Components of threat (another view)

Lung Hu presents an exceptional view of a topic I’ve written about here over the years: The components of threat and risk.

He defines risk thus: R = V + T

And, of course, threat is defined as: T = ntent + apabilities = ntent * apabilities to account for the fact that without both intent and capabilities there is no threat.  The same would apply to the risk equation as well.]

Lung Hu does some yeoman work here and brings up some very important points that are worth repeating and thinking about.

Intent: While this should be a fairly ‘easy’ component to threat (and risk) to consider, we continue to have a great deal of difficulty in plugging it in to the equations. Intent often becomes a tool by which security (civilian or military) forces can use to push their own agendas or project their own fears.

Back in the late 1990s street gangs were the big rage. Warnings were issued with a regularity you could set your watch to that various gangs had expressed the intent to form highly centralized and organized nationwide organizations that would control a wide array of criminal activity. Never mind that these plans were usually written in a run down basement or a jail cell and each would be modern criminal Napoleon had difficulty in securing the loyalty of more than a handful of (usually) talentless flunkies. And even those who were able to demonstrate skills and ability were lost in a sea of criminality which expressed no desire to be tamed or placed under the yoke of some criminal mastermind.

Tis better to reign in petty crime squalor, apparently, than serve in the world of a criminal mastermind

But intent was intent. Lung Hu describes this as a function of American culture and I suspect there’s some truth to that. Among the descriptions I’ve heard of Americans by others is that we do tend to say what we mean. And, an old bugbear of intelligence analysts when trying to get into our adversary’s mind is when we project our own cultural and personal biases and beliefs into our foe. Then allow the madcap hilarity to ensue…

Why would Saddam not open up his chemical facilities? No self respecting, corn-fed, middle American farm boy would act so deceptive if he had nothing to hide. Therefore, he must have a fully functioning chemical and biological weapons capability.

<laugh track> Ooops!</laugh track>

The past decade is littered with alerts, notifications and grant requests all built around the intent of adversaries that had virtually no possibility of becoming reality.

It works the other way as well. Is it politically uncomfortable to pay attention to an ideologically motivated threat because they have sympathetic elements associated with one major political party *cough* right wing militias/white supremacists and the Republican party *cough*? Well, ignore their actions (and accompanying rhetoric) and voila(!), no threat.

Get a bunch of 20 somethings hanging around in a drum circle and advocating alternatives to the unregulated derivative market? Well, Rush Limbaugh won’t be mobilizing the masses if we crack some of those heads so let’s go boys!

In that vein, allow me to recommend this article from Outside. I did consider building a whole post around it but the story is a familiar one.  FBI looks to make a big counter-terrorism score to make careers and justify budgets so they find some knuckleheads who don’t like the status quo, plant a source to rile them up, goad them to action and provide them with the ‘materials’ to conduct an attack.  It should sound familiar as it’s been the playbook of most of the domestic terrorism arrests we’ve seen over the past few years.

The problem, as it appears from this and similar stories is the apparent disregard of threat as a consideration of priorities and focus.  And while I am loath to suggest that any sort of rigorous thought process governs law enforcement/homeland security investigative decision making it appears whatever thought goes into such a decision looks like this:

T = Pi (Possible intent) + Pc (Possible capabilities)

In this equation we no longer need to concern ourselves with what sorts of actions people actually (or even probably) will engage in and you can base decisions on speculation about what people might do if they get access to the appropriate capabilities.

So, let’s work though the scenarios which make up most of our counter-terrorism ‘success stories’.  Someone is displeased with the status quo and considering taking violent action in response (for the purposes of this little experiment, let’s say they’re serious and have actual intent to do harm but keep in mind that this is often less than certain).  Unfortunately for this prospective anarchist, jihadist, etc., they don’t have the technical know how to carry out their plot .  They can’t build their bomb, culture their anthrax, whatever.  They also lack access to that knowledge from whatever social network they are plugged into.  They lack, in short, the capability to carry out their attack.

Now, according to the threat equation that’s kind of the end of things.  If intent is particularly strong you can do some investigative due diligence like doing some checks to make sure they don’t acquire the capabilities portion of the equation or even just talk to the suspect.  Reading over these cases, one gets the impression that many of the suspects are people who get caught up in ideological echo chambers which serve to escalate radical thought.  There are simply few opportunities to bring these people back to the reality of shared cultural norms.  A visit from the feds could be that shock to the system that lets the knuckleheaded 20 something know (s)he’s actually messing around with serious issues that have serious consequences.  I’m not so naive to believe this would work in all cases or wouldn’t, particularly when talking about emotionally disturbed persons, result in an escalation of intent but the point here is to give us options for reducing or eliminating threat at the lowest level of suppressive/oppressive force.  It’s one of the tenets of intelligence led policing (and, for that matter, counterinsurgency doctrine).

So, we’ve got aspiring terrorist ‘X’ who has the intent to do some mischief but not the capabilities and no way, close at hand, to get those capabilities.  What to do?  Quick! To the interwebs!

Here’s where things get really weird.  In order to get something in the ‘capabilities’ column terrorist X goes on the web and finds some forum or social network that he thinks contains members who can help him out.  So he goes on and, sooner or later, posts something like ‘Anyone know where I can get some C4?’

Now, it’s important to realize the assumption wrapped up in classifying this as a threat.  What is needed is, at the same time mind you, someone who actually has access to or knowledge of this capability being in that location.  So, let’s say you’ve got your hands on 50 pounds of primo plastic explosive (never mind where you got it…let’s just assume you found it at a yard sale).  Maybe you’re a true believer (well, not that true of a believer or you’d use it yourself, right?) or you just need some cash.  How in the world, would you convert all that sweet, sweet explosive power to money?  Respond to an anonymous request on an internet forum asking for explosives to blow up a government building?

Sure, why not.

To summarize, we need someone with intent who has no clue about capabilities.  We need someone with capabilities willing to transact with the perspective terrorist.  We need both to be connected to the same social network at the same time AND we need  neither to be distracted by deception operations.  Oh, and ideally we’d also need them both to confine their monumental stupidity solely to the area of how these two meet and communicate so that they can find each other but not botch every other aspect of whatever plan they come up with.

That’s a tall order in itself and recent terrorism cases give some hint at how difficult it is to get those stars to align.  The homeland security complex frequently has to rely on generating both sides of the equation in order to get an arrest.  It both has to encourage potential terrorists to action sufficient to meet the conspiracy threshold AND provide the capabilities.  Certainly, many of the people arrested have demonstrated some willingness to discuss violent action but what isn’t clear is if this talk goes beyond what’s considered within the normal range of current behaviors.

Can we really say that we’re any safer by having these sorts of investigations occurring where

So, how could (or dare I say it, should) these sorts of things work?  Well, I’ll start by saying what it doesn’t have to be.  There’s no need for an adversarial system (after all, that’s what’s court can be for) where someone plays a permanent role devil’s advocate.  You could use that system but I don’t think it’s necessary.  What does seem imperative is a viewpoint hardwired into the system which has a different orientation than the one that views success in terms of arrests and seizures.  That means people whose careers don’t depend on being involved in ‘successful’, complex cases.  Intelligence personnel could fill that role but only if the source of their power becomes independent from the prosecutorial system which now runs the whole show.

An independent intelligence function (without arrest powers) could fill that role, forwarding cases to law enforcement that meet some criteria for their attention and forwarding (or ignoring) others based upon their threat and the most effective method for dealing with them.  One of the problems with our existing system is that it presupposes the best solution (investigate, arrest, imprison) in all cases.  When that’s your solution then you have to rig the threat equation in such a way to make it look that everything deserves that level of attention.

And then, you find yourself hiring a 17 year old to play the role of agent provocateur, and encouraging a bunch of people to commit terrorism so that they can be arrested.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s