table of contents - globsec · globsec intelligence reform initiative we recognise that while the...

Table of ContentsAbbreviations 4Executive Summary 51. Introduction 6 1.1. Terminology 72. The Evolving Jihadist Threat 9 2.1. The Paris Attacks 10 2.2. The Brussels Attacks 11 2.3. Common Denominators 14 2.4. Time to Adapt 153. Current Intelligence and Law Enforcement Architecture 16 3.1. European Intelligence Architecture 16 3.2. European Law Enforcement Architecture 174. CT Intelligence and Law Enforcement Issues 20 4.1. Trust in Transatlantic Intelligence and Law Enforcement Liaison 20 4.2. Domestic Inter-Agency Trust 21 4.3. Operationalisation 22 4.3.1. Capacity 22 4.3.2. Privacy and Digital Tools 23 4.3.3. Speed 24 4.3.4. Political Will and Decision Making 24 4.3.5. The Politics of CT Intelligence Reform 25 4.3.6.TransnationalThreatandRiskAssessmentDeficit 255. Recommended Reforms 26 5.1. Existing Models 26 5.2. Recommendation 1: CORE TRANSATLANTIC CT HUB AND TASK FORCES 28 5.2.1. Core Transatlantic CT Hub 28 5.2.2. Case-Based Task Forces 29 5.3. Recommendation 2: SINGLE SEARCH INTERFACES 29 5.4. Recommendation 3: TRANSATLANTIC CT CENTRE OF EXCELLENCE 306. Conclusion 32

3

GLOBSEC Intelligence Reform Initiative

Abbreviations

AQAP Al-Qa’ida in the Arabian PeninsulaCdB Club de BerneCEPOL EU Agency for Law Enforcement TrainingCoE CT Centre of ExcellenceCT Counter-TerrorismCTF Counter-Terrorism Fusion CentreCTG Counter-Terrorism GroupCTIC Western Counterterrorist Intelligence CentreDGSI Direction Générale de la Sécurité IntérieureECTC European Counter Terrorism CentreEEAS European External Action Service EU INTCEN EU Intelligence Analysis Centre FIU Financial Intelligence Unit GIRI GLOBSEC Intelligence Reform InitiativeHUMINT Human IntelligenceISIL Islamic State in Iraq and the LevantJIC Joint Intelligence CommitteeJTAC United Kingdom’s Joint Terrorism Analysis CentreLinCT Leadership in Counter TerrorismMS Member StatesPNR Passenger Name RecordSATCEN EU Satellite CentreSIENA Secure Information Exchange Network ApplicationSIGINT Signals IntelligenceSMART Scotland’s Strategic Multi-Agency Response TeamSTRA Strategic Threat and Risk AssessmentTEU Treaty on the European Union TFTP EU-US Terrorist Finance Tracking ProgrammeTFEU Treaty on the Functioning of the European Union

4


Executive SummaryThisreport’sprimaryfocusistheSalafijihadistterroristthreat.Since2014,therehasbeenasignificantincrease inattacksby thesegroupsand, inEuropealone,at least274civilianshavebeenkilledandover960wounded.Buildingontheexperienceofforeignfighters,terroristtacticsareevolvingrapidlytoblendsmall,overlappingandinformalnetworksofextremistscapableofconductingbothsophisticated and crude attacks. These groups retain the intent and capability to cause further harm.

These attacks have revealed major seams in some nations’ law enforcement and intelligencecapacities and capabilities, and highlighted failures in both domestic and transnational counter-terrorismliaison.Betterliaisonisnotonlypossible,butalsoapoliticalresponsibility.Itistimetoadaptand address existing barriers to better law enforcement and intelligence integration and transnational liaison.Theseincludeissuesoftrust,standardisation,legislation,counter-terrorismapproachesandculture. These must be addressed incrementally through existing best practises and models.

The key problem the Globsec Intelligence Reform Initiative (GIRI) addresses is that of intelligence and personal data sharing and its operationalisation at the domestic as well as transnational level. Altoughmanyintelligenceagencieshavebeenatthecentreofcounter-terrorismeffortssince9/11,this report recognises that as terrorism is fundamentally viewed as a crime in both Europe and North America, lawenforcement is increasingly at the centre of better pan-Europeanand transatlanticcounter-terrorismcooperation.Crucially,betterfusionofintelligenceprocesses,andintelligenceandlawenforcementagencies,isneededtoprovidethemeansforpre-emptingterroristattacksbeforetheyoccur,ratherthanrelyingoneffectiveinvestigationaftertheevent.

The GIRI report is based on extensive interviews and consultations with GIRI’s network of serving andformercounter-terrorismofficialsandacademicsfromEuropeandNorthAmerica.Ourapproachis not to recommend new top-down institutions or bureaucracies. Rather it is to build capacities and capabilities to address existing problems by implementing best practises already utilised by somenations,throughexistinginstitutionsandinnovativetechnologies.Italsoarguesforbetterjointtraining to encourage standardisation.

Basedonexistingmodels,thereportintroducesfour,bottom-uppracticalsolutionstotheselargelyoperationalandtacticalCTchallenges.ItsfirstproposalcallsfortheestablishmentofapermanentCore Transatlantic Counter-Terrorism Hub, which would mark an initial step toward providing asecure space for linking existing national CT centres with high degrees of mutual trust. The success ofthiscorehub,wouldencouragelesscapableand/orwillingnationstoimprovetheirservicesinorderto join.Experiencehasshownthatco-locationleadstocollaboration,andthroughstrategiccoordination,canleadtointegratedapproachesbuiltonasolidfoundationoftrustenabledthroughenhancedsocialrelations.Secondly,thereportadvocatesforoperationalCase-BasedTaskForcestobesetupwithintheHub,designedtoreacttocurrent,emergingandresidualCTchallenges.Suchtask forceswouldpromoteproactive, intelligence-ledoperations through the fusionofenhanced,assessed intelligence/personaldata.Thirdly, thereportadvocatesforasinglesearch interfacetoenable real time information exchange. This so-called “hit-no-hit” single search interface would enable eachnation to hold and control its data, but encrypted searcheswould help identify informationorpatternsforfollow-up,enablingmemberstatestobebetterequippedtoprotectthesafetyandsecurity of their citizens. No longer should the word secret be an inhibitor to good and effective information exchange. GIRI’s fourth recommendation is to establish a transatlantic CT Centre of Excellence,whichwouldenablejointriskassessments,standardisationandtraining.Itwouldalsocreateamuch-neededbridgebetweenintelligenceandlawenforcementprofessionalsonCTissues,and promote the social relations upon which trust rests.

5


Anewtransatlanticsecurityarchitectureisneeded.SalafijihadistterroristattacksinFrance,Belgium,GermanyandDenmark,aswellas in theUnitedStates,haveexposedmajor loopholes insomenations’ security architecture and highlighted that counter-terrorism co-operation needs to be better integrated at the transnational level to address the 21stcenturythreat.Morespecifically,theyhavehighlightedapressingneedtoraisesomenations’intelligenceandlawenforcementcapabilities,andbetterintegratethesecapabilitiestostopsmall,informaloverlappingnetworksofviolentextremistsfrom conducting both sophisticated and crude terrorist attacks. This evolving nature of transnational terrorismnecessitatesajointtransatlanticapproachandupdatedsecuritystrategiesthatreston21st centurymeans,technologyandalliances.

Clearly,manyoftheproblemsbehindtherisingthreatfromjihadistterrorisminEuropeandNorthAmericaarerelatedtomacrofactorsbeyondthescopeofthisreport,suchasissuesconcerningEUimmigration,socialexclusion,andunrestinIraq,SyriaandLibya,someofwhich,itshouldberecognised,mayhavebeenexacerbatedbythepastpoliciesofsomeWesternnations.However,inthewakeoftheBrusselsattacks,publiccriticismofcounter-terrorismfailureshasreachedanewpitch, increasingpoliticalpressure for the reformofEuropeanand transatlanticcounter-terrorismcooperation.

The GLOBSEC Intelligence Reform Initiative (GIRI) is a pan-European and North American network ofservingandformercounter-terrorismofficialsandacademicswhorecognisetheneedforchangein the transatlantic security architecture. At the heart of the GIRI Initiative lies this report. Based on extensiveconsultationsandinterviewswithformerpractitionersandexpertsintheintelligence,lawenforcement,defence,andhomeaffairssectorsacrossEuropeand theUS, this report identifieskey tactical and operational counter-terrorism issues within intelligence and law enforcement. It then proposes practical solutions to these issues based on pre-existing “best practice”.

GIRI’s primary focus is on the growing internal security threat across the European and North American continents. The key problem this report addresses is that of intelligence and personal data sharing and its operationalisation at the domestic as well as transnational level. Altough many intelligence agencieshavebeenatthecentreofcounter-terrorismeffortssince9/11,thisreportrecognisesthatasterrorismisfundamentallyviewedasacrimeinbothEuropeandNorthAmerica,lawenforcementis increasinglyat thecentreofbetter transatlanticcounter-terrorismcooperation.Crucially,betterintegration of both intelligence and law enforcement agencies is needed to provide the means for pre-emptingterroristattacksbeforetheyoccur,ratherthanrelyingoneffectiveinvestigationaftertheevent.Thesharingofintelligenceprovidesaricherpictureintermsofwhatiscollectivelyknown,andthereforeallowsthe“collective”tofocusonwhatitdoesnotknow,directingsensitivesourcestofillthose“gaps”.Thishelpsdelivergreaterconfidenceinthecollectiveunderstandingofthethreatandidentify the strategies needed to manage and mitigate these threats before they manifest themselves and threaten the very fabric of our communities.

Our approach is not to recommend new top-down institutions or bureaucracies. Rather it is to build capacities and capabilities to address existing problems by implementing best practises already utilisedinsomenations,throughexistinginstitutionsandinnovativetechnologies.Thereportarguesthatweneedbothadhoc,threat-focusednetworks,whichinitiallyengageacorenumberofnationsinordertograduallyencouragewidercooperation,aswellasbroadersearchsystems,toenablebetter counter-terrorism information and intelligence sharing. It also argues for better training to encourage standardisation and trust.

1. Introduction

6


We recognise that while the EU must play a role, CT intelligence and law enforcement reform cannot be solely an EU project. Not only are threats transatlantic, but especially after Brexit, some of the key European players in security will be outside the Union, as is the US. Even within the EU, according to the Lisbon treaty, national security is the sole responsibility of member states (MS). More Article 4 (2) of the Treaty on the European Union (TEU) stipulates that national security remains the sole competence of MS, preserving the prerogative for national security to be under exclusive national (and not EU) control. However, information exchange between all relevant security stakeholders at EU level, including the security intelligence community and law enforcement authorities, is possible under Article 67 (3) of the Treaty on the Functioning of the European Union (TFEU) which sets out that the Union shall endeavour to ensure a high level of security through measures for “coordination” and “cooperation” between police, judicial and other competent authorities. These competent authorities can be understood to include security and intelligence services. Thus, while the EU does have a prerogative to improve CT information exchange between MS, the responsibility for capacity building and liaison primarily rest with MS and their ability to network and build trust.

Our focus on jihadist terrorism is by the fact that it has been the most lethal form of terrorism in Europe and North America since 2014. We also contend that many of our proposed solutions are applicable to other forms of terrorism and, potentially, the rising cyber threat. Nevertheless, we recognise that addressing the root causes of terrorism, as well as containing it beyond European and American borders, are fundamental to solving this complex global security threat.

It should be noted from the outset that drawing on experiences from numerous nations, and respectful of the different politics, legal foundations and cultures across the transatlantic space and within Europe, GIRI has endeavoured to present unpartisan and inclusive practical solutions through which all nations concerned could While we recognise that some of our proposals would require legislative changes in certain nations, we argue that the changing nature of terrorism will eventually force these changes on these nations anyway.

1.1. TerminologyAs this paper argues, effective transatlantic counter-terrorism (CT) is increasingly reliant on the integration of intelligence, security and law enforcement agencies, and on the fusion of the “intelligence” and “personal data” that these agencies primarily deal with. The main purpose of intelligence is the accumulation of political, strategic, operational and tactical advantage over adversaries.1 Intelligence therefore helps decrease uncertainty to enhance decision making. Throughout the paper, the term “intelligence and security agencies” or services refers to nations’ internal and external organisations that collect, analyse, share and operationalise sensitive information often gathered by covert means. These range from purely intelligence collectors to those that have a domestic responsibility to protect their nation from threats. “Law enforcement” agencies refers to national-level, local and/or specialised police and border control forces.

It is also important to distinguish between information sharing and liaison between law enforcement and intelligence services. Both are sensitive but in different ways. “Personal data” sharing refers to that often conducted by law enforcement and includes information such as databases of: passports, criminal records, vehicle registrations, DNA, advance passenger movements, and credit card and bank details which ought to be accessible by investigators with the right legal authority. As the section below outlining recent attacks highlights, there is scope for major improvement here before the sharing of intelligence is better integrated. “Intelligence liaison” refers to establishing capacity

1 Hatlebrekke K.A. (2011), Towards a Theory of Intelligence: The Art of Knowing beyond the Limits of Formal Logic, Why Intelligence is Art and its Impact on The Problem of Induction and Discourse Failure, Doctoral Thesis of Philosophy in War Studies, Department of War Studies, King´s College, London, p. 275.

7


andrulesamong transatlanticallies toenable thesharingofsecret informationassessments,aswellasselectedrawintelligence,oftencollectedbycovertorsensitivemeans.Importantly,asthisreportshows,lawenforcementagenciesinvolvedintheinvestigationofseriousandcomplexcrimesincludingterrorismalsoincreasinglyrelyoncovertand/or“intelligencetechniques”,sothedistinctionbetween the two communities can be blurred.

“Liaison”,alsoreferredtohereas“sharing”,isusedinatwofoldway.First,domesticliaisonrefersto cooperation between intelligence and law enforcement agencies within a particular nation. Transnationalliaisonisthatbetweenintelligenceorlawenforcementagenciesfrommultiplenations,either conducted bilaterally ormultilaterally.To date,multilateral transnational liaison in the fieldof law enforcement has most prominently been developed within Europol and Interpol. In terms of intelligence,aprimeexampleof long-standingtransnational intelligenceliaisonisthe“FiveEyes”system,comprisingofAustralia,Canada,NewZealand,theUnitedKingdomandtheUnitedStates.WithintheEuropeanCTcontext,theClubdeBerne’s(CdB)Counter-TerrorismGroup(CTG)isalsoof increasing prominence.

8


TheSalafijihadistterroristthreatinsideEuropehasneverbeenmorepressing.Whilewerecognisethatseparatistandtransnationalterrorismwasmorelethalinsomeyearsofthe1970sand1980s,andthatthethreatfromal-Qa’idaendures,since2014therehasbeenasignificantincreaseinattacksby individuals and groups linked to Islamic State in Iraq and the Levant (ISIL) across the Continent. Between May 2014 and August 2016 at least 21 serious ISIL-related attacks have occurred inside theEU,killing274andwounding968citizens,217ofwhomwerecriticallyinjured.Thelethalityoftheseattackshasdemonstrated ISIL’sclear intent to targetEurope,while the terrorists’evolvingcapabilitieshavealsohighlighted failingsamongEuropeannations’ intelligence,securityand lawenforcementservices.Duringthesameperiod,themostlethalterroristattackintheUSsince9/11wasconductedbyanISILsympathiser,whilemajorattacksinTunisia,onaRussianairliner,andinTurkeyindicatethetransnationalnatureofthejihadistthreat.Violentjihadistattackshaveincludedthose directed or planned by ISIL as well as those inspired by ISIL propaganda. The latter are sometimesreferredtoas“loneactors”,butrarelyactwithoutthesupportofothers.Understandingthe nature of these attacks is crucial for assessing this evolving terrorist threat and the challenge itposestotransatlanticsecurity.Belowwepresentthefirstopen-sourcecomprehensive,collectiveanalysis of recent attacks. Those familiar with the evolution of terrorist attacks since 2014 may wish to skip to Section 2.3.

SinceEurope’sfirstISIL-relatedattackinMay2014,whenalonegunman,MehdiNemmouche,shotdeadfourpeopleinaJewishmuseuminBrussels,therehavebeenatleasttenother“loneactor”attacksontheContinentandintheUS.AFrench/Algeriancitizen,NemmouchehadfoughtforISILinSyria,andtheattackwasthefirstincidentofaEuropeanjihadistcommittinganactofterrorismafter returning fromSyria.Although viewedasa loneactor attack,Nemmouchehad likely beeninstructedtoattackEuropewhilstinSyria.Thenextincidentoccurredon20December2014,whenaFrenchmanofBurundianorigin,BertrandNzohabonayo,enteredapolicestationnearToursinFranceandattackedofficerswithaknife,injuringthreebeforehewasshotdead.Priortotheattack,Nzohabonayo had been reported to French security services and had links to ISIL.2 In the following days,anothertwoattacksoccurredinDijon(11injured)andNantes(1killed,10injured)involvingtherunning-overofpedestriansbymeninvehicles,allegedlyshoutingIslamistphrasesduringtheincident.Oneoftheattackerswaspreviouslyknowntopolice,butbothmenhadpsychiatricissues,and their links with terrorist groups were disputed.3However,itisworthnotingthatISILpropagandaatthistimehadbeenencouragingloneactorattacksofthissort,andsimilartacticshavesincebeenused to great effect.

On7January2015brothersCherifandSaidKouachi–armedwithassault rifles–attacked theofficesoftheCharlieHebdomagazine,killingtwopolicemen,tenciviliansandwoundingafurther11beforefleeingParis.Thefollowingday,apolicewomanwasshotdeadandapasser-bywoundedinaParisiansuburbbyanotherjihadist,AmedyCoulibaly.CoulibalyhadpledgedallegiancetoISILandwasincontactwiththeKouachisduringtheattacks.Indeed,whentheKouachiswerekilledafterabriefhostagesituationinafactorynorthofParison9January,amajorstandoffwithmorehostagestook place between Coulibaly and the security forces in a Parisian supermarket. By the time French special forces entered the supermarket and killedCoulibaly, fourmore civilianswere killed andanother11wounded.Thisbroughtthetotalto15deadand23injuredinwhatbecameknownasthe“Charlie Hebdo” attacks.

Theattacksweresignificantforanumberofreasons.Firstly,theattackersusedfirearmsboughtfromcriminalnetworks, rather thansmuggled fromwarzones.Secondly, thecoordinatedanddynamicassaults on numerous soft targets severely tested the French security forces’ ability to respond

2“Frenchanti-terrordepartmentinvestigatesknifeattackinNice”,Euronews,4February2015,retrieved17November2015. 3 “Franceenduresdeadlyattacks”,Reuters,22December2014,retrieved17November2015.

2. The Evolving Jihadist Threat

9


rapidly,whilethewillingnessoftheattackerstosacrificethemselvesmeantthatcounterterrorforceswouldthereforeneedtointervenemorerapidlyandrobustlyinfuture.Meanwhile,itemergedthattheKouachisandCoulibalykneweachother,hadbeenradicalisedinFrance,andthattheiractionshadlikelybeencoordinatedbyanotherjihadist.CherifKouachiwasaknownjihadistwhohadbeenimprisonedinFranceonterrorismchargesin2008,andtheKouachishadtravelledtoYemenin2011wheretheyreceivedtrainingandfundingfromal-Qa’idaintheArabianPeninsula(AQAP).Indeed,inthe wake of the attacks it also emerged that the US provided the French authorities with intelligence ontheKouachis’activitiesinYemen.AlthoughtheFrenchbeganmonitoringthem,thiswasstoppedin spring 2014,most likely for resourcing reasons.Thus, theHebdo attacks also represented afailuretodirectandprioritisetargets,andhenceanintelligenceandoperationalfailure.

TheHebdoattackswerefollowedbynumerous,smaller-scaleincidentsacrossEurope,indicatingthat ISIL was supplementing lone actor attacks with larger assaults conducted by cells with supporting networks.On15January2015inVerviers,easternBelgium,twojihadistswerekilledandanotherarrestedduringaCTraidagainstagroupsuspectedofplanninga“major”attackonBelgianpolice.Thesuspects,allBelgiannationalsofArabicdescent,openedfirewhenspecialforcesclosedinonthem.AccordingtoBelgianmedia,theyhadrecentlyreturnedfromSyriaandwereinthefinalstagesofaplantoattackapolicestationandpubliclybeheadanofficer.4Meanwhile,over14-15February,a radicalised Danish citizen of Arab descent conducted a series of shootings in Copenhagen which killed two civilians and left five police officerswoundedbefore the gunmanwas shot dead.Theattackerhadbeenknowntothepolicepreviously,andDanishintelligencewereawarehehadbeenradicalisedinprison.Fourmen,whohelpedtheattackerprocureweaponsbeforetheattack,andgave him ammunition and a change of clothes during the attacks, were chargedwith terrorismoffences in January 2016.5

On26June2015,twoISIL-inspiredattackersdecapitatedonepersonandblewupagascanisterinafactoryinSaint-Quentin-Fallavier,nearLyon,France.Onepersonwaskilledandtwelvewereinjured,aswellastheassailants.Then,on21August2015,ashootingandstabbingincidenttookplace on board a Thalys train in France on its way from Amsterdam to Paris. Three people were injured beforeAyoub el-Khazzani, fromMorocco, was arrested for the attack. El-Khazzani wasapparentlyknowntoFrenchauthoritiesandhadbeentaggedwitha“ficheS”(securityfile),inordertomonitorhim.HehadbeensimilarlyprofiledbyBelgian,Spanish,andGermanauthorities.UponleavingSpainforFrancein2014,theSpanishauthoritiesinformedtheFrenchoftheirsuspicions.El-KhazzanialsospenttwomonthsinSyriain2015.Meanwhile,inBerlin,on17September2015,an Iraqi extremist was shot dead after he stabbed a policewoman in the neck.6

2.1. The Paris AttacksThe largest-scale terrorist attack in the EU since the 2004 Madrid bombings occurred on the evening of13November2015 inParis,whennumerous ISIL-inspired terroristcellsattackedmultiplesofttargetsinthecentreandnorth-westerndistrictsofthecity.Threeseparateteams,madeupofthreemen each, near-simultaneously attacked the Stade de France, Parisien cafés and restaurants,andtheBataclanTheatre,usingsuicidevestsandassault rifles.Theattackers,whowere ledbyISILfighterAbdelhamidAbaoud,killed130peopleintotal,including89attheBataclanwheretheytookhostagesbeforeengaginginastand-offwiththepolice.Another368peoplewereinjured,99

4 “Belgiananti-terrorraidinVerviersleavestwodead”,BBC,16January2015,http://www.bbc.co.uk/news/world-europe-30840160,retrieved 10 April 2016. 5 “CopenhagenAttacks:DanishPoliceChargeTwoMen”,The Guardian,16February2015,http://www.theguardian.com/world/2015/feb/16/copenhagen-attacks-danish-police-charge-two-men,retrieved10April2016. 6“IslamicextremistshotdeadinBerlinafterstabbingpoliceofficer”,The Independent,17September2015http://www.independent.co.uk/news/world/europe/berlin-terrorist-attack-police-stabbed-islamic-extremist-10506370.html,retrieved10April 2016.

10


seriously. Seven of the 11 assailants died in the assault – for which ISIL claimed responsibility – many by detonating suicide vests.

Theattackswerenotablefortheircomplexity,co-ordination,andbrutality,includingtacticsdevelopedtomitigatetheresponseofCTteams.Forexample,FrenchcourtdocumentsrevealedthatintheBataclansiegewell-trainedgunmenwerepositionedtokillfleeingciviliansanddefendthebuildingfrom French CT teams. The assailants used disposable mobile phones and those taken from their victims to communicate, and also used encrypted computers and simple written notes to sendmessages to avoid detection before and during the attacks. The successful use of suicide vests containing the highly unstable TATP explosive made from over-the-counter items also indicated a marked increase in bomb-making capability. The co-ordinated assaults were conducted by at least 11menofArabdescent,someofwhomhadfoughtinSyria,wheretheygainedconsiderabletacticalexperience.Assuch, theParisattacksmarkeda significantescalation in thecapabilities, intent,and attack methodology of ISIL-related terrorist cells in Europe.7 Indeed,Michael Leiter, formerdirectorof theUnitedStates’NationalCounterterrorismCenter, said theattacksdemonstratedasophisticationnotseeninacityattacksincethe2008Mumbaiattacks,andwouldchangehowtheWest regards the threat.8

TheParisattacksalsorevealedstronglinksbetweenjihadistsinBelgiumandSyria.Abaoud,whohadescapedtoSyriaafterbeingimplicatedintheThalysattack,waskilledinastand-offwithpoliceinParison18November.Theleaderofthecells,aswellasthemainplanner,Abaoudhadbeenresponsible for recruiting the Paris attack teams, including the Abdeslam brothers. Indeed, asinvestigationsproceeded, the linkbetween theattacksand theMollenbeekdistrictofBrussels–fromwhichtheAbdeslamsandotherattackershailed–grew,withevidenceemergingthatweaponsbought in Brussels had been transported into Paris and that Salah Abdesalam had also been waved through a Belgian police checkpoint hours after the Paris attacks. He also evaded arrest until 18 March2016withthehelpofsomemembersoftheMollenbeekcommunity,highlightingtheBelgianpolice’s lackofsourcesamongthecommunity.Moreover,Salahhadcriminal linksandhadbeenquicklyradicalised,traitsthatweretobecomeincreasinglycommoninfutureattacks.

2.2. The Brussels AttacksInthewakeoftheParisattackstherewerenumerousothersecurityscares,butonthemorningof22March 2016 – likely prompted by the arrest of Salah Abdeslam in Mollenbeek four days previously –threecoordinatedsuicidebombandgunattacksoccurredinBelgium:twoatBrusselsZaventumAirport,andoneatMaalbeekmetrostationincentralBrussels.Thirtytwovictimsandthreesuicidebomberswerekilledintheattacks,while316peoplewereinjured,62critically.ISILagainclaimedresponsibility.TwoBelgian-Moroccanbrothers, theEl-Bakraouis,andanotherMoroccanattacker,Najim Laachraoui, detonated suicide vests. The El-Bakrouis were serious Mollenbeek-basedcriminalswell-knowntoBelgianpolice.Khalidwasalsothesubjectofaninternationalarrestwarrantinrelationtoterrorism,whileLaachraouihadpreviouslytravelledtoSyriaandissuspectedofbeingthebombmakerfortheParisandBrusselsattacks.Anotherattackerisontherun,supplyingfurtherevidence from the Abdeslam case that a network within France and Belgium are supporting these cells.Indeed,on24MarchFrenchpolicearrestedanotherISILoperative,inanorth-westernsuburbof Paris after they unveiled a plot that was in its advanced stages and planned to detonate an “unprecedented” amount of explosives. The plotter is believed to have travelled to Syria in 2014 and 2015,hadlinkswithAbaoud,andmadeseveraltripsbetweenFrance,BelgiumandtheNetherlands.

7“HowISISBuilttheMachineryofTerrorunderEurope’sGaze”,The New York Times,29March2016http://www.nytimes.com/2016/03/29/world/europe/isis-attacks-paris-brussels.html,retrieved6April2016. 8 “ResponsibilityforParisTerrorAttacksRemainsUnclear”,NBC News,retrieved14November2015.

11


He was previously known to the French police but not thought to be a terrorist. Two Algerians linked to the plot were detained in Brussels and there were several arrests in Rotterdam, including aFrenchman. All men are believed to be linked to ISIL’s external operations wing that planned the Paris,BrusselsandthefoiledParisattacks,andwhichwasledbyAbaoud.On10April,anothercellmember,wasarrestedalongwithfiveothersinBrussels.9

ISIL attacks since Brussels appear to indicate a move back toward simpler tactics perpetrated by seemingly lone actors but often enabled by a supporting network. This may be in response to increasing pressure from security services, and in all these attacks the perpetratorswere killedby CT forces or had killed themselves. On 10 May one civilian was killed and three wounded in anISIL-relatedstabbingattackinMunich,whileon13JuneaParisianpoliceofficerandhiswifewere stabbed to death at their home in Magnanville by a man who had pledged allegiance to ISIL. Prosecutor FrançoisMolins said the attacker, appeared to be acting on a recent general orderfrom ISIL commander Abu Bakr al-Baghdadi to “kill miscreants at home with their families”.10 The assailant had been convicted of terrorism in 2013 and placed under surveillance after his release but this ended in late 2015. Two other men were charged with supporting his attack. Just over a month later,84peoplewerekilledand308injured–53critically–inthe14JulyNiceattacksinwhichaTunisianman,MohamedLahouaiej-Bouhlel,droveatruckovercrowdscelebratingBastilleDayonthePromenadedesAnglais.ISILlaterclaimedresponsibilityfortheattack,whichMolinssaidhadbeen planned for months and had help from seven accomplices who were arrested.11Lahouaiej-BouhlelwasknowntoFrenchpoliceforpriorcriminaloffences,butwasnotregisteredasaFiche‘S’ and he was not known by French or Tunisian authorities to have links to terrorist organisations.12 AuthoritiesbelieveLahouaiej-BouhlelradicalisedquicklyshortlybeforetheattackwithMolinsstatinghehada“clear,recentinterestintheradicaljihadistmovement”.13Lahouaiej-Bouhlelwasalsoknowntohavepsychiatricproblems,characteristicthathasincreasinglybeenfoundinsomeattackers.On18 July a 17 year-old alleged Afghan asylum seeker attacked passengers on a train with an axe anda knife inWürzburg,Germanywoundingfivepeople.Videos lateremergedof the teenagerpledgingallegiance to ISIL.Sixdays later,aSyrianrefugeeblewhimselfupoutsidea festival inAnsbach,Germany,wounding14people.HehadalsopledgedallegiancetoISILandhadahistoryof psychiatric problems.14Similarly,asuspectedcellthatwasshutdowninGermanymayhavehadtieswiththeNetherlands.Twodayslater,anAlgerian-born19year-oldandFrench-born19year-oldattackedachurchserviceinSaint-Étienne-du-Rouvray,Normandy,withahandgun,knivesandfakeexplosivebelts,killingapriestandwoundinganothercivilian.Bothoftheattackerswereknowntothepolice,withonehavingbeenconvictedofterrorismoffencesin2015andsentencedtoprison,where he radicalised further.

