The Watch Floor with Sarah Adams
Episode: "This Happens Before Every Attack"
Date: March 25, 2026

Episode Overview

In this episode, former CIA Targeter Sarah Adams explores the decision logic that underlies major terrorist attacks. Moving beyond ideology, she examines how terrorists choose targets, assess vulnerabilities, and adapt their plans for maximum impact. Through three internationally significant case studies—the 2008 Mumbai attacks, the 2013 Westgate Mall attack in Nairobi, and the 2015 Paris attacks—Sarah breaks down the methods and thinking patterns that precede every large-scale attack. Her aim: to help listeners recognize the signs and understand the decision-making chain, making it possible for ordinary people to contribute to the prevention of future attacks.

Key Discussion Points & Insights

Moving Beyond Ideology (01:00)

• Not about ideology alone: While ideology motivates, operational decisions hinge on target selection, timing, vulnerability, and risk calculation.
• Factors terrorists weigh: Psychological impact, accessibility, vulnerability, control over the environment, and likelihood of media attention.

Notable quote:

"It's not just about what happened when we talk about these attacks, it's how and why certain decisions were made to either prolong these attacks, to choose the correct targets to lead to higher casualties."
— Sarah Adams [02:05]

Case Study 1: 2008 Mumbai Attacks (06:57)

• Event summary: 10 attackers from Lashkar-e-Taiba, 60+ hours, 166 killed, 300+ injured.
• Target diversity: Taj Mahal Palace Hotel, Oberoi Trident Hotel, Chhatrapati Shivaji train terminal, Nariman House (a Jewish center).
• Planning elements:
  • Multiple objectives: control space (hotels), mass casualties (train), symbolic/religious signaling (Nariman House).
  • Reconnaissance: On-site surveillance, observing security routines, studying crowd patterns.
  • Use of technology: GPS, satellite imagery, real-time communication.
  • Deliberate target selection: Less about symbolism-vs-practicality, more about optimizing both.
• Flexibility: Real-time adaptation during attacks to evade law enforcement.

Notable quote:

"This attack wasn't like symbolic versus practical. It was both working in concert so it was planned in a very smart way."
— Sarah Adams [08:54]

Insight:
Reconnaissance and advance preparations are critical—between 25–35% of terrorist attackers conduct on-the-ground surveillance, allowing for detection opportunities if public stays alert. [11:52]

Case Study 2: 2013 Westgate Mall, Nairobi (13:10)

• Attack at a mall, not a 'symbolic' site: The Westgate Mall’s appeal lay in its high foot traffic (25,000/day) and inconsistent security.
• Attacker preparation:
  • Multiple site visits for surveillance.
  • Studying guard placement, shift patterns, entry points, and peak times.
  • Operational practicality trumps symbolism: The attack itself creates its own symbolism.

Notable quote:

"The target does not have to be symbolic. The attack itself can create symbolism. So attackers are really making practical decisions."
— Sarah Adams [14:37]

• Weapon and tactic selection: Determined by local accessibility and the desired outcome, not necessarily by terrorist doctrine.
  • In places where guns are hard to obtain, attackers may opt for knives, vehicles, or homemade explosives instead.

Memorable example:
Detailed discussion about the 2016 Nice truck attack, noting how attackers adapt their methods to the environment for mass casualties [16:35].

Case Study 3: 2015 Paris Attacks (17:25)

• Coordinated, cross-border planning: ISIS attackers operated across France, Belgium, and Syria using encrypted comms, safe houses, and smuggled weapons.
• Multiple simultaneous targets: Bataclan Theater, Stade de France, restaurants/cafes.
• Tactics: Suicide vests for lethality, automatic weapons for sustained attack, multiple teams for chaos and to overwhelm first responders.
• Adaptation: Plans evolved in real time, teams prepared for complications.

Notable quote:

"Every decision reinforced the next. And here we had nine attackers working in concert, very similar to Mumbai, to carry out this level of an attack."
— Sarah Adams [18:30]

Core Patterns & Lessons (19:20)

• A chain of events: Major attacks are not a result of a single decision; planning is iterative, with numerous adjustments and contingencies.
• Flexibility: Terrorists conduct dry runs and "what if" exercises to prepare for real-time shifts.
• Ultimate goal: The outcome trumps symbolism or specific targets.
• Prevention opportunities: Public vigilance and reporting of unusual surveillance or behaviors can thwart attacks, often without the public ever knowing what was averted.

Notable quote:

"If there's one thing to understand, it's this. Terrorist attacks don't start with a target. They start with an outcome. Everything else, including the location, the timing, the weapons, and even the skill symbolism, are all chosen to actually make the preferred outcome possible."
— Sarah Adams [20:15]

Memorable Moments & Quotes

• Flexibility in Terrorist Planning:
  "Terrorists, when they're on the objective, they're much more flexible than what people realize... they are better prepared to make decisions on the fly." [19:45]

• Empowering the Public:
  "It all comes down to observation. So if we have people noticing unusual behavior, repeated surveillance, strange questions, and just the testing of boundaries around certain locations, these tips help play a role in stopping attacks." [20:00]

• Attack Prevention:
  "Dozens of attacks get thwarted a year and there maybe was one little piece that stopped it and we never know what the final result would have been or what it would look like. But that is the wins we want, right?" [19:52]

High-Value Timestamps

• [01:00] – Setting up the episode’s focus on operational decision logic, not ideology.
• [06:57] – Introduction to the 2008 Mumbai case study.
• [13:10] – Lessons from the Westgate Mall attack, target selection.
• [17:25] – Planning and execution of the 2015 Paris attacks.
• [19:20] – Key patterns across all case studies, public role in prevention.
• [20:15] – "Attacks start with an outcome, not a target" – anchor insight.

Conclusion

Sarah Adams’ insights illustrate that the myth of the purely ideological terrorist is only half the story. Instead, practical and ruthless logic—focused on achieving a specific outcome—drives the decision-making of attackers. By understanding the patterns of reconnaissance, flexibility, and outcome-orientation, listeners are better equipped to spot pre-attack signs and contribute to a safer world.

For those interested in learning what to look for and how to help, Sarah promises further episodes focused on recognizing and reporting suspicious behaviors picked up during real-world surveillance and attack planning.

For more actionable insights, stay tuned to "The Watch Floor."