Your SlideShare is downloading. ×
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
12 steps to_id-dt
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

12 steps to_id-dt

428

Published on

The identification process for Domestic Extremists requires considering many indicators. Recently released research indicates examining the mix of behavioral indicators such as personal connections, …

The identification process for Domestic Extremists requires considering many indicators. Recently released research indicates examining the mix of behavioral indicators such as personal connections, ideology, travel, and training may prove beneficial in determining the existence of an individual’s extremist views. The presentation suggests using these indicators not as a checklist but as a type of scale to help analysts determine priorities for research and investigation as resources become available.

Published in: Education
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
428
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
2
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. 9/27/2012 Abstract• The identification process for Domestic Extremists requires considering many indicators. Recently released research indicates examining the mix of behavioral indicators such as personal connections, ideology, travel, and training may prove beneficial in determining the existence of an individual’s extremist views. The presentation suggests using these indicators not as a checklist but as a type of scale to help analysts determine priorities for research and investigation as resources become available. 1
  • 2. 9/27/2012 Why is this being done?• Contacted by friend at Fusion Center –Worked gangs together.• In TN (and other states), used point system for gang investigators to quantify indicators of gang membership. – Could we come up with similar system for domestic terrorists? 2
  • 3. 9/27/2012 • Domestic Terrorists • Militia Extremists • Homegrown Violent • Animal Rights Extremists Extremists • Racist Skinhead • Anti-Abortion Extremists Extremists • Sovereign Citizen • Environmental Rights Extremists Extremists • Supremacist • Anarchist Extremists Extremists (black) • Lone Offender • Supremacist • Facilitators Extremists (white) • Unwitting Co-optees Domestic Terrorism (DHS/FBI)• act of violence –dangerous to life, potentially destructive of critical infrastructure or key resources –committed by group or individual –operating entirely within US without direction or inspiration from foreign terrorist group (unlike homegrown violent extremist). 3
  • 4. 9/27/2012 Important to note (NCTC, 2011): • Wide array of indicators in case studies, coupled with variety of US organizations that appear best placed to detect specific signs, cautions against adopting checklist- like mentality in countering HVE threat. • Simplistically interpreting any single indicator as confirmation of mobilization probably will lead to ineffective and counterproductive efforts to identify and defeat HVEs. Gang points (count to 10)Self Admission (9). Corresponding with GangTattoos (8) members (3)Hand Signs/Symbols/Logos (3) Named Gang member inWearing colors, clothing, correspondence (8)paraphernalia (1) Confirmation by outsidePossessing related docs (3) agency gang unit/database (10)Possessing commercial pubs (1) Gang Crime or activity (8)Participation commercial pubs (8) STG-related discipline (5)Consistent contact with Gang Identified as Gang member by members (2) gang member (8)Contact w/Gang members Identified as Gang member byIn photo with Gang members (2) reliable informant (9)Outside jurisdiction docs (5) 4
  • 5. 9/27/2012 Available Research (DT/HVE)• The DHS Information Sharing Environment (ISE) Suspicious Activity Reporting (SAR) Version 1.5, Functional Standard (FS) 200, May 21, 2009, defines suspicious activity as observed behavior reasonably indicative of pre-operational planning related to terrorism or other criminal activity.• Examples of the criteria for identifying behavior, with defined relationships to criminal activity that also have a potential terrorism nexus, include 5
  • 6. 9/27/2012• Breach/Attempted • Testing or Probing Intrusion Security• Misrepresentation • Recruiting• Theft/Loss/Diversion • Photography• Sabotage/Vandalism/ • Observe/Surveillance Tampering • Materials• Cyber Attack Acquisition/Storage• Expressed or Implied • Acquisition of Expertise Threat • Weapons Discovery• Aviation Activity (used)• Eliciting Information • Sector-Specific Incident These activities are generally FirstAmendment-protected activities . . . absent articulable facts and circumstances . . . behavior observed is not innocent . . . (DHS, 2009).Race, ethnicity, national origin, or religious affiliation should not be considered as factors that create suspicion (although these factors may used as specific suspect descriptions) (DHS, 2009). 6
  • 7. 9/27/2012Keeping that in mind 7
  • 8. 9/27/2012 More Available Research (HVE) In Identifying Homegrown Violent Extremists Before They Strike, the Department of Homeland Security (2010) identified a list of activities that might warrant reporting Homegrown Violent Extremists before they carry out a terrorist act.• New or increased advocacy of violence• New life styles/segregation from normal groups- association with criminal/terrorists.• Adoption of new name.• Surveillance of potential targets.• Acquisition of excessive quantities of weapons or explosive materials.• Travel to or interest in traveling to attend extremist institutions or paramilitary camps.• Reading materials that advocate violence and initiating action in support.• Interest in critical infrastructure and landmarks 8
  • 9. 9/27/2012 Even More Available Research (HVE) In Behavioral Indicators Offer Insights for Spotting Extremists Mobilizing for Violence, the National Counterterrorism Center (NCTC) (2011) reported discovering major mobilizing patterns shared by a majority of HVE cases between 2008 and 2010, identified distinct behaviors often associated with an individual mobilizing for violence. These four patterns included :1) links to known extremists2) ideological commitment to extremism3) international travel4) pursuit of weapons and associated training. 9
  • 10. 9/27/2012 Of 70 behaviors associated with HVE mobilization, 16 appeared most (at least 50%) of the time• Communicating/Links to Extremists• Possessing/sharing Jihadist videos or propaganda• Seeking religious instruction• Suspicious foreign travel (destination-based)• Acceptance/approval/intent to conduct violent jihad or martyrdom ops• Weapons/paramilitary training, acquiring gear, recon, surveillance• Expressed perception of threat against individual or Islam• Effort to obtain weapons, materials, chemicals• Acknowledge/implied membership or association with radical groups• Use of cover terms to mask meaning of events or other illicit activities• Attempted/desired foreign travel• Research targets, technical capabilities, planning, logistics• Suspicious travel patterns – one way, lost passports, using agencies of interest• Isolation/ruptured family relationship• Active engagement in online, password protected websites.• Active leadership or participation in secret group meetings.Let‘s combine the indicators . . . 10
  • 11. 9/27/2012 There are three areas • Foundation • Preparation/Intelligence Gathering • Commission of Crime/Terrorist Activity How’s that work?Imagine you are investigating activity after the fact.• Foundation – not likely to be prosecutable – may be protected by Constitution.• Preparation & Intelligence – could be the overt act in conspiracy, where two or more agree to commit crime and one does something (overt act) in furtherance of the crime.• Commission of Crime/Terrorist Activity – activity likely charged alone in most jurisdictions. 11
  • 12. 9/27/2012 Foundation1. Discarding Old Associations: New life styles, isolation, segregation, ruptured relationships, (DHS, 2010; NCTC, 2011)2. Making New Associations: – Connection to Criminals, Extremists , Terrorists (DHS, 2010; NCTC, 2011) – Using online, password protected websites (NCTC, 2011) – Use of cover terms to mask meaning of events or other illicit activities (NCTC, 2011)3. Adopting New Beliefs: – New or increased advocacy of violence (DHS, 2010) – Seeking religion, including extremist, instruction, possessing videos or propaganda, perception of threat against beliefs , association with radical groups (NCTC, 2011) – Participating in secret group meetings (NCTC, 2011) Preparation and Intelligence Gathering1. Acquiring New Identification: Adoption of new name (DHS, 2010)2. Developing New Skills: – Reading materials that advocate violence and acting (DHS, 2010) – Acquiring Expertise (DHS, 2009)3. Obtaining Tools and Conducting Research: – Acquiring weapons, gear, materials, chemicals, paramilitary training; recon, surveillance (NCTC, 2011, DHS, 2010) – Observe/Surveillance Photography (DHS, 2009; DHS, 2010) – Attempted Intrusion, Probing ,Expressed or Implied Threat (DHS, 2009) – Research targets (e.g. landmarks, infrastructure), tech capabilities, planning, logistics (NCTC, 2011; DHS, 2010) – Eliciting Information (DHS, 2009) – Suspicious Aviation Activity (DHS, 2009)4. Traveling: – Travel to or interest in traveling to attend extremist institutions or paramilitary camps (DHS, 2010) – Attempted/desired/completed suspicious foreign travel (NCTC, 2011) – Suspicious travel patterns (NCTC, 2011).5. Recruiting (DHS, 2009) 12