Whiletheworstoftheattacksinthelast24monthshavebeenconcentratedinFrance,Belgium,andmorerecentlyGermany–indicatingthemajorproblemsthesenationsarefacing–otherEuropeanstates are not immune. For example, in November 2015 the then British PrimeMinister DavidCameronstated that sevenmajorplotshadbeendisruptedbyBritish intelligence that year,15 a numberthathasincreasedsincethen.Indeed,unfortunatelyitisnowamatterofwhen,notif,further

9 “Belgiumattacks:MohamedAbrini‘admitsbeingmaninthehat”,BBC,9April2016,http://www.bbc.co.uk/news/world-europe-36005709,retrieved10April2016. 10 “Frenchjihadistpolicekiller‘obeyedIslamicStateorder”,BBC,14June2016,http://www.bbc.co.uk/news/world-europe-36530710,retrieved2August2016. 11 “Niceattack:Prosecutorsayssuspecthadaccomplices”,BBC,21July2016http://wayback.archive.org/web/20160721181557/http://www.bbc.co.uk/news/world-europe-36859312,retrieved2August2016. 12 “FranceSaysTruckAttackerWasTunisiaNativeWithRecordofPettyCrime”,The New York Times,15July2016http://www.nytimes.com/2016/07/16/world/europe/attack-nice-bastille-day.html?_r=0,retrieved2August2016. 13 NicekillerMohamedLahouaiejBouhlel‘onlystartedgoingtomosquethisApril”,The Sydney Morning Herald,17July2016http://www.smh.com.au/world/nice-killer-mohamed-lahouaiej-bouhlel-only-started-going-to-mosque-this-april-20160717-gq7esi.html,retrieved 2 August 2016. 14 “AnsbachsuicidebomberconfirmsIsisloyaltyinvideo”,The Local,25July2016,http://www.thelocal.de/20160725/ansbach-suicide-bomber-confirms-isis-link-in-video,retrieved2August2016. 15 “UKhasthwartedsevenIsisplotsinayear,saysDavidCameron”,The Guardian,16November2015http://www.theguardian.com/politics/2015/nov/16/uk-thwarts-seven-isis-plots-in-a-year-says-david-cameron,retrieved10April2016.

12


ISIL-inspiredattacks takeplaceonEuropeansoil.Thesemaybe relativelyminorattacks,or themorecoordinatedandprolificattacksofParisandBrussels,andindeedthesimplermasscasualtyattack as seen in Nice. A very rough estimate based on data since May 2014 indicates that if you are amemberofthepublicinFranceorBelgium,younowhaveagreaterthan1/10,000chanceofbeingkilledorwoundedinanISILattackinthenexttwoyears.Thisisobviouslysignificantlyhigherforurbanresidents,commuters,andcertaingroups,suchasJewishcommunities.Moreover,itmarksavastincreaseinthechancesofdeathorinjuryfromterrorismsincetheendof2004.Unfortunately,itappears this trend is likely to continue as evidence suggests that ISIL are actively seeking to establish networksofhardenedfighterswithinEurope,withoneformerISILoperativewarninghisinterlocutorsfrom France’s intelligence service after his arrest “it’s like a [European terrorist] factory out there [in Syria].TheyaredoingeverythingpossibletostrikeFrance,orelseEurope.”16Atpresent,recordsfromFrance’sdomestic intelligenceagencyshowat least21fighters trainedby ISIL inSyriaareknown to have been dispatched back to Europe with the intention of causing mass murder. Records from France’s domestic intelligence agency show.17 Other reports put this number as high as 400.18

However, the Salafist jihadist threat to the transatlantic space is not confined to the Europeancontinent.TheJanuary2013 InAmenasattack inAlgeria,conductedbyagroupwith links toal-Qa’ida,killedat least39,while, inJune2015,37Europeancitizens– thevastmajorityBritish–werekilledinagunattackbySeifeddineYacoubiatabeachresortinSousse,Tunisia.Yacoubihadpledged allegiance to ISIL and is understood to have received operational support from others. The downingofaRussiancivilianaircraftovertheSinaiinOctober2015,killing224,andanISILattackonIstanbulairportinJune2016thatkilled45civilians,furtherhighlightthetransnationalnatureofthe threat.

Foritspart,NorthAmericahasalsoexperiencedincreasingnumbersofjihadistterroristattacks.TheApril2013BostonMarathonbombingskilledfourandwoundedover280civilians,whiletheJuly2015Chattanoogaattackkilledfiveservicemenandleftanotherthreeinjured.BothattackswerecarriedoutbyyoungMuslimmenwhowereUSresidents,andtheChattanoogaattackerhadahistoryofmentalillnessanddrugabuse.On2December2015inSanBernardino,Californiatwoextremistskilled14peopleandwounded22attheInlandRegionalCentre.Aftertheattackers–SiyadFarook,aUScitizenofPakistaniorigin,andhisPakistaniwife,TashfeenMalik–weresubsequentlykilledbypolice, it becameclearneitherhadacriminal record,andneitherwasonTerroristScreeningDatabaselists.Theyhadalsoself-radicalised,pledgedallegiancetoISILandreceivedthesupportofanaccomplice.On6June2016,theworstmasscasualtyterroristattackintheUSsince9/11tookplaceatagayclubinOrlando,Floridakilling49andwounding53others.Theperpetrator,OmarMateen,wasaUScitizenofAfghanextractionheldextremistIslamistviewsandsaidthattheattackcameinrevengeforthekillingofanISILmemberinIraqtheweekbefore.Meanwhile,on10August,Canadian police received a tip-off from the FBI that a young radicalised Canadian citizen was about to conduct an attack in Ontario. The attacker was killed by police after he detonated a rudimentary device,andalthoughhewasknowntotheCanadianauthoritiesasanISILsupporter,hisintentionsonly became known after he uploaded a martyrdom video.

ISIL’ssuccessfulattacks,andthedisruptionofotherterrorplotsinEuropeandNorthAmericasince,indicatethatthethreattoEuropeandNorthAmericafromJihaditerroristsisnotonlyrising,butisalsohighlydynamicandevolvingrapidly.Moreover,thetempoandscopeofISILcellsoperationshas revealed a mismatch between them and some European intelligence and police services’ ability

16 “HowISISBuilttheMachineryofTerrorunderEurope’sGaze”, The New York Times,29March2016http://www.nytimes.com/2016/03/29/world/europe/isis-attacks-paris-brussels.html,retrieved6April2016. 17 Ibid. 18 “ISILhave400fighterstrainedtotargetEurope”,Euronews,24March2016http://www.euronews.com/2016/03/24/isil-have-400-fighters-trained-to-target-europe/,retrieved10April2016.

13


topreventattacks,rather thansimply“react toexplosions.”19 Finally,al-Qa’idaandother jihadistgroupsshouldnotbewrittenoff.Globallyspeaking,itisISILthatcurrentlyholdsthegreatestappealforactiveandaspiringjihadists.Itisemblematicofthisnewpowerbalanceandtherivalrybetweenthe two thatnoneof theofficialbranchesofal-Qa’idahave joined ISIL.However, like ISIL,unitsbelonging to al-Qa’ida also retain the intention and capability to strike at targets in Europe. They remainamajorthreatinsomeregionsandmayenjoyaresurgenceasISILcomesunderincreasingpressure. The multitude of terrorist groups that seek to do Europe and North America harm therefore provides another motivating factor for better CT cooperation. Some of the wider problems in the transatlanticsecurityarchitectureareidentifiedbelow.

2.3. Common DenominatorsToday’s terroristsareevolving rapidly.According toa former seniorUS intelligencepolicymaker,terroristsaredifferenttodayfromthegenerationthatexecutedthe9/11attacks.Then,terroristsweresubject to “qualitycontrol”,usuallyattended trainingcampsabroadbeforebeingsent toconductspecificattacks,andterroristorganisationswerehierarchical,enablingtheintelligenceservicestoengagetraditionalintelligencecapabilitiesagainstthem.However,themorerecentterrorismoutlinedabove often has its origins in criminal networks and is often perpetrated by known criminals. Both terrorists and “criminals” know no boundaries. They can transit international borders with relative ease thanks to the interaction with criminals who can provide fraudulent documents; they can procure weapons “in country” by simply paying the required sum and they can share intelligence and bribeofficialsthusenablingthemtokeepaheadoflawenforcement.Assuch,theyshareexperienceandexpertiseacrossenvironments,communities,andprisonswithaflexibilityandagilitythatlawenforcementandsecurityservicescanonlywishforthemselves.Thus,our intelligencecollectionapproachneedstoappreciatethisandadapt.Thisstrengtheningrelationshipbetweenjihadismandcriminalityisadefiningcharacteristicofthemorerecentterrorism.

Theterroristsoftodaycanthereforebemoredifficulttofind.AsoneCTexpertputit,“thesepeopleleavealotfewerbreadcrumbs[traces]onthewaytoterrorism”,withthespeedofself-radicalisationanduseofcrudeweaponsinattacksparticularlydifficulttodetect.Moreover,today’sterroristnetworksincreasingly blend often rapidly self-radicalised Muslims with European citizenship and links to criminalgangswithcellleaderstrainedinSyriaandIraq,andrefugeesradicalisedontheinternet.20 Asone formerheadofan intelligenceagencyhasstressed, thesenetworks “aresmall, informaloverlapping networks of violent extremists from which small groups may coalesce and emerge at short notice to conduct attacks that vary from the sophisticated [Paris] to the crude [Nice].” Often drawingontheexperienceofthecellleaders,thesenetworksplantheirownoperationswithminimumoperationaldirectionfromISILcentral.Moreover,onlineandphysicalnetworkshaveprovenadeptat influencingmentallyunstableyoungmen tocommit terroristattacks. Indeed, it is increasinglyclear that the mental health services need to be better integrated into CT efforts. The internal nature ofthethreat,therapidityofself-radicalisation,theprofessionalismandtechnologicalsophisticationofsomeattackcellsorthesimplicityofothers,andtheiroperationalflexibilityallindicateagrowingintentandcapabilitytostrikemultiplesofttargetsinEuropeancities,oroncrowdedtouristbeaches,near simultaneously.21

Theircapabilityhasalsochanged.Evenifseeminglyloneactors,attacksarealmostalwayssupportedbyanetworkofindividuals,whilethemoresophisticatedassaultshaveinvolveddegreesoftactical,

19 Interview,15April2016. 20 “TerroralertoverIsisplottoputbombsunderbeachsunloungers”,The Times,20April2016http://www.thetimes.co.uk/edition/news/terror-alert-over-isis-plot-to-put-bombs-under-beach-sunloungers-662bm0txs,retrieved20April2016. 21 “TerroralertoverIsisplottoputbombsunderbeachsunloungers”,The Times,20April2016http://www.thetimes.co.uk/edition/news/terror-alert-over-isis-plot-to-put-bombs-under-beach-sunloungers-662bm0txs,retrieved20April2016.

14


operationalandtechnologicalproficiencynotseenbeforeinEurope.Terroristsareactivelylearningabout CT counter-measures and usingways andmeans to negate them, for example by usingsecureapps,encryptedcomputers,andinthefuturewillprobablyutilisecyber-attacksanddronesas vectors of disruption.

2.4. Time to AdaptAswereflectonthepast,considerthepresentandseektopredictthefuture,wecanbeconfidentthat ISIL’s intent and terrorist capabilities are unlikely to diminish in the coming years. According to General JohnAllen, the former US Special Representative for Countering ISIL, this is beingdriven to a large degree by the success of the coalition’s efforts against ISIL in Iraq and Syria during the past 18 months. ISIL has lost strategic momentum in its core areas during this period. Asaresult,ISILcommandviewstheEuropeantheatreasasecondfrontwhichitcanmaximiseforpropagandavaluetoreverseitsdefeatsintheLevant.AccordingtoAllen,ISILviewsthecoalitionas an “existential threat” and Europe as the battleground for its coming counterattack. This view is supportedbyISIL’sowndocuments,mediareportscitingISILmembersofincreasingnumbersofEuropeanISILfightersbeingorderedhometoprepareEuropeanmissions,andtheorganisation’sestablishment of an external operations wing.22Furthermore,accordingtoaformerheadofGermanexternalintelligence,themagnitudeofterrorsuspectsinEuropeisbecomingacute,withuptoonethousand terror suspects in Germany alone.23AsISILlosesgroundinitsheartland,moreforeignfighterscouldbeexpectedtotricklebackhometocarryoutattacks.Whilethedegreetowhichthisthreat will actually materialise is of course debatable given the fact that failing states could offer ISILfurtheroperatingspace,thegroup’scurrentemphasisonEuropeunderscorestheurgencyoftrackingpeoplereturningfromoverseasandcounteringradicalisation,andispartlyatechnologicalissue and partly a policy decision.

Yet this perspective is only just beginning to be understood in Europe, a fact which has led tocomplacency amongst some intelligence and security services.24Facedwiththisthreat,theEuropeancontinentisnowataninflectionpoint–similartothatintheUSafter9/11–whereithastheabilitytochangecourse.ForAllen,however,Europe’spositionisuniqueasitstillhastheopportunitytoadaptits intelligence and law enforcement services’ practises and architecture without the massive trauma causedtotheUSin2001.Therecentattackshaveclearlyrevealedinstitutional,organisationalandfunctionalseamswhichneedaddressingtobetterpreventfurtherattacks.ForAllen,theEuropeanintelligencearchitecture isundermajorpressureand“theenemy ismappingthegaps”.25 Former seniorpoliceandCTofficialsandnumerouspolicymakersacrosstheEU,UKandNorthAmericaecho such a view and are aware that reform is needed.26 Perhaps now is the time to do so.

22 “IslamicStatefilesleak:securityfearsasdozensofEuropeanfightersgranted‘leave’toreturnhome”,The Daily Telegraph,19April2016http://www.telegraph.co.uk/news/2016/04/20/islamic-state-files-leak-fears-as-dozens-of-european-fighters-gr/,retrieved20April.23 PanelatGLOBSEC2016,17April2016. 24 Ibid.25 Interview,15April2016. 26 Interviews,15-16April2016,“BetterBorderControl”,The Daily Telegraph,19April2016http://www.telegraph.co.uk/opin-ion/2016/04/19/letters-outside-the-eu-britain-would-be-free-to-spend-its-money/,retrieved20April2016.

15


The following section discusses the key pillars of the European intelligence and law enforcement architecture and its liaison capacity. It recognises that both intelligence and law enforcement are criticalforeffectiveCT,especiallytodaywhenlinesbetweencriminalsandterroristsareincreasinglyblurred. Some national intelligence and law enforcement agencies need to adapt to this new type of terrorist,needtobetrainedinwhotolookfor,wheretolookforthem,andwhatthemosteffectiveways of looking for them are.27

3.1. European Intelligence Architecture Thecontinent’sintelligencecapacityfirmlyrestswithnationalstates.Thisisproblematicas,inshort,manynationsintheEUhaveintegratedtheirborderswithoutanyintegrationorsufficientcooperationamongtheirintelligenceservices.Whilewearenotadvocatingthecompleteintegrationofthelatter,asaresult,intheEU,eachMSisarguablynowonlyasstrongasitsweakestlink.28Hence,inthecontextofCTintelligence,liaisonisincreasinglyimportant.Today,asidefrombilateralrelationshipsbetween individual intelligence liaison in Europe and the transatlantic space is conducted through anumberofinformalcooperationarrangements,includingtheplatformoftheCTG,theG6,whilesomejointintelligencebodieshavealsobeenestablishedwithintheEU.

IntelligenceliaisonwithintheEUhavebeenaprocessoftop-down,incrementalchange.Itbeganapproximately 15 years ago with shared diplomatic reports, later evolved into sharing selectedintelligence assessments, and,most recently, has started producing joint analysis.Although theUnion’s development of intelligence liaison has been substantial, it largely focuses on strategicintelligence, leaving the operational and tactical levels to its MS.29 Moreover, it lacks its ownsubstantial intelligence collection capabilities.30TheEU’sjointCTandintelligencearchitectureeitherfalls under the High Representative (HR) of the EU for Foreign Affairs and the European External ActionServices(EEAS),whichhousestheEUIntelligenceAnalysisCentre(INTCEN),31 its military intelligencecounterpartINTDIRandSATCEN,theEUSatelliteCentre.32 The European Council is hometotheEU’sCounter-TerrorismCoordinator,wholacksexecutivepowersbutistheEU’sgo-tofigureonissuesofcounterintelligence,33 and several working groups on terrorism.34Finally,other–largelylawenforcement–bodiesdiscussedindetailbelowcontributetotheCTcause:Europol,FrontexandEurojust.35

Attheinformallevel,theCdBisthebestknownintelligence-sharingmechanisminEurope,butothergroups such as the G6 and Prum Convention also discuss internal intelligence matters. Established

27 Roundtable 15 April 2016. 28 Ibid. 29 Ibid. 30 WiththeexceptionofSATCEN,whichdoescollectsomeofitsownIMINT,butmostlyviaMS’technology.31 “EUINTCEN”,Europa.eu,http://eeas.europa.eu/factsheets/docs/20150206_factsheet_eu_intcen_en.pdf,retrieved22March2016.32 “TheCentre”,European Union Satellite Centre,https://www.satcen.europa.eu/centre.php?menu=1,retrieved24March2016;“Eu-ropeanUnionSatelliteCentre(Torrejón)”,EEAS,http://eeas.europa.eu/csdp/structures-instruments-agencies/eu-agencies-on-csdp/eu-satellite-centre/index_en.htm,retrieved24March2016. 33 “Counter-TerrorismCoordinator”,European Council,http://www.consilium.europa.eu/en/policies/fight-against-terrorism/counter-terror-ism-coordinator/,retrieved24March2016.34 “WorkingPartyonTerrorism(TWP)”,European Council,http://www.consilium.europa.eu/en/council-eu/preparatory-bodies/work-ing-party-terrorism/,retrieved28March2016.35MoreontheEU’sworkinggroupsandorganisationsdealingwithCTand/orintelligencesee:Fägersten,B.“Intelligenceanddeci-sion-makingwithintheCommonForeignandSecurityPolicy”,Sieps – Swedish Institute for European Policy Studies,October2015http://www.sieps.se/sites/default/files/2015_22epa_eng.pdf,retrieved20March2016;Fägersten,B.(2014),“EuropeanIntelligenceCooperation”.InDuyvesteyn,I.deJong,B.&vanReijn,J.(eds.),TheFutureofIntelligence-Challengesinthe21stcentury,London:Routledge.

3. Current Intelligence and Law Enforcement Architecture

16


in1971,theCdBconsistsoftheheadsofEUMSinternalintelligenceservices,andthoseofNorwayandSwitzerland.Itisfunctionallydividedintoworkinggroupsondomesticterrorism,cybersecurity,andcounter-espionage.AlthoughtherearenoofficialconnectionstotheEU,therotatingpresidencyof the Club is synchronised with that of the EU and some of its threat assessments are made available to high level committees of the EU. Criteria have also been set for the CdB’s new MS in order that they meet the operational security requirements of the Club.

The nature of intelligence exchanged within the CdB framework has traditionally been strategic and hence,asone intervieweeput it, “it ismore likeagentlemen’sclubora think tank”.36 However,following9/11,abranchoftheCdB,theCounter-TerrorismGroup(CTG)wasestablishedtodealspecifically with terrorism and to provide a forum for collaborationwithin and outside the grouponmajorCTissues.SetuptofocusonIslamicextremistterrorism, itmeetsregularlytofacilitateoperational liaison among its members and is also believed to generate threat assessments which are passed on to EU policymakers.”37Moreover, within theCTG framework,MS in cooperationwith US envoys seconded to the Group produce common threat assessments that are also shared with some EU committees.38Althoughthereisnoformalisedlinkbetweenthetwo,aCTGteamissecondedtotheEU’sintelligenceanalysiscentre,INTCEN,inBrussels.39

InthewakeoftherecentISILattacks,theCTGisincreasinglybeingusedonamoreregularbasistoaddresssomeoftheissuesidentifiedbytheevolvingjihadistthreat.HostedbytheDutchdomesticintelligenceand security service, theAIVD,weunderstand representatives from itsMSarenowmeetingonaweeklybasis.Italsorecentlyestablisheditsowndatabase,theeffectivenessofwhichis yet to be determined. While the CdB does have some liaison links with the EU’s main intelligence andlawenforcementhubs,INTCENandEuropol,theCdBhastraditionallybeenreluctanttoshareintelligence with these bodies. Liaison could and should be much stronger; and one starting point elaborated on below should be a Europol-CdB hit-no-hit database search capability.

3.2. European Law Enforcement ArchitectureFormuchofthepasttwodecades,Europolhasbeenthemostprominentpan-Europeaninstitutionin terms of law enforcement liaison. The EU’s centralised law-enforcement body began operations in1999,predominantly to facilitate jointanalysisandexchangeofcriminal intelligence, includingterrorism,betweenallEUMS.Todateithashadsustainedsuccessincounteringorganisedandcyber-crime,butsomeimportantMSaremorereluctanttoshareCTintelligence.40 Without its own collectioncapabilities(barringtheInternetReferralUnitdiscussedbelow)Europolcollects,stores,processes,analysesandexchangesinformationandintelligenceprovidedbyMSandcooperationpartners,notifyingMSwhenithas“informationconcerningthemandofanyconnectionsidentifiedbetween criminal offences” and providing “threat assessments, strategic analyses and generalsituation reports”.41 Using operational data from MS and third partners (international organisations orcountriessuchastheUS)aswellasopensourceintelligence,theSecureInformationExchangeNetworkApplication (SIENA)enables fullysecure information transferbetweenMS,Europolandother third parties. Europol has some of the strictest information handling codes of EU MS and acts as an EU benchmark in this regard.42ItalsohostspermanentliaisonofficersfromallMS,the

36 Interview,15April2016. 37 “CounterTerroristGroup–CTG”,Harvard Law School PILAC,http://pilac.law.harvard.edu/europe-region-efforts//counter-terror-ist-group-ctg,retrieved5April2016.38 Walsh,J.(2006)“Intelligence-SharingintheEuropeanUnion:InstitutionsAreNotEnough”,Journal of Common Market Studies,Vol.44.No.3625-43,http://jamesigoewalsh.com/jcms.pdf,retrieved5April2016.39 Fägersten,“Intelligenceanddecision-making…”,Fägersten,“EuropeanIntelligenceCooperation”,98.40 Interview,17August2016. 41“EuropolCouncilDecision(ECD)”,Official Journal of the European Union (OJEU),L121/37-L121/66,15May2009http://jamesi-goewalsh.com/jcms.pdf,retrieved6August2016.42 Interview,17August2016.

17


USandotherthirdpartners,andsinceJanuary2016italsoisresponsibleforhostingtheFinancialIntelligenceUnit (FIU)system,Europol is therefore functioningwell inmany respects,but itsCTcapability remains curtailed by the distrust with which numerous national intelligence agencies view it,predominantlyduetoitsmultilateralnature.

In respect to terrorism, in January 2016 the European Counter Terrorism Centre (ECTC) wasestablishedatEuropol.TheestablishmentoftheECTChighlightsthat,giventhegravityandincreasedcomplexityofthethreat,forthefirsttimeintermsofEUCTpolicy,thereexistsincreasingpoliticalandoperational consensus that a cornerstone for cooperation at EU level is required to support national CTefforts.FocusedonCTintelligence,itutilisesnewintegrateddatabasesandcomputernetworkstostoreandexchangedatabetweenMS,andpartnerssuchasInterpolandEurojust.43 It aims to becometheEUhubforCT informationsharingandanalysis,andoperationalcoordination in theevent of terror attacks. It builds on existing databases and Europol’s past experience of establishing adhocteamsfromitandinterestedMStoshareandoperationaliseintelligenceonspecificterroristgroups.44TheECTChasfourareasofcompetency;trackingforeignfighters(Europol’sFocalPointTravellersDatabase is themostadvanced inEuropeon themovementof foreignfightersand inApril 2016 it enhanced its cooperation with the FBI); tracking/preventing illegal arms trafficking;trackingterroristfinancingundertheEU-USTerroristFinanceTrackingProgramme(TFTP);45 while the recently established EU Internet Referral Unit collects and analyses terrorist-related content onlineandflagsittointernetproviders.It’s“ChecktheWeb”portalenablesMStoshareinformationon internetactivitiesofjihadistterroristgroups.TheECTCusesSIENAforsecuredataexchangeand the Europol Information System (EIS) as central criminal information and intelligence database. Security and data ownership control are a key feature of the EIS. The EIS user’s right of access to thedatastored in theEIS isdependenton theuserprofileandtherestrictionsdefinedby thedataowner.Accessrightsmaybelimitedbytheowneroftheinformationonacasebycasebasis,allowingforahiddenhitmechanismtonotifytheowner.Againstthisbackground,someintelligenceservices which are designated at MS level to also constitute “competent” authorities under the legal frameworkofEuropolhavecontributeddataonforeignterroristfighterstotheEIS.

WhileEuropol is still developing itsCTcapabilities, it is havingan increasingly effective impact,especially in terms of law enforcement CT issues. Its operational function is also regarded as increasinglystrong.InthewakeoftheParisandBrusselsattacks,“Europolimmediatelyperformedcross checks in its databases on the names of the identified perpetrators to look for possibleaccomplices,producedasignificantnumberofuniquefinancialintelligenceleads,monitoredextremistpropagandaonlineandofferedtheseandotheroperationalservices,includingweaponstraffickingexpertise,totheFrenchandBelgianauthorities.”46Over3,000piecesofinformationweresharedwiththeFrenchalone,andtheseactionsresultedinthegenerationofnewinvestigativelinks.47 As aresultof thesesuccesses, increasingnumbersofMSnow trustEuropolandaremoreactivelysharing CT police information and intelligence. As police-to-police information sharing goes back atleastacentury,thereisoftenagoodleveloftrustbetweenforces.However,curtailedbyalackofCTintelligenceprovidedbyMSintelligenceagencies,Europol’smajorweaknessinthisregardisthatitworksbestintheaftermathofanattack.Clearly,progressisbeingmade,butourresearchrevealed that numerous MS’ intelligence services remain very reluctant to share their information withEuropol.Morecanandshouldbedone in thisregard,especiallyastheTFEUandthe legalframework of Europol do allow information exchange between law enforcement and intelligence services.

43“HistoryofEurojust”,Eurojust,http://www.eurojust.europa.eu/about/background/Pages/History.aspx,retrieved6April2016.44 “ConventionbasedonArticleK.3oftheTreatyonEuropeanUnion,ontheEstablishmentofaEuropeanPoliceOffice(EuropolCon-vention)”https://www.coe.int/t/dghl/cooperation/economiccrime/organisedcrime/projects/carpo/output_3_-_special_investigative_means/Europol_Convention.pdf,retrieved10March2016.45 “EuropolJoinsForceswithEUFIUstoFightTerroristFinancingandMoneyLaundering”,Europol,28January2016https://www.europol.europa.eu/content/europol-joins-forces-eu-fius-fight-terrorist-financing-and-money-laundering,retrieved10October2016.46 “EuropolReview2014:GeneralReportonEuropolActivities”,Europol https://www.europol.europa.eu/content/europol-review-2014,retrieved10March2016.47 Interview,17August2016.

18


BeyondEurope,InterpolisalsomakingprogressinCTlawenforcement.TheorganisationincludesmanystatesintheGulfandSahelregionsthatareparticularlyrelevanttotherisingjihadistthreat.Primarily, itcirculatesalertson terroristsandweapons threats topolice forces in itsNoticesandDiffusion system. Interpol’s relatively new Counter-Terrorism Fusion Centre (CTF) investigates the organisationalhierarchies,training,financing,methodsandmotivesofterroristgroups.TheCTF’sactivities are global in scope and implemented through a number of regionally focused but interlinked projects.Theaimistoimprovetheexchangeoflawenforcementinformationacrossbordersandtoenrich lawenforcementpractises. Interpolalsorunsaforeignfighter trackingprogramme,andanothertoboostborderpolicecapabilitythroughintegratedpolicedatabases.Clearly,likeEuropol,Interpol is making some headway in integrating CT law enforcement capabilities, but also likeEuropol,ourresearchrevealedthatmanynations’ intelligenceservicesremainhighlyreluctanttoshare CT intelligence with it.

