“Pursue one great decisive aim with force and determination.”
-General Carl von Clausewitz

Understanding and recognizing the terrorist planning cycle is one of the primary tools used by law enforcement, military and intelligence operators in the global war on terror. The criminal planning cycle closely emulates the terrorism cycle and both are used on specific targets or targets of opportunity.

At Trident Response Group, we are often asked if there was an event or activity that became a real game changer in how we planned, prepared and conducted operations. For everyone in the executive protective business and those involved in counter-terrorism operations, that event came in the fall of 1989.

On November 30, 1989, an event took place that forever changed the way executive protection experts performed their duties, and how threat assessments were performed.  In the intelligence arena, it upped the game of how to accurately predict what type of technology could be weaponized for terrorist use. The incident also became a learning tool for future terrorist attacks on American military personnel in Iraq and Afghanistan after the 9-11 attacks.

The Game Changer
On that November morning in 1989, Alfred Herrhausen, the chairman of the West German Deutsche Bank, was riding to work in his chauffeur-driven level three armored car when he was killed by a concealed explosive device.  The attack was carried out by a prominent West German terrorist Group, The Red Army Faction (RAF), and it was a “Game Changer.”

The Attack
Mr. Herrhausen lived in a quiet, exclusive residential area in Bad Homburg, a suburb of Frankfurt.  Mr. Herrhausen’s normal pattern of life was to travel to work in a three-car motorcade, riding in the right rear seat of the second car.  He was accompanied by four bodyguards, two in the lead car and two in the follow-up car. The motorcade usually departed Mr. Herrhausen’s home between 8:15 and 8:30 a.m. and always took the same route to the office in Frankfurt.

On the morning of the event, Mr. Herrhausens left his home at 8:24 a.m. traveling in his motorcade down a narrow, tree-lined street that went past a school and a large public park. Due to a school street crossing and a bus stop on this street, cars were required to reduce their speed to 30 mph as they drove through the park area and even slower to 15 mph in the school zone.

As Mr. Herrhausen’s lead security car approached the attack site, they did not perceive as a threat a man on the left side of the road in workout clothes wearing what appeared to be a Sony type headphone set. This was not unusual since the park had several jogging and biking paths that were used at all times of the day.  As the lead car passed through the attack site, the security team observed a child’s bike chained to one of the white roadside posts that ran along both sides of the street. This bike along with several others were often seen here where the park paths began.  On this particular day, a small package was located on the child’s bike back basket.

What the security team clearly didn’t see was a small photoelectric device attached to the roadside post directly in front of the child’s bike.  Directly across the road on the other side was another post which had a square, red plastic reflector-similar to what one would find on a bike.

Concealed and unobserved was a second man also dressed in jogging clothes with a Sony headset over his ears crouched down in the thick underbrush, just around the corner from the attack site. This man had a small electronic device, just a little bigger than a transistor radio (think modern day Blackberry).

The lead security car passed the bike chained to the post and continued up the street and turned right onto Promenade Highway.  Mr. Herrhausen’s armored car (with him sitting in the right rear seat) was approximately 200 meters (656 feet) behind the lead security car as it turned right.  At 8:36 a.m., Mr. Herrhausen’s armored car passed the child’s bike which then exploded propelling shrapnel through the right rear door.  The explosion (10 kilos or 22 pounds of high explosive), took place less than 3 feet away from the right rear door of Mr. Herrhausen’s car.  The explosion threw the 2.8-ton level three armored car across the street and was heard over 500 yards away.

The explosion ripped open the right side of the armored car and forced what was initially thought to be a piece of the armored car door into Mr. Herrhausen upper groin. Mr. Herrhausen was pushed across the back seat of the car pinning him to the left side door.  The injuries to Mr. Herrhausen were initially not thought to be life threating, but he quickly bled to death before first responders could arrive.  Mr. Herrhausen driver was only slightly injured and none of the security personnel in the lead or  follow-up cars were injured. 

