How to Tell if Your Neighbor is a Bombmaker is republished with permission of STRATFOR.

By Scott Stewart

Al Qaeda in the Arabian Peninsula (AQAP) released the fifth edition of its English-language jihadist magazine “Inspire” on March 30. AQAP publishes this magazine with the stated intent of radicalizing English-speaking Muslims and encouraging them to engage in jihadist militant activity. Since its inception, Inspire magazine has also advocated the concept that jihadists living in the West should conduct attacks there, rather than traveling to places like Pakistan or Yemen, since such travel can bring them to the attention of the authorities before they can conduct attacks, and AQAP views attacking in the West as “striking at the heart of the unbelievers.”

To further promote this concept, each edition of Inspire magazine has a section called “Open Source Jihad,” which is intended to equip aspiring jihadist attackers with the tools they need to conduct attacks without traveling to jihadist training camps. The Open Source Jihad sections in past editions have contained articles such as the pictorial guide with instructions titled “Make a Bomb in the Kitchen of Your Mom” that appeared in the first edition.

In this latest edition of Inspire there are at least three places where AQAP encourages jihadists to conduct “lone wolf” attacks rather than coordinate with others due to the security risks inherent in such collaboration (several jihadist plots have been thwarted when would-be attackers have approached government informants looking for assistance). In recent years there have been a number of lone wolf attacks inside the United States, such as the June 2009 shooting at an armed forces recruiting center in Little Rock, Ark.; the November 2009 Fort Hood shooting; and the failed bombing attack in New York’s Times Square in May 2010. Of course, the lone wolf phenomena is not just confined to the United States, as evidenced by such incidents as the March 2 shooting attack against U.S. military personnel in Frankfurt, Germany.

In the past, STRATFOR has examined the challenges that lone wolf assailants and small, insulated cells — what we call grassroots jihadists — present to law enforcement and intelligence agencies. We have also discussed the fact that, in many cases, grassroots defenders such as local police officers can be a more effective defense against grassroots attackers than centralized federal agencies.

But local federal agents and local police officers are not the only grassroots defenders who can be effective in detecting lone wolves and small cells before they are able to launch an attack. Many of the steps required to conduct a terrorist attack are undertaken in a manner that makes the actions visible to any outside observer. It is at these junctures in the terrorist attack cycle that people practicing good situational awareness can detect these attack steps — not only to avoid the danger themselves, but also to alert the authorities to the suspicious activity.

Detecting grassroots operatives can be difficult, but it is possible if observers focus not only on the “who” aspect of a terrorist attack but also the “how” — that is, those activities that indicate an attack is in the works. In the past we’ve talked in some detail about detecting preoperational surveillance as part of this focus on the “how.” Now, we would like to focus on detecting another element of the “how” of terrorism and discuss the ways one can detect signs of improvised-explosives preparation — in other words, how to tell if your neighbor is a bombmaker.

IEDs and Explosive Mixtures

In the 11th edition of “Sada al-Malahim,” AQAP’s Arabic-language online jihadist magazine, Nasir al-Wahayshi noted that jihadists “don’t need to conduct a big effort or spend a lot of money to manufacture 10 grams of explosive material” and that they should not “waste a long time finding the materials, because you can find all these in your mother’s kitchen, or readily at hand or in any city you are in.” Al-Wahayshi is right. It truly is not difficult for a knowledgeable individual to construct improvised explosives from a wide range of household chemicals like peroxide and acetone or chlorine and brake fluid.

It is important to recognize that when we say an explosive mixture or an explosive device is “improvised,” the improvised nature of that mixture or device does not automatically mean that the end product is going to be ineffective or amateurish. Like an improvised John Coltrane saxophone solo, some improvised explosive devices can be highly-crafted and very deadly works of art. Now, that said, even proficient bombmakers are going to conduct certain activities that will allow their intent to be discerned by an outside observer — and amateurish bombmakers are even easier to spot if one knows what to look for.

In an effort to make bombmaking activity clandestine, explosive mixtures and device components are often manufactured in rented houses, apartments or hotel rooms. We have seen this behavior in past cases, like the December 1999 incident in which the so-called “Millennium Bomber” Ahmed Ressam and an accomplice set up a crude bombmaking factory in a hotel room in Vancouver, British Colombia. More recently, Najibullah Zazi, who was arrested in September 2009, was charged with attempting to manufacture the improvised explosive mixture tri-acetone tri-peroxide (TATP) in a Denver hotel room. In September 2010, a suspected lone wolf assailant in Copenhagen, accidentally detonated an explosive device he was constructing in a hotel. Danish authorities believe the device was intended for an attack on the Jyllands-Posten newspaper, which was targeted because of its involvement in publishing the controversial cartoons featuring the Prophet Mohammed.

