A funny thing happened on the way to the stadium
This is an amazing story about how a coordinated group of non state actors planned and executed a series of attacks to successfully disrupt the interests of a nation state at the international level. Specifically, how hooligans managed to sabotage their own side (probably in protest) during the Euro 2016 Croatia vs. Czech football match.
Caveat: football hooligan firms are not my domain, I don’t know much about them. Croatian ones, even less.
What Happened
The Croatians were beating the Czechs 2:1 when, towards the end of the match, a series of attacks, fights and disturbances interrupted play. The Czechs took advantage of the distractions and scored an equaliser. The motivation for the violence and disturbances is a bit puzzling to understand, but not particularly important.
Far more interesting is how a bunch of thugs organised and carried out these actions while evading tight security and international police cooperation. Theres a lot of planning and preparation that goes into a brawl, particularly when there is a strategic objective guiding the participants.
In a football tournament most memorable for it’s hooligan violence, the tradecraft of modern hooligan firms has been exposed in the media.
Hooligan Organisation
Hooligan firms associated with football clubs, have internal organisations, and have “special arrangements” with their local stadiums. Due to their affiliation with a particular football club and stadium, local firms will generally have established connections for sourcing tickets and smuggling in contraband (e.g. pyrotechnics, flares, etc.) In addition to all that, they’re also love to cause a ruckus and have a bit of a brawl. Organised violent thugs, basically.
The important points are: that hooligan firms are organisations. They have leaders, a hardcore of committed members, arrangements with local stadium officials, and a support infrastructure. They are illicit, but not necessarily underground, organisations. Their members, particularly the more hardcore, face an adversarial organisation — the police.
How illicit organisations operate against an adversarial organisation is always interesting. There are a number of techniques that have been developed by the hooligan firms which enable them evade police measures designed to prevent violent outbreaks at football matches. At their local stadiums, firms can take advantage of their arrangements with corrupt officials, but for international games things become more complicated.
United We Brawl
This particular event was the result of a planned and coordinated action involving four Croatian firms:
- Torcida Split
- Bad Blue Boys
- Armada
- Vinkovcani
Additionally, support services from the local St Etienne Magic Fans firm were critical for the success of the attack. For historic reasons, the Magic Fans and the Torcida Split are closely linked. The selection of the St Etienne stadium for the attack was almost certainly due to the availability of logistical support capabilities from the Magic Fans.
Torcida & Magic Fans, fans of Hajduk & St. Etienne, who are in friendly relations, are solely being blamed for the riots yesterday. #CRO
— Juraj Vrdoljak (@JurajVrdoljak) June 18, 2016
70% of Success is Showing Up
Hooligan firm membership lists are known to the police who track their identities. They share these lists typically before matches where the firms are expected to be present so that local police forces can interdict them. This means that generally speaking, the hooligans are unable to fly to where the games are taking place due to strict ID checks.
One solution is to fly to a neighbouring country and then drive across the border where the passport checks might be lax or nonexistent (e.g. inside Schengen.) That was the a strategy used by Russian hooligans, for example
He also meets a journalist, who tells him the trouble had been sparked in part by Russian hooligans who flew to Switzerland and then drove into France by car in order to avoid detection. — Source
Simply being in the right country and the right city isn’t enough though, the guys still need tickets. Again, police lists of banned hardcore ultras present a problem for international hooligans. The Torcida Split ultras were able to use their strong connection to the local Magic Fan firm to arrange tickets under false names. Apparently at the stadium, there was a “security lapse” where names on tickets where not verified against an ID. Classic “Time of Check, Time of Use” vulnerability, most likely due to assistance from the local firm.
Tradecraft Lessons
- Evade bans on flying to a match by flying to neighboring country and driving across the open border.
- Bypass ticket sales ban lists by using cut outs to make the purchases
- If you want to go large, you’ll need to get assistance from the local firm
Weaponised MS Paint
The specific planning for the attacks had been going on for some time. Clearly, the firms had to agree on united action, as well as what form that action should take. Given the strong connection between Torcida and the Magic Fans, as well as their seniority, organisation, and reputation, it seems probable that they took the lead in planning and organising the attack. They even devised and illustrated a detailed assault plan using, it appears, Microsoft Paint.
The map illustrates where the four firms would be positioned inside the stadium, and the different actions they would attempt to execute. Of particular interest here is the separation of duties, possibly based on risk appetite, group size, or prestige. The larger more violent firms were responsible for brawling, while the other firms were in charge of throw flares on the pitch and lighting pyrotechnics.
Critical Role of Local Support
Without the aid of the local firm, the Croatian ultras probably wouldn’t have been able to bypass the multiple security controls: ticket sales; stadium ID checks and security searches. The St Etienne Magic Fans were essential to:
- Arrange tickets to allow the Croatian hooligans to bypass the block lists
- Probably “greased the wheels” to ensure they gained entry to the stadium
- Arranged the smuggling of contraband pyrotechnics and flares (likely via corrupt security officials before the match) something they’ve accomplished in the past.
Croatian intelligence forces were aware of the planned attacks and informed the French police days in advance.
Hours before the match the Facebook page of the Torcida Splits was updated with their battle plan. Clearly, operational security and COMSEC are not significant parts of hooligan ultras training. Not that it mattered, as they were able to effectively bypass the security measures in place thanks to their close ties with the local firm.
Mere months after ISIS attempted to infiltrate suicide bombers into a French stadium, violent thugs were able to smuggle in large amounts of prohibited items. French security at stadiums does not appear to be particularly robust, so long as one has the right connections.
Tradecraft Lessons
- To smuggle contraband into a football stadium, talk to the local firm. They will be able to help using their established smuggling routes.
Dat OPSEC Do’
The only minor downside for these hooligans appears to be that images, including video and photos, of their violent actions can be used both to identify them and as evidence against them. Brawling with a mask over your face is probably not the best idea, but then again, being arrested and going to jail isn’t the best idea either.
Already Croatians have put together a page with images of the ruckus, linking hooligans with their Facebook profiles (archive.) French police are promising arrests, although based on past performance that might not be a credible threat.
Tradecraft Lesson
- Try not to get photographed, or at least cover your face, and how about instead of taking off your shirt and revealing your identifying tattoos you cover up?
Leave a Reply