Dead Drop Intel

Dead Drop Intel

The Intelligence Blueprint Behind the Next 9/11

How Mumbai revealed the command, control, and reconnaissance model that will shape future complex terror attacks.

CommandEleven Intelligence®'s avatar
CommandEleven Intelligence®
Feb 20, 2026
∙ Paid

Prior to 2001, terror groups were not as mature as we see them today. Any GWOT veteran will happily explain during the invasion of Afghanistan, the Taliban could barely hit their targets because they were hampered by both weapons and skill sets. The use of suicide bombers and car bombs in Iraq was largely due to the inefficiency of the terrorists. Today, that picture has significantly changed and presents a massive threat to nation states.

Mumbai was the first test, or example, of how the terrorists had modified their warfare capabilities. The attack, while planned by Lashkar-e-Taiba (LeT), was not a single group exercise. LeT ground assets spent close to 2 years carrying out surveillance and counter-intelligence activities in Mumbai, building a comprehensive understanding of:

  • capabilities of law enforcement to react to a terror attack

  • identifying ingress and attack locations where significant damage could be delivered before the attacker was neutralized

  • defining a rally point (or siege location) that would deliver the greatest psychological impact both to India and globally

  • understanding the number of terrorists needed to carry out the attack

With this information being gathered and continually transmitted to LeT leadership in both Pakistan and Afghanistan, LeT enlisted al Qaeda’s leadership in Afghanistan to organize the attack itself. Keeping in mind AQ has always believed a “spectacular attack” model, where they are able to deliver significant impact on a single target with limited loss of resources, the AQ leadership took over command and control of the operation.

When Mumbai was carried out, the ingres point from the ocean, selected for its vulnerability. Once ashore, the 10 terrorists split into 5 teams, dressed in denim jeans, t-shirts, and Hindu religious wristbands, so they blended in with the city’s population making detection more difficult. Each terrorist was carrying a backpack loaded with a folding stock AK-47 or AK-56, multiple pistols, grenades, rations, ammunition, and communication equipment, including satellite phones to maintain communications with their commanders in Pakistan and Afghanistan.

Communications were used by the commanders monitoring live Indian news broadcasts and social media news feeds to gather live intelligence during the attack. First, they built a massive base of intelligence on the entire city of Mumbai, then they use Indian television and social media to provide their terrorists with up-to-date information to increase the complexity of the attack for local law enforcement.

Communications were also used to provide psychological encouragement to young, inexperienced terrorists to continuing killing civilians and law enforcement.

DISCLOSURE: This post contains affiliate links. If you make a purchase through them, we may earn a small commission at no extra cost to you. This helps keep our work independent. Thank you for your support.The Attack

The 5 teams were quickly moved through the city, with 2 teams taking taxis - one to the Chhatrapati Shivaji Terminus and hospital, the other to the Oberoi Trident Hotel. Both of these teams planted timer-based improvised explosive devices (IEDs) in the taxis, while the other 3 teams moved on foot – one to the Nariman House, one to Leopold Café, and the other to the Taj Mahal Palace Hotel.

In the Chhatrapati Shivaji Terminus, 2 attackers calmly, over 20 minutes, calmly moved through passenger halls and terminals, shooting anyone they encountered. The Railway and local police were sorely under-equipped for what they were facing and were outgunned. When the terrorists left the Chhatrapati Shivaji Terminus, 58 were dead and hundreds injured.

These attackers moved to the Cama and Albless Hospital, intermittently shooting Mumbai residents and structures, until they reached the hospital. Even though the hospital administration had received alert calls and locked the doors of wards, the terrorists moved through the hospital and terrorists were still able to kill guards, police, take hospital employees as hostages and exit the complex to move to their next target.

A second group of 2 terrorists attacked the Leopold Café, where they detonated a grenade and indiscriminately opened fire on the crowded café, killing ten and wounding dozens. This group left the café and move toward the Taj Mahal Palace Hotel, their primary target. Eyewitnesses reported that one of the terrorists made a phone call prior to starting the attack, coordinating and getting instructions from their commanders.

While moving towards the hotel, this group placed an IED on a road, which failed to detonate.

In the Oberoi Trident Hotel, the terrorists entered the lobby, opening fire and throwing grenades into crowded restaurants and cafes within the hotel, before taking up positions in the higher floors of the hotel to continue their attack via indiscriminate gunfire and grenades. In the span of 15 minutes, 2 IEDS dropped outside the hotel detonated, making police entry into the hotel more difficult.

During these attacks, the Mumbai police, the Quick Response Force, and the Anti-Terrorism teams were all easily encountered by the terrorists and neutralized. From 9:20 pm on the November 26th to 2:40 pm on November 28th, the 2 terrorists were able to effectively counter police, Marine commandos, National Security Guard’s counter-terrorism team, killing 30 and wounding 20, before being neutralized.

At 9:44 pm on November 26th, 2 terrorists entered the Taj Mahal Palace Hotel and opened fire into the crowded lobbies and restaurants. At the same time, the 2 terrorists who had attacked the Leopold Café entered the hotel via another entrance and fired on those around the swimming pool area, before joining the first 2 terrorists to form a four-man assault team.

When police entered the hotel, they were met with assault fire and grenades pinning them down. With the commanders watching the entire attack on live television, the terrorists were told to start fires on the different floors of the hotel so the international media would broadcast the Taj Mahal Palace Hotel was on fire.

The interesting part of this attack is the terrible response of the local law enforcement, even the Marine commandos and Indian Army, even though calls were made for urgent assistance and hostages being tied up and moved to secure locations under terrorist control.

From 9:44 pm on November 26th to 8:50 am on November 29th, the 4 terrorists were able to take over 150 hostages, killing 30 guests, staff and security personnel and wounding hundreds more, before being neutralized by the National Security Guard commandos.

What Do We Know …

User's avatar

Continue reading this post for free, courtesy of Chris Heaven.

Or purchase a paid subscription.
© 2026 Outlaw Media Group · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture