Trapwire Stratfor Email 34

RE: Counterterrorism: Shifting from 'Who' to 'How'

Released on 2012-08-09 18:00 GMT
Email-ID 	376889
Date 	2009-11-05 01:46:25
From 	[email protected]
To 	[email protected]
Appreciate the update Fred. Thanks and all the best. Hope the new book is
working out
for you. Steve

Very respectfully,

Steve Musgrove


> From: [email protected]
> To: [email protected]
> Subject: Counterterrorism: Shifting from 'Who' to 'How'
> Date: Wed, 4 Nov 2009 16:57:03 -0600
>
>
>
> COUNTERTERRORISM: SHIFTING FROM 'WHO' TO 'HOW'
>
> By Scott Stewart and Fred Burton
>
> In the 11th edition of the online magazine Sada al-Malahim (The Echo of
> Battle), which was released to jihadist Web sites last week, al Qaeda in
the
> Arabian Peninsula (AQAP) leader Nasir al-Wahayshi wrote an article that
> called for jihadists to conduct simple attacks against a variety of
targets.
> The targets included "any tyrant, intelligence den, prince" or
"minister"
> (referring to the governments in the Muslim world like Egypt, Saudi
Arabia
> and Yemen), and "any crusaders whenever you find one of them, like at
the
> airports of the crusader Western countries that participate in the wars
> against Islam, or their living compounds, trains etc.," (an obvious
> reference to the United States and Europe and Westerners living in
Muslim
> countries).
>
>
> Al-Wahayshi, an ethnic Yemeni who spent time in Afghanistan serving as a
> lieutenant under Osama bin Laden, noted these simple attacks could be
> conducted with readily available weapons such as knives, clubs or small
> improvised explosive devices (IEDs). According to al-Wahayshi, jihadists
> "don't need to conduct a big effort or spend a lot of money to
manufacture
> 10 grams of explosive material" and that they should not "waste a long
time
> finding the materials, because you can find all these in your mother's
> kitchen, or readily at hand or in any city you are in."
>
> That al-Wahayshi gave these instructions in an Internet magazine
distributed
> via jihadist chat rooms, not in some secret meeting with his operational
> staff, demonstrates that they are clearly intended to reach grassroots
> jihadists -- and are not intended as some sort of internal guidance for
AQAP
> members. In fact, al-Wahayshi was encouraging grassroots jihadists to
"do
> what Abu al-Khair did" referring to AQAP member Abdullah Hassan Taleh
> al-Asiri, the Saudi suicide bomber who attempted to kill Saudi Deputy
> Interior Minister Prince Mohammed bin Nayef with a small IED on Aug. 28.
>
> The most concerning aspect of al-Wahayshi's statement is that it is
largely
> true. Improvised explosive mixtures are in fact relatively easy to make
from
> readily available chemicals -- if a person has the proper training --
and
> attacks using small IEDs or other readily attainable weapons such as
knives
> or clubs (or firearms in the United States) are indeed quite simple to
> conduct.
>
> As STRATFOR has noted for several years now, with al Qaeda's structure
under
> continual attack and no regional al Qaeda franchise groups in the
Western
> Hemisphere, the most pressing jihadist threat to the U.S. homeland at
> present stems from grassroots jihadists, not the al Qaeda core. This
trend
> has been borne out by the large number of plots and arrests over the
past
> several years, to include several so far in 2009. The grassroots have
> likewise proven to pose a critical threat to Europe (although it is
> important to note that the threat posed by grassroots operatives is more
> widespread, but normally involves smaller, less strategic attacks than
those
> conducted by the al Qaeda core).
>
> From a counterterrorism perspective, the problem posed by grassroots
> operatives is that unless they somehow self-identify by contacting a
> government informant or another person who reports them to authorities,
> attend a militant training camp, or conduct electronic correspondence
with a
> person or organization under government scrutiny, they are very
difficult to
> detect.
>
> The threat posed by grassroots operatives, and the difficulty
identifying
> them, highlight the need for counterterrorism programs to adopt a
proactive,
> protective intelligence approach to the problem -- an approach that
focuses
> on "the how" of militant attacks instead of just "the who."
>
> The How
>
> In the traditional, reactive approach to counterterrorism, where
authorities
> respond to a crime scene after a terrorist attack to find and arrest the
> militants responsible for the attack, it is customary to focus on the
who,
> or on the individual or group behind the attack. Indeed, in this
approach,
> the only time much emphasis is placed on the how is either in an effort
to
> identify a suspect when an unknown actor carried out the attack, or to
prove
> that a particular suspect was responsible for the attack during a trial.
> Beyond these limited purposes, not much attention is paid to the how.
>
> In large part, this focus on the who is a legacy of the fact that for
many
> years, the primary philosophy of the U.S. government was to treat
> counterterrorism as a law-enforcement program, with a focus on
prosecution
> rather than on disrupting plots.
>
> Certainly, catching and prosecuting those who commit terrorist attacks
is
> necessary, but from our perspective, preventing attacks is more
important,
> and prevention requires a proactive approach. To pursue such a proactive
> approach to counterterrorism, the how becomes a critical question. By
> studying and understanding how attacks are conducted -- i.e., the exact
> steps and actions required for a successful attack -- authorities can
> establish systems to proactively identify early indicators that planning
for
> an attack is under way. People involved in planning the attack can then
be
> focused on, identified, and action can be taken prevent them from
conducting
> the attack or attacks they are plotting. This means that focusing on the
how
> can lead to previously unidentified suspects, e.g., those who do not
> self-identify.
>
> "How was the attack conducted?" is the primary question addressed by
> protective intelligence, which is, at its core, a process for
proactively
> identifying and assessing potential threats. Focusing on the how, then,
> requires protective intelligence practitioners to carefully study the
> tactics, tradecraft and behavior associated with militant actors
involved in
> terrorist attacks. This allows them to search for and identify those
> behaviors before an attack takes place. Many of these behaviors are not
by
> themselves criminal in nature; visiting a public building and observing
> security measures or standing on the street to watch the arrival of a
VIP at
> their office are not illegal, but they can be indicators that an attack
is
> being plotted. Such legal activities ultimately could be overt actions
in
> furtherance of an illegal conspiracy to conduct the attack, but even
where
> conspiracy cannot be proved, steps can still be taken to identify
possible
> assailants and prevent a potential attack -- or at the very least, to
> mitigate the risk posed by the people involved.
>
> Protective intelligence is based on the fact that successful attacks
don't
> just happen out of the blue. Rather, terrorist attacks follow a
discernable
> attack cycle. There are critical points during that cycle where a plot
is
> most likely to be detected by an outside observer. Some of the points
during
> the attack cycle when potential attackers are most vulnerable to
detection
> are while surveillance is being conducted and weapons are being
acquired.
> However, there are other, less obvious points where people on the
lookout
> can spot preparations for an attack.
>
> It is true that sometimes individuals do conduct ill-conceived, poorly
> executed attacks that involve shortcuts in the planning process. But
this
> type of spur-of-the-moment attack is usually associated with mentally
> disturbed individuals and it is extremely rare for a militant actor to
> conduct a spontaneous terrorist attack without first following the steps
of
> the attack cycle.
>
> To really understand the how, protective intelligence practitioners
cannot
> simply acknowledge that something like surveillance occurs. Rather, they
> must turn a powerful lens on steps like preoperational surveillance to
gain
> an in-depth understanding of them. Dissecting an activity like
> preoperational surveillance requires not only examining subjects such as
the
> demeanor demonstrated by those conducting surveillance prior to an
attack
> and the specific methods and cover for action and status used. It also
> requires identifying particular times where surveillance is most likely
and
> certain optimal vantage points (called perches in surveillance jargon)
from
> where a surveillant is most likely to operate when seeking to surveil a
> specific facility or event. This type of complex understanding of
> surveillance can then be used to help focus human or technological
> countersurveillance efforts where they can be most effective.
>
> Unfortunately, many counterterrorism investigators are so focused on the
who
> that they do not focus on collecting this type of granular how
information.
> When we have spoken with law enforcement officers responsible for
> investigating recent grassroots plots, they gave us blank stares in
response
> to questions about how the suspects had conducted surveillance on the
> intended targets. They simply had not paid attention to this type of
detail
> -- but this oversight is not really the investigators' fault. No one had
> ever explained to them why paying attention to, and recording, this type
of
> detail was important. Moreover, it takes specific training and a
practiced
> eye to observe and record these details without glossing over them. For
> example, it is quite useful if a protective intelligence officer has
first
> conducted a lot of surveillance, because conducting surveillance allows
one
> to understand what a surveillant must do and where he must be in order
to
> effectively observe surveillance of a specific person or place.
>
