Mark Brace, Aviation Security Analyst at Osprey Flight Solutions, discusses the threats posed by unauthorised commercial drone flights near airports and highlights the aviation sector as a prime target for militant groups.
Emerging Threat Report: Drone use by Militant Groups

According to data released by the United Kingdom Airprox Board, there were just six emergency situations involving small commercial drones and civilian aircraft in 2014. However, that number increased exponentially to 70 such incidents in 2016. In similar fashion, the United States Federal Aviation Administration documented 1,145 drone sightings near airports or by civilian aircraft inflight during 2016, with just 57 instances reported in 2014.

Our own comprehensive analysis of publicly available data has identified over 5,200 drone sightings near airports or by civilian aircraft inflight worldwide in just the past decade.

Historical evidence highlights the aviation sector as a prime target set for militant groups, from a threat-to-life, psychological and economic impact perspective. During July 2017, the US Director of the Department of Homeland Security stated: “terrorists want to bring down aircraft to instill fear, disrupt our economies, and undermine our way of life; and it works - which is why they still see aviation as a crown jewel target.”

A key concern on this topic shared by governments and by security experts within the aviation industry is that militants with a hostile intent will begin to use small commercial drones outside areas of armed conflict to attack aircraft and/or airports.

Our analysis of multiple areas of armed conflict coupled with an in-depth examination of global terrorism trends indicates that drone use by militants for reconnaissance, propaganda development and weaponisation for terror attacks is steadily expanding. The focus of this article will evaluate efforts by the extremist Islamic State group (IS) and the al-Qaida-linked terror network (AQ) to develop and hone the use of small commercial drones for use in armed attacks. Since 2014, governments have taken notice of the threat posed by drones and enacted limited measures to protect public safety in response:

• Following a near miss between a passenger jet and a small drone near London Heathrow Airport (EGLL/LHR) in July 2014, security professionals at Birmingham University issued a report on drone use by terror groups that called for ‘urgent’ measures to protect UK airports and airspace from an attack scenario. During early-July 2017, two separate emergency situations involving small commercial drones and civilian aircraft occurred near UK airports in a three-day span, renewing calls for increased vigilance and oversight.

• The aviation sector in the UK is not alone in its concerns regarding the threat posed by drones. Former UK Prime Minister David Cameron noted in an address at an April 2016 summit in the US that IS was: “planning on using drones to spray nuclear material over Western cities in a horrific ‘dirty bomb’ attack.” A UK government-backed terrorism insurance company issued a report in late-2016, warning of the use of weaponised drones by IS against ‘soft targets’ in the country.

• France has also witnessed a spike concerning drone activity, highlighted by reports of over 60 unauthorized drone flights over sensitive areas between October 2014 and March 2015. Prior to the UEFA Euro 2016 football tournament, which took place during June-July 2016, French security forces conducted anti-terror training exercises designed to defend against weaponised drone attacks. In addition, French authorities issued an order to police in November 2016 which detailed the threat posed by drones used in terror attacks and mandated drones be treated as ‘suspicious packages’. More recently, during the first half of 2017, French police forces began training eagles to hunt down small drones operating in unauthorised airspace; and Charles de Gaulle Airport (LFPG/CDG) installed counter-drone radar systems.

Threat Environment

The historical threat of weaponised drone attacks dates back to the mid-1990s with key plots linked to the AQ terror group. In July 2001, reports surfaced that AQ was plotting to attack the G8 Summit in Genoa, Italy with explosive devices attached to remote-controlled drones. This was followed by a disrupted plot in the UK during June 2002, where an AQ operative planned to attack the House of Commons with a drone equipped with an anthrax poison device. Within the US, an AQ operative was convicted in 2008 for conducting research into the weaponisation of small drones and reportedly plotting attacks using remote-controlled helicopters equipped with explosives. During April 2017, Belgian authorities issued a terror alert to the country’s security services regarding the potential threat of an IS-inspired weaponsied drone attack. IS and AQ and their affiliates have been documented using small drones for propaganda, reconnaissance and/or attack purposes in Iraq, Syria, Turkey, Libya, Somalia, Afghanistan, Pakistan and the Philippines.