Similar to clandestine methamphetamine labs (which are also frequently set up in rental properties or hotel rooms), makeshift bombmaking operations frequently utilize volatile substances that are used in everyday life. Chemicals such as acetone, a common nail polish remover, and peroxide, commonly used in bleaching hair, can be found in most grocery, beauty, drug and convenience stores. Fertilizers, the main component of the bombs used in the 1995 Oklahoma City bombing and the 1993 World Trade Center attack, can be found in large volumes on farms or in farm supply stores in rural communities.

However, the quantities of these chemicals required to manufacture explosives is far in excess of that required to remove nail polish or bleach hair. Because of this, hotel staff, landlords and neighbors can fairly easily notice signs that someone in their midst is operating a makeshift bombmaking laboratory. They should be suspicious, for example, if a new tenant moves several bags of fertilizer into an apartment in the middle of a city, or if a person brings in gallons of acetone, peroxide or sulfuric or nitric acid. Furthermore, in addition to chemicals, bombmakers also utilize laboratory implements such as beakers, scales, protective gloves and masks — things not normally found in a hotel room or residence.

Additionally, although electronic devices such as cell phones or wristwatches may not seem unusual in the context of a hotel room or apartment, signs that such devices have been disassembled or modified should raise a red flag, as these devices are commonly used as initiators for improvised explosive devices. There are also certain items that are less commonly used in household applications but that are frequently used in bombmaking, things like nitric or sulfuric acid, metal powders such as aluminum, magnesium and ferric oxide, and large quantities of sodium carbonate — commonly purchased in 25-pound bags. Large containers of methyl alcohol, used to stabilize nitroglycerine, is another item that is unusual in a residential or hotel setting and that is a likely signal that a bombmaker is present.

Fumes from the chemical reactions are another telltale sign of bombmaking activity. Depending on the size of the batch being concocted, the noxious fumes from an improvised explosive mixture can bleach walls and curtains and, as was the case for the July 2005 London attackers, even the bombmakers’ hair. The fumes can even waft outside of the lab and be detected by neighbors in the vicinity. Spatter from the mixing of ingredients like nitric acid leaves distinctive marks, which are another way for hotel staff or landlords to recognize that something is amiss. Additionally, rented properties used for such activity rarely look as if they are lived in. They frequently lack furniture and have makeshift window coverings instead of drapes. Properties where bomb laboratories are found also usually have no mail delivery, sit for long periods without being occupied and are occupied by people who come and go erratically at odd hours and are often seen carrying strange things such as containers of chemicals.

The perpetrators of the 1993 World Trade Center bombing manufactured the components for the truck bomb used in that attack in a rented apartment in Jersey City, N.J. The process of cooking the nitroglycerine used in the booster charges and the urea nitrate used in the main explosive charge created such strong chemical fumes that some of the paint on the walls was changed from white to blue and metal doorknobs and hinges inside of the apartment were visibly corroded. The bombmakers also flushed some of the excess chemicals down the toilet, spilling some of them on the bathroom floor and leaving acidic burn marks. The conspirators also spilled chemicals on the floor in other places, on the walls of the apartment, on their clothing and on other items, leaving plenty of trace evidence for investigators to find after the attack.

Given the caustic nature of the ingredients used to make homemade explosive mixtures — chemicals that can burn floors and corrode metal — and the very touchy chemical reactions required to make things like nitroglycerin and TATP, making homemade explosives can be one of the most dangerous aspects of planning an attack. Indeed, Hamas militants refer to TATP as “the Mother of Satan” because of its volatility and propensity to either severely burn or kill bombmakers if they lose control of the chemical reaction required to manufacture it.

In January 1995, an apartment in Manila, Philippines, caught fire when the bombmaker in the 1993 World Trade Center attack, Abdel Basit (aka Ramzi Yousef), lost control of the reaction in a batch of TATP he was brewing for his planned attack against a number of U.S. airliners flying over the Pacific Ocean — an operation he had nicknamed Bojinka. Because of the fire, authorities were able to arrest two of Basit’s co-conspirators and unravel Bojinka and several other attack plots against targets like Pope John Paul II and U.S. President Bill Clinton. Basit himself fled to Pakistan, where he was apprehended a short time later. This case serves to highlight the dangers presented by these labs to people in the vicinity — especially in a hotel or apartment building.

Another form of behavior that provides an opportunity to spot a bombmaker is testing. A professional bombmaker will try out his improvised mixtures and components, like improvised blasting caps, to ensure that they are functioning properly and that the completed device will therefore be viable. Such testing will involve burning or detonating small quantities of the explosive mixture, or actually exploding the blasting cap. The testing of small components may happen in a backyard, but the testing of larger quantities will often be done at a more remote place. Therefore, any signs of explosions in remote places like parks and national forests should be immediately reported to authorities.

Obviously, not every container of nitric acid spotted or small explosion heard will be absolute confirmation of bombmaking activity, but reporting such incidents to the authorities will give them an opportunity to investigate and determine whether the incidents are indeed innocuous. In an era when the threat of attack comes from increasingly diffuse sources, a good defense requires more eyes and ears than the authorities possess. As the New York Police Department has so aptly said, if you see something, say something.