The Global Intelligence Files,
files released so far...
2163
The Global Intelligence Files

### Index pages

List of Releases

### by Date of Document

unspecified
2001
2004
2005
2006
2007
2008
2009
2010
2011

### by Date of Release

2001-03-13
2010-03-10
2011-03-05
2011-03-15
2012-01-29
2012-02-27
2012-02-28
2012-02-29
2012-03-01
2012-03-02
2012-03-03
2012-03-04
2012-03-05
2012-03-06
2012-03-07
2012-03-08
2012-03-09
2012-03-10
2012-03-11
2012-03-12
2012-03-13
2012-03-14
2012-03-15
2012-03-16
2012-03-17
2012-03-19
2012-03-20
2012-03-23
2012-03-25
2012-03-26
2012-03-27
2012-04-01
2012-04-02
2012-04-24
2012-04-26
2012-04-30
2012-05-10
2012-06-18
2012-06-20
2012-07-01
2012-07-24
2012-07-28
2012-07-29
2012-07-30
2012-07-31
2012-08-01
2012-08-02
2012-08-05
2012-08-06
2012-08-07
2012-08-08
2012-08-09
2012-08-10
2012-08-11
2012-08-12
2012-08-13
2012-08-14
2012-08-15
2012-08-16
2012-08-17
2012-08-18
2012-08-19
2012-08-20
2012-08-21
2012-08-22
2012-08-23
2012-08-24
2012-08-25
2012-08-26
2012-08-27

### Our Partners

ABC Color - Paraguay
Al Akhbar - Lebanon
Al Masry Al Youm - Egypt
Asia Sentinel - Hong Kong
Bivol - Bulgaria
Carta Capital - Brazil
CIPER - Chile
Dawn Media - Pakistan
L'Espresso - Italy
La Repubblica - Italy
La Jornada - Mexico
La Nacion - Costa Rica
Malaysia Today - Malaysia
McClatchy - United States
Nawaat - Tunisia
NDR/ARD - Germany
Owni - France
Pagina 12 - Argentina
Philip Dorling - Fairfax media contributor - Australia
Plaza Publica - Guatemala
Publica - Brazil
Publico.es - Spain
Rolling Stone - United States
Russian Reporter - Russia
Ta Nea - Greece
Taraf - Turkey
The Hindu - India
The Yes Men - Bhopal Activists
Sunday Star-Times - New Zealand

### Community resources

Supporters Support Wikileaks Follow us on Twitter Twitter this Follow us on Facebook

courage is contagious

# The Global Intelligence Files

On Monday February 27th, 2012, WikiLeaks began publishing The Global Intelligence Files, over five million e-mails from the Texas headquartered "global intelligence" company Stratfor. The e-mails date between July 2004 and late December 2011. They reveal the inner workings of a company that fronts as an intelligence publisher, but provides confidential intelligence services to large corporations, such as Bhopal's Dow Chemical Co., Lockheed Martin, Northrop Grumman, Raytheon and government agencies, including the US Department of Homeland Security, the US Marines and the US Defence Intelligence Agency. The emails show Stratfor's web of informers, pay-off structure, payment laundering techniques and psychological methods.

## RE: Counterterrorism: Shifting from 'Who' to 'How'

Released on 2012-08-12 08:00 GMT

Email-ID | 376889
Date | 2009-11-05 01:46:25
From | musgrovesteve@hotmail.com
To | burton@stratfor.com

