- The Washington Times - Wednesday, September 11, 2002

My job series and title is GS-132 intelligence research specialist. My analytical portfolio is terrorism, specifically threat assessment. In essence, I am a mechanic on terrorism. I deal with the nuts and bolts, not the theories and motivations. For the past several months I, and many of my colleagues, have watched, listened and read the comments by television talking heads, newspaper reporters and commentators, former U.S. government military, law-enforcement and intelligence pundits, members of Congress, and the academic experts. They have talked of "a failure of imagination," "missed clues," "pieces of a puzzle," and a failure "to connect the dots."

I would like to offer the perspective of an intelligence analyst whose job it is to put the pieces of the puzzle together and to connect the dots.

First, it is important to understand the nature of the enemy that threatens us at home and abroad. They live a clandestine lifestyle. They rarely travel in groups of more than two. They travel with false documents and disguises. They blend into their surroundings. Their communications are short and cryptic. They practice very good internal security. They are dedicated and thus not prone to betraying the group. Their attack plans are treated like the code word that the president must use to launch a nuclear strike. They are extremely patient. Their existence is based on secretiveness. They also read newspaper and journals to detect how much we know about them. They are willing to die for their cause. And lastly, they are small in numbers. This is a formidable enemy that should not be underestimated. Its most deadly characteristic is that it is patient.

The media and non-government experts on terrorism have used puzzles as a primary metaphor for the alleged September 11 intelligence failures. One gets the impression that this puzzle apparently consists of a small number of clearly definable and obtainable pieces. As a terrorism mechanic, I can tell you that these representations are not accurate. Here is the reality.

Imagine your boss coming to your desk, placing a lunch-size brown bag twisted at the top on your desk and asking you to tell him what the contents mean. The contents are some 120 disparate pieces of a puzzle. As you look over the puzzle pieces, you immediately notice that about one-third of the pieces are blank, and another one-third appear to have edges that have been cut off. As you look at those remaining pieces that are intact and have some part of a picture on them, you sense that this is really a mixture of about four different puzzles. Now keep in mind that you have no box top to tell you what the puzzle(s) should look like and you do not know how many total pieces are in the puzzle(s). Welcome to the art of terrorist threat analysis! And, it is an art, not a science. I was amused last year when a New York Times headline on Nov. 29 stated: "Scientists Find the New Field of Threat Assessment Full of Uncertainties."

The unfortunate reality is that the government rarely sees a majority of the key pieces of a terrorist threat. In my two-and-a-half decades as a terrorism mechanic, I have examined about 9,000 anti-American terrorist threats. Many have been flagrantly illogical, unsubstantiated, or non-credible. Still, about 2,100 have been logical enough or contained enough credible components to cause concern and trigger further analysis and data mining. Unfortunately, I can only think of about two dozen reports that provided all the key pieces of a credible terrorist plot. I think it is crucial that the American people understand that the quest of acquiring or detecting key pieces of a terrorist plot is extremely difficult.

A terrorist operation is composed of five elements: (1) target selection, (2) surveillance, (3) operational plan, (4) the attack, and (5) escape and evasion.

The group's ideology, objectives, and current domestic and international political developments shape target selection. Over time, it is possible for an experienced mechanic to detect a particular group's preferred targeting sectors (diplomatic, military, business, law-enforcement, religious, et. al.). More specific information (name, building address, flight number) on a target can only come from intelligence. The first part of a terrorist attack is determining what message the group wants to send to its enemy and selecting the appropriate target to transmit that message.

Initially, multiple targets are selected. Surveillance will filter the targeting list down to the most accessible and vulnerable target. Surveillance can detect a target's protective security vulnerabilities. It can be accomplished up close, from a distance or even in some cases via the Internet. Ruses, disguises and other camouflage methods are employed by terrorists when conducting surveillance activity. You have seen the picture puzzles called "Where's Waldo?" This is an appropriate metaphor for what our surveillance detection and countersurveillance teams engage in almost every day. Terrorist surveillance is a key ingredient in an attack since almost all terrorist attacks require some degree and level of surveillance. Al Qaeda has been quite proficient at detecting security vulnerabilities around our targets.

Once it is determined that one or more targets are vulnerable, then an operational plan is constructed around the selected target's vulnerabilities. It should be noted that the selection of the final target is generally made by the group's senior leadership under a security umbrella that is equal, if not superior, to a Fortune 500 company planning a merger or a new product launching. After the specific target is selected, the operational plan is constructed.

How should the attack be carried out (car bomb, rocket attack, suicide attack, etc.)? Who should be selected for the attack team? How large will the attack team be? How many supporting elements or facilitators will be needed? Should contact be made with local cells? What are the escape plans? What will be the reaction of the target's government or the host country be? Should a claim of responsibility be issued? If yes, when and how? When will the attack take place? Only four to six people are aware of all the components of the operational plan. From an intelligence standpoint, you want to quickly acquire the specific location and timing of the proposed attack. Members of the attack team may only know pieces of the plan. The attack team leader usually knows more. The more movements or logistical activities (travel, purchases, car and residence rentals, communications) the attack team makes increases the possibility that one of these actions will be detected or an attack team member will be discovered.

After the attack team has arrived and is ready, the attack takes place. The attack phase is simply the implementation of the operational plan with minor adjustments from the attack team if necessary. The final element is the escape plan. While suicide attacks do not incorporate this element into the operation, most terrorist groups do plan for their members to escape unharmed.

Another, less precise method of obtaining useful information is by analysis of disparate pieces of strategic intelligence that may or may not give you a fragment of the attack plan. Unfortunately, it is virtually impossible to deduce the specific target and exact timing of an attack via this process. At best, this analytical process can lead an analyst to conclude that a particular group might be shifting targeting sectors, or may deploy a specific tactic, or is showing increased interest in a particular region, or has become angered by a specific issue.

This analytical process may also lead an analyst to conclude that a confluence of disconnected indicators has surfaced to suggest that the terrorists are plotting an attack at an undetermined location at an unknown time. This would result in the opening of a "threat window." Opening a threat window usually triggers the U.S. government to issue a threat alert to official elements overseas, and/or to the American public. It is easy to open a threat window; it is hard to close it. To close it means that the threat was fabricated, has diminished, or is postponed. It takes analytical guts to close a threat window.

Be aware that assessing al Qaeda threats today is more difficult. The pre-September 11 al Qaeda no longer exists. It has most likely metamorphosed into a new structure with different characteristics, tendencies, procedures, communication codes, false documents, membership, command and control, travel methods and financial channels. It is quite possible that al Qaeda may eventually transform itself into a "leaderless resistance" movement like the Earth Liberation Front or the defunct Revolutionary Cells in Germany. Al Qaeda could become amorphous, with no structure, hierarchy, central headquarters, or group dynamics. It evolves into an ideal that provides, via Web sites, CDs, videotapes, manuals and publications, the ideological framework and training for adherents. Islamic extremists around the globe could then decide if they want to further the movement by setting up small, local, autonomous cells to carry out attacks consistent with the ideological framework. In this scenario, al Qaeda is no longer called "the base" but the "nexus."

I became a terrorism mechanic in 1977. I have served in five administrations. I believe the current one has displayed an unparalleled patience, determination and intelligence in its fight against terrorism. I believe that al Qaeda will be neutralized as a threat to U.S. interests within four years if we stay the current course.

Dennis Pluchinsky is a U.S. government terrorism analyst with 25 years of experience in the field. The opinions expressed are personal ones and do not reflect in any way the official views or policies of the U.S. government.

Copyright © 2018 The Washington Times, LLC. Click here for reprint permission.

The Washington Times Comment Policy

The Washington Times is switching its third-party commenting system from Disqus to Spot.IM. You will need to either create an account with Spot.im or if you wish to use your Disqus account look under the Conversation for the link "Have a Disqus Account?". Please read our Comment Policy before commenting.


Click to Read More and View Comments

Click to Hide