Terrorism and Counterintelligence

How Terrorist Groups Elude Detection

Blake Mobley

• Publisher: Columbia University Press
• Year: 2012
• ISBN:
  9780231528092
• Topic: Politics & International Relations
• Subtopic: International Relations
• Index: Politics & International Relations

Protecting information, identifying undercover agents, and operating clandestinely—efforts known as counterintelligence—are the primary objectives of terrorist groups evading detection by intelligence and law enforcement officials. Some strategies work well, some fail, and those tasked with tracking these groups are deeply invested in the difference.

Discussing the challenges terrorist groups face as they multiply and plot international attacks, while at the same time providing a framework for decoding the strengths and weaknesses of their counterintelligence, Blake W. Mobley provides an indispensable text for the intelligence, military, homeland security, and law enforcement fields. He outlines concrete steps for improving the monitoring, disruption, and elimination of terrorist cells, primarily by exploiting their mistakes in counterintelligence.

A key component of Mobley's approach is to identify and keep close watch on areas that often exhibit weakness. While some counterintelligence pathologies occur more frequently among certain terrorist groups, destructive bureaucratic tendencies, such as mistrust and paranoia, pervade all organizations. Through detailed case studies, Mobley shows how to recognize and capitalize on these shortcomings within a group's organizational structure, popular support, and controlled territory, and he describes the tradeoffs terrorist leaders make to maintain cohesion and power. He ultimately shows that no group can achieve perfect secrecy while functioning effectively and that every adaptation or new advantage supposedly attained by these groups also produces new vulnerabilities.

1 / INTRODUCTION

Jamal Ahmed al-Fadl joined al Qa’ida in 1989. As a founding member, he was a close confidant of Osama Bin Laden and helped the notorious leader to manage al Qa’ida’s properties and front companies in Sudan. By the mid-1990s, al-Fadl was entrenched in the upper echelons of al Qa’ida’s bureaucracy and by all appearances was ready to lay down his life for the organization. On September 7, 1996, al-Fadl approached the US embassy in Eritrea on foot, undoubtedly rehearsing in his mind a dark plot that had been planned for many months. The ensuing events caught everyone off guard. Al-Fadl’s secret plot did not involve attacking the embassy—his plan was to sell al Qa’ida’s most treasured secrets to the US government. Above all, al-Fadl’s decision to betray al Qa’ida made it clear to all observers that the shadowy terrorist organization was not immune to spies.

Al Qa’ida’s problems are not unique. In fact, most terrorist groups face even greater challenges, and many do not survive past their first few years of existence.¹ Some groups lose key leaders, transition to nonviolent political entities, or fail to pass on their cause to the next generation of terrorists.² All terrorist groups—even those that survive for decades—face an even more basic threat to their existence: the discovery of their activities, members, and plans by government law enforcement and intelligence agencies.

Groups that fail to hide their communications, movements, and plots from a determined adversary will be eliminated quickly. Terrorist groups that survive for years do so because they have developed sophisticated methods for staying hidden. These strategies are often referred to a “counterintelligence.” Current studies on terrorism have not systematically addressed this critical issue, and, more important, most terrorist groups that experience crippling counterintelligence problems do not survive long enough to be studied at all. What factors shape a terrorist group’s counterintelligence capabilities? The answer to this question has profound implications for homeland security and international counterterrorism efforts.

This book is fundamentally about disrupting terrorist groups. It examines terrorist groups through the lens of counterintelligence and offers lessons for uncovering terrorist plots and manipulating terrorist-group decision making. The book makes a case for elevating the role of counterintelligence analysis in counterterrorism operations. The book specifically explores how we can better monitor, impede, and eliminate terrorist groups by exploiting the weaknesses of their counterintelligence and security practices. Part of the approach involves knowing where to look for their weaknesses. Some counterintelligence pathologies are more likely to accrue to certain types of terrorist groups, whereas some destructive bureaucratic tendencies, such as mistrust and paranoia, pervade all terrorist groups. Being smarter about where to look for weaknesses and how to capitalize on them will allow intelligence and law enforcement agencies to improve how they recruit and manage human penetrations (spies) into terrorist groups, locate and monitor the groups’ communications, and analyze and manipulate their decision making.