Both IS and AQ-linked groups in Iraq and Syria have many foreign fighters in their ranks from all over the world, including Western Europe, North Africa, Russia and the former Soviet states, Turkey, Jordan and Saudi Arabia. A main concern is the return of remaining foreign fighters to their home countries outside the conflict zones, potentially to providing local extremist networks with battlefield experience and capability. A small number of these returning fighters may have the capacity to weaponise drones for use in ABIED attacks, employ drone technology for pre-attack reconnaissance and/or make use of drones in propaganda production. Drone use by militant groups inside areas of armed conflict highlights evolving tactics, techniques and procedures (TTPs) available as an inexpensive and effective means of terrorism. These developments highlight the metastasized nature of global terrorism trends and the increasing number of attack modes available to militants seeking to use drone technology.

Extremist IS Group & Affiliates

The extremist IS group has a history of operating drones for reconnaissance and propaganda purposes dating back to mid-2014 in both Iraq and Syria. During 2015, the group increased its efforts to weaponise its drone inventory by creating small munitions which could be dropped from the air or by arming the drone itself in the form of a ‘kamikaze’ attack vehicle. Based on our analysis, the majority of weaponised drones operated by the extremist IS group are of the first variety: an airborne improvised explosive device (ABIED) attached to the drone fuselage and dropped from the air on targets below.

The first documented use of an ABIED by IS in Syria occurred in December 2015 in Aleppo Governorate, when a small weaponised drone was shot down by Kurdish militia forces during clashes with the group. In October and December 2016, Syrian military forces reportedly downed multiple IS drones carrying rocket-propelled grenade warheads in Dayr az Zwar Governorate. Reports of IS weaponised drone use in Iraq emerged in early-October 2016 when the group deployed a weaponised ‘kamikaze’ drone, killing two Kurdish militia forces and injuring two French military personnel in the Kurdistan Region. This attack demonstrated further innovation, as the drone was reportedly ‘booby-trapped’ with an IED disguised as a battery, which only exploded when the militia examined the crashed drone.

US-led coalition forces have conducted dozens of airstrikes on IS group drone launch sites and production facilities in Iraq and Syria since 2015. Analysis of US-led coalition airstrike data indicates that IS began frequently using drones to conduct ABIED attacks and reconnaissance operations in Iraq and Syria from late-2016. Correspondingly, IS began releasing propaganda videos depicting its drones dropping ABIEDs in Iraq and Syria in late-January 2017. Our analysis indicates that IS conducted over 150 such attacks in Iraq and Syria during 2017.

Of additional concern, IS-linked groups in Yemen, Libya and the Philippines have reportedly utilised drones for reconnaissance and or propaganda purposes. During September 2017, IS released a propaganda video of its fighters training in the al-Bayda Province of Yemen, which included portions filmed via drone. In Libya, IS militants used drones for reconnaissance purposes during clashes with internationally recognised government-aligned militia forces in city of Sirte in 2016-2017. In addition, IS militants released propaganda images taken by a drone of rocket attacks conducted in the Libyan city of Benghazi in December 2016. In the Philippines, militants in Marawi have repeatedly used drones for reconnaissance purposes during clashes with government security forces since June 2017.

Despite recent losses in Iraq and Syria, IS will continue to operate in pockets of those countries and in areas of weak governance, such as Egypt’s North Sinai Governorate, Afghanistan, Libya, Pakistan, Nigeria and parts of the Philippines. More and more verifiable available data regarding the effectiveness of IS drones in combat within Iraq and Syria is becoming available and it is clear that the group has gone from small-scale use of drones for reconnaissance or propaganda to developing TTPs for mass and standardised production.

