Security Debrief

The fingers are pointing thick and fast about the intelligence failures that allowed Abdulmultallab to board a plane to the US, equipped to attempt to bring down a plane onto the city. However, there has been a complete paucity of commentary about the device that was used; a device that was designed to pass current airport security measures. While we absolutely must examine the systemic failures that missed the terrorist and enabled him to board a US-bound aircraft — including the activities in isolation at both airports — we should also be examining exactly how this type of device wasn’t predicted and counter-measures developed.

A fundamental characteristic of counter-insurgency and counter-terrorist operations is that one side will develop tactics and equipment, for example terrorist bombs or security forces forensic measures, and the other side will develop counter-measures to protect themselves and new measures to overcome the counter-measures. Al-Qaeda and extreme Islam is not a centrally controlled movement; given the right inspiration and training, a devout believer could be motivated to construct and operate his own device, acting in complete independence of the local command. Although the risk of this is low, the impact is certainly very high; how much effort does it really take a chemical engineering major to construct an incendiary device that requires no actual explosives.

The protective measures for airports and aircraft are open to a reasonable level of interpretation. Initially Al-Qaeda opted for box-cutters and taking over airplanes to use them as flying bombs, a tactic that was wholly successful. However, rather than attempt to reprise an old tactic that would fail, the next time they attempted a major, coordinated strike at airlines they opted for suicide bombers, using a dynamic fluid mix mid-air. This tactic failed, because the cell was compromised. Interspersed among the ‘spectaculars’ are the isolated attempts; for instance Richard Reid’s shoe bomb or the recent events in Denver.

With airport defensive tactics focused on old tactics, it was reasonable to assume, as many have, that the attempt to destroy aircraft would not reprise an old method. The question that remains to be asked, let alone answered, is just how developed the US, UK and other at-risk countries’ technical red-teaming has become. Clearly L3 and other companies have been creating search technologies; clearly the technologies in both Nigeria and Amsterdam failed.

They failed because the processes — as opposed to the technology — was not predicted, nor searched for. One has to wonder what the real purpose of Richard Reid’s attack was. Given the Al-Qaeda predilection for spectaculars, is it possible that Richard Reid’s attempt was more about testing the infiltration of security than an effective bomb — if his unlikely attempt worked, so much the better. Certainly if I were an intelligence officer I would be delving more deeply into the relationship between individual based attacks and spectaculars.

Of course, timely reporting and response is essential. It appears that the Somalis arrested someone boarding a domestic flight who was equipped similarly to Abdulmultallab; how much of this was known around the intelligence community remains to be seen. Details are sparse, but could it be that a reliance on an integrated approach between personal and technological factors was applied, and proved to result in Somali success and US failure?

A response has to be integrated across, and considerate of, culture, personnel, equipment, politics, media and other factors. “See something, say something” is an essential component of this. Basic indicators like a single male unduly focused or withdrawn without anything but carry-on luggage, should attract notice. The ‘process’ classification has to be robustly used where necessary, not only in the US but for all passengers on all vulnerable airlines.

It’s easy to Monday morning quarterback — the real test is having the moral courage to perceive a threat and to comment about it, no matter whether you’re a TSA agent, a passenger or a co-worker; the perception by classmates of the Fort Hood shooter that they’d be judged negatively for reporting the conduct of a Muslim suggests that political correctness has overtaken common sense, as it has in far too many organizations. Profiling is important; disregarding it simply because of political correctness is folly.

Counter-terrorism, like everything else, is about a systems approach, based in seeing the world as it really is, not as we would wish it to be. It is not simply the people we must protect against, nor the equipment. It is the combination, and only by attacking along each of those axes can we deliver an effective protective regime.