There is generally a set modus operandi employed in the planning and execution of an attack or serious crime. These will differ from group to group and while some may be crude, the majority are professional in nature and military in their precision. These stages can be simplified into the preparation, attack and extraction phases. A key element of the preparation phase is acquiring as much information and intelligence as possible through open source and covert means. This process will entail thorough studies of plans, maps, satellite imagery, local guides, company and government websites, followed by surveillance on the ground. Such activity is time-consuming. For example, the 1996 attack on the Khobar Towers barracks, in which 19 US servicemen were killed, was more than three years in the planning and the attacks of 11 September 2001 were conceived in the late 1990s.

The majority of competitive intelligence is legitimately available. Al-Qaeda estimates this to be 80 per cent of their specialised needs. The remaining 20 per cent can be obtained from unsuspecting employees divulging valuable information offsite, or through ineffective security policies and procedures allowing information to be gathered covertly. The more information which is denied through effective pre-employment screening, physical, electronic and information security policies and procedures, the more the potential attacker will be forced to rely on reconnaissance and surveillance. Nevertheless, regardless of how much intelligence is gained through open or clandestine methods, planning will still necessitate some form of reconnaissance and surveillance.

Surveillance is an essential prerequisite to any terrorist attack, kidnap, assassination or organised crime. To maximise the likelihood of success, a target must be placed under surveillance to assess and evaluate security arrangements and identify a target's vulnerabilities. Employing all or some of the core elements of surveillance (eg, static, foot, mobile, close target reconnaissance and aerial), the crucial targeting information is obtained and an attack plan formulated.

Survey the scene

Even if an insider provided some or all of the tactical intelligence, it would still necessitate some form of surveillance. This surveillance will verify the intelligence and allow the attack team to familiarise themselves with the target. Positive target identification is paramount, particularly in cases involving attacks or actions against individuals. Surveillance may be conducted through remote technical means (cameras or even the internet) but will nearly always involve human observation, working around, and at times within, the target area.

Again, this is a long-term activity. In the 1998 bombing of the US embassy in Nairobi, surveillance had commenced five years earlier. In another case, Chechen rebels ran a 'mole' within Sleptsovsky Airport in Russia's North Caucasus for nearly 18 months. Through the mole's extensive access militants were able to identify numerous high-net individuals for kidnap and ransom.

Surveillance can be hampered by a number of measures including: good access control to facility and surrounding buildings and areas, frequent checks of likely surveillance and attack positions, daily review of CCTV footage and not forming patterns - b