(U//FOUO) Recent calls over the past year for attacks on hospitals in the West by media outlets sympathetic to the Islamic State of Iraq and ash-Sham (ISIS) highlight terrorists’ perception of hospitals as viable targets for attack. Targeting hospitals and healthcare facilities is consistent with ISIS’s tactics in Iraq and Syria, its previous calls for attacks on hospitals in the West, and the group’s calls for attacks in the West using “all available means.” While we have not seen any specific, credible threat against hospitals and healthcare facilities in the United States, we remain concerned that calls for such attacks may resonate with some violent extremists and lone offenders in the Homeland because of their likely perceived vulnerabilities and value as targets.
» (U//FOUO) The pro-ISIS Nashir Media Foundation released a series of messages on 29 December 2016 encouraging lone offenders in the West to conduct attacks on hospitals, cinemas, and malls. In early June 2016, ISIS called for a “month of calamity,” encouraging followers in Europe and the United States to attack schools and hospitals in an audio message released via Twitter. Additionally, in its January 2016 issue of Rumiyah magazine, ISIS provided tactical guidance and encouraged lone offenders to conduct arson attacks on hospitals.
» (U) ISIS, through its Amaq news agency in November 2016, took credit for an attack on a hospital in Quetta, Pakistan that resulted in at least 74 deaths and 100 injuries. Aid organizations and coalition governments have alleged since early 2015 that ISIS has systematically targeted hospitals, healthcare facilities, patients, and healthcare workers in Iraq and Syria, resulting in hundreds of deaths and injuries and reducing the overall capacity of healthcare delivery infrastructure.
(U) Possible Indicators of the Targeting of Hospitals and Healthcare Facilities
(U//FOUO) Some of these activities may be constitutionally protected, and any determination of possible illicit intent should be supported by additional facts justifying reasonable suspicion. These activities are general in nature and any one may be insignificant on its own, but when observed in combination with other suspicious behaviors—particularly advocacy of violence—they may constitute a basis for reporting.
» (U//FOUO) Consumption and sharing of media glorifying violent extremist acts in attempting to mobilize others to violence;
» (U//FOUO) Loitering, parking, standing, or unattended vehicles in the same area over multiple days with no reasonable explanation, particularly in concealed locations with optimal visibility of potential targets or in conjunction with multiple visits;
» (U//FOUO) Photography or videography focused on security features, including cameras, security personnel, gates, and barriers;
» (U//FOUO) Unusual or prolonged interest in or attempts to gain sensitive information about security measures of personnel, entry points, peak days and hours of operation, and access controls such as alarms or locks;
» (U//FOUO) Individuals wearing bulky clothing or clothing inconsistent with the weather or season, or wearing official uniforms or being in unauthorized areas without official credentials;
» (U//FOUO) Individuals presenting injuries consistent with the use of explosives or explosive material without a reasonable explanation; and
» (U//FOUO) Unattended packages, bags, and suitcases.
(U) Possible Mitigation Strategies
» (U//FOUO) Limit access in restricted areas and require employees to wear clearly visible identifications at all times;
» (U//FOUO) Ensure personnel receive training and briefings on active shooter preparedness, lockdown procedures, improvised explosive device (IED) and vehicle-borne IED awareness and recognition, and suspicious activity reporting procedures; and
» (U//FOUO) Conduct law enforcement and security officer patrols in loading, waiting, and patient triage areas, and around drop-off and pick-up points where there are large numbers of people concentrated in restricted spaces.