July 15, 2016
Consider the following hypothetical situations:
- A woman walks into gun store and attempts to purchase two military-grade ballistic vests. She’s denied the sale and leaves. This was her third attempt to acquire these items.
- Two men enter a beauty supply store and purchase three gallons of hydrogen peroxide. They pay in cash and appear nervous.
- A security guard outside a high rise office building notices a white van has circled his building three times and appears to be taking pictures of employee entrances and CCTV cameras.
- Police officers manning a gate at a public parade stop a vehicle with three foreigners who claim to work for a caterer serving the event, but fail to produce invitations or show ID.
- A college student notices her roommate’s Facebook page has been left up and, upon closer examination, sees what appears to be extremist conversations with several people with ISIS profile pictures.
None of these activities are criminal events and, taken individually, probably would not rise to a level worthy of an investigation by local law enforcement. Nevertheless, when viewed together, each of these actions could represent pre-attack planning for a terrorist event. Even more so if all of these activities were being carried out by the same two or three individuals, or were occurring in the same geographic area. But how do we make this determination?
Connecting these dots is currently the single greatest challenge facing law enforcement and intelligence agencies around the world. With few exceptions, every successful terrorist attack over the past fifty years was preceded by some kind of planning. In some instances, such as the US Embassy attacks in Africa, this operational planning was conducted over many years. In others, such as San Bernardino, Orlando, Brussels, Paris and Istanbul, the planning cycle appears to have been anywhere from a few weeks to several months.
Law enforcement, intelligence and security forces have become very good at collecting forensic evidence in post-attack investigations that eventually leads to the identification of the perpetrators. However, in many instances most of this same information was actually available prior to the attack, but missed or never acted upon. From pre-attack indicators posted by the perpetrators on social media, to suspicious activities observed (but never reported) by security officers at the attack site, to private citizens who noted unusual activity, but opted not to report out of fear of being labeled racist – the opportunities to identify and thwart terrorist attacks have been numerous but remain, for the most part, an untapped resource.