Archive for June, 2017

More catch-up posting, this time for the Telegraph looking at trying to understand the difficulties around intelligence and counter-terrorism. Got various media posting to also catch up on, but will do soon.

Intelligence is fragmented by nature – sometimes terrorists will slip through

Three knife-wielding assailants led a deadly rampage through central London on Saturday. One was known to UK intelligence, another to the Italian police
Three knife-wielding assailants led a deadly rampage through central London on Saturday. One assailant was known to UK intelligence, another to the Italian policeCREDIT:  MATTHEW CHATTLE/BARCROFT IMAGES

It has become habit that in the wake of a terrorist incident it is soon uncovered that security agencies were aware of the individuals in question. The immediate assumption therefore is that there was a clear failure, with questions understandably asked about why those involved had not been detained and prevented from carrying out the atrocity.

The problem is that this assumption is based on fragmentary information.

First, the wider picture is unknown. How many other people were there in view at that moment in time, and how did the behaviour of the individual who launched the attack match up to theirs?

Maybe he was not doing anything particularly suspect, while the others being watched were in the midst of undertaking suspicious behaviour which appeared far more menacing. The more menacing person will merit greater attention while the other will be observed in a slightly less intense fashion.

This is ultimately a process of prioritization, where choices to deploy resources are made on the basis of activity and information.

Second, someone who comes under the suspicion of intelligence agencies is not necessarily by default guilty. Security and intelligence agencies will gather a lot of information on a lot of people: but not all of them will require any deeper investigation.

Someone may appear in an investigation by default of who they live near, who they know or who they bump into for some reason. Some will require greater investigation to understand who they are, but the majority are irrelevant and simply passers-by who happen to have encountered someone who is malicious.

Those who are investigated to a greater extent, dealt with by the police and ultimately jailed are those who are undertaking activity that is against the law and against whom a specific criminal case can be made. We live in a country where due process and jury courts require the state to produce a burden of evidence to demonstrate guilt.

Third, security and intelligence agencies are not always very keen to demonstrate their methods. Consequently information that has maybe been gathered by covert agents or through technical means is not necessarily something that is usable in an open court.

In the case of the agent, their identity may be compromised, while the revelation of technical tools will give other terrorists the opportunity to learn about what they have to do to avoid detection in future. This means that sometimes information is gathered which cannot immediately be acted upon openly.

Clearly if suspects are moving towards violent or dangerous behaviour something will be done, but if they are not doing anything criminal, and there is no usable evidence of them planning something, then observation has to be the default.

Of course we have no clear idea at this moment whether any or all of these are the reason why the existing information on the various recent plotters was not acted upon.

Questions are being understandably asked about whether the process of prioritization is calibrated correctly. Three successful attacks from the broader pool of people known to the intelligence agencies is clearly a worrying reality. Have they adequately factored into the prioritization process patterns of behaviour by terrorist groups, new methodologies of attack and how radicalisation works these days?

It is worth noting that in many ways it is a good thing that intelligence agencies have knowledge of individuals who ultimately go on to commit terrorist atrocities. It would be even worse if they did not know who they were.

Should terrorists emerge completely from the void, questions would have to be asked about how it was they had no knowledge of them. Awareness demonstrates that they are looking at the right people and places.

The reality is that intelligence information is by its nature fragmentary. Unable to see inside people’s minds, security and intelligence agencies rely on assorted inputs to develop a picture on the basis of which they make judgements and assessments about who they should devote attention to watching.

The process by which these choices are made are subject to fairly constant revision and consideration, but unfortunately, they are not perfect.

None of this will of course provide comfort to those who have lost loved ones in an atrocity, but it is something that is important to bear in mind when considering what should be done in its wake.

Clearly security and intelligence agencies will have to review their processes, but care should be paid to not move to more extreme and draconian measures that will ultimately foster the very narrative that extremists advance.

Raffaello Pantucci is Director of International Security Studies at the Royal United Services Institute (RUSI)

Advertisements

More catch-up posting, this time a piece for my institutional home RUSI’s magazine Newsbrief, looking at how the threat from ISIS/Daesh may evolve over the next few years.

Daesh: What Happens Next?

May 24, 2017

As the battle for Mosul rages on and Daesh is put under increasing pressure in other parts of Iraq and Syria, how will the threat from the group evolve? Will Daesh end up following the path of Al-Qa’ida, with regional affiliates becoming more prominent? 