Al-Qaida-linked Groups

AQ-linked militants in Pakistan have a documented history of drone activity dating to 2002. During late-2005, an AQ-linked militant was arrested in the US for purchasing a small drone for the Pakistan-based Lashkar-e-Taiba terror group in 2002. In addition, AQ militants in the North Waziristan area of Pakistan reportedly used small drones for reconnaissance purposes during clashes with government security forces in September 2005. A subsequent raid against an AQ site recovered a commercial drone and IED materials that were assessed to be intended for weaponisation purposes.

The AQ-linked Taliban group in Afghanistan also has a limited history of small drone use since 2012. During a raid against a Taliban compound in Helmand Province during May 2012, US military forces recovered a small drone which was included in a weapons cache. More recently, the Taliban has used drones for reconnaissance and propaganda purposes, highlighted by the release of a video filmed by a drone of an attack in the Afghan capital of Kabul in October 2016. In addition, a drone was recovered during a security forces raid against Taliban fighters in the Afghan capital of Kabul in January 2018.

Multiple AQ-linked groups in Syria have reportedly operated drones for reconnaissance and propaganda purposes dating back to mid-2014, including Hayat Tahrir al-Sham (HTS), the Turkistan Islamic Party and Ahar al-Sham. HTS, formerly known as the Jabhat al-Nusra, has taken a leap further and pursued the use of weaponised drones. Social media analysis indicates HTS has conducted drone operations in Syria’s Idlib and Hama Governorates as recently as September 2017. Jund al Aqsa - an HTS affiliate at the time - released a propaganda video showing a drone airdropping multiple ABIEDs on Syrian military forces in Hama Governorate during September 2016. While the video did not appear to show significant damage or casualties caused by the ABIED attack, it denotes the further experimentation with both explosives and drones by HTS.

On 8 January 2018, the Russian Ministry of Defence (MoD) issued a statement reporting its military air defence forces in Syria's Latakia Governorate at Hemeimeem Airbase (OSLK/LTK) thwarted a coordinated swarm attack consisting of 13 weaponised drones operated by militants on 5-6 January 2018. The Russian MoD statement indicated six drones were downed via GPS jamming and seven additional drones were downed via conventional surface-to-air missile system engagement. Specifically, Russia claims the militants responsible for the attack operated the drones from territory controlled by HTS in the Syrian governorate of Idlib. Images released by the Russian MoD indicate the drones used in the attack were handcrafted and weaponised via the attachment of air-releasable sub-munitions. Local media reporting indicates Russian military air defence forces in Latakia thwarted a prior weaponised drone swarm attack on 27 December 2017, again reportedly conducted by militants from territory controlled by HTS in Idlib.

In both Somalia and Libya, AQ-linked groups have used small drones for propaganda and reconnaissance purposes. The AQ affiliate al-Shabaab released a propaganda video in November 2016 showing militants operating a small drone in Somalia. This was followed by reports of al-Shabaab operating small drones for propaganda purposes in the Jilib area of Somalia during September 2017. Along these lines, the AQ-linked Shura Council of Benghazi Revolutionaries (BRSC), Shura Council of Mujahideen in Derna (MSCD) and Ansar al-Sharia have each used drones in similar fashion in multiple cities in Libya. Such activity occurred by the BRSC in Benghazi in March 2017 and by the MSCD in Derna during April 2016.

Disrupted Plots

Instances whereby the attackers in a planned or actual terror attack were inspired by online propaganda have grown in frequency since 2001, highlighting the ability of terror groups to incite violence via the internet. The TTPs and incidents discussed above could evolve into the use of small drones as an attack vehicle in areas outside areas of armed conflict. However, potential for a terrorist network, individual militant or internet extremist to utilise a drone for an ABIED attack and/or pre-attack reconnaissance purposes is not without precedent. Examination of foiled attack plots is key to understanding the evolution of the threat environment:

• September 2011: Authorities in the US arrested an AQ-inspired internet extremist allegedly planning to use small drones loaded with explosives in the capital, Washington DC.

