After a multi-faceted attack in London on Saturday evening that saw a van with three assailants drive into pedestrians on London Bridge and then attack victims in the popular Borough Market shopping area nearby, the United Kingdom has now been the victim of terror three times in as many months. The Cipher Brief's Callie Wang asked David Shedd, the former Acting Director of the Defense Intelligence Agency, about ISIS’ strategic and tactical evolution, how law enforcement and intelligence can get closer to disrupting lone wolf plots, and whether “lone wolf” is the right way to frame the issue.
The Cipher Brief: The attack in London comes just after the attack in Manchester. What struck you about these latest London attacks? Could it be a result of a ‘contagion effect’?
David Shedd: There are a couple of underlying issues that we see unfolding. Several former and sitting intelligence officials have long warned of Islamic extremists taking action in Europe as a result of being further squeezed in Iraq and Syria. That is a strategic overlay to what we are seeing.
At a more tactical level, these extremists have seen that they can be quite successful with these brute force attacks by singletons. Notice that I don’t use the term ‘lone wolf,’ because these terrorists who derive their motivation from Islamism have been radicalized along the way by others – directly or via the propaganda available to them – and have dependencies, but then may carry out the actual terrorist event as independent actors without command and control from places like Syria or from Iraq. Using trucks or knives, which have been used before in the UK, is a natural tactical outgrowth of the success that the coalition is seeing in the ISIS epicenter of Syria and Iraq.
That’s how I’m interpreting these acts of international terrorism – as a strategic and tactical manifestation across these attacks in the UK.
TCB: After so many instances of these types of attacks, have we made any progress in combatting the singleton phenomenon? Is this the new normal?
DS: We have made progress if you consider UK Prime Minister Theresa May’s public statements of five disruptions of attacks. The FBI has a running list of disruptions as well, directed at attacks on American soil. What we’re seeing is that the UK’s challenges are increasing b/c of the modalities that these singletons or partnered attacks are using: executing attacks generally in an unsophisticated manner.
The Manchester suicide bomber had greater sophistication because it was an explosive, but it was a crude bomb, which I’m told you could build from knowledge found on the Internet. It used nails and other metallic content that act as shrapnel that will do tremendous damage as we saw in the Boston Marathon case; it was very similar to the Tsarnaev brothers’ attacks.
Is it a new normal? I think the new normal is less about the tactics that they use and more about the fact that you’re going to get individuals – whether they are veterans of the Syria/Iraq war returning to their country of origin or entirely homegrown without ever leaving the country where they undertake their act of terrorism – that have given indications that they may be recruits for this type of thing. The numbers and types of people that the UK authorities alone needs to track are staggering.
TCB: The UK has been on high alert since the Manchester attack, with ongoing investigations. Are the attacks of Saturday evening the type of attacks law enforcement and intel would expect?
DS: I know less about the UK law and what it can do but I have been a strong advocate that the U.S. Department of Justice must give new authorities to the FBI to conduct something between a full and open investigation on a potential attacker, which is very resource-intensive as you can imagine, to closing the investigation. I think technology can help us do that.
These in-between collection authorities would require court oversight but would use technology to track and then flag anomalies related to the kind of correspondence, postings, or activities of a suspicious individual. This approach would make it far less human resource-intensive. In this in-between state, there would be little-to-no physical surveillance on that individual until such time as a full fledged investigation is opened on the collection target. When we look back at everything from San Bernardino to present day, there were indications on social media and in correspondence that if properly flagged, we would have seen – not necessarily indications of the actual attack – but rather changes in the demeanor of the individual and manifestations of radicalization in their social media or correspondence.
Now again, this approach will require oversight, but it does not require new law. It requires modifying the operational authorities from DOJ to the FBI. There are any number of technologies that measure and determine patterns of behavior. That’s certainly one way to give warning of a change in behavior that needs to be investigated.
TCB: What will coordination and cooperation with the U.S. look like given the UK police’s frustration with the U.S. media leaks on the Manchester attacks? You recently described the agreement between the two countries as ‘tenuous’ – is information sharing delayed or slowed down by recent leaks? Does that affect security?
DS: Let me start with the end of your question. If delayed, if sharing becomes less comprehensive, it will definitely have a negative impact on our collective security. Knowledge is enhanced by further knowledge. If there’s a curtailment of any sort in sharing the experience and expertise of UK law enforcement and foreign intelligence with the U.S. for fears of it being publicly exposed in an unauthorized manner – aka leaked – that will be highly detrimental. This is an evolving threat in terms of the means and execution, and sharing what that looks like and the indicators – looking retrospectively – that were either missed or weren’t sufficiently followed up on, is critical.
This intelligence sharing will continue because of the President’s intervention with the Prime Minister herself after the really abominable leak on the U.S. side. But it remains tenuous, and I think there will be a reluctance to share if the British believe they are going to see their sensitive information in the media.
Why? Because for them, just like for us, these are open investigations. It may compromise the eventual prosecution of co-conspirators associated with the attacker or prejudice the attacker should he survive the terrorist attack he undertakes. The information is very fluid, but I understand the UK police have picked up at least five people in connection with the Manchester attacks. Any information that is leaked about those individuals may very well undercut the efforts of UK law enforcement.
TCB: Outside of the leaks, how does the U.S. intelligence community react to news such as Saturday night’s attack? Walk our readers through the next 24-48 hours in the USG after an event like this.
DS: First and foremost, you identify that but for the grace of God, that could have been us. The threats from international terrorism are global in nature.
The IC will ask: are we doing our utmost to share every piece of lead information that we have? Do we have any information on the communications of this either self-radicalized or already-radicalized individual inside or outside of the country in which they carried out the attack?
Obviously, the UK is going to have their own collection but if there are any indications of some kind of relationship outside, as we saw with the Manchester bombing vis a vis Libya and the attacker’s family, then the U.S. kicks into high gear to see what kind of connections the son, the father, other family members, co-conspirators potentially had outside of Manchester.
Secondly, the IC draws lessons from shared information. Is this a new modus operandi that would cause the NYPD or the LAPD or others to say, “maybe they’re pursuing new tactics?” Is this the new normal, as you said? Is this something we need to be concerned about?
For example, it may cause us to do more in terms of truck rentals or anomalies associated with individuals that the Bureau’s already watching that you didn’t think would be the means of attack. Now, suddenly, these means are under consideration based on observable changes that occurred in the latest attack.
TCB: Anything else we should be thinking about?
DS: We must continue to resolve to further strengthening our partnerships while underscoring the importance of ensuring that law enforcement and the elements of national intelligence – that is, our Intelligence Community and the national intelligence capabilities of our friends and allies – are sharing information with each other. We cannot afford to build a wall between law enforcement and intelligence sharing. Making sure that the lash-up between those national intelligence collection and analysis capabilities are enjoined with law enforcement is vital to defeating Islamic terrorism. It’s not an either/or in terms of trying to understand the nature of the threats – and countering those threats at every turn.
