By: John Milton Peterson, Contributing Analyst
WHAT IS KNOWN:
A large explosion occurred at approximately 6:30am CST on Christmas morning, Friday, December 25th, 2020 outside of 166 2nd Avenue North and across from the AT&T facility at 185 2nd Avenue North in downtown Nashville, Tennessee. It was preceded by a verbal warning via some type of public address system, purportedly coming from a recreational vehicle (RV) which had arrived at the scene at 1:22am Police initially came to the scene when there were reports of gunshots at this location at 5:30am, hearing the warning, and subsequently evacuating citizens from the area. Then a very large explosion occurred. This damaged approximately 40 businesses and affected infrastructure which included a portion of the AT&T mobile phone and internet service both locally and regionally as well as interruptions of flights at the nearby international airport. As of this writing, there are no confirmed or named fatalities or persons missing. But, three persons were injured in the blast. The law enforcement agencies handling the crime scene state that this was an intentional act and linked to the suspicious and now destroyed RV. The FBI says that they are conducting investigations against at least one person of interest, to include conducting a search warrant on a residence possibly belonging to that person in the Nashville neighborhood of Antioch. A section of this portion of Nashville has been blocked off and a curfew implemented. A massive recovery effort is underway in downtown Nashville as attempts to restore power, search for bodies, and get the damaged infrastructure back online continue. The Governor of Tennessee has asked for federal assistance for the damaged economic district directly from President Trump. At the time of this writing, no arrests have been made and no fatalities have been reported. The FBI, ATF, and Metropolitan Nashville Police Department are seeking information about the suspicious RV and anyone who may know something about the explosion.
ANALYSIS
What was this event? – Was this a terrorist attack?
Many of us with background in this professional realm believe that this was a domestic terrorist attack that successfully detonated a massive VBIED – Vehicle Borne Improvised Explosive Device. It meets all or most of the criteria for a terrorist attack, although the specific motive and target have not yet been confirmed nor the perpetrators identified. The time and place clearly point to it being intentional and a terrorist attack. (more on that below). Contrary to amateur speculation on the internet, this was not a missile attack or some other type of explosive event, such as a gas leak or accident. Initial bomb damage assessments (BDA) and crater analysis all point to this being a VBIED. Whether the method of initiation of the bomb was command detonated, victim operated (booby-trapped), or detonated using a timer or time delay fuse all remain to be seen. Judging by the effects on the nearby buildings, and a series of very obvious “intel indicators,” this very much so was an intentional, pre-planned event and had a very specific motive. The timing, location, and type of blast all point to this being a terrorist attack. More of this is discussed below.
How we will eventually know all of this, and more definitive results pertaining to what is included in this analysis presented here, will come from the now two day old yet rapidly expanding investigation by the FBI, ATF, and Metropolitan Nashville Police Department. The FBI and DOJ have a formidable capability for getting to the bottom of exactly this type of explosion. They have an enormous laboratory at the Quantico Marine Corps base near Washington, D.C. and other capabilities that would astound most. I got an inside look at all of this serving firstly as a Special Forces soldier and then contractor in this war that we are in now, at one point deeply involved in predicting the terrorist’s next moves and targeting them for capture or elimination.
This particular Christmas Day bombing bears some similarities to the bombings on February 26th, 1993 of the World Trade Center in New York City, and on April 19th, 1995 of the federal Alfred P. Murrah Federal Building in Oklahoma City. The DOJ got convictions in both cases.
In many other situations, the FBI has conducted sting operations or other proactive measures to thwart attempts to develop IEDs or acquire more sophisticated weapons and conduct domestic terrorist attacks. Federal law enforcement learned a lot from these and other cases involving IEDs. The very expensive and prolonged searches for the domestic terrorist “Unabomber” Theodore John “Ted” Kaczynski (nearly 18 years) and Eric Rudolph (nearly 7 years) delivered many lessons learned and caused major changes in how they investigated these cases. Since these, and 9/11, they have gotten very, very good at this. Terrorists tend to copy and improve upon the work of other terrorists, and creatures of habit. The FBI and U.S. Intelligence Community know this, employ massive databases that catalogue and track every bit of it, thereby now being able to connect the dots. They can conduct rapid, granular searches, determining both the forensic grade details of the method of attack as well as the perpetrator in less and less time than ever before.
