Since 9/11, the role of law enforcement has shifted with ever larger numbers of officers now working in counter terrorism.  Over 1,000 NYPD officers are engaged in CT; and 700 officers of the LAPD work directly in CT.  The effort includes community outreach to (for example) Muslim populations to develop positive ties and establish communication and trust.  The CT effort also involves the gathering, analysis and dissemination of intelligence.  CT HUMINT is an efficient and effective addition to the job description of law enforcement officers who are already working on the streets and intimately familiar with their communities.  Homeland Security is a national effort made better when played out locally.

COMINT and SIGINT offer amazing resources but sometimes no intelligence is as critical as that obtained via human interaction.  Having law enforcement take on this role naturally involves a job description adjustment that in turn requires new training.   A modified set of skills is needed for a law enforcement officer to be able to identify targets within an appropriate context.  What’s more, in order to recruit and cultivate sources, a HUMINT operator working on any level needs to understand the culture, politics and practices of the target community.  But perhaps the most important tool in the kit is being able to skillfully develop personal relationships.  Good HUMINT can’t be dictated.  It doesn’t arrive in a neat package.  It is up to the officers in the field to develop the excellent communication and observation skills needed to bring well corroborated, actionable intel to the table.  It is not easy but it is critical to our broader success in the war on terrorism.

Can a security organization work well without the aid of external intelligence?  The answer is a resounding yes.  Often security agencies are dependent on government agencies for information.  The TSA looks to the FBI’s Terrorist Screening Center to provide the No Fly, Terrorist Watch and Selectee lists, for example. Government-supplied intelligence might concern a possible attack, identify a particular person of interest or a terrorist means of attack.  Intel broadcast may be general, or more specific.  But whether it concerns the identity of a potential adversary, suspicion indicators or is related to their methods of operation, it is although welcome, by its nature – limited.

A security system which relies solely on this kind of intel is vulnerable.  Likewise, a system which relies solely on intelligence it derives on its own can be very effective.  The real intelligence exists on the inside and comes from our own internal understanding of the operational environment in which we work and what it takes on the part of an adversary to beat it.

Looked at another way, when someone else is providing you with the intel, it’s hard to know what information you do not have.  The intel begets questions including: what’s the larger picture?  what pieces if any are missing?  what does the intel mean to us, in our particular security context?

How many CIA officers know the detailed, inner workings of a U.S. airport?  It makes sense that the folks working within a system know it best.  Just as you know best how to infiltrate your own house: where the goods are hidden, the best times of day to attack, which neighbors to avoid and which window has the broken lock.

Externally derived intelligence is supportive and provides an important peripheral ring to a security system.  But when we rely too heavily on it and it fails, so too does security fail.  The Christmas Bomber is but one example of this.

Creating and maintaining an independent system where we identify the methods of operation on our own results in actionable intel that takes the form of the identities of adversaries and suspicious individuals, of various MOs and suspicion indicators.  The information we need to provide excellent security resides within the system itself.

The longest international border in the world (4,000 miles) is getting safer.  As part of a $30 million project the Operational Integration Centre opened officially this month at Selfridge Air Force Base in Michigan.  Information flows into the center from 22 high tech cameras mounted on 11 surveillance towers located along the U.S. side of the St Clair River.  From the high tech control room, officers can monitor video feeds from those cameras as well as from Coast Guard helicopters and unmanned aerial vehicles.  Boats moving along the waterways are tracked by radar.

This configuration gives operators the flexibility to take a closer look at activity they identify (via radar, for example) as suspicious.

Historically, the Canada-United States border has been proudly porous, with residents on either side feeling more like neighbors than disparate foreign nationals.  But the advent of terrorism combined with Canada’s open and liberal immigration policies has resulted in a wide variety of terrorists currently operating in Canada, a jumping point into the U.S. which is the primary target of their efforts.

Earlier this year, the U.S. General Accounting Office issued a report saying that U.S. Customs and Border Protection agents have secured less than 1 percent (about 32 miles) of the Canada-U.S. border.  Regardless of one’s definition of ‘secure’, it’s a dismal showing albeit a daunting task.  The OIC seems a really good step in the right direction.

But in addition to upgraded technology, there is the unique participation with the Royal Canadian Mounted Police who have a full-time intelligence agent stationed at the OIC.  Information can be passed via the RCMP to other Canadian police and border agencies, in real time.  This kind of international partnership, resource and information sharing is simply invaluable.

So …. should this level of attention next be brought to bear on that other North American border, you know, the quiet one between Mexico and the U.S.?

Last week a French chartered German cargo ship sailing under Liberian flag was intercepted carrying 50 tons of weapons.  The weapons cache included: 2,500 (120mm and 60mm) mortar shells, 75,000 bullets, 2 radar systems with hydraulic mounting cranes, 2 launchers, and six C-704 anti ship missiles which carry 130 kg warheads to a range of 35 km.  The arms were concealed behind sacks of lentils and cotton and distributed throughout 36 containers on the ship.  Instruction materials printed in Farsi (the language of Iran) were found with the cache very likely destined for Hamas in Gaza, courtesy of Iran, one of that terrorist organization’s prime benefactors.  The journey began in Syria with a stop in Turkey on its way to its destination in Alexandria, Egypt.  The smuggling tunnels connecting Egypt to Gaza are routinely used to move arms shipments to Hamas.

The Israeli government was quick to note that Turkey was not complicit but it’s clear that smuggling is an international affair.  One should think that fighting the armament side of terrorist activity is best accomplished with international cooperation.

There is a long history of smuggling into the area and there have been several captures at sea of note over the past decade.  Larger arms are often smuggled by sea.  Given the size of the Mediterranean, and the relentless motivation of Iran to provide weapons to various terrorist factions, the task of intercepting smuggled arms is daunting.  Ships don’t exactly line up like passengers at a TSA security checkpoint.

This attempted infiltration was thwarted primarily through intelligence which time and again the most effective tool in the counter-terrorism toolbox.   It has been reported that IDF and US intelligence had been closely watching the movements of the Iranian destroyer and cruiser that traversed the Suez Canal late last month en route to Turkey, eventually leading to the interception of the Victoria.

Link below to a brief video describing the operation.

Sometimes it seems the distinction between counter terrorism versus counter insurgency gets blurred.   After all, if the war on terror is global, what’s the difference if it’s being fought over here, or over there?  Indeed, the main issue distinguishing these efforts is where the enemy is operating.  In terrorism, they are working within your environment.  With insurgents, you are fighting them in theirs. 

Timelines for withdrawal aside, the Petraeus COIN doctrine spells out neatly the strategies to win a battle that go well beyond firepower to political, diplomatic, psychological, economic and social concerns.  A war of hearts, minds and pockets.  Alas, with few exceptions, most counter insurgencies fail.  Absent brutal broad strokes that decimate a population beyond the insurgents themselves (the U.S. versus native Americans, or vs. the Philippines at the turn of the 20^th c), insurgency is a real challenge to counter.  How many such campaigns can you count that have succeeded?

Although some would put them under the same wide umbrella, terrorism and insurgency are fundamentally different.  While both terrorize, operationally they deal with different considerations and even immediate objectives.  Here are a couple of ways they differ:

• To commit a successful terrorist attack usually takes 1-5 years to plan; to commit a successful insurgent attack could take only hours to plan, even less.
• Insurgents usually operate in larger, sectarian or tribal groups; terrorists – even if they belong to a large terrorist operation – their operational units are small.
• Depending on their capabilities, insurgents use military guerilla tactics; terrorists maneuver more like an intelligence operative does: infiltration, recruitment, using covers, etc.

In modern times, and especially against democratic regimes like the U.S. and the West, insurgents find terrorism an attractive means for obtaining their political objectives.  The Madrid train bombings in 2004 are a good example of how a terrorist attack succeeded in removing a country from its territory.  That would not have occurred if a Spanish soldier(s) had been assassinated in Iraq.

In counter terrorism the adversary is the odd man out.   In counter insurgency, it is the target (soldier) that deviates from the norm.  In some geographic locations, activities swing between counter insurgency and counter terrorism.   When the military protects its own bases in Afghanistan, it is conducting counter terrorism.  But when that military moves to the streets of Kabul, it is engaging in counter insurgency.  Of course, on the periphery of the base and the outskirts of Kabul, what is being countered is less clear.

Nadia and Paul Rockwood were arrested by the FBI and last week pleaded guilty to charges of domestic terrorism which involved plotting the assassination of more than a dozen targets. The targets were people whom Paul, a convert to Islam and a follower of Anwar al-Awlaki, had identified as having desecrated Islam. It was to be his violent contribution to the Jihadi war against America.

This is a disconcerting story.  One wonders gee, which of my neighbors or colleagues is other than what they seem?  Heaven forbid we start spying on our neighbors and in any event, as the Rockwood case illustrates, it would not have helped.  According to friends and neighbors, nothing in their demeanor or conversation would have given them away.

The thread that no doubt lead the FBI to Alaska was the al-Awlaki connection.  The cleric casts a mesmerizing spell and Rockwood wasn’t the first to fall for it.  Keeping tabs on webs woven by the al-Awlakis of our world, scouring all sources for good intelligence and learning all we can about the fanaticism that fuels terrorists seems to be the best path for mitigating the threat of domestic terrorism.

Mosab Hassan Yousef is once again in the news.  We last heard of him at the launch of his book Son of Hamas , detailing his experiences as a Palestinian spy working for Israel’s Shin Bet (Israel Security Agency).  Lately, he had been busy fighting a deportation attempt by the U.S. government on the basis that Mr. Yousef consorted with terrorists.  Since then he has been granted asylum.  Aside from the deportation attempt, the story of Mr. Yousef raises questions that have not been asked by the media covering the case.  What really caused him to flip?

Intelligence handlers will tell you that it takes profound and very personal motives to leverage a betrayal and to convince someone to become an agent despite the fatal risks involved.

Mr. Yousef is no run of the mill young man.  He is the son of the founder of Hamas, and was raised in a very closed Arab Muslim society where one is a member of a social group first, where family, status, honor, religion and culture define you as a person.  Maintaining one’s honor and that of your family is everything.  You are an individual only secondarily.  In such a close knit environment, betrayal has only one fate: death.  In order to motivate someone to commit a betrayal of this magnitude, a HUMINT source operator must rely on a very, very strong motive.  In this case it could be any social deviation, for example a sexual one, or committing a dishonorable act.

Mr. Yousef enjoyed special status and was the heir apparent to head Hamas; money does not seem to have been an obvious motivator.  According to his book and to reports, the recruitment took place in prison where at least among the Palestinian prisoners his status would have been very high and would have garnered him a certain level of protection and respect.  Yousef claimed to have been ‘shocked’ by the Hamas behaviors he saw in prison yet these were people he had grown up around.  He had been groomed to be a terrorist.  He was privy to the stories and exploits of Hamas members including de facto ex-prisoners of Israeli prisons.  It seems unlikely that anything he saw of his fellow inmates would have been a revelation and further, that what he learned about Hamas there rendered him a traitor.  (Side note: his conversion to Christianity occurred after his cross over to the Israelis.)

The explanations he provides in his book and interviews about his reasons for flipping, seem not to hold water, specifically to those who understand the society and close familial structure in which he operated.  These explanations may satisfy a western audience as plausible but are not convincing to professional HUMINT operators and/or to those who come his background.

Mr. Yousef acknowledges that he “was a traitor, to my family, to my nation, to my God.  I crossed all the red lines in my society.  I didn’t leave one that I didn’t cross.”

The intensely strong motivation that would fuel his willingness to betray everything in his life, may not yet or ever be identified.  One wonders why Yousef hasn’t yet been assassinated by Hamas for this phenomenal betrayal.  It may be that the circumstances that fueled his willingness to betray is the very thing protecting his life.  Perhaps killing him would reveal the circumstances that – in and of themselves – are far more damaging to Hamas and his family.

Chameleon Associates provided the US Army 5/2 Stryker Brigade with Predictive Profiling and Field Intelligence Training as part of their Language Enabled Soldier Program. Parts of the training were conducted in Arabic.  The training provided soldiers with tools to identify suspicion indicators in high risk environments. Here is the case study for the LES program which includes Predictive Profiling training as presented by Col. Tunnell, Commander of the 5/2 Stryker Brigade:

http://www.chameleonassociates.com/Predictive_Profiling_LES_US_Army.pdf

Predictive Profiling becomes especially important to a soldier working in an environment that is not familiar to him. Predictive Profiling is much easier when one knows the norms in his surroundings, but when facing am unfamiliar culture, language and environment Profiling becomes a lot harder. This is exactly the situation a soldier facesbeing deployed in Afghanistan or Iraq. Predictive Profiling is as much a counter insurgency tool as it is counterterrorist or security methofology.

It was announced today that the TSA will be using new intelligence-based screening guidelines that should cause fewer problems for some foreign travelers who were previously put under extra scrutiny simply because of the countries from which they came.

Residents from 14 specific countries had been subject to more intensive screening procedures since the U.S. introduced new rules in the wake of the failed Christmas Day bombing attack. That meant that all travelers from Afghanistan, Algeria, Cuba, Iran, Iraq, Lebanon, Libya, Nigeria, Pakistan, Saudi Arabia, Somalia, Sudan, Syria and Yemen were singled out for extra attention — including full-body pat-downs by TSA personnel

But now, other passenger information will also be scrutinized: their travel patterns, whether their ticket was paid for in cash, what stops they may be making in their journey, if they are traveling alone, and other behavioral data. A filtering process can zero in on whatever characteristics may be considered of interest at the time…

These new security procedures taken today by TSA are a step in the right direction and in fact, they should be implemented to every passenger on any flight regardless of nationality or port of origin. With intelligence based screening data mining applications detect patterns/suspicions in a traveler’s ticket information and from other  sources; all of which indicate a potential terrorist threat from a specific passenger.

As many of you know, detecting the suspicion indicator is the easiest part of any screening process. In fact, on 9/11 nine out of the nineteen hijackers were deemed suspicious by the Computer Assisted Passenger Pre-Screening System (CAPPS) and by airline representatives. Richard Reid, the
Shoe Bomber, was also identified as suspicious by a profiler at Paris Airport on the day he planned to blow up an American Airline flight bound to Miami.  These examples and many others prove that the true vulnerability in aviation security screening does not rest in the detection of the suspicion but rather in trying to determine the MO and choosing the appropriate security measure against the MO.

With the new“intelligence based screening, detection efforts will be improved. It is however the determination skills that must be enhanced.  TSA screeners must retain the skills and the authority to determine the potential terrorist MO they are faced with. Terrorist MOs such as hijacking, surveillance, dry run, suicide bombing on the aircraft in mid-air, unintentional mule, semi-intentional mule etc.

All the terrorist MOs mentioned above require different security procedure to counter them. Searching for a bomb on someone who was identified as an unintentional mule will be completely different than searching for a bomb on a traveler who is deemed a potential suicide terrorist. When searching an unintentional mule, the screener should look for a fully assembled bomb ready to be activated by a non-human detonation mechanism (barometric, GPS, cellular phone etc.). The search in this case, should be limited mostly to the mule’s language and belonging. When searching a potential suicide terrorist, the screener must look for the components of a bomb that could potentially be assembled to a bomb on board the plane. This requires  a very intrusive check of the traveler’s belonging as well as a  strip search and continued monitoring throughout the flight.

Conducting security screening based on adversarial methods of operation is the most effective (in cost and in results) and it the most intelligent, common sense approach to take towards threat mitigation. We must integrate intelligence based screening with intelligent screening to succeed in this counter-terrorism effort.

New media reports from the UK talk about new intelligence from the MI5 about Muslim doctors trained at some of Britain’s leading teaching hospitals have returned to their own countries to fit surgical implants filled with explosives. The reports also say that similar surgery has been performed on male suicide bombers. In their cases, the explosives are inserted in the appendix area or in a buttock. Both are parts of the body that diabetics use to inject themselves with their prescribed drugs.

While this MO seems like a great way to go undetected through security, it is not as easy of an MO to accomplish as it is portrayed to be. Bear in mind that the body itself can contain the blast and reduce the overall effectiveness of the bomb, detonation may be problematic as well as the likelihood of a technical malfunction. This type of MO involves contingencies that complicate this attack plan or method of operation.

Here is a video of one of the news report about the new “Booby Traps”: