Intelligence failures exposed by the LTTE

We reproduce excerpts from the cover story of JANE’S INTELLIGENCE REVIEW - SEPTEMBER 2001 ( Seven Years Ago) issue titled "Intelligence failures exposed by Tamil Tiger airport attack" authored by Fellow, Centre for the Study of Terrorism and Political Violence, Scotland UK, and Author "Sri Lanka’s Ethnic Crisis and National Security."
_______________________________

by Dr. Rohan Gunaratna

(April 07, London, Sri Lanka Guardian) The Tamil Tiger attack on Sri Lanka’s Bandaranaike airport was aviation history’s most destructive terrorist act. A suicide squad of the Liberation Tigers of Tamil Eelam (LTTE) staged an audacious attack on Sri Lanka’s Bandaranaike international airport and the adjoining air force base at Katunayake on 24 July 2001.

In three waves, a highly trained and heavily armed 14-man squad penetrated the 800-acre high security complex and destroyed or damaged 26 commercial and military aircraft. The attack is the biggest terrorist operation so far launched by the LTTE and the most destructive terrorist attack in the history of aviation. The suicide dimension - 14 members targeting 26 aircraft - made the operation cost effective.

The LTTE attack

The LTTE attack exposed the shaky foundations on which the country’s national security structure was founded. It questioned the government’s capacity to develop intelligence, forecast threats, protect its critical infrastructure and prepare appropriate force structures to disrupt LTTE operations in the government-held south. It also symbolised the sharp decline in the capability of the Directorate of Internal Intelligence (DII), responsible for anti-terrorist (protective) intelligence as well as counterterrorist (offensive) intelligence.

The LTTE attack revealed the weakness of strategic and tactical intelligence collection, analysis, dissemination and review and second, force protection. As there was no prioritisation of intelligence gathering, projection and sharing to erode the LTTE’s network, the LTTE was allowed to build up an extensive intelligence infrastructure in the south over a year. This infrastructure hosted the suicide squad and its kit. Furthermore, the eight months of peace in the south lulled the government forces deployed there into complacency. A warning, three weeks prior to the attack from a district intelligence bureau located north of the airport, that the airport was likely to be attacked was ignored.

Without tactical intelligence - the time, modus operandi and location of the attack - it is nearly impossible to prevent a suicide attack against a civilian or military target. The Sri Lankan government lacked full-time intelligence professionals dedicated and committed to penetrating the LTTE organisation in the north and clandestine cells in the south. To develop sound, timely and usable intelligence, the government needs to depoliticise and professionalise the intelligence organisation and appoint a full-time head. The DII Director General Cyril Herath, a political appointee, has come under increasing criticism for continuing to hold on to a second non-intelligence post as chairman of the National Savings Bank.

Prior to the attack it had become evident that the LTTE was planning to target both naval and air assets. As there is no land route to the Jaffna peninsula, it was clear that government forces were dependent on the air bridge and sea route to the northern frontlines. Furthermore, the Kfirs and MiGs of the Sri Lankan Air Force provided much needed fire support for frontline troops increasingly finding it difficult to engage the LTTE. These aircraft could be launched only from Katunayake air base and not from the other bases at Anuradhapura, Hingurakgoda, Trincomalee, Vavuniya, Jaffna and Ratmalana. Therefore, Katunayake had become a crucial target for the LTTE.

The LTTE has a history of spectacular attacks on civil and military aviation. The lack of continuity in the security and intelligence community also adversely affected the institutional memory essential to periodically alert threat trends and patterns to civil and military aviation assets.

Responsibility with airport and airbase security

Although the prime responsibility rests with the security and intelligence community, the secondary responsibility rests with airport and airbase security. Despite Katunayake housing 5,000-8,000 airmen and their families and the largest concentration of its civilian and military air assets, both the security of the complex and the perimeter was appalling. In addition to the glaring failure to police the fence as a means of access control, there were no dogs and electric/electronic fencing. Thick undergrowth facilitated both LTTE reconnaissance and infiltration at the entrance to the complex as well as to the V-area. It appears that airmen and the officers responsible for security were not sufficiently motivated. To build confidence and prepare ground troops on sentry duty, there was no workable contingency plan, no prudent rehearsals, and no useful mock attacks. The fact that the military response was weak even an hour after the fighting began, demonstrated that there was no effective co-ordination between airbase and airport security. Security was not periodically reviewed and those responsible for security were unsupervised.

In addition to the initial reporting by civilians, the LTTE squad was spotted twice by airmen in the run up to the attack. At 1.15 am on the day of the attack, a sergeant returning from the north on home leave observed the squad inside the base and informed a corporal on duty. The corporal failed to inform his superior officer. Half an hour later, a sergeant at the fixed-wing squadron guard point observed the squad and reported an ambush party’s presence to the operations room. Although no air force ambush party was to take position near the jet squadron, the operations room confirmed that it was one of its own ambush parties. In sum, security alertness as well as security awareness was low. The security and intelligence community failed to formally and informally educate all ranks on the LTTE’s modus operandi.

The attack also exposed the lack of a counterintelligence understanding and capability within government. Past LTTE operations in the south demonstrated that LTTE intelligence members are masters in agent spotting, recruitment, running and termination. Prior to the attack, LTTE intelligence members are likely to have entered the airport and airbase on reconnaissance several times with the aid of an agent or two. Although there are Tamil airmen who work in the signals unit at Katunayake, the LTTE has a reasonably high capacity for recruiting Sinhalese airmen. In fact, the LTTE pattern of agent recruitment suggests that it prefers to recruit a non-Tamil in order to give better cover to its agent. Both the LTTE Directorate of Military Intelligence (LTTEMI) and Tiger Organisation of Security Intelligence Service (TOSIS) run agents into the Sri Lankan security forces and to the intelligence community. One Sinhalese warrant officer (WO) working at the air force base at Ratmalana in the south in the mid-1990s even recruited other agents - including a soldier working at the security forces HQ at Palaly in the north - for the LTTE. The WO provided real-time intelligence to the LTTE on military aircraft movement from Ratmalana as well as other critical information that affected air force security. When the WO agent’s handler failed to contact him, he phoned an LTTE office in Europe and requested an LTTE activist to ask LTTE HQ in Sri Lanka to contact him. In sum, the LTTE can recruit Sri Lankans irrespective of community, or as the composition of the LTTE’s UK and other offices indicate, nationality. Although the LTTE has threatened and blackmailed potential agents, it appears that money is the most effective incentive to recruit and sustain an LTTE agent.

If Sri Lanka is to prevent a Katunayake-type attack in the future, among the many aspects it will have to consider is counterintelligence. Unfortunately, the DII has employed assets that can be used for counterintelligence to monitor political opposition and personal rivals. Misuse of limited technical and other assets from telephone tapping to physical surveillance has not only wasted technical resources but also diverted limited manpower to focus on activities that have no bearing on national security.

Ironically, after the attack, President Chandrika Kumaratunge thanked the security forces. It demonstrated the government’s lack of understanding of security and, more importantly, the steps that should be taken to prevent the recurrence of a similar attack elsewhere in the country.

Implications of the attack

The LTTE attack was intended to cripple Sri Lanka’s economy by affecting tourism and foreign investment and to degrade and destroy the air capability of the Sri Lankan military. Although no tourists were injured, the attack has already reduced hotel occupancy to about 10% of its expected level. The attack destroyed a third of Sri Lanka’s commercial fleet and a quarter of the the Sri Lankan Air Force’s fixed-wing capability. The latter is likely to affect the air force’s capability to destroy LTTE targets, provide ground fire support for frontline troops, airlift troops and supplies, and evacuate security forces casualties.

Within a week of the attack, Sri Lankan Airlines grounded 300 cabin crew. In effect, they are being pushed for retirement. On 31 July, under the voluntary retirement scheme, 600 employees who had opted to leave were asked to stay at home. On 1 August, Sri Lankan Airlines issued a circular providing the option of retirement to anyone except the Sri Lankan technical crew and pilots. Although the employment of 120 Sri Lankan pilots is secured, the 90 foreign pilots are likely to be affected. Twenty-eight foreign pilots, mostly Filipinos and Bulgarians, are likely to be given three months notice and three months pay. Furthermore, Sri Lankan Airlines closed down several of its offices overseas and drastically reduced the number of international flights.

Sri Lankan Airlines, 40% owned by Emirates Airlines, suffered US$350 million in losses. The UK underwriters paid compensation for the passenger aircraft damaged and destroyed. The rise in insurance premiums will lead to an increase in airfares to Sri Lanka. As of today, a number of airlines have stopped flying and a number of ships are avoiding Sri Lanka. As military aircraft are not insured, Sri Lankan taxpayers will have to bear the cost of their loss. Both Sri Lankan Airlines and the air force will have to wait at least a year to replenish their losses. The losses leave Sri Lanka’s No 10 jet squadron with 10 Kfirs and the No 5 squadron with five MiG-27s and one MiG trainer. The two Mi-17s destroyed were among the No 9 attack squadron’s 18 helicopter gunships equipped with electronic equipment to mount night operations. In sum, the LTTE attack achieved its multiple objectives.

Government response

The response of the Sri Lankan state to the LTTE attack has been cosmetic. As the runaway was not damaged, at 3.00 pm the same day the air force took off on bombing missions. Two Sri Lanka Air Force Kfirs and two MiG-27 ‘Floggers’ bombed LTTE ground targets in Vishwamadhu, 17km southeast of Kilinochchi and in Trincomalee. The government has appointed two committees of inquiry. In the past, such committees - appointed with a view to pacifying public opinion - have been a waste of time and, more importantly, resources. The committees likely recommendation of the dismissal of the base commander and a few airmen will have no immediate, mid or long-term impact on improving security.

Since the ruling Peoples Alliance (PA) came to office in 1995, its tendency to make political appointments and promotions in pursuit of its aim to gain political control of the national security organisation has undermined Sri Lanka’s military, security and intelligence capabilities. Officials wanting to curry favour with PA politicians branded many of the UK and Israeli-trained frontline intelligence professionals as supporters of the previous United National Party. As a result, 60% of senior, 40% of middle and 20% of junior officers of the National Intelligence Bureau, the forerunner of the DII, either retired or were sent on uniformed postings. As a result of the purge, the government lost ‘intelligence continuity’ and a number of LTTE specialists. The changes were presided over by the former elections commissioner Chandrananda de Silva, another political appointee, now the secretary for defence.

In contrast to the Sri Lankan government’s failure to maintain an effective intelligence operation, the LTTE has invested 40% of its war budget in developing and managing both a civilian and a military intelligence organisation. All LTTE attacks are either intelligence-driven or intelligence-led. The LTTE has been able to do so because it has one of the most successful agent-handling programmes. Past detections indicate that the LTTE has live agents within the four armed services and in two of the three intelligence directorates. While the LTTE has meticulously studied the successes and failures of every operation, the Sri Lankan security forces and the intelligence community have continued to repeat the same mistakes time and again. As long as the government is unwilling to revamp and restructure the national security organisation, the LTTE will be free to step up guerrilla operations in the north and terrorist operations in the south.
- Sri Lanka Guardian