Thread by @AlexLittleTN

The Nashville Christmas Bombing is incredibly unusual for a few reasons. The facts we think we know so far — and things may change as new information emerges — paint a picture that is different than any other attack on U.S. soil.

It raises some serious questions.

A thread 1/x

First, let’s talk about what makes this attack different.

This was a successful bombing on U.S. soil in a large metro area. There have not been many of these in the last 40 years: Oklahoma City, Atlanta Olympics, Boston Marathon, Times Square.

2/x

Of this list, the Nashville attack is much more like OKC than the rest. There, a moving truck. Here, an RV. The other, smaller attacks involved pressure cooker devices and devices more like pipe bombs. (It also looks to me like there’s a passenger in the RV.)

3/x

So, in terms of the blast and damage, this appears to be the second largest domestic bombing in the US in the past few decades. W

We’re talking about a powerful explosive — large enough to damage an entire downtown city block. Smaller than OKC, bigger than Boston.

4/x

It isn’t particularly easy to make or source a large car bomb without being detected. (And it’s super hard if the FBI is already watching you.) It’s also expensive and time-consuming. Nichols and McVeigh spent something like 8 months to build the OKC bomb.

5/x

All of this is frightening enough. But there’s more. Police confirmed that the RV itself appeared to be broadcasting a loud message over speakers warning people nearby to evacuate because there was a bomb. There was even a countdown.

6/x

Part of the warning message was: “If you can hear this message, evacuate now.” And it worked. There were, incredibly, no known deaths. Folks living nearby left their apartments, police swept the streets, and no one died.

7/x

It is difficult to overstate how unusual it is for an attack like this to include a warning. That stuff happens in movies. It *doesn’t* generally happen in real life. But it tells us that the attacker(s) didn’t want to cause casualties. This is a critical data point.

8/x

Thinking quickly, beside warnings before bombings provided by nation-states (like the leaflets before the atom bomb in Hiroshima, some warnings to Palestinian areas before bombings by Israel), there are few examples of attackers preceding their bombing with a warning.

9/x

But it *has* happened before. In 1996, the IRA phoned in a warning to authorities in Manchester about 90 minutes before it exploded a massive bomb. Many were evacuated, but 200 people were injured. Even when it took credit for the bomb, the IRA apologized for the injuries.

10/x

The IRA warnings made sense in context. Especially by 1996, the IRA was in a war for hearts and minds. Its leadership knew that massive casualties would ultimately harm its overall goal in Ireland and the UK. It needed to show power but temper it with reason.

11/x

Few terror groups possess that same motivation, which is why most bombings aim to cause the most carnage possible. Causing death, chaos, and fostering fear — that’s why a terror group carries out an attack instead of, say, marching in the street.

12/x

But whoever did this didn’t have those aims.

**THIS IS UNUSUAL.**

People don’t generally load an RV with explosives for a purpose *other* than killing people. But it’s pretty clear evidence that this attacker had one of those rare, *other* motives.

13/x

So, here’s the first major question this bombing poses:

If not to kill people, why explode this bomb in this location in the middle of a major U.S. city?

There are a few possible answers.

14/x

Sometimes, terror attacks target a location not to kill but to send a message. After all, political violence is “political” — it has a goal or, at least, a reason. (I’m going to ignore, for now, the possibility of nihilist, Joker-like violence.)

15/x

Symbolic targets like the White House, the Pentagon, the WTC all make sense regardless of any resulting casualties. In attacking those targets, the terrorist sends a clear message that he believes that what those symbols represent should be destroyed.

16/x

This attack doesn’t look like a symbolic attack. It appears that the RV was parked where it wanted to be — the middle of 2nd Ave in Nashville in front of an AT&T network switch/data center and across from some not-particularly-notable bars and restaurants.

17/x

There is nothing obvious about this location that would send a clear message of the terrorist’s aims and goals. Symbolic terrorism only achieves its aim when the symbols and message are clear. Compare this attack to, say, jihadists exploding a car bomb in a Jewish temple.

18/x

I’ve seen the speculation that the symbol here could be the AT&T network. These folks are guessing that the bombers might be crazy folks raging against conspiracy theories about the rollout of 5G wireless networks. And, sure, that’s possible. But not likely.

19/x

The crazy-anti-5G-network theory isn’t likely because this attack isn’t clearly linked to the aims of those folks — to the extent they have aims.

20/x

If you wanted to explode a bomb to express your displeasure with supposedly mind-altering wireless networks, you’d probably publish a manifesto, too. Or do *something* more obvious to make the link clear.

There’s none of that here.

21/x

So, I think we can rule out both (1) “generalized” terrorism, by which I mean an attack meant to instill fear through causing casualties, and (2) symbolic terrorism, by which I mean an attack that uses violence to send a public message.

Ok, then what’s left?

22/x

There are a few different categories of possible motives still on the table. Let’s call them mundane and dramatic. Let’s start with the mundane.

23/x

The most mundane possibility: a dramatic suicide.

2020 has been a dark year, and it’s possible that someone planned to kill themselves (but not others) on Christmas in the most dramatic way possible.

24/x

The fact that recent reports indicate there are remains on the scene certainly make this motive possible.

And investigators should know soon if the remains are those of the attacker by looking at nearby videos. Did anyone exit the RV after it parked early this morning?

25/x

If it’s suicide, then investigators should be able to close the case quickly.

They should be able to identify the RV or DNA, and there’d be no reason for the attacker to hide his/her identity. There may also be a suicide note or message back at their home/elsewhere.

26/x

But I’m leaning against a generic suicide — at least based on what we know now. Why? Because that’s a dramatic way to kill yourself and an unusual place to do it, unless you have other goals or motives.

27/x

There are other mundane motives, though. Let’s call these the “private” reasons.

Private reasons can be as diverse as people themselves. Perhaps that location holds some significance to the attacker. Did he work at AT&T? Have a beef with someone who owns a business there?

28/x

If you’re an investigator, you never want to discount a private motive — especially this early in an investigation. People do crazy things for crazy reasons.

29/x

But this doesn’t *feel* like a private-motive attack for a few reasons, including the timing, the location, and the collateral consequences.

And so now I’m going to dip my toe in the more dramatic possibilities.

29/x

This attack *feels* dramatic for a few reasons.

First, consider the timing. This attack was planned for early Christmas morning.

This is a terrorist’s wet dream. The attack dominates the news on our country’s most peaceful and restful day.

31/x

The timing alone suggests that this attack has some broader political/terror motivations or is, at least, part of a larger plan.

And the other facts don’t yet weigh against those considerations, either.

32/x

But there’s much more than the timing.

The location! Which resulted in serious consequences beyond 2nd Ave. Specifically, the attack damaged what appears to be a major artery of AT&T’s communication network. This is a big, big deal.

33/x

If you looked just at the consequences of the attack, you’d guess it was a terror plot.

Someone has managed to take down phone and internet communications for millions of Americans in the region.

It was, in other words, a massive infrastructure attack.

34/x

Was the loss of a communications network just a coincidence?

It’s 2020, so I won’t rule anything out. But that’d be a *hell* of a coincidence.

And I watched Die Hard 2 last night, so that pushes me away from the “it’s a coincidence” theory.

35/x

But what if the network disruption *was* the goal?

Why would someone want to take down a communications network?

36/x

There are plenty of reasons.

But let me discount from the start the types of reasons that drive the plots of blockbusters like Oceans 11 or Die Hard 2.

Sure, someone could knock out AT&T so they can commit some other crime. But that requires some tough leaps of logic.

37/x

Most importantly, we don’t have any evidence that some other nefarious activity is happening as a result of the AT&T downtime. So, I think we can heavily discount the idea that this bombing was merely a distraction from some *other* crime.

This was it. This was the attack.

38/x

Now back to where I began: It is how these pieces fit together that is so unusual.

39/x

We have an attacker who has detonated a large bomb, who took steps to avoid casualties, who chose a location notable only for its impact on our communications network, and who has (at least not *yet*) claimed responsibility.

What explains this mix?

40/x

One (admittedly outlandish) possibility: A state-sponsored attack, perhaps by Russia, as part of an escalating tit-for-tat cyberwar.

41/x

“Whoa,” you say. “That’s nutty.”

Sure, it is. Any answer to this riddle is going to be nutty, as I’ve tried to lay out above.

But this theory both fits the unusual facts here and also conforms to things happening elsewhere in the world.

42/x

We know that someone (some sources say Russia, some China) has succeed in a massive cyber attack on U.S. soil.

It doesn’t matter *who* did it. It matters who the U.S. intel community and the President thinks did it — and whether we have responded since we learned of it.

43/x

If the U.S. intel community and military have responded to this cyber attack, one of the things it *might* have done, covertly, is escalate cyberattacks to physical attacks.

And, if our military did that, the most obvious target is our adversaries’ infrastructure.

44/x

And, if such an attack occurred, that adversary (whether Russia, China, or N Korea) might’ve wanted to respond itself.

But that adversary *also* wouldn’t have wanted casualties, which would be too provocative. Nor would it need to take credit. U.S intel would already know.

45/x

But let’s not get carried away.

The investigation, the direction it takes, and what we learn in the next few days should help us sort out which of these motives was the actual motive.

There should be more clues soon.

46/x

I’m going to divert for a moment to address Mayor Cooper’s comment that this was about fear and that it could’ve caused more casualties but for the good work of MNPD.

47/x

It’s certainly true that any bombing is going to cause fear. But there are few precedents for terror groups who try to cause as little fear and as few deaths as possible.

The recorded warning just isn’t consistent with an attacker(s) whose goal is to instill fear.

48/x

And it’s also true that MNPD almost certainly saved lives. But it’s also beyond debate that whoever did this was not motivated by the goal of killing people.

If they were, they’d pick a different time and place to park their very large, very (very) dangerous bomb.

49/x

If you look at similar car bombs elsewhere, you might expect between a dozen to more than a 100 deaths.

Whoever did this had the capacity to inflict that sort of damage — but *chose* not to. That’s the most notable thing about this attack (with the location a close 2nd).

50/x

Since we don’t know much more tonight than we knew earlier today, let’s talk about what investigators are likely doing right now, and how those investigative steps and leads will (hopefully) answer the question of who did this, and why.

51/x

This seems obvious, but it’s important to say:

When we know *who* did this, we’ll learn much more about *why* it was done.

It’s a lot easier to determine a motive when you have a suspect.

52/x

So what are the basic steps that the investigators are taking right now to find the identity of the attacker(s)?

I’d guess there are three (and a half) major threads they’re following:

(1) The RV
(2) The passenger(s) of the RV, and
(3) The victims

53/x

Let’s start w/the victims.

You’d expect investigators to talk to the residents/business affected and ask if they’d received any threats recently or were embroiled in disputes.

If so, add those folks to the suspect list.

I’d be especially interested to hear from AT&T.

54/x

Now, of course, the passenger(s) of the RV are the prime suspects. And if we knew who they were, the investigation would be in great shape.

But even without their name(s), there’s lots investigators should (we hope) already know.

55/x

From video surveillance, and possibly evidence on the scene, investigators should (we hope) already know:

- If the driver (or anyone else) left the RV after parking it.
- If they did leave, where did they go?
- If they didn’t leave, can we find their remains?

56/x

The answers to these questions, whatever they may be, will tell us a great deal.

The most important, by far, is whether the attacker(s) left the scene.

If they didn’t, the focus on suicide and/or a “private motive” will intensify.

57/x

Alternatively, if the attacker(s) left the scene, or parked the RV in a location where no surveillance cameras could detect if he/she left the scene, a more sophisticated operation will become more likely. And then we’re squarely in lots-of-unexplained-questions land.

58/x

Finally, we’ve got the RV — by far the most important piece of evidence.

Investigators will try to track its movements in the hours, days, and weeks before the attack. They’ve already released a good photo, and let’s hope they have other good video from downtown.

59/x

From the photos and videos they already have, investigators will know the make, model, and possibly production year of the RV — all of this will narrow the search for it considerably. High quality video may even capture the plates.

60/x

In addition to the possible surveillance videos, which hopefully can help trace the RVs route — at least downtown — there are likely to be many leads from people in the public who may have seen it in the past few days.

61/x

Less likely given the size of the blast, but still possible, is that investigators at the scene will find a part of the RV that will help identify it.

Given the explosion, I’d say they’re focusing more on prior photos, videos, and witnesses who may have seen it.

62/x

However they identify it, investigators are going to focus on finding out as much as possible about the RV.

Who owned it? Was it rented? When? Reported stolen? If so, how long ago and where?

The answers to those questions will determine where the investigators look next.

63/x

So, for close readers, what’s the 1/2 major thread left for investigators to follow?

Intelligence reports + claims of responsibility.

When someone commits an attack like this, they and people around them tend to talk. Investigators will be listening, hoping for a break

64/x

This can happen two ways.

For the criminal/terrorist himself, they might want to brag about what they’ve one. Even if they don’t take public credit, they want their buddies to know what they’ve done.

These loose lips can become solid leads.

65/x

Almost as useful, and certainly much more common, is a friend, family member, or jilted paramour who — after the fact — connects the dots and starts to tell *their* friends and associated.

This is how the Unabomber got busted ... eventually.

66/x

And... 66 tweets later, I think that’s it for now.

Hopeful that investigators made major progress today and can tell us something positive tomorrow.

67/x

Going to connect the threads for folks reading the old one.

67/x

https://twitter.com/alexlittletn/status/1342956706570121216