In the wake of 9/11, Al-Qa’ida was sharply ejected from its base in Afghanistan. Re-establishing itself in Pakistan’s border areas, the leadership continued their bitter struggle against the world, launching and coordinating a series of attacks. Most immediately these included: an attempt on transatlantic airlines using British shoe bombers; an attack on the Ghriba Synagogue on the island of Djerba, Tunisia; the bombing of a nightclub in Bali; a rocket attack on an Israeli passenger aircraft leaving Mombasa, Kenya; and ship-borne suicide bombers targeting the French-flagged Petronas oil tanker MV Limburg off the coast of Yemen. Scattered around the world, these plots included a mix of local Al-Qa’ida affiliates and people who had trained at camps in Afghanistan, but all showed a clear link to the group’s leadership.

This set a pattern for the next few years, where the group continued to manipulate its networks from a distance, as well as send out cells of plotters to launch attacks around the world. In some cases, largely autonomous local networks took some seed support (or had a few key individuals return from the training camps), leading to a spate of attacks.

A good example of this was in Indonesia, where Jemaah Islamiah, the Southeast Asian Al-Qa’ida affiliate, launched a series of attacks in Bali and Jakarta. In other cases, such as the UK, the group had a steady supply of radicalised young men travel to its camps in Pakistan where they were indoctrinated and then directed to commit atrocities back home. This pipeline generated a string of plots directed from the core with escalating ambition that culminated in the August 2006 plot to bring down eight transatlantic flights with liquid bombs. This ideology received a boost from the invasion of Iraq, with random individuals seeking to launch attacks to advance the group with little evidence of a clear link to the leadership.

This pattern really started to change only in 2008–2010, when an extensive drone and Special Forces campaign was launched against the Al-Qa’ida leadership in Pakistan. This persistent hammering had an effect and led to a noticeable drop in Al-Qa’ida’s capacity to train and send out jihadis, as well as communicate with its international network. A Birmingham network, disrupted in 2011, was overheard talking about how the extent of their training camp was hanging about indoors hiding from drones and watching extremist videos. In 2010, French jihadist Mohammed Merah sought out training camps in Pakistan and appeared only able to spend a day at one before being sent quickly back on his way. The Birmingham cell was disrupted while Merah went on to launch a campaign in southern France, murdering off-duty soldiers and Jewish schoolchildren. Bin Laden senior was able to issue only occasional messages to his network and the world, leading to growing strategic stagnation.

But as the leadership took a beating in Afghanistan and Pakistan, Al-Qa’ida’s regional affiliates assumed a more prominent role in launching attacks. Al-Qa’ida in the Arabian Peninsula (AQAP) raised its profile, becoming a greater draw to the community of radicalised young westerners seeking to connect with jihadist groups. This brought a new wave of young aspiring Western warriors to Yemen, in particular through the attraction of its American-Yemeni preacher Anwar Al-Awlaki. These warriors were further indoctrinated, trained and then dispatched to launch attacks back home. This led to repeated attempts on international aviation, including: the ‘underwear bomber’; the printer cartridge bombs; concerns over an attempt to launch an attack with surgically implanted explosives: and a threat from a radicalised IT worker at British Airways. AQAP became the standard bearer for Al-Qa’ida globally, continuing the international struggle as the core lost its capacity to manage such attacks.

But the core organisation continued to exist and exert influence and direction over the network. As was evidenced by the many letters to have leaked from the correspondence seized in Abbottabad, Osama was a controlling leader. In one letter, for example, he expressed disappointment and disapproval of methods of attacks advocated by AQAP in its influential English-language magazine Inspire. Elsewhere, it seems clear that he was responsible for the continuing refusal to formally recognise Somali affiliate Al-Shabaab as part of the global organisation. However, his ability to control the group was weakening and as regional affiliates became more prominent or others developed, the nature of the ideology that Osama had launched changed. His death at the hands of US Special Forces at his Abbottabad compound in 2011 changed the group, with his successor Ayman Al-Zawahiri offering a different style of leadership and direction.

The result of this was a clear shift towards regionalisation by the group. Attacks and campaigns became much more localised. The 2013 attacks at In Amenas in Algeria and Al-Shabaab’s assault on the Westgate Mall in Nairobi are the best examples of this. In both cases, the attackers were linked to Al-Qa’ida, but there was a mix of local dynamics and new leadership figures establishing themselves at play in both cases. Despite Al-Qa’ida’s celebrations and announcements, it was not clear the degree to which the attacks were directed from Afghanistan or Pakistan, if at all. The incident advanced the global cause, although appeared much more about local than international dynamics. The regional affiliates still used Al-Qa’ida’s rhetoric and ideology, though their motivations appeared to be driven by a different set of drivers than the core leadership or ideology would necessarily advocate. More focused on local enemies, they were retreating to confront the ‘near enemy’ rather than the ‘far enemy’.

Daesh appears to be undergoing the same process, albeit in a more compressed timeframe than the decade or so it has taken Al-Qa’ida. Plots linked to the Daesh’s core continue to show up around the world, with some evidence of individual former fighters returning home to plant the seeds of a network. There is also evidence of attackers being directed, instigated or inspired by the group’s core in Syria and Iraq.

At the same time, Daesh’s regional affiliates – for instance, its groups in Afghanistan, Egypt, Nigeria or Libya – are taking a much more forward and aggressive position. The core group claims responsibility for these attacks and releases images through formal information channels linked to its Amaq or Nashir news agencies. The attacks themselves, however, often appear to be far more locally oriented and directed. That is to say, they are focused on striking enemies in their immediate environments, rather than using their bases to launch the large-scale attacks on the West that the core seems interested in wanting to do. Daesh’s Afghan affiliate, for example, has repeatedly launched attacks against Shia or government targets in Kabul. The group’s Egyptian affiliate continues to strike against minorities or the state in Egypt. Libya is possibly the exception to this rule, given the disorder in the state, the group has often used its training camps or footprint there to launch attacks or attempted plots in nearby North African countries such as Morocco or Tunisia.

This local focus suggests a far looser network of groups whose allegiance may be more limited, or at the very least a narrative by the core organisation that allows for far greater autonomy by regional affiliates. But this strategy carries with it risks for the core. If a regional affiliate has been operating autonomously for some time and is merely carrying the banner locally, then its loyalty may over time become frayed. Members of the leadership with personal links to the affiliate may get killed off, leading to the rise of new individuals whose ties may lie elsewhere. This will change the power dynamic between the core and the affiliate as the historical kinship links which tie the groups together get lost and new ones are harder to develop over long distances. This is a dynamic that has already played out to some degree with Al-Qa’ida, but it is happening with Daesh over a much shorter timeline as the core organisation continues to hold territory in the Levant and directs, instigates and inspires terrorist plots around the world.

Therefore, the potential threat from Daesh is one that is an enhanced version of what was seen with Al-Qa’ida. And the dangers from these patterns are similar to those seen with Al-Qa’ida. The growing prominence of affiliates is something that became a threat not only to Western countries or their nationals abroad, but also means that the core ideology and threat from the group is transferred from the core to affiliates at moments when the former comes under particular stress. The rise of AQAP to prominence in the late 2000s is a reflection of this, and it is possible that we could see a similar displacing as Daesh comes under greater pressure in the Levant.

At the same time, it is equally possible to draw some lessons from Al-Qa’ida’s weakening to understand how to damage Daesh and manage its growth. First, the core needs to be hammered and deprived of territory. This pressure clearly degrades capacity. Second, the West needs to be vigilant against more confident and strong affiliates as they can become the core threat. Third, it needs to understand the nature of individual links between groups. Targeting key individuals may disrupt connections between groups. However, according to the law of unintended consequences, there might be some instances of degrading, while in some other cases there may be individuals whose rise will pose a greater menace. All of this provides a pen portrait for how aggressive counterterrorism activity, as well as careful management of regional affiliates is at the core of understanding how to manage the threat from the group.

All of this is taking place as the threat from Al-Qa’ida core continues to exist. As Hamza bin Laden’s latest message illustrates, the progenitor organisation continues to want to stay relevant and is trying to re-appropriate the concept of lone-actor terrorist attacks (an attack methodology it had long advocated but was unable to weaponise as effectively as Daesh), showing the longevity of these sorts of threats. While Daesh seeks to distinguish itself in many ways from Al-Qa’ida and there are strong tensions between the two groups, their ideologies and outlooks remain similar. Daesh’s methods of attack, direction and radicalisation may have developed from Al-Qa’ida’s, but in many ways this is due to changes in the way people communicate since Al-Qa’ida’s heyday in the mid-2000s. And while Daesh’s relative youth and wanton brutality have somewhat distinguished it from Al-Qa’ida, the biggest danger in many ways is that the two threats may end up fusing.

While this may seem a far-fetched notion at the moment given the leadership tensions, it is not an outcome that can be completely discounted, especially if we see a Daesh that fragments back to its affiliates as the core becomes weakened. In this scenario, we could see enhanced affiliates drawing on both groups support to launch concerted regional campaigns both in their immediate areas, but also against the West.

The unfortunate reality is that it is likely that both threats will be with us for some time yet. While there are some clear lessons in how to manage the threat down from the struggle against Al-Qa’ida, that conflict has shown how hard it is to eradicate such groups. Patience, focus and a long-term plan will be the only way to manage the threats from such international terrorist organisations.

Raffaello Pantucci
Director, International Security Studies, RUSI.

 

 

Catching up on various bits of writing from the past few weeks that haven’t had a chance to re-publish. Starting with this longer piece for the Italian English-language geopolitical publication Longitude looking at the threat from Islamic State and how it might evolve going forwards. Am not republishing the text here, as it was in a magazine, so instead there is a link to the PDF in the title below.

The Islamic State’s Four Layers of Threat

Pantucci_Longitude 72

Although IS keeps losing territory rapidly, it is by no means about to disappear. Rather, it will probably spread out from its core in the Levant and morph into local terrorist groups loosely connected through ideological affinity.

 

Another short piece from this weekend in the wake of the atrocity in London Bridge this time for the Financial Times. Will catch up on other posting as soon as possible, though things at the moment are quite busy.

The Chilling Effect of a Brutally Simple Style

London attack comes as Isis is losing territory, making life harder for security forces

Back in May 2013 two radicalised young Britons ran a car into an off-duty soldier outside his London barracks, leapt out and butchered Lee Rigby as he lay in the street. Brutal in its simplicity and effectiveness, this has become a style terrorist groups champion as they seek to bring horror to our streets. It was used in Saturday’s London attack, in which at least seven were murdered — and has made security agencies’ lives markedly harder.

As low-tech attacks have proliferated, the terror threat facing the UK has escalated. Since Khalid Masood staged his car and knife offensive on Westminster in late March, there have been two successful attacks and five failed ones.

The Manchester suicide bomb last month and the London attack appear to have been produced by conspiracy rather than lone individuals. This is a worrying development given that until recently the analysis of the threat picture suggested the latter were the greatest concern. The use of a sophisticated device in Manchester suggests Salman Abedi had contact with others before killing himself and 22 others at an Ariana Grande concert. The London atrocity involved at least three people — the suspected attackers killed by police.

Looking abroad, terrorist groups have been pushing people to launch attacks whenever and however they can — particularly in this holy month of Ramadan. Isis pumps out a stream of messages, exhorting the use of knives, cars or other tools to kill “crusaders”. In a recent post, the group told people to wear fake suicide vests to confuse authorities — just as the London attackers are reported to have done.

Two weeks ago Hamza bin Laden — the son of Osama bin Laden, who is trying to reinvent himself as the leader of al-Qaeda — issued his own advice for “martyrdom seekers” in the west. They need not use “a military tool. If you are able to pick a firearm, well and good; if not, the options are many”.

All this comes as Isis is losing territory and it is becoming harder for prospective jihadis to travel to such battlefields. This denies terrorist groups space to plan but also creates two new categories of concern: returnees who have fought on these battlefields and blocked travellers who retain the radical impulse. These categories are added to the long list of individuals already of concern to security agencies. In the UK there are 500 under investigation, according to Ben Wallace, security minister, and 3,000 of active interest. There are a further 20,000 in a wider ring including people on the fringes of investigations going back years. In other words, security agencies are managing a roster of dangerous extremists from which it is almost impossible ever to remove names. Individuals such as Masood, investigated a decade ago on the edge of plots, may return to strike years later so agencies must stay alert to them.

A successful attack is by definition a failure by security agencies. In the case of London and Manchester, it is not yet clear whether we are looking at a lack of analysis, intelligence or capacity — or whether the threat has suddenly grown more acute and overwhelming. Whatever the answer, the question will become central to political debate, particularly given the proximity of the attacks to the general election.

Prime Minister Theresa May has pointed to the need to deal with ideology and “safe space” — online and offline. There will also be ever-louder questions about whether the security agencies have the resources to manage an engorged threat — as well as how they manage sometimes fraught relations with allies in Washington and Europe.

But it is clear that the current strategy — seeking to deal with the threats through a four-pillar approach of “prevent, pursue, protect and prepare” — is merely managing a problem that appears to be getting worse.

The writer is director of international security studies at the Royal United Services Institute and author of ‘We Love Death As You Love Life’

Trying to catch up on various recent posts, though am a bit behind, so apologies. A few longer pieces have landed now as well. In the short term, here is something for my institutional home RUSI about what policy ideas could be advanced to manage the long-term threat that the UK faces.

What Policy Changes Are Needed after the Manchester Attack?

Raffaello Pantucci
Commentary31 May 2017
UK Counter-terrorismTackling ExtremismSecuring BritainTerrorism

A week after the atrocity in Manchester, it is now possible to draw some preliminary conclusions: there clearly was a breakdown in the intelligence flow that led to suicide bomber Salman Abedi slipping through the net; there are enduring questions about the UK’s Prevent anti-terrorism strategy; and, finally, there are the weaknesses of ‘soft targets’ that such an attack invariably expose.

It is, of course, impossible, without full access to information, to properly understand exactly the nature of the intelligence breakdown that led to last week’s suicide attack on an Ariana Grande concert in Manchester.

Still the fact that the bomber, Salman Abedi, was flagged up to authorities a number of times, by locals in Manchester, was travelling back and forth to a country that is a warzone and came from a family with strong militant pedigrees all indicate – without the benefit of hindsight – that he was someone who should have attracted attention.

If, as suggested, he was someone who had featured in previous investigations but was sidelined in favour of what were deemed to be more menacing targets, then the attack in which 22 people were killed and dozens wounded highlights what for the intelligence services remains a perennial question: how do you determine who seems more menacing when resources are limited?

This is not only a difficult calibration to make, it is also not a way to remove someone from concerns altogether. For, as we have seen repeatedly, individuals will sometimes rise back out of this pool of downgraded threats to pose an immediate danger.

And the challenge is immense. According to Security Minister Ben Wallace, there are about 20,000 in this larger pool of people who are not seen as an immediate danger but who, like Abedi, can suddenly become one.

What can be done to manage this problem? Additional resources would help, as well as new technologies such as super computers using artificial intelligence to manage the challenge through data-crunching looking for particular patterns of behaviour. Another method is to continually challenge previous assessments about the security risks that certain individuals may pose, a determination which is bound to shift over time.

However, the principle of proportionality also has to be borne in mind: having lots of security forces chasing those individuals not only requires more resources than are currently available, but may also end up exacerbating the very problem that they are trying to manage.

Other, more extreme ideas have been advanced: internment or enhanced restrictive movement orders. The first proposal is so clearly counterproductive that it bears no consideration; internment in Northern Ireland during the early 1970s became part of the problem, rather than the solution to terrorism troubles.

The second proposal – house arrests – has greater value, except in that it does not necessarily reduce the burden on security officials. An individual who has been placed under house arrest is not actually being dealt with; rather, he or she is being put in a very publicly visible ‘holding pattern’.

Similarly, excluding people from the UK – either through passport denial or exclusion orders – is not actually dealing with the challenge; it simply postpones a determination, and pushes the individual on to another country to be dealt with.

A proportion of the work managing this pool of 20,000 ‘lower-grade’ suspects will come under the contentious Prevent strategy of counterterrorism activity. And this raises another strand of debate to emerge from the Manchester atrocity: how to reform Prevent.

One aspect that should be undertaken is to separate out the different strands of the strategy. The work of managing dangerous offenders or suspects clearly needs to stay attached to the security realm, possibly through the creation of a new specifically developed and tailored service, modelled on the probation service.

Combining probation, welfare, police and intelligence, the new agency could be staffed by individuals who are each managing a specific case-load of former offenders or suspects.

Each case will require a different sort of engagement, but this may provide a way of both keeping an eye on such cases while also focusing on trying to get them on a different path.

A version of the Channel programme, which provides early support to individuals who are at risk of being drawn into terrorism, could be used; this will be a way of providing an individually tailored ‘light touch’ over-watch.

But other parts of the Prevent that are focused on more forward-looking efforts to steer people away from radical paths before they get on to them, should instead be moved firmly out of the criminal space.

Prevent is intended to be about keeping people away from ever getting to terrorism, and this means, among other measures, actually keeping them out of the criminal justice arena. Consequently, it would seem imperative that these programmes are not handled by a security department such as the Home Office.

Finally, there are some very understandable questions about the fact that the bomber was able to walk his device into a crowded space and kill so many. Most arenas nowadays are heavily guarded and people are subject to bag checks on entry.

Clearly, some additional thought must be given to reviewing entry and exit points to such sites, with the usual difficulties of agreeing where to draw the ultimate line of the security cordon.

Much work has gone into managing security in crowded spaces: the lessons learned need to be applied more rigorously and around the entire country. Sports events or concerts that by their very nature aim to be open and accessible will continue to pose a potential problem.

It is unlikely that this will be the last terrorist attack the UK faces. Coming during an election cycle, however, this incident offers an occasion for both introspection and new ideas as future governments continue to confront the challenge.

Banner image: Armed police stand guard at Manchester Arena after Salman Abedi’s suicide bomb attack during a Ariana Grande gig. Courtesy of PA Images.