Bolstering this, and in the most exponential of ways, has been the experience of our military in the Global War On Terrorism (GWOT). On multiple contingents and involving the deployment of over a million troops, one of the three most common methods of attack, and most casualty producing, against our troops has been that of the IED. This advancement in countering IEDs led to the military’s establishment of a massive, highly funded organization to focus on this threat, the Joint IED Defeat Organization, or JIEDDO. Billions of dollars of contracts were awarded via JIEDDO as well as DIA and other entities focused on the defensive and offensive measures against IEDs and those that fund, build, and employ them against us. This has caused one of the most dramatic series of changes ever seen in how our military equips and operates, to include its vehicles, protective items, intelligence processes, and so much more.
Nearly every type of completed and planned terrorist attack on American soil, especially involving explosives, has been terrorist techniques, tactics, & procedures (TTPs) pioneered by and/or that are in widespread use by foreign terrorists. This is especially the case with IEDs. Even the co-conspirators of the Oklahoma City Bombing had the advice of a foreign terrorist organization, the Abu Sayyaf Group (ASG, a designated FTO very active in the Philippines at the time). The 1993 WTC bombing was the work of foreign and foreign connected terrorists. And, was only partially successful as it did not work as intended. Nearly every element of the set of bombings on April 15th, 2013 at the finish line area of the Boston Marathon was an IED type and method of initiation developed and perfected overseas. In fact, these were among the exact same type that myself and other troops faced in Afghanistan in the first two years of the war. Although much of the Weapons Technical Information (WTI) and “how-to” of IED making originated in the USA, most of it is perfect overseas by our adversaries, to include the Islamic Republic of Iran. And to a rare art form at that. These foreign terrorist organizations (FTO) and malign actors spread these IED WTI and TTPs far and wide. This gets into the hands of persons based in the USA. This is why we are seeing highly successful bombings. The question is who did it and why did they do it.
Who did it and Why?
This bombing most probably was a terrorist attack based upon its method of attack and specific time and place chosen.
However, there are some very peculiar aspects to this event which are not the type modus operandi (M.O.) of international terrorists. At first glance, the choice of the morning of one of the two most significant Christian holidays would lead some to believe that this was the work of foreign, non-Christian terrorists, in particular, islamists / jihadists. And yes, they have for decades very often chosen dates and holidays either of significant to them or to their intended victims. However, I do not believe that this was the work of foreign terrorists. There are a number of reasons for this:
1. Primarily because their M.O. is to seek mass terror, most often by producing the most number of casualties possible in the target population and/or destroying a high value target. Although investigators stated that they have found human tissue remains at the crime scene, there has been no official determination of casualties at the scene yet, to include the perpetrators themselves.
2. The perpetrators issued a warning and picked a time and place that would be completely absent of human activity, in what is becoming obvious was an effort to avoid human casualties. Foreign terrorists almost never do that. In particular, islamists / jihadists. The perpetrators focused their efforts on a time, place, method, and target that was very specific and not at all what an FTO sponsored or foreign inspired, remotely radicalized terrorist would seek to do. Americans almost never specifically set out to target and kill large number of Americans. There have been a few attempts over the years, some successful. But, mass casualty events are almost always the work of foreign national or foreign inspired terrorists, or at least with their assistance. Of course, there are exceptions. In some of those cases, it served the purposes of foreign terrorists to aid domestic terrorists who had a separate agenda.
3. The perpetrators may have chosen a target that is not considered of high value to foreign terrorists. If they had intended to bomb this important cultural hub for live music, eateries, and bars, they would have done so when it was lively and packed with people. If they had intended to bomb the infrastructure present at the site, they would have both picked a more high value target and done a better job emplacing the explosives.
This and other clues all lead me to believe that the nature and motive of this attack was at least partially symbolic, perhaps to send a message. One of those clues lies in the location of the VBIED and its positioning.