Appreciate the update Fred. Thanks and all the best. Hope the new book is
working out
for you. Steve
Very respectfully,
Steve Musgrove
> From: burton@stratfor.com
> To: burton@stratfor.com
> Subject: Counterterrorism: Shifting from 'Who' to 'How'
> Date: Wed, 4 Nov 2009 16:57:03 -0600
>
>
>
> COUNTERTERRORISM: SHIFTING FROM 'WHO' TO 'HOW'
>
> By Scott Stewart and Fred Burton
>
> In the 11th edition of the online magazine Sada al-Malahim (The Echo of
> Battle), which was released to jihadist Web sites last week, al Qaeda in
the
> Arabian Peninsula (AQAP) leader Nasir al-Wahayshi wrote an article that
> called for jihadists to conduct simple attacks against a variety of
targets.
> The targets included "any tyrant, intelligence den, prince" or
"minister"
> (referring to the governments in the Muslim world like Egypt, Saudi
Arabia
> and Yemen), and "any crusaders whenever you find one of them, like at
the
> airports of the crusader Western countries that participate in the wars
> against Islam, or their living compounds, trains etc.," (an obvious
> reference to the United States and Europe and Westerners living in
Muslim
> countries).
>
>
> Al-Wahayshi, an ethnic Yemeni who spent time in Afghanistan serving as a
> lieutenant under Osama bin Laden, noted these simple attacks could be
> conducted with readily available weapons such as knives, clubs or small
> improvised explosive devices (IEDs). According to al-Wahayshi, jihadists
> "don't need to conduct a big effort or spend a lot of money to
manufacture
> 10 grams of explosive material" and that they should not "waste a long
time
> finding the materials, because you can find all these in your mother's
> kitchen, or readily at hand or in any city you are in."
>
> That al-Wahayshi gave these instructions in an Internet magazine
distributed
> via jihadist chat rooms, not in some secret meeting with his operational
> staff, demonstrates that they are clearly intended to reach grassroots
> jihadists -- and are not intended as some sort of internal guidance for
AQAP
> members. In fact, al-Wahayshi was encouraging grassroots jihadists to
"do
> what Abu al-Khair did" referring to AQAP member Abdullah Hassan Taleh
> al-Asiri, the Saudi suicide bomber who attempted to kill Saudi Deputy
> Interior Minister Prince Mohammed bin Nayef with a small IED on Aug. 28.
>
> The most concerning aspect of al-Wahayshi's statement is that it is
largely
> true. Improvised explosive mixtures are in fact relatively easy to make
from
> readily available chemicals -- if a person has the proper training --
and
> attacks using small IEDs or other readily attainable weapons such as
knives
> or clubs (or firearms in the United States) are indeed quite simple to
> conduct.
>
> As STRATFOR has noted for several years now, with al Qaeda's structure
under
> continual attack and no regional al Qaeda franchise groups in the
Western
> Hemisphere, the most pressing jihadist threat to the U.S. homeland at
> present stems from grassroots jihadists, not the al Qaeda core. This
trend
> has been borne out by the large number of plots and arrests over the
past
> several years, to include several so far in 2009. The grassroots have
> likewise proven to pose a critical threat to Europe (although it is
> important to note that the threat posed by grassroots operatives is more
> widespread, but normally involves smaller, less strategic attacks than
those
> conducted by the al Qaeda core).
>
> From a counterterrorism perspective, the problem posed by grassroots
> operatives is that unless they somehow self-identify by contacting a
> government informant or another person who reports them to authorities,
> attend a militant training camp, or conduct electronic correspondence
with a
> person or organization under government scrutiny, they are very
difficult to
> detect.
>
> The threat posed by grassroots operatives, and the difficulty
identifying
> them, highlight the need for counterterrorism programs to adopt a
proactive,
> protective intelligence approach to the problem -- an approach that
focuses
> on "the how" of militant attacks instead of just "the who."
>
> The How
>
> In the traditional, reactive approach to counterterrorism, where
authorities
> respond to a crime scene after a terrorist attack to find and arrest the
> militants responsible for the attack, it is customary to focus on the
who,
> or on the individual or group behind the attack. Indeed, in this
approach,
> the only time much emphasis is placed on the how is either in an effort
to
> identify a suspect when an unknown actor carried out the attack, or to
prove
> that a particular suspect was responsible for the attack during a trial.
> Beyond these limited purposes, not much attention is paid to the how.
>
> In large part, this focus on the who is a legacy of the fact that for
many
> years, the primary philosophy of the U.S. government was to treat
> counterterrorism as a law-enforcement program, with a focus on
prosecution
> rather than on disrupting plots.
>
> Certainly, catching and prosecuting those who commit terrorist attacks
