Over 100 years ago, during the summer of 1919, dozens of members of that year’s West Point graduating class were sent to Europe to tour World War I battlefields. They walked on ground left deeply scarred by the conflict that had ended just months before, and met people left equally scarred by the war’s massive and bitter toll. They traveled across the Atlantic because no amount of classroom study can replicate the experience of such firsthand study of a recent conflict.
In the same spirit, the Modern War Institute at the U.S. Military Academy at West Point, New York, conducts research trips each summer during which cadets and faculty study recent conflict. This past summer, we led a trip to India to study the 2008 terrorist attacks in Mumbai and its counterinsurgency in Kashmir. Like those future Army leaders in Europe a century ago, we walked through the sites of those attacks and spoke to people who directly experienced them. What we learned can help shape how the Army thinks about modern conflict.
Sudden Attack
On Nov. 26, 2008, 10 Pakistan-based terrorists simultaneously attacked and laid siege to multiple sites across Mumbai—a megacity of about 18 million people—bringing the city to a standstill for more than two days. The attack was meant to overwhelm both the city and its security forces, creating a sense that the entire city was under assault. It took Indian security forces over 60 hours to end the attack. Often referred to as India’s 9/11, the attacks were planned and orchestrated with what seemed to be impressive military precision—so much so that the world was shocked by the attackers’ tactics, their brutality, and the attacks’ exposure of the vulnerabilities of large urban areas to state-sponsored terrorism.
The terrorists infiltrated Mumbai from the sea by blending into the megacity’s littoral flows using a hijacked Indian fishing boat to get near the coast, then transferring into small inflatable boats, brightly colored to look like the colorful fishing boats common along the shores of the slums around the city, where they landed in two groups. The terrorists dressed in Western clothes and carried backpacks similar to those of low-budget tourists.
Multiple Targets
Once on land, the 10 attackers split further, into four groups, and walked or took taxis to their objectives. There were five primary objectives around the city: a cafe frequented by tourists, the city’s main train station, a Jewish community center and two luxury hotels. Once the terrorists reached their objectives, they immediately attacked anyone in sight with AK-47 rifles, grenades and other weapons. Despite the geographic separation of the targeted sites around the city, they were struck nearly simultaneously. The two hotels and community center were besieged for up to 60 hours. The attackers killed approximately 174 civilians before Indian security forces finally subdued them, capturing one and killing the other nine.
Over multiple days, our West Point research team walked the streets and sites of the city—which the terrorists had turned into a battlefield. We followed the teams’ routes from their amphibious landings to their individual objectives. We studied the physical aspects of each site as well as their significance to the city and the reasons the terrorists targeted them. We spoke to Indian civilians who were present during the attacks, as well as to security experts to understand how India has modified its security practices since the attacks.
Size and Complexity
There are many lessons to be learned from studying the Mumbai attacks. The events, for example, illuminate the roles of proxies in hybrid warfare. Among the most contemporarily relevant lessons relate to the challenges of operating in a megacity.
While the U.S. military has operated in urban terrain, it has never conducted large-scale offensive or defensive operations in a megacity. Most definitions of megacities are based on a population size of more than 10 million. But it is these cities’ complexity more than their sheer size that makes them such challenging environments. Some believe the U.S. Army should not try to prepare for operations in megacities simply because doing so isn’t possible—the scale and complexity are beyond the Army’s capabilities. Others argue that the Army must be capable of operating in megacities, but it is unprepared.
During our research in Mumbai, we were witness to what urban specialists have long counseled: that major urban areas are complex, adaptive systems with massive flows of people, resources and requirements woven together by intricate webs of social, economic and governance strands down to the neighborhood level. Under these conditions, there are constant tensions between the need for security and allowing the flows of the city to work unhindered. Striking a balance is consequently difficult.
Flow of the City
For example, under normal operating conditions, over 7 million passengers pass each day through the Mumbai central train station that was attacked. Drastic overt security measures that disrupt this flow would create significant ripples throughout the city. While the station has metal detectors at all entrances, they never seem to be used—and if they are, it is extremely unlikely they could come close to handling 7 million people.
It is important for security professionals to understand these tensions and balance the competing demands of security and the city’s natural flows. In a counterinsurgency context, there will be times when heightened security measures, and even martial law, are required, but these steps can’t be employed indefinitely or the city will grind to a halt—and because large cities are economic and social hubs, with impacts felt well beyond them.
A similar challenge exists along Mumbai’s coast. It is difficult to secure Mumbai’s 90-mile coastline given the thousands of fishing boats that set out daily. While India made modest measures to increase its coast guard and is working toward universal boat registration, we couldn’t find anyone who believed these measures could fully stop terrorists from entering the city from the coast. Instead, most individuals we talked to believe the best way to prevent illegal entry from the coast is to simply embed more police in the fishing slums.
While Mumbai may have 18 million people who don’t know one another, the city is made up of smaller neighborhoods—many of them slums—and these micro-communities can identify someone who doesn’t belong. This is a lesson for any military force operating in a megacity, where a company commander, for example, could make use of a sort of “community watch” and take advantage of the same characteristics local law enforcement use in small towns. Doing so can limit a neighborhood’s vulnerability without requiring substantial resources.
Getting Local Support
We also saw the tension that private organizations, like the two luxury hotels targeted in the attacks, must grapple with in balancing customer comfort and hospitality with protective measures recommended by security forces. The hotels are profit-oriented and having guests killed is, of course, bad for business, so they don’t depend on the state to provide necessary security. The hotels significantly increased their private security measures following the attack. In fact, if we congregated as a group anywhere in a hotel, within minutes, a hotel employee would approach us and usually ask us to move. The lesson is that a formal security force doesn’t need to provide all the security in a city; local organizations—including businesses—may also contribute. A military force operating in a city will be more effective by understanding this and working to align these nontraditional security providers’ actions and interests with their own.
From a more operational level, Mumbai emphasized the importance for a security force to have distributed capabilities with decentralized execution orders. Once under attack, the chaos of battle blinded the city and its security forces, which were unprepared for the enemy they faced. Most Mumbai police to this day don’t carry weapons, so any first responders to the attack were not able to do much. Instead, the city relied on rapid assault forces, similar to a military quick-reaction force, that took hours to get to the sites under assault in 2008.
Any local or expeditionary security force must have the ability to rapidly move to an attack site and possess the capability and authority to act immediately. Capability can be addressed by investing in, equipping and training the appropriate types of security forces, then distributing those forces around the city. But mobility will be the critical vulnerability. Even today, in the traffic-congested, complex physical terrain of Mumbai, it is unlikely that rapid response security forces, without dedicated aerial assets, would get to a location under attack quickly. For any military force, significant thought must be given to how to get the right capability to an objective fast enough in dense urban terrain.
The terrorist attacks in Mumbai offer lessons for any military force that seeks to be prepared to operate in a mega-city—not just in a counterterrorism context, but across a range of operations. Distributed capabilities, Mission Command and detailed mobility planning would have had an impact in Mumbai and will be key to any future urban operation, especially in a megacity.