defender in more danger in the medium or long term (realistically, such requirements of armed protection are very difficult to fulfil!). Sometimes a Government offers armed escorts to a defender, after national or international pressure; in these cases, accepting or rejecting the escort may have to do with holding the state accountable for the security of defenders, but in no way can a Government say that they are relieved of their responsibilities if the defender does not accept the armed escorts. Private security companies may lead to more risk if they are informally linked to State forces (see chapter 9). And for defenders to carry weapons we must say that it is usually ineffective against an organized attack, and also may make defenders vulnerable if a Government uses it as a pretext to attack them on the basis of fighting terrorism or insurgency.
Threatening situations that can lead to an attack are easier to handle if other relevant actors or stakeholders become involved and work together. Examples include a functioning judicial system; support networks (domestic and international) that can put political pressure on duty-bearer stakeholders; social networks (within or among organisations), personal and family networks, UN/international peacekeepers, etc.
Counter-surveillance can help you establish whether you are being watched. It is difficult to find out whether your communications are being intercepted, and for this reason you should always assume that they are . However, it is possible to determine if your movements and offices are being watched.
Who could be watching you?
People who are usually in your area, such as doormen or porters in buildings, travelling sales people who work close to the building entrance, people in nearby vehicles, visitors, etc, could potentially all be watching your movements. People do surveillance for money; because they are being pressurised to do it; because of their sympathies, or due to a combination of these factors. Those behind the surveillance can also place collaborators or members of their organisation in your area.
People can also watch you from a distance. In this case they are almost always members of an organisation and probably use the tactic of watching without wishing to be seen. This means keeping a certain distance, various people taking turns and watching from different locations, using different vehicles, etc.
How to know if you are being watched
You can find out if you’re being observed by watching those who could be watching you, and by adopting the following rules (without, of course, becoming paranoid):
For example:
Before arriving home you can ask a family member or trusted neighbour to take up a position close by (e.g., changing a car wheel), to check if somebody is awaiting your arrival. The same can be done when leaving your office on foot. If you are using a private vehicle, it will be necessary to have another car leave after yours in order to allow a potential observer time to begin their approach towards you.
The benefit of counter-surveillance is that, at least initially, the person observing you does not realise you know they are there. It should therefore be made clear to anyone involved that it may not be advisable to confront the person observing you. They will then realise that you know about their activities, and this could also provoke a violent reaction. It is important to take the utmost care and keep a distance if you are aware of somebody watching you. Once surveillance has been detected, you can take the necessary action recommended in this manual (see Chapter 9).
Most of this counter surveillance advice applies almost exclusively to urban and semi-urban areas. In rural areas the situation is very different, but defenders and communities who live in such areas are more used to being aware of strangers nearby. It is therefore more difficult for somebody who wants to watch you to gain access to inhabitants of a rural area - unless the local population is deeply hostile towards your work.
A note: Building relationships with the security forces monitoring you could be beneficial in some circumstances – and in some circumstances the surveillance is not so secret, part of the point is to make it visible/intimidating. In some situations defenders cultivate people in the security forces who can sometimes tip them off when surveillance or even an action is planned against them
When to check if you are being watched
Logic dictates that it is wise to check if you are under surveillance if you have reason to believe that you are - for example, because of security incidents which could be related to surveillance. If your human rights work carries a certain risk, it is a good idea to conduct a simple counter-surveillance exercise from time to time, just in case.
You need also to think about risk you bring to others if you are under surveillance – the risk may be greater for a witness/family member of a victim you are meeting than for you – think about where it would be most secure for them to meet? You may need to warn them that your movements might be under surveillance.
No single rule can be applied to all attacks against defenders. Attacks are also security incidents, and you can find guidelines for how to react to security incidents in Chapter 4.
In any kind of attack there are two essential things to remember: