On Sept. 20 at approximately 8 p.m. local time, a large vehicle-borne improvised explosive device (VBIED) detonated in front of the Marriott Hotel in Islamabad
, Pakistan. Pakistani sources report that the device contained approximately 2,000 pounds of explosives. Judging from photos of the blast crater (which was reportedly 24-30 feet deep and some 60 feet wide), the size of the truck containing the device and the damage done to the hotel and the surrounding neighborhood, that estimate is probably accurate. The hotel was destroyed despite the fact that its extensive physical security measures operated as designed — they were overcome by the massive amount of explosive used. The success of the attack highlights the need for protective intelligence in addition to physical security measures. The attack has been blamed on al Qaeda — which is a reasonable assumption, especially in light of the four large VBIEDs that were seized by Pakistani authorities in June
and the VBIED attack on the Danish Embassy
that was claimed by al Qaeda in a video showing the bomber's preparation. The four devices seized after the Danish Embassy attack contained a combined total of nearly 2,600 pounds of explosives. As we noted at the time those devices were seized, such large VBIEDs are very powerful, and are normally intended to be used in attacks on hard targets — targets with security that would prevent attacks by smaller devices. There are unconfirmed reports that the Prime Minister House may have been the primary target for this attack, but that the attackers found security too tight at that site and diverted to the Marriott instead. This is plausible. Secondary attack sites are commonly planned for VBIED attacks, and certainly either target would be high on al Qaeda's priority list. If this report is true, however, it is somewhat odd that the heightened security that allegedly prevented the truck from hitting the Prime Minister House did not notice the out-of-place truck and then act to interdict it. It is important to note that the security measures in place at the Marriott did not fail. In fact, the security at his particular hotel was better than that employed at most hotels around the world, but it is very difficult to seal off completely a commercial building like a hotel. The physical security measures at the Marriott functioned as designed, and, in fact, managed to stop the truck at the hotel's exterior barricade. Had this attack employed a smaller device like the one deployed against the Danish Embassy, the damage to the hotel would have been much less. However, while the hotel's security measures — which prevented an attempt in January 2007 to attack the hotel by an operative wearing a suicide vest
— were sufficient to protect against smaller devices, the attackers' use of a very large device overcame the standoff distance from the vehicle checkpoint to the hotel building itself — a building that was built to be a luxury hotel and not a hardened facility such as a U.S. Embassy. The explosive device in the truck did not detonate immediately; the vehicle stopped at the barrier, burst into flames and burned for several minutes (during which time the security personnel attempted to put out the flames with a fire extinguisher), and only then exploded. In hindsight, had security officers recognized the truck contained a VBIED and begun to evacuate the hotel at that time, the number of casualties might have been reduced. In the end, this was not a particularly sophisticated or elegant attack. Brute force — in the form of a huge explosive device — worked to overcome the security measures in place, and the damage done to the hotel appears to have been amplified by the inability to shut down the natural gas lines in the hotel. The resulting intense fires not only caused considerable additional damage to the structure but also greatly hampered rescue efforts. With the security measures functioning as designed, the real failure was not in physical security but in protective intelligence. At the national level, Pakistani authorities failed to intercept the VBIED before it could be employed. On a tactical level, if hotel security or the authorities in Islamabad were using countersurveillance teams outside the hotel, they apparently failed to catch the preoperational surveillance performed prior to this attack. Though in their defense, with such a high-profile target, one that has been hit by multiple attacks in the past, much of the targeting surveillance was undoubtedly conducted months ago and only a limited amount of surveillance would have been necessary to update plans and check current conditions at the target prior to launching this attack. We wrote at the time the Pakistani authorities seized the four large VBIEDs in June that more attacks were likely, and some of that analysis bears quoting here because it remains applicable: "At this point, however, it appears that al Qaeda, the Tehrik-i-Taliban Pakistan and other militants can operate with a large degree of freedom and that the Pakistani government does not have the ability to consistently prevent them from planning and launching attacks. From the intent and effort displayed by al Qaeda in the last several days, we anticipate more attempted attacks in Islamabad — including attacks on hard targets — in the foreseeable future. "This means that foreigners with interests in Pakistan would be well advised to heed the June 6 Warden message, in spite of the recovery of the fourth VBIED. With militants' targeting plans likely to continue, it would also be prudent to ratchet up surveillance detection efforts at potential target sites." As we noted at the time, an organization that goes to the expense and effort to amass 2,600 pounds of explosives and fashion the material into very large and destructive VBIEDs typically will not stop attacking until it is destroyed or otherwise neutralized.