The Investigation
The German National Police secured the attack site and began a field investigation.  First, they identified a detonating wire running along the sidewalk which led from the attack site down to the location where the second man had concealed himself in the underbrush.  There they found a small makeshift electronic device consisting of six 4.5-volt batteries attached to a voltmeter with an on/off switch. Beneath the device, they found a single sheet of paper within a plastic protective cover. On the paper was the logo of the RAF and the words: “Kommando Wolfgang Beer.” Wolfgang Beer was an RAF terrorist killed in a car accident in July 1980.

According to a police reconstruction of the attack, the device found at the site was a photo-electronic cell that generated a light beam that served as the ignitor of the explosive device. The photo-electronic cell projected an infrared beam across the street onto the bike reflector. The reflected beam bounced back to the infrared device which was connected to the explosives concealed on the back of the child’s bicycle and inside the sealed basket. The bomb was precisely placed on the bike to match the height of the back right door of the armored car.

The first terrorist (man #1, dressed in workout clothes) served as the lookout and signaler to the second terrorist (man #2 concealed in the underbrush). As the motorcade approached the ambush site, terrorist #1 sent a simple radio signal to terrorist #2 that began a well-rehearsed countdown to turn the photo-electronic cell on after, repeat after the lead security car passed the bicycle. The second vehicle carrying Mr. Herrhausen was approximately 200 meters (657 feet) behind the lead security car which turned right onto Promenade highway. When Mr. Herrhausen’s car entered the attack site it broke the light beam triggering the electronic detonator that ignited the explosive device. The device was less than three feet directly across from Mr. Herrhausen’s position in the car. The explosion was directly aimed at the right rear seat of the car and was designed to match the height of the right rear door of the car. This type of attack required the RAF to perform several different types of analysis. They had to compute the speed of the car while cross referencing the length of the car, and the height of the back right door to accurately pinpoint the “kill zone”. Needless to say, they did an excellent job.

A third, female terrorist was positioned on the corner of a small side street, just beyond the attack site to observe the immediate aftermath of the attack. There was a RAF car parked on a side street facing the wrong direction about 100 yards from the attack site. This was later determined to be an escape vehicle for terrorist #1 (lookout/signaler) and terrorist #2 (initiator/attacker) who operated the photoelectric cell. A second RAF car was located around the corner just off Promenade highway. After the lead security car rounded the corner onto Promenade highway, this second RAF car moved up and blocked the road leading into the attack site. This effectively isolated the attack site from any unwanted vehicular traffic (no other collateral damage was intended).

The second most significant find of the investigation after the photoelectric device was  how the detonation cord was put in place.  From in-depth interviews conducted with people who used the park regularly or had children within walking distance of the school, a stealthy plot was uncovered. About 6 weeks before the attack, in mid-October 1989, several RAF members apparently dressed as construction workers had laid the detonator wire from the attack point to the post where the bike was positioned. The RAF members chiseled a trough into the sidewalk and laid the detonating wire in place. They covered the wire with asphalt that was very similar in color to that of the sidewalk. The wire was then placed in the bushes and concealed with forest deadfall, leaves and brush.

The explosive device itself consisted of ten kilos (22 pounds) of explosive and a two-kilo (4.5 pound) copper plate that created a platter charge. The explosive force molded the copper plate into a spearhead shaped projectile which became a metal piercing explosively formed penetrator (EFP) A.K.A. an explosively formed projectile. This type of self-forging warhead is designed to effectively penetrate armored vehicles, which it did. As noted earlier, this EFP pierced the armored car and struck Mr. Herrhausen in the groin area opening a pelvic artery which led to rapid blood loss and causing death minutes after the attack.

Lessons Learned
The RAF were West Germany’s most dangerous terrorist group and had demonstrated the ability to strike and then go underground for months.  Prior to the assassination of Mr. Herrhausen, the RAF had conducted no significant act of terrorism for just under 14 months.

In the months leading up to the attack there had been no specific intelligence to indicate that Mr. Heerhausen would be directly targeted by the RAF. There were no specific indicators that the RAF was entering an attack mode. There were several general developments that suggested a higher state of alert might be a prudent move, but nothing concrete to identify a potential RAF event. There had been a failed hunger strike by imprisoned RAF members earlier in 1989, increased bank robberies (one of their prime sources of sustenance funding) and then an RAF letter smuggled out of prison to the national media with specific code words authorizing the RAF “Commando Initiative” to conduct an attack.