Therefore, the intent and target of the attack could have been any of the following:
1. A disgruntled former employee at one of the local establishments, or person affected by the economic losses in the pandemic, seeking to inflict damage to an important cultural and economic district in Nashville. I believe that this has a low probability.
2. Someone intending to attack the critical infrastructure present in the very large, multistory building located directly in front of the VBIED, belonging to AT&T and home to a major center for internet and server based digital communications in the region, to include a consideration portion of the phone network. This explosion disrupted or knocked out ATT internet and mobile service both in Nashville and extending outwards to several other states. The president of technology at T-Mobile, stated on Saturday “We continue to see service interruptions in these areas following yesterday’s explosion. Restoration efforts continue around the clock & we will keep you updated on progress,” naming service disruptions affecting Louisville, Nashville, Knoxville, Birmingham and Atlanta. It also affected flights in the area, temporarily grounding flights at nearby Nashville International Airport. In my monitoring the twitter accounts and websites of these various emergency services agencies in and around Nashville, they continue to have problems getting their services back in proper operation. Portable cell sites had to be brought in to temporarily restore coverage. Therefore, the fact that such an important piece of local and regional infrastructure as the AT&T building cannot be ruled out as being the target of the attack. So, if the AT&T building was the target, any of these motives could have existed:
a. An attempt to damage our critical infrastructure, either for some yet to be known purpose, or to send a message of sorts, as a “sample” of further and continued attacks. Federal law enforcement must always assume that there will be follow-on attacks and a nexus of continued terrorism by an active cell or network until that is ruled out.
b. An ideological motivation that involves the AT&T building, to include possibly the conspiracies involving the developing 5G network. There are some absolutely preposterous theories going on regarding this 5G network, their connection to the pandemic, and more. Much of it is the mind-numbing, mindless “tin foil hat” conspiracy theory nonsense that spreads among intellectually lazy and amateur night folks on the internet. Many of these persons are either mentally ill or driven to the point of delusion and militancy by the fiction spread online. Periodically, the influence of these result in mass shootings, workplace violence, and other terroristic events. Additionally, there is increasing ire and animus towards the various “Big Tech” companies by millions of Americans, to include for their role in election interference, censorship, deplatforming, and a massive destabilization campaign against the President for the past four years. All of this flows through the primary internet service providers (ISPs) and mobile & internet service companies such as AT&T.
c. Something connected to our strife over the 2020 General Election. In less than ten days from the explosion is to be the final counting of the Electoral College votes by our legislature. It may be the most contentious in history. Some of the rhetoric online is concerning. Anyone seeing the contentious and volatile rhetoric on social media and in chat rooms would easily conclude that there is a dramatic uptick the strife and banter over this. To include talk of a “civil war.” After a few hours of this, I have observed very concerning discussions by left wing, libertarian and anarchist, and right-wing account holders. This is not isolated to any one political party or faction. Luckily, our federal counterterrorism capabilities monitor and investigate articulated threats and any nexus to conduct such. They are constantly on the watch both domestically and overseas. Yet there is cause concern, especially when it comes to entities which have clearly demonstrated in the recent past their propensity to act on their threats.
In particular, we have suffered a portion of this year seeing billions of dollars of damage and some casualties caused by left wing militant groups who conducted criminal rioting, domestic terrorism, and insurrection. These were highly funded to the tune of hundreds of millions of dollars and coordinated nationwide. Some of this funding was from foreign sources. Some of the methods used showed telltale signs of the same TTPs of foreign militant and terrorist groups who conduct insurrection and insurgencies. These organized rioters and looters were originally preparing for an undesirable result in the General Election later in the year, but activated and launched much earlier due to the events concerning police use of force and purported racial injustice. This bombing was in the middle of a historic legal challenge to the General Election, and days away from both the final certification of the election and court cases to be filed by the President and his campaign. Could this bombing have been some kind of warning? The possibility that the explosion was somehow connected to this cannot be ruled out yet.
