ISPLA Security Related Topics

NYPD Counterterrorism Methods

Thu, 13 Oct 2011 18:10:44 GMT

Growing Concern Over the New York City Police Department's Counterterrorism Methods is Repudiated

By Scott Stewart

In response to the 9/11 attacks, the New York Police Department (NYPD) established its own Counter-Terrorism Bureau and revamped its Intelligence Division. Since that time, its methods have gone largely unchallenged and have been generally popular with New Yorkers, who expect the department to take measures to prevent future attacks.

Preventing terrorist attacks requires a very different operational model than arresting individuals responsible for such attacks, and the NYPD has served as a leader in developing new, proactive approaches to police counterterrorism. However, it has been more than 10 years since the 9/11 attacks, and the NYPD is now facing growing concern over its counterterrorism activities. There is always an uneasy equilibrium between security and civil rights, and while the balance tilted toward security in the immediate aftermath of 9/11, it now appears to be shifting back.

This shift provides an opportunity to examine the NYPD’s activities, the pressure being brought against the department and the type of official oversight that might be imposed.

Under Pressure

Reports that the NYPD’s Intelligence Division and Counter-Terrorism Bureau engage in aggressive, proactive operations are nothing new. STRATFOR has written about them since 2004, and several books have been published on the topic. Indeed, police agencies from all over the world travel to New York to study the NYPD’s approach, which seems to have been quite effective.

Criticism of the department’s activities is nothing new, either. Civil liberties groups have expressed concern over security methods instituted after 9/11, and Leonard Levitt, who writes a column on New York police activities for the website NYPD Confidential, has long been critical of the NYPD and its commissioner, Ray Kelly. Associated Press reporters Adam Goldman and Matt Apuzzo have written a series of investigative reports that began on Aug. 24 detailing “covert” NYPD activities, such as mapping the Muslim areas of New York. This was followed by the Aug. 31 publication of what appears to be a leaked NYPD PowerPoint presentation detailing the activities of the Intelligence Division’s Demographics Unit.

In the wake of these reports, criticism of the NYPD’s program has reached a new level. Members of the New York City Council expressed concern that their constituents were being unjustly monitored. Six New York state senators asked the state attorney general to investigate the possibility of “unlawful covert surveillance operations of the Muslim community.” A group of civil rights lawyers also asked a U.S. district judge in Manhattan to force the NYPD to publicize any records of such a program and to issue a court order to prevent their destruction. In response to the AP investigation, two members of Congress, Reps. Yvette Clarke, D-N.Y., and Rush Holt, D-N.J., asked the Justice Department to investigate. The heat is on.

After an Oct. 7 hearing regarding NYPD intelligence and counterterrorism operations, New York City Council Public Safety Committee Chairman Peter Vallone said, “That portion of the police department’s work should probably be looked at by a federal monitor.”

Following Vallone’s statement, media reports cited Congressional and Obama administration officials saying they have no authority to monitor the NYPD. While Vallone claims the City Council does not have the expertise to oversee the department’s operations, and the federal government says that it lacks the jurisdiction, it is almost certain that the NYPD will eventually face some sort of new oversight mechanisms and judicial review of its counterterrorism activities.

New York City and the Terrorist Threat

While 9/11 had a profound effect on the world and on U.S. foreign policy, it had an overwhelming effect on New York City itself. New Yorkers were willing to do whatever it took to make sure such an attack did not happen again, and when Kelly was appointed police commissioner in 2002, he proclaimed this as his primary duty (his critics attributed the focus to ego and hubris). This meant revamping counterterrorism and moving to an intelligence-based model of prevention rather than one based on prosecution.

The NYPD’s Intelligence Division, which existed prior to 9/11, was known mainly for driving VIPs around New York, one of the most popular destinations for foreign dignitaries and one that becomes very busy during the U.N. General Assembly. Before 9/11, the NYPD also faced certain restrictions contained in a 1985 court order known as the Handschu guidelines, which required the department to submit “specific information” on criminal activity to a panel for approval to monitor any kind of political activity. The Intelligence Division had a very limited mandate. When David Cohen, a former CIA analyst, was brought in to run the division, he went to U.S. District Court in Manhattan to get the guidelines modified. Judge Charles Haight modified them twice in 2002 and 2003, and he could very well review them again. His previous modifications allowed the NYPD Intelligence Division to proactively monitor public activity and look for indications of terrorist or criminal activity without waiting for approval from a review panel.

The Counter-Terrorism Bureau was founded in 2002 with analytical and collection responsibilities similar to those of the Intelligence Division but involving the training, coordination and response of police units. Differences between the two units are mainly bureaucratic and they work closely together.

As the capabilities of the NYPD’s Intelligence Division and Counter-Terrorism Bureau developed, both faced the challenges of any new or revamped intelligence organization. Their officers learned the trade by taking on new monitoring responsibilities, investigating plots and analyzing intelligence from plots in other parts of the United States and abroad. One of their biggest challenges was the lack of access to information from the federal government and other police departments around the United States. The NYPD also believed that the federal government could not protect New York. The most high-profile city in the world for finance, tourism and now terrorism, among other things, decided that it had to protect itself.

The NYPD set about trying to detect plots within New York as they developed, getting information on terrorist tactics and understanding and even deterring plots developing outside the city. In addition to the challenges it also had some key advantages, including a wealth of ethnic backgrounds and language skills to draw on, the budget and drive to develop liaison channels and the agility that comes with being relatively small, which allowed it to adapt to changing threat environments. The department was creating new organizational structures with specific missions and targeted at specific threats. Unlike federal agencies, it had no local competitors, and its large municipal budget was augmented by federal funding that has yet to face cyclical security budget challenges.

Looking for Plots

STRATFOR first wrote about the NYPD’s new proactive approach to counterterrorism in 2004. The NYPD’s focus moved from waiting for an attack to happen and then allowing police and prosecutors to “make the big case” to preventing and disrupting plots long before an attack could occur. This approach often means that operatives plotting attacks are charged with much lower charges than terrorism or homicide, such as document fraud or conspiracy to acquire explosives.

The process of looking for signs of a terrorist plot is not difficult to explain conceptually, but actually preventing an attack is extremely difficult, especially when the investigative agency is trying to balance security and civil liberties. It helps when plotters expose themselves prior to their attack and ordinary citizens are mindful of suspicious behavior. Grassroots defenders, as we call them, can look for signs of pre-operational surveillance, weapons purchasing and bombmaking, and even the expressed intent to conduct an attack. Such activities are seemingly innocuous and often legal undefined taking photos at a tourist site, purchasing nail-polish remover, exercising the right of free speech undefined but sometimes these activities are carried out with the purpose of doing harm. The NYPD must figure out how to separate the innocent act from the threatening act, and this requires actionable intelligence.

It is for this reason that the NYPD’s Demographics Unit, which is now apparently called the Zone Assessment Unit, has been carrying out open observation in neighborhoods throughout New York. Understanding local dynamics, down to the block-by-block level, provides the context for any threat reporting and intelligence that the NYPD receives. Also shaping perceptions are the thousands of calls to 911 and 1-888-NYC-SAFE that come in every day, partly due to the city’s “If you see something, say something” campaign. This input, along with observations by so-called rakers (undercover police officers) allows NYPD analysts to “connect the dots” and detect plots before an attack occurs. According to the AP reports, these rakers, who go to different neighborhoods, observe and interact with residents and look for signs of criminal or terrorist activity, have been primarily targeting Muslim neighborhoods.

These undercover officers make the same observations that any citizen can make in places where there is no reasonable expectation of privacy. Indeed, law enforcement officers from the local to the federal level across the country have been doing this for a long time, looking for indicators of criminal activity in business, religious and public settings without presuming guilt.

Long before the NYPD began looking for jihadists, local police have used the same methods to look for mafia activity in Italian neighborhoods, neo-Nazis at gun shows and music concerts, Crips in black neighborhoods and MS-13 members in Latino neighborhoods. Law enforcement infiltration into white hate groups has disrupted much of this movement in the United States. Location is a factor in any counterterrorism effort because certain targeted groups tend to congregate in certain places, but placing too much emphasis on classifications of people can lead to dangerous generalizations, which is why STRATFOR often writes about looking for the “how” rather than the “who.”

Understanding New Threats and Tactics

As the NYPD saw it, the department needed tactical information as soon as possible so it could change the threat posture. The department’s greatest fear was that a coordinated attack would occur on cities throughout the world and police in New York would not be ramped up in time to prevent or mitigate it. For example, an attack on transit networks in Europe at rush hour could be followed by an attack a few hours later in New York, when New Yorkers were on their way to work. This fear was almost realized with the 2004 train attacks in Madrid. Within hours of the attacks, NYPD officers were in Madrid reporting back to New York, but the NYPD claims the report they received from the FBI came 18 months later. There was likely some intelligence sharing prior to this report, but the perceived lack of federal responsiveness explains why the NYPD has embarked on its independent, proactive mission.

NYPD officers reportedly are located in 11 cities around the world, and in addition to facilitating a more rapid exchange of intelligence and insight, these overseas operatives are also charged with developing liaison relationships with other police forces. And instead of being based in the U.S. Embassy like the FBI’s legal attache, they work on the ground and in the offices of the local police. The NYPD believes this helps the department better protect New York City, and it is willing to risk the ire of and turf wars with other U.S. agencies such as the FBI, which has a broader mandate to operate abroad.

Managing Oversight and Other Challenges

The New York City Council does not have the same authority to conduct classified hearings that the U.S. Congress does when it oversees national intelligence activity. And the federal government has limited legal authority at the local level. What Public Safety Committee Chairman Vallone and federal government sources are implying is that they are not willing to take on oversight responsibilities in New York. In other words, while there are concerns about the NYPD’s activities, they are happy with the way the department is working and want to let it continue, albeit with more accountability. As oversight exists now, Kelly briefs Vallone on various NYPD operations, and even with more scrutiny from the City Council, any operations are likely be approved.

The NYPD still has to keep civil rights concerns in mind, not only because of a legal or moral responsibility but also to function successfully. As soon as the NYPD is seen as a dangerous presence in a neighborhood rather than a protective asset, it will lose access to the intelligence that is so important in preventing terrorist attacks. The department has plenty of incentive to keep its officers in line.

Threats and Dimwits

One worry is that the NYPD is overly focused on jihadists, rather than other potential threats like white supremacists, anarchists, foreign government agents or less predictable “lone wolves.”

The attack by Anders Breivik in Oslo, Norway, reminded police departments and security services worldwide that tunnel vision focused on jihadists is dangerous. If the NYPD is indeed focusing only on Muslim neighborhoods (which it probably is not), the biggest problem is that it will fail in its security mission, not that it will face prosecution for racial profiling. The department has ample incentive to think about what the next threat could be and look for new and less familiar signs of a pending attack. Simple racial profiling will not achieve that goal.

The modern history of terrorism in New York City goes back to a 1916 attack by German saboteurs on a New Jersey arms depot that damaged buildings in Manhattan. However unlikely, these are the kinds of threats that the NYPD will also need to think about as it tries to keep its citizens safe. The alleged Iranian plot to carry out an assassination in the Washington area underscores the possibility of state-organized sabotage or terrorism.

That there have been no successful terrorist attacks in New York City since 9/11 cannot simply be attributed to the NYPD. In the Faisal Shahzad case, the fact that his improvised explosive device did not work was just as important as the quick response of police officers in Times Square. Shahzad’s failure was not a result of preventive intelligence and counterterrorism work. U.S. operations in Afghanistan and other countries that have largely disrupted the al Qaeda network have also severely limited its ability to attack New York again.

The NYPD’s counterterrorism and intelligence efforts are still new and developing. As such, they are unconstrained compared to those of the larger legacy organizations at the federal level. At the same time, the department’s activities are unprecedented at the local level. As its efforts mature, the pendulum of domestic security and civil liberties will remain in motion, and the NYPD will face new scrutiny in the coming year, including judicial oversight, which is an important standard in American law enforcement. The challenge for New York is finding the correct balance between guarding the lives and protecting the rights of its people.

ISPLA is grateful for the permission granted by STRATFOR to republish this article. www.stratfor.com

Personal Protection

Thu, 28 Apr 2011 13:42:03 GMT

The Kapersky Kidnapping – Lessons Learned – Scott Stewart

On April 24, officers from the anti-kidnapping unit of Moscow’s Criminal Investigation Department and the Russian Federal Security Service (FSB) rescued 20-year-old Ivan Kaspersky from a dacha in Sergiev Posad, a small town about 40 miles northeast of Moscow. Kaspersky, the son of Russian computer software services billionaire Eugene Kaspersky (founder of Kaspersky Lab), was kidnapped on April 19 as he was walking to work from his Moscow apartment. A fourth-year computer student at Moscow State University, Kaspersky was working as an intern at a software company located near Moscow’s Strogino metro station.

Following the abduction, Kaspersky was reportedly forced to call his father and relay his captors’ demands for a ransom of 3 million euros ($4.4 million). After receiving the ransom call, the elder Kaspersky turned to Russian law enforcement for assistance. On April 21, news of the abduction hit the Russian and international press, placing pressure on the kidnappers and potentially placing Kaspersky’s life in jeopardy. In order to defuse the situation, disinformation was leaked to the press that a ransom had been paid, that Kaspersky had been released unharmed and that the family did not want the authorities involved. Kaspersky’s father also contacted the kidnappers and agreed to pay the ransom. Responding to the ruse, four of the five members of the kidnapping gang left the dacha where Kaspersky was being held to retrieve the ransom and were intercepted by Russian authorities as they left. The authorities then stormed the dacha, arrested the remaining captor and released Kaspersky. The five kidnappers remain in custody and are awaiting trial.

According to Russia’s RT television network, Russian officials indicated that the kidnapping was orchestrated by an older couple who were in debt and sought to use the ransom to get out of their financial difficulties. The couple reportedly enlisted their 30-year-old son and two of his friends to act as muscle for the plot. Fortunately for Kaspersky, the group that abducted him was quite unprofessional and the place where he was being held was identified by the cell phone used to contact Kaspersky’s father. Reports conflict as to whether the cell phone’s location was tracked by the FSB, the police anti-kidnapping unit or someone else working for Kaspersky’s father, but in any case, in the end the group’s inexperience and naivete allowed for Kaspersky’s story to have a happy ending.

However, the story also demonstrates that even amateurs can successfully locate and abduct the son of a billionaire, and some very important lessons can be drawn from this case.

The Abduction

According to the Russian news service RIA Novosti, Kaspersky’s abductors had been stalking him and his girlfriend for several months prior to the kidnapping. This pre-operational surveillance permitted the kidnappers to determine Kaspersky’s behavioral patterns and learn that he did not have any sort of security detail protecting him. Media reports also indicate that the kidnappers were apparently able to obtain all the information they required to begin their physical surveillance of the victim from information Kaspersky himself had posted on Vkontakte.ru, a Russian social networking site. According to RT, Kaspersky’s Vkontakte profile contained information such as his true name, his photo, where he was attending school, what he was studying, who he was dating, where we was working for his internship and even the addresses of the last two apartments where he lived.

Armed with this cornucopia of information, it would be very easy for the criminals to establish physical surveillance of Kaspersky in order to gather the additional behavioral information they needed to complete their plan for the abduction. Kaspersky also appears to have not been practicing the level of situational awareness required to detect the surveillance being conducted against him undefined even though it was being conducted by amateurish criminals who were undoubtedly clumsy in their surveillance tradecraft. This lack of awareness allowed the kidnappers to freely follow him and plot his abduction without fear of detection. Kaspersky made himself an easy target in a dangerous place for high net worth individuals and their families. While kidnapping for ransom is fairly rare in the United States, Russian law enforcement sources report that some 300 people are kidnapped for ransom every year in Russia.

Denial

In terms of being an easy target, Kaspersky was not alone. It is not uncommon for the children of high net worth families to want to break free of their family’s protective cocoon and “live like a regular person.” This means going to school, working, dating and living without being insulated from the world by the security measures in place around their parents and their childhood homes. This tendency was exemplified by the well-publicized example of George W. Bush’s twin daughters “ditching” their Secret Service security details so they could go out and party with their friends when they were in college.

Having personally worked as a member of an executive protection detail responsible for the security of a high net worth family, I have seen firsthand how cumbersome and limiting an executive protection detail can be undefined especially a traditional, overt-security detail. A low-key, “bubble-type” detail, which focuses on surveillance detection and protective intelligence, provides some space and freedom, but it, too, can be quite limiting and intrusive undefined especially for a young person who wants some freedom to live spontaneously. Because of the very nature of protective security, there will inevitably be a degree of tension between personal security and personal freedom.

However, when reacting to this tension, those protected must remember that there are very real dangers in the world undefined dangers that must be guarded against. Unfortunately, many people who reject security measures tend to live in a state of denial regarding the potential threats facing them, and that denial can land them in trouble. We have seen this mindset most strongly displayed in high net worth individuals who have recently acquired their wealth and have not yet been victimized by criminals. A prime example of this was U.S billionaire Eddie Lampert, who at the time of his abduction in 2003 did not believe there was any threat to his personal security. His first encounter with criminals was a traumatic kidnapping at gunpoint. But this mindset can also appear in younger members of well-established families of means who have not personally been victimized by criminals.

It is important to realize, however, that the choice between security and freedom does not have to be an either/or equation. There are measures that can be taken to protect high net worth individuals and children without employing a full protective security detail. These same measures can also be applied by people of more modest means living in places such as Mexico or Venezuela, where the kidnapping threat is pervasive and extends to almost every strata of society, from middle-class professionals and business owners to farmers.

In this type of environment, the threat also applies to mid-level corporate employees who serve tours as expatriate executives in foreign cities. Some of the cities they are posted in are among the most crime-ridden in the world, including such places as Mexico City, Caracas, Sao Paulo and Moscow. When placed in the middle of an impoverished society, even a mid-level executive or diplomat is, by comparison, incredibly rich. As a result, employees who would spend their lives under the radar of professional criminals back home in the United States, Canada or Europe can become prime targets for kidnapping, home invasion, burglary and carjacking in their overseas posts.

The Basics

Before anything else can be done to address the criminal threat, like any other issue, the fact that there is indeed a threat must first be recognized and acknowledged. As long as a potential target is in a state of denial, very little can be done to protect him or her.

Once the threat is recognized, the next step in devising a personal protection system is creating a realistic baseline assessment of the threat undefined and exposure to that threat. This assessment should start with some general research on crime and statistics for the area where the person lives, works or goes to school, and the travel corridors between these places. The potential for natural disasters, civil unrest undefined and in some cases the possibility of terrorism or even war undefined should also be considered. Based on this general crime-environment assessment, it might be determined that the kidnapping risk in a city such as Mexico City or Moscow will dictate that a child who has a desire to attend university without a protective security detail might be better off doing so in a safer environment abroad.

Building on these generalities, then, the next step should be to determine the specific threats and vulnerabilities by performing some basic analyses and diagnostics. In some cases, these will have to be performed by professionals, but they can also be undertaken by the individuals themselves if they lack the means to hire professional help. These analyses should include:

In-depth cyberstalking report. Most of the people for whom we have conducted such reports have been shocked to see how much private information analysts are able to dig up on the Internet. This information is available for free (or for a few dollars) to anyone, including criminals, who might be targeting people for kidnapping, extortion or other crimes. The problem of personal information being available on the Internet is magnified when potential targets gratuitously post personal information online, as in the Kaspersky case. Even in cases where personal information is available only to online “friends,” it is quite easy for savvy Internet users to use a false social networking account with an attractive photo to social engineer their way into a circle of friends using common pretexting tactics. Therefore, potential targets need to be extremely careful what they post online, and they also must be aware of what information about them is publicly available on the Internet and how that information may make them vulnerable to being targeted. If it is determined that the information available makes them too vulnerable, changes may have to be made.

Baseline surveillance diagnostics. Surveillance diagnostics is a blend of surveillance-detection techniques that are designed to determine if an individual is under systematic criminal surveillance. This can be conducted by the potential targets themselves, if they receive the necessary training, or by a specialized professional surveillance-detection team. As the name suggests, this diagnostic level helps establish a baseline from which to plan future security and surveillance-detection operations.

Route analysis. This type of analysis examines the regular travel routes of a potential target in order to identify locations such as choke points that can be used by criminals for surveillance or to conduct an attack. Route analysis can be performed by the same team that conducts surveillance diagnostics, or even by a potential target if the person will thoughtfully examine his or her daily travel routes. Such an analysis allows the potential target to be cognizant of such locations and of the need to increase situational awareness for signs of surveillance or a potential attack as he or she passes through them undefined especially during a highly predictable move like the morning home-to-work commute.

Physical security surveys. Such surveys are performed for the home, workplace or school of the potential target. While individuals can effectively conduct such surveys using common sense, a professional assessment can be useful and will often be performed for free by alarm companies. Obviously, any security upgrades required at a workplace or school will require coordination with the security managers for these locations.

Response capability assessment. This is a realistic assessment of the capabilities and responsiveness of the local police and security forces as well as fire and medical first-responders. In some places, security personnel themselves may be involved in criminal activity, or prove to be generally unresponsive or incompetent. Knowing their true capabilities is necessary to create a realistic security plan.

There are some very good private training facilities that can provide individuals with training in things like attack recognition/avoidance, surveillance detection and route analysis as well hands-on skills like tactical driving.

Guns Alone Are Not the Answer

Even if a potential target is being afforded a protection detail, it must be remembered that guards with guns are not in and of themselves a guarantee of security. If a group is brazen enough to undertake a kidnapping, they will in many cases and many places not hesitate to use deadly force in the commission of their crime. If they are given free rein to conduct pre-operational surveillance, they will be able to make plans to overcome any security measures in place, including the neutralizing of armed security personnel.

After recognizing that a threat indeed exists, the next key concept that potential targets need to internalize is that criminals are vulnerable to detection as they plan their crimes, and that ordinary people can develop the skills required to detect criminal activity and take measures to avoid being victimized. The fact is, most criminals practice terrible surveillance tradecraft. They are permitted to succeed in spite of their lack of skill because, for the most part, people simply do not practice good situational awareness.

The good news for potential targets is that being aware of one’s surroundings and identifying potential threats and dangerous situations is more a mindset or attitude than a hard skill. Because of this, situational awareness is not something that can be practiced only by highly trained government agents or specialized surveillance detection teams undefined it is something that can be practiced by anyone with the will and the discipline to do so. In the Kaspersky case, it is very likely that had the young man been practicing good situational awareness, he would have been able to note the criminals conducting surveillance on him and to take appropriate action to avoid being kidnapped.

Armed guards, armored vehicles and other forms of physical security are all valuable protective tools, but they can all be defeated by kidnappers who are allowed to form a plan and execute it at the time and place of their choosing. Clearly, a way is needed to deny kidnappers the advantage of striking when and where they choose or, even better, to stop a kidnapping before it can be launched. This is where the intelligence tools outlined above come into play. They permit the potential target, and any security officers working to protect them, to play on the action side of the action/reaction equation rather than passively waiting for something to happen.

ISPLA is grateful to Stratfor in granting permission to republish this article. www.stratfor.com

AVIATION SECURITY

Fri, 26 Nov 2010 16:06:27 GMT

Aviation Security Threats and Realities – Stratfor Global Intelligence - By Scott Stewart

Over the past few weeks, aviation security undefined specifically, enhanced passenger-screening procedures undefined has become a big issue in the media. The discussion of the topic has become even more fervent as we enter Thanksgiving weekend, which is historically one of the busiest travel periods of the year. As this discussion has progressed, we have been asked repeatedly by readers and members of the press for our opinion on the matter.

We have answered such requests from readers, and we have done a number of media interviews, but we’ve resisted writing a fresh analysis on aviation security because, as an organization, our objective is to lead the media rather than follow the media regarding a particular topic. We want our readers to be aware of things before they become pressing public issues, and when it comes to aviation-security threats and the issues involved with passenger screening, we believe we have accomplished this. Many of the things now being discussed in the media are things we’ve written about for years.

When we were discussing this topic internally and debating whether to write about it, we decided that since we have added so many new readers over the past few years, it might be of interest to our expanding readership to put together an analysis that reviews the material we’ve published and that helps to place the current discussion into the proper context. We hope our longtime readers will excuse the repetition.

We believe that this review will help establish that there is a legitimate threat to aviation, that there are significant challenges in trying to secure aircraft from every conceivable threat, and that the response of aviation security authorities to threats has often been slow and reactive rather than thoughtful and proactive.

Threats

Commercial aviation has been threatened by terrorism for decades now. From the first hijackings and bombings in the late 1960s to last month’s attempt against the UPS and FedEx cargo aircraft, the threat has remained constant. As we have discussed for many years, jihadists have long had a fixation with attacking aircraft. When security measures were put in place to protect against Bojinka-style attacks in the 1990s undefined attacks that involved modular explosive devices smuggled onto planes and left aboard undefined the jihadists adapted and conducted 9/11-style attacks. When security measures were put in place to counter 9/11-style attacks, the jihadists quickly responded by going to onboard suicide attacks with explosive devices concealed in shoes. When that tactic was discovered and shoes began to be screened, they switched to devices containing camouflaged liquid explosives. When that plot failed and security measures were altered to restrict the quantity of liquids that people could take aboard aircraft, we saw the jihadists alter the paradigm once more and attempt the underwear-bomb attack last Christmas.

In a special edition of Inspire magazine released last weekend, al Qaeda in the Arabian Peninsula (AQAP) noted that, due to the increased passenger screening implemented after the Christmas Day 2009 attempt, the group’s operational planners decided to employ explosive devices sent via air cargo (we have written specifically about the vulnerability of air cargo to terrorist attacks).

Finally, it is also important to understand that the threat does not emanate just from jihadists like al Qaeda and its regional franchises. Over the past several decades, aircraft have been attacked by a number of different actors, including North Korean intelligence officers, Sikh, Palestinian and Hezbollah militants and mentally disturbed individuals like the Unabomber, among others.

Realities

While understanding that the threat is very real, it is also critical to recognize that there is no such thing as absolute, foolproof security. This applies to ground-based facilities as well as aircraft. If security procedures and checks have not been able to keep contraband out of high-security prisons, it is unreasonable to expect them to be able to keep unauthorized items off aircraft, where (thankfully) security checks of crew and passengers are far less invasive than they are for prisoners. As long as people, luggage and cargo are allowed aboard aircraft, and as long as people on the ground crew and the flight crew have access to aircraft, aircraft will remain vulnerable to a number of internal and external threats.

This reality is accented by the sheer number of passengers that must be screened and number of aircraft that must be secured. According to figures supplied by the Transportation Security Administration (TSA), in 2006, the last year for which numbers are available, the agency screened 708,400,522 passengers on domestic flights and international flights coming into the

United States

. This averages out to over 1.9 million passengers per day.

Another reality is that, as mentioned above, jihadists and other people who seek to attack aircraft have proven to be quite resourceful and adaptive. They carefully study security measures, identify vulnerabilities and then seek to exploit them. Indeed, last September, when we analyzed the innovative designs of the explosive devices employed by AQAP, we called attention to the threat they posed to aviation more than three months before the Christmas 2009 bombing attempt. As we look at the issue again, it is not hard to see, as we pointed out then, how their innovative efforts to camouflage explosives in everyday items and hide them inside suicide operatives’ bodies will continue and how these efforts will be intended to exploit vulnerabilities in current screening systems.

As we wrote in September 2009, getting a completed explosive device or its components by security and onto an aircraft is a significant challenge, but it is possible for a resourceful bombmaker to devise ways to overcome that challenge. The latest issue of Inspire magazine demonstrated how AQAP has done some very detailed research to identify screening vulnerabilities. As the group noted in the magazine: “The British government said that if a toner weighs more than 500 grams it won’t be allowed on board a plane. Who is the genius who came up with this suggestion? Do you think that we have nothing to send but printers?”

AQAP also noted in the magazine that it is working to identify innocuous substances like toner ink that, when X-rayed, will appear similar to explosive compounds like PETN, since such innocuous substances will be ignored by screeners. With many countries now banning cargo from Yemen, it will be harder to send those other items in cargo from Sanaa, but the group has shown itself to be flexible, with the underwear-bomb operative beginning his trip to Detroit out of Nigeria rather than Yemen. In the special edition of Inspire, AQAP also specifically threatened to work with allies to launch future attacks from other locations.

Drug couriers have been transporting narcotics hidden inside their bodies aboard aircraft for decades, and prisoners frequently hide drugs, weapons and even cell phones inside body cavities. It is therefore only a matter of time before this same tactic is used to smuggle plastic explosives or even an entire non-metallic explosive device onto an aircraft undefined something that would allow an attacker to bypass metal detectors and backscatter X-ray inspection and pass through external pat-downs.

Look for the Bomber, Not Just the Bomb

This ability to camouflage explosives in a variety of different ways, or hide them inside the bodies of suicide operatives, means that the most significant weakness of any suicide-attack plan is the operative assigned to conduct the attack. Even in a plot to attack 10 or 12 aircraft, a group would need to manufacture only about 12 pounds of high explosives undefined about what is required for a single, small suicide device and far less than is required for a vehicle-borne improvised explosive device. Because of this, the operatives are more of a limiting factor than the explosives themselves; it is far more difficult to find and train 10 or 12 suicide bombers than it is to produce 10 or 12 devices.

A successful attack requires operatives who are not only dedicated enough to initiate a suicide device without getting cold feet; they must also possess the nerve to calmly proceed through airport security checkpoints without alerting officers that they are up to something sinister. This set of tradecraft skills is referred to as demeanor, and while remaining calm under pressure and behaving normally may sound simple in theory, practicing good demeanor under the extreme pressure of a suicide operation is very difficult. Demeanor has proved to be the Achilles’ heel of several terror plots, and it is not something that militant groups have spent a great deal of time teaching their operatives. Because of this, it is frequently easier to spot demeanor mistakes than it is to find well-hidden explosives. Such demeanor mistakes can also be accentuated, or even induced, by contact with security personnel in the form of interviews, or even by unexpected changes in security protocols that alter the security environment a potential attacker is anticipating and has planned for.

There has been much discussion of profiling, but the difficulty of creating a reliable and accurate physical profile of a jihadist, and the adaptability and ingenuity of the jihadist planners, means that any attempt at profiling based only on race, ethnicity or religion is doomed to fail. In fact, profiling can prove counterproductive to good security by blinding people to real threats. They will dismiss potential malefactors who do not fit the specific profile they have been provided.

In an environment where the potential threat is hard to identify, it is doubly important to profile individuals based on their behavior rather than their ethnicity or nationality undefined what we refer to as focusing on the “how” instead of the “who.” Instead of relying on physical profiles, which allow attack planners to select operatives who do not match the profiles being selected for more intensive screening, security personnel should be encouraged to exercise their intelligence, intuition and common sense. A Caucasian U.S. citizen who shows up at the U.S. Embassy in Nairobi or

Dhaka claiming to have lost his passport may be far more dangerous than some random Pakistani or Yemeni citizen, even though the American does not appear to fit the profile for requiring extra security checks.

However, when we begin to consider traits such as intelligence, intuition and common sense, one of the other realities that must be faced with aviation security is that, quite simply, it is not an area where the airlines or governments have allocated the funding required to hire the best personnel. Airport screeners make far less than FBI special agents or CIA case officers and receive just a fraction of the training. Before 9/11, most airports in the

United States

relied on contract security guards to conduct screening duties. After 9/11, many of these same officers went from working for companies like Wackenhut to being TSA employees. There was no real effort made to increase the quality of screening personnel by offering much higher salaries to recruit a higher caliber of candidate.

There is frequent mention of the need to make

U.S.

airport security more like that employed in

Israel

. Aside from the constitutional and cultural factors that would prevent American airport screeners from ever treating Muslim travelers the way they are treated by El Al, another huge difference is simply the amount of money spent on salaries and training for screeners and other security personnel. El Al is also aided by the fact that it has a very small fleet of aircraft that fly only a small number of passengers to a handful of destinations.

Additionally, airport screening duty is simply not glamorous work. Officers are required to work long shifts conducting monotonous checks and are in near constant contact with a traveling public that can at times become quite surly when screeners follow policies established by bureaucrats at much higher pay grades. Granted, there are TSA officers who abuse their authority and do not exhibit good interpersonal skills, but anyone who travels regularly has also witnessed fellow travelers acting like idiots.

While it is impossible to keep all contraband off aircraft, efforts to improve technical methods and procedures to locate weapons and IED components must continue. However, these efforts must not only be reacting to past attacks and attempts but should also be looking forward to thwart future attacks that involve a shift in the terrorist paradigm. At the same time, the often-overlooked human elements of airport security, including situational awareness, observation and intuition, need to be emphasized now more than ever. It is those soft skills that hold the real key to looking for the bomber and not just the bomb.

"Aviation Security Threats and Realities is republished with permission of STRATFOR." <ahref="http://www.stratfor.com/weekly/20101123_aviation_security_threats_and_realities">.

Cybertheft of data surpasses physical theft according to report

Fri, 29 Oct 2010 12:52:06 GMT

The 2010/2011 Annual Edition of the Kroll Global Fraud Report

NEW YORK - October 18, 2010 – Theft of information and electronic data at global companies has overtaken physical theft for the first time, according to the latest edition of the Kroll Annual Global Fraud Report. This year’s study shows that the amount lost by businesses to fraud rose from $1.4m to $1.7m per billion dollars of sales in the past 12 months – an increase of more than 20%. The findings are the result of a study commissioned by Kroll with the Economist Intelligence Unit of more than 800 senior executives worldwide.

While physical theft of cash, assets and inventory has been the most widespread fraud by a considerable margin in previous Global Fraud Reports, this year’s findings reveal that theft of information or assets was reported by 27.3% of companies over the past 12 months, up from 18% in 2009. In contrast, reported incidences of theft of physical assets or stock declined slightly from 28% in 2009 to 27.2% in 2010.

According to the 2010 survey, 88% of companies said they had been the victim of at least one type of fraud during the past year. Of the specific countries analyzed,

China

is the top market in which companies suffered fraud with 98% of businesses operating there affected.

Colombia

ranked second with a 94% incidence of fraud in 2010, followed by

Brazil

with 90%.

Robert Brenner, vice president of Kroll’s

Americas

region said: “Theft of confidential information is on the rise because data is increasingly portable and perpetrators – often departing or disgruntled employees – can remove it with ease absent sufficient controls. At the same time, there is a growing awareness among thieves of the increasing intrinsic value of an organization’s intellectual property. The results of the survey do not suggest other types of fraud are decreasing but merely that the rise in theft of intellectual capital has outstripped other fraudulent activity that has remained constant. Companies need to regularly evaluate how they are controlling access to information within their organization to ensure they are keeping pace with technological advancement and the imperative for collaboration in the workplace.”

Information-based industries reported the highest incidence of theft of information and electronic data over the past 12 months. These include financial services (42% in 2010 versus 24% in 2009), professional services (40% in 2010 versus 27% in 2009) and technology, media and telecoms (37% in 2010 versus 29% in 2009).

The speed of technological developments poses new challenges in the fight against fraud. Nearly one-third (28%) of respondents cited information infrastructure complexity as the single most important factor in raising their exposure to fraud. However, despite the increased risks, only 48% of companies are planning to spend more on information security in the next 12 months, down from 51% last year.

Other key findings include:

• Fear of fraud dissuades nearly half of companies surveyed from becoming more global: 48% of respondents indicated that fraud had dissuaded them from pursuing business opportunities in at least one foreign country. The biggest impact has been on emerging economies, with fraud deterring 11% of businesses operating in

China

and similar percentages of businesses operating in Africa (11%) and Latin America (10%). Respondents claimed they managed risk in these countries simply by avoiding the regions, even though they may offer attractive investment opportunities.

• Companies are unprepared for regulation: Increased regulation through the Foreign Corrupt Practices Act (FCPA) and the introduction of the

’s new Bribery Act has created new challenges for companies. According to the survey, nearly two-thirds (63%) of businesses with operations in the

believe the laws do not apply to them or are unsure. As a result, many are unprepared to deal with the regulatory risks: less than one-half (47%) are confident that they have the controls in place to prevent bribery at all levels of the operation, compared with 42% who say they have assessed the risks and put in place the necessary monitoring and reporting procedures.

• Fraud is usually an ‘inside job’: For those companies who have been affected by fraud over the past year, junior employees and senior management were the most likely perpetrators at 22% each, followed by agents or other intermediaries at 11%. The proportion of fraud carried out by these employees ranged from 50% to 60% in North America, Europe and Asia-Pacific to 71% in the Middle East and

Africa . The number dropped to 42% in Latin America where customers are the primary fraudsters.

Tom Hartley, vice president of Kroll’s Eurasia region, said: “Some of the most concerning findings from the report this year were that challenges faced by corporates investing in unfamiliar territories in search of growth are dissuading them from expansion. This is a combination of opportunity lying where fraud risk is highest and at the same time, the penalties for regulatory failure and likelihood of prosecution increasing. Companies can manage these risks but need to think broadly about the appropriate steps taken to minimize exposure and investigate suspicious actions.”

The fourth Kroll Annual Global Fraud Report includes a full detailed industry analysis across a range of fraud categories and regions. To obtain a copy please visit www.kroll.com/fraud.

Methodology

Kroll commissioned The Economist Intelligence Unit to conduct a worldwide survey on fraud and its effect on business during 2010. A total of 801 senior executives took part in this survey. Nearly a third (29%) of the respondents were based in North America, 25% in Europe, just under a quarter from Asia-Pacific region and 11% each from Latin America and the Middle East and

Africa .

Ten industries were covered, with no fewer than 50 respondents drawn from each industry. The highest number of respondents came from the financial services industry (13%). A total of 51% of the companies polled had global annual revenues in excess of $500m

Bioterrorism: A 9/11 reminder - Security Professionals might wish to take a look!

Tue, 07 Sep 2010 21:27:29 GMT

Anthrax War 2014 the Malaysian Connection by Bob Coen and Eric Nadler, Special to ProPublica

Fears about bioterrorism have prompted new efforts by corporations and governments worldwide to build defenses against germ attacks. But some of these arrangements themselves raise security issues. Consider the spirited global contest to corner the franchise on providing halal inoculations against anthrax and other deadly pathogens to the world's 1.7 billion Muslims. Devout Muslims have an understandable aversion to being injected with vaccines grown in pig cells or alcohol, the methods traditionally used by the world's leading pharmaceutical firms to manufacture such drugs. The reluctance of Muslims to accept non-halal polio injections has been linked to the re-emergence of polio in 27 countries that had been free of the debilitating disease, including Pakistan and Afghanistan.

Enter Emergent BioSolutions, a Rockville, Md., firm with expanding multinational operations that sells a vaccine against anthrax to the U.S. government. In January 2008, in a little-noticed deal, Emergent, or EBS, announced a joint venture with a firm funded by the Malaysian Health Ministry to build 52,000 square feet of "vaccine development and manufacturing infrastructure" on a 62-acre site in an industrial park just outside of Kuala Lumpur. "It is our belief that this joint venture will not only expand the use of our anthrax vaccine in this market, but will also serve as a platform for joint product development and manufacturing activities," Fuad El-Hibri, chief executive of Emergent (the majority partner), said of the deal with Ninebio Sdn Bhd. "It is anticipated that the joint venture will also supply such products and services to certain member countries of the Organization of the Islamic Conference ("OIC") and other countries within Asia," an href="http://investors.emergentbiosolutions.com/phoenix.zhtml?c=202582&p=irol-newsArticle&ID=1099450&highlight=">EBS press release said. The facility was originally scheduled to open this year, but is now set to begin operations in 2013. href="http://www.merrick.com/images/uploads/project_sheets/2795.pdf">Web page describing architectural plans</a> for the Malaysian venture is a sentence that has raised some eyebrows. It says the companies plan to build a "biocontainment R&D facility that includes BSL ... 3 and 4 laboratories."

Biosafety Level 3 ("high-containment") labs are for disease-causing organisms that can cause death in humans, such as anthrax, plague and SARS. Malaysia already has three BSL-3 labs, and there are several thousand worldwide (1,356 in the U.S. alone). Biosafety Level 4 (BSL-4) labs are for diseases that are one step up in the pathogen chain -- invariably fatal, highly contagious and for which no known vaccine or cure exists. Within these labs, the most-dangerous "select agents" -- Ebola virus, Marburg virus, Lassa fever and other hemorrhagic fevers -- are used in countermeasure research, including vaccines, to thwart 21st-century delivery systems and genetic manipulation of these natural horrors. BSL-4's have special safety features, including the use of full-body suits equipped with life support systems.

These would be Malaysia's first BSL-4 labs. Proliferation experts note that these high-security laboratories -- fewer than three dozen are currently operating worldwide -- are themselves valuable items. The href="http://hpac.com/ventilation-iaq/biosafety_level_labs/">specialized engineering</a> that allows scientists to safely handle such deadly germs is coveted by terrorists as much as the pathogens within carefully secured walls.

Geography also counts. In March, Assistant Secretary of State Vann H. Van Diepen told the House Foreign Affairs Subcommittee on Terrorism that one key component of the new "biological threat" is "the growing biotechnology capacity in areas of the world with a terrorist presence." Malaysia, where six in 10 citizens are Muslims, was tied to several terrorist plots earlier in the decade. Al-Qaida leaders used Kuala Lumpur as the "primary operational launch pad" for the 9/11 attacks, the FBI says. An organization known as Jemaah Islamiyah operating out of Malaysia bombed a disco in neighboring Bali in 2002, killing 202 people; the group's leaders were subsequently arrested and executed by Indonesian authorities. More disturbing are recent revelations that Kuala Lumpur was a crucial base of operations in the lucrative black-market nuclear centrifuge network put together by Pakistani scientist A.Q. Khan. For some experts, this raises a question of whether it is wise to encourage the creation of a BSL-4 lab there. Building such a facility in Malaysia does have benefits for American interests in the region.

Security analysts see the development of an advanced biotech sector in the developing world as inevitable. A U.S. partner allows the American government to have some measure of influence and control on foreign "biodefense" efforts. Malaysian officials say they want the advanced labs to deal with local outbreaks of SARS, dengue, Japanese encephalitis and the lethal Nipah virus, as well as to develop possible bioterrorism vaccines. Such regional self-sufficiency is embraced by the World Health Organization. "The question for (U.S. officials) is, 'How can we ensure a 'responsible' biotech sector in places like Malaysia, which are Muslim and are cranking out capable and well-educated scientists and have the money to build state-of-the-art facilities?'" says Edward Hammond, who used to head the Sunshine Project, which monitors biosecurity efforts. Hammond has long criticized lax U.S. government oversight of facilities handling dangerous bio-agents. He said strategic imperatives have, by and large, trumped security concerns about new overseas labs.

In Malaysia, says Hammond, U.S. officials are especially wary of China's biotech industries (Chinese vaccine exports to the developing world shot up 20 percent last year.): "The argument is, of course we have the best technology, but the Chinese can make respectable vaccines ... We certainly don't want budding Malaysian biotech companies to turn to China for equipment and expertise." Instead, the Malaysian government turned to EBS -- which holds the exclusive U.S. government contract to supply the controversial anthrax vaccine to the military and the National Strategic Stockpile. Despite FDA approval, health complaints about the vaccine, called BioThrax, persist among those vaccinated. From a modest $24 million investment in 1998, EBS, formerly known as BioPort, has signed U.S. government vaccine contracts worth almost $1 billion, and today operates subsidiaries in 15 countries. Its BioThrax vaccine sets the pace in the expanding anthrax market.

Customers include the military, first responders, mail carriers and, potentially, the general public under threat scenarios now being drafted on the local, state, federal and international levels. Booster shots of BioThrax are recommended every year during possible exposure to anthrax. EBS can claim a special feel for the Muslim world. El-Hibri, its CEO, is a prominent Muslim businessman born of a Lebanese father and a German mother. He grew up in Lebanon and Europe before coming to the U.S. and earning a bachelor's degree in economics from Stanford and a master's in public and private management from Yale. In addition to his biotech labors, he has worked for Citigroup in New York and Saudi Arabia and in telecommunications in Russia and Venezuela. His British holding -- Porton International -- provided the anthrax vaccine to Saudi Arabia during the first Persian Gulf War.

El-Hibri brought his vaccine operations to America in the late 1990s, cultivating U.S. military, intelligence and political support. One of the original investors/partners in BioPort was the late Adm. William J. Crowe, chairman of the Joint Chiefs of Staff under Ronald Reagan and later Bill Clinton's ambassador to Britain. Today, EBS directors include Louis Sullivan, the Health and Human Services secretary under President George H.W. Bush, and Jerome Hauer, the emergency preparedness czar under former New York Mayor Rudolph Giuliani.

In the anxious days after 9/11, Michigan Gov. John Engler ordered the National Guard to surround BioPort's anthrax vaccine plant in Lansing because anthrax bacteria were present there. There have been persistent reports that al-Qaida has an interest in producing bioweapons. In 2003, coalition forces raiding a safe house believed to be used by al-Qaida in Iraq discovered a copy of the 1997 environmental assessment of renovations to BioPort's anthrax manufacturing plant in Lansing. Malaysia has promised to be vigilant, which would set it apart from some Asian counterparts. In 2006, Sandia National Laboratories surveyed Asian scientists, including some from Malaysia, and half of them reported that they had no guards at the entrances of their facilities. Only half said there was restricted access to laboratories, and just 54 percent kept a current inventory of toxins and infectious agents they handled. To its credit, the Malaysian government has begun crafting new biosecurity rules and regulations in line with U.S. standards, with the help of Sandia and the encouragement of the State Department.

We asked EBS if it had begun the application process for licensing the transfer of sensitive biological commodities administered by the Departments of Commerce, State and Defense. The Export Control Act and the International Trafficking in Arms Regulations require companies to get permission when exporting material useful for biowarfare and bioterrorism. We also asked the company some questions about what will be happening in its BSL-3 and BSL-4 labs in Malaysia: What biological agents will be handled? How will the pathogens get on site? Will the work include genetic manipulation or DNA recombination of select agents? Will any of that work be classified? EBS hasn't responded to written questions and phone messages. Its Malaysian partner, Ninebio, likewise refused to answer inquiries. The U.S. government also declined to comment.

The State Department redirected our inquiry to the Commerce Department, which wouldn't say anything about the EBS-Malaysia deal: "Pursuant to Section 12(c) of the Export Administration Act, the Department of Commerce does not publicly release any information on export license applications, including whether any particular transactions were the subject of license applications." Arms control experts in Europe and the United States are pushing for more effective oversight on deals like the Malaysia project. These include: tougher export controls; a "harmonizing" of international guidelines for securing dangerous pathogens; and international inspection of biological production facilities under the Biological Weapons Convention. The latter is opposed by the U.S. and Russia on commercial as well as effectiveness grounds. The prospects for such reforms are uncertain, and approvals for potentially dangerous deals apparently keep on coming.

Why the rush? Well, there's the money of course -- $70 billion in U.S. government money alone this past decade for programs for battlefield defense, civilian preparedness and response, and countermeasures including vaccines. Francis Boyle, a law professor at the University of Illinois, suspects that more than just commercial considerations may be at play. Professor Boyle helped to draft the Biological Weapons Anti-Terrorism Act of 1989, which makes it a federal crime to develop or produce biological weapons. He wonders if projects like the Malaysian lab could be used to circumvent U.S. rules against biological projects with offensive applications. Since the 9/11 attacks, the government, via the USA Patriot Act (2001) and the Bioterrorism Preparedness and Response Act (2002), tightened controls over dangerous pathogens and toxins stored, used and transferred within the United States. "It seems to me that this could be a very dangerous end-run by EBS and its government funders around the numerous legal restrictions now put in place since 9/11 making it difficult to research, develop and test bioweapons domestically," says Boyle. Boyle says it's reasonable to ask if the Kuala Lumpur operation will be part of the U.S. government's controversial "laboratory threat characterization research" programs, under which scientists are charged with developing and testing newly bioengineered pathogens under the rubric of developing medical countermeasures for a potential threat. This type of research, mandated by a presidential directive in April 2004, is conducted within classified "Black Projects" sponsored by the Pentagon and the CIA and carried out by private contractors. For its part, the Defense Department says it's not ruling anything out. Asked if such efforts could take place in these Malaysian BSL-4 labs, a spokesman said, "We currently do not have labs in Malaysia but we would be happy to collaborate with the government of Malaysia on bio surveillance, safety and security in the future."

Suspicions are further fueled by the addition of Ronald Richard to the EBS board of directors. Richard used to head a href="http://www.iqt.org">In-Q-Tel (IQT), the high-tech venture capital arm of the CIA. IQT, started by the CIA in 1999 as an independent, not-for-profit private company, has a unique mission, according to its website, to "attract and build relationships with technology startups outside the reach of the Intelligence community." All of this could be coincidental. But until the government lifts some of the limits imposed by trade laws and national security rules, the risks and benefits of this project remain difficult to assess. In this instance, a little transparency would go a long way.

Filmmakers Bob Coen and Eric Nadler's documentary "Anthrax War," <a href="http://www.anthraxwar.com">www.anthraxwar.com</a>, will be broadcast on the ARTE Network in Europe Tuesday night. </em></p><script type="text/javascript" src="http://pixel.propublica.org/pixel.js" async></script>

Permission has been granted to ISPLA by ProPublica to post this investigative report.

Situational Awareness - Criminals and Terrorists

Thu, 10 Jun 2010 18:42:04 GMT

A Primer on Situational Awareness

Scott Stewart – Stratfor Global Intelligence – June 10, 2010

The world is a wonderful place, but it can also be a dangerous one. In almost every corner of the globe militants of some political persuasion are plotting terror attacks undefined and these attacks can happen in London or New York, not just in Peshawar or Baghdad. Meanwhile, criminals operate wherever there are people, seeking to steal, rape, kidnap or kill.

Regardless of the threat, it is very important to recognize that criminal and terrorist attacks do not materialize out of thin air. In fact, quite the opposite is true. Criminals and terrorists follow a process when planning their actions, and this process has several distinct steps. This process has traditionally been referred to as the “terrorist attack cycle,” but if one looks at the issue thoughtfully, it becomes apparent that the same steps apply to nearly all crimes. Of course, there will be more time between steps in a complex crime like a kidnapping or car bombing than there will be between steps in a simple crime such as purse-snatching or shoplifting, where the steps can be completed quite rapidly. Nevertheless, the same steps are usually followed.

People who practice situational awareness can often spot this planning process as it unfolds and then take appropriate steps to avoid the dangerous situation or prevent it from happening altogether. Because of this, situational awareness is one of the key building blocks of effective personal security undefined and when exercised by large numbers of people, it can also be an important facet of national security. Since situational awareness is so important, and because we discuss situational awareness so frequently in our analyses, we thought it would be helpful to discuss the subject in detail and provide a primer that can be used by people in all sorts of situations.

Foundations

First and foremost, it needs to be noted that being aware of one’s surroundings and identifying potential threats and dangerous situations is more of a mindset than a hard skill. Because of this, situational awareness is not something that can be practiced only by highly trained government agents or specialized corporate security countersurveillance teams. Indeed, it can be exercised by anyone with the will and the discipline to do so.

An important element of the proper mindset is to first recognize that threats exist. Ignorance or denial of a threat undefined or completely tuning out one’s surroundings while in a public place undefined makes a person’s chances of quickly recognizing the threat and avoiding it slim to none. This is why apathy, denial and complacency can be (and often are) deadly. A second important element is understanding the need to take responsibility for one’s own security. The resources of any government are finite and the authorities simply cannot be everywhere and cannot stop every criminal action. The same principle applies to private security at businesses or other institutions, like places of worship. Therefore, people need to look out for themselves and their neighbors.

Another important facet of this mindset is learning to trust your “gut” or intuition. Many times a person’s subconscious can notice subtle signs of danger that the conscious mind has difficulty quantifying or articulating. Many people who are victimized frequently experience such feelings of danger prior to an incident, but choose to ignore them. Even a potentially threatening person not making an immediate move undefined or even if the person wanders off quickly after a moment of eye contact undefined does not mean there was no threat.

Levels of Awareness

People typically operate on five distinct levels of awareness. There are many ways to describe these levels (“Cooper’s colors,” for example, which is a system frequently used in law enforcement and military training), but perhaps the most effective way to illustrate the differences between the levels is to compare them to the different degrees of attention we practice while driving. For our purposes here we will refer to the five levels as “tuned out;” “relaxed awareness;” “focused awareness;” “high alert” and “comatose.”

The first level, tuned out, is like when you are driving in a very familiar environment or are engrossed in thought, a daydream, a song on the radio or even by the kids fighting in the backseat. Increasingly, cell phone calls and texting are also causing people to tune out while they drive. Have you ever gotten into the car and arrived somewhere without even really thinking about your drive there? If so, then you’ve experienced being tuned out.

The second level of awareness, relaxed awareness, is like defensive driving. This is a state in which you are relaxed but you are also watching the other cars on the road and are looking well ahead for potential road hazards. If another driver looks like he may not stop at the intersection ahead, you tap your brakes to slow your car in case he does not. Defensive driving does not make you weary, and you can drive this way for a long time if you have the discipline to keep yourself at this level, but it is very easy to slip into tuned-out mode. If you are practicing defensive driving you can still enjoy the trip, look at the scenery and listen to the radio, but you cannot allow yourself to get so engrossed in those distractions that they exclude everything else. You are relaxed and enjoying your drive, but you are still watching for road hazards, maintaining a safe following distance and keeping an eye on the behavior of the drivers around you.

The next level of awareness, focused awareness, is like driving in hazardous road conditions. You need to practice this level of awareness when you are driving on icy or slushy roads undefined or the roads infested with potholes and erratic drivers that exist in many third-world countries. When you are driving in such an environment, you need to keep two hands on the wheel at all times and have your attention totally focused on the road and the other drivers. You don’t dare take your eyes off the road or let your attention wander. There is no time for cell phone calls or other distractions. The level of concentration required for this type of driving makes it extremely tiring and stressful. A drive that you normally would not think twice about will totally exhaust you under these conditions because it demands your prolonged and total concentration.

The fourth level of awareness is high alert. This is the level that induces an adrenaline rush, a prayer and a gasp for air all at the same time undefined “Watch out! There’s a deer in the road! Hit the brakes!” This also happens when that car you are watching doesn’t stop at the stop sign and pulls out right in front of you. High alert can be scary, but at this level you are still able to function. You can hit your brakes and keep your car under control. In fact, the adrenalin rush you get at this stage can sometimes even aid your reflexes. But, the human body can tolerate only short periods of high alert before becoming physically and mentally exhausted.

The last level of awareness, comatose, is what happens when you literally freeze at the wheel and cannot respond to stimuli, either because you have fallen asleep, or, at the other end of the spectrum, because you are petrified from panic. It is this panic-induced paralysis that concerns us most in relation to situational awareness. The comatose level of awareness (or perhaps more accurately, lack of awareness) is where you go into shock, your brain ceases to process information and you simply cannot react to the reality of the situation. Many times when this happens, a person can go into denial, believing that “this can’t be happening to me,” or the person can feel as though he or she is observing, rather than actually participating in, the event. Often, the passage of time will seem to grind to a halt. Crime victims frequently report experiencing this sensation and being unable to act during an unfolding crime.

Finding the Right Level

Now that we’ve discussed the different levels of awareness, let’s focus on identifying what level is ideal at a given time. The body and mind both require rest, so we have to spend several hours each day at the comatose level while asleep. When we are sitting at our homes watching a movie or reading a book, it is perfectly fine to operate in the tuned-out mode. However, some people will attempt to maintain the tuned-out mode in decidedly inappropriate environments (e.g., when they are out on the street at night in a third-world barrio), or they will maintain a mindset wherein they deny that they can be victimized by criminals. “That couldn’t happen to me, so there’s no need to watch for it.” They are tuned out.

Some people are so tuned out as they go through life that they miss even blatant signs of pending criminal activity directed specifically at them. In 1992, an American executive living in the Philippines was kidnapped by a Marxist kidnapping gang in Manila known as the “Red Scorpion Group.” When the man was debriefed following his rescue, he described in detail how the kidnappers had blocked off his car in traffic and abducted him. Then, to the surprise of the debriefing team, he said that on the day before he was abducted, the same group of guys had attempted to kidnap him at the exact same location, at the very same time of day and driving the same vehicle. The attackers had failed to adequately box his car in, however, and his driver was able to pull around the blocking vehicle and proceed to the office.

Since the executive did not consider himself to be a kidnapping target, he had just assumed that the incident the day before his abduction was “just another close call in crazy Manila traffic.” The executive and his driver had both been tuned out. Unfortunately, the executive paid for this lack of situational awareness by having to withstand an extremely traumatic kidnapping, which included almost being killed in the dramatic Philippine National Police operation that rescued him.

If you are tuned out while you are driving and something happens undefined say, a child runs out into the road or a car stops quickly in front of you undefined you will not see the problem coming. This usually means that you either do not see the hazard in time to avoid it and you hit it, or you totally panic and cannot react to it undefined neither is good. These reactions (or lack of reaction) occur because it is very difficult to change mental states quickly, especially when the adjustment requires moving several steps, say, from tuned out to high alert. It is like trying to shift your car directly from first gear into fifth and it shudders and stalls. Many times, when people are forced to make this mental jump and they panic (and stall), they go into shock and will actually freeze and be unable to take any action undefined they go comatose. This happens not only when driving but also when a criminal catches someone totally unaware and unprepared. While training does help people move up and down the alertness continuum, it is difficult for even highly trained individuals to transition from tuned out to high alert. This is why police officers, federal agents and military personnel receive so much training on situational awareness.

It is critical to stress here that situational awareness does not mean being paranoid or obsessively concerned about your security. It does not mean living with the irrational expectation that there is a dangerous criminal lurking behind every bush. In fact, people simply cannot operate in a state of focused awareness for extended periods, and high alert can be maintained only for very brief periods before exhaustion sets in. The “flight or fight” response can be very helpful if it can be controlled. When it gets out of control, however, a constant stream of adrenaline and stress is simply not healthy for the body or the mind. When people are constantly paranoid, they become mentally and physically burned out. Not only is this dangerous to physical and mental health, but security also suffers because it is very hard to be aware of your surroundings when you are a complete basket case. Therefore, operating constantly in a state of high alert is not the answer, nor is operating for prolonged periods in a state of focused alert, which can also be overly demanding and completely enervating. This is the process that results in alert fatigue. The human body was simply not designed to operate under constant stress. People (even highly skilled operators) require time to rest and recover.

Because of this, the basic level of situational awareness that should be practiced most of the time is relaxed awareness, a state of mind that can be maintained indefinitely without all the stress and fatigue associated with focused awareness or high alert. Relaxed awareness is not tiring, and it allows you to enjoy life while rewarding you with an effective level of personal security. When you are in an area where there is potential danger (which, by definition, is almost anywhere), you should go through most of your day in a state of relaxed awareness. Then if you spot something out of the ordinary that could be a potential threat, you can “dial yourself up” to a state of focused awareness and take a careful look at that potential threat (and also look for others in the area).

If the potential threat proves innocuous, or is simply a false alarm, you can dial yourself back down into relaxed awareness and continue on your merry way. If, on the other hand, you look and determine that the potential threat is a probable threat, seeing it in advance allows you to take actions to avoid it. You may never need to elevate to high alert, since you have avoided the problem at an early stage. However, once you are in a state of focused awareness you are far better prepared to handle the jump to high alert if the threat does change from potential to actual undefined if the three guys lurking on the corner do start coming toward you and look as if they are reaching for weapons. The chances of you going comatose are far less if you jump from focused awareness to high alert than if you are caught by surprise and “forced” to go into high alert from tuned out. An illustration of this would be the difference between a car making a sudden stop in front of a person when the driver is practicing defensive driving, compared to a car that makes a sudden stop in front of person when the driver is sending a text message.

Of course, if you know that you must go into an area that is very dangerous, you should dial yourself up to focused awareness when you are in that area. For example, if there is a specific section of highway where a lot of improvised explosive devices detonate and ambushes occur, or if there is a part of a city that is controlled (and patrolled) by criminal gangs undefined and you cannot avoid these danger areas for whatever reason undefined it would be prudent to heighten your level of awareness when you are in those areas. An increased level of awareness is also prudent when engaging in common or everyday tasks, such as visiting an ATM or walking to the car in a dark parking lot. The seemingly trivial nature of these common tasks can make it all too easy to go on “autopilot” and thus expose yourself to threats. When the time of potential danger has passed, you can then go back to a state of relaxed awareness.

This process also demonstrates the importance of being familiar with your environment and the dangers that are present there. Such awareness allows you to avoid many threats and to be on the alert when you must venture into a dangerous area.

Clearly, few of us are living in the type of intense threat environment currently found in places like Mogadishu, Juarez or Kandahar. Nonetheless, average citizens all over the world face many different kinds of threats on a daily basis undefined from common thieves and assailants to criminals and mentally disturbed individuals aiming to conduct violent acts to militants wanting to carry out large-scale attacks against subways and aircraft.

Many of the steps required to conduct these attacks must be accomplished in a manner that makes the actions visible to the potential victim and outside observers. It is at these junctures that people practicing situational awareness can detect these attack steps, avoid the danger and alert the authorities. When people practice situational awareness they not only can keep themselves safer but they can also help keep others safe. And when groups of people practice situational awareness together they can help keep their schools, houses of worship, workplaces and cities safe from danger.

And as we’ve discussed many times before, as the terrorist threat continues to devolve into one almost as diffuse as the criminal threat, ordinary citizens are also becoming an increasingly important national security resource.

ISPLA gratefully acknowledges this report is republished with the permission of STRATFOR. www.stratfor.com

New Major Security Training Legislation Proposed in New York

Fri, 09 Apr 2010 17:42:24 GMT

Security Legislation News – New York

From: Bruce Hulme, ISPLA Director of Government Affairs

To: Contract Security Industry and Stakeholders

We have been advised that the legislation offered below is at the request of SEIU, 32 BJ. Note provisions concerning NYS contracts for security services over $500K; OJT provisions increased to 40 hours within 90 days following employment; which shall cover observation, detection and reporting skills, coordination with local police, fire and emergency services skills, in working with advanced security technology including surveillance and access control procedures, and at least 3 hours of training devoted to terrorism awareness. The entity employing the security guard shall compensate security guard for all hours while in attendance at his or her regular hourly wage or, if applicable, overtime rate. Violation of provisions may result in revocation or suspension of license or fine not exceeding $10,000 per violation or occurrence, or reprimand or denial of license renewal.

ISPLA is a singularly focused voice protecting our profession by proactively working with members of state and federal legislators, regulators, and other governmental agencies. Its dues are used for the administration of its political action committee with the specific purpose of lobbying on legislative and regulatory issues – nothing else. Fighting ill-conceived legislation and regulation is our only mission! We invite you to join us. Go to: www.ISPLA.org

April 9, 2010

* * *

A10554 Text:

                           S T A T E   O F   N E W   Y O R K

       ________________________________________________________________________

                                 I N  A S S E M B L Y

                                     April 7, 2010

                                      ___________

       Introduced by M. of A. LENTOL -- read once and referred to the Committee on Economic Development, Job Creation, Commerce and Industry

       AN  ACT  to amend the state finance law and the general business law, in relation to the purchase of security services

         THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEMBLY, DO ENACT AS FOLLOWS:

    1    Section 1. Section 165 of the state finance law is amended by adding a

    2  new subdivision 9 to read as follows:

    3    9. SPECIAL PROVISIONS REGARDING THE PURCHASING OF SECURITY SERVICES.

    4    A. WHENEVER THE STATE OR ANY GOVERNMENTAL AGENCY OR POLITICAL SUBDIVI-

    5  SION  OR  PUBLIC BENEFIT CORPORATION OF THE STATE ENTERS INTO A CONTRACT

    6  IN EXCESS OF FIVE HUNDRED THOUSAND DOLLARS TO PURCHASE SECURITY SERVICES

    7  FROM ANY PRIVATE INVESTIGATOR, OR WATCH,  GUARD  OR  PATROL  AGENCY,  OR

    8  SECURITY  GUARD  COMPANY,  THE  CONTRACT  SHALL  PROVIDE THAT THE ENTITY

    9  PROVIDING THE SECURITY SERVICES SHALL ENSURE THAT  EACH  SECURITY  GUARD

   10  WHO  PERFORMS  SERVICES  UNDER THE CONTRACT COMPLETES A TRAINING PROGRAM

   11  CERTIFIED BY THE DEPARTMENT OF HOMELAND SECURITY PURSUANT  TO  PARAGRAPH

   12  (R)  OF  SUBDIVISION  TWO OF SECTION SEVEN HUNDRED NINE OF THE EXECUTIVE

   13  LAW WITHIN NINETY WORKING  DAYS  FOLLOWING  EMPLOYMENT,  AND  THAT  SUCH

   14  TRAINING SHALL BE PROVIDED AT NO COST TO THE SECURITY GUARDS.

   15    B. EXCEPT IN THE CASE OF CONTRACTS IN THE AMOUNT OF FIVE HUNDRED THOU-

   16  SAND DOLLARS OR LESS, EVERY BID, PROPOSAL, OR OTHER RESPONSE TO A SOLIC-

   17  ITATION  FOR BID OR PROPOSAL FOR SECURITY SERVICES TO BE PROVIDED TO THE

   18  STATE OR ANY GOVERNMENTAL AGENCY  OR  POLITICAL  SUBDIVISION  OR  PUBLIC

   19  BENEFIT  CORPORATION  OF THE STATE SHALL BE DEEMED NON-RESPONSIVE UNLESS

   20  THE PERSON OR ENTITY SUBMITTING THE BID  ESTABLISHES  THAT  IT  HAS  THE

   21  CAPACITY  TO  PROVIDE  THE  NECESSARY  TRAINING TO EACH SECURITY OFFICER

   22  PERFORMING SERVICES UNDER THE CONTRACT.

   23    C. WHENEVER THE STATE OR ANY GOVERNMENTAL AGENCY OR POLITICAL SUBDIVI-

   24  SION OR PUBLIC BENEFIT CORPORATION OF THE STATE ENTERS INTO  A  CONTRACT

   25  IN EXCESS OF FIVE HUNDRED THOUSAND DOLLARS TO PURCHASE SECURITY SERVICES

   26  FROM  ANY  PRIVATE  INVESTIGATOR,  OR  WATCH, GUARD OR PATROL AGENCY, OR

   27  SECURITY GUARD COMPANY, THE  CONTRACT  SHALL  PROVIDE  THAT  THE  ENTITY

   28  PROVIDING  THE  SECURITY  SERVICES  SHALL  FURNISH  A  PERFORMANCE  BOND

        EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets

                             [ ] is old law to be omitted.

                                                                  LBD16779-02-0

       A. 10554                            2

    1  EXECUTED BY A SURETY AUTHORIZED TO DO BUSINESS  IN  THE  STATE,  OR  THE

    2  EQUIVALENT  IN CASH. THE PERFORMANCE BOND SHALL BE IN AN AMOUNT ADEQUATE

    3  TO ENSURE THE PROTECTION OF THE GOVERNMENT, BUT SHALL BE  NO  LESS  THAN

    4  FIFTY PERCENT OF THE AMOUNT PAYABLE UNDER THE CONTRACT.

    5    S  2.  The  opening  paragraph  of  subdivision 1 of section 79 of the

    6  general business law, as amended by chapter 336 of the laws of 1992,  is

    7  amended to read as follows:

    8    The  department of state shall have the power to revoke or suspend any

    9  license, or in lieu thereof to impose a fine  not  exceeding  [one]  TEN

   10  thousand  dollars  PER VIOLATION OR OCCURRENCE payable to the department

   11  of state, or reprimand any licensee or deny an application for a license

   12  or renewal thereof upon proof:

   13    S 3. Paragraph b of subdivision 1 of section 89-n of the general busi-

   14  ness law, as amended by chapter 634 of the laws of 1994, is  amended  to

   15  read as follows:

   16    b. an on-the-job training course to be completed within ninety working

   17  days following employment, consisting of a minimum of [sixteen hours and

   18  a  maximum  of]  forty  hours,  [as determined by the council, generally

   19  relating to the security guard's specific duties, the nature of the work

   20  place and the requirements of the security guard  company]  WHICH  SHALL

   21  COVER  OBSERVATION,  DETECTION  AND  REPORTING SKILLS; COORDINATION WITH

   22  LOCAL POLICE, FIRE  AND  EMERGENCY  SERVICES  SKILLS;  IN  WORKING  WITH

   23  ADVANCED  SECURITY  TECHNOLOGY INCLUDING SURVEILLANCE AND ACCESS CONTROL

   24  PROCEDURES; AND AT LEAST THREE HOURS OF TRAINING  DEVOTED  TO  TERRORISM

   25  AWARENESS.  THE ENTITY EMPLOYING THE SECURITY GUARD SHALL COMPENSATE THE

   26  SECURITY GUARD FOR ALL HOURS OF ATTENDANCE AT THE TRAINING COURSE AT  NO

   27  LESS  THAN  THE  SECURITY  GUARD'S  REGULAR HOURLY WAGE, OR THE OVERTIME

   28  RATE, IF APPLICABLE;

   29    S 4. This act shall take effect immediately.

FTC Uncovers Data Widespread Data Breaches

Wed, 24 Feb 2010 14:11:42 GMT

Widespread Data Breaches Uncovered by FTC Probe

FTC Warns of Improper Release of Sensitive Consumer Data on P2P File-Sharing Networks

Feb. 23, 2010 – The Washington Post reports security experts say the Federal Trade Commission’s investigation is the broadest of its kind by the agency and comes amid recent outrage over missteps by Google on how it handled users' data in its recent launch of a new social-networking application, Buzz. Facebook faced similar criticism in December when changes to its privacy policy caused confusion among users and left some of their information more widely available to the public.

Concerns about Internet privacy also have intensified as broadband and other technologies become more widespread. Consumer advocates, for example, are leery of advertisers using global-positioning satellite technology to track cell phone users. Law enforcement officials routinely ask companies with cloud computing applications, such as Microsoft and Yahoo, for information about users, yet there are no clear rules dictating how federal regulators should address those and other issues.

"Everything is coming to a head here and the FTC is acting effectively and prudently in trying to grapple with this very fast moving marketplace," said Jeffrey Chester, executive director of the Center for Digital Democracy.

The FTC has notified almost 100 organizations (some with only 8 employees) that personal information, including sensitive data about customers and/or employees, has been shared from the organizations’ computer networks and is available on peer-to-peer (P2P) file-sharing networks to any users of those networks, who could use it to commit identity theft or fraud. The agency also has opened non-public investigations of other companies whose customer or employee information has been exposed on P2P networks. To help businesses manage the security risks presented by file-sharing software, the FTC is releasing new education materials that present the risks and recommend ways to manage them.

Peer-to-peer technology can be used in many ways, such as to play games, make online telephone calls, and, through P2P file-sharing software, share music, video, and documents. But when P2P file-sharing software is not configured properly, files not intended for sharing may be accessible to anyone on the P2P network.

“Unfortunately, companies and institutions of all sizes are vulnerable to serious P2P-related breaches, placing consumers’ sensitive information at risk. For example, we found health-related information, financial records, and drivers’ license and social security numbers--the kind of information that could lead to identity theft,” said FTC Chairman Jon Leibowitz. “Companies should take a hard look at their systems to ensure that there are no unauthorized P2P file-sharing programs and that authorized programs are properly configured and secure. Just as important, companies that distribute P2P programs, for their part, should ensure that their software design does not contribute to inadvertent file sharing.”

As the nation’s consumer protection agency, the FTC enforces laws that require companies in various industries to take reasonable and appropriate security measures to protect sensitive personal information, including the Gramm-Leach-Bliley Act and Section 5 of the FTC Act. Failure to prevent such information from being shared to a P2P network may violate such laws. Information about the FTC’s privacy and data security enforcement actions can be found at www.ftc.gov/privacy/privacyinitiatives/ promises_enf.html.

The notices went to both private and public entities, including schools and local governments, and the entities contacted ranged in size from businesses with as few as eight employees to publicly held corporations employing tens of thousands. In the notification letters, the FTC urged the entities to review their security practices and, if appropriate, the practices of contractors and vendors, to ensure that they are reasonable, appropriate, and in compliance with the law. The letters state, “It is your responsibility to protect such information from unauthorized access, including taking steps to control the use of P2P software on your own networks and those of your service providers.”

The FTC also recommended that the entities identify affected customers and employees and consider whether to notify them that their information is available on P2P networks. Many states and federal regulatory agencies have laws or guidelines about businesses’ notification responsibilities in these circumstances.

Samples of the notification letters can be found at: http://www.ftc.gov/os/2010/02/100222sampleletter-a.pdf, http://www.ftc.gov/os/2010/02/100222sampleletter-b.pdf, http://www.ftc.gov/os/2010/02/100222sampleletter-c.pdf.

The fact that a company received a letter does not mean that the company necessarily violated any law enforced by the Commission. Letters went to companies under FTC jurisdiction, as well as entities such as banks and public agencies over which the agency does not have jurisdiction.

Assisting the FTC were the Department of Health and Human Services, the Securities and Exchange Commission, the Federal Reserve Board, the Federal Deposit Insurance Corporation, the Office of Thrift Supervision, and the Office of Comptroller of the Currency.

The new business education brochure – titled Peer-to-Peer File Sharing: A Guide for Business – is designed to assist businesses and others as they consider whether to allow file-sharing technologies on their networks, and explain how to safeguard sensitive information on their systems, and other security recommendations. This information is available at www.ftc.gov/bcp/edu/pubs/business/idtheft/bus46.shtm. Tips for consumers about computer security and P2P can be found at www.onguardonline.gov/topics/p2p-security.aspx.

ISPLA has been closely following a number of security breach bills in the House and Senate, along with monitoring the activities of the FTC.

Anti-money laundering measures proposed

Mon, 15 Feb 2010 20:10:01 GMT

Anti-Money Laundering: Senate Investigations Subcommittee Holds Hearing on Keeping Foreign Corruption Out of the United States: Four Case Histories

ISPLA, as part of its mission to keep our profession informed, is providing the information below for your evaluation and review.

Corrupt foreign officials and their relatives have used gaps in U.S. law and the assistance of U.S. professionals to funnel millions of dollars in illicit money into the United States, an investigation by the Senate’s Permanent Subcommittee on Investigations has found.

“For the United States, which has so much riding on global stability, corruption is a direct threat to our national interest,” said Sen. Carl Levin, [D-MI] subcommittee chairman. “That’s why the United States is engaged in a relentless, worldwide battle to stop the flow of illegal money into and within places like Iraq and Afghanistan. Laundered money is used to train and provide support for terrorists and terrorism. If we want to credibly lead efforts to stop illegal money abroad, we’ve got to stop it here at home as well.”

A 330-page bipartisan report released by Levin and subcommittee ranking member Sen. Tom Coburn, [R-OK], for the hearing shows that politically powerful foreign officials, and those close to them, have found ways to use the U.S. financial system to protect and enhance their ill-gotten gains. The report exposes how those powerful individuals – known internationally as “politically exposed persons” or PEPs – have used the services of U.S. lawyers, lobbyists, real estate and escrow agents, and other professionals who currently have no obligation under U.S. regulations to establish anti-money laundering (“AML”) programs, know their customers, or evaluate the source of funds transferred into the United States. Banks, in contrast, are subject to AML obligations and for the most part have honored them. But glaring gaps have undermined the overall effectiveness of U.S. AML laws.

Four Case Histories. The report presents four case histories, each with multiple stories exposing the tactics being used by PEPs to use our financial system to protect and enhance their illicit funds. They include the following:

· $110 Million. Teodoro Obiang, the 40-year old son of the President of Equatorial Guinea, is currently under investigation by the Justice Department for corruption and other misconduct. Between 2004 and 2008, Mr. Obiang used U.S. lawyers, bankers, and real estate and escrow agents to move more than $110 million in suspect funds through U.S. bank accounts, including $30 million to purchase a residence in Malibu and $38.5 million to purchase an aircraft.

· Third Party Accounts. Mr. Obiang used shell company, attorney-client, and law office accounts controlled by his attorneys to bring suspect funds into the United States and conduct transactions through U.S. banks without their knowing of his activity, including at banks that had made it clear they did not want his business.

· Lost Escrow Business. An escrow agent who refused to complete the purchase of a $38.5 million Gulfstream jet without information on the source of the funds being supplied by Mr. Obiang, lost out to a competitor willing to complete the transaction with no questions asked.

· $18 Million Through Lobbyist Account. Omar Bongo, President of Gabon for 41 years until his death last year, and his eldest son, Ali Bongo, Minister of Defense until he took his father’s place as President of the country, amassed substantial wealth while in office, amid the extreme poverty of its citizens. In 2006, $18 million in funds from Gabon were wired to the U.S. corporate bank accounts of a U.S. lobbyist who then distributed the funds within the United States and across the globe as directed by President Bongo in connection with two projects to support his regime, buying U.S.-made armored cars and C-130 military cargo planes. Among the funds the lobbyist distributed was $9.2 million which he wire transferred to an account for President Omar Bongo – not in Gabon – but in the country of Malta.

· $1 Million Shrink Wrapped. In 2007, President Omar Bongo brought $1 million in shrink-wrapped $100 bills into the United States under cover of diplomatic immunity without declaring the cash to U.S. authorities as required by law. His daughter, who told her bank that she was an unemployed student, deposited the cash in a U.S. safe deposit box and later into her bank account.

· U.S. Trust Accounts. President Ali Bongo’s wife formed a U.S. trust under her maiden name, and used the trust to open U.S. bank and securities accounts in California.

· Offshore Wire Transfers. Jennifer Douglas, a U.S. citizen and the fourth wife of Atiku Abubakar, former Vice President and former presidential candidate in Nigeria, helped her husband bring more than $40 million in suspect funds into the United States from 2000 to 2008, through wire transfers from offshore corporations. The Securities and Exchange Commission has alleged in a 2008 civil complaint that Ms. Douglas received $2.8 million in bribe payments from a German conglomerate, Siemens AG, which has acknowledged making the payments.

· Arms Dealer. Pierre Falcone, a notorious Angolan arms dealer with a history of run-ins with the law and who is currently serving a 6-year prison sentence, had open access to more than 30 U.S. bank accounts in Arizona for 18 years.

· Central Banker. Aguinaldo Jaime, former head of the Central Bank of Angola, tried twice to transfer $50 million in Angolan government funds to a private account in the United States, only to have the transfers reversed by U.S. financial institutions who became suspicious. The corruption concerns raised by his actions caused Citibank to close all accounts for Angolan government agencies and to close down its office in Angola.

· Private Angolan Bank. Banco Africano Investimentos (“BAI”), a $7 billion private Angolan bank which caters to PEPs, gained access to the U.S. financial system through HSBC in New York, despite troubling information about its ownership and failure to provide a copy of its anti-money laundering policies and procedures.

Recommendations. To combat the abuses, the report makes several recommendations, including:

World Bank PEP Controls. Implementing stronger controls on PEP accounts as laid out in a recent World Bank report, including by requiring banks to use reliable databases to screen clients for PEPs, requiring beneficial ownership forms for bank accounts so hidden PEPs are exposed, and conducting annual reviews of PEP accounts to detect suspicious activity.
Beneficial Owners. Requiring U.S. corporations to identify their beneficial owners, in order to thwart the use of shell companies with hidden PEP owners.
Ending Exemptions. Ending the exemptions Treasury granted in 2002 to the Patriot Act’s anti-money laundering requirements, so that real estate and escrow agents will have to know their customers, evaluate the source of their funds, and turn away suspect clients. Also requiring Treasury to instruct banks to subject attorney-client and law office accounts to greater oversight and stop their use to shield PEPs from scrutiny.
Immigration and Visa Criteria. Toughening immigration and visa rules to make foreign corruption a legal basis for barring entry into the United States and for removing PEPs already here. Increasing law enforcement support for Presidential Proclamation 7750 to identify corrupt foreign officials who should be barred from the United States.
Stronger FATF Recommendations. Encouraging U.S. professional organizations to issue anti-money laundering and anti-corruption guidance to their members.

“Stopping the flow of illegal money is critical, because foreign corruption damages civil society, undermines the rule of law, and threatens our security,” said Levin.

ISPLA is continually reviewing proposed legislation, government reports, media releases, and hearing testimony in its ongoing government affairs program on behalf of investigative and security professionals.

Bruce Hulme, ISPLA Director of Government Affairs

- Providing Timely Important Information to Investigative and Security Professionals -

Current Counter-Terrorist Framework at the National and International Level

Mon, 11 Jan 2010 11:42:26 GMT

STATEMENT BY RICHARD HOROWITZ

Seminar on Human Rights and Terrorism co-sponsored by the Council of Europe, the Spanish Ministry of Foreign Affairs, the Club of Madrid, and the Valsaín Foundation - Malaga, Spain, October 8, 2009

Richard Horowitz is an attorney concentrating in corporate, international, and security matters. He served in the Israeli Defenses Forces for six years and holds a private investigator’s license. His website is www.rhesq.com.

Let me begin by saying that we all want the same thing, which is to save lives without departing from our values in the process. As the opening speaker of the second session though I paid close attention to the deliberations of the first session and recognized that no one mentioned terrorism.

The topic of our seminar is not human rights; it is human rights and terrorism, and since no one spoke about the terrorism this morning I’ll compensate for that. After all, the name of this session is “Current Counter-Terrorist Framework at the National and International Level.” How can we discuss a counter-terrorist framework if we do not talk about the terrorist threat we face?

As such, I wish to make the following points.

First, I disagree with the name of this morning’s session: “Human Rights at the Core of Counter-Terrorism.” It is not. At the core of counter-terrorism is keeping people alive and safe; human rights is one of numerous considerations in carrying out this policy but it is not its core.

An American court, in my opinion, displayed a similarly mistaken view in 1997:

The PFLP [Popular Front for the Liberation of Palestine] is an international organization with ties to Palestine, and which the district court concluded is engaged in a wide range of lawful activities, including the provision of "education, day care, health care, and social security, as well as cultural activities, publications, and political organizing." The government avers that the PFLP is an international terrorist and communist organization, but does not dispute the district court's finding that the organization conducts lawful activities.

Is the PFLP a social welfare organization with a military wing or a terrorist organization that takes care of the social welfare of its people? This sort of question is not new - its nature can be traced backed to Plato and Aristotle - essence versus characteristics. Is terrorism the essence of the PFLP or one of its characteristics? Many people will disagree along political and ideological lines in analyzing a specific group but I think on reflection one should agree that saving lives that is at the core of counterterrorism.

Second, the main threat we face, that of Islamic terrorism, is also not new. Extreme statements made by Islamic terrorists last month are no different than statements made by their ideological predecessors last millennium. The world did not change on 9/11 as is often said; rather, people unaccustomed to thinking about this threat were now confronted with an aspect of the world they heretofore neglected. You all have the article I published in 1999 entitled The International Problem of Islamic Terrorism. It was simply a compilation of news items from the world press from January to June, 1999. I was not the only one who recognized this problem before 9/11.

This is the name hearing before the U.S. House Subcommittee on Europe and the Middle East: Islamic Fundamentalism and Islamic Radicalism. When – July 1985.

An important news item from the BBC –

The 16-hour siege on a Pan Am jet in Pakistan has come to a bloody end, with at least 17 people dead.

Four gunmen, who boarded the Bombay to New York flight at Karachi Airport disguised as security guards, opened fire on the 390 hostages at 2130 local time.

Some passengers were able to escape the carnage down one of the plane's emergency chutes, but it is thought to have been at least 10 minutes before Pakistani commandos reached the jet.

Businessman Mohammed Amin said he heard one hijacker tell another: "The moment of the Last Jihad has arrived. If we are all killed we will all be martyrs."

This BBC report is dated September 5, 1986.

Third, to understand the threat we have to recognize that Islamic and Arab terrorism are the only real forms of international terrorism. Other situations commonly referred to as international terrorism are in reality domestic terrorism occurring in a foreign country. The Shining Path in Peru, the IRA in North Ireland, the ETA in Spain, the Tamil Tigers in Sri Lanka, the FARC in Colombia, Baader-Meinhof in Germany, and so on – do not plan or execute attacks in foreign countries, unrelated to the conflict, or in the international arena. Examples otherwise are the exception that proves the rule.

It can be argued that international terrorism began with Arab hijacking of international flights in the 1960s. And, the U.S. State Department’s Office of the Historian published a history of its Office for Combattng Terrorism, dated March 1984, explaining that the “historical antecedent” to this office was that “on September 25, 1972, 20 days after the terrorist attack on Olympic athletes at Munich, President Nixon established the Cabinet Committee to Combat Terrorism.”

Moreover, U.S. law for example defines international terrorism as follows: “The term ‘international terrorism’ means terrorism involving citizens or the territory of more than one country,”[1] the definition used by the State Department in its well-known Country Reports and Patterns of Global Terrorism. This definition can hardly distinguish between true international terrorism and a domestic attack in a foreign country where citizens of another country happened to be killed.

International hijackings, the Munich Olympics attack, and the attacks in recent years by Islamic terrorists in, for example, New York, London, Madrid, Mumbai, Delhi, Bali, Mombasa, Algiers, Djerba, Kenya and Tanzania, Riyadh, Jakarta, Casablanca, Istanbul, Glasgow, and Amman, the murder of Theo van Gogh in Amsterdam and the fatwa calling for the death of Salman Rushdie; foiled attacks, for example, in Paris, Toronto, Rome, Manila, Germany; the NATO base plot, the Shoe Bomber, the Millennium Bomber, Australia’s Operation Pendennis, Operation Bojinka in 1995 and the Trans-Atlantic plot in 2006, clearly indicate a different objective, strategy, and mind-set than the aforementioned terrorist groups from various countries.

Fourth, concern and hesitancy about using the phrase “Islamic terrorism” hampers an understanding of the threat. No one hesitates using the world mujahidin, yet this word which is the plural of the word mujahid, contains the letters “j,” “h,” and “d.” It and the word jihad have the same root. The letter “m” as a prefix indicates “he who does” – a mujahid is he who does jihad, or a Jihadi in English. Similarly, a mufti is he who makes a fatwa. The world islam has the same root, “s,” “l,” and “m” as the word silm which means submission. A muslim is he who submits (to the will of Allah).

We refer to Hamas, Hezballah, and al-Qaeda because those are the names in Arabic that these groups call themselves. We call the group the Islamic Jihad because it is the translation of what they call themselves – al-Jihad al-Islami.

Is there a Western prejudice against Muslims, a conviction that Muslim morality is so feeble that using the wrong language may push them towards radicalism, which would then be our fault? If radical Muslims use the words Jihad and Islam to describe themselves, why the concern that our doing so will radicalize mainstream Muslims?

Fifth, to a great extent it is the West’s conviction to liberal, democratic values that fuels Islamic terrorists, who are on a mission to insure that the world runs according to Allah’s will. Islamic terrorists cannot and do not reconcile Allah’s will with Western liberty and freedom.

In his 2003 State of the Union speech President Bush said “Americans are a free people, who know that freedom is the right of every person and the future of every nation. The liberty we prize is not America’s gift to the world, it is God’s gift to humanity.” From the President Bush’s 2006 State of the Union speech: “Liberty is the future of every nation in the Middle East, because liberty is the right and hope of all humanity.”

A Western leader invoking God to support liberty in the Middle East, claiming it to be “God’s gift to humanity”?

President Bush is not alone. From John F. Kennedy’s inaugural address in 1961:

[The] same revolutionary beliefs for which our forebears fought are still at issue around the globeundefinedthe belief that the rights of man come not from the generosity of the state, but from the hand of God . . . Let every nation know, whether it wishes us well or ill, that we shall pay any price, bear any burden, meet any hardship, support any friend, oppose any foe, in order to assure the survival and the success of liberty.

And so, my fellow Americans: ask not what your country can do for youundefinedask what you can do for your country. My fellow citizens of the world: ask not what America will do for you, but what together we can do for the freedom of man.

Finally, whether you are citizens of America or citizens of the world, ask of us the same high standards of strength and sacrifice which we ask of you . . .. let us go forth to lead the land we love, asking His blessing and His help, but knowing that here on earth God's work must truly be our own.

A conservative republican and a liberal democratic president, 40 years apart, publicly proclaim that the United States is on a mission from God to spread liberty and freedom – a direct challenge to whether the liberal West or radical Islam will rule the world.

Even without these statements from Western leaders, it is the West’s practice itself of liberty and democratic values that Islamic terrorists want to eradicate. There is no paucity of statements attesting to this from these extremists themselves.

Sixth, human rights, the protection of which is the Council of Europe’s mission, is not a universally agreed-upon concept. Read Sayyid Qutb’s Social Justice in Islam for example, first published in Arabic in 1949, for an understanding of human rights and social justice different than our Western understanding.

Excerpts from the 1990 Cairo Declaration on Human Rights in Islam:

Wishing to contribute to the efforts of mankind to assert human rights, to protect man from exploitation and persecution, and to affirm his freedom and right to a dignified life in accordance with the Islamic Shari’ah;

Article 2
(a) Life is a God-given gift and the right to life is guaranteed to every human being. It is the duty of individuals, societies and states to protect this right from any violation, and it is prohibited to take away life except for a Shari’ah-prescribed reason.

(d) Safety from bodily harm is a guaranteed right. It is the duty of the state to safeguard it, and it is prohibited to breach it without a Shari’ah-prescribed reason.

Article 7

(b) Parents and those in such like capacity have the right to choose the type of education they desire for their children, provided they take into consideration the interest and future of the children in accordance with ethical values and the principles of the Shari’ah.

Article 16
Everyone shall have the right to enjoy the fruits of his scientific, literary, artistic or technical production and the right to protect the moral and material interests stemming therefrom, provided that such production is not contrary to the principles of Shari’ah.

Article 19

(d) There shall be no crime or punishment except as provided for in the Shari’ah.

Article 22
(a) Everyone shall have the right to express his opinion freely in such manner as would not be contrary to the principles of the Shari’ah.

Article 24
All the rights and freedoms stipulated in this Declaration are subject to the Islamic Shari'ah.

Article 25
The Islamic Shari'ah is the only source of reference for the explanation or clarification to any of the articles of this Declaration.

When comparing the 1990 Cairo Declaration on Human Rights and the 1950 European Convention on Human Rights, it is not difficult to see that the Cairo Declaration’s provisions that are subject to Sharia parallel the European Conventions’ provisions that are “subject only to such limitations as are prescribed by law” or similar language.

I do not know what the drafters of the Cairo Declaration had in mind when they referred to Sharia but I do know what today’s Islamic terrorists consider a Sharia dominated world to be, and there is no need to emphasize the difference between their world view and that of the West.

An April 19, 2009 New York Times article entitled “Secure Enough to Sin, Baghdad Returns to Its Old Ways” begins with the sentence “Vice is making a comeback in this city once famous for 1,001 varieties of it.” Since the fall of the Taliban, men in Kabul can shave their beards, girls have gone back to school, and people can buy music and DVDs, all prohibited under Taliban rule.

And so we see that Bin Laden and the Taliban are correct; the spread of Western liberal culture and values are a threat to their interpretation and application of Islam, and they believe they are on a mission from Allah to fight to the death to stop it.

This is the terrorist threat we face; one that affects international security with transnational consequences. It certainly deserves appropriate analysis and discussion, particularly in the context of human rights.

[1] 22 USC § 2656f(d)

Security: Jihadism in 2010

Wed, 06 Jan 2010 19:00:20 GMT

Jihadism in 2010: The Threat Continues

Stratfor Global Intelligence Report – January 6, 2010 - By Scott Stewart

For the past several years, STRATFOR has published an annual forecast on al Qaeda and the jihadist movement. Since our first jihadist forecast in January 2006, we have focused heavily on the devolution of jihadism from a phenomenon primarily involving the core al Qaeda group to one based mainly on the wider jihadist movement and the devolving, decentralized threat it poses.

The central theme of last year’s forecast was that al Qaeda was an important force on the ideological battlefield, but that the efforts of the United States and its allies had marginalized the group on the physical battlefield and kept it bottled up in a limited geographic area. Because of this, we forecast that the most significant threat in terms of physical attacks stemmed from regional jihadist franchises and grassroots operatives and not the al Qaeda core. We also wrote that we believed the threat posed by such attacks would remain tactical and not rise to the level of a strategic threat. To reflect this reality, we even dropped al Qaeda from the title of our annual forecast and simply named it Jihadism in 2009: The Trends Continue.

The past year proved to be very busy in terms of attacks and thwarted plots emanating from jihadist actors. But, as forecast, the primary militants involved in carrying out these terrorist plots were almost exclusively from regional jihadist groups and grassroots operatives, and not militants dispatched by the al Qaeda core. We anticipate that this dynamic will continue, and if anything, the trend will be for some regional franchise groups to become even more involved in transnational attacks, thus further usurping the position of al Qaeda prime at the vanguard of jihadism on the physical battlefield.

A Note on ‘Al Qaeda’

As a quick reminder, STRATFOR views what most people refer to as “al Qaeda” as a global jihadist network rather than a monolithic entity. This network consists of three distinct entities. The first is a core vanguard organization, which we frequently refer to as al Qaeda prime or the al Qaeda core. The al Qaeda core is comprised of Osama bin Laden and his small circle of close, trusted associates, such as Ayman al-Zawahiri. Due to intense pressure by the U.S. government and its allies, this core group has been reduced in size since 9/11 and remains relatively small because of operational security concerns. This insular group is laying low in Pakistan near the Afghan border and comprises only a small portion of the larger jihadist universe.

The second layer of the network is composed of local or regional terrorist or insurgent groups that have adopted jihadist ideology. Some of these groups have publicly claimed allegiance to bin Laden and the al Qaeda core and become what we refer to as franchise groups, like al Qaeda in the Islamic Maghreb (AQIM) or al Qaeda in the Arabian Peninsula (AQAP). Other groups may adopt some or all of al Qaeda’s jihadist ideology and cooperate with the core group, but they will maintain their independence for a variety of reasons. Such groups include the Tehrik-i-Taliban Pakistan (TTP), Lashkar-e-Taiba (LeT) and Harkat-ul-Jihad e-Islami (HUJI). Indeed, in the case of some larger organizations such as LeT, some of the group’s factions may actually oppose close cooperation with al Qaeda.

The third and broadest layer of the network is the grassroots jihadist movement, that is, people inspired by the al Qaeda core and the franchise groups but who may have little or no actual connection to these groups.

As we move down this hierarchy, we also move down in operational capability and expertise in what we call terrorist tradecraft undefined the set of skills required to conduct a terrorist attack. The operatives belonging to the al Qaeda core are generally better trained than their regional counterparts, and both of these layers tend to be far better trained than the grassroots operatives. Indeed, many grassroots operatives travel to places like Pakistan and Yemen in order to seek training from these other groups.

The Internet has long proved to be an important tool for these groups to reach out to potential grassroots operatives. Jihadist chat rooms and Web sites provide indoctrination in jihadist ideology and also serve as a means for aspiring jihadists to make contact with like-minded individuals and even the jihadist groups themselves.

2009 Forecast Review

Overall, our 2009 forecast was fairly accurate. As noted above, we wrote that the United States would continue its operations to decapitate the al Qaeda core and that this would cause the group to be marginalized from the physical jihad, and that has happened.

While we missed forecasting the resurgence of jihadist militant groups in Yemen and Somalia in 2008, in our 2009 forecast we covered these two countries carefully. We wrote that the al Qaeda franchises in Yemen had taken a hit in 2008 but that they could recover in 2009 given the opportunity. Indeed, the groups received a significant boost when they merged into a single group that also incorporated the remnants of al Qaeda in Saudi Arabia, which had been forced by Saudi security to flee the country. We closely followed this new group, which named itself al Qaeda in the Arabian Peninsula (AQAP), and STRATFOR was the first organization we know of to discuss the threat AQAP posed to civil aviation when we raised this subject on Sept. 2 and elaborated on it Sept. 16, in an analysis titled Convergence: The Challenge of Aviation Security. That threat manifested itself in the attempt to destroy an airliner traveling from Amsterdam to Detroit on Christmas Day 2009 undefined an operation that very nearly succeeded.

Regarding Somalia, we have also been closely following al Shabaab and the other jihadist groups there, such as Hizbul Islam. Al Shabaab publicly pledged allegiance to Osama bin Laden in September 2009 and therefore has formally joined the ranks of al Qaeda’s regional franchise groups. However, as we forecast last January, while the instability present in Somalia provides al Shabaab the opportunity to flourish, the factionalization of the country (including the jihadist groups operating there) has also served to keep al Shabaab from dominating the other actors and assuming control of the country.

We also forecast that, while Iraq had been relatively quiet in 2008, the level of violence there could surge in 2009 due to the Awakening Councils being taken off the U.S. payroll and having their control transferred to the Shiite-dominated Iraqi government, which might not pay them and integrate them into the armed forces. Indeed, since August, we have seen three waves of major coordinated attacks against Iraqi ministry buildings in Baghdad linked to the al Qaeda affiliate in Iraq, the Islamic State of Iraq. Since this violence is tied to the political situation in Iraq, and there is a clear correlation between the funds being cut to the Awakening Councils and these attacks, we anticipate that this violence will continue through the parliamentary elections in March. The attacks could even continue after that, if the Sunni powers in Iraq deem that their interests are not being addressed appropriately.

As in 2008, we paid close attention in 2009 to the situation in Pakistan. This not only was because Pakistan is the home of the al Qaeda core’s leadership but also because of the threat that the TTP and the other jihadist groups in the country posed to the stability of the nuclear-armed state. As we watched Pakistan for signs that it was becoming a failed state, we noted that the government was actually making considerable headway in its fight against its jihadist insurgency. Indeed, by late in the year, the Pakistanis had launched not only a successful offensive in Swat and the adjacent districts but also an offensive into South Waziristan, the heart of the TTP’s territory.

We also forecast that the bulk of the attacks worldwide in 2009 would be conducted by regional jihadist franchise groups and, to a lesser extent, grassroots jihadists, rather than the al Qaeda core, which was correct.

In relation to attacks against the United States, we wrote that we did not see a strategic threat to the United States from the jihadists, but that the threat of simple attacks against soft targets remained in 2009. We said we had been surprised that there were no such attacks in 2008 but that, given the vulnerabilities that existed and the ease with which such attacks could be conducted, we believed they were certainly possible. During 2009, we did see simple attacks by grassroots operatives in Little Rock, Arkansas, and at Fort Hood, Texas, along with several other grassroots plots thwarted by authorities.

Forecast for 2010

In the coming year we believe that, globally, we will see many of the trends continue from last year. We believe that the al Qaeda core will continue to be marginalized on the physical battlefield and struggle to remain relevant on the ideological battlefield. The regional jihadist franchise groups will continue to be at the vanguard of the physical battle, and the grassroots operatives will remain a persistent, though lower-level, threat.

One thing we noticed in recent months was that the regional groups were becoming more transnational in their attacks, with AQAP involved in the attack on Saudi Deputy Interior Minister Prince Mohammed bin Nayef in Saudi Arabia as well as the trans-Atlantic airliner bombing plot on Christmas Day. Additionally, we saw HUJI planning an attack against the Jyllands-Posten newspaper and cartoonist Kurt Westergaard in Denmark, and on Jan. 1, 2010, a Somali man reportedly associated with al Shabaab broke into Westergaard’s home armed with an axe and knife and allegedly tried to kill him. We believe that in 2010 we will see more examples of regional groups like al Shabaab and AQAP reaching out to become more transnational, perhaps even conducting attacks in the United States and Europe.

We also believe that, due to the open nature of the U.S. and European societies and the ease of conducting attacks against them, we will see more grassroots plots, if not successful attacks, in the United States and Europe in the coming year. The concept behind AQAP leader Nasir al-Wahayshi’s article calling for jihadists to conduct simple attacks against a variety of targets may be gaining popularity among grassroots jihadists. Certainly, the above-mentioned attack in Denmark involving an axe and knife was simple in nature. It could also have been deadly had the cartoonist not had a panic room within his residence. We will be watching for more simple attacks.

As far as targets, we believe that they will remain largely the same for 2010. Soft targets such as hotels will continue to be popular, since most jihadists lack the ability to attack hard targets outside of conflict zones. However, jihadists have demonstrated a continuing fixation on attacking commercial aviation targets, and we can anticipate additional plots and attacks focusing on aircraft.

Regionally, we will be watching for the following:

Pakistan: Can the United States find and kill the al Qaeda core’s leadership? A Pakistani official told the Chinese Xinhua news agency on Jan. 4 that terrorism will come to an end in Pakistan in 2010, but we are not nearly so optimistic. Even though the military has made good progress in its South Waziristan offensive, most of the militants moved to other areas of Pakistan rather than engage in frontal combat with Pakistan’s army. The area along the border with Pakistan is rugged and has proved hard to pacify for hundreds of years. We don’t think the Pakistanis will be able to bring the area under control in only one year. Clearly, the Pakistanis have made progress, but they are not out of the woods. The TTP has launched a number of attacks in the Punjabi core of Pakistan (including Karachi) and we see no end to this violence in 2010.
Afghanistan: We will continue to closely monitor jihadist actors in this war-torn country. Our forecast for this conflict is included in our Annual Forecast 2010, published on Jan. 4.
Yemen: We will be watching closely to see if AQAP will follow the normal jihadist group lifespan of making a big splash, coming to the notice of the world and then being hit heavily by the host government with U.S. support. This pattern was exhibited a few years back by AQAP’s Saudi al Qaeda brethren, and judging by the operations in Yemen over the past month, it looks like 2010 might be a tough year for the group. It is important to note that the strikes against the group on Dec. 17 and Dec. 24 predated the Christmas bombing attempt, and the pressure on them will undoubtedly be ratcheted up considerably in the wake of that attack. Even as the memory of the Christmas Day attack begins to fade in the media and political circles, the focus on Yemen will continue in the counterterrorism community.
Indonesia: Can Tanzim Qaedat al-Jihad find an effective leader to guide it back from the edge of destruction after the death of Noordin Mohammad Top and the deaths or captures of several of his top lieutenants? Or will the Indonesians be able to enjoy further success against the group’s surviving members?
North Africa: Will AQIM continue to shy away from the al Qaeda core’s targeting philosophy and essentially function as the Salafist Group for Preaching and Combat with a different name in Algeria? Or will AQIM shift back toward al Qaeda’s philosophy of attacking the far enemy and using suicide bombers and large vehicle bombs? In Mauritania, Niger and Mali, will the AQIM-affiliated cells there be able to progress beyond amateurish attacks and petty banditry to become a credible militant organization?
Somalia: We believe the factionalism in Somalia and within the jihadist community there will continue to hamper al Shabaab. The questions we will be looking to answer are: Will al Shabaab be able to gain significant control of areas of the country that can be used to harbor and train foreign militants? And, will the group decide to use its contacts within the Somali diaspora to conduct attacks in East Africa, South Africa, Australia, Europe and the United States? We believe that al Shabaab is on its way to becoming a transnational player and that 2010 may well be the year that it breaks out and then draws international attention like AQAP has done in recent months.
India: We anticipate that Kashmiri jihadist groups will continue to plan attacks against India in an effort to stir-up communal violence in that country and stoke tensions between India and Pakistan undefined and provide a breather to the jihadist groups being pressured by the government of Pakistan.

As long as the ideology of jihadism survives, the jihadists will be able to recruit new militants and their war against the world will continue. The battle will oscillate between periods of high and low intensity as regional groups rise in power and are taken down. We don’t believe jihadists pose a strategic geopolitical threat on a global, or even regional, scale, but they will certainly continue to launch attacks and kill people in 2010.

Note - ISPLA appreciates the excellent work of Stratfor Global Intelligence. This report is republished with the permission of Stratfor: www.STRATFOR.com

Christmas Day Airliner Terrorist Attack & Intelligence Process

Mon, 04 Jan 2010 17:34:47 GMT

The Christmas Day Airliner Attack and the Intelligence Process

By George Friedman-Stratfor Global Intelligence – January 4, 2010

As is well known, a Nigerian national named Umar Farouk Abdulmutallab attempted to destroy a passenger aircraft traveling from Amsterdam to Detroit on Dec. 25, 2009. Metal detectors cannot pinpoint the chemical in the device he sought to detonate, PETN. The PETN was strapped to his groin. Since a detonator could have been detected, the attacker chose undefined or had chosen for him undefined a syringe filled with acid for use as an improvised alternative means to initiate the detonation. In the event, the device failed to detonate, but it did cause a fire in a highly sensitive area of the attacker’s body. An alert passenger put out the fire. The plane landed safely. It later emerged that the attacker’s father, a prominent banker in Nigeria, had gone to the U.S. Embassy in Nigeria to warn embassy officials of his concerns that his son might be involved with jihadists.

The incident drove home a number of points. First, while al Qaeda prime undefined the organization that had planned and executed 9/11 undefined might be in shambles, other groups in other countries using the al Qaeda brand name and following al Qaeda prime’s ideology remain operational and capable of mounting attacks. Second, like other recent attacks, this attack was relatively feeble: It involved a single aircraft, and the explosive device was not well-conceived. Third, it remained and still remains possible for a terrorist to bring explosives on board an aircraft. Fourth, intelligence available in Nigeria, London and elsewhere had not moved through the system with sufficient speed to block the terrorist from boarding the flight.

An Enduring Threat

From this three things emerge. First, although the capabilities of jihadist terrorists have declined, their organizations remain functional, and there is no guarantee that these organizations won’t increase in sophistication and effectiveness. Second, the militants remain focused on the global air transport system. Third, the defensive mechanisms devised since 2001 remain ineffective to some degree.

The purpose of terrorism in its purest form is to create a sense of insecurity among a public. It succeeds when fear moves a system to the point where it can no longer function. This magnifies the strength of the terrorist by causing the public to see the failure of the system as the result of the power of the terrorist. Terror networks are necessarily sparse. The greater the number of persons involved, the more likely a security breach becomes. Thus, there are necessarily few people in a terror network. An ideal terror network is global, able to strike anywhere and in multiple places at once. The extent of the terror network is unknown, partly because of its security systems and partly because it is so sparse that finding a terrorist is like finding a needle in a haystack. It is the fact that the size and intentions of the terror network are unknown that generates the sense of terror and empowers the terrorist.

The global aspect is also important. That attacks can originate in many places and that attackers can belong to many ethnic groups increases the desired sense of insecurity. All Muslims are not members of al Qaeda, but all members of al Qaeda are Muslims, and any Muslim might be a member of al Qaeda. This logic is beneficial to radical Islamists, who want to increase the sense of confrontation between Islam and the rest of the world. This not only increases the sense of insecurity and vulnerability in the rest of the world, it also increases hostility toward Muslims, strengthening al Qaeda’s argument to Muslims that they are in an unavoidable state of war with the rest of the world. Equally important is the transmission of the idea that if al Qaeda is destroyed in one place, it will spring up elsewhere.

This terror attack made another point, intended or not. U.S. President Barack Obama recently decided to increase forces in Afghanistan. A large part of his reasoning was that Afghanistan was the origin of 9/11, and the Taliban hosted al Qaeda. Therefore, he reasoned the United States should focus its military operations in Afghanistan and neighboring Pakistan, since that was the origin of al Qaeda. But the Christmas Day terror attempt originated in Yemen, a place where the United States has been fighting a covert war with limited military resources. It therefore raises the question of why Obama is focusing on Afghanistan when the threat from al Qaeda spinoffs can originate anywhere.

From the terrorist perspective, the Yemen attack was a low-cost, low-risk operation. If it succeeded in bringing down a U.S. airliner over Detroit, the psychological impact would be massive. If it failed to do so, it would certainly increase a sense of anxiety, cause the U.S. and other governments to institute new and expensive security measures, and potentially force the United States into expensive deployments of forces insufficient to dominate a given country but sufficient to generate an insurgency. If just some of these things happened, the attack would have been well worth the effort.

The Strategic Challenge

The West’s problem can be identified this way: There is no strategic solution to low-level terrorism, i.e., terrorism carried out by a sparse, global network at unpredictable times and places. Strategy involves identifying and destroying the center of gravity of an enemy force. By nature, jihadist terrorism fails to present a single center of gravity, or a strong point or enabler that if destroyed would destroy the organization. There is no organization properly understood, and the destruction of one organization does not preclude the generation of another organization.

There are two possible solutions. The first is to accept that Islamist terrorism cannot be defeated permanently but can be kept below a certain threshold. As it operates now, it can inflict occasional painful blows on the United States and other countries undefined including Muslim countries undefined but it cannot threaten the survival of the nation (though it might force regime change in some Muslim countries).

In this strategy, there are two goals. The first is preventing the creation of a jihadist regime in any part of the Muslim world. As we saw when the Taliban provided al Qaeda with sanctuary, access to a state apparatus increases the level of threat to the United States and other countries; displacing the Taliban government reduced the level of threat. The second goal is preventing terrorists from accessing weapons of mass destruction that, while they might not threaten the survival of a country, would certainly raise the pain level to an unacceptable point. In other words, the United States and other countries should focus on reducing the level of terrorist capabilities, not on trying to eliminate the terrorist threat as a whole.

To a great extent, this is the American strategy. The United States has created a system for screening airline passengers. No one expects it to block a serious attempt to commit terrorism on an airliner, nor does this effort have any effect on other forms of terrorism. Instead, it is there to reassure the public that something is being done, to catch some careless attackers and to deter others. But in general, it is a system whose inconvenience is meant to reassure.

The Challenge of Identifying Potential Terrorists

To the extent to which there is a center of gravity to the problem, it is in identifying potential terrorists. In both the Fort Hood attack and the Detroit incident, information was in the system that could have allowed authorities to identify and stop the attackers, but in both cases, this information didn’t flow to the places where action could have been taken. There is thus a chasm between the acquisition of information and the person who has the authority to do something about it. The system “knew” about both attackers, but systems don’t actually think or know anything. The person with authority to stop a Nigerian from boarding the plane or who could relieve the Fort Hood killer from duty lacked one or more of the following: intelligence, real authority and motivation.

The information gathered in Nigeria had to be widely distributed to be useful. It was unknown where Abdulmutallab was going to go or what he was going to do. The number of people who needed to know about him was enormous, from British security to Amsterdam ticket agents checking passports. Without distributing the intelligence widely, it became useless. A net can’t have holes that are too big, and the failure to distribute intelligence to all points creates holes.

Of course, the number of pieces of intelligence that come into U.S. intelligence collection is enormous. How does the person interviewing the father know whether the father has other reasons to put his son on a list? Novels have been written about father-son relations. The collector must decide whether the report is both reliable and significant, and the vast majority of information coming into the system is neither. The intelligence community has been searching for a deus ex machina in the form of computers able not only to distribute intelligence to the necessary places but also to distinguish reliable from unreliable, significant from insignificant.

Forgetting the interagency rivalries and the tendency to give contracts to corporate behemoths with last-generation technology, no matter how widely and efficiently intelligence is distributed, at each step in the process someone must be given real authority to make decisions. When Janet Napolitano or George Tenet say that the system worked after an incident, they mean not that the outcome was satisfactory, but that the process operated as the process was intended to operate. Of course, being faithful to a process is not the same as being successful, but the U.S. intelligence community’s obsession with process frequently elevates process above success. Certainly, process is needed to operate a vast system, but process also is being used to deny people authority to do what is necessary outside the process, or, just as bad, it allows people to evade responsibility by adhering to the process.

Not only does the process relieve individuals in the system from real authority; it also strips them of motivation. In a system driven by process, the individual motivated to abort the process and improvise is weeded out early. There is no room for “cowboys,” the intelligence community term for people who hope to be successful at the mission rather than faithful to the process. Obviously, we are overstating matters somewhat, but not by as much as one might think. Within the U.S. intelligence and security process, one daily sees good people struggling to do their jobs in the face of processes that can’t possibly anticipate all circumstances.

The distribution of intelligence to the people who need to see it is, of course, indispensable, along with whatever other decision supports can be contrived. But, in the end, unless individuals are expected and motivated to make good decisions, the process is merely the preface to failure. No system can operate without process. At the same time, no process can replace authority, motivation and, ultimately, common sense.

The fear of violating procedures cripples Western efforts to shut down low-level terrorism. But the procedures are themselves flawed. A process that says that in a war against radical Islamists, an elderly visitor from Iceland is as big of a potential threat as a twentysomething from Yemen might satisfy some ideological imperative, but it violates the principle of common sense and blocks the authority and the motivation to act decisively.

It is significant that this is one of the things the Obama administration has changed in response to the attempted bombing.

The U.S. Transportation Security Administration (TSA) announced Jan. 4 that anyone traveling from or through nations regarded as state sponsors of terrorism as well as “other countries of interest” will be required to go through enhanced screening. The TSA said those techniques would include full-body pat downs, carry-on luggage searches, full-body scanning and explosive detection technology. The U.S. State Department lists Cuba, Iran, Sudan and Syria as state sponsors of terrorism. The other countries whose passengers will face enhanced screening include Afghanistan, Algeria, Iraq, Lebanon, Libya, Nigeria, Pakistan, Saudi Arabia, Somalia and Yemen. A rational system of profiling thus appears to be developing.

In all likelihood, no system can eliminate events such as what happened on Christmas, and in all likelihood, the republic would survive an intermittent pattern of such events undefined even successful ones. Focusing on the strategic level makes sense. But given the level of effort and cost involved in terrorist protection throughout the world, successful systems for distributing intelligence and helping identify potentially significant threats are long overdue. The U.S. government has been tackling this since 2001, and it still isn’t working.

But, in the end, creating a process that precludes initiative by penalizing those who do not follow procedures under all circumstances and intimidating those responsible for making quick decisions from risking a mistake is bound to fail.

This report is republished with permission of Stratfor www.stratfor.com

U.S. Circuit Court Decision of Note: Computer Records

Fri, 04 Sep 2009 14:56:25 GMT

U.S. Circuit Court Ruling on Computer Searches

In a ruling with broad implications for computer privacy, the Ninth U.S. Circuit Court of Appeals in San Francisco ruled that federal investigators went too far when they seized the digital records of a drug testing company and kept the results of confidential drug tests performed on all Major League baseball players during the 2002 season.

According to published reports, 104 players tested positive for performance enhancing drugs. The names of four of them undefined Alex Rodriguez, Manny Ramirez, David Ortiz, and (now retired) Sammy Sosa undefined were leaked to the press by an anonymous source or sources.

The court upheld a ruling by Judge Florence-Marie Cooper of the Central District Court of California that required the government to yield records taken in the investigation. The judges ruled that law-enforcement agents went far beyond the scope of the warrant authorizing a search of the records of 10 ballplayers for whom the government had established probable cause. Government officials said they are considering an appeal to the U.S. Supreme Court.

The court's 9-2 ruling could have a significant impact on future database searches. It sets forth a five-part standard for warrants, reminiscent of the "Miranda warning" established by the U.S. Supreme Court in a 1966 ruling requiring that criminal suspects be fully notified of their rights when placed under arrest. In computer searches, the circuit court ruled, warrants should not be issued unless the government waives reliance upon the plain view exception to the exclusionary rule, which bars evidence seized without authority of a warrant. Under the long-established plain view exception, evidence that is in plain sight during an authorized search may be taken and used in court even when the object or objects seized are not among the things described in the warrant. Officers with a warrant to search a home for stolen merchandise, for example, may also recognize and seize as evidence marijuana in a transparent bag, left in plain sight on a coffee table.

The Ninth Circuit ruling is the latest in a long and winding trail of litigation stemming from a federal investigation of the Bay Area Laboratories Company (BALCO), suspected of providing steroids to professional baseball players. Prosecutors obtained a subpoena from a grand jury in the Northern District Court of California, calling on Comprehensive Drug Testing Inc. of Santa Ana to turn over
all drug testing records and specimens of all the players who had participated in the 2002 testing. The tests were conducted on all Major League players at the time, with the guarantee that the results would be confidential and there would be no penalties for testing positive. The purpose was to determine if five percent or more of the players would test positive, the threshold agreed to by
the Major League Baseball and the Major League Baseball Players Association as grounds for future testing.

The players association and the testing company appealed the subpoena and succeeded in having it quashed. But the government also obtained a warrant from the Central District Court of California to seize and search the records of the 10 players for whom it had probable cause. Both the district and circuit courts ruled, however, that officials exceeded the terms of the warrant they executed against Comprehensive Drug Testing. The warrant instructed the investigators to determine how much of the information about the ten players could be segregated on-site from the rest of the company's records. It also required procedures for segregating the data in any investigation of the files and records that might be conducted in a law-enforcement laboratory.

"Brushing aside an offer by on-site by CDT personnel to provide all information pertaining to the ten identified baseball players," wrote Chief Judge Alex Kozinski, "the government copied from CDT's computer what the parties have called the 'Tracey Directory,' which contained, in Judge Cooper's words 'information and test results involving hundreds of other baseball players and athletes engaged in other professional sports.'"

Kozinksi dismissed as "too clever by half" the contention that once the agents opened the directory, the disputed records were in plain view. Under that line of reasoning, the judge argued, everything the government wishes to seize would come under the plain view exception.

"Why stop at the list of all baseball players when you can seize the entire Tracey Directory?" Kozinski wrote. "Why just that directory and not the entire hard drive? Why just this computer and not the one in the next room and the next room after that?"

The court noted the difficulties inherent in computer searches, since records can be quickly and easily be destroyed, mislabeled or even "booby trapped" to thwart an investigation. Nonetheless it set forth the following rules for judges to follow in issuing warrants:

Magistrates should insist that the government waive reliance on the plain view doctrine in digital evidence cases.
Segregation and redaction must be either done by specialized personnel or an independent third party. If the segregation is to be done by government computer personnel, it must agree in the warrant application that the computer personnel will not disclose to the investigators any information other than that which is the target of the warrant.
Warrants and subpoenas must disclose the actual risks of destruction of information as well as prior efforts to seize that information in other judicial fora.
The government's search protocol must be designed to uncover only the information for which it has probable cause, and only that information may be examined by the case agents.
The government must destroy or, if the recipient may lawfully possess it, return non-responsive data, keeping the issuing magistrate informed about when it has done so and what ithas kept.

The court's majority opinion acknowledged the difficulty of limiting searches to prescribed bounds when dealing with computer data:

We accept the reality that such over-seizing is an inherent part of the electronic search process and proceed on the assumption that, when it comes to the seizure of electronic records, this will be far more common than in the days of paper records. This calls for greater vigilance on the part of judicial officers in striking the right balance between the government's interest in law enforcement and the right of individuals to be free from unreasonable searches and seizures.

The two dissenting judges argued that it was the court's majority that was overreaching in this case and ignoring it's own precedent, established in a ruling in which the court had denied an appeal to suppress evidence of child pornography found during a computer search for false identity cards. "There is no rule," wrote Judges Consuelo Callahan and Sandra Ikuta, "that evidence turned up while officers are rightfully searching a location under properly issued warrant must be excluded simply because the evidence may support charges for a related crime."

al Qaeda in Arabian Peninsula - Lessons Learned

Wed, 02 Sep 2009 19:16:36 GMT

AQAP: Paradigm Shifts and Lessons Learned

Global Security & Intelligence Report (WWW.STRATFOR.COM ) provided this comprehensive report on international terrorism with emphasis on al Qaeda in Arabian Peninsula (AQAP) which ISPLA gratefully acknowledges.

By Scott Stewart - September 2, 2009

On the evening of Aug. 28, Prince Mohammed bin Nayef, the Saudi Deputy Interior Minister, and the man in charge of the kingdom’s counterterrorism efforts, was receiving members of the public in connection with the celebration of Ramadan, the Islamic month of fasting. As part of the Ramadan celebration, it is customary for members of the Saudi royal family to hold public gatherings where citizens can seek to settle disputes or offer Ramadan greetings.

One of the highlights of the Friday gathering was supposed to be the prince’s meeting with Abdullah Hassan Taleh al-Asiri, a Saudi man who was a wanted militant from al Qaeda in the Arabian Peninsula (AQAP). Al-Asiri had allegedly renounced terrorism and had requested to meet the prince in order to repent and then be accepted into the kingdom’s amnesty program. Such surrenders are not unprecedented, and they serve as great press events for the kingdom’s ideological battle against jihadists. Prince Mohammed, who is responsible for the Saudi rehabilitation program for militants, is a key figure in that ideological battle.

In February, a man who appeared with al-Asiri on Saudi Arabia’s list of most-wanted militants, former Guantanamo Bay inmate Mohammed al-Awfi , surrendered in Yemen and was transported to Saudi Arabia where he renounced terrorism and entered into the kingdom’s amnesty program. Al-Awfi, who had appeared in a January 2009 video issued by the newly created AQAP after the merger of the Saudi and Yemeni nodes of the global jihadist network, was a senior AQAP leader, and his renouncement was a major blow against AQAP.

But the al-Asiri case ended very differently from the al-Awfi case. Unlike al-Awfi, al-Asiri was not a genuine repentant, he was a human Trojan horse. After al-Asiri entered a small room to speak with Prince Mohammed, he activated a small improvised explosive device (IED) he had been carrying inside his anal cavity. The resulting explosion ripped al-Asiri to shreds but only lightly injured the shocked prince, the target of al-Asiri’s unsuccessful assassination attempt.

While the assassination proved unsuccessful, AQAP had been able to shift the operational paradigm in a manner that allowed them to achieve tactical surprise. The surprise was complete and the Saudis did not see the attack coming, the operation could have succeeded had it been better executed.

The kind of paradigm shift evident in this attack has far-reaching implications from a protective-intelligence standpoint, and security services will have to adapt in order to counter the new tactics employed. The attack also allows some important conclusions to be drawn about AQAP’s ability to operate inside Saudi Arabia.

Paradigm Shifts

Militants conducting terrorist attacks and the security services attempting to guard against such attacks have long engaged in a tactical game of cat and mouse. As militants adopt new tactics, security measures are then implemented to counter those tactics. The security changes then cause the militants to change in response and the cycle begins again. These changes can include using different weapons, employing weapons in a new way or changing the type of targets selected.

Sometimes, militants will implement a new tactic or series of tactics that is so revolutionary that it completely changes the framework of assumptions undefined or the paradigm, under which the security forces operate. Historically, al Qaeda and its jihadist progeny have proved to be very good at understanding the security paradigm and then developing tactics intended to exploit vulnerabilities in that paradigm in order to launch surprise attacks. For example:

•· Prior to the 9/11 attacks, it was inconceivable that a large passenger aircraft would be used as a manually operated cruise missile. Hence, security screeners allowed box cutters to be carried onto aircraft, which were then used by the hijackers to take over the planes.

•· The use of faux journalists to assassinate Ahmed Shah Masood with suicide IEDs hidden in their camera gear was also quite inventive.

•· Had Richard Reid been able to light the fuse on his shoe bomb, we might still be wondering what happened to American Airlines Flight 63.

•· The boat bomb employed against the USS Cole in October 2000 was another example of a paradigm shift that resulted in tactical surprise.

Once the element of tactical surprise is lost, however, the new tactics can be countered.

•· When the crew and passengers on United Airlines Flight 93 learned what had happened to the other flights hijacked and flown to New York and Washington on Sept. 11, 2001, they stormed the cockpit and stopped the hijackers from using their aircraft in an attack. Aircraft cockpit doors have also been hardened and other procedural measures have been put in place to make 9/11-style suicide hijackings harder to pull off.

•· Following the Masood assassination, journalists have been given very close scrutiny before being allowed into the proximity of a VIP.

•· The traveling public has felt the impact of the Reid shoe-bombing attempt by being forced to remove their shoes every time they pass through airport security. And the thwarted 2006 Heathrow plot has resulted in limits on the size of liquid containers travelers can take aboard aircraft.

•· The U.S. Navy is now very careful to guard against small craft pulling up alongside its warships.

Let’s now take a look at the paradigm shift marked by the Prince Mohammed assassination attempt.

AQAP’s Tactical Innovations

First, using a repentant militant was a brilliant move, especially when combined with the timing of Ramadan. For Muslims, Ramadan is a time for introspection, sacrifice, reconciliation and repentance, it is a time to exercise self-restraint and practice good deeds. Additionally, as previously mentioned, Ramadan is a time when the Saudi royal family customarily makes itself more accessible to the people than at other times of the year. By using a repentant militant who appears on Saudi Arabia’s list of most-wanted militants, AQAP was playing to the ego of the Saudis, who very much want to crush AQAP, and who also want to use AQAP members who have renounced terrorism and the group as part of their ideological campaign against jihadists. The surrender of an AQAP member offered the Saudi government a prize and a useful tool, it was an attractive offer and, as anticipated, Prince Mohammed took the bait. (Another side benefit of this tactic from the perspective of AQAP is that it will make the Saudis far more careful when they are dealing with surrendered militants in the future.)

The second tactical innovation in this case was the direct targeting of a senior member of the Saudi royal family and the member of the family specifically charged with leading the campaign against AQAP. In the past, jihadist militants in Saudi Arabia have targeted foreign interests and energy infrastructure in the kingdom. While jihadists have long derided and threatened the Saudi royal family in public statements, including AQAP statements released this year, they had not, prior to the Prince Mohammed assassination attempt, ever tried to follow through on any of their threats. Nor has the group staged any successful attack inside the kingdom since the February 2007 attack that killed four French citizens, and it has not attempted a major attack in Saudi Arabia since the failed February 2006 attack against a major oil-processing facility in the city of Abqaiq. Certainly the group had never before attempted a specifically targeted assassination against any member of the very large Saudi royal family, much less a senior member. Therefore the attack against Prince Mohammed came as a complete surprise. There are many less senior members of the royal family who would have been far more vulnerable to attack, but they would not have carried the rank or symbolism that Mohammed does.

But aside from his rank, Mohammed was the logical target to select for this operation because of his office and how he conducts his duties. Mohammed has long served as the primary contact between jihadists and the Saudi government, and he is the person Saudi militants go to in order to surrender. He has literally met with hundreds of repentant jihadists in person and had experienced no known security issues prior to the Aug. 28 incident. This explains why Mohammed personally spoke on the phone with al-Asiri prior to the surrender and why he did not express much concern over meeting with someone who appeared on his government’s list of most-wanted militants. He met with such men regularly.

Since it is well known that Mohammed has made it his personal mission to handle surrendering militants, AQAP didn’t have to do much intelligence work to realize that Mohammed was vulnerable to an attack or to arrange for a booby-trapped al-Asiri to meet with Mohammed. They merely had to adapt their tactics in order to exploit vulnerabilities in the security paradigm.

The third tactical shift is perhaps the most interesting, and that is the use of an IED hidden in the anal cavity of the bomber. Suicide bombers have long been creative when it comes to hiding their devices. In addition to the above-mentioned IED in the camera gear used in the Masood assassination, female suicide bombers with the Liberation Tigers of Tamil Eelam have hidden IEDs inside brassieres, and female suicide bombers with the Kurdistan Workers’ Party have worn IEDs designed to make them look pregnant. However, this is the first instance we are aware of where a suicide bomber has hidden an IED inside a body cavity.

It is fairly common practice around the world for people to smuggle contraband such as drugs inside their body cavities. This is done not only to get items across international borders but also to get contraband into prisons. It is not unusual for people to smuggle narcotics and even cell phones into prisons inside their body cavities (the prison slang for this practice is “keistering”). It is also not at all uncommon for inmates to keister weapons such as knives or improvised stabbing devices known as “shanks.” Such keistered items can be very difficult to detect using standard search methods, especially if they do not contain much metal.

In the case of al-Asiri, he turned himself in to authorities on the afternoon of Aug. 27 and did not meet with Mohammed until the evening of Aug. 28. By the time al-Asiri detonated his explosive device, he had been in custody for some 30 hours and had been subjected to several security searches, though it is unlikely that any of them included a body cavity search. While it is possible that there was some type of internal collusion, it is more likely that the device had been hidden inside of al-Asiri the entire time.

AQAP’s claim of responsibility for the attack included the following statement:
“…Abdullah Hassan Taleh al-Asiri, who was on the list of 85 wanted persons, was able, with the help of God, to enter Nayef’s palace as he was among his guards and detonate an explosive device. No one will be able to know the type of this device or the way it was detonated. Al-Asiri managed to pass all the security checkpoints in Najran and Jeddah airports and was transported on board Mohammed bin Nayef’s private plane.”

AQAP also threatened additional surprise attacks in the “near future,” but now that the type of device al-Asiri used is known, security measures can, and almost certainly will, be implemented to prevent similar attacks in the future.

While keistering an IED is a novel tactic, it does present operational planners with some limitations. For one thing, the amount of explosive material that can be hidden inside a person is far less than the amount that can be placed inside a backpack or is typically used in a suicide belt or vest. For another, the body of the bomber will tend to absorb much of the blast wave and most of any fragmentation from the device. This means that the bomber would have to get in very close proximity to an intended target in order to kill him or her. Such a device would not be very useful for a mass-casualty attack like the July 17 Jakarta hotel bombings and instead would be more useful in assassination attempts against targeted individuals.

We have not been able to determine exactly how the device was triggered, but it likely employed a command-detonated remote device of some kind. Having wires protruding from the bomber’s body would be a sure giveaway. The use of a wireless remote means that the device would be susceptible to radio frequency countermeasures.

One other concern about such a device is that it would likely have a catastrophic result if employed on an aircraft, especially if it were removed from the bomber’s body and placed in a strategic location on board the aircraft. Richard Reid’s shoe IED only contained about four ounces of explosives, an amount that could conceivably be smuggled inside a human.

What the Attack Says About AQAP

While the Aug. 28 attack highlighted AQAP’s operational creativity, it also demonstrated that the group failed to effectively execute the attack after gaining the element of surprise. Quite simply, the bomber detonated his device too far away from the intended target. It is quite likely that the group failed to do adequate testing with the device and did not know what its effective kill radius was. AQAP will almost certainly attempt to remedy that error before it tries to employ such a device again.

In the larger picture, this attempt shows that AQAP does not have the resources inside the kingdom to plan and execute an attack on a figure like Prince Mohammed. That it would try a nuanced and highly targeted strike against Mohammed rather than a more brazen armed assault or vehicle-borne IED attack demonstrates that the group is very weak inside Saudi Arabia. It even needed to rely on operatives and planners who were in Yemen to execute the attack.

When the formation of AQAP was announced in January, STRATFOR noted that it would be important to watch for indications of whether the merger of the Saudi and Yemeni groups was a sign of desperation by a declining group or an indication that it had new blood and was on the rise. AQAP’s assassination attempt on Prince Mohammed has clearly demonstrated that the group is weak and in decline.

AQAP has not given up the struggle, but the group will be hard-pressed to weather the storm that is about to befall it as the Saudis retaliate for the plot. It will be very surprising if it is able to carry through with its threat to attack other members of the Saudi royal family in the near future. Indeed, the very fact that AQAP has threatened more attacks on the royal family likely indicates that the threats are empty; if the group truly did have other plots in the works, it would not want to risk jeopardizing those plots by prompting the Saudis to increase security in response to a threat.

Lacking the strength to conduct large, aggressive attacks, the weakened AQAP will need to continue innovating in order to pose a threat to the Saudi monarchy. But, as seen in the Aug. 28 case, tactical innovation requires more than just a novel idea, militants must also carefully develop and test new concepts before they can use them to effectively conduct a terrorist attack.

Investigation of Terrorism

Thu, 27 Aug 2009 17:01:23 GMT

Investigation of Airline Terrorism

Investigation of Airline Terrorism is thoroughly examined in critique by Stratfor Global Intelligence (www.stratfor.com)

Libya: A Hero’s Welcome - By Scott Stewart and Fred Burton | August 26, 2009

On Aug. 24, Scottish Justice Secretary Kenny MacAskill addressed a special session of the Scottish Parliament. The session was called so that MacAskill could explain why he had decided to release Abdel Basset Ali al-Megrahi, the former Libyan intelligence officer convicted of terrorism charges in connection with the bombing of Pan Am Flight 103, and who had been expected to spend the rest of his life in prison. MacAskill said he granted al-Megrahi a compassionate release because al-Megrahi suffers from terminal prostate cancer and is expected to live only a few months.

The Aug. 20 release of al-Megrahi ignited a firestorm of outrage in both the United Kingdom and the United States. FBI Director Robert Mueller released to the press contents of an uncharacteristically blunt and critical letter he had written to MacAskill in which Mueller characterized al-Megrahi’s release as inexplicable and “detrimental to the cause of justice.” Mueller told MacAskill in the letter that the release “makes a mockery of the rule of law.”

The flames of outrage over the release of al-Megrahi were further fanned when al-Megrahi received a hero’s welcome upon his arrival in Tripoli -- video of him being welcomed and embraced by Libyan leader Moammar Gadhafi was broadcast all over the world.

For his part, Gadhafi has long lobbied for al-Megrahi’s release, even while taking steps to end Libya’s status as an international pariah. Gadhafi first renounced terrorism and his nuclear ambitions in 2003, shortly after the U.S. invasion of Iraq. In October 2008 he completed the compensation agreement with the families of the U.S. victims of the December 1988 bombing of Pan Am 103 and of an April 1986 Libyan attack against the La Belle disco in Berlin.

Yet despite the conviction of al-Megrahi, the 2003 official admission of Libyan responsibility for the Pan Am bombing in a letter to the United Nations, and the agreement to pay compensation to the families of the Pan Am victims, Gadhafi has always maintained in public statements that al-Megrahi and Libya were not responsible for the bombing. The official admission of responsibility for the Pan Am bombing, coupled with the public denials, has resulted in a great deal of ambiguity and confusion over the authorship of the attack -- which, in all likelihood, is precisely what the denials were intended to do.

The Pan Am 103 Investigation

At 7:03 p.m. on Dec. 21, 1988, an improvised explosive device (IED) detonated in one of Pan Am Flight 103’s cargo containers, causing the plane to break apart and fall from the sky. The 259 passengers and crew members aboard the flight died, as did 11 residents of Lockerbie, Scotland, the town where the remnants of the jumbo jet fell.

Immediately following the bombing, there was suspicion that the Iranians or Syrians had commissioned the Popular Front for the Liberation of Palestine General Command (PFLP-GC) to conduct the bombing. This belief was based on the fact that German authorities had taken down a large PFLP-GC cell in Frankfurt in October 1988 and that one member of the cell had in his possession an IED concealed inside a Toshiba radio. Frankfurt is the city where Pan Am 103 departed before stopping in London. Indeed, even today, there are still some people who believe that the PFLP-GC was commissioned by either the Iranian or the Syrian government to conduct the Pan Am bombing.

The PFLP-GC theory might eventually have become the officially accepted theory had the bomb on Pan Am 103 detonated (as planned) while the aircraft was over the North Atlantic Ocean. However, a delay in the plane’s departure from London resulted in the timed device detonating while the aircraft was still over land, and this allowed authorities to collect a great deal of evidence that had been scattered across a wide swath of the Scottish countryside. The search effort was one of the most complex crime-scene investigations ever conducted.

Through months of painstakingly detailed effort, investigators were able to determine that the aircraft was brought down by an IED containing a main charge of Semtex, that the IED had been placed inside a Toshiba radio cassette player (in a macabre coincidence, that particular model of Toshiba, the RT-SF 16, is called the “BomBeat radio cassette player”), and that the radio had been located inside a brown Samsonite hard-side suitcase located inside the cargo container.

Investigators were also able to trace the clothing inside the suitcase containing the IED to a specific shop, Mary’s House, in Sliema, Malta. While examining one of the pieces of Maltese clothing in May 1989, investigators found a fragment of a circuit board that did not match anything found in the Toshiba radio. It is important to remember that in a bombing, the pieces of the IED do not entirely disappear. They may be shattered and scattered, but they are not usually completely vaporized. Although some pieces may be damaged beyond recognition, others are not, and this often allows investigators to reconstruct the device

In mid-1990, after an exhaustive effort to identify the circuit-board fragment, the FBI laboratory in Washington was able to determine that the circuit board was very similar to one that came from a timer that a special agent with the U.S. Diplomatic Security Service had recovered from an arms cache while investigating a Libyan-sponsored coup attempt in Lome, Togo, in 1986. Further investigation determined that the company that produced the timers, the Swiss company MEBO, had sold as many as 20 of the devices to the Libyan government, and that the Libyan government was the company’s primary customer. Interestingly, in 1988, MEBO rented one of its offices in Zurich to a firm called ABH, which was run by two Libyan intelligence officers: Abdel Basset Ali al-Megrahi and Badri Hassan.

The MEBO timer, model MST-13, is very different from the ice-cube timer in the PFLP-GC device found in Frankfurt in October 1988. Additionally, the ice-cube timer in the PFLP-GC device was used in conjunction with a barometric pressure switch, and the IED used a different main charge, TNT, instead of the Semtex used in the Pan Am 103 device.

Perhaps the fact that does the most damage to the PFLP-GC conspiracy theory is that the principal bombmaker for the PFLP-GC Frankfurt cell (and the man who made the PFLP-GC Toshiba device), Marwan Khreesat, was actually an infiltrator sent into the organization by the Jordanian intelligence service. Kreesat not only assisted in providing the information that allowed the Germans to take down the cell, but he was under strict orders by his Jordanian handlers to ensure that every IED he constructed was not capable of detonating. Therefore, it is extremely unlikely that one of the IEDs he created was used to destroy Pan Am 103.

One of the Libyans connected to MEBO, al-Megrahi, is an interesting figure. Not only was he an officer with Libyan intelligence, the External Security Organization, or ESO, but he also served as the chief of security for Libyan Arab Airlines (LAA) and had visited Malta many times. The owner of the Mary’s House clothing shop in Sliema identified al-Megrahi as the man who purchased the clothing found in the suitcase, and Maltese immigration records indicated that al-Megrahi was in Malta on Dec. 7, 1988, the time that the clothing was purchased. Al-Megrahi left Malta on Dec. 9, 1988, but returned to the country using a false identity on Dec. 20, using a passport issued by the ESO in the name of Ahmed Khalifa Abdusamad. Al-Megrahi left Malta using the Abdusamad passport on Dec. 21, 1988, the day the suitcase was apparently sent from Malta aboard Air Malta Flight KM180 to Frankfurt and then transferred to Pan Am 103.

On Nov. 13, 1991, the British government charged al-Megrahi and Lamin Khalifah Fhimah, the LAA station manager at Luqa Airport in Malta, with the bombing. One day later, a federal grand jury in the United States returned an indictment against the same two men for the crime. In March 1995, the FBI added the two men to its most wanted list and the Diplomatic Security Service’s Rewards for Justice Program offered a $4 million reward for their capture. Al-Megrahi and Fhimah were placed under house arrest in Libya -- a comfortable existence that, more than actually confining them, served to protect them from being kidnapped and spirited out of Libya to face trial.

After many years of boycotts, embargos, U.N. resolutions and diplomatic wrangling -- including extensive efforts by South African President Nelson Mandela and U.N. Secretary-General Kofi Annan -- a compromise was reached and all parties agreed to a trial in a neutral country -- the Netherlands -- conducted under Scottish law. On April 5, 1999, al-Megrahi and Fhimah were transferred to Camp Zeist in the Netherlands to stand trial before a special panel of Scottish judges.

On Jan. 31, 2001, after a very long trial that involved an incredible amount of technical and detailed testimony, the judges reached their decision. The Scottish judges acquitted Fhimah, finding that there was not proof beyond a reasonable doubt that he was involved in the plot (the British government had charged that he had been the person who stole the luggage tags and placed the suitcase on the Air Malta flight), but they did find al-Megrahi guilty of 270 counts of murder. He was sentenced to life in prison, with a minimum sentence of 27 years.

Although the case against al-Megrahi was entirely circumstantial -- there was no direct evidence he or Fhimah had placed the device aboard the aircraft -- the Scottish judges wrote in their decision that they believed the preponderance of the evidence, including al-Megrahi’s knowledge of airline security measures and procedures, his connection to MEBO, his purchase of the clothing in the suitcase that had contained the IED and his clandestine travel to Malta on Dec. 20 to 21, 1988, convinced them beyond a reasonable doubt that al-Megrahi was guilty as charged.

In a December 2003 letter to the United Nations, Libya accepted responsibility for the Pan Am 103 bombing. (In the same letter, Libya also took responsibility for the September 1989 bombing of UTA Flight 772, a French airliner destroyed by an IED after leaving Brazzaville, Congo, and making a stop in N’Djamena, Chad. All 170 people aboard the aircraft died when it broke up over the Sahara in Niger.) Nevertheless, the Libyan government continued to maintain al-Megrahi’s innocence in the Pan Am bombing, just as al-Megrahi had done throughout the trial, insisting that he had not been involved in the bombing.

Al-Megrahi’s reluctance to admit responsibility for the bombing or to show any contrition for the attack is one of the factors singled out by those who opposed his release from prison. It is also one of the hallmarks of a professional intelligence officer. In many ways, al-Megrahi’s public stance regarding the bombing can be summed up by the unofficial motto of the CIA’s Office of Technical Services -- “Admit nothing, deny everything, make counter-accusations.”

Shadows

In the shadow world of covert action it is not uncommon for the governments behind such actions to deny (or at least not claim) responsibility for them. These governments also often attempt to plan such attacks in a way that will lead to a certain level of ambiguity -- and thereby provide plausible deniability. This was a characteristic seen in many Libyan attacks against U.S. interests, such as the 1986 La Belle Disco bombing in Berlin. It was only an intercept of Libyan communications that provided proof of Libyan responsibility for that attack.

Many attacks that the Libyans sponsored or subcontracted out, such as the string of attacks carried out against U.S. interests by members of the Japanese Red Army and claimed in the name of the Anti-Imperialist International Brigade, were likewise meant to provide Libya with plausible deniability. Gadhafi did not relish the possibility of another American airstrike on his home in Tripoli, like the one that occurred after the La Belle attack in April 1986. (A number of Libyan military targets also were hit in the broader U.S. military action, known as Operation El Dorado Canyon.) Pan Am 103 is considered by many to be Gadhafi’s retribution for those American airstrikes, one of which killed his adopted baby daughter. Gadhafi, who had reportedly been warned of the strike by the Italian government, was not injured in the attack.

During the 1980s, the Libyan government was locked in a heated tit-for-tat battle with the United States. One source of this friction were U.S. claims that the Libyan government supported terrorist groups such as the Abu Nidal Organization (ANO), which conducted several brutal, high-profile attacks in the 1980s, including the December 1985 Rome and Vienna airport assaults. There was also military tension between the two countries as Libya declared a “line of death” across the mouth of the Gulf of Sidra. The U.S. Navy shot down several Libyan fighter aircraft that had attempted to enforce the edict. But these two threads of tension were closely intertwined; the U.S. Navy purposefully challenged the line of death in the spring of 1986 in response to the Rome and Vienna attacks, and it is believed that the La Belle attack was retribution for the U.S. military action in the Gulf of Sidra. The Libyan ESO was also directly implicated in attacks against U.S. diplomats in Sanaa, Yemen, and Khartoum, Sudan, in 1986.

Because of the need for plausible deniability, covert operatives are instructed to stick to their cover story and maintain their innocence if they are caught. Al-Megrahi’s consistent denials and his many appeals, which often cite the PFLP-GC case in Frankfurt, have done a great deal to sow doubt and provide Libya with some deniability.

Like Osama bin Laden’s initial denial of responsibility for the 9/11 attacks, al-Megrahi’s claims of innocence have served as ready fuel for conspiracy theorists, who claim he was framed by the U.S. and British governments. However, any conspiracy to frame al-Megrahi and his Libyan masters would have to be very wide ranging and, by necessity, reach much further than just London and Washington. For example, anyone considering such a conspiracy must also account for the fact that in 1999 a French court convicted six Libyans in absentia for the 1989 bombing of UTA Flight 772. The six included Abdullah al-Sanussi, Gadhafi’s brother-in-law and head of the ESO.

Getting two or more governments to cooperate on some sort of grand conspiracy to frame the Libyans and exonerate the Iranians and Syrians is hard to fathom. Such cooperation would have to involve enough people that, sooner or later, someone would spill the beans -- especially considering that the Pan Am 103 saga played out over multiple U.S. administrations. As seen by the current stir over CIA interrogation programs, administrations love to make political hay by revealing the cover-ups of previous administrations. Surely, if there had been a secret ploy by the Reagan or Bush administrations to frame the Libyans, the Clinton or Obama administration would have outed it. The same principle applies to the United Kingdom, where Margaret Thatcher’s government oversaw the beginning of the Pan Am 103 investigation and Labour governments after 1997 would have had the incentive to reveal information to the contrary.

While the U.S. and British governments work closely together on a number of intelligence projects, they are frequently at odds on counterterrorism policy and

foreign relations. From our personal experience, we believe that it would be very difficult to get multiple U.S. and British administrations from different political parties to work in perfect harmony to further this sort of conspiracy. Due to the UTA investigation and trial, the conspiracy would have to somehow involve the French government. While the Americans working with the British is one thing, the very idea of the Americans, British and French working in perfect harmony on any sort of project -- much less a grand secret conspiracy to frame the Libyans -- is simply unimaginable. It is much easier to believe that the Libyans were guilty, especially in light of the litany of other terror attacks they committed or sponsored during that era.

Had the IED in the cargo hold of Pan Am 103 exploded over the open ocean, it is very unlikely that the clothing from Malta and the fragment of the MEBO timer would have ever been recovered -- think of the difficulty the French have had in locating the black box from Air France 447 in June of this year. In such a scenario, the evidence linking al-Megrahi and the Libyan government to the Pan Am bombing might never have been discovered and plausible deniability could have been maintained indefinitely.

The evidence recovered in Scotland and al-Megrahi’s eventual conviction put a dent in that deniability, but the true authors of the attack -- al-Megrahi’s superiors -- were never formally charged. Without al-Megrahi’s cooperation, there was no evidence to prove who ordered him to undertake the attack, though it is logical to conclude that the ESO would never undertake such a significant attack without Gadhafi’s approval. Now that al-Magrahi has returned to Libya and is Lybian safekeeping, there is no chance that any death-bed confession will ever be make it to the West. His denials will be his final words and the ambiguity and doubt those denials cast will be his legacy. In the shadowy world of clandestine operations, this is the ideal behavior for someone caught committing an operational act. He has shielded his superiors and his government to the end. From the perspective of the ESO, and Moammar Gadhafi, al-Megrahi is indeed a hero.

Hotels as Targets

Fri, 14 Aug 2009 18:17:01 GMT

Hotels as Targets

By Scott Stewart and Fred Burton

On the morning of July 17, a guest at the JW Marriott hotel in Jakarta came down to the lobby and began walking toward the lounge with his roll-aboard suitcase in tow and a backpack slung across his chest. Sensing something odd about the fellow, alert security officers approached him and asked him if he required assistance. The guest responded that he needed to deliver the backpack to his boss and proceeded to the lounge, accompanied by one of the security guards. Shortly after entering the lounge, the guest activated the improvised explosive device (IED) contained in the backpack, killing himself and five others. Minutes later, an accomplice detonated a second IED in a restaurant at the adjacent Ritz-Carlton hotel, killing himself and two other victims, bringing the death toll from the operation to nine undefined including six foreigners.

The twin bombings in Jakarta underscore two tactical trends that STRATFOR has been following for several years now, namely, the targeting of hotels in terrorist attacks and the use of smaller suicide devices to circumvent physical security measures. The Jakarta attacks also highlight the challenges associated with protecting soft targets such as hotels against such attacks.

Hotels as Targets

During the 1970s the iconic terrorist target became the international airliner. But as airline security increased in response to terrorist incidents, it became more difficult to hijack or bomb aircraft, and this difficulty resulted in a shift in targeting. By the mid-1980s, while there were still some incidents involving aircraft, the iconic terrorist target had become the embassy. But attacks against embassies have also provoked a security response, resulting in embassy security programs that have produced things like the American “Inman buildings”, which some have labeled “fortress America” buildings due to their foreboding presence and their robust construction designed to withstand rocket and large IED attacks. Due to these changes, it became far more difficult to attack embassies, many of which have become, for the most part in our post-9/11 world, hard targets. (This is certainly not universal, and there are still vulnerable embassies in many places. In fact, some countries locate their embassies inside commercial office buildings or hotels.)

Overall, however, this trend of making embassies hard targets has caused yet another shift in the terrorist paradigm. As STRATFOR has noted since 2004, hotels have become the iconic terrorist target of the post-9/11 era. Indeed, by striking an international hotel in a capital city, militants can make the same type of statement against Western imperialism and decadence that they can make by striking an embassy. Hotels are often full of Western businessmen, diplomats and intelligence officers, providing militants with a target-rich environment where they can kill Westerners and gain international media attention without having to penetrate the extreme security of a modern embassy.

Our 2004 observation about the trend toward attacking hotels has been borne out since that time by attacks against hotels in several parts of the world, including Pakistan, Afghanistan, Iraq, Jordan, India and Egypt. In addition to attacks against single hotels, in the attacks in Mumbai, Amman , Sharm el-Sheikh undefined and now Jakarta undefined militants staged coordinated attacks in which they hit more than one hotel.

Hotels have taken measures to improve security, and hotel security overall is better today than it was in 2004. In fact, security measures in place at several hotels, such as the Marriott in Islamabad , have saved lives on more than one occasion. However, due to the very nature of hotels, they remain vulnerable to attacks.

Unlike an embassy, a hotel is a commercial venture and is intended to make money. In order to make money, the hotel needs to maintain a steady flow of customers who stay in its rooms; visitors who eat at its restaurants, drink at its bars and rent its banquet and conference facilities; and merchants who rent out its shop space. On any given day a large five-star hotel can have hundreds of guests staying there, hundreds of other visitors attending conferences or dinner events and scores of other people eating in the restaurants, using the health club or shopping at the luxury stores commonly found inside such hotels. Such amenities are often difficult to find outside of such hotels in cities like Peshawar or Kabul , and therefore these hotels also become gathering places for foreign businessmen, diplomats and journalists residing in the city, as well as for wealthy natives. It is fairly easy for a militant operative to conduct surveillance of the inside of a hotel by posing as a restaurant patron or by shopping in its stores.

Of course, the staff required to run such a huge facility can also number in the hundreds, with clerks, cooks, housekeepers, waiters, bellboys, busboys, valets, florists, gardeners, maintenance men, security personnel, etc. These hotels are like little cities with activities that run 24 hours a day, with people, luggage, food and goods coming and going at all hours. There are emerging reports that one of the suicide bombers in the Jakarta attack was a florist at one of the hotels and it is possible that he used his position to smuggle IED components into the facility among floral supplies. If true, the long-term placement of militant operatives within the hotel staff will pose daunting challenges to corporate security directors. Such an inside placement could also explain how the cell responsible for the attack was able to conduct the detailed surveillance required for the operation without being detected.

Quite simply, it is extremely expensive to provide a hotel with the same level of physical security afforded to an embassy. Land to provide standoff distance is very expensive in many capital cities and heavy reinforced-concrete construction to withstand attacks is far more expensive than regular commercial construction. Such costs must be weighed against the corporate bottom line.

Moreover, security procedures at an embassy such as screening 100 percent of the visitors and their belongings are deemed far too intrusive by many hotel managers, and there is a constant tension between hotel security managers and hotel guest-relations managers over how much security is required in a particular hotel in a specific city. In fact, this debate over security is very similar to the tension that exists between diplomats and security personnel at the U.S. Department of State. And the longer the period between successful attacks (there had not been a successful terrorist attack in Jakarta since September 2004 and in Indonesia since October 2005), the harder it is to justify the added expense undefined and inconvenience undefined of security measures at hotels. (Of course, in very dangerous places such as Baghdad , Islamabad and Kabul heavy security is far easier to justify, and some hotels in such locations have been heavily fortified following attacks on other hotels in those cities.)

In many places, hotel guests are subjected to less security scrutiny than visitors to the hotel, as the hotel staff seeks to make them feel welcomed, and it is not surprising that militants in places like Mumbai (and perhaps Jakarta ) have been able to smuggle weapons and IED components into a hotel concealed inside their luggage. We have received a report from a credible source indicating that one of the Jakarta attackers had indeed been checked into the JW Marriott hotel. The source says the attacker, posing as a guest, was an Indonesian but was likely from a remote area because he did not appear to be familiar with how to use modern conveniences such as the room’s Western-style toilet. That the attackers were Indonesians supports the theory the attack was conducted by the Southeast Asian group Jemaah Islamiyah (JI) or a JI splinter group. JI has conducted (or is a suspect in) every high-profile terror attack in Indonesia in recent years.

Sources advise that significant similarities exist between the unexploded device discovered in the attacker’s hotel room in the JW Marriott and known JI explosive devices used in past attacks and recovered in police raids. This is another strong indication JI was involved.

One other important lesson that travelers should take from this string of hotel attacks is that, while they should pay attention to the level of security provided at hotels, and stay at hotels with better security, they should not rely exclusively on hotel security to keep them safe. There are some simple personal security measures that should also be taken to help mitigate the risk of staying at a hotel.

Size is Not Everything

As STRATFOR has noted since 2005, the counterterrorism tactic of erecting barricades around particularly vulnerable targets undefined including government buildings such as embassies and softer targets such as hotels undefined has forced militants to rethink their attack strategies and adapt. Instead of building bigger and bigger bombs that could possibly penetrate more secure areas, operational planners are instead thinking small undefined and mobile. In fact it was the October 2005 triple-bomb attacks against restaurants in Bali , Indonesia , by JI and the November 2005 triple suicide-bombing attacks against three Western hotels in Amman , Jordan , that really focused our attention on this trend.

Like the July 7, 2005, London bombings, these two attacks in Jakarta and Amman used smaller-scale explosive devices to bypass security and target areas where people congregate. Such attacks demonstrated an evolution in militant tactics away from large and bulky explosives and toward smaller, more portable devices that can be used in a wider variety of situations. Flexibility provides many options, and in the case of the operative who attacked the JW Marriott on July 17, it appears that he was able to approach a meeting of foreign businessmen being held in the lobby lounge and attack them as a target of opportunity. A vehicle-borne IED (VBIED) detonated in front of the hotel would not likely have been able to target such a group so selectively on the fly.

Of course, this trend does not mean that large VBIEDs will never again be employed any more than the trend to attack hotels means aircraft and embassies will never be attacked. Rather, the intent here is to point out that as security has been increased around targets, militants have adapted to security measures designed to stop them and they have changed their tactics.

At first glance, it would seem logical that the shift from large VBIEDs would cause casualty counts to drop, but in the case of JI attacks in Indonesia , the shift to smaller devices has, in fact, caused higher casualty counts. The August 2003 attack against the JW Marriott in Jakarta used a VBIED and left 12 people dead. Likewise, the September 2004 attack against the Australian embassy in Jakarta used a VBIED and killed 10 people. The use of three smaller IEDs in the 2005 Bali attacks killed 23, more than JI’s 2003 and 2004 VBIED attacks combined. Additionally, the 2005 attacks killed five foreigners as opposed to only one in the 2003 attack and none in the 2004 attacks. The operatives behind the July 17 attacks surpassed the 2005 Bali attacks by managing to kill six foreigners.

The reason that smaller is proving to be more effective at killing foreigners is that the rule for explosives is much like real estate undefined the three most important factors are location, location and location. Though a larger quantity of explosives will create a larger explosion, the impact of an explosion is determined solely by placement. If a bomber can carry a smaller explosive into the center of a heavily packed crowd undefined such as a wedding reception or hotel lobby undefined it will cause more damage than a larger device detonated farther away from its intended target. These smaller devices can also be used to target a specific person, as seen in the December 2007 assassination of former Pakistani Prime Minister Benazir Bhutto .

A person carrying explosives in a bag or concealed under clothing is much more fluid and can thus maneuver into the best possible position before detonating. In essence, a suicide bomber is a very sophisticated form of “smart” munition that can work its way through gaps in security and successfully seek its target. This type of guidance appears to have worked very effectively in the July 17 Jakarta attacks. As noted above, of the seven victims in this attack (the nine total deaths included the bombers), six were foreigners. JI has received criticism from the Islamist community in Indonesia for killing innocent bystanders (and Muslims) and such targeted attacks will help mute such criticism.

In addition to being more efficient, smaller IEDs also are cheaper to make. In an environment where explosive material is difficult to obtain, it is far easier to assemble the material for two or three small devices than the hundreds of pounds required for a large VBIED. An attack like the July 17 Jakarta attack could have been conducted at a very low cost, probably not more than a few thousand dollars. The three devices employed in that attack (as noted above, there was a third device left in the hotel room that did not explode) likely did not require much more than 60 pounds of explosive material.

This economical approach to terrorism is a distinct advantage for a militant group like Noordin Mohammad Top’s faction of JI, Tanzim Qaedat al-Jihad. Due to the Indonesian government’s crackdown on JI and its factions, the Indonesian militants simply do not have the external funding and freedom of action they enjoyed prior to the October 2002 Bali attack. This means that, at the present time, it would be very difficult for JI to purchase or otherwise procure the hundreds of pounds of explosive material required for a large VBIED undefined coming up with 60 pounds is far easier.

Even though JI is fragmented and its abilities have been degraded since the 2002 Bali attack, a cell like the one headed by Top certainly maintains the ability and the expertise to conduct low-cost, carefully targeted attacks like the July 17 Jakarta bombings. Such attacks are easily sustainable, and the only real limiter on the group’s ability to conduct similar attacks in the future is finding attackers willing to kill themselves in the process. Perhaps a more significant limiter on their operational tempo will be the law enforcement response to the attack, which could force the cell to go underground until the heat is off. It might also be difficult to move operatives and IEDs from safe houses to targets when there is more scrutiny of potential JI militants.

Increased security at potential targets could also cause the cell to wait until complacency sets in before attacking a less wary undefined and softer undefined target. Of course, the group’s operational ability will also be affected should the Indonesian government capture or kill key operatives like Top and his lieutenants.

From the standpoint of security, the challenges of balancing security with guest comfort and customer service at large hotels will continue to be a vexing problem, though certainly it would not be surprising to see an increase in the use of magnetometers and X-ray machines to screen guests and visitors at vulnerable facilities. This may also include such measures as random bomb-dog searches and sweeps in areas where dogs are not a cultural taboo. Additionally, in light of the threat of suicide bombers using smaller devices or posing as guests, or even placing operatives on the hotel staff, much more effort will be made to implement proactive security measures such as protective intelligence and counter surveillance, which focus more on identifying potential attackers than on his or her weapons.

Hotel staff members also need to be taught that security is not just the role of the designated security department. Security officers are not omnipresent; they require other people on the hotel staff who have interactions with the guests and visitors to be their eyes and ears and to alert them to individuals who have made it through security and into the hotel and appear to be potential threats. Of course, the traveling public also has a responsibility not only to look out for their own personal security but to maintain a heightened state of situational awareness and notify hotel security of any unusual activity

Above report prepared by Stratfor Global Intelligence.

Security at Places of Worship: More Than a Matter of Faith

Fri, 14 Aug 2009 18:14:43 GMT

Security at Places of Worship: More Than a Matter of Faith

June 17, 2009 | 1706 GMT - By Scott Stewart and Fred Burton of Stratfor Global Intelligence

In recent months, several high-profile incidents have raised awareness of the threat posed by individuals and small groups operating under the principles of leaderless resistance. These incidents have included lone wolf attacks against a doctor who performed abortions in Kansas, an armed forces recruitment center in Arkansas and the U.S. Holocaust Memorial Museum in Washington, D.C. Additionally, a grassroots jihadist cell was arrested for attempting to bomb Jewish targets in the Bronx and planning to shoot down a military aircraft at an Air National Guard base in Newburgh, N.Y.

In addition to pointing out the threat posed by grassroots cells and lone wolf operatives, another common factor in all of these incidents is the threat of violence to houses of worship. The cell arrested in New York left what they thought to be active improvised explosive devices outside the Riverdale Temple and the Riverdale Jewish Community Center. Dr. George Tiller was shot and killed in the lobby of the Reformation Lutheran Church in Wichita. Although Abdulhakim Mujahid Muhammad conducted his attack against a Little Rock recruiting center, he had conducted preoperational surveillance and research on targets that included Jewish organizations and a Baptist church in places as far away as Atlanta and Philadelphia. And while James von Brunn attacked the Holocaust Museum, he had a list of other potential targets in his vehicle that included the National Cathedral.

In light of this common thread, it might be instructive to take a more detailed look at the issue of providing security for places of worship.

Awareness: The First Step

Until there is awareness of the threat, little can be done to counter it. In many parts of the world, such as Iraq, India and Pakistan, attacks against places of worship occur fairly frequently. It is not difficult for religious leaders and members of their congregations in such places to be acutely aware of the dangers facing them and to have measures already in place to deal with those perils. This is not always the case in the United States, however, where many people tend to have an “it can’t happen here” mindset, believing that violence in or directed against places of worship is something that happens only to other people elsewhere.

This mindset is particularly pervasive among predominantly white American Protestant and Roman Catholic congregations. Jews, Mormons, Muslims and black Christians, and others who have been targeted by violence in the past, tend to be far more aware of the threat and are far more likely to have security plans and measures in place to counter it. The Jewish community has very well-developed and professional organizations such as the Secure Community Network (SCN) and the Anti-Defamation League that are dedicated to monitoring threats and providing education about the threats and advice regarding security. The Council on American-Islamic Relations has taken on a similar role for the Muslim community and has produced a “Muslim community safety kit” for local mosques. The Church of Jesus Christ of Latter-day Saints (LDS) also has a very organized and well-connected security department that provides information and security advice and assistance to LDS congregations worldwide.

There are no functional equivalents to the SCN or the LDS security department in the larger Catholic, evangelical Protestant and mainline Protestant communities, though there are some organizations such as the recently established Christian Security Network that have been attempting to fill the void.

Following an incident, awareness of the threat seems to rise for a time, and some houses of worship will put some security measures in place, but for the most part such incidents are seen as events that take place elsewhere, and the security measures are abandoned after a short time.

Permanent security measures are usually not put in place until there has been an incident of some sort at a specific house of worship, and while the triggering incident is sometimes something that merely provides a good scare, other times it is a violent action that results in tragedy. Even when no one is hurt in the incident, the emotional damage caused to a community by an act of vandalism or arson at a house of worship can be devastating.

It is important to note here that not all threats to places of worship will emanate from external actors. In the midst of any given religious congregation, there are, by percentages, people suffering from serious mental illnesses, people engaged in bitter child-custody disputes, domestic violence situations and messy divorces. Internal disputes in the congregation can also lead to feuds and violence. Any of these situations can (and have) led to acts of violence inside houses of worship.

Security Means More than Alarms and Locks

An effective security program is more than just having physical security measures in place. Like any man-made constructs, physical security measures undefined closed-circuit television (CCTV), alarms, cipher locks and so forth undefined have finite utility. They serve a valuable purpose in institutional security programs, but an effective security program cannot be limited to these things. Devices cannot think or evaluate. They are static and can be observed, learned and even fooled. Also, because some systems frequently produce false alarms, warnings in real danger situations may be brushed aside. Given these shortcomings, it is quite possible for anyone planning an act of violence to map out, quantify and then defeat or bypass physical security devices. However, elaborate planning is not always necessary. Consider the common scenario of a heavy metal door with very good locks that is propped open with a trashcan or a door wedge. In such a scenario, an otherwise “secure” door is defeated by an internal security lapse.

However, even in situations where there is a high degree of threat awareness, there is a tendency to place too much trust in physical security measures, which can become a kind of crutch undefined and, ironically, an obstacle to effective security.

In fact, to be effective, physical security devices always require human interaction. An alarm is useless if no one responds to it, or if it is not turned on; a lock is ineffective if it is not engaged. CCTV cameras are used extensively in corporate office buildings and some houses of worship, but any competent security manager will tell you that, in reality, they are far more useful in terms of investigating a theft or act of violence after the fact than in preventing one (although physical security devices can sometimes cause an attacker to divert to an easier target).

No matter what kinds of physical security measures may be in place at a facility, they are far less likely to be effective if a potential assailant feels free to conduct preoperational surveillance, and is free to observe and map those physical security measures. The more at ease someone feels as they set about identifying and quantifying the physical security systems and procedures in place, the higher the odds they will find ways to beat the system.

A truly “hard” target is one that couples physical security measures with an aggressive, alert attitude and sense of awareness. An effective security program is proactive undefined looking outward to where most real threats are lurking undefined rather than inward, where the only choice is to react once an attack has begun to unfold. We refer to this process of proactively looking for threats as protective intelligence.

The human interaction required to make physical security measures effective, and to transform a security program into a proactive protective intelligence program, can come in the form of designated security personnel. In fact, many large houses of worship do utilize off-duty police officers, private security guards, volunteer security guards or even a dedicated security staff to provide this coverage. In smaller congregations, security personnel can be members of the congregation who have been provided some level of training.

However, even in cases where there are specially designated security personnel, such officers have only so many eyes and can only be in a limited number of places at any one time. Thus, proactive security programs should also work to foster a broad sense of security awareness among the members of the congregation and community, and use them as additional resources.

Unfortunately, in many cases, there is often a sense in the religious community that security is bad for the image of a particular institution, or that it will somehow scare people away from houses of worship. Because of this, security measures, if employed, are often hidden or concealed from the congregation. In such cases, security managers are deprived of many sets of eyes and ears. Certainly, there may be certain facets of a security plan that not everyone in the congregation needs to know about, but in general, an educated and aware congregation and community can be a very valuable security asset.

Training

In order for a congregation to maintain a sense of heightened awareness it must learn how to effectively do that. This training should not leave people scared or paranoid undefined just more observant. People need to be trained to look for individuals who are out of place, which can be somewhat counterintuitive. By nature, houses of worship are open to outsiders and seek to welcome strangers. They frequently have a steady turnover of new faces. This causes many to believe that, in houses of worship, there is a natural antagonism between security and openness, but this does not have to be the case. A house of worship can have both a steady stream of visitors and good security, especially if that security is based upon situational awareness.

At its heart, situational awareness is about studying people, and such scrutiny will allow an observer to pick up on demeanor mistakes that might indicate someone is conducting surveillance. Practicing awareness and paying attention to the people approaching or inside a house of worship can also open up a whole new world of ministry opportunities, as people “tune in” to others and begin to perceive things they would otherwise miss if they were self-absorbed or simply not paying attention. In other words, practicing situational awareness provides an excellent opportunity for the members of a congregation to focus on the needs and burdens of other people.

It is important to remember that every attack cycle follows the same general steps. All criminals undefined whether they are stalkers, thieves, lone wolves or terrorist groups undefined engage in preoperational surveillance (sometimes called “casing,” in the criminal lexicon). Perhaps the most crucial point to be made about preoperational surveillance is that it is the phase when someone with hostile intentions is most apt to be detected undefined and the point in the attack cycle when potential violence can be most easily disrupted or prevented.

The second most critical point to emphasize about surveillance is that most criminals are not that good at it. They often have terrible surveillance tradecraft and are frequently very obvious. Most often, the only reason they succeed in conducting surveillance without being detected is because nobody is looking for them. Because of this, even ordinary people, if properly instructed, can note surveillance activity.

It is also critically important to teach people undefined including security personnel and members of the congregation undefined what to do if they see something suspicious and whom to call to report it. Unfortunately, a lot of critical intelligence is missed because it is not reported in a timely manner undefined or not reported at all undefined mainly because untrained people have a habit of not trusting their judgment and dismissing unusual activity. People need to be encouraged to report what they see.

Additionally, people who have been threatened, are undergoing nasty child-custody disputes or have active restraining orders protecting them against potentially violent people need to be encouraged to report unusual activity to their appropriate points of contact.

As a part of their security training, houses of worship should also instruct their staff and congregation members on procedures to follow if a shooter enters the building and creates what is called an active-shooter situation. These “shooter” drills should be practiced regularly undefined just like fire, tornado or earthquake drills. The teachers of children’s classes and nursery workers must also be trained in how to react.

Liaison

One of the things the SCN and ADL do very well is foster security liaison among Jewish congregations within a community and between those congregations and local, state and federal law enforcement organizations. This is something that houses of worship from other faiths should attempt to duplicate as part of their security plans.

While having a local cop in a congregation is a benefit, contacting the local police department should be the first step. It is very important to establish this contact before there is a crisis in order to help expedite any law enforcement response. Some police departments even have dedicated community liaison officers, who are good points of initial contact. There are other specific points of contact that should also be cultivated within the local department, such as the SWAT team and the bomb squad.

Local SWAT teams often appreciate the chance to do a walk-through of a house of worship so that they can learn the layout of the building in case they are ever called to respond to an emergency there. They also like the opportunity to use different and challenging buildings for training exercises (something that can be conducted discreetly after hours). Congregations with gyms and weight rooms will often open them up for local police officers to exercise in, and some congregations will also offer police officers a cup of coffee and a desk where they can sit and type their reports during evening hours.

But the local police department is not the only agency with which liaison should be established. Depending on the location of the house of worship, the state police, state intelligence fusion center or local joint terrorism task force should also be contacted. By working through state and federal channels, houses of worship in specific locations may even be eligible for grants to help underwrite security through programs such as the Department of Homeland Security’s Urban Areas Security Initiative Nonprofit Security Grant Program.

The world is a dangerous place and attacks against houses of worship will continue to occur. But there are proactive security measures that can be taken to identify attackers before they strike and help prevent attacks from happening or mitigate their effects when they do.

This report may be forwarded or republished on your website with attribution to www.stratfor.com