12 August 2016, 24 bombs in 7 provinces in Thailand

Aug Mon, 2016

Between 10-14 August, terrorists deployed 24 bombs in seven mid-south provinces in Thailand. Fifteen bombs exploded, and another nine failed to detonate. At least six devices were the incendiary type (fire bombs), and the others were apparently the conventional type (concussion and/or shrapnel.)

CNN reported four people killed – all Thai nationals – and 36 wounded, including 10 foreigners. The latter consisted of Austrian, Netherlands/Dutch, Italian, and German nationals. Authorities said all of the bombs were similar or identical in construction, and they were triggered by cell phone timers.

As an aside, the head of Muir Analytics, in an article for UPI, warned in 2014 that insurgent/terrorist targeting of Thai tourist areas would increase.

While the official bombing chain of events has yet to be finalized, multiple reports indicate the following timeline:* **

*Muir Analytics will update the scenario if/when new information becomes available.

10 August

11 August

12 August

13 August

14 August

(**It is unclear if three bombs in Chachoengsao province were related to these mid-south bombings. In this case, on 18 August, one small bomb detonated under a pickup truck, and another was found under a nearby pickup truck and defused, both in the parking lot of the Anuchart Engineering Limited Partnership workshop. Another bomb was found and defused at a Burger King.)

The mid-south bombs exploded right after a majority of the population voted in favor of the new, military-sponsored constitution that, in a nutshell, dampened and delayed increased democratic reform in order to maintain political and economic stability. The three southern border provinces of Pattani, Narathiwat, and Yala – Thailand’s southern border insurgency zone (minus Songkhla) – mostly voted against the constitution. The bombings also took place on Queen Sirikit’s birthday, 12 August.

To date, a massive police investigation has linked the mid-south bombings to the southern insurgency. How so?

First, police say the bombing technology used was applied by insurgents who bombed Bangkok on 26 May 2013 at Ramkhamhaeng 43/1 in Bang Kapi.

Second, the police believe that two confirmed insurgents were involved in the bombings. First is Ahama Leng-ha from Narathiwat. He seems to have had a bomb building or leadership role in the operation. The Nation reports that his DNA is on file from an insurgent attack in 2008. It seems his DNA is linked to the mid-south bombings as well. The second is Asameen Gatem-madee from Pattani. He has been linked to an insurgent bombing in Koh Samui (see below.)

Third, the police believe CCTV footage has captured what appears to be, a) the bombing team boarding a train in Hat Yai, b) the same suspects entering a Muslim community in Surat Thani, and, c) the same suspects carrying backpacks and loitering at one of the bombing sites. Authorities noted that the suspects made efforts to conceal their identities from CCTV by wearing gloves, masks, and hats. This is counter surveillance tradecraft. Police have additional CCTV footage identifying other bombers in Trang and Hua Hin, and they have been linked to the far south, at least initially.

Fourth, the police arrested one person associated with the Krabi attack, which led to them arresting a Pattani man on 17 August, though no more details on these arrests have been released.

Fifth, on 22 August, the police said there were 20 people in the network who carried out these bombings, and that those responsible were from the southern insurgency zone. Adding to this point, the reconnoitering, bomb building, bomb placement, and detonations all took a wide and sophisticated intelligence, operations planning, execution, and logistical effort. The southern insurgency has these capabilities.

Sixth, and separate from the police investigation, on 17 August, a military official told the press that the southern border based insurgent group, Barisan Revolusi Nasional (BRN,) broadcasted a message saying that it would not recognize the new constitution until the “Siamese parliament” “addressed their Melayu Muslim identity as a group or state in the highest law.” The insurgency uses the term “Siamese” as an insult to Thailand, and the mid-south bombings could be seen as the violent communication of the insurgency’s clearly stated political disdain.

Seventh, the southern insurgency has the proven ability to strike targets spread out over multiple locations at the same time – distributed operations. On 17-18 February 2007, for example, it staged scores of attacks – bombings, arson, and assassinations – in all four southern provinces over a short timespan. And more recently in 2016, insurgents staged multiple attacks during the last 10 days of Ramadan in Narathiwat, Pattani, and Yala, including several bombings. This has been a continual pattern since the war began in earnest in 2004.

Eighth, the targets attacked in this case – police, civilian entertainment/tourist venues, and businesses – all fall in line with standard insurgent targeting.

Ninth, the insurgency’s end goals of an independent southern state are not even close to being met, and peace talks, which the movement seems to be clinging to as a means of progress, have floundered against the Thai government’s ignoring the critical element of the pressure of time. In fact, the government seems to have used the talks as a delaying tactic. As a result, the insurgency is most likely frustrated and angry. Striking these venues in mid-southern Thailand would then make sense for the insurgents as a means to pressure Bangkok.

Tenth, the insurgency has been linked to other attacks in the mid-south, namely the 1 August 2013 bombings in Phuket (one detonated, one failed,) and the 10 April 2015 bombing on Koh Samui. There is also speculation that insurgents might have been behind the firebombing of the Surat Thani Cooperative that happened on the same day as the Kho Samui attack. The Cooperative fire resulted in 30 tonnes of natural rubber destroyed. The insurgency, then, is comfortable operating outside the normal confines of the insurgency zone, and the mid-south attacks fall within its extended battlespace.

Another possibility could be that the bombers were part of a splinter group. In this regard, all 10 points mentioned above apply, along with the added element of a history of splintering. Over several decades, the BRN, for example, has split into at least two other major groups and multiple smaller ones (BRN-Coordinate, BRN-Congress, BRN-Ulama faction, etc.) And PULO (the Pattani United Liberation Organization) in decades past spawned New PULO, PULO 88, and Pulo Keris.

Additionally, while these bombings certainly demonstrated audacity, solid planning, and efficient bomb placement, 37% of the bombs failed to detonate, so the group responsible appears to have suffered from some degree of technical failing. This might have been because, as a splinter group, its bomb building expertise was limited.

Having said this, the government has made scores of insurgent arrests over the past many months, and it is possible that key insurgent bomb makers have been picked up, leaving the main groups with limited explosives expertise for the moment.

Might it have been a southern insurgent faction linked with an Islamist jihadist group such as ISIS, Jemaah Islamiyah, or the like? Although this is a much more speculative angle, it is indeed possible. ISIS is on the rise globally, including Southeast Asia. Police have arrested ISIS members in the Philippines, Singapore, Indonesia, and especially Malaysia (over 100 arrested there). And ISIS is in Thailand as well.

Also, as ISIS’ territory in Syria and Iraq shrinks, it is beginning to carry out more distributed operations in various countries such as Egypt, Libya, Germany, Belgium, the U.S., Bangladesh, and France. In France alone there have been 10 attacks since the beginning of 2015-August 2016 in 8 different cities, so the distributed operations pattern fits. Additionally, ISIS has carried out two successful attacks (that have been made public) in Southeast Asia: 14 January 2016 in Jakarta, and 28 June 2016 in Kuala Lumpur. It is indeed possible that Thailand, the Philippines, or a neighboring country could be next.

Furthermore, two suspects linked to the ISIS attack in Malaysia – a grenade attack on a sports bar – have been traced to Narathiwat. It is not clear if they are Thai or Malaysian citizens, but police from both countries are pursuing the matter, and the evidence against the duo caused the Thai government to put up wanted posters for them in Narathiwat. If it were just a hunch, they wouldn’t have done that.

As for other possibilities, the Red Shirt angle proffered by the army was, compared to mounting police evidence, weak from the beginning. But Thailand can, in some cases, be the land of wild card conspiracy theories come true. For example, there is a government element that insists that an alleged Red Shirt operative, Sakarin Kharuehas, is connected to the mid-south bombings. It seems unlikely, but the evidence against him needs to be acted on, and eventually made public, or the angle needs to be scuttled. Only until all leads are exhausted will the entire bombing investigation be complete.

At present, the main takeaway here is this: regardless of the “whodunit” speculation, it is clear that Thailand has an irregular warfare group that is increasingly targeting its tourist areas. Improved counterinsurgency and/or counter terrorism methods, with counter political warfare and heightened physical security in the van, are critical at this juncture.

More attacks such as the mid-south bombings are possible both inside and outside the normal insurgency zone, and all tourist venues in country should be considered at risk. Furthermore, as tensions with Thailand’s irregular threat groups fester, a Mumbai and/or Paris 2015 style attack on local and/or tourist venues cannot be ruled out.

Sources and further reading:

Samui, Hua Hin blasts ‘linked’,” Bangkok Post, 30 August 2016.

Phuket bombing suspect ‘in Malaysia,’” The Nation, 20 August 2016.

Arson suspect also faces bombing charge,” The Nation, 18 August 2016.

Police: 2013 Ramkhamhaeng bomb possible link to attacks,” Bangkok Post, 17 August 2016.

Warrant for Phuket bombs suspect linked to insurgency,” Bangkok Post, 16 August 2016.

Thai police uncover more bombs,” TTR Weekly, 15 August 2016

Thai police find more unexploded bombs following coordinated blasts,” Reuters, 14 August 2014.

Unexploded bombs found in Phuket, Hua Hin,” Bangkok Post, 14 August 2016.

New ‘strange contraption’ found at Patong souvenir market, EOD unit confirms ‘undetonated bomb’,” The Phuket News, 14 August 2016.

Bomb attacks so far,” The Nation, 12 August 2016.

Thailand Bombings ‘Were Meant to Scare Tourists’ Locals in Phuket Say,” Time, 12 August 2016.

Thailand rocked by 11 bombs in one day,” CNN, 12 August 2016.

Bombs rattle Phuket and Phangnga,” Bangkok Post, 12 August 2016.

Bombs explode at Surat Thani police stations,” Bangkok Post, 12 August 2016.

Mother’s Day Attacks: Bombs Hit 5 Thai Provinces, Killing 4,” Khaosod English, 12 August 2016.

Cops widen Puchong bomb blast investigation to southern Thailand,” The Malay Mail, 26 July 2016.

Police probing cause of Surat Thani co-op fire,” Bangkok Post, 15 April 2015

BREAKING: ‘Bomb’ found on Phuket beach,” The Phuket News, 28 October 2014.

Copyright © Muir Analytics 2016