Tactics, Techniques, and Procedures (TTPs) is an essential concept in

terrorism Terrorism, in its broadest sense, is the use of criminal violence to provoke a state of terror or fear, mostly with the intention to achieve political or religious aims. The term is used in this regard primarily to refer to intentional violen ...

and

cyber security Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...

studies. The role of TTPs in terrorism analysis is to identify individual patterns of behavior of a particular terrorist activity, or a particular terrorist organisation, and to examine and categorize more general tactics and weapons used by a particular terrorist activity, or a particular terrorist organisation.

Requirement to identify individual terrorism TTPs

The current approach to terrorism analysis involves an examination of individual terrorist, or

terrorist organisations A number of national governments and two international organizations have created lists of organizations that they designate as terrorist. The following list of designated terrorist groups lists groups designated as terrorist by current and fo ...

use of particular

weapon A weapon, arm or armament is any implement or device that can be used to deter, threaten, inflict physical damage, harm, or kill. Weapons are used to increase the efficacy and efficiency of activities such as hunting, crime, law enforcement, s ...

s, used in specific ways, and different tactics and

strategies Strategy (from Greek στρατηγία ''stratēgia'', "art of troop leader; office of general, command, generalship") is a general plan to achieve one or more long-term or overall goals under conditions of uncertainty. In the sense of the " ar ...

being exhibited. Broadly, a wide range of TTPs have been exhibited historically by individual terrorist, or terrorist organisations worldwide.

Key concepts

Evolution of TTPs

All terrorists, or terrorist organisations, worldwide historically have exhibited an evolution in TTPs. This can be as a result of: * changing circumstances; * resource availability; or, * changing ideologies, or 'war-focus'. In the case of the

Taliban The Taliban (; ps, طالبان, ṭālibān, lit=students or 'seekers'), which also refers to itself by its state (polity), state name, the Islamic Emirate of Afghanistan, is a Deobandi Islamic fundamentalism, Islamic fundamentalist, m ...

, their tactics have consisted primarily of guerrilla-style

improvised explosive device An improvised explosive device (IED) is a bomb constructed and deployed in ways other than in conventional military action. It may be constructed of conventional military explosives, such as an artillery shell, attached to a detonating mechan ...

(IED) attacks and small-arms ambushes against international and state-level security forces and interests, such as police checkpoints and military supply convoys. However, more recently Taliban TTPs have expanded to include mass casualty attacks by

suicide bombers A suicide attack is any violent attack, usually entailing the attacker detonating an explosive, where the attacker has accepted their own death as a direct result of the attacking method used. Suicide attacks have occurred throughout histor ...

and other suicide attacks in order to undermine the current government.

Kill-chain model

The kill-chain model (KCM) is a conceptual tool used in terrorism analysis and studies. Sullivan, J.P., Bauer, A. eds (2008).
Terrorism Early Warning: 10 Years of Achievement in Fighting Terrorism and Crime
Los Angeles, CA: Los Angeles Sheriff’s Department. All terrorists' or terrorist organisations' TTPs form part of understanding the terrorist kill chain, which is the pattern of transactional activities, link together in order for a terrorist act to take place. Broadly, this involves describing the '

hierarchy A hierarchy (from Greek: , from , 'president of sacred rites') is an arrangement of items (objects, names, values, categories, etc.) that are represented as being "above", "below", or "at the same level as" one another. Hierarchy is an important ...

of tasks and sub-tasks that may be involved in the execution', or in making a terrorist act happen. These can include the arrangement and sequence of activities a terrorist or terrorist organisation uses in planning, organizing, mobilizing, training, equipping and staging resources and operatives. These activities make up the terrorist or terrorist organisations' modus operandi or 'attack system'. Four sets of steps make-up the full KCM: * The first set of activities are the 'attack preparation steps'. In terms of terrorism analysis, individual transactions, such as acquiring finances, acquiring expertise, acquiring materiel, munitions or capability, recruiting members, conducting

reconnaissance In military operations, reconnaissance or scouting is the exploration of an area by military forces to obtain information about enemy forces, terrain, and other activities. Examples of reconnaissance include patrolling by troops (skirmisher ...

