Who, then, is a danger to defenders?

Generally, anyone who thinks that attacking a defender is a desirable, acceptable, or potentially effective way to achieve a goal can be considered a potential attacker. The threat increases if s/he also has, or can develop, the capacity to attack a defender.

Some attacks are preceded by threats, and some are not. However, the behaviour of individuals planning a targeted violent attack often shows subtle signs, since they need to gather information about the right time to attack, plan how to get to their target, and how to escape.

The threat can decrease with changes in the potential attacker’s capacity to stage an attack, their attitude towards how acceptable an attack is, or how likely s/he is to be caught and punished.

It is therefore vital to detect and analyse any signs indicating a possible attack. This involves:

• Determining the likelihood of a threat being carried out (see Chapter 3);
• Identifying and analysing security incidents.

Security incidents which involve surveillance of defenders or their workplace are aimed at gathering information. This information isn’t always intended for use in an attack, but it is important to try and establish whether it is or not (see Chapter 4).

Surveillance of staff or offices is intended to acquire information about them and can be used for a number of purposes:

• To establish what activities are carried out, when and with/by whom;
• To use this information later to attack individuals or organisations;
• To gather the information necessary to carry out an attack.
• To gather information for a legal action or other harassment (without direct violence);
• To intimidate your supporters or other people who work with you, or provide you with information to stop doing so;

It is important to remember that surveillance is usually necessary in order to carry out an attack, but doesn’t in itself constitute an attack. Also, not all surveillance is followed by an attack. Targeted violence does sometimes occur in situations when an attacker suddenly sees an opportunity to strike, but even then some level of preparation has usually been carried out first.

There is little information available to help you recognise an attack being prepared. The absence of studies on this subject contrasts sharply with the large number of attacks against defenders. However, the studies which do exist offer some interesting insights .

Attacking a defender isn’t easy and requires resources. Surveillance is needed to establish an individual’s movements and the best location for attacking. Getting to the target and making an effective, quick escape is also vital. (However, if the environment is highly favourable to the attacker, attacks are easier to carry out.)

People who attack defenders usually show a degree of consistency. The majority of attacks are aimed at defenders who are heavily involved in issues affecting the attackers. In other words, usually attacks are not random or aimless, but respond to the interests of the attackers.

Geographical factors matter. For example, attacks on defenders in rural areas may be less public and therefore provoke less reaction at law enforcement level and political level than attacks in urban areas. Attacks against NGO headquarters or high profile organisations in urban areas generate an even greater reaction.

Choices and decisions are made before an attack. People who are considering an attack against a defenders’ organisation must decide whether to attack the leaders or grass-roots members, and choose between a single hit (against a key, possibly high profile person and therefore at an increased political cost) or a series of attacks (affecting the organisation’s membership). The few studies done on attacks against defenders suggest that both strategies are usually applied.