Mumbai Large Scale Attack Lessons

This awareness guide is designed to help responders and planners understand the nature of current and emerging threats. It is for use by U.S. public safety agencies and special operations assets such as those with critical infrastructure protection, tactical teams, bombs squads, weapons of mass destruction, fusion centers and others.

INCIDENT

The 2008 attacks took place from November 26, 2008 to November 29, 2008 in Mumbai, India's largest city and financial capital. Teams of terrorists using automatic weapons launched a series of 10 coordinated attacks. Approximately 195 people were killed and 325 injured during the attacks.

PRE-PLANNING
Terrorists began preoperational planning and surveillance several months prior to the attacks. The operation had an extensive planning, intelligence, support, training, and resource network in place. The terrorists had reported sites with prepositioned weapons and supplies in several locations. They had also conducted publicly available Internet mapping studies of the target areas.

ATTACKS
The police command and control station was the first target of the attack, which disrupted police response and communications. In some of the incidents, the terrorists employed fast "hit-and-run" tactics using automatic weapons and grenades to attack large groups of people. In these attacks, the terrorists would move away from security agencies and move on to secondary targets. In several other incidents, terrorists used "seize-and-hold" tactics to seize locations and defend these areas using strong points against the security agencies and the military. These incidents became into barricaded hostage situations.

SECONDARY ATTACKS
As terrorists retreated from security agencies, they were reported to have stolen at least one police vehicle. They also conducted several "drive-by" attacks using automatic weapons against a hospital and theatre using this vehicle while moving between locations. The attackers ambushed responders when they had the opportunity. Early in the incident, the attackers killed the chief of Mumbai's Anti-Terrorism Squad and two other senior police officials.

IMPROVISED EXPLOSIVE DEVICES
Latest open-source reporting indicates at least seven improvised explosive devices (IEDs) were employed during the four-day siege; two might have been vehicle borne IEDs (VBIEDs).

ATTACKERS
The terrorists spent at least a year prior to the attacks training in the handling of weapons and close-quarters combat tactics. The attackers infiltrated the city using fishing vessels and inflatable speedboats under the cover of darkness. They used cell phones, satellite phones, Blackberries, radios, and preprogrammed global positioning systems. During the incident, the teams were in communication with each other and command elements outside the city. The terrorists operated in teams of two to four and moved on foot and in stolen vehicles.

RESPONSE
The Army had to conduct extensive building-to-building and room-to-room clearing of attack sites, since it was the only agency with the resources and personnel to conduct these operations. The clearing operations took a long time because of the barricaded terrorists and civilians hidden in multiple locations. It took from 700 to 900 soldiers and police to successfully clear and secure the multiple incident sites.

LESSONS LEARNED

1. Communications interoperability was a significant issue during the Mumbai attack and previous terrorist attacks. Public safety agencies must continue to expand and test interoperable multi-agency communications.

2. There was a lack of a unified/central command and control system during the Mumbai incidents. Public safety preparation efforts must include all primary public safety and support agencies in the planning, training, and exercises for critical incidents, and the Incident Command System must be followed.