Railway Attack Classification: Quick Reference for Field Teams

Read perpetrator motivation from crime scene evidence, notify the right unit.

The most critical bottleneck in physical crime scene interventions is differentiating whether the incident is a simple criminal case (theft) or a national security threat (sabotage). Misclassification leads to misdirection of security forces and prolongs response time. The following protocol is a decision support algorithm designed to identify the perpetrator’s motivation based on physical evidence at the scene and to activate the correct unit.

📋 USAGE NOTE

• ⏱️ Reading time: 5 minutes
• 🖨️ Printable: A4, 2 pages
• 📱 Mobile-friendly: Opens on phone in the field
• 🔗 Theoretical background: See Whitepaper →

---

🎯 SINGLE QUESTION PRINCIPLE

When physical intervention is detected, ask only one question:

┌─────────────────────────────────────────┐
│  IS THE MATERIAL ON-SITE OR REMOVED?   │
└─────────────────────────────────────────┘
         │                    │
         ▼                    ▼
    [ON-SITE]              [REMOVED]
         │                    │
         ▼                    ▼
    SABOTAGE 💣             THEFT 🔧

---

✅ TYPE A: THEFT CHECKLIST

Motivation: Economic (Scrap Sale)

Field Checks

□ Is cable cut AND middle section missing?
□ Are there plastic sheath fragments at scene?
□ Are there burn marks? (burned for stripping)
□ Are there vehicle tire marks or drag marks?
□ Is it at transformer station or tension weight area?
□ Did it occur between 01:00-04:00?
□ Has there been a previous incident at same location?

RESULT: 4+ checked → THEFT CONFIRMED

☎️ Notification

┌────────────────────────────────────┐
│  📞 LAW ENFORCEMENT               │
│  📋 Alert scrap yards             │
│  📷 Request camera for location   │
└────────────────────────────────────┘

---

✅ TYPE B: SABOTAGE CHECKLIST

Motivation: Operational Disruption / Political Message

Field Checks

□ Is fiber optic cable cut?
□ Is severed material left at scene?
□ Are there arson/burn traces in relay cabinet?
□ Are there simultaneous similar incidents at different locations?
□ Are cable conduits/culverts forced open?
□ Is it before a critical date? (holiday, summit, event)
□ Is backup line also affected?

RESULT: 4+ checked → SABOTAGE CONFIRMED

☎️ Notification

┌────────────────────────────────────┐
│  🚨 SECURITY UNIT (URGENT!)       │
│  🔒 Secure scene (forensics)      │
│  🔍 Scan similar locations        │
│  ⚠️  NOT Law Enforcement—Security!│
└────────────────────────────────────┘

---

✅ TYPE C: ACCIDENTAL SABOTAGE CHECKLIST

Scenario: Thieves cut fiber mistaking it for copper, then abandoned it

Field Checks

□ Is fiber cut BUT copper also targeted nearby?
□ Are there "abandonment" signs at cut point?
   (half-finished cuts, scattered tools)
□ Are different cable types mixed in same conduit?
□ Are glass fiber fragments on the ground? (fiber core)

RESULT: 2+ checked → ACCIDENTAL SABOTAGE

☎️ Notification

┌────────────────────────────────────┐
│  📞 LAW ENFORCEMENT + SECURITY    │
│  📋 Motivation: Theft             │
│  ⚠️  Result: Sabotage effect      │
└────────────────────────────────────┘

---

📸 FIELD PHOTOGRAPHY GUIDE

Take photos from 5 ANGLES for every incident:

□ 1. OVERVIEW
     Location's relationship with surroundings (wide shot)

□ 2. CUT POINT
     Where cable was severed (close-up)

□ 3. REMAINING MATERIAL
     Abandoned pieces (if any)

□ 4. TOOL MARKS
     Impressions on cut surface (macro)

□ 5. ENVIRONMENTAL EVIDENCE
     Footprints, vehicle tracks, abandoned equipment

---

⚡ QUICK REFERENCE TABLE

---

⚠️ MISCLASSIFICATION RISKS

---

🖨️ PRINT AND POCKET

A quarter-page summary version of this guide:

┌─────────────────────────────────────────────────────────────┐
│                    FIELD POCKET CARD                        │
├─────────────────────────────────────────────────────────────┤
│  MATERIAL REMOVED  → THEFT    → LAW ENFORCEMENT            │
│  MATERIAL ON-SITE  → SABOTAGE → SECURITY                   │
│  BOTH TOGETHER     → ACCIDENT → BOTH UNITS                 │
├─────────────────────────────────────────────────────────────┤
│  ✓ 5 angles of photos                                       │
│  ✓ Secure the scene                                         │
│  ✓ Check if coordinated                                     │
└─────────────────────────────────────────────────────────────┘

---

📎 Related Content

📄 Theoretical Background and Case Studies:
→ Physical Threat Vectors in Critical Railway Infrastructure (Whitepaper)

---

Last updated: January 2026 | Version: 1.0