Counter-Ambush Tactics for Civilians

By ISDA Member Tom Pecora

Anyone can become a victim of an ambush, be it a robbery, carjacking, or straight up assault.  If we work in or travel through hostile environments (war zones, insurgent areas, high crime neighborhoods) we need to utilize some specific skills to prevent or survive an ambush.  In the protective operations world, these are sometimes referred to as Protective Intelligence (PI) skills while in other security disciplines they are known as situational and tactical awareness skills.  The specific skills we are discussing include:

  1. Route Analysis
  2. Surveillance Detection and Counter-Surveillance
  3. Attack Recognition
  4. Countering the “Surprise” Factor
  5. Evasive Action

Route Analysis is the tactical examination of our environment from the point of the view of an attacker.  Specifically, we are examining the routes we will use looking for potential attack sites, chokepoints, and any hazards which may cause us harm or impact our ability to move from one location to another securely.

Potential attack sites are locations that provide the enemy with the ability to control our movements, provides them cover and concealment, and leaves them with potential escape routes.  The actual location where we feel the attacker would stage or initiate the attack (location where the most firepower would be used) is called the “X”.

One type of location we need to focus our attention to is the “Fringe” areas.  These are locations at the edges of the public areas between safe zones.  Some examples of this are parking structures, parking lots, and pedestrian walkways.  Criminals are frequently stalking these fringe areas as they provide prey and the more secluded locations where they can do their work outside of public view.

Another area we need to focus on is “Chokepoints”.  These are areas that we are required to travel through when moving from one location to the other.  Chokepoints can be the result of geographic features (bridges over river, parks), traffic patterns (only road between two points), or architectural features (buildings and structures) which restrict our movements.

Historical studies of assassinations and ambushes have shown that if victims vary their routes and times (what we call being time and place unpredictable) if they are attacked it will most likely occur in one of the chokepoints.  Route analysis, done correctly, will show us where we are vulnerable (fringe areas and chokepoints) and help us determine the most likely attack sites (i.e. the “X”).  We must, therefore, pay more attention to these areas.

One historical example of poor route analysis involved an attack in Heidelburg, Germany on U.S. Army General Frederick Kroesen, Commander in Chief of the US Army in Europe in December 1981.  The General’s staff had received warning information that a terrorist group, the Red Army Faction (RAF) was targeting him.

On December 15th, 1981 at 0722 hours, General Kroesen, was attacked with RPGs and rifle fire by members RAF terrorist group near Heidelberg, West Germany.  The RAF terrorist group surveilled Gen. Kroesen for approximately one week prior to the attack and found that the General’s movements were time and place predictable as he took this specific route on a daily basis.  The RAF group set up their firing position overlooking a traffic light at a major intersection. The RAF then used a Volkswagen Golf sedan to get in front of the motorcade to slow it down forcing the motorcade to miss the signal light and stop at the intersection.  The Volkswagen then ran the red light and drove away leaving the motorcade stopped at the intersection.

The RAF team fired two Rocket Propelled Grenade (RPG) at the motorcade, only one struck the trunk of the Limo detonating and causing the breaking the rear windshield resulting lacerations to the General’s neck.  The Limo finally drove away from the attack site.  The total time the Limo was in the ambush site was approximately 12 seconds.

The Security Detail made a variety of mistakes to include not raising their awareness level once they received threat information, not varying their times and routes and not analyzing their routes for good potential ambush sites.  They also did not recognize the Volkswagen Golf as a potential threat even when it ran the red light.

Surveillance Detection

To target us, the attacker must know where we are and when we will be there.  At a minimum, they must be aware of our presence early enough to prepare to act. While more sophisticated attackers can gather this data electronically, at some point all attackers must employ “eyes on” the target.  Thinking like the attacker, we need to find the most likely Surveillance Points near our work, our residence, along our routes, in fringe areas, chokepoints and near potentially good ambush sites.

We need to analyze potential surveillance points looking for the likely places where the Surveillants will be located and the possible methods they may use to blend in to their environments. For example, a local park across from our residence may provide ample cover for a surveillant to surveil us.

Once we have located likely surveillance points we begin to look for Correlation (i.e. movement by people or vehicles which corresponds to or is concurrent with our movements).  In the case of a criminal attack, the attackers may begin walking behind us or paralleling us as we move along the street.  Additionally, we need to look for some common mistakes made by the surveillants (unnatural movements or activities, staring, note-taking, photography, etc.).

Upon discovery of some correlation or unusual activity, we need to immediately investigate.  This can be done covertly (using counter-surveillance) or overtly (using

interviews, arrests, site inspections, etc.). If there is enough evidence to warrant concern we need to then respond (change our routes and times, post obvious security in the chokepoints, etc.).  In the case of a criminal attack, we need to get to a safe location and alert law enforcement.

To effectively employ Surveillance Detection, we must be situationally and environmentally aware.  Situational awareness is being alert to the changing events around you in the environment – mentally prepared to react to any sudden incident like someone crossing the street.  We also need to be aware of the specific “threats” in our environment – anything that is likely to cause us harm or that can affect our safety.  Knowing local crime characteristics (where are the hot spots, types of crime, when, etc.), the location of the nearest safe havens (police and fire departments) and the closest medical facilities are key environmental elements.

As a civilian in our everyday life, we need to maintain a level of environmental and situational awareness.  In the protective world, we call this practice Surveillance Detection and during every movement we employ surveillance detection skills especially in fringe areas, chokepoints, and potential ambush sites.

