A Special Forces commando stands guard in front of the Taj Mahal Palace hotel in Mumbai on Nov 25, 2010, ahead of the second anniversary of the Nov 26, 2008 Mumbai attacks

Hotel Mumbai is a tale of courage. It is also a worrying reminder of India’s security flaws

by Sumit Ganguly

In India, visitors to elite hotels encounter what has now become a familiar drill: a body scan and a check of one’s belongings. If they arrive by car, guards also look inside the vehicle’s trunk and hood. These security precautions were put in place almost immediately after the Nov. 26, 2008, terrorist attacks in Mumbai, which included targets such as the city’s iconic Taj Mahal Palace Hotel. But the decade-old hotel checks are perfunctory; it is not difficult to imagine even a petty criminal bypassing the guards, let alone a trained terrorist. And worse, the half-hearted security measures characterise a larger issue, which is that more than a decade after the most devastating terrorist attack on Indian soil, the country’s security establishment has failed to rectify crucial systemic flaws.

The 2008 attacks, widely attributed to members of the Pakistan-based terrorist organisation Lashkar-e-Taiba, are newly relevant because of last week’s coordinated suicide bombings across Sri Lanka, which killed more than 300 people. Perhaps inspired by Mumbai’s model, the targets in Sri Lanka included luxury hotels in Colombo, likely because that is where the perpetrators would be able to kill wealthy tourists—and how they would capture global media attention.

India’s 2008 experience is also back in the public consciousness because of the new film Hotel Mumbai. Starring the well-known international actors Dev Patel, Armie Hammer, Nazanin Boniadi, Jason Isaacs, and Anupam Kher, the movie provides a compelling account of the coordinated assault that gripped the country’s financial capital for nearly 72 hours. And while the attacks spanned several locations—including a heavily trafficked railway terminal, a Jewish outreach centre, and a posh hotel called the Oberoi—the movie recounts three days and nights of horror mostly from within one hotel, the glamorous Taj.

As with any film, Hotel Mumbai takes cinematic liberties by changing the sequence of a few events and adding fictional scenes for dramatic effect. However, for the most part, the film deftly captures the fear that this unprecedented attack unleashed on a hapless city’s inhabitants and visitors.

Patel, a British actor of Indian origin cast in the role of a hotel employee, provides an accurate yet painful glimpse of the profound inequality that defines modern India. After waking up in a squalid slum, quickly grooming himself, and dropping off his child at an improvised day care, he wends his way to the gleaming Taj hotel barely in time for his shift. Throughout the film his character showcases how those on the lower rungs of the hospitality industry are expected to be suitably obsequious as they attend to the whims of the country’s wealthy and powerful.

Most importantly, Hotel Mumbai deserves credit for depicting India’s shambolic security response.

Mumbai’s police are shown to be hopelessly ill-equipped and outgunned. Were it not for the courage of these police officers and the selfless acts of the Taj’s hotel staff, the overall death toll for the attacks could have stretched well beyond the official count of 174. The mettle of the hotel staff is embodied by the performance of Kher, a veteran Indian actor who plays the role of the real-life head chef of the hotel, Hemant Oberoi. As the terrorists open fire across the Taj, Oberoi saves several lives by calmly moving guests into an exclusive section of the hotel, the Chambers. The question, however, is why heroes like Oberoi were needed in the first place. What steps has India taken to secure its cities from a re-occurrence?

It is now well known that Indian intelligence agencies had received warnings from their U.S. counterparts about an impending attack. However, there were no specific alerts. When the attacks began, local and national security authorities were caught flat-footed. It turned out India had no dedicated counter terrorism force. And the country’s elite National Security Guard (NSG) commandos were in a base just outside New Delhi, with no local presence in or around Mumbai. When the commandos were informed about the attack, they lacked a dedicated aircraft to fly to Mumbai. As a result, they arrived at the scene nine hours after the attack began, by which time the terrorists had not only killed dozens of people but had also taken hostages at the Taj hotel, prolonging the attack for a further two days.

Other structural and idiosyncratic factors worsened the response to the crisis. Routine police work is controlled by individual states in India. As a result, federal police or paramilitary forces can, under most circumstances, only be deployed when a state government explicitly seeks their services. Accordingly, the state government of Maharashtra, of which Mumbai is the capital, had to specifically ask the central government to send in NSG forces to cope with the onslaught. This established procedure, in turn, wasted critical hours.

Flawed choices worsened the crisis. Shivraj Patil, who as minister of home affairs was at the time the nation’s top law enforcement official, announced on national television the deployment of NSG units to Mumbai. The terrorist handlers in Pakistan, who were in real-time contact with their charges, promptly alerted them to the imminent departure of the commandos for Mumbai. Any hint of surprise that the commandos may have enjoyed was effectively squandered. As Hotel Mumbai depicts, the terrorists began to seize hostages in response to the deployment of NSG forces.

Has India done enough to ensure that similar attacks don’t occur again?

After 2008, there was a flurry of proposals to secure urban areas and enhance maritime security. Only a few of those plans have been realised. Today there are NSG hubs in some large Indian cities. India has created a National Investigation Agency to tackle terrorist violence. The Mumbai police has a dedicated counter terrorism unit within its ranks. Some efforts have been made to secure India’s vast coastline. But there are still several well-known systemic flaws that can be exploited. In the event of a crisis, individual states still need to formally request federal help, which could slow down response times. The security of ports remains patchy: Coastal police still lack adequate equipment and, in 2016, an Indian Intelligence Bureau audit concluded that 187 out of 227 minor ports still lacked any meaningful security measure. Some national security precautions, while implemented, are not taken seriously: At Mumbai’s Chhatrapati Shivaji Railway Terminus, the site of a major massacre during the 2008 terrorist attacks, metal detectors routinely go off as local police pay scant heed. And at hotels across the country, guards make a show of scanning guests, but it is well known that the checks are easy to sidestep. India’s security personnel remain outgunned: While a series of checkpoints have been set up across cities such as Mumbai, the police manning them are armed with World War II-era rifles.

Other institutional reforms announced in the aftermath of the 2008 attacks remain in abeyance. For example, plans were made for the creation of an apex National Counter Terrorism Centre, modelled along the lines of the United States’ organisation of the same name. However, owing to both political and bureaucratic constraints, this entity has yet to be set up. Similarly, a national grid for the sharing of intelligence across various agencies remains in limbo, as intelligence organisations are still unwilling to share information with one another. Other critical gaps also remain. For example, most railway stations still do not have bomb detection and disposal squads. India is especially vulnerable along its coastline: While fishing boats of 20 feet or longer are required to have automated identification systems, smaller boats face no such requirements. Fisherman are required to have biometric identification but there are no checks on whether they have them or not. All of this is especially galling because the Mumbai attackers came ashore at a small fishing village near the city, and on a small boat.