Finally, some commentators have suggested thatNATOwould represent a suitable platform foraddressing theterrorist threat.Thisreportargues,however, that this isamisconception.NATO’sprimary concern in the intelligence domain is sharing intelligence to support its military operations. Moreover,itdoesnothavearemittocoverCTinsideitsMS.Foritspart,thefourmajorintelligencedepartmentsinNATOdonotcollectanyoftheirownCTintelligence,areunder-resourced,primarilyfocusonmilitary intelligence, andperhapsmost importantly, suffer fromsimilar problemsas theEU agencies in terms of a lack of trust.48 Interoperability and standardisation of capabilities remain problematic and overall intelligence sharing in NATO has been described as “a big challenge”.49 Recognisingthis,NATOMSagreedatthe2016WarsawSummittoestablishanewJointIntelligenceand Security Division to be led by an Assistant Secretary General for Intelligence and Security. This newAssistantSecretaryGeneral “will directNATO’s intelligenceandsecurityactivities, ensuringbetteruseofexistingpersonneland resources,whilemaximizing theefficientuseof intelligenceprovided by Allies.”50Overall,however,NATO’sprimarygoalisnotfocusedonCTeffortswithinitsMS and outside the military theatres it is engaged in.

48 Interview,16April2016. 49 Interview,16April2016.50 “NATOWarsawSummitCommunique”,9July2016http://www.nato.int/cps/en/natohq/official_texts_133169.htm?selectedLocale=en,retrieved 3 August 2016.

19


ManykeyEuropean intelligenceand lawenforcementfiguresagreethere isaproblem.After theBrussels attacks, the EU’s HomeAffairs Commissioner, DimitrisAvramopoulos stated “There isa shortageof trustbetweenmember states…The ‘deepstate’ resistsandwemust change thisattitude. Iknow it isnoteasy tostart thinking inamoreEuropeanway,but it isamust.”51 Rob Wainwright,directorofEuropol, recentlystated that: “The fragmented intelligencepicturearoundthisdispersedcommunityofsuspectedterroristsisverychallengingforEuropeanauthorities”,whiletheEU’sCounter-TerrorismCoordinator,GillesdeKerchove,stated,“Idomybesttoputpressure,toconfrontthem[MemberStates]withbluntfigures,andwearemakingprogress,butnotquicklyenough.”52Thefollowingsectiondiscussessomeofthekeyproblemsinhibitingtheeffectiveworkof,andmostprominentlyliaison,betweenintelligenceandlawenforcementbodiesontheoldcontinent.

4.1. Trust in Transatlantic Intelligence and Law Enforcement LiaisonBilateral as well as multilateral intelligence and law enforcement structures and organisations are heavilyreliantontrust.Accordingtoourinterviewswithpractitioners,trustremainsakeyproblemofEuropeanintelligenceliaisonandisalsofarfromguaranteedinCTlawenforcement.Moreover,trust issues are not simply a problem of EUMS, but are also present across the transatlanticspace,bothinrespecttointernationalaswellasdomesticcooperation.Organisationalrivalriesanddistrust remainbetween the16US intelligence, securityand lawenforcementagencies,despitetheprogressthatthefederalandstategovernmentshavemade.Thisprogress,however,wasmostchieflyfacilitatedbytheshockof9/11aswellasthefactthatitwascomparablyeasytointegrateduetheUS’federalisedstate.Similarly,afearofcompetitionfromgrowingEUinstitutions,suchasEuropol’sECTC,mayalsobeafactorinexplainingthereluctanceofsomeintelligenceservicestocooperate more fully with Europol.

Anumberof factors impedetransnational trust.Sincethemid-1990s, therehasbeenawelcomeincrease in parliamentary and judicial oversight, aswell as liaison between national intelligenceandlawenforcementorganisations.Nevertheless,recentattackshaveshownthattherearewidediscrepancies between European states’ intelligence as well as law enforcement capabilities and capacities.WhileEuropolismakinggoodprogressinintegratingEuropeanlawenforcement,thereremaindifferencesbetweenpoliceforces’capabilities.Someofthoseidentifiedhaveinvolvedtheadequacy of evidence gathering, casemanagement, and prosecution. In respect to intelligenceliaison, a number of intervieweeshave indicated that trust remains an issuebetweenEuropeannations with longer democratic traditions and those that have only recently democratised. The backgroundanddividedloyaltiesofsomeintelligenceleaders,unclearcontrolmechanismsoftheirintelligenceorganisations,andthepossibilityofleaksbeyondtheEuropeanintelligencecommunityhave,attimes,strainedtheserelationships.Therearealsooftenwell-foundedhistoricalandpoliticalreasons for discrepancies between CT legislation and personal data and intelligence sharing.

This inequality impedes the sharing of CT intelligence and personal data, as themore capablestatesarereluctanttosharetheir“goods”withstateswithlessercapacity.Forexample,databasesonforeignfightersremainseparatedandreliantonacoreoffivemaincontributingMSservices.Intermsofsignalsintelligence(SIGINT),capabilitiesoftransatlanticpartnersarelargelydeterminedbytheirintelligencearchitecture,itsevolution,sizeandlegislation,withtheUKbeingthemostprominentEuropean nation that regularly collects bulk data.

51 “Brusselsattacks:WhyEuropemissedwarningsigns”,BBC,24March2016http://www.bbc.co.uk/news/blogs-eu-35891078,retrieved10April201652 ‘FirstonCNN:TopU.S.intelofficial:Europenottakingadvantageofterrortrackingtools’,CNN,7April2016http://edition.cnn.com/2016/04/07/politics/christopher-piehota-us-intel-europe-terror-tracking/index.html,retrieved10April2016.

4. CT Intelligence and Law Enforcement Issues

20


Moreover,therealsoneedstobetrustthatifaspecificpieceofintelligenceispassedon,itisnotactionedwithout theoriginator’sconsent,andthat theoriginator’s legal framework isconsidered.One potential issue here is whether European intelligence services can share “live” information on theirCTinvestigationsandtrusttheUSnottoactunilaterally,especiallyastheUShasadifferentlegalframeworkallowingittotargetsometerroristsabroadasitwouldonabattlefield.Bothsidesmay need to compromise and take a longer-term view in order to build trust.

Allofthisiscloselyrelatedtotheissueof“securityculture”.Inmanyorganisations,thetraditionalapproach to security has focused on addressing physical and information security issues. Nevertheless, the “people” or cultural element, which is equally important, is often overlooked.Asmostintervieweesagreed,“theactionsandattitudesofpeoplecanmakeallthedifference”.Asignificant factoraffectinghowpeopleact is thesecuritycultureof theorganisation.Thiscanbedefinedasthestyles,approachesandvaluesthattheorganisationwishestoadopttowardssecurity.It can range from whether employees adhere to a clear desk policy to whether they share sensitive information on social networking sites or with outsiders. In organisations with a strong security culture,employeeswill tend to thinkandact inamoresecurity-consciousmanner.Thishelps toreduce risk and vulnerability, which in turn helps protect against reputational damage, businessimpact and ultimately national security threats. Organisational and security culture are as important as riskmanagement, business continuity andother disciplinesand, of course, theypervade thewhole organisation with less visibility and less controls.

Overthepastdecade,transnationaltrusthasfurtherbeenunderminedbytheWikileaksandEdwardSnowden revelations,whichdrewattention to theproblemofcertainnations “spyingon friends”.Although the fact that even allies eavesdrop on each other did not come as a surprise to those familiarwiththetrade,thepublicuproarandwidepublicitythesedevelopmentsreceiveddidimpactmutualtrust.Forinstance,afterSnowdenallegedthattheUShadbeenspyingonGermancitizens,thisledtoatemporarybutsignificantdamagetothetrustbetweenthesenations.Concernsaboutprivacy therefore remain strong in someEuropean nations.Nevertheless, there does appear tobe a growing recognition in these nations that the evolving terrorist threat requires reappraisal of legislation designed when other threats were perceived as more pressing. This has been helped by thesteadyspreadofintelligence,lawenforcementandjudicialoversight.

AlackofjointoperationalinformationsharinghistoryalsoexistsbetweensomenationalintelligenceagenciesandtheCTGontheonehand,andEuropolontheother,withtheformerregardingthelatter’sinformationsecurityandabilitytopreventleaksassuspect,despitethefactthatithassomeof the most stringent information security systems in place in the EU. While the reserved approach oftheCTGtoroutinelysharewithEuropoldoesreflecttheintelligenceservices’ inherentdistrustof multilateral personal data and intelligence sharing platforms, it does also indicate a culturalunwillingnesstoadapttochangedstrategiccircumstances.Indeed,aseniorintelligenceofficialhasestimated that only one-two percent of CT intelligence collected by MS is truly secret and should notbesharedwithEuropoloranyotherbody.Therefore,changingtheculturalapproachtosharingamongst MS intelligence services and transnational bodies is also sorely needed.

4.2. Domestic Inter-Agency TrustTrustissueshavealsohadamajoreffectondomesticcooperationbetweenlawenforcementandintelligence agencies. A number of countries within the transatlantic community struggle with domestic dissemination failures. Better integration of information held by the police into the intelligence picture iskey,asafterattacksithasemergedthatoftentheydidinfactholdanumberofimportant“crumbs”.Moreover,Europeanterrorismisincreasinglyalocallawenforcementissue,relyingongoodrelationsand deep familiarity with local communities to collect actionable human intelligence (HUMINT). Law enforcementisessentiallyonthefrontlineoftoday’sCTefforts.Nevertheless,numerousEuropean

21


intelligence, law enforcement, security and legal services have not succeeded in developing astrongsenseofasingleintelligenceandsecuritycommunity,includingtherelevantlawenforcementbodies,toenablejointmissionplanning, investigations,evidencegatheringandwherenecessarydisruption operations. This is a lesson the British had to learn from hard experience of countering attacksinGreatBritainduringtheirlongNorthernIrelandCTcampaign,andthattheDutchhavealsoincorporated.Inmanyothernations,servicesarestillfunctionallydivided,curtailedbyrivalry,andreportedly under-resourced. They therefore do not share information between services – or with their governments–tothesamedegree,andcanstruggletoshareinformationrapidlyinordertoidentifyandpre-emptattacks.Moreover,inmanycountries,lawenforcementforceshavenottraditionallybeenviewedascentraltoCTefforts.Asaconsequence,lawenforcementofficershavenotbeentaskedtopotentialproblemareaswithsufficienturgencyandinsufficientnumbersinordertohelpbuild the community relations that are vital to generating good CT intelligence.

One interesting example of effective best practice in this regard was the British realisation after the 2005 London bombings that its CT effort needed to decentralise from London and move out to theregions, ineachcaseco-locatedwiththepolice,enablingintegratedplanningandoperationsthat harnessed the output of all the intelligence agencies. British CT experts argue that this has transformed the effectiveness of domestic CT. Following the recent attacks in France, it is alsobeginning to recognise thepowerofan integratedCTapproach,which restson thecooperationbetweenintelligence,securityagenciesandthepolice.Moreover,excessivecentralisationinParishasalsobeenrecognisedasaproblem.AlthoughtheUSintelligence,securityandlawenforcementagencies have integrated since 9/11, it should be also noted that some functional seams andorganisational rivalries remain.

4.3. OperationalisationFailures and loopholes have also been identified when it comes to operationalising – followingthrough and acting on – “personal data” and “intelligence” received from allies or international law enforcement organisations. Arguably, operationalisation failures have been caused primarily byfailurestoprioritiseinformationconcerningthreats,therelativelyfreemovementofpeopleacrossEurope,andbycapacityissues.

4.3.1. CapacityThe capacity problem in respect to operationalisation is noteworthy. With the growing number of radicalisedEuropeanswithknownassociations to ISILorother terroristorganisations,Europeanintelligence services are still under resourced, despite recent increases in personnel. As threepoliceor intelligence teamsoffive-sixpersonnelareusually required foreach24-hourperiodofsurveillance of a person of interest, monitoring suspects is manpower intensive and thereforerequires prioritisation. France’s Direction Générale de la Sécurité Intérieure (DGSI) employs roughly 3,300officerstomonitor20,000peopleonthecountry’swatchlist.TheBelgianintelligenceagency,SuretedeL’Etat, has600personnel tomonitora suspected900 terroristson its territory. In thewake of theParis attacks its budgetwas increased by 20 percent to €50million.Nevertheless,beforetheBrusselsattacksaBelgianintelligenceofficialstated:“Wejustdon’thavethepeople…wedon’t have the infrastructure to properly investigate or monitor hundreds of individuals suspected of terrorlinks…It’sliterallyanimpossiblesituation.”53Bycomparison,theDutchhave1800intelligenceandmilitarypersonnelintotaltomonitoralargerpopulation,butonlyasmallamountoftheseareinvolvedinthesurveillanceofabout40jihadistsuspects.Despiteattemptstoreform,andhelpfromtheUS,ourresearchrevealedthatBelgianintelligenceiscurrentlyviewedasa“weaklink”byothernations’ intelligence services.

53 “BelgianAuthoritiesOverwhelmedByTerrorInvestigations”,Buzzfeed,22March2016http://www.buzzfeed.com/mitchprothero/belgian-authorities-overwhelmed-by-terror-investigations#.pszkgBYr5b,retrieved9April2015.

22


ThefreemovementofpeoplewithintheEU,combinedwitharguablyporousbordersinthesouth-eastand the loopholes in information exchange and intelligence liaison has led to suspects falling off the radar. A number of the Brussels and Paris attackers were considered a threat. Their radicalisation and engagementwithISILinSyriawasknowntotheauthorities,yettheyfellofftheradarwhilemovingbetween Western Europe and the Middle East with relative ease. This problem has manifested itself in respect to the recentCTchallenges in the followingway: anestimated5,000EuropeancitizenshavetravelledtojoinextremistgroupslikeISILinSyriaandIraq,butthereare2,786inonedatabase,1,473inanother,and90percentofthenamesaddedrecentlycamefromonlyfiveEUgovernments.54 Although some have suggested that European suspects known to have associations withISILshouldbemonitoredwhileintheMiddleEast,thisproposalrepresentsamajorchallengeastheWest’sintelligencecapacitytotracksuspectsincountriessuchasSyriaandIraqislimited,and cooperation with some governments in the region controversial.

4.3.2. Privacy and Digital ToolsAnotherobstacleissomeMS’historically-conditionedemphasisonprivacy,althoughtherearesignsof increasing recognition that a more pragmatic balance needs to be struck between this and the newthreatfacingEUcitizens.Yet,legislationislaggingbehindthethreatinmanynationsandthosethat have introduced new CT legislation do not want their model to be widely adopted in the EU as theyfearthismayattracttoomuchattention,provokeopposition,andcouldbejudgedtobeillegalby the European Court of Justice.55 Powerful digital intelligence and data mining tools are essential forCT,notleasttotriggerinvestigationsandpre-emptattackplanning.Buttheverypowerofthesetools means that there must be adequate safeguards and oversight to ensure that they cannot be misused; for most nations this means new legislative frameworks need to be considered.

TheDirectorof theUS’TerroristScreeningCenter,ChristopherPiehota, recentlycommentedontheissueofoperationalisation.AccordingtoPiehota,allEuropeancountriescooperatewiththeUSto varying degrees and information sharing has greatly improved in response to the ISIL threat.56 Nevertheless, he stated that European countries can domore to screen terrorists and take fulladvantageoftoolstheUShasofferedinthefightagainstterrorism:“It’sconcerningthatourpartnersdon’tuseallofourdata.Weprovidethemwithtools.Weprovidethemwithsupport,andIwouldfinditconcerningthattheydon’tusethesetoolstohelpscreenfortheirownaviationsecurity,maritimesecurity,borderscreening,visas,thingslikethatfortravel.”PiehotasaidthattheUSsharesitswatchlistswithEUcountries,but thatEUcountriesdonotsystematicallyutilise it to identifysuspectedterroristsorscreenincomingmigrants.Simultaneously,someformerseniorEuropeanpolicymakershave expressed concerns about sharing “live” information on their CT investigations with the US. They ask: “Can we trust the US not to act on this information unilaterally?”

With its systems of warrants and information sharing databases (Schengen II and the more recently acceleratedEU arrest warrants being themost prominent), and the recently passedPassengerNameRecord(PNR)legislation,theEUnowpossessesavenuestophysicallyexchangeinformationonsuspects.Theseresourceshave,however,thusfarpredominantlybeenusedtofightorganisedcrime and are yet to be adopted as common ways of CT information-sharing between European andothertransatlanticallies.WithrespecttothenewlyadoptedPNRlegislation, itremainstobeseen how this data will be used for CT purposes. According to a former member of the post-9/11 administrationintheUS,PNRdatawascrucialtotheUS’slarge-scaleCTeffort.Thisinformationcombinedwithotherintelligenceforcemultipliescapabilitiesandpinpointssuspects.Nevertheless,contrastingtheUS,therearesomany landandseaentrypoints intoEuropethatmanywhoare

54 Roundtable 15 April 2016. 55 Interview,7March2016.56 FirstonCNN:TopU.S.intelofficial:Europenottakingadvantageofterrortrackingtools”,CNN,7April2016http://edition.cnn.com/2016/04/07/politics/christopher-piehota-us-intel-europe-terror-tracking/index.html,retrieved10April2016.

23


enteringaredoingsowithoutbeing identified.Thus,simplysharingPNRdatamaynotproveaseffectiveasithasintheUS.ThedecentralisedframeworkofprocessingPNRdata,asestablishedbythe“newEUinstrument”,alsoofferscertainlimitationsintermsofthenon-uniformwayinwhichdatawillbeprocessed,storedandexchangedwithinandbetween28differentnationalarrangements.Assuch,anopportunitywaslosttointroduceamorecoherent,centralisedarchitectureintheEU.

4.3.3. SpeedAlthoughtechnicallypossible,sharingamongEUandtransatlanticalliescanbeslowandrestricted,which represents another obstacle to operationalisation. One possible explanation for this is the EU MS’ varied ability to respond effectively and in a coordinated fashion to operational intelligence. GivenISIL’stempoofoperations,inthecurrentarchitecture,bythetimeapieceofintelligencehadbeenclearedforsharing,thensharedbilaterally,itcanbetoolate.UnlikeintheColdWar,inwhichmostofEurope’sintelligenceservicesweredesignedtooperate,therequiredtempoofinformationfusionandspeedofreactionismuchhighertoday.IntheColdWar,intelligencewasseparatefromreaction;nowitgoesoutofdateinhours.Thespeedofreaction, intermsof intelligenceandCTresponse,isnowcriticaltosavinglives.Interoperabilityisthereforekey.Moreover,statesprefertoshareapieceofintelligencemultipletimesbilaterallythaninonesinglemultilateralrelease,leadingto the situation where those excluded could have vital pieces of relevant information but are not awareofit.Hence,anyeffectivesolutiontotheproblemofsharingwillnotbebasedonanequalshare for all. The core of any future transatlantic intelligence liaison will therefore be limited numbers and common standards that are conducive to increasing common trust. A more positive outlook is emergingatEuropol,however,asitdevelopsintoanincreasinglyeffectivetransatlanticinformationsharinghub,involvingEUMemberStatesand(todate)12federalagencies.

4.3.4. Political Will and Decision MakingPolitical will and decision makers’ understanding of CT challenges are fundamental to the effective operationalisationofpersonaldataandintelligence.Following9/11,USpractitionersandpolicymakerstaskedwithCTbriefedthePresidenteverydayonmajorthreats,asdidtheirBritishcounterparts.Theseregularupdatesmadetheleadