(U//FOUO) FBI-DHS Moscow Metro Bombings Joint Intelligence Bulletin

Intelligence Bulletin Joint FBI-DHS Bulletin No. 348

7 pages
For Official Use Only
March 29, 2010

(U) Scope

(U//FOUO) This product is intended to provide perspective and understanding of the nature and scope of potentially emergent threats and to assist federal, state, local, and tribal government agencies and authorities, the private sector, and other entities to develop priorities for protective and support measures relating to an existing or emerging threat to homeland security.

(U) Key Findings

(U/FOUO) According to Russian government and open source reporting, two female suicide bombers attacked two trains on the Moscow metro on 29 March by detonating improvised explosive devices (IEDs) that were worn on their bodies. Initial reporting indicates 38 people may have been killed and 102 injured.

• (U//FOUO) The attacks appear intended to cause maximum casualties and publicity, taking place in the crowded morning hours as trains were in or arriving at busy stations located near iconic government buildings.

• (U//FOUO) According to the Russian Federal Security Service, the bombs were composed of military-grade explosive and augmented with shrapnel to make them even more lethal.

• (U//FOUO) FBI, DHS/I&A, and TSA OI have no current, credible information indicating terrorist plots to conduct similar attacks against U.S. mass transit.

(U) Suicide Bombers Attack Two Metro Trains

(U) The attacks appeared timed specifically to target the trains as they were in or arriving at stations to causing the greatest number of casualties both aboard the trains and on the platforms. According to Russian press reports, both explosions occurred on the oldest line of the Moscow metro system and both were detonated in the second car of a train during a busy morning period.

• (U) Both bombers boarded their trains at the Yugo-Zapadnaya station which is the outermost station on the line that was targeted. The first bomber detonated her device at the Lubyanka metro station at 7:56 a.m. Moscow time as the train was pulling into the station; the second bomber detonated her device at the Park Kultury station (four stops south of Lubyanka) at 8:37 a.m. as the train was stopped and passengers were boarding. Both the Lubyanka and Park Kultury stations are transfer stations and may have been chosen to target the greatest number of people.

• (U//FOUO) The location of the attacks also may have been chosen to generate the most media attention by occurring near important government facilities. The Lubyanka metro station is directly under the headquarters of the Federal Security Service. Russian officials believe that the second bombing most likely was meant to occur at the Oktyabrskaya station, which is the location of the Interior Ministry, but was mistakenly detonated at Park Kultury for reasons that have not yet been determined.

• (U//FOUO) Preliminary reports indicate the attackers wore the IEDs under their clothing. Russian officials assess the devices used the military and industrial explosive hexogen (RDX) and that the first was equivalent to 4 kilograms (8.8 pounds) of TNT and the second to 1.5 to 2 kilograms (3.3 to 4.4 pounds) of TNT. The devices were filled with shrapnel to increase casualties.

(U) Similarities to 2004 Incidents

(U//FOUO) The attack is similar to two that occurred in 2004 on the Moscow metro system, which a Russian court found were caused by a Chechen separatist organization; 49 people were killed and 300 were injured in those attacks.

(U) Investigation

(U//FOUO) There have been no claims of responsibility, but Russian officials attribute the attacks to Chechen separatists.

• (U//FOUO) A Chechen extremist leader posted a video to the internet in February in which he claimed responsibility for derailing a train between Moscow and St. Petersburg in November 2009 and added, “The war is coming to their cities.”

(U//FOUO) Attack Method Viable in the United States

(U//FOUO) Terrorists historically have used the tactic of detonating explosives on mass transit using suicide bombers and IEDs placed or carried inside rail cars or at stations.

• (U//FOUO) High-ridership passenger and mass transit trains serve many major U.S. cities, some with stations near notable government or private sector buildings or other iconic facilities. Passenger rail and mass transit routes linking government and business centers would be likely targets for this type of attack.

(U) Security Recommendations

(U//FOUO) The vastness of the U.S. rail network makes it impractical to prevent attacks on rail assets at all times. TSA recommendations focus on regional collaboration, employee vigilance, and public awareness to deter terrorist operational planning and attack. These measures specifically aim to increase collaboration among federal, state, local, and private sector officials responsible for securing U.S. mass transit and railroads and to highlight the important role sector employees and the public play in alerting security and law enforcement to suspicious activities.

• (U//FOUO) Regional collaboration among federal, state, local, and private sector officials enhances the level of security awareness and expands the scope of security resources available in and around mass transit systems and passenger railroads.

• (U//FOUO) Employee vigilance provides additional capabilities to identify suspicious activities and items in and around trains, buses, rail lines, stations, terminals, tunnels, bridges, elevated track, and other key facilities. Employees are force multipliers for railroad and mass transit security programs.

• (U//FOUO) Public awareness is crucial to inspire vigilance and timely reporting of suspicious activities and items. Vendors and others who work at or near facilities can expand security efforts. Law enforcement officers should be familiar with and engage those with the ability to reinforce their security efforts.

…

(U) Reporting Notice

(U) DHS and the FBI encourage recipients of this document to report information concerning suspicious or criminal activity to the nearest state and local fusion center and to the local FBI Joint Terrorism Task Force. The nearest state and local fusion centers’ contact information can be found online at http://www.dhs.gov/files/resources/editorial_0306.shtm. The FBI regional phone numbers can be found online at http://www.fbi.gov/contact/fo/fo.htm and the DHS National Operations Center (NOC) can be reached by telephone at (202) 282-9685 or by e-mail at NOC.Fusion@dhs.gov. For information affecting the private sector and critical infrastructure, contact the National Infrastructure Coordinating Center (NICC), a sub-element of the NOC. The NICC can be reached by telephone at (202) 282-9201 or by e-mail at NICC@dhs.gov. When available, each report submitted should include the date, time, location, type of activity, number of people and type of equipment used for the activity, the name of the submitting company or organization, and a designated point of contact.