Terrorist Threat Indicators

By Richard Marquise

Photo: Scott Morrison

24 The Counter Terrorist ~ September/October 2008 On September 5, 1972, Palestinian terrorists from the Black September Organization entered the world stage at the Olympic Games in Munich. Before it was over, 11 Israeli athletes were dead and the world was forever changed.

n the following weeks, the United the general public, through undercover States Government received operations, searches and car stops, as well information that a terrorist attack as interviews, technical coverage and jail would occur within the . intelligence. Law enforcement analysts IFBI agents familiar with the threat from review large amounts of information the enemies of the time, the Soviet Union and are a source of identifying pre-attack and China – the Communists—were indicators. A knowledgeable general dispatched to prevent it. public can also identify and report Due to the large “Arab” population indicators of terrorism. in the Dearborn, Michigan, area, agents Not all terrorists look like the 19 men began surveillances and conducted who hijacked airplanes on September numerous interviews. Few of them 11. They look like each of us. John understood the difference between Walker Lindh, José Padilla, or any of Sunnis and Shiites or knew about the the terrorists who have attacked targets complex political situation in the Middle in Russia, east Africa, the Philippines, East. The police in Dearborn were India, Jordan, Pakistan, Indonesia, Spain unaware of the FBI activities in that or the United Kingdom over the past community. The FBI believed it alone 15 years are proof of this. While this was equipped to deal with this threat, makes an officer’s job more difficult, each and since the information came from must examine behaviors and activities, “intelligence” sources, it could not be rather than appearance, to spot a terrorist shared. Fortunately we have come a long planning an attack. Terrorists plan, way since this time. collect intelligence, acquire materials Today, there are approximately 13,000 and exhibit certain behaviors during FBI agents in the United States, not all this process, which, if recognized, could of whom work terrorism. It is the great prevent an act of terrorism. force multiplier of 800,000 federal, Throughout our nation’s history, state, local and tribal law enforcement terrorism has been prevented by state officers who will prevent the next act of and local officers. In late 1987, the terrorism. These officers may encounter chief of police in a small Vermont town terrorist indicators during contact with arrested three Middle Eastern men near

Photo: Scott Morrison

The Counter Terrorist ~ September/October 2008 25 The planning stage not designed to cause mass casualties, finding the ideal apartment and forging but simply send a message that terrorists documents, as well as training in making is the best opportunity could strike at will. Nonmilitary chemical and biological weapons.6 Every to prevent attacks, government institutions have traditionally law enforcement officer should read this been targeted. Police stations in America manual, a version of which is available and it is through were attacked by domestic terrorists on the Internet, in order to “know the the recognition of in the 1960s and 1970s. In Iraq, law enemy.” enforcement and nonmilitary government Terrorists are opportunistic and indicators that law entities are daily targets. Approximately will strike where we are vulnerable enforcement can stop 17 percent of the 25,000 international and inattentive, much as we were on terrorist attacks which occurred in September 11. The planning stage is the an attack. Just as 2005-06 were directed against law best opportunity to prevent attacks, and terrorists learn from enforcement.3 The Murrah Building it is through the recognition of indicators was targeted by domestic terrorists. that law enforcement can stop an attack. previous attacks, Military facilities and specific individuals Just as terrorists learn from previous law enforcement can have been targeted by domestic and attacks, law enforcement can study their study their methods to international terrorists throughout methods to prevent future attacks. history. FBI Director Robert S. Mueller, Terrorists surveil their targets. During prevent future attacks. in Congressional testimony, stated that an officer’s daily work, he or she may see future attacks will be against “economic unusual cameras, night-vision equipment, targets such as aviation, the energy sector maps with targets highlighted, blueprints and mass transit; soft targets such as large and law enforcement or terrorist training public gatherings; and symbolic targets, manuals. Officers may notice individuals the Canadian border. It appeared that such as monuments and government loitering near or photographing these men had circumvented the border buildings.”4 potential targets. During 2004, officers crossing and later provided conflicting United States law enforcement has from Baltimore County, Maryland, information in response to the chief’s had the al Qaeda manual or “playbook” noticed individuals videotaping on the questions. Investigation determined for more than a decade. First discovered Chesapeake Bay Bridge, a major east- they were preparing to commit a terrorist in the mid-1990s, one version says the coast route. They tried to conceal their attack in the United States.1 Months best targets for spreading fear in the U.S. activities, but the officers spoke with later, a Japanese Red Army member was and Europe include skyscrapers, nuclear them and shared the information with arrested by a New Jersey state trooper plants, and crowded football stadiums. the Joint Terrorism Task Force (JTTF). outside New York City en route to It discusses hitting sites of sentimental Investigation determined the driver of commit terrorist attacks.2 The bombers of value, including the Statue of Liberty, their vehicle was a co-conspirator in a 15- the Murrah Building in Oklahoma City Big Ben and the EiffelT ower, to generate year scheme to finance terrorist activities and the Atlanta Olympic games in 1995 intense publicity. Their targets include in Israel for Hamas, a Palestinian terrorist and 1996, respectively, were arrested by Jewish organizations and large gatherings organization.7 Although Hamas has state and local police officers just doing to cause as many deaths as possible. never conducted an attack in the United their jobs. This manual stipulates the strikes must States, we have been a major source There are many challenges to be strong and have a wide impact on of funds for them. However, as the preventing terrorism. These include the population.5 Their tactics are also U.S. Government increasingly restricts target displacement, sleeper cells and outlined in the manual and include fundraising, groups like Hamas have less the fact the threat is ever-changing. The gathering information about the enemy and less reason not to conduct an attack. solution is to understand the threat, (intelligence collection), kidnapping During the past several years, collect information and share it. and assassinating enemy personnel, and automatic weapons attacks have replaced Terrorist targets have changed. how to respond to law enforcement bombings as the number one weapon Historically, most attacks were symbolic, contacts. Other sections are devoted to of choice for international terrorist

26 The Counter Terrorist ~ September/October 2008 organizations.8 If officers receive reports is often easy to acquire through illegal of thefts or unusual sales of weapons or means, but others counterfeit driver’s ammunition, these should be shared with licenses, vehicle registrations and license the JTTF. The same is true for reports of plates, identification cards, social security automatic weapons firing, theft or sale of cards, as well as immigration documents, body armor to non law enforcement, as visas and passports. Each document well as any unusual paramilitary training. should be questioned and officers should An alert officer in Skamania County, look for alterations. Compare the Washington, investigated reports of individual with the photograph on the automatic gunfire shortly after 9/11 and document presented. Ask where the reported his findings to the JTTF. This document was obtained, and inquire as resulted in convictions of the “Portland to citizenship and place of birth. If the Seven,” a group of American citizens who officer is unable to ascertain whether the were preparing to go to Afghanistan and documents are legitimate, have an expert wage war on American troops.9 verify them. Since terrorists still use explosives Officers may come upon evidence to carry out attacks, any theft, sale or that drug proceeds support terrorist storage of explosive components should organizations. The Madrid train attacks be shared with the JTTF. Vehicles are in 2004 may have been in part financed used to transport explosives, and reports through the sale of drugs.11 In South about the modification of cars, trucks or America, there is a close relationship limousines should be shared. The same between drug traffickers and terrorist is true if information is received about organizations.12 Because terrorists individuals undergoing emergency room must finance their operations and most treatment for missing fingers, hands or governments are making concerted efforts chemical burns. These may be indicators to seize assets and shut down fund-raising of terrorist bomb-making activity. mechanisms, “routine” criminal activity is In the fall of 2005, a University one way they can earn money. of Oklahoma student detonated a State sponsors and nongovernmental homemade bomb outside the school’s organizations have historically funded football stadium during a game attended terrorist operations. As governments by more than 80,000 people. It is not have clamped down on these activities, conclusively known whether the bomb terrorists have turned to various criminal detonated prematurely, whether he enterprises. These include credit- and intended to take it into the stadium, or telephone-card fraud, trafficking in stolen whether it was his intention to wait until property, counterfeiting, bank- and the game was over and kill passersby. The mail-fraud schemes, as well as selling investigation turned up no connection counterfeit designer clothing, high end to terrorism, yet this young man had beauty products, CDs and DVDs. attempted to buy ammonium nitrate In the late 1990s, a deputy sheriff in several days before he detonated his North Carolina was working security at bomb. The bomb he made with easily a cigarette mart. He noted that some obtainable items was similar to those used men were regularly purchasing large in the 2005 London subway attacks.10 quantities of cigarettes. Engaging them Technology has made the creation of in conversation, he learned they were identification documents easier and more taking them to Michigan where taxes difficult to detect. Legal documentation were ten times those of North Carolina.

The Counter Terrorist ~ September/October 2008 27 He initially reported this information suicide bomber. They: France in February 1994, and although to the Bureau of Alcohol, Tobacco and • conduct boundary probing (how he possessed false documentation, he Firearms (ATF). Investigation soon close can they get to the target?) was welcomed and provided with social determined these men were fund raisers • Wear heavy clothing to hide assistance. Ressam failed to appear for for Hezbollah, an Iranian-backed terrorist explosives regardless of the season his immigration hearing and became organization, which, before September • Display a robotic gait or nervously involved in criminal activity. 11, 2001, had killed more Americans look around A French magistrate, investigating than any other international terrorist • show signs of tunnel vision and are the al Qaeda threat in France, told the organization. The FBI and ATF worked not responsive to commands Canadians about Ressam. Although the together and brought down this group, • Give the appearance of being Canadians monitored Ressam and his a major Hezbollah cell, which had drugged colleagues’ telephone conversations, they transferred $8 million to the Middle • Wear too much cologne or have did not consider them a threat. They East. The observations of one alert police other unusual smells learned that Ressam, who had acquired officer had disrupted a major terrorist • carry a large backpack another identity, was on his way to fund-raising cell.13 • Have wires protruding from sleeves “camp” in Afghanistan. He spent most In addition to cigarette smuggling or hands in pockets (for detonator) of 1998 there learning to make bombs. schemes, law enforcement officers should • Have a fresh shave or make other Ressam returned to Canada via Los be alert for baby-formula and grocery- attempts to “blend in.”15 16 Angeles, and despite spending nearly a store coupon fraud, as well as individuals While these indicators may be year in Afghanistan, and having been the having connections to foreign charities. appropriate to Israel, other suspicious focus of Canadian and French authorities, Officers should also be aware of behavior outlined in this article may be he was on no one’s radar. He drove to individuals having multiple forms more applicable to a suicide bomber in western Canada and began assembling of identification during car stops, the United States. In 2004, the Capitol his bombs at a motel. While there for contacts and searches. In addition, they police in Washington believed if suicide several weeks, no one noticed that he left should be alert for individuals having bombers struck America, they would windows open, did not allow maid service law enforcement or terrorist training target the U.S. Capitol. That agency into his room, and had strange odors manuals, radical literature, maps which has documented a plan to deal with emanating from the room. It took the have possible targets highlighted, as well suicide attackers. Police officers receive last line of defense, an American customs as unusual photographs or decals and comprehensive training on when and inspector, to arrest him because numerous bumper stickers. how to use deadly force. However, few When interacting with an individual, are trained to deal with a suicide bomber. the officer is the expert on the scene. Every law enforcement department is Based on his or her experience, the encouraged to develop a plan to deal with Almost every official may see things that appear to be a suicide attacker. This plan should be terrorist attack unusual. If something appears unusual written and practiced, and every officer to the expert on the scene, it probably should be aware of its contents. in history was is and should be shared with the JTTF if Almost every terrorist attack in presaged by it appears to be terrorist related. history was presaged by indicators which We have not seen suicide bombing should have been recognized and acted indicators which in the United States, however, Pakistan upon by law enforcement. Ahmed should have been had only one suicide bombing prior to Ressam, the “Millennium Bomber,” was 2007, yet had 59 attacks during that year arrested in December 1999 by a U.S. recognized and alone.14 Many believe it is only a matter Customs inspector. Ressam’s activities acted upon by of time before a suicide bomber strikes had been noticed by law enforcement law enforcement. in our country. The Israelis have studied and intelligence officials in two countries suicide bombers in depth and include before he ever arrived at the U.S. border. the following as telltale signs of a possible An Algerian, he arrived in Canada via

The Counter Terrorist ~ September/October 2008 29 precursors were ignored.17 She prevented in the al Qaeda manual is the Eiffel school in Minnesota and was arrested on a significant attack at the Los Angeles Tower). French commandos were able to immigration charges. Each of the above International Airport. kill the hijackers prior to their carrying circumstances, taken individually, meant The events of September 11th have out the plan.19 little. Collectively the entire plot could been widely detailed. Indicators leading In January 1995 authorities in the be seen. The 9/11 Commission report to this attack began as early as the murder Philippines encountered Yousef. He detailed the failures of American law of by in was plotting to destroy 11 airliners enforcement and intelligence agencies 1990. During their investigation, the over the Pacific using an innovative to share information which may have New York City Police Department and liquid explosive. Yousef’s partner later prevented the attacks. the FBI recovered 47 boxes of documents, confessed to wanting to fly a plane into Since the breakup of the Soviet Union, mostly written in Arabic. They were not CIA Headquarters, among other targets. Chechens have tried to establish an translated or analyzed until after the 1993 Yousef escaped but was arrested two independent Muslim state in southern World Trade Center attack. Some believe months later in Pakistan. One of the Russia. In the early 1990s, Chechen examining them could have prevented plotters in the Filipino plan was Yousef’s terrorists invaded a school and later this attack. , a Pakistani, uncle , the hijacked a school bus. Teachers and had entered the United States a few mastermind of 9/11.20 students in both cases were held for months before with false documentation. In March 1995 the first of the al ransom.23 Chechen terrorists also Like Ressam in Canada, he had been Qaeda manuals was found, which assassinated and kidnapped government allowed into the country. Working with a outlined the targets of the organization. officials, military leaders and soldiers. local cell, Yousef designed the plan which Other copies were also found: in the On August 18, 2004, the Russian he hoped would topple both towers, United Kingdom in 2000, and then in security service reported that an attack by killing 50,000 people. Following the Afghanistan in 2001. The manual stated terrorists was imminent in North Ossetia attacks he fled to Pakistan.18 that among their targets were skyscrapers, (near Chechnya). On August 28 there In December 1994 terrorists in Algeria but the information contained in it was were specific reports that terrorists had hijacked an Air France plane hoping to not widely disseminated. infiltrated the North Ossetian town of fly it into the center of Paris (one target In January 2000 intelligence agencies, Beslan. In the week before the raid, three including the CIA, surveilled a meeting terrorist attacks, including two airline in Malaysia of senior al Qaeda officials. bombings, had killed 100 people. At No one can Because information was not shared with 5:00 am on September 1, an informant American law enforcement, two of the in Chechnya advised authorities that afford to lose men freely traveled to Los Angeles and an attack would take place at one of the focus and believe San Diego, where they lived, attended four schools in Beslan that morning. local mosques and took flight lessons. Although the warning was target- and the prevention On 9/11, they would be among the 19 time-specific, as school opened at of terrorism will hijackers.21 9:30 a.m., 32 armed men and women In July 2001 an FBI agent in Arizona overtook the lone, unarmed police officer be handled by documented that Middle Eastern men assigned to guard the facility. The officer someone else. were taking flying lessons and that he had no radio or cell phone. The siege believed they should be investigated.22 ended on September 3 with the deaths For fear of being accused of racial of 31 terrorists and approximately 332 profiling, nothing was done, despite the others, including 186 children.24 information contained in the al Qaeda Each of these attacks may have been manual, the documents seized in New prevented if there had been proper York, and the events aboard the Air analysis and sharing of information. France flight and in the Philippines. A Ressam should have been stopped before month later, another pilot, Zacharias he reached the Washington-Canadian Moussaoui, attracted attention in a flight border. Two of the 9/11 hijackers

