Terrorists Learn Tactics by Watching Each Other

| Mitch Silber
Mitch Silber
Former Director of Analysis, NYPD

Earlier today, an improvised explosive device was detonated on the London underground railway, known as the Tube, injuring more than 20 people in what British authorities have deemed a terrorist attack. If confirmed, this incident would mark the fifth terrorist attack in the UK this year alone, as British authorities have attempted to keep up with the rising number of potential terrorist suspects in the country. The Cipher Brief’s Bennett Seftel spoke to Mitch Silber, Cipher Brief expert and former Director of Analysis at the NYPD, about the recent attack, how the investigation will proceed, and the extent of the terrorist threat facing the UK.

 The Cipher Brief: An improvised device exploded (IED) on a London underground train, setting off a fire.  There are wires coming from the device and there are reports there was a timing device found.  What does that tell you about this attack?

 Mitch Silber: By looking at the IED – and this is based on visuals and looking at it from a distance – it essentially seems like a relatively unsophisticated device, something that was made locally in the UK, and whoever did it is not a terrorist with a great level of sophistication and technical expertise.

 TCB: What are the next steps in this type of investigation when a perpetrator is not on the scene?

 Silber: Since someone left this device, the first question is if there is anything on or related to this device that can tie us to a person. A good example of this is the Times Square attempted bombing in New York in 2010 where there was a failed explosive device. So you are checking if there are any fingerprints on the device that would lead you back to someone that you might already have on your radar screen.

And then you are essentially going to do an autopsy on the device to check where the materials came from or if they came from any particular stores. They are also going to check the particular timer that was used. Any device where a cell phone was used as a timer, such as in the 2004 Madrid attacks, could help break the case wide-open. In Times Square, it was the VIN number on the truck.

So you are checking for anything on the device or anything the device was made of that could lead you in the direction of where it originated.

The British will also be checking whether there was any camera footage to see if they can pick up who left the device on the train

 TCB: Most of the recent attacks involved suicide bomber(s) or the attacker was actively involved at the scene.  This was a bomb left on a train, possibly detonated by a devise.  Do you see this as a change in tactics?

 Silber: This type of attack still fits into the broad category and trend line that we’ve been going on in the UK and in Europe in general, which is less sophisticated attacks that use knives, trucks, a homemade device that doesn’t look like it worked as it was supposed to. In general, the trend line has been less sophistication and this falls in that larger category.

TCB: This is the fifth attack this year in the UK.  What does this tell you about the focus of extremists? What does it tell you about the UK?

 Silber: Right now, and this is a key point, the UK is essentially experiencing its own “intifada.” They have a series of random events spread out – this is the fifth attack in 2017 – and they are coming in all shapes and sizes – knives, trucks, trucks and knives, unsophisticated IEDs. So there is a wide variety. They are not necessarily all coordinated, and they are being carried out by a population that the UK has categorized as being pretty significant.

According to MI5’s latest estimates, the UK has admitted that 3,000 people are under investigation and another 20,000 people who they have some level of concern about. Those are gigantic numbers, and those are numbers that would overwhelm the best intelligence and police agencies. So there is just a volume of threat that can come at them from so many different directions that makes this so hard. The British have frankly been so good, up until 2017, in preventing these attacks.

 TCB: What role does the availability of instructions on how to build a bomb as well as radicalization material on the internet play in terrorism? What can counterterrorism forces do to combat it?

 Silber: In a sense, showing that a terrorist attack could be very deadly, driving a van and using a knife, makes the argument that even if you prevented or blocked the knowledge about how to make these devices, you still wouldn’t eliminate and maybe not even reduce the threat. So there is really not much that can be done to take away that knowledge once it’s out there, whether it’s on the internet or in the library. Once knowledge is out in the public domain, you can’t put it back in the box. Law enforcement and intelligence can’t monitor everyone who looks at an instruction manual. It’s an overwhelming task.

In terms of the internet as a medium for radicalization, law enforcement and intelligence need to use cyber undercover and cyber informants who are on the web and hopefully bumping into some of these people who are radicalizing through online interactions. But nevertheless, once the information is up, there it will still have an effect on people.

TCB: What more can law enforcement and intelligence officials in the UK do to deal with these immense numbers of suspects?

 Silber: This problem that is playing out today in the UK didn’t happen overnight. You go back to July 2005 with the 7/7 bombers when this suddenly became a big issue in the UK.

The issue is that the UK has this population that has not been well integrated, has been vulnerable to radicalization, and has only grown in the years since. The UK has experimented with counter-radicalization and de-radicalization programs to mixed responses. So there is not going to be an easy solution to this.

One of the things the UK will have to do is hire more intelligence analysts, police investigators, and staff in order to be better prepared to match up with the numbers that they are up against.

TCB: Is this something that will have to be done across Europe?

 Silber: In Europe, you have to go country by country. Certainly after the March 2016 Brussels attacks, we learned how Belgium had been cutting back on its security services as this threat was metastasizing there, which means they were heading in the exact opposite direction. So in Europe more generally, the scale of the threat is much larger.

But let’s just compare the U.S. and the UK. The UK has 3,000 people under investigation and 20,000 people they are concerned about out of a population of 65 million people. In the U.S. where we have 300 million people, if you multiply those figures by five, then you have 15,000 people under investigation and another 100,000 people you are concerned about. I don’t know how well the U.S. would do if we were dealing with 15,000 people under investigation and 100,000 people we were concerned about. So the U.S. has been lucky in that the scope of our terrorist threat is so much less per capita than, for example, the UK.

 

The Author is Mitch Silber

Mitch Silber is the Senior Managing Director at FTI Consulting. He served as the Director of Intelligence Analysis for the New York Police Department.  In that capacity, he created a deep web, dark net cyber intelligence unit that focused on terrorism threats to New York City. He has presented on behalf of the NYPD at the White House, National Security Council, CIA, FBI, and National Counter Terrorism Center and testified before the U.S. Senate and House of Representatives.

Learn more about The Cipher Brief's Network here.

CLICK TO ADD YOUR POINT OF VIEW