Scholarship on intelligence and terrorism offers limited insights into terrorist-group counterintelligence. A large portion of terrorism literature focuses on terrorist-group motivations and decision-making as well as on government policy responses. The intelligence literature consists mainly of firsthand accounts of intelligence practitioners and large-scale assessments of the intelligence community. Very few studies attempt to examine carefully and theorize about operational intelligence, and almost none has dealt with terrorist-group intelligence operations. I seek to answer two basic questions: How do a terrorist group’s organizational structure, level of popular support, and access to territory it controls affect its counterintelligence strengths and vulnerabilities? How can governments exploit terrorist groups’ counterintelligence vulnerabilities to collect more accurate information about them and disrupt their activities?

To investigate either of these questions, we must address an even more basic question: What is terrorist-group counterintelligence? The answer to this question is not as simple as it may initially appear because terrorist-group counterintelligence strategies vary widely among groups. Some strategies can be as simple as avoiding the use of communication technologies that can be intercepted by state adversaries. In planning the attacks of September 11, 2001 (9/11), al Qa’ida operatives occasionally used trusted couriers to transmit sensitive messages rather than risk using telephones or email. A terrorist group may also develop sophisticated counterintelligence procedures if such innovations can provide an important intelligence advantage over the group’s adversaries. When British intelligence began paying members of the Provisional Irish Republican Army (PIRA) to spy for the British government, the PIRA responded by recruiting government tax and social security bureaucrats to identify PIRA spies who were earning and spending beyond their “means”—an indication that they were receiving payment as British informants.

I explore how three primary factors shape a terrorist group’s counterintelligence capabilities: the terrorist group’s organizational structure, its popular support, and its access to territory it controls. The book also shows, to a lesser extent, how the counterterrorism capabilities of the group’s adversary and the terrorist group’s resources shape its counterintelligence strengths and vulnerabilities. Even a small change in one of these factors can have a dramatic effect on a terrorist group’s counterintelligence fitness.

Understanding terrorist-group counterintelligence will lead to a better understanding of terrorist groups and the design of more effective counterterrorism efforts. Anticipating terrorist counterintelligence vulnerabilities will enable governments to monitor and diagnose more effectively a terrorist group’s capabilities and weaknesses. Improved monitoring will allow governments to adapt to a terrorist group’s counterintelligence strengths and to disrupt more effectively the group’s activities. Understanding why and predicting when the key counterintelligence trade-offs arise will allow government law enforcement and intelligence agencies to better detect and exploit them.

KEY FINDINGS

All terrorist groups face counterintelligence dilemmas, or trade-offs, that challenge their ability to function securely. No terrorist group can maintain perfect secrecy and function effectively—every counterintelligence adaptation or new advantage produces new vulnerabilities. The three factors named earlier in particular—organizational structure, popular support, and controlled territory—shape terrorist organizations’ counterintelligence practices and are at the heart of the trade-offs their leaders face.

Terrorist groups with a centralized and tight command-and-control structure rather than a loose and decentralized command structure tend to have superior counterintelligence training and compartmentation. Centralization of command gives group leaders greater control over group members, allowing leaders to mandate specific training for the entire organization and to punish those who do not comply. Almost all terrorist groups attempt to train their members in basic counterintelligence skills, which can significantly impact how members and new recruits are monitored and captured by the adversary. The Palestinian terrorist groups Fatah and Black September Organization (BSO) had tight command structures and successfully trained their members in counterintelligence methods. Al Qa’ida had a relatively tight command structure from 1989 to 2001 and was able to train its members in counterintelligence.

Terrorist groups with a tight and centralized command structure are more vulnerable, however, to their adversaries’ efforts to develop high-level spies, or “penetrations,” and to exploit the groups’ standardized counterintelligence procedures. The PIRA improved its counterintelligence training when its organizational structure tightened in the 1970s, but the tightening also allowed British to place a long-term spy in the PIRA’s “internal security” department, giving British forces access to a volume of PIRA secrets that they could not have acquired with even their best spies of the early 1970s. Groups with a loose and decentralized command structure are more difficult to train systematically but also are less predictable to the state adversary because they develop fewer standardized organizational procedures. Fatah’s use of standard codes for communicating with its operatives allowed the Jordanian government to manipulate the organization by mimicking its communications; had each Fatah unit developed its own codes, the Jordanian government would have had to study and break all of the subgroups’ codes instead of just one code.

Terrorist groups with popular support tend to receive more counterintelligence support from the local population. Militant groups that have won their local population’s affection are more likely to win their support in intelligence tasks, such as identifying government spies and notifying the group of government raids and investigations. The PIRA received crucial counterintelligence support from its Hen Patrols, made up of members of the community who alerted the Republicans to incoming British patrols and searches.

At the same time, however, terrorist groups that invest in developing popular support are more likely to expose sensitive details about their plans and members in their efforts to generate and maintain their popularity. The growth of video-sharing and user-generated media outlets on the Internet has heightened this publicity dilemma. Outreach to the population, in particular outreach through the media, can reveal details about the group that a clever adversary can piece together to learn about the group’s personnel and activities. Al Qa’ida leaders, for example, were in frequent contact with journalists and media organizations, and group members in the West had regular liaison contact with the media. Bin Laden routinely leaked valuable information about his health, locations, and operational intentions in video interviews and tapes released to media organizations. Importantly, for clandestine organizations there is a natural tension between secrecy and popularity. One PIRA member noted that increased secrecy drew PIRA volunteers away from daily interaction with the average citizen of Northern Ireland and that less contact with the population eventually resulted in less familiarity and trust between the PIRA and its base of popular support.³

Terrorist groups that control territory rather than living in uncontrolled territory or areas the adversary controls tend to have superior communications security, physical security, and counterintelligence vetting. Operating freely in territory that the adversary has trouble entering and observing allows the group to dominate the local intelligence environment, to move freely between safe houses, and to interrogate locals and outsiders. For the Egyptian terrorist group known as the “Islamic Group” (IG), controlled territory provided a shelter from the Egyptian security forces. Egyptian forces could not adequately police the group’s territories and had to rely on mass sweeps and raids when venturing into those areas. Police raids on this scale may have been easy to predict and may have given key leaders and operatives a chance to hide or escape police roundups.

Terrorist groups that control territory are, however, more vulnerable to their adversaries’ efforts to concentrate their intelligence and military forces on a discrete and often well-known location. In the case of the Egyptian IG, controlled territories gave Egyptian security forces an area to target, and mass arrests almost certainly netted some operatives and IG sympathizers. Israel found it difficult to track and assassinate Fatah leaders in their controlled territory in Lebanon, but at least Israel knew where to direct their human, signal, and imagery-collection assets to begin looking for targets. In contrast, the rank-and-file members of BSO spread out across Europe and Asia were more anonymous and hidden among tens of thousands of noncombatants with similar biographical profiles. In many cases, BSO operatives were legitimate students and workers in Europe, and BSO operatives who participated in only one mission would leave very few operational footprints.

Among the three key factors, controlled territory stands out as the factor offering the most important counterintelligence advantages. Groups that do not control territory suffer tremendously if they are constantly targeted by hostile intelligence and law enforcement entities or if they live at the mercy of state sponsors that can and often do turn on them at any time. Organizational structure is the second most influential factor. Tightly commanded groups tend to have a counterintelligence advantage over loosely connected groups because they can more efficiently train and discipline their members while centrally coordinating and professionalizing the group’s security, investigation, and counterespionage functions. However, groups that do not control territory and face an overwhelmingly powerful adversary may prefer the advantages of a loose command structure, which allows for some level of adversary penetration without a catastrophic collapse. In this situation, the tight command structure would promote counterintelligence behavior—centralized counterespionage and record keeping, standardized counterintelligence tradecraft, and the maintenance of secure facilities or safe houses—that would allow a penetration that may fatally wound the group.

DEFINITIONS

The definitions of the two main concepts of the book—“terrorism” and “counterintelligence”—have been vigorously debated. This research does not seek to resolve these controversies. Rather, the definitions selected allow for a broad application of the book’s insights into both theory and practice.

Terrorist Group. I use a modified version of terrorism expert Bruce Hoffman’s definition of a terrorist group. Hoffman identifies five key elements of terrorism: “ineluctably political in aims and motives,” “violent—or equally important, threatening violence,” “designed to have far-reaching psychological repercussions beyond the immediate victim or target,” “conducted by an organization,” and “perpetuated by a subnational group or non-state entity.”⁴ Terrorism scholar Daniel Byman adds a sixth element in his study of state sponsors of terrorism: “The attack deliberately targets non-combatants.”⁵ Terrorist groups are those that use terrorism as a core tactic to achieve their objectives.

An insurgent group—defined as a nonstate actor engaged in a political-military campaign seeking to overthrow a government or to secede from it through use of conventional and unconventional military strategies and tactics—may use terrorist tactics to achieve its objectives.⁶ In many cases, insurgent groups are not easily distinguished from terrorist groups. In principle, an insurgent group’s intention to overthrown a government or to secede from it can distinguish it from a classic terrorist group. In reality, many insurgent groups target civilian populations with terrorist tactics to achieve objectives short of “overthrowing a government.” This may be especially true in the cases where an insurgent group conducts its operations in densely populated urban settings or where the line between combatant and noncombatant is blurred or creatively defined by either side.⁷ In addition, many terrorist groups participate in internal conflicts designed to overthrow or undermine the stability of a government, often to gain controlled territory. Even an archetypal terrorist group such as al Qa’ida supported the Afghan Taliban in its efforts to undermine Afghanistan’s central government after 2001.

Defining a terrorist group as an entity that uses terrorism as a core tactic to achieve its objectives intentionally casts a wide net into murky waters teeming with clandestine, armed groups. This approach reduces the need for highly subjective distinctions among terrorist, insurgent, guerrilla, and revolutionary groups and broadens the applicability of the analysis and conclusions.

In some respects, this broad definition applies—albeit unevenly—to many types of groups that are not typically considered terrorist organizations, including some organized criminal groups, drug-trafficking organizations, and large, transnational street gangs.⁸ This book does not address the counterintelligence practices of this broader set of armed, clandestine groups, but a rigorous investigation of these organizations would likely show many similarities.

Counterintelligence. Counterintelligence is the process—or constellation of activities, analysis, and decision-making—that a group engages in to prevent adversaries from acquiring accurate information about its actions, personnel, and plans. Counterintelligence has three subprocesses—basic denial, adaptive denial, and covert manipulation—each building on the previous in sophistication.

Basic denial, the foundational counterintelligence practice, consists of activities that prevent the passage of information, intentionally or unintentionally, from the group to the adversary. Activities in this category are sometimes referred to as “defensive counterintelligence” and often focus on prohibited behaviors. For example, group members may be required to refrain from discussing the group’s information with nongroup ...

Table of contents

• Cover 
• Half title
• Series Page
• Title
• Copyright
• Contents 
• Acknowledgments
• 1 / Introduction
• 2 / The Provisional Irish Republican Army
• 3 / Fatah and Black September
• 4 / Al Qa’ida
• 5 / The Egyptian Islamic Group
• 6 / Failure in Embryonic Terrorist Groups
• 7 / Terrorism and Counterintelligence
• Notes
• Bibliography
• Index