Transcript Understandig and Conducting Threat Assessments

An Introduction to Understanding and
Conducting Threat Assessments:
A Practical Guide for
Sergeant-At-Arms
Cornerstone of Threat Awareness:
See Something, Say Something, Do Something
2 April 2015: Al-Shabbab attack on Garissa University,
Garissa Town, northestern Kenya
• “High-profile warnings about a threat to a major
university" prior to the attack.
• “Strangers had been spotted in Garissa town and were
suspected to be terrorists"
• The Garissa Teachers Training College in Garissa closed
and sent its students home, but the University remained
open in spite of the warnings
• KDF’s elite paramilitary unit needed seven hours to deploy
to Garissa from their base in Nairobi. Local security forces
were unable to stop the attackers
• 148 killed, 79 wounded
• University layout roughly the same as the National
Assembly campus
Garissa University and
National Assembly Campus layouts
Constant Vigilance can mitigate risk
• Threat Awareness is constant and ongoing
• Threat Awareness and Assessment will deter the
casual threat, but determined attackers may take
months (or even years) to conduct surveillance and
plan attacks
• Case Study: Fort Dix Plot—May 2007
• A store clerk alerted authorities after finding a
video of the group firing weapons and calling for
jihad
• Six men arrested
• The plan involved using assault rifles and grenades
to attack and kill U.S. soldiers
• The arrests were made after a 16-month FBI
operation
Criminal/Terrorist/Threat
Planning Process
The attacker’s planning process includes:
• A broad target selection list to produce the effect desired
• A target analysis and low-level surveillance to assess target awareness and security
• Specific target selection, intelligence collection and high-level surveillance
• Detailed planning, enhanced target analysis and rehearsals
• Pre-attack surveillance, planning adjustments and finalization of operational activity
• Attack, actions on the target and escape
• Exploitation, media attention and analysis of reaction
In several phases of attack planning the threat element requires close in surveillance that
allows expose while they are conducting surveillance
If threat surveillance is detected, the threat loses the element of surprise, good threat
assessment should lead to appropriate counter-measures
Appropriate counter-measures will deter most threat activity before it starts
Threat Cues:
Visual, Auditory, Sensory, Cyber
1. Example Visual Cues:
• Empty Streets – Places usually busy vacant
without explanation
• Crowded Streets that should be empty
• Open doors that should be closed – Closed
doors that should be open
• Anything that looks “out of the ordinary” or
“off”
2. Example Audio Cues:
• Quiet when there should be noise (no prayer
calls, music, vendors hawking, etc.)
• Noise when it should be quiet
3. Example Sensory Cues:
• Wet surfaces without rain
• Powdery residue
4. Example Cyber Cues:
• Unusual cyber network activity
• Social media postings threatening some
action
• Phishing attacks on organization networks,
workstations or mobile devices
Sample Issue from FBI Threat Matrix
Caution:
“Threat Awareness is a judgment call”
People are not suspicious; their behaviors are!
Two factors to assess suspicious behavior or demeanor are:
• How persons are acting
Harder to define, hostile interactions, avoiding contact
• What are persons doing
Loitering, measuring, taking photos, etc.
2 November 2014: Cal State University - San Marcos was stormed by law
enforcement and temporarily placed on lockdown for more than 30 minutes after
reports of a suspicious person armed with a gun on campus.
• An observer mistook a staff member’s umbrella for a gun.
• The staff member was held at gunpoint by sheriff’s deputies during the lockdown.
• The staff member was the person – reported as being suspicious – described as a
white male, wearing a black shirt and jeans and walking across campus carrying a rifle.
• Campus-wide alerts led students to shelter in place and barricade classrooms.
• “They immediately … the doors locked and then they took all the chairs and all the
tables and barricaded the doors,” said junior James Collins. “People were kind of
freaked out and you could tell that there was a nervous tension.”
Practical Exercise
• Brainstorm Session to compile a list of possible threats to the
Legislature that might be encountered by the Sergeant At Arms
Service
•
Examples: Protests, Bombs, Assassination, Terrorist Attack or
Embarrassing Propaganda
Questions
Randell R. Torno, Lt. Col. (Ret) US Army
Principal Officer BeST Technical Solutions, LLC
Dallas, TX USA
[email protected]  +1 214 532 3207