7133 Trouble V4.Pdf
Total Page:16
File Type:pdf, Size:1020Kb
HOW TO LOOK FOR TROUBLE A STRATFOR Guide to Protective Intelligence S t r at for Global Intelligence STRATFOR 700 Lavaca Street, Suite 900 Austin, Texas 78701 Copyright © 2010 by STRATFOR All rights reserved, including the right of reproduction in whole or in part Printed in the United States of America The contents of this book originally appeared as analyses on STRATFOR’s subscription Web site. ISBN: [?] EAN-13: [?] Publisher: Grant Perry Editor: Michael McCullar Project Coordinator: Robert Inks Designer: TJ Lensing COntenTs Introduction v ANoteonContent ix CHapter 1: PrinCiples and CHallengEs TheProblemoftheLoneWolf 1 TheSecretsofCountersurveillance 8 Threats,SituationalAwarenessandPerspective 14 IntelligenceasaProactiveTool 19 CounterterrorismFunding:OldFearsandCyclical Lulls 25 AQAP:ParadigmShiftsandLessonsLearned 31 Counterterrorism:Shiftingfromthe‘Who’tothe ‘How’ 39 Profiling:SketchingtheFaceofJihadism 46 CHapter 2: The Art of SurvEillance Surveillance:ForGood—andEvil 53 TheSpreadofTechnicalSurveillance 55 PhysicalSurveillance:TailingSomeoneontheMove 57 PhysicalSurveillance:TheArtofBlendingIn 60 TurningtheTablesonSurveillants 62 iii Table of Contents CHapter 3: Protecting People Bhutto’sDeath:FatalFactors 67 India:AKidnappingCaseStudy 70 China:SecurityAspectsoftheDalaiLama’sTravels 73 TheU.S.ElectionSeason:SecurityChallengesand ConventionalWisdom 75 Mexico:ExaminingtheCartelWarThrougha ProtectiveLens 80 Mexico:TacticalImplicationsoftheLabastida Killing 87 Mexico:TheThirdWar 89 CHapter 4: SafegUaRding Places CorporateSecurity:TheTechnologyCrutch 97 IncidentForeshadowsFutureAttacksinPakistan 102 ProtectiveIntelligenceAssessment:TheIslamabad MarriottBombing 109 ImplicationsoftheManawanAttack 112 SecurityatPlacesofWorship:MoreThanaMatter ofFaith 119 ExaminingtheJakartaAttacks:Trendsand Challenges 126 Convergence:TheChallengeofAviationSecurity 135 iv introductiOn Protectiveintelligence(PI)isaconceptweadoptedandrefined while working as special agents in the counterterrorism investiga- tions division of the U.S. State Department’s Diplomatic Security Service.Whenagentsfromourofficeweredispatchedtoinvestigate anincidentsuchasanembassybombing,assassinationorkidnapping, oureffortswerefocusednotonlyondeterminingwhoconductedthe attackbutalsoongatheringalltheminutedetailsofhowtheattack wasconducted.TheideabehindPI,simplyenough,istofocuson intelligencethatwillhelppreventthenextattackfromoccurring. Determining who was responsible for conducting an attack is important,especiallyifthereistobesomesortofmilitaryoperation directedagainsttheguiltypartyoranattempttobringtheperpe- tratortojusticeinacourtoflaw.Butfocusinginvestigativeefforts solelyonidentifyingtheperpetratorisnotalwaysusefulinprevent- ingfutureattacksandsavinglives,whichisthegoalofPI. Practitionersofprotectiveintelligencecarefullystudythetactics, tradecraft and behavior associated with militant actors involved in terroristattacks,threateningcriminalsandthementallydisturbed— anyone,really,wantingtodoharmtosomeoneelse.Byunderstanding howattacksareconducted—i.e.,theexactstepsandactionsrequired forasuccessfulattack—measurescanthenbetakentoproactively identify early indicators that planning for an attack is under way. Evenbeforeitisknownwhoisinvolvedintheactivity,thefactthat someoneisundertakingsucheffortscanbeidentified. Thisisanimportantcapabilityinthecurrentterroristenviron- ment,wherelonewolvesandsmallcellscomprisesuchalargeportion v How to look forTrouble ofthethreatspectrum.Oncesuchindicatorsofsuspiciousbehavior are noted, the people involved in planning the attack can then be focusedonandidentifiedandactioncanbetakentopreventthem from conducting the attack or attacks they are plotting. Studying thehowofanattackalsoallowsonetoobservethevulnerabilitiesin securitymeasuresthatwereexploitedbytheattackersandpermits securitymeasurestobealteredaccordinglytopreventsimilarattacks inthefuture. PIisbasedonthefactthatattacksdon’tjusthappenoutofthe blue.Mostfollowadiscernibleattackcycleinwhichtherearecriti- calpointswhenaplotismostlikelytobedetectedbyanoutside observer.Two of these points are when surveillance is being con- ductedandweaponsarebeingacquired.However,thereareother,less obviouspointswhenpeopleonthelookoutcanspotpreparationsfor anattack.Itistruethatindividualssometimesconductill-conceived, poorlyexecutedattacksthatinvolveshortcutsintheplanningpro- cess,butthistypeofspur-of-the-momentattackisusuallyassoci- atedwithmentallydisturbedindividuals,anditisextremelyrarefor a militant actor or professional criminal to conduct a spontaneous terroristattackwithoutfirstfollowingthestepsoftheattackcycle. Toreallyunderstandthenutsandboltsofanattack,PIpracti- tionerscannotsimplyacknowledgethatsomethinglikesurveillance occurs.Itiscriticaltounderstandexactlyhowthesurveillanceiscon- ducted.PIpractitionersmustturnapowerfullensonattackelements likepreoperationalsurveillancetogainanin-depthunderstandingof itandallthebehaviorsandoperationalelementsthatgoalongwith the process. Dissecting an activity like preoperational surveillance requiresmorethansimplyexaminingsubjectssuchasthedemeanor demonstratedbythoseconductingsurveillancepriortoanattackand thespecificmethodsandcoverforactionandcoverforstatusused.It alsorequiresidentifyingparticulartimeswheresurveillanceismost likelyandtheoptimalvantagepoints(called“perches”insurveillance jargon)fromwhereasurveillantismostlikelytooperatewhenmoni- toringaspecificfacilityorevent.Thistypeofcomplexunderstanding vi Introduction ofsurveillancecanthenbeusedtohelpfocushumanortechnological countersurveillanceeffortswheretheycanbemosteffective. Unfortunately,manycounterterrorisminvestigatorsaresofocused onidentifyingtheperpetratorthattheydonotfocusoncollecting this type of granular“how” information. Prosecution is the prior- ityinsteadofprevention.Whenwehavespokenwithlawenforce- ment officers responsible for investigating recent grassroots plots, theyoftenhavegivenusblankstaresinresponsetoquestionsabout howthesuspectsconductedsurveillanceontheintendedtargets.Too many investigators are not drilling down into specificity regarding surveillance.Thisisanintelligencefailure.Toooften,theysimplydo notpayattentiontothistypeofdetail.Butthisoversightisnotreally theinvestigators’fault.Noonehaseverexplainedtothemwhypaying attentionto,andrecording,thistypeofdetailisimportant. Moreover,ittakesspecifictrainingandapracticedeyetoobserve andrecordthesedetailswithoutglossingoverthem.Forexample,it isquiteusefulifaprotectiveintelligenceofficerhasfirstconducted alotofsurveillance,becauseconductingsurveillanceallowsoneto understandwhatasurveillantmustdoandwherehemustbeinorder toeffectivelyobserveaspecificpersonorplace. Militantsandcriminalsconductingattacksandsecurityperson- nelattemptingtoguardagainstsuchattackshavelongengagedin atacticalgameofcatandmouse.Asmilitantsandcriminalsadopt newtactics,securitymeasuresarethenimplementedtocounterthose tactics.Thesecuritychangesthencausetheattackerstochangein response and the cycle begins again. However, the basic tools of protectiveintelligence,oncemastered,allowtheinvestigatororana- lyst to spot trends and shifting paradigms as they develop.This is whatallowedSTrATFOrtodiscussthedangersofalQaedainthe ArabianPeninsula’sinnovativebombdesigns(andthepotentialfor their employmentagainstaircraft)inSeptember2009, well before theChristmasDayattackagainstNorthwestAirlinesflight253. BecomingaseasonedPIpractitionertakesyearsandalotofprac- ticalexperience,butalmostanyonecantakethebasicprinciplesof protectiveintelligenceandemploythemeffectivelytospotsuspicious vii How to look forTrouble behavior.Oneofthegrandsecretswewanttoshareisthatwhenit comestoterroristandcriminaltradecraft,thebadguysarenotreally asgoodasthepublicisledtobelieve.Theyareoftenawkwardand makemistakes.Oneofthebigfactorsthatallowthemtosucceedis thatnobodyislookingforthem.Whentheyare“watchedback,”the likelihoodoftheirmissionsucceedingisdramaticallyreduced. ScottStewart,VP,TacticalIntelligence FredBurton,VP,Counterterrorism STrATFOr Austin,Texas Feb.12,2010 viii a Note On COntenT STrATFOr presents the following reports as they originally appeared on our subscription Web site, www.STrATFOr.com. Thesepiecesrepresentsomeofourbesttutorialsrelatedtoprotective intelligence since December 2005, organized under chapter head- ingsandpresentedintheorderinwhichtheywerepublished.Since mostofthearticleswerewrittenasindividualanalyses,theremay beoverlapfrompiecetopieceandchaptertochapter,andsomeof the information may seem dated. Naturally, some observations are linkedtoaspecifictimeoreventyearsremovedfromtoday’ssecurity environment,whichcontinuestoevolve,buttherecommendations andprinciplesareeverybitasrelevanttodayastheywerewhenthey werewritten. ix CHapter 1: PrinCiples and CHallengEs TheProblemoftheLoneWolf May 30, 2007 Historically,gunmenandbomberswhoactontheirown—lone wolves—haveposedasignificantthreatintheUnitedStates.Indeed, fromtheassassinationofPresidentAbrahamLincolntotheslaying ofmusiclegendJohnLennontheyhavepresentedafarmoredeadly threattoprominentpeopleintheUnitedStatesthanhavemilitant groups. Additionally, as demonstrated by cases such as the 1991 Luby’srestaurantshootinginKilleen,Texas,ortherecentVirginia Techmassacre,theyalsoposeagravedangertoordinaryAmericans. Duetotheiroftensolitary,withdrawnnature,lonewolvespresent uniqueproblemsforsecurityandlawenforcement,astheirveryqual- itiesmakeithardforlawenforcementorprotectivesecuritydetailsto gatherintelligenceregardingtheirintentions.However,theyarenot impossibletoguardagainst.Lonewolvesfrequentlytakeactionsin advanceofanattackthatmakethemvulnerabletodetectionbyapro-