(U//FOUO) DHS-FBI Terrorist Tradecraft: Impersonation Using Stolen, Cloned or Repurposed Vehicles

Fire Line Terrorist Tradecraft—Impersonation: Use of Stolen, Cloned, or Repurposed Vehicles

1 page
For Official Use Only
January 18, 2013

(U//FOUO) Stolen, cloned, or repurposed commercial or official vehicles—such as police cars, ambulances, and public utility service trucks—have been used in terrorist attacks. These vehicles could facilitate terrorist access to restricted and hardened targets as well as to emergency scenes. The use of these vehicles can provide individuals the ability to approach targets to conduct pre-operational surveillance or carry out primary attacks or secondary attacks against first responders.

— (U) In January 2013, a stolen ambulance was used as a vehicle-borne improvised explosive device (VBIED) as part of a secondary attack on a billiards hall in Quetta, Pakistan.
— (U//FOUO) Cloned vehicles are those that have been modified to resemble an authentic vehicle. In January 2010, coordinated attacks in downtown Kabul, Afghanistan included a vehicle-borne improvised explosive device van cloned as an ambulance.
— (U//FOUO) Repurposed vehicles are authentic vehicles that are no longer in official service; they often can be purchased at auctions or on the Internet. In August 2012, assailants detonated a possibly repurposed taxi cab VBIED targeting a funeral procession in Damascus, Syria.

(U//FOUO) Mitigating the risk:

— (U//FOUO) Secure station or facility entrance and exit points, including apparatus bay doors.
— (U//FOUO) Limit or lock unattended emergency vehicles.
— (U//FOUO) Establish a policy for decommissioning vehicles.
— (U//FOUO) Stay current on the “branding” of vehicles used by neighboring jurisdictions and mutual aid companies.
— (U//FOUO) Consider using holograms on emergency vehicles for authentication.
— (U//FOUO) Establish a stolen vehicle reporting process that includes “be on the lookout” warnings for high interest vehicles.

(U//FOUO) Possible indicators:

— (U//FOUO) Improperly marked emergency vehicles.
— (U//FOUO) Driver of emergency vehicle not knowledgeable about area of responsibility or service.
— (U//FOUO) Incorrect vehicle decal verbiage, colors, word font, and size.
— (U//FOUO) Visible identifiers—such as phone numbers, license plates, or call numbers—that are inconsistent with the vehicle’s operating area or mission.
— (U//FOUO) Heavily loaded vehicle, possibly beyond capacity.

(U) Report Suspicious Activity

(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx.