Feeds

Homebrew chemical terror bombs, hype or horror?

Beyond the valley of the poison suicide vests of death...

Intelligent flash storage arrays

Analysis Shall we do chemical weaponry? Given that at time of writing the Metropolitan Police was conducting a "fingertip search" of a London house for a home-made chemical weapon, it somehow seems appropriate to reality-check the practicalities of such devices. The Met, incidentally, deployed 250 officers and a five mile air exclusion zone to arrest two people at the house, in Forest Gate, London, and in a statement afterwards, Deputy Assistant Commissioner Peter Clarke said that the raid was in response to "very specific" intelligence. This was "such that it demanded an intensive investigation and response." Later, however, sources were quoted as saying there were "questions about the reliability of the informant" - these two positions do not necessarily sit well together.

How rational was a deployment of this size?

Specific details of the purported device have not been released, but reports sourced to the police estimated potential casualties. The Sun contrived to spin this as: "The device is believed to have been designed to release a toxic cloud in a crowded space - killing hundreds." More sober, but still somewhat misleading, BBC reports nailed this down more clearly. Simulations of explosions by Porton Down scientists indicated possible "casualties in double or even triple figures", depending on quantities used. That is, not hundreds of deaths, but the possibility of casualties in up to three figures depending on the data put into the equation. Porton Down is staffed by serious scientists, not snake-oil salesmen, and it seems reasonable to assume that the 'three figure' outcome was the most extreme of a range of results produced using data passed to them by the security services.

We don't as yet know what that data was, but we do have enough information about the class of device the police were searching for us to be able to say with a good degree of certainty how real or unreal the threat was/is. The 'business end' of the conjectured device is said to be a chemical agent of some sort. Various of these have been floated in the press, including sarin, cyanide and anthrax (which is biological, but let's not quibble). It was not ricin - we suspect the Met may not be entirely proud of its previous ricin-related exploits. In most reports it seems dispersal of the agent would be via conventional explosives, although the Sunday Telegraph veers off-piste with claims of a "canister or flask" being used for delivery, and cites the 1995 Aum Shinrikyo Tokyo subway sarin attack with reckless inattention to detail. It's not clear how much responsibility security sources bear for the Saturday Times and Daily Mail 'poison suicide vest of death' stories, but said sources seem now to be distancing themselves furiously from the vest. As well they might - the mockup used to illustrate the Times story looks strangely like a t-shirt with wires stuck on, and the apparent lack of payload space makes one doubt whether a suicide bomber could successfully kill themselves with it. The Times science writer, possibly baffled, appears to agree with us here.

But we'll go initially with a chemical weapon dispersed by conventional explosives, put together in a conventional bomb-type package. We will, purists will be depressed to hear, flit carelessly between chemical and biological - terrorists and security forces tend to do this themselves, and for the purposes of this analysis it'll be simpler. We'll also presume detonation in a confined space, which most of the press reports agree on, and which is where the release of a chemical agent would be likely to cause the greatest damage. This may not seem a lot to go on, but it's enough.

There are several factors to consider in relation to our hypothetical device. The substance used clearly has some relevance, as does its purity. The design of the weapon, however, is particularly critical if the intention is to disperse a chemical or biological agent quickly within a confined space. Logically, Porton's worst possible case result ought to be based on assumptions of a fairly pure agent and an explosive device which disperses it according to plan. This is by no means easy, and is a substantially different matter from arranging nails around stuff that goes bang. Note that a poison vest of death would be even harder, because aside from the more restricted payload it's got a would be-suicide slap-bang where you'd want to put the charge.

Consider VX (a US-produced nerve agent), for example. This is a liquid at room temperature and the delivery mechanism needs to convert it into a cloud of droplets. The size of these droplets is not controllable, and this will clearly influence the effectiveness of the device. In addition, quite a lot of the agent will be destroyed in the detonation or will be fired down into the ground. Some agents are flammable, and in US tests VX ignited in around one third of detonations (source: GlobalSecurity.org's chemical weapons reference section). Anthrax also is not entirely happy if you blow it up. Many chemical agents are highly corrosive (which, if you think about what the stuff is supposed to do to you, is maybe kind of obvious) so containment is an issue. It needs to be in something that isn't going to kill everybody who touches it, right up until the moment the device goes off and then it's intended to kill everybody it touches.

Even if they have the ingredients, a fairly pure agent and explosives, construction of an effective device poses a significant challenge to a kitchen-table terrorist. The construction process is extremely dangerous, and it's perfectly possible that the resultant device will have no effect at all.

About those ingredients...

Keep in your mind that the weapon, even with the right ingredients, might not work, but then consider, where would the terrorists get them? There is no identified 'rogue state' source of chemical or biological agents. Corruption or disaffected scientists might provide access to US or Russian Government stocks, but Aum Shinrikyo, with a very large chequebook, tried both of these and failed. A connection of this sort would also require the involvement of an international terror network, intermediaries and the physical importation of the agent; considering what we've heard about the current investigation we can probably discount these. "Cyanide" is a possibility, as sodium cyanide is both fairly nasty and widely-used in mining, but again there are obvious problems in sourcing and shipping it without being spotted. There have however been instances of sodium cyanide being sourced by terrorists. And weaponising it? In mining it's used in solution to wash ore, and repurposing it for weaponry has clear containment/distribution issues.

Some form of cyanide laundered from the mining industry is however infinitely preferable to making your own chemical agent. This, (see GlobalSecurity, above) is complex, dangerous, and best undertaken using teams of trained scientists and a nice clean and secure factory. An individual who knew what they were doing and was able to source the right ingredients might be able to produce sample quantities without killing themselves, but it'd take a long time to produce enough for a chemical weapon, and considering the risks they probably wouldn't have that long. Storage during the production process would also be difficult, and many agents deteriorate over time. In addition, protracted periods of manufacture outside of a specially equipped facility would face major and ongoing clean-up issues.

The odds small-scale wanabee chemical terrorists face look even poorer if we consider the examples of Saddam Hussein's Iraq, al Qaeda and Aum Shinrikyo. Despite having experienced scientists and a state's resources, Iraq's chemical weapons efforts failed to achieve results from 1971 to 1978, according to the CIA's Iraq Survey Group, while the biological weapons programme failed similarly during the same period, according to UNSCOM (see Leitenberg, Assessing the Biological Weapons and Bioterrorism Threat, US Army War College Strategic Studies Institute). Citing US Government sources Leitenberg also concludes that although al Qaeda had the intent to develop biological weapons, it had got no further than preliminary research (amounting to a small book collection and some very basic equipment) by the time US troops arrived in Afghanistan. Between 1990 and 1994 Aum Shinrikyo also failed in attempts to "procure, produce and disperse anthrax and botulinum toxin" (Leitenberg).

Aum Shinrikyo's subsequent efforts with sarin are widely held to have been a success and a 'wake-up call' in the sense that they showed that terrorists could manufacture nerve agents. "It sent out an alarming message about how easy it was to plot and carry out a chemical attack", as today's Sunday Telegraph claims faultily, getting the casualty figure wildly wrong while it's about it. The 2000 study Ataxia: The Chemical and Biological Threat and the US Response (Amy Smithson & Leslie-Anne Levy, published by the Stimson Center) includes a detailed study of the Tokyo attack which points to the reverse.

Aum Shinrikyo spent $30 million, and had a team of trained scientists, top-class equipment and at least one factory at its disposal. In addition it benefited from the frankly inexplicable Japanese security climate of the time, which left the cult free to do dangerous and scary things, to purchase and stockpile ingredients and equipment and even to conduct live tests of distribution mechanisms on real victims. It pumped out the wrong kind of anthrax (the veterinarian, non-fatal type) from its factory for a protracted period, resulting only in the neighbours complaining about the smell. It attempted hits on rivals with sarin - they appear not to have noticed, but an Aum Shinrikyo operative needed an antidote when it went off in the wrong direction. Attempts to disperse anthrax (still the wrong kind) by spray resulted in strange jellyfish-like stuff on the pavement, and despite the knowledge of its scientists and the quality of its equipment, the cult was plagued (if you'll pardon the expression) by leaks and accidents throughout the production process.

Aum never really licked distribution. An attempt prior to the Tokyo attack to assassinate three judges with sarin missed the targets, but killed seven. This used a van in a car park, with a heat source vaporising drips of sarin and a fan blowing the gas out of the van. Aum's operatives again were exposed by the early build-up of fumes in the van, but Aum had exacted its first innocent casualties. For the Tokyo attack, the sarin was sealed in bags during production and operatives with specially sharpened umbrellas placed the bags in railway carriages then punctured them. The death toll eventually rose to 12. A total of 54 people had been seriously affected, while 980 others suffered mild exposure problems. The remainder of the often claimed 5,500 total (hello, Sunday Telegraph) is accounted for by those Smithson terms the "worried well" - this is certainly an affect of an attack, and certainly a problem for hospitals dealing with the aftermath, so in fairness you could say chemical and biological weapons carry an extra psychological payload. The overall Tokyo numbers however were probably higher than would be the case today, as neither the victims nor the emergency services grasped what they were dealing with early enough to be able to mitigate the effects.

Whether Aum Shinrikyo's attack was a success or not is a matter of debate. From the point of view of bangs per buck, people killed, physical mess created, it was clearly far less cost-effective than attacks using conventional weaponry would have been. The attack has however had a continuing global effect out of all proportion to the physical damage it caused. Governments, security services and journalists are all too ready to repeat how 'easy' it is to plot and carry out a chemical attack, and then to run around in circles shouting. In that sense you could call it a reverberation from Tokyo or a victory for al Qaeda's ricin programme whenever security forces over-react to a biological or chemical threat. Which is a particulary good trick for al Qaeda, as it has no record whatsoever of successful ricin production (vanishingly few have, according to Leitenberg).

Could it happen anyway? Of course - but as we've seen there are clear and high hurdles that a terror group must overcome before it can turn half-baked plans into reality. So far, aside from the Aum Shinrikyo exception,* nobody has. Security services themselves need to grasp this, to avoid deploying hundreds of operatives and millions of pounds on investigations which in the final analysis do not add up. Essentially, they need to start doing risk assessment and to stop over-reacting on the strength of 'might'. While they're chasing 'might' they can all to easily be neglecting a whole stack of 'wills'.

* Another possible exception is "Amerithrax", the distribution of high grade anthrax in attacks in the US. The source of this anthrax has not been identified, but it is commonly assumed to have come from the US' own bio-defence programme. As Leitenberg points out, identification of both source and perpetrator has a relevance to bioterror threat assessments. Which we think you could sum up as, lone wacko = isolated problem, US stocks sold to international terrorist group = huge problem, all bets off. But even then they'd still face the delivery issues. The US Government, incidentally, has reacted to the ricin non-threat by working on a ricin antidote, meaning that high-grade US Government manufactured ricin is now a target for terrorists. ®

Internet Security Threat Report 2014

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
'Internet Freedom Panel' to keep web overlord ICANN out of Russian hands – new proposal
Come back with our internet! cries Republican drawing up bill
What a Mesa: Apple vows to re-use titsup GT sapphire glass plant
Commits to American manufacturing ... of secret tech
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.