3. An elaborate suicide – the clear attempt to cause an evacuation of the area of bystanders, the choice of time of day and a holiday where few if any people would be around, the report of human remains at the scene, and the probability that the explosion could have been initiated by that person or persons, would lead me to not rule out the possibility of suicide. Particularly because the AT&T building was unoccupied and the time & place were to be a ghost town. This could have been combined with any of the motives and targets above. No pun intended, but this could have been a suicide by someone “going out with a bang.” We may learn more about this possible motive from what the investigation unearths. Those committing suicide and those conducting ideologically based terrorist often leave a statement or message somewhere to be found.
Therefore, I believe that there is a likelihood that the motive of this terrorist attack was to send a message. If someone was trying to send a message regarding this is one way that it manifests. Twenty-five years ago someone named Timothy McVeigh did exactly that thing. And, using nearly the exact same method of attack. We may soon know what, if any message or warning there was.
What was different about this terrorist attack from others?
Whether this was an infrastructure attack, attack on a famous cultural district, a more general attack on our heartland, or any of the aforementioned ideological justifications, we cannot rule out either the symbolism or pinpoint nature of this location, date, and method. What is different about this domestic terrorist attack is that it:
1. Appears to have sought to avoid loss of life.
2. Despite having the hallmarks of a VBIED attack, there were some flaws in the conduct of the attack for which is did not achieve the full potential or effects intended.
3. It did not choose a particularly high value target or inflict mass terror. Unless this was a “sample” to send some type of message and warning of possible future attacks, then this attack falls short as compared to the majority of VBIEDs on record.
Judging by the considerable and plainly visible rooftop air conditioning systems and power that goes into the AT&T building, this mostly windowless building houses many servers, cabling, and electronics. Complete destruction of this facility could cause even more serious disruption in a wide area and over several states, far more than what occurred. I observed that this particular building did not have any barriers or other physical security enhancements other than very simple key locked doors and security cameras.
Although there was damage and interruption of service, this building is still standing. Crews are attempting to reestablish power and function to this facility. With the right type of explosive and knowledge of how and where to emplace it, such a building can be taken out. This particular VBIED did not produce the maximum potential yield that it could have. Despite what appears to be serious damage to the buildings in close proximity to the blast, most of the explosion vented up and down the street and straight up in the air. Explosions go the path of least resistance. Unless they are directed in such a way to yield maximum physical destruction. If this VBIED had been in that location during a typical, pre-pandemic night in that district, the casualty count would have been immense. I examined photos from right before the blast and then a variety of older street view imagery, and determined that this RV could have either gotten onto the sidewalk in front of the AT&T building. Better yet, behind the AT&T building is a large, open, and empty parking lot directly behind which almost any sized vehicle could drive directly up to the side of unhindered. Either the perpetrator did not intend to get the maximum effect of their explosives or did not know how to. This is part of what makes me suspect that suicide by the perpetrator was one of the objectives of this terrorist attack. That would make this what we call an SVBIED – Suicide Vehicle Borne Improvised Explosive Device.
In previous bombings, larger trucks were used. Some were rental and delivery trucks. Since these have been used in many bombings as well as by terrorists to run over pedestrians, law enforcement knows to look for them. An American made recreational vehicle (RV) is certainly less suspicious. More of these are becoming commonplace, particularly as more Americans are homeless due to the economic situation, with RVs being sighted in increasing manner in our cities. A self-propelled RV might have the capacity for the weight of a large IED. If the interior were stripped out, even more so. In many cases, bomb makers had to reinforce the suspensions of their trucks or cars as the weight of the explosives cause the vehicle to look abnormally overloaded. Law enforcement are taught to look for this as an indicator. We may soon know if this RV was modified to hold the additional weight of a large main charge of explosives. We will also know the material used in the main charge and its explosive yield. They will also know how the bomb was built, with what, and how it was initiated. The FBI and other agencies have this type of forensics down to a science.