Surveillance Detection (SD) is very effective against the initial surveillance phase in an attack as untrained personnel are frequently used and this surveillance takes place over a great deal of time.  In terms of basic criminal elements, being situationally/environmentally aware will help us determine when a criminal has begun to look us over as a potential target based on their behaviors.

With sophisticated terrorist/criminal elements, SD is less effective against the final surveillance phase as they will most likely use trained/experienced personnel and this surveillance takes less time.

Attack Recognition

Using our surveillance detection skills, we need to look for signs of a possible attack.  This is especially critical in fringe areas, chokepoints and potential ambush sites.  Specifically, we are looking for unusual interest in our movements (on foot or in a vehicle), anything which slows or stops our movement, any unusual activities by pedestrians or vehicles, and of course, we are looking for any visibly deployed attack elements and/or vehicles. In a nutshell, we are looking for anything which causes us to feel that “something is wrong”.  If anything unusual is observed, we must immediately raise our awareness level, find the problem, mentally prepare to react to the environment, and think of possible options.

Countering the Surprise Factor

In an attack, we cannot be “surprised”!  We must be aware of our environment, looking ahead of us, “anticipating” problems or threats, and mentally preparing for a potential threat by playing the “What If” game (i.e. mentally asking ourselves what we will do if we see a situation developing).  We need to be ready to increase our awareness level if we notice anything unusual.

If we “anticipate” and mentally prepare we will not be surprised and therefore we will not go into “SHOCK” if an attack occurs.  Shock is a condition when the body reacts to great stress, releasing chemicals into the muscles at such a rate that the muscles are overloaded, interfering with their normal functioning, to include possibly freezing up.  This reaction can last three seconds or more.  Shock will dramatically affect our ability to think and to act in an emergency when three seconds may be all the time we have to act and save ourselves.

A historical example of an individual who was caught by surprised was an attack on an Egyptian Major General Raouf Khayrat, Anti-Terrorism Chief in Giza, Egypt on April 9th, 1994.  The Egyptian left his residence at the same time every day and took the same route to work driving down a small side street.  On the day of the attack, the Egyptian continued his time and place predictable pattern and upon entering the small side street he found his way blocked by a vehicle.  Two attackers exited the blocking vehicle and opened fire with automatic weapons.  After firing a large volley of shots into the Egyptian’s vehicle, a motorcycle with two riders drove up from behind the Egyptian’s vehicle.  The passenger on the motorcycle climbed off, took out a pistol and fired several shots at point blank range into the Egyptian’s vehicle then threw a Molotov cocktail bottle onto the Egyptian’s vehicle which burst into flames and burned while the attackers left the area.

A subsequent investigation and autopsy was performed and the results indicated that the Egyptian was not struck by a single bullet but had burnt to death.  The Egyptian had sat in his vehicle while they shot at him with the automatic weapons, while the passenger from the motorcycle had shot at him with the pistol, and while this same passenger threw a Molotov cocktail onto his vehicle.  The Egyptian froze in place and burned to death having taken absolutely no evasive or defensive action.  “Shock” had been the true cause of death in this situation.

Evasive Action

In an ambush situation, the attacker has the following advantages: the element of “surprise”, knowledge of the area/terrain, greater speed and mobility, and they can easily establish total command and control of the ambush site.  By avoiding “Surprise” we can avoid going into shock and have a much better chance to execute specific pre-planned maneuvers in an effort to defeat an ambush.

Our actions must get us off the “X” by any means possible and we also need to be alert for a secondary ambush.  Any efforts which result in our moving off and away from the “X”, increases our survivability.  In an effort to simplify what we need to do the tactically the word we have to remember is “MOVE”! Any movement is better than sitting still and by moving we gain options.

Historically, in assassination type attacks, 85% of these attacks occur in or near the vehicle and the victims have had less than a 10 percent chance of survival if they were caught by surprise on the “X”. As a civilian, we spend a lot of time in our vehicles and as carjacking is a serious criminal concern in most major cities, we can apply the same tactical methods used by protective operations teams to our daily lives to possibly detect, deter, or avoid an ambush.  But if we find ourselves in that worst-case scenario if we can avoid being caught by surprise on the “X” we stand a much better chance of taking some type of action to get us out of the situation – remembering the key word “MOVE”!!

About the Author

Tom Pecora retired from the CIA in 2013 as a GS-15 Security Officer. During his 24 year career, he was extensively involved in protective operations, training, and security activities in low-intensity conflict areas.  Tom conducted protective operations and provided counter-surveillance support in the US and overseas.  He also has taught protective operations to foreign presidential level protection details as well as to USG personnel.

You can contact Tom via LinkedIn


Join the International Security Driver Association (ISDA)

ISDA serves the protective services community.  The ISDA membership is open to all who have an interest in personal protection.

Whether you are exploring a career in executive protection, honing your expertise, or, you are an established security professional, ISDA is your essential resource for continuing education, benchmark research, and online learning programs, all designed to improve your skill set and advance your business.

ISDA membership enables you to:

  • Access benchmark educational, networking, and marketing programs.
  • Connect with your colleagues and peers across the globe via the member directory.
  • Increase your knowledge and marketability through the precedent-setting education center, research, and online learning programs.
  • Be part of a supportive community of like-minded experienced personal protection professionals.
  • Obtain Certification to members who meet the requirements. The corporate community accepts the ISDA Certification process for more than 40 years. ISDA certification provides proof of knowledge and skill.

LEARN MORE ABOUT THE MEMBERSHIP AND JOIN TODAY