, mission rehearsal, conducting an attack, have signatures that identify them as terrorist or

criminal acts In ordinary language, a crime is an unlawful act punishable by a State (polity), state or other authority. The term ''crime'' does not, in modern criminal law, have any simple and universally accepted definition,Farmer, Lindsay: "Crime, definit ...

or are consistent with the operations of a specific individual, cell or group. * The second set of activities are called the 'execution timeline'. This identifies the timeline, along which the terrorist, or terrorist organisations various activities, leading up to an attack process flows time-wise. * The third set of activities is identified as 'targeting'. An individual or group would carry out some form of dedicated reconnaissance with the aim of identifying weaknesses in the site or operation; and with that information determine the best method of attack. * The fourth set of activities is identified as the 'planning stages'. These involve some type of planning activity embedded into the ‘kill chain’, and is part of the process of organizing, mobilizing, training, equipping, staging, collecting resources and operatives. These make up the terrorist or terrorist organisations’

modus operandi A ''modus operandi'' (often shortened to M.O.) is someone's habits of working, particularly in the context of business or criminal investigations, but also more generally. It is a Latin phrase, approximately translated as "mode (or manner) of op ...

, or its system of attack. The KCM "sequence of activities" is not linear, but discontinuous. Three additional KCM scenarios can be identified:Flaherty, C. (2012) Dangerous Minds: A Monograph on the Relationship Between Beliefs –Behaviours – Tactics. Published by OODA LOOP (7 September 2012).URL: http://www.oodaloop.com/security/2012/09/07/dangerous-minds-the-relationship-between-beliefs-behaviors-and-tactics/ * An individual or group actively promote a terrorist/extremist ideology on the

internet The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...

, in books, pamphlets, etc. This is then picked up by another terrorist, or terrorist organisations, who then act on this. * Two or more parallel kill chain sequence of activities (by various individuals/groups) which are only indirectly connected by intermediary individuals/groups. Sharing similar beliefs, but as well cross over into complementary beliefs/ideologies. Many such intermediaries can operate in this space, passing ideas and resources, even recruits between the various terrorist, or terrorist organisations, groups and cells. * A terrorist or terrorist organisations picks up ideas, knowledge, etc., and jump-start into various places along the ‘standard’ concept of the KCM.

Transfer of Terrorist Tactics, Techniques and Procedures

Terrorist TTPs are often transferred between various terrorists, or terrorist organisations, and they often learn from each other. The degree to which the transfer of TTPs occurs depends on their relative success when transferred to a different conflict, and a different environment. The similarities in TTPs between various terrorists, or terrorist organisations, across conflicts and periods suggest a transfer of information. *

Explicit Knowledge Explicit knowledge (also expressive knowledge) is knowledge that can be readily articulated, codified, stored and accessed. It can be expressed in formal and systematical language and shared in the form of data, scientific formulae, specifications, ...

: This is the

theoretical A theory is a rational type of abstract thinking about a phenomenon, or the results of such thinking. The process of contemplative and rational thinking is often associated with such processes as observational study or research. Theories may be ...

information which is often stored in hard copies, such as textbooks, manuals and on computers through

PDF Portable Document Format (PDF), standardized as ISO 32000, is a file format developed by Adobe in 1992 to present documents, including text formatting and images, in a manner independent of application software, hardware, and operating systems. ...

and video files. These are extremely easy to get hold of, but without the appropriate teaching or experience, this easy access information is commonly not effectively used. * Tactical Knowledge: Most commonly taught or learnt through experience and hands on teaching. This requires training establishments to be organised. For terrorists, or terrorist organisations, acquiring this information is harder, and more difficult; however, it is seen as a more effective transfer of knowledge.

Key tactical concepts related to TTPs

Several key tactical concepts can be related to TTPs, which are typically used in

insurgency An insurgency is a violent, armed rebellion against authority waged by small, lightly armed bands who practice guerrilla warfare from primarily rural base areas. The key descriptive feature of insurgency is its asymmetric nature: small irregu ...

operations. *

Interposing tactics Interposing Tactics is tactical concept, developed under Terrorist Tactics, Techniques, and Procedures, to explain a tactical action where a small-scale action takes place between two combatants, where one manoeuvres into interposition or interject ...

* Mimicking operationsFlaherty, C.J. (December 2003) Mimicking Operations, Australian Army Journal. (1)2: 11-14. URL: http://www.army.gov.au/Our-future/LWSC/Our-publications/Australian-Army-Journal/Past-issues/~/media/Files/Our%20future/LWSC%20Publications/AAJ/2003Summer/02-InformationWarfareAndMi.pdf * Rhizome Manoeuvre *

Three-dimensional (3D) tactics analysis Three-Dimensional (3D) Tactics Analysis, is a tactical analysis methodology under the concept of Terrorist Tactics, Techniques, and Procedures, and is related to Rhizome Manoeuvre. The approach is applicable to Urban warfare, urban combat, and takes ...

* Swarming tactics * Deliberate erratic actions, and erratic attacksFlaherty, C. (2009) 2D Verses 3D Tactical Supremacy in Urban Operations. Journal of Information Warfare. (8)2: 13-24. * Dynamic defence

References

{{reflist Counterterrorism