is
> necessary, but from our perspective, preventing attacks is more
important,
> and prevention requires a proactive approach. To pursue such a proactive
> approach to counterterrorism, the how becomes a critical question. By
> studying and understanding how attacks are conducted -- i.e., the exact
> steps and actions required for a successful attack -- authorities can
> establish systems to proactively identify early indicators that planning
for
> an attack is under way. People involved in planning the attack can then
be
> focused on, identified, and action can be taken prevent them from
conducting
> the attack or attacks they are plotting. This means that focusing on the
how
> can lead to previously unidentified suspects, e.g., those who do not
> self-identify.
>
> "How was the attack conducted?" is the primary question addressed by
> protective intelligence, which is, at its core, a process for
proactively
> identifying and assessing potential threats. Focusing on the how, then,
> requires protective intelligence practitioners to carefully study the
> tactics, tradecraft and behavior associated with militant actors
involved in
> terrorist attacks. This allows them to search for and identify those
> behaviors before an attack takes place. Many of these behaviors are not
by
> themselves criminal in nature; visiting a public building and observing
> security measures or standing on the street to watch the arrival of a
VIP at
> their office are not illegal, but they can be indicators that an attack
is
> being plotted. Such legal activities ultimately could be overt actions
in
> furtherance of an illegal conspiracy to conduct the attack, but even
where
> conspiracy cannot be proved, steps can still be taken to identify
possible
> assailants and prevent a potential attack -- or at the very least, to
> mitigate the risk posed by the people involved.
>
> Protective intelligence is based on the fact that successful attacks
don't
> just happen out of the blue. Rather, terrorist attacks follow a
discernable
> attack cycle. There are critical points during that cycle where a plot
is
> most likely to be detected by an outside observer. Some of the points
during
> the attack cycle when potential attackers are most vulnerable to
detection
> are while surveillance is being conducted and weapons are being
acquired.
> However, there are other, less obvious points where people on the
lookout
> can spot preparations for an attack.
>
> It is true that sometimes individuals do conduct ill-conceived, poorly
> executed attacks that involve shortcuts in the planning process. But
this
> type of spur-of-the-moment attack is usually associated with mentally
> disturbed individuals and it is extremely rare for a militant actor to
> conduct a spontaneous terrorist attack without first following the steps
of
> the attack cycle.
>
> To really understand the how, protective intelligence practitioners
cannot
> simply acknowledge that something like surveillance occurs. Rather, they
> must turn a powerful lens on steps like preoperational surveillance to
gain
> an in-depth understanding of them. Dissecting an activity like
> preoperational surveillance requires not only examining subjects such as
the
> demeanor demonstrated by those conducting surveillance prior to an
attack
> and the specific methods and cover for action and status used. It also
> requires identifying particular times where surveillance is most likely
and
> certain optimal vantage points (called perches in surveillance jargon)
from
> where a surveillant is most likely to operate when seeking to surveil a
> specific facility or event. This type of complex understanding of
> surveillance can then be used to help focus human or technological
> countersurveillance efforts where they can be most effective.
>
> Unfortunately, many counterterrorism investigators are so focused on the
who
> that they do not focus on collecting this type of granular how
information.
> When we have spoken with law enforcement officers responsible for
> investigating recent grassroots plots, they gave us blank stares in
response
> to questions about how the suspects had conducted surveillance on the
> intended targets. They simply had not paid attention to this type of
detail
> -- but this oversight is not really the investigators' fault. No one had
> ever explained to them why paying attention to, and recording, this type
of
> detail was important. Moreover, it takes specific training and a
practiced
> eye to observe and record these details without glossing over them. For
> example, it is quite useful if a protective intelligence officer has
first
> conducted a lot of surveillance, because conducting surveillance allows
one
> to understand what a surveillant must do and where he must be in order
to
> effectively observe surveillance of a specific person or place.
>
> Similarly, to truly understand the tradecraft required to build an IED
and
> the specific steps a militant needs to complete to do so, it helps to go
to
> an IED school where the investigator learns the tradecraft firsthand.
> Militant actors can and do change over time. New groups, causes and
> ideologies emerge, and specific militants can be killed, captured or
retire.
> But the tactical steps a militant must complete to conduct a successful
> attack are constant. It doesn't matter if the person planning an attack
is a
> radical environmentalist, a grassroots jihadist or a member of the al
Qaeda
> core, for while these diverse actors will exhibit different levels of
> professionalism in regard to terrorist tradecraft, they still must
follow
> essentially the same steps, accomplish the same tasks and operate in the
> same areas. Knowing this allows protective intelligence to guard against
> different levels of threats.
>
> Of course, tactics can be changed and perfected and new tactics can be
> developed (often in response to changes in security and law enforcement
> operations). Additionally, new technologies can emerge (like cell phones
and
> Google Earth) -- which can alter the way some of these activities are
> conducted, or reduce the time it takes to complete them. Studying the
> tradecraft and behaviors needed to execute evolving tactics, however,
allows
> protective intelligence practitioners to respond to such changes and
even
> alter how they operate in order to more effectively search for potential
> hostile activity.
>
> Technology does not only aid those seeking to conduct attacks. There are
a
> variety of new tools, such as Trapwire, a software system designed to
work
> with camera systems to help detect patterns of preoperational
surveillance,
> that can be focused on critical areas to help cut through the fog of
noise
> and activity and draw attention to potential threats. These
technological
> tools can help turn the tables on unknown plotters because they are
designed
> to focus on the how. They will likely never replace human observation
and
> experience, but they can serve as valuable aids to human perception.
>
> Of course, protective intelligence does not have to be the sole
> responsibility of federal authorities specifically charged with
> counterterrorism. Corporate security managers and private security
> contractors should also apply these principles to protecting the people
and
> facilities in their charge, as should local and state police agencies.
In a
> world full of soft targets -- and limited resources to protect those
targets
> from attack -- the more eyes looking for such activity the better. Even
the
> general public has an important role to play in practicing situational
> awareness and spotting potential terrorist activity.
>
> Keeping it Simple?
> Al-Wahayshi is right that it is not difficult to construct improvised
> explosives from a wide range of household chemicals like peroxide and
> acetone or chlorine and brake fluid. He is also correct that some of
those
> explosive mixtures can be concealed in objects ranging from electronic
items
> to picture frames, or can be employed in forms ranging from hand
grenades to
> suicide vests. Likewise, low-level attacks can also be conducted using
> knives, clubs and guns.
>
> Furthermore, when grassroots jihadists plan and carry out attacks acting
as
> lone wolves or in small compartmentalized cells without inadvertently
> betraying their mission by conspiring with people known to the
authorities,
> they are not able to be detected by the who-focused systems, and it
becomes
> far more difficult to discover and thwart these plots. This focus on the
how
> absolutely does not mean that who-centered programs must be abandoned.
> Surveillance on known militants, their associates and communications
should
> continue, efforts to identify people attending militant training camps
or
> fighting in places like Afghanistan or Somalia must be increased, and
people
> who conduct terrorist attacks should be identified and prosecuted.
>
> However -- and this is an important however -- if an unknown militant is
> going to conduct even a simple attack against some of the targets
> al-Wahayshi suggests, such as an airport, train, or specific leader or
media
> personality, complexity creeps into the picture, and the planning cycle
must
> be followed if an attack is going to be successful. The prospective
attacker
> must observe and quantify the target, construct a plan for the attack
and
> then execute that plan. The demands of this process will force even an
> attacker previously unknown to the authorities into a position where he
is
> vulnerable to discovery. If the attacker does this while there are
people
> watching for such activity, he will likely be seen. But if he does this
> while there are no watchers, there is little chance that he will become
a
> who until after the attack has been completed.
>
>
> This report may be forwarded or republished on your website with
attribution
> to www.stratfor.com.
>
> Copyright 2009 Stratfor.
>
>
>
----------------------------------------------------------------------
Hotmail: Trusted email with powerful SPAM protection. Sign up now.