Mr. Herrhausen was a very attractive target and was far more than just the Chairman of the Deutsche Bank. He was one of the most prominent citizens in West Germany and was called the country’s “senior industrialist and the most influential economic strategist in West Germany at this time.” As a personal friend and economic advisor to West German Chancellor Helmut Kohl, he played a central role in pushing West German business into Communist Eastern Europe. The RAF’s ideology was social communism, so from their perspective, his role in expanding Deutsche Bank investment into Eastern Europe made him their ideal symbolic target.

Then U.S. Secretary of State, James Baker said in an interview shortly after the attack that “the impact of Mr. Herrhausen’s assassination is like a European head of state, in fact, one of our allies. The West German government offered a $2.2 million reward for information leading to the capture of the assassins.

Once of the key lessons learned in the post incident assessment was the importance of understanding the “terrorist planning cycle”. That information and knowledge could have been used by the protective detail to spot the attack before entering the kill zone or better yet as it was being planned.  This would have allowed the terrorist attack to have been effectively countered on site or stop the attack altogether before it occurred.

When closely examining the Herrhausen assassination and the terrorist planning cycle; it quickly becomes apparent that the opportunity to counter this attack was lost on several levels. First, the executive protection detail was prepared to counter a kidnapping or a force on force encounter, not an explosive device. Secondly, Mr. Herrhausen controlled the timeline, not the security detail. The motorcade departed the house between 8:15 and 8:30 a.m. each business day.  RAF surveillance did not have to linger in an area for a lengthy amount of time to get intelligence on selecting the best time of day to conduct the attack. Thirdly, Mr. Herrhausen was a banker and businessman, so “time is money” was his mindset. Waste no time, take the most direct route to the office. This allowed the RAF to identify several different ambush points. The post incident route assessment proved that the RAF had selected the most desirable site to catch the motorcade at a slow rate of speed, excellent concealment for the attacker, excellent environment for the cover story (jogging in the park) and little chance of collateral damage to civilian personal (minimal foot traffic in the kill zone).

As stated earlier, the Herrhausen assassination forever changed the way executive protection was performed, how route analysis would be conducted and what type of threat assessment was truly needed.  The intelligence community found itself dealing with a fare more sophisticated terrorist, one who could utilize off the shelf technology and use it in multiple ways to conduct operations on many levels. The game plan for the war on terrorism changed dramatically on November 30, 1989.

The most disturbing outcome of this event was that simple benign technology could be weaponized for terrorist use. This attack became the blueprint for future terrorist attacks on American military personnel in Iraq and Afghanistan after the 9-11 attacks.

The RAF device that killed Mr. Herrhausen is generally described as a platter charge, rather than an ISIS or Al-Qaeda designed EFP. Those Improvised Explosive Devices (IED) were different, but the attack profile while varied, remained similar. What the Herrhausen event did was demonstrate ways to attack convoys or motorcades without putting valued personal or difficult to replace equipment at great risk. It has become the blueprint for finding the soft underbelly of executive protection or physical security. Far worse, it showed that simple observation of every day “patterns of life” can and will reveal that opportune moment to attack.

The criminal planning cycle parallels the terrorist planning cycle, especially in crimes perpetrated against individuals. The correlation is a bit less obvious when looking at crimes like the sales of narcotics, but the planning cycle is still there.

For example, a drug pusher decides to deal narcotics in a specific part of town because the market is there. He plans his sales and their related activities. He selects a specific place to sell the drugs. He makes his sales and then departs the area to avoid exposure. He uses the cash from those sales to restock his products, conceals some cash for an emergency and then spends some of the money on fun times. It’s a cycle with specific activity, unique tasks, real time analysis and an end goal.

We would like to invite you down to Trident Response Group to meet the team. We would enjoy sitting down and talking about the terrorist planning cycle and how it relates to the criminal planning cycle. We can educate you and explain how it’s used against a specifically selected target or how a criminal uses the same format to quickly go after a target of opportunity.

“The backbone of surprise is fusing speed with secrecy.”
-General Carl von Clausewitz