With the recent rise in domestic homegrown terrorist attacks, the fear of a domestic WMD attack is also rising. John Cohen, former Acting Under Secretary for Intelligence and the Counterterrorism Coordinator at the U.S. Department of Homeland Security, assesses the evolving threat to the nation and how the government can work with the private sector to combat this threat.
The Cipher Brief: How would you characterize the WMD threat posed by homegrown terrorists?
John Cohen: Today, the United States faces a terrorist threat that differs greatly from the one we faced immediately after the 9-11 attacks. Clearly, we still must guard against the threat of attack by those directly associated with and controlled by foreign terrorist groups.
However, increasingly we also face a significant risk from people in the United States, Europe, and Canada who are: inspired by the ideology of terrorist groups such as al Qaeda and ISIS; willing to conduct acts of violence in furtherance of this ideology; but never directly communicate with members of the terrorist group and operate independent of its command and control infrastructure. To date, most of the disrupted plots and successful attacks carried out by homegrown terrorist have involved the use of knives, firearms, and maybe rudimentary explosive devices. Attackers have targeted so-called “soft targets” – locations that are open to the public, where large numbers of people congregate, and difficult to secure, such as shopping malls, museums, sporting events, and business offices.
So far, homegrown terrorists have mostly not used sophisticated chemical, biological, radiological, or other weapons of mass destruction. Many believe that in the near-term, the threat posed by homegrown terrorist will focus more on active shooter type of attacks versus attacks using WMD. But, if we have learned anything since the attacks of 9-11, it is that the threat facing the nation will continue to evolve. ISIS has actively sought to lure individuals with technical knowledge to its cause. There are concerns that as ISIS acquires more technical knowledge regarding the construct of WMD, they could seek to share information more broadly with those inspired by its ideology.
TCB: How has this threat changed in recent years due to increased access to advanced technology and Internet usage? On a related note, we have recently seen a spike in ISIS-inspired attacks. Should we be nervous about an ISIS-inspired homegrown WMD attack?
JC: The growth of the Internet and other advances in communication technologies impact every aspect of our lives. Today, we truly are a global, digital society. We are connected by technologies that enable global collaboration amongst people, business, and government. Like-minded people can use open and secure communication platforms to share information and conduct sensitive transactions. But, just as it has impacted those involved in legal commerce, trade, and collaboration, criminal organizations and terrorist groups have benefited from these technology advances as well.
The expanded use of the Internet, encrypted communications capabilities, and social media by groups like al Qaeda in the Arabian Peninsula and the Islamic State has been a game changer as it relates to their communications and recruitment efforts. These groups are using sophisticated social media campaigns intended to resonate with young, disaffected people searching for a cause or connection that will give their life meaning. Terrorist recruiters can identify individuals of interest through social media communication and then direct potential recruits to encrypted communication platforms as they seek to encourage people to join their cause. Would be attackers using commercially available encryption tools can mask communications amongst collaborators that are part of operational planning efforts.
Once committed to a terrorist ideology, self-radicalized individuals can acquire pre-operational intelligence in advance of an attack. Also, information that can inform the design and construction of explosive or other sophisticated weapons can be accessed via the Internet. Dangerous chemicals and other materials that potentially could be used to construct a device are obtainable via the Internet as well. These pre-operational activities can all be achieved without a homegrown terrorist ever having to leave their home or meet with collaborators.
The use of these technologies, coupled with the growing threat posed by those inspired by extreme ideology but who operate independent of a designated terrorist organization, makes detection by intelligence or law enforcement authorities using traditional counter-terrorism tools much more difficult. This is why, in the United States, law enforcement authorities, including the FBI, are exploring locally-based prevention strategies that can complement traditional federal counterterrorism activities.
TCB: What is the U.S. government doing to counter the homegrown WMD threat? What advice would you give to improve these efforts?
JC: Over the past several years, our national efforts to counter violent extremism have expanded. Federal agencies have worked with local authorities, faith leaders, and other to encourage the development of local partnerships intended to prevent ideologically motivated violence. The emphasis of Federal efforts to date has been on engagement with Muslim organizations through local “round-table” events and developing strategies to counter the narrative of terrorist groups like the Islamic State. Federal officials have also worked with private companies and universities to ensure that materials that could be used to construct a WMD are safeguarded
There is a growing body of analysis and research that examines why young adults in the United States, Europe, and Canada are increasingly becoming drawn to extremist causes. Based on this work, law enforcement and mental health professionals, as well as faith leaders, have increasingly come to believe that there are opportunities for authorities to detect high-risk individuals and intervene before violence occurs. In the majority of cases, these homegrown terrorist are not life-long adherents to the Muslim faith, nor do they necessarily come from common economic, ethnic, cultural, or educational backgrounds. They do, however, share common psychological and life experience characteristics. They are overwhelmingly from dysfunctional families and disconnected from others within their communities. They have underlying mental health issues and may have a history of criminal behavior. They have experienced a pattern of life failures and exhibit excessive Internet and social media usage. In short, these are disaffected young people searching for something that provides meaning to their lives – and they are finding deep and meaningful connection with the cause of groups like ISIS. This population can and has included highly educated individuals. One area of concern is that an individual possessing advance knowledge of chemistry, physics, or engineering could become radicalized to violence and use those skills to construct a WMD to use in an attack.
Understanding this is important because it explains why the social media campaigns of groups like ISIS are resonating with growing number of young adults in the West. It also helps to identify intervention opportunities intended to prevent these people from becoming violent. These intervention efforts work best when local law enforcement officials work with community members, mental health professionals, faith leaders, and educators to detect individuals who pose the risk of committing a violent attack and intervene prior to it occurring. This may include law enforcement action, but it could also include some other type of mental health or other support. There are a growing number of examples across the nation where this type of approach has been successful. Replicating these best practices holds promise in not only preventing violent extremism, but also other types of mass casualty attacks and even gang related violence. Federal efforts should focus on supporting these locally-based, multi-disciplinary intervention efforts.
TCB: There is a fine balance between protecting our nation’s safety and protecting citizens’ rights to privacy and freedom of expression. How does the U.S. government find a balance between security and civil liberties in the face of this threat?
JC: We must both protect our nation from attack and protect the privacy, civil liberties, and civil rights of all Americans. It is important to remember that people have a constitutionally protected right to have extreme thoughts and to even engage in speech that others find offensive. Our goal should not be to prevent extremist thought or speech but instead to prevent violent behavior. Our efforts should emphasize training law enforcement and security personnel to distinguish between behaviors that are associated with specific threats and criminal activity, and those that represent a religious or cultural practice and/or constitutionally protected free speech.
Emerging analytic and information gathering technologies allow law enforcement to better understand the risks facing our communities and then employ information-driven and risk-based strategies that can keep our communities safer from acts of violence. To not use every tool possible to protect our communities would be foolish. At the same time, as law enforcement and security personnel evaluate and employ these tools, they must understand the privacy and civil liberty implications associated with their use and ensure that core constitutional rights and liberties are protected
TCB: What is the role of the private sector in combatting the homegrown WMD threat? How does the private sector work with the federal, state, and local governments to combat this threat? How can this cooperation improve?
JC: The private sector regularly works with federal, state, and local law enforcement to enhance the physical security around potential targets, such as hotels, shopping malls, other commercial facilities, and houses of worship, just to name a few. There also has been a great deal of work to improve how private entities and first responders react to mass casualty attacks, like a bioweapon attack or the dissemination of toxic chemicals. These efforts obviously should continue to be a top priority from a funding and programmatic perspective.
Greater collaboration is needed to prevent the growing use of encryption by terrorist organizations. Terrorist and other criminal organizations are increasingly turning to commercially available encryption to mask their communications and avoid detection by law enforcement and intelligence organizations. There are concerns that, if left unchecked, the growing use of these technologies will impede the ability of law enforcement to stop attacks here in the homeland.
At the same time, more must be done to protect sensitive data that could help terrorist build a WMD. Today, foreign intelligence, criminal, and terrorist organizations are conducting cyber-attacks targeting information systems used by private sector companies, universities, and government organizations in order to extract sensitive data. The targeted information could include research and other data used to inform the construct of a WMD. Mitigating the threat of these cyber-attacks is critical to both our national and economic security, and data protection technologies such as encryption are essential to our broader cyber-security efforts. In addition to protecting sensitive data from unauthorized extraction, private sector companies and universities should put in place procedures for notifying Federal authorities whenever they believe unauthorized individuals have acquired information or materials that could be used to construct a dangerous weapon.
