On 21 October 2019, the French anti-terrorism prosecutor’s office announced that the investigation into the 2015 terror attacks in Paris, France, had concluded. It took French authorities four years to complete the investigation. The attacks targeted outdoor cafes, a stadium, and a concert hall – resulting in 130 deaths and another 352 injured. The investigation revealed that a larger jihadist cell was behind the complex coordinated terrorist attacks (CCTA), reaching across Europe but particularly Belgium, which was later also targeted by the cell. The result of the French investigation has led to the indictments of at least 20 suspects and the discovery of many lessons learned.
The Department of Homeland Security (DHS) defines CCTA as “acts of terrorism that involve synchronized and independent teams at multiple locations, sequentially or in close succession, initiated with little or no warning, and employing one or more weapon systems: firearms, explosives, fire as a weapon, and other nontraditional attack methodologies that are intended to result in large numbers of casualties.”
Timeline of Attacks
Paris was challenged with responding to multiple attacks in 2015, culminating in November. On 7 January 2015 there was an attack at the Charlie Hebdo magazine headquarters, with a subsequent manhunt and hostage situation. In August 2015, there was an attempted attack on the Thalys Amsterdam-Paris train, where three Americans managed to subdue the attacker. Then, on 13 November 2015, multiple coordinated attacks in Paris occurred in quick succession.
Planning for the November attacks started months before. The terrorist cell that planned and executed the attacks consisted of nine attackers who split into three groups. One group drove to the Stade de France (soccer stadium), another group targeted a bar and restaurant district, and a third group targeted the Bataclan concert venue.
At the Stade de France, the attackers were armed with suicide vests. At about 8:20 p.m., one of them attempted to enter the stadium but was denied access to the venue. In response, he detonated his explosives outside of the stadium, killing himself and a bystander. Ten minutes after that explosion, a second attacker detonated his explosives outside the stadium as well, killing only himself. Twenty minutes later, the last attacker in that group detonated his explosives near a fast-food restaurant close to the stadium, also killing only himself. All three explosions occurred in a 30-minute time span. The French president was in the stadium and was evacuated. Some in the crowd heard the explosions and knew something had occurred, but French officials decided not to make any announcements and the stadium was locked down while the match continued. When the match ended, the crowd remained orderly as they became aware of activity outside of the arena and within the city of Paris.
At about the same time, the team that targeted the cafe and bar district launched their attacks. Driving a black vehicle, they opened fire on cafes, killing 15 and severely injuring another 15 in the initial shootings. They continued to another location and opened fire on two additional restaurants only minutes later, killing another 5 and severely injuring 8 more. Minutes later, they again opened fire on a bar, killing an additional 19 people and gravely injuring 9 others. Only minutes afterward, one of the attackers entered a restaurant, sat down, and detonated his vest, killing himself and 15 others. All of these attacks happened in the span of about 25 minutes in rapid succession.
At about the same time as the explosion in the restaurant, three men entered the Bataclan concert hall, which holds about 1,500 people and was in the middle of a concert. As the attackers entered, they executed the security guard and opened fire on the crowd, killing 90 people and taking the remaining audience hostage. After a two-and-a-half-hour siege, police stormed the concert hall, shooting one of the attackers, who detonated his suicide vest, miraculously killing only himself. Thereafter, the other two attackers detonated their own vests, killing themselves. No other lives were lost, though there were a large number of injuries. The remaining hostages were freed.
The result of these attacks led the French president to declare a state of emergency. The French borders were closed and troops deployed to the city of Paris. The ensuing manhunt lasted several days, resulting in the raid of an apartment in a Paris suburb, where a shoot-out lasting several hours left three dead (i.e., two related to the terror cell and one a family member not connected otherwise). The sole attacker left alive was apprehended months later in March 2016 in Molenbeek, Belgium.
Successes, Failures & Worldwide Responses
The goal of these attacks was simple – overwhelm government resources by exploiting vulnerabilities. The attacks were carefully planned, and their goal of mass murder was achieved.
In his 2015 Brookings Institution blog, Bruce Reidel pointed out that the Paris attacks were likely modeled on the 2008 attacks in Mumbai, India. The Mumbai attacks were a series of terrorist attacks that took place in November 2008, when 10 members of the terror group Lashkar-e-Taiba carried out 12 attacks throughout Mumbai. The attacks lasted four days, killing 164 people and wounding more than 300 others. In both cases, the terrorists used small, well-armed bands of attackers striking concurrently against several targets in an urban area. One difference was that the attackers in Paris used suicide vests, while the ones in Mumbai did not.
The Paris attacks were important enough that, in 2016, Congress appropriated $50 million to the Secretary of Homeland Security to address emergent threats from violent extremism and CCTAs. Congress additionally directed the Federal Emergency Management Agency (FEMA) to allocate funds to state and local jurisdictions to focus on the CCTA threat. A number of states and regions were awarded grants to develop CCTA programs and are currently developing programs. Given the threat picture with recent incidents around the globe, local jurisdictions should be paying attention as well.
To better understand the CCTA threat, consider the response to an active shooter. During active shooter events, officers from multiple agencies converge in the area where the shootings are reported. Issues of command and control abound as commanders attempt to manage the incident and numerous resources. However, if a series of coordinated attacks were to occur simultaneously with this active shooter incident, the issues responders encounter would expand exponentially. This issue requires attention within the public safety community before other attacks like the ones in Paris occur.
The larger the incident and the more complexities involved, the more vexing the response will be. If an active shooter is already considered a “wicked problem,” imagine what a CCTA might look like. The French were caught off guard in these attacks, but they managed to recover and respond. Imagine the need to properly identify each incident as other incidents are occurring, the number of crime scenes requiring investigation, the number of victims involved, the need to identify and track everyone, and the number of families affected. All of these factors will be more difficult in ways most responders have not yet experienced.
French authorities purposely did not evacuate the stadium because they were concerned that was the very goal of the terrorists. Had they done so, they would have sent thousands of fans among the remaining two suicide bombers waiting outside. Additionally, they held off on ordering a large number of resources to the scene because they were concerned about other attacks. It was a lesson learned from the Charlie Hebdo attacks earlier that year that proved prescient.
Despite how well they did, though, the French also had a number of issues:
- They failed to capitalize on intelligence;
- Officers self-deployed;
- Traffic jams formed at some scenes;
- Command posts failed to coordinate; and
- Emergency medical services (EMS) and call centers (equivalent to 9-1-1) were quickly overwhelmed with the large number of victims.
The Los Angeles Police pioneered the concept of Multiple Assault Counter-Terrorism Action Capabilities (MACTAC) in 2009. MACTAC is the adoption of military tactics allowing for a rapid response to react and neutralize the threat. At the dawning of an initial incident, officers are taught to expect follow-up attacks and stage accordingly. Several agencies have adopted it, including the Las Vegas Metropolitan Police Department.
MACTAC is what prevented the over-convergence of responders at the Route 91 Harvest music festival on the Las Vegas Strip on 1 October 2017. Las Vegas Police officers are trained in MACTAC, so they staged in rally areas within their patrol beats in case of secondary and tertiary attacks. When calls came in about shots fired at multiple casino resorts, the on-scene commander was able to implement actions and quickly rule out that they were victims of a larger complex coordinated attack.
The thrust of MACTAC is that officers immediately transition to small unit infantry tactics to pursue and stop multiple attackers rather than create perimeters and wait for tactical assistance. The concept of MACTAC is Incident Command System (ICS) compliant and includes an emphasis on officers staying within their assigned areas in case multiple attacks occur. This concept has the potential to address attacks like the ones in Paris and may be worth adopting as a way to address the myriad of issues a CCTA presents. MACTAC has been called “active shooter response 2.0.” Assuming CCTAs are “active shooter 2.0,” then MACTAC may be the training officers need to counter this kind of incident.
Note: Credit is given to the Los Angeles HSAC and Paris Public Safety Delegation white paper of June 2016, called The Attacks on Paris: Lesson Learned, from which much of the information is derived.