Conventional approaches to unconventional problems: Analyzing terrorism

Military Intelligence Professional Bulletin, Jan-March, 2002 by Del Erin Stewart

Considering the implications of the 11 September 2001 attack on the United States, many changes must occur in how the U.S. Army conducts its counterterrorist operations. New methodologies and tactics, techniques, and procedures (TTP) must emerge if the Army is to address this new threat. Based on experience, the following methodology is one possible interim fix.

The theory is simple: if you know your enemy's capabilities, vulnerabilities, methods, and thought processes, you are more likely to successfully predict when, where, and how he will attack and be able to plan countermeasures. While we used the following methodology experimentally at an analytical cell at a numbered Army level, the tools and techniques discussed below may be useful for other echelons.

When predicting traditional or conventional military threats, the U.S. Army employs analytical methodologies such as intelligence preparation of the battlefield (IPB) and related tools. The terrorist threat, however, is unique in that its nature and survival require it avoid direct engagements with main force units. Terrorists are exceedingly mobile, have mastered the art of blending into the surrounding population, and employ harsh measures to ensure security.

On the other hand, our national collection assets provide so much diverse information that making sense of it all is a daunting task. Reports on terrorist activity originate from all intelligence disciplines, to include open source. The information that surfaces is usually of limited scope, fragmented, and can address anything from financial issues to those focused on training or operations. Currently approved doctrinal symbols do not reflect terrorist operations types of data, nor is there generally a doctrinal method for graphically portraying such activities. The question is, then, how can an analyst take the disparate, seemingly unrelated data points, and move forward toward accurate predictive analysis? One thing is certain: the effort will involve all intelligence disciplines.

We rethought and revisited these methodologies because the commander was very unhappy with detailed, multicolored charted and graphed after-the-fact analysis; he wanted reasonably accurate predictions to help in his decision-making process for recommending countermeasures. First, it is useful to look at existing tools and methodologies for analysis, then additional areas of focus, and recommending countermeasures.

Existing Analytical Methodologies Applied Against Terrorist Operations

The following analytical tool descriptions and examples are from FM 34-60, Counterintelligence, Section VI, Counter-Human Intelligence Analysis, to Appendix A, Counter-Human Intelligence Techniques and Procedures. We modified the wording slightly for ease of use in this forum. This section discusses a chronological record and three analytical techniques.

Time-Event Charting. The time-event chart shown in Figure 1 is a chronological record of individual or group activities designed to store and display large amounts of information in as little space as possible. This tool is easy to prepare, understand, and use. Symbols used in time-event charting are very simple. Analysts use triangles to show the beginning and end of the chart and to show shifts in methods of operation or changes in ideology. Rectangles or diamonds indicate significant events or activities.

Analysts can highlight particularly noteworthy or important events by drawing an "X" through the event symbol (rectangle or diamond). Each of these symbols contains a chronological number (event number), date (day, month, and year of event), and may contain a file reference number. The incident description is a very brief explanation of the incident, and may include the team size, type of incident or activity, place and method of operation, and duration of incident. Arrows indicate time flow.

Analysts also use a variety of symbols, such as parallelograms, pentagons, and others, to depict different types of events and activities. Using these symbols and brief descriptions, an analyst can analyze the group's activities, transitions, trends, and operational patterns. Time-event charts are excellent briefing aids as well as flexible analytical tools.

Association Matrix. The association matrix delineates the existence of relationships between individuals. The part of the problem deserving the most analytical effort is the group itself. Analysts examine the group's elements (members) and their relationships with other members, other groups and associated entities, and related events. Analysts can show the connections between critical players in any event or activity in an association matrix (see Figure 2), which shows associations within a group or similar activity, and is based on the assumption that people involved in a collective activity know one another.

The construction of this type of matrix is in the form of a right triangle, and analysts list personalities in exactly the same order along both the rows and columns to ensure that all possible associations appear correctly. The purpose of the personality matrix is to show who knows whom. Analysts determine a known association by "direct contact" between individuals; a number of factors determine direct contact, including face-to-face meetings, confirmed telephonic conversation between known parties, and all the members of a particular organizational cell.