> Similarly, to truly understand the tradecraft required to build an IED
and
> the specific steps a militant needs to complete to do so, it helps to go
to
> an IED school where the investigator learns the tradecraft firsthand.
> Militant actors can and do change over time. New groups, causes and
> ideologies emerge, and specific militants can be killed, captured or
retire.
> But the tactical steps a militant must complete to conduct a successful
> attack are constant. It doesn't matter if the person planning an attack
is a
> radical environmentalist, a grassroots jihadist or a member of the al
Qaeda
> core, for while these diverse actors will exhibit different levels of
> professionalism in regard to terrorist tradecraft, they still must
follow
> essentially the same steps, accomplish the same tasks and operate in the
> same areas. Knowing this allows protective intelligence to guard against
> different levels of threats.
>
> Of course, tactics can be changed and perfected and new tactics can be
> developed (often in response to changes in security and law enforcement
> operations). Additionally, new technologies can emerge (like cell phones
and
> Google Earth) -- which can alter the way some of these activities are
> conducted, or reduce the time it takes to complete them. Studying the
> tradecraft and behaviors needed to execute evolving tactics, however,
allows
> protective intelligence practitioners to respond to such changes and
even
> alter how they operate in order to more effectively search for potential
> hostile activity.
>
> Technology does not only aid those seeking to conduct attacks. There are
a
> variety of new tools, such as Trapwire, a software system designed to
work
> with camera systems to help detect patterns of preoperational
surveillance,
> that can be focused on critical areas to help cut through the fog of
noise
> and activity and draw attention to potential threats. These
technological
> tools can help turn the tables on unknown plotters because they are
designed
> to focus on the how. They will likely never replace human observation
and
> experience, but they can serve as valuable aids to human perception.
>
> Of course, protective intelligence does not have to be the sole
> responsibility of federal authorities specifically charged with
> counterterrorism. Corporate security managers and private security
> contractors should also apply these principles to protecting the people
and
> facilities in their charge, as should local and state police agencies.
In a
> world full of soft targets -- and limited resources to protect those
targets
> from attack -- the more eyes looking for such activity the better. Even
the
> general public has an important role to play in practicing situational
> awareness and spotting potential terrorist activity.
>
> Keeping it Simple?
> Al-Wahayshi is right that it is not difficult to construct improvised
> explosives from a wide range of household chemicals like peroxide and
> acetone or chlorine and brake fluid. He is also correct that some of
those
> explosive mixtures can be concealed in objects ranging from electronic
items
> to picture frames, or can be employed in forms ranging from hand
grenades to
> suicide vests. Likewise, low-level attacks can also be conducted using
> knives, clubs and guns.
>
> Furthermore, when grassroots jihadists plan and carry out attacks acting
as
> lone wolves or in small compartmentalized cells without inadvertently
> betraying their mission by conspiring with people known to the
authorities,
> they are not able to be detected by the who-focused systems, and it
becomes
> far more difficult to discover and thwart these plots. This focus on the
how
> absolutely does not mean that who-centered programs must be abandoned.
> Surveillance on known militants, their associates and communications
should
> continue, efforts to identify people attending militant training camps
or
> fighting in places like Afghanistan or Somalia must be increased, and
people
> who conduct terrorist attacks should be identified and prosecuted.
>
> However -- and this is an important however -- if an unknown militant is
> going to conduct even a simple attack against some of the targets
> al-Wahayshi suggests, such as an airport, train, or specific leader or
media
> personality, complexity creeps into the picture, and the planning cycle
must
> be followed if an attack is going to be successful. The prospective
attacker
> must observe and quantify the target, construct a plan for the attack
and
> then execute that plan. The demands of this process will force even an
> attacker previously unknown to the authorities into a position where he
is
> vulnerable to discovery. If the attacker does this while there are
people
> watching for such activity, he will likely be seen. But if he does this
> while there are no watchers, there is little chance that he will become
a
> who until after the attack has been completed.
>
>
> This report may be forwarded or republished on your website with
attribution
> to www.stratfor.com.
>
> Copyright 2009 Stratfor.
>
>
>