30 The Counter Terrorist ~ September/October 2008 should never have been allowed to live unimpeded in the United States for two years. The Phoenix memo should have been perceived as an effort to conduct good solid investigation, not one for profiling. If authorities in Russia had taken the information they received in August and early September more seriously, they may have prevented the terrorists from taking over the school in Beslan. Recognition of events before they occur can prevent acts of terrorism. Just seeing them will not be enough, however. Information has to be collected, analyzed Buildings are targeted as an opportunity for inflicting mass casualties. Photo: SSI and shared with the appropriate entity, the JTTF. There are now more than 100 information should be shared with the 6 Al Qaeda Manual, Author of them in the United States. The JTTFs JTTF, as well as with each other. unknown. must also share information with their Law enforcement and intelligence 7 Gretchen Parker, “Hamas local, state and tribal counterparts. It is a agencies around the globe should examine Suspect Arrested After Wife Videotapes two-way street. their relationships with each other. Every Chesapeake Bay Bridge,” The Milwaukee There have been many successes in agency should put officers in a position to Journal Sentinel, August 25, 2004. America and around the world since recognize the indicators of terrorism, then 8 National Counterterrorism Center the events of September 11, 2001. Law collect, analyze and share information “Reports on Incidents of Terrorism 2005.” enforcement and intelligence agencies to keep each of our communities safe. 9 terence P. Jeffrey, “Terrorist have disrupted dozens of planned attacks, Federal, state, local and tribal officers, the Blamed His Failure on Bush,” February and many arrests have been made. great force multiplier, are our first line of 2006, retrieved March 23, 2007. from However, disruptions get far less attention defense against future acts of terrorism. http://www.discoverthenetworks.org/ than successful attacks, and it would Each can make a difference.• Articles/Terrorist%20Blamed%20His%20 be incorrect to assume the problem Failure%20on%20Bush.html of terrorism has gone away. No one NOTES: 10 Nolan Clay and Randy Ellis, “No can afford to lose focus and believe the 1 Jeffrey J. Martel, “America’s Last Terror Link Seen So Far in Blast; OU prevention of terrorism will be handled Line of Defense,” interview with Chief of Tightens Security After Death Outside by someone else. Police Richard Jewett, 2006. Stadium,” The Daily Oklahoman, October Terrorism affects us all, regardless of 2 oliver B. Revell, “International 5, 2005. whether we live in a major metropolitan Terrorism in the United States,” The 11 mar Roman Associated area or a rural state. It is in our national Police Chief magazine, March 1989. Press, “Madrid Train Bombing Trial interest to prevent the next act of 3 National Counterterrorism Begins,” February 16, 2007, retrieved terrorism, before anyone else loses his Center reports retrieved 3/29/08 from March 23, 2007 from http://www. or her life, property is destroyed, and nctc.gov. suburbanchicagonews.com/couriernews/ all of us are fiscally impacted. It can be 4 robert S. Mueller, FBI Director, news/260019.3_1_EL16_A5SPAIN_ done if the 800,000 federal, state, local testimony before the Senate Select S1.article and tribal law enforcement officers see Committee on Intelligence, January 11, 12 mark S. Steinitz, “TheT errorism themselves as a force multiplier and 2007. and Drug Connection in Latin America’s watch for indicators. In addition to the 5 Hamza Hendawi, “Manual Andean Region,” Policy Papers on the police, an informed public can also report Teaches How to Kill Thousands,” The Americas, Volume XIII, Study 5, July 2002. suspicious activities. Once observed, Milwaukee Journal Sentinel, February 2, 2002. 13 Author interview with Deputy

The Counter Terrorist ~ September/October 2008 31 Sheriff Robert Fromme, Iredell County 18 peter Lance, “Triple Cross,” (New About the Author Sheriff’s Department, North Carolina, York, Regan , 2006), page 58. Richard A. Marquise is a Senior December 11, 2003. 19 peter Lance, “Triple Cross,” (New Research Associate with the Institute for 14 Khuram Iqbal, “Drivers of York, Regan, 2006), page 188. Intergovernmental Research and teaches Suicide Terrorism in Pakistan,” RSIS 20 The 9/11 Commission Report, July in the State and Local Antiterrorism Commentaries, February 27, 2008. 2004, page 491. Training (SLATT) program. He also 15 International Association of Chiefs 21 The 9/11 Commission Report, July teaches for the U.S. Department of State of Police Training Key #581, retrieved 2004, page 182. in the Anti Terrorism Assistance Program on March 23, 2007, from http://www. 22 FBI FD-302 of SA Kenneth and has assisted the countries of Pakistan, theiacp.org/pubinfo/IACP581SuicideBo Williams, July 10, 2001, retrieved Kenya, Serbia and the Philippines in mbersPart1.pdf March 23, 2007 from http://www. creating and training their terrorist task 16 Neil Livingstone, “The Detection thememoryhole.org/911/phoenix-memo/ forces. Mr. Marquise is a retired FBI agent and Prevention of Suicide Bombings,” 23 paul Murphy, “The Wolves of who has had extensive counterterrorism Total Integrated Preparedness Solutions, Islam,” (Dulles, Virginia, Brassey, 2004) experience. He led the American task force Volume I, Number 10, May 18, 2005. pages 242-243. that investigated the bombing of Pan Am 17 Hal Bernton, Mike Carter, David 24 John B. Dunlop, “Beslan, Russia’s Flight 103 over Scotland and is the author Heath and James Neff, “TheT errorist 9/11?” The American Committee for of Scotbom: Evidence and the Lockerbie Within: The Story Behind One Man’s Peace in Chechnya and the Jamestown Investigation, Algora, 2006. Holy War Against America,” The Seattle Foundation, October 2005. Times, June 23-July 7, 2002.

32 The Counter Terrorist ~ September/October 2008 Circle 207 on Reader Service Card