The Cipher Brief: First Paris, then San Bernardino, now Brussels. How widespread are ISIS networks in Europe and North America, and can we expect these kinds of attacks on a regular basis?
Michael Hayden: This attack was not surprising. It was somewhere between expected and inevitable. It’s right in that band of what we expected—the country that was targeted, the specific facilities that were targeted, even the success of the attacks in terms of the relative damage it caused. All were within the range of things I think we knew were coming at us.
What made it happen now was simply the arrest of one conspirator last week; I think that prompted his co-conspirators to shove this one out the door. But it had already been underway in terms of serious planning. It was reasonably sophisticated, sequential, well timed, well carried out. All that happened because of the arrest is they accelerated their timeline.
TCB: Should this be of grave concern to the U.S. in terms of posing the same threat here?
MH: Of course it should, but that said, we’re not Belgium. Our security services are actually a whole lot better than the Belgian services. We’re actually a tougher target because we are more distant from Raqqa and Mosul - the battlefield. Our demographics are quite different. And finally, we have a fairly assimilating society. We’re not replicating all of the pre-conditions that existed in Belgium that enabled this to take place.
Our threat is not zero, of course, but I do think on balance this is less likely, or less likely to succeed, or less lethal if it does succeed here in North America, when compared to several places in Europe.
TCB: What are the challenges to detecting these terrorist networks?
MH: It’s interesting, have you seen all of the statements from Glen Greenwald and Edward Snowden today?
TCB: No, I didn’t.
MH: Neither did I. How about that.
We are coming off a conversation, internally in the U.S., internally in Europe, and between the United States and Europe that was badly distorted and based on an altered view of reality. But that conversation dealt with very serious questions about security privacy, liberty, safety, and so on. Maybe this is the time that we actually have the fact-based version of that discussion.
These are not malevolent forces trying to pry into the lives of European or Americans. They are well-intentioned security services – which is different from saying everything they do is fine and we should all agree to it. I don’t mean that. But I do think the last round of discussions on this was a badly distorted round. So maybe we should talk about it again now.
TCB: What would you tell the President about the threat to the U.S., and what next steps should there be to prevent the next attack?
MH: Steady as you go with what you are doing domestically. Like I said, we’re actually pretty good at this. I would have the adult, non-distorted conversation about surveillance and security, liberty, and privacy.
We also need to have the adult conversation about Islam in the modern world and not pretend this has nothing to do with Islam. And remind some other folks, who may or may not be running for president, that this is not about all of Islam, and it’s certainly not about all Muslims. But there is a space in the middle where we do need to talk about things and not run away from them.
And then finally, I do believe we need to take the fight to the enemy and inflict losses on him and make him far more concerned about his safety than focused on ending ours.
TCB: By taking that fight to the enemy, what are you suggesting?
MH: Ramping up what we are doing in Iraq and Syria; targeted killings, use of special forces and so on. My macro description of that effort is: under resourced and over regulated. We’re only now beginning to put our toe in the water in Libya. There are a variety of places where we have the tools to keep these people’s heads down.
TCB: Europe has been criticized for not sharing counterterrorism related intelligence. In light of these events, will this spur greater cooperation on counterterrorism within Europe—and with the U.S.?
MH: You’d think they would. I certainly hope so. If our sharing is imperfect, no time like the present to make it better. We really need to continue to work on that.
That’s also a subset of the legal regimes under which each of us operates. And maybe, as I tried to suggest earlier, in the aftermath of this attack, we can all reasonably agree on a commonly accepted legal regime within which the sharing takes place.
TCB: Concerning the attacks themselves, what do you make of reports that these were explosives using TAPT (triacetone triperoxide) and showing all the hallmarks of the same bomb maker?
MH: We’re probably never going to get to the type, hierarchical, command and control, “we’re waiting for the dispatches from Raqqa before we went and did this,” kind of forensic evidence—because it probably doesn’t exist. But I do think we’re going to find enough commonalities in the physical evidence to see that this is all of a piece, that it is a network that is interrelated and shares resources, talents and skills. It’s not a one off, lone wolf sort of thing.
TCB: Once again we’re seeing transportation targets—airports and subway systems. Is there more that needs to be done to protect these entities, or is there going to be a certain amount of risk at these places regardless of what you do?
MH: You can put the metal detectors outside of the ticket area. But how wide do you want to expand the security perimeter? At some point that begins to be not sensible.
There are three ways of coming at it. One is to defend in the goal mouth. Or you widen the security perimeter, but then of course the long lines you form outside the security perimeter in the parking lots now become the target. I don’t think that is a winning hand.
I think aggressive intelligence collection – back to metadata, contact chaining and bulk collection—that is within rules, consistent with the law, and respectful of privacy might actually spare you the more dramatic things you would have to do if you had to do it all at the airport.
And then finally, beyond the intelligence collection, which is still kind of defense, there’s offensive action. How did they get the money to do this? Oh, they sell oil. How can we stop them from selling oil? We can attack their tanker trucks. There are multiple layers.
Don’t concentrate on just making the goalie better because a penalty kick got through. You might want to work on your midfielders and your forwards too.
