Identifying a Mundane but Deadly Threat

7 MINS READAug 15, 2016 | 09:30 GMT
Identifying a Mundane but Deadly Threat
Ukrainian police officers and security services experts examine the car of journalist Pavel Sheremet. The execution of the attack on Sheremet suggests the perpetrators were experienced and well-trained.
Forecast Highlights

  • Identifying choke points — areas that are difficult to avoid and therefore often used — along commutes and other frequently traveled routes can mitigate the risk of attack.
  • Changing up daily patterns, including departure times, modes of transportation and routes, can make it more difficult for attackers to plan an assault.
  • Security teams can use the same surveillance measures that assailants often use in plotting attacks to identify vulnerabilities in potential targets' normal routines.

In a world of new and evolving threats lurks a hidden danger, whose peril lies in its very consistency: routine. Pavel Sheremet, a Belarusian journalist and commentator, recently fell victim to his own daily patterns. Just before 7:40 a.m. on July 20, he got in his partner's car to drive the few kilometers from his neighborhood in central Kiev to Radio Vesti, where he hosted a morning radio show. Parking in Kiev — as in any big city — can be tricky, and Sheremet had to park at the top of Ivan Franko Street, a few hundred meters from his apartment. From there, he made a U-turn and headed to the busy intersection with Bohdan Khmelnytsky Street, which would take him to a major thoroughfare. As Sheremet turned left onto Bohdan Khmelnytsky Street, an explosion struck his vehicle. Though emergency response teams arrived at the scene within minutes, Sheremet succumbed to the injuries caused by the blast shortly after the attack.

The motives behind the attack are unclear. Sheremet was an outspoken journalist who had criticized Russian, Belarusian and Ukrainian policies alike, and any number of groups may have wanted to silence him. But in investigating attacks like the one on Sheremet, "how" is often a more practical question than "why." After all, understanding how assaults are carried out gives security professionals — and possible targets — the means to prevent or avoid them. Reviewing the Sheremet case, along with surveillance video that shows the attack and much of its staging, provides insight into the potential dangers of routine and what can be done to mitigate them.

The Product of Planning

Whatever the perpetrators' motive, the attack's execution suggests that they were well-trained and experienced. Ukrainian investigators have confirmed that the device that killed Sheremet was command-detonated, meaning that it was planted ahead of time and triggered remotely. Five hours before the explosion, unconfirmed surveillance video shows a man and woman walking down Ivan Franko Street toward Sheremet's vehicle, which was parked along the street and was not covered or protected in any way. In the video, a man with a limp positions himself opposite the targeted vehicle and stands watch while a woman retrieves an item from a bag, disappears behind Sheremet's car for a moment and then continues down the street. She likely attached a so-called sticky bomb to the vehicle using magnets to secure the device, a common tactic in assassinations. (Suspected Israeli operatives used sticky bombs to attack two Iranian nuclear scientists in Tehran in 2010.)

At the time of the explosion, Sheremet's vehicle had just cleared a busy pedestrian crossing and was about as isolated as it could get in Kiev's morning rush-hour traffic. Judging by the size of the blast, the device was likely small, armed with half a kilogram (about 1 pound) of explosives or less — just enough to get the job done without causing collateral damage. Amateur attackers usually err in favor of more explosives to make sure they hit their target. By contrast, the attack that killed Sheremet was a clean execution, well-orchestrated and well-executed.

The Choke Point

The attack's location also reflects careful planning on the part of the attack team. Driving to work that morning, Sheremet had five different routes to choose from. All but one of them passed through the intersection of Ivan Franko and Bohdan Khmelnytsky streets. The intersection is a choke point — a spot along a route that is difficult to avoid and that a target, therefore, will very likely pass. Because commuting to and from work is one of the most predictable parts of a person's daily routine, it offers assailants a prime opportunity. Using pre-operational surveillance, criminals and attackers can establish a target's likely whereabouts at a given time and stage their assault accordingly. Based on his routine and, likely, pre-operational surveillance, Sheremet's attackers knew that he would almost certainly drive through the intersection where they eventually killed him.

Beyond offering a choke point, the location had other advantages. In Sheremet's case, the attack team did not need pre-positioned car bombs or gunmen to take out its target. It did, however, need a spotter to look out for his car and detonate the device concealed under the driver's seat at just the right time. The intersection at Ivan Franko and Bohdan Khmelnytsky streets, the site of a McDonald's, a cafe and a hotel, provided plenty of good vantage points for a spotter. Moreover, it is a high-traffic area where someone in a car or on foot could wait for his or her target to drive by without attracting too much attention. Operating a command-detonated device against a moving target is tricky, since delays in the signal and ignition of the charge can throw off the timing. By targeting a car in an intersection, where a driver will have to slow down to turn, the spotter has more time to react, allowing him or her to better time the blast. The explosion was perfectly timed, suggesting that whoever hit the switch had experience and a steady hand. And in detonating the explosive in a crowded intersection — a riskier option than setting it off as soon as Sheremet got in his car — the attackers ensured a very public assassination.

Regardless of their training and experience, the attackers may have given themselves away at the scene of the crime. Surveillance footage captured just after the explosion reveals suspicious behavior among some of the witnesses present. As everyone else jumped from the shock of the blast, a man standing with his back to the intersection reacted slowly. In addition, he is shown using a cane, recalling the male suspect who walked with a limp toward Sheremet's car earlier that morning. Just before he reaches the intersection, Sheremet drives past a woman sitting in a parked white car. After the explosion, she immediately gets out of her vehicle before getting right back in. A heavyset gentleman then walks into frame right next to her with an unusual air of calm. Unlike everyone else on the street, he keeps his distance from Sheremet and his car, surveying the scene from behind a pole that partially obscures him from the surveillance camera's view. Despite their unusual behavior and proximity to the attack site, these individuals may not have been involved in the assassination. But they would certainly be individuals of interest in the investigation.

Limiting an Attacker's Advantage

If the team that attacked Sheremet had government backing, it probably had more resources at its disposal than the typical criminal or grassroots jihadist does. But the team members' target also made their job a little easier, however unwittingly. Sheremet's vehicle was left unprotected in a public space, vulnerable to anyone who happened to pass by. Had Sheremet paid a little more to park in a garage, the attackers would have had to be more aggressive to get to the vehicle, increasing their risk of being noticed and stopped. Furthermore, Sheremet, like most people, apparently lived by a routine. He was predictable enough for the attackers to identify a choke point and predict when he would drive through it. Changing up his departure time, route and mode of transportation would have made it more difficult for assailants to plan an attack against him.

Presumably, Sheremet's attackers had collected copious information on his daily habits through extensive surveillance before they planned the assassination. Personal security teams can run the same analysis on potential targets to identify choke points in their daily routines. Finding these areas of increased vulnerability can help security professionals determine where to deploy countersurveillance assets to watch for suspicious behavior and deter nefarious activity.

Sheremet's assassination was not the first of its kind, nor will it be the last. In spite of the assailants' skill in planning and executing the attack, it was not unavoidable. Taking a lesson from the surveillance footage that captured the attack's staging and execution, security personnel and people concerned with their own safety can take precautions to prevent similar incidents. 

Connected Content

Regions & Countries

Article Search

Copyright © Stratfor Enterprises, LLC. All rights reserved.

Stratfor Worldview


To empower members to confidently understand and navigate a continuously changing and complex global environment.