• August 2012: Spanish authorities released a video of suspected AQ members using a drone to practise for ABIED attacks; the case led to the arrest of three suspected militants.

• June 2013: German authorities arrested members of an AQ-inspired terror network allegedly plotting to use small drones to carry out terrorist attacks.

• July-August 2016: IS issued propaganda urging followers to conduct weaponised drone attacks on the Summer Olympics in Rio de Janeiro, Brazil. Brazilian authorities, with the help of US law enforcement agencies, arrested 10 individuals for plotting attacks at the games.

• November 2016: A militant cell in Albania linked to IS was arrested in possession of a drone while planning a terror attack.

• December 2016: A Syria-based Australian IS member plotted to conduct weaponised drone attacks in the Australian city of Sydney.

• January 2017: Turkish authorities in Istanbul arrested an IS militant, recovering two drones in his possession. In the weeks following the initial arrest, Turkish authorities charged nine members of an IS cell with plotting to use weaponised drones in attacks in Istanbul.

• April 2017: An individual with IS sympathies was arrested in the US city of Tampa Bay for allegedly planning a weaponised drone attack.

• July 2017: An IS-inspired militant was jailed in Qatif, Saudi Arabia for planning to blow up police and security forces sites using weaponised drones.

• August 2017: Turkish police in the city of Adana detained a Russian citizen, suspected of being an IS operative, who planned to down a US military aircraft via a weaponised drone.

• November 2017: An IS sympathiser in the Italian city of Lodi was arrested after planning to bomb a train station and receiving instructions via Telegram on weaponised drone use.

Response

Employment of drones, weaponised or otherwise, in forms of terrorism both inside and out of areas of armed conflict is an emerging threat that has to potential to negatively affect the aviation security environment at airports globally. While it is not clear in the examples above how advanced the attack planning was, nor whether the operatives actually had the capability to carry out a drone attack, it is inevitable that conflict-zone drone TTPs will migrate away from such areas. Terror group TTPs for drone modification continue to be proliferated on a wide scale due to the expansive nature of the internet; and availability and sophistication of commercial off-the-shelf systems has expanded globally since 2014. In addition, the trend of attacks by returning foreign fighters from Iraq and Syria, terrorist acts conducted by individual militants and plots hatched by internet-inspired extremists indicates that the employment of a weaponised drone in a terror operation is a credible scenario.

Potential targets for any form of terrorist act are difficult to effectively categorise, making acute control of exposure unfeasible. In general, soft targets remain the preferred setting for attacks. Crowded public areas represent the most likely venue of a potential weaponised drone attack. However, the aviation target set has been a key focus area for militant groups since 2001 and the potential for a weaponised and/or unarmed drone attack within the industry must be adequately accounted for. We advise aviation security managers take the following actions:

• Monitor government advisories as well as trends in terrorist TTPs, such as the employment and proliferation of weaponised drones and ABIEDs. Evaluate instances where drones were recovered in possession of the suspects, where attacks were to include drones for pre-attack reconnaissance or weaponisation of the drone.

• Conduct a threat assessment of nefarious drone capability and intent for airports and installations of recurring flight operations, based on the potential risk to facilities, aircraft, passengers and crew.

• Revise internal mechanisms for suspicious activity, safety and security reporting. Revisions should account for drone sightings as part of a wider aviation risk management strategy to protect aircraft, passengers and crew.

• Develop procedures for alerting personnel to a nefarious drone event similar to an “Active Shooter” notification. Following any nefarious drone incident, investigate the background of the event and implement mechanisms for sharing the findings with appropriate authorities and relevant aviation industry bodies.

About the Author

Mark Brace is an Aviation Security Analyst at UK-headquartered Osprey Flight Solutions, a risk analysis and management solutions company offering comprehensive airport, country and overflight risk assessments to business aviation operators. Mark has many years' experience in the public sector as a senior aviation security intelligence analyst in the UK government.

www.ospreyflightsolutions.com

BlueSky Business Aviation News | 4th January 2018 | Issue #445