The approach precedes the attack. It has to and Green-on-Blue attacks are no different. An attacker must get closer to his target in order to be successful, but it also is going to cause that person to stand out from the baseline. If you are a new reader, I recommend you take a look at the article explaining Proxemic Pulls to better understand this dynamic before moving on:
From Science To The Streets – Where The Proxemic Pull Came From
The reason for this is that attackers intuitively understand the principle that Proximity Negates Skill. If you can’t shoot someone from 500 yards away, you have to get within a range where you can hit your target. If you don’t have a gun, you need to get within knife striking range. If you don’t the skill or the ability, you have to get within a closer proximity to compensate and be successful.
The consequences for failing to identify an insider threat are extremely high, and while the fact that attackers are moving closer to Marines or Soldiers can make stopping these attacks more challenging (a closer attacker reduces the amount of time available to react and limits the number of options available for dealing with the threat), it also simplifies the problem as well. It lets us start our analysis on the people approaching us and determining if they fit the baseline or an anomaly.
Proxemic Pulls are going to be the context that we will place all of our Green-on-Blue observations into and can be thought of as adding physical movement to the Interested Cluster. The baseline for a Proxemic Pull is a positive encounter, you typically only approach things that you have a high degree of interest in. This makes our hunt for anomalies to be centered on the nonverbal cues we might expect to see on a person approaching us with violent intentions.
A criminal will approach his target for two reasons: the first is to conduct the attack itself and the second would be to conduct surveillance in preparation for their planned attack. Regardless of which reason, I am initially concerned about where a member of the ANSF has focused their interest – are they observing habitual areas or anchor points?
Why Attack An Anchor Point?
An anchor point is a place where people go to feel safe. It is a place that not just anyone can come or go freely, but a place where you have to meet some pre-existing criteria to gain access. In Afghanistan, an American anchor point could be the Combat Operations Center (COC) where only people who have a security clearance or are directly involved in the planning and execution of missions are allowed to be. It could be the berthing areas that are prohibited to the ANSF. These places are usually off-limits to the ANSF.
In a Green-on-Blue situation, attacking an anchor point would likely show a lack of planning on the part of the attacker. To attack here would make your intentions clear right from the beginning. This would be like storming into your bosses office uninvited. It won’t end well. Should an ANSF soldier decide to conduct his attack on the anchor point, it is unlikely he will make it out alive.
Attacking here would show elements of rage, where emotion clouds the decision-making process to the point where the attacker is no longer worried about the inherent risk. This is why I say that attacking an anchor point would show that the attack was unplanned. If these were terrorist attacks, or an infiltration by the Taliban, than they would be able to exploit the fact that they hit an anchor point, but they are more often the result of a breakdown in personal relationships.
Why Attack In A Habitual Area?
For the purposes of Green-on-Blue attacks, I would consider an attacker conducting his attack in a habitual area as someone who put more thought into the plan. Because a habitual area is a place where anyone can come or go, it would be easier for someone with violent intentions to get closer to their target undetected. These could include places like
– The chow-hall where they are already allowed to eat
– On training ranges where they are already expected to have their weapons and ammunition
– Possibly on patrol, where people are distracted searching for outside threats and would be more susceptible to a threat from the inside
Because the attacker will likely have a greater degree of surprise than if they were approaching an anchor point, it also opens the door to the chance of them surviving the attack or even escaping once the attack is complete. If you read about the Empire State Building shooting that occurred in August 2012, the attacker went to his former business to kill the boss that fired him. Instead of approaching his boss inside of the office, the confrontation was on the street (a habitual area). The attacker was able to flee a few blocks before shot by police officers. Even though his escape was unsuccessful, by attacking in a habitual area, the opportunity had presented itself.
The Proxemic Pull is the context that we will need to place the nonverbal cues into so that we can find meaning. The body language cues that will be in tomorrow’s article do not make someone a threat, they only become a threat when they don’t fit the baseline.
Download The Threats Inside The Wire E-Book
(This series of posts has been edited and expanded upon in the ebook)