Whether any of what has been posited here comes to be true, here is something that should be of concern – this bomb worked on the first try. Why this is a concern – They usually don’t. In the world of IED-making there are a large number of misfires and mishaps. Many bombs that our troops faced in the war either failed to detonate (misfire), or “low-ordered” (partially detonated or did not detonate to its maximum explosive yield). Since improvised/homemade explosives have such a high failure rate and certainly not the reliability of military or commercial grade explosives, the IED maker who wants to succeed will often conduct “test shots,” building and improving their IED design by testing it to ensure that it will go off when intended. Therefore, the maker of this particular bomb, a VBIED, most likely conducted tests to ensure that. They must do so in an undetected manner. They had to have used a remote location somewhere to conduct their tests. This also means that there could be additional explosive components yet to be found by law enforcement. This also could mean that there might be others who either were directly involved, or in some manner facilitated or at least knew that something was afoot. This brings me to the next portion of this analysis.
Was attack the work of a terrorist cell or a solo “lone wolf” terrorist?
Almost no terrorist attacks of any major scale are solo in nature. For most successful terrorist attacks, there is a cell of several operatives and a network of many more facilitators and enablers. A ratio of 5 to 20 such support personnel for a single terrorist would not be uncommon. We found in Afghanistan that a single suicide bomber might have a few dozen other terrorists and facilitators involved in the entire operation to get them recruited, trained, equipped, and emplaced at their target. For bombs they themselves, this requires a sophisticated capability for the WTI and logistical support that goes into it. And cost. So, a terrorist must be funded, hidden, given a place to sleep, eat, meet, plan, train, build explosives or prepare weapons, and be able to communicate. Some are assigned to conduct pre-attack surveillance of the target. This often occurs for a period of 4 to 12 weeks before an attack, to narrow down the target, learn the patterns of life of people and vehicles in the area, and a list of other considerations.
The terrorist must be infiltrated to the attack site. In this case, if the RV and VBIED did in fact come from the local neighborhood that the FBI just raided in connection with the person of interest, then this ten-mile route would need to be covered without impediment or detection.
It is very, very likely that this particular attacker had visited the target site in advance. There are some unconfirmed reports of the RV having been seen in that area in the recent past.
Whatever the case, it is possible for a very determined individual to plan such an attack from beginning to end, and without any assistance of any kind. We have in fact seen lone sniper and lone active shooter attacks in this country on multiple occasions since the 1960s. In doing so alone, many of the indicators and chatter picked up by government surveillance would have not existed and thusly avoided detection. The FBI and DOJ have admitted of years, to include in Congressional testimony, that lone wolf and small cell terrorists are the most elusive and often difficult or impossible to detect and stop before they act.
However, if this was an ideologically motivated attack by some type of extremist, it is highly likely that this perpetrator was connected to other extremists, as many of them do. They rely on each other for information, assistance with logistics, and even encouragement. They cannot help themselves but confide in others.
Nearly every planned domestic terrorist attack that has been thwarted by the FBI was against a small cell operating domestically. In most all cases, they had vulnerabilities in their operational security (OPSEC) and communications, flaws in their planning and approach, for which federal authorities were able to exploit and act upon. No matter how hard they try or how cunning that they think that they are, many of these extremists sew the seeds of their own disaster, leaving clues and forensic evidence that are easily found by counterterrorism personnel. That capability, as I have seen firsthand, is quite formidable in the post 9/11 era.
Thusly, the FBI will be looking for a network, any facilitators, and to determine or rule out the possibility that there could be follow-on attacks.
What could be coming next?
When such an investigation is underway, some impressive and complex resources are leveraged. The mentioned FBI lab at Quantico, fusion centers, and other assets are hard at work in a worldwide dragnet both to drill down on the localized aspects of this bombing while trying to either confirm or deny an international nexus of terrorism and the possibility of follow-on attacks by the same cell of terrorists, if they do exist. They are very likely in a race at this moment to run this down.
This also includes the large, well-funded National Counterterrorism Center (NCTC). It is the focal point of all intelligence and early warning for terrorist related intelligence and knowledge, a veritable nerve center on the watch twenty-four hours a day. This is where they “connect the dots” and issue warnings throughout government and law enforcement. On the ground, the FBI has specially trained & equipped teams that conduct these investigations. Others will conduct a series of raids and warrants, following up on the combination of evidence from the blast crater, the RV, and other mentioned digital & forensic evidence. This is the real-world version of CSI, but much much better. While this is going on, the intelligence centers will be analyzing and feeding back to them information. In some cases, leading them to their next location to conduct a warrant service on. In some cases, leading them to conduct surveillance or interviews. At this moment, all of the above are either going on or being planned. Warrants are being drawn up and approval being sought for them. Special Operations (SWAT) teams and task forces are deployed to assist in some of these warrants, especially for a higher risk suspect or location.
Included in their search will be still and video footage from all available CCTV, security cameras, ATM machines, traffic cameras, and other systems in the vicinity of the explosion and working outwards. Connected to other investigative tools, they will look for evidence of the suspects conducting pre-attack surveillance and other activities (such as “casing” and “drive-bys” and “dry runs”), anyone that they may have come into contact with, and much more. They will compare physical and even biometric evidence from the crime scene, to include from the bomb and any bodies, to the same in other vehicles, workplaces, and residences that they may have been recently. These can become veritable jackpots for investigators, as even an explosion of that magnitude does not destroy everything. Our personnel were able to lift fingerprints of insurgents off of fired and abandoned rocket launchers, the tape used to make a bomb, or residue of explosives on the fly of their pants and shoelaces. We once traced the origin of where the bombers got their materials based upon some unique yet carelessly discarded packaging for string that one of the components came from in a nearby country.
For example, a locker at a gym regularly used, bicycle, dishes in a sink, bottoms of shoes, and contents of a garage can yield significant evidence to connect the dots.
When it comes to investigating bombings, our federal law enforcement has this down to a science.
What I believe will surface will be some type of death note, message, or other communication by the perpetrator(s) about their motive. This will possibly be uncovered via exploitation and computer & digital forensics examinations of their personal electronics and accounts connected to them. This includes possibly internet search history to prepare for blast and acquisitions of materials to learn how to develop the type of IED used. Or, the perpetrator could have timed a release of such information.
Initial Assessment - In consideration of the above, and breaking information from the crime scene, my initial assessment is that this was certainly a domestic terrorist attack, though very possibly not the work of a terrorist network nor is there a nexus seeking to conduct similar attacks and not the work of foreign nationals. This looks to be the work of either a lone actor or a small cell, a single target that was attacked, and for a very specific ideological rationale. This was planned far in advance and implemented some of the TTPs used in other terrorist attacks of this kind.
However, in connection with political events and increasing strike, the possibility of a network and follow-on attacks cannot yet be ruled out. Particularly because of the current political environment and timing of events, the vulnerability of our country considering an election in question and upcoming inauguration, and a list of other considerations which our federal counterterrorism, counterintelligence, and law enforcement officials are toiling over as we speak.
For Reference:
https://www.dni.gov/index.php/nctc-home
(an impressive website for research and those interested on all manner of terrorism information)
John Milton Peterson is a contributing author/analyst at the Gold Institute for International Strategy.
Mr. Peterson is a combat veteran of the U.S. Army Special Forces (a.k.a. the “Green Berets”) with multiple deployments to the Middle East and Asia. His post 9/11 experience includes a series of government positions and contracts in support of national security and the Global War On Terrorism. These include being recruited to a position at the new U.S. Department of Homeland Security after 9/11, followed by contracts for the Department of Defense and Intelligence Community focused on counterterrorism, intelligence, special operations, and training of personnel in these professions.
During this period, he worked on more than one assignment where he was deployed overseas assigned to collect and analyze intelligence on terrorists, including specialized training and assignments focused on targeting IED networks. In another, he taught special operations troops intelligence techniques & tactics for targeting of terrorist networks. He has also taken part in as a role player and been a developer of elaborate counterterrorism training scenarios for the military, to include involving IEDs and WMD.
For the past 23 years, he has been serving on the Advisory Board of the International Association of Counterterrorism & Security Professionals (IACSP), serving as their Special Projects Director, contributing to their long running journal many times, and representing the organization in presenting about terrorism at national level conferences as well as instructional invites to government.
His professional memberships include such natsec related organizations as the Association of Former Intelligence Officers, AFCEA, National Tactical Officers Association, OSS Society, Global SOF Foundation, Nine Lives Associates, National Press Club, and is a life member of the IACSP, AFCEA, and five veterans service organizations.