  • 13. 9/27/2012Commission of Crime/Terrorist Activity1.Misrepresentation (DHS, 2009)2.Theft/Loss/Diversion (DHS, 2009)3.Sabotage/Vandalism/ Tampering (DHS, 2009)4.Cyber Attack (DHS, 2009)5.Sector (e.g. Public Health, Police) Specific/Unique Incident (DHS, 2009) SimplifiedFoundation 5. Recruiting1. Discard Old Assoc Crime/Terrorist2. New Assoc Activity3. New Beliefs 1.MisrepresentationPreparation & 2.Theft/Loss/Diversion Intelligence 3.Sabotage/Vandalism/ Tampering1. New ID 4.Cyber Attack2. New Skills 5.Sector-Specific3. Tools & Research Incidents4. Travel 13
  • 14. 9/27/2012 Consider agency-specific needs and desires Make steps: 13. 12. 11. 10. 9. 8. 7. 6. 5. 4. 3. 2.1. 14
  • 15. 9/27/2012• Collection process can take each step into account, perhaps equally weighted.• With 13 indicators, anything above 8 is definitely actionable, most above 4 are.• If indicators climbing and resources available, organization, agency, etc. can choose to devote time to cultivate more intelligence or determine strategy.• If prioritization needed due to heavy workload, the scoring system could easily provide the way. Goal is combining objectivity & subjectivity while leaving room for reality 15
  • 16. 9/27/2012 Next Steps• Review, revise, refine• Examine past decade DT offenders and indicators• Consider weighting indicators• _______________• _______________• _______________ Follow up? 16
  • 17. 9/27/2012 ReferencesDepartment of Homeland Security. (2010) Identifying Homegrown Violent Extremists Before They Strike: An Information Needs Review. Author. Retrieved from http://www.scribd.com/doc/37873835/DHSHomegrownThre atsDepartment of Homeland Security. (2009). Information Sharing Environment (ISE) Suspicious Activity Reporting (SAR) Version 1.5, Functional Standard (FS) 200. Author. Retrieved from http://www.dhs.gov/xlibrary/assets/privacy/privacy-pia- dhswide-sar-ise-appendix.pdfNational Counterterrorism Center. (2011). Behavioral Indicators Offer Insights for Spotting Extremists Mobilizing for Violence. Author. Retrieved from http://publicintelligence.net/ufouo- national-counterterrorism-center-mobilizing-homegrown- violent-extremists-hves-behavioral-indicators What fit where? • Foundation – F • Preparation/intelligence Gathering - P • Commit Crime/Terrorist Act - C 17
  • 18. 9/27/2012 DHS 2009• Breach/Attempted Security P3 Intrusion P3 • Recruiting P5• Misrepresentation C1 • Photography P3• Theft/Loss/Diversion C2 • Observe/Surveillance P3• Sabotage/Vandalism/ • Materials Tampering C3 Acquisition/Storage P3• Cyber Attack C4 • Acquisition of Expertise• Expressed or Implied P2 Threat P2 • Weapons Discovery• Aviation Activity P3 (used) P3• Eliciting Information P3 • Sector-Specific Incident• Testing or Probing C5 DHS 2010 • New or increased advocacy of violence F3 • New life styles/segregation from normal groups- association with criminal/terrorists F1 • Adoption of new name P1 • Surveillance of potential targets P3 • Acquisition of excessive quantities of weapons or explosive materials P3 • Travel to or interest in traveling to attend extremist institutions or paramilitary camps P4 • Reading materials that advocate violence and initiating action in support P2 • Interest in critical infrastructure and landmarks P3 18
  • 19. 9/27/2012 NCTC 2011• Communicating/Links to Extremists F2• Possessing/sharing Jihadist videos or propaganda F3• Seeking religious instruction F3• Suspicious foreign travel (destination-based) P4• Acceptance/approval/intent to conduct violent jihad or martyrdom ops F3• Weapons/paramilitary training, acquiring gear, recon, surveillance• Expressed perception of threat against individual or Islam P3• Effort to obtain weapons, materials, chemicals P3• Acknowledge/implied membership or association with radical groups F3• Use of cover terms to mask meaning of events or other illicit activities F2• Attempted/desired foreign travel P4• Research targets, technical capabilities, planning, logistics P3• Suspicious travel patterns – one way, lost passports, using agencies of interest P4• Isolation/ruptured family relationship F1• Active engagement in online, password protected websites F2• Active leadership or participation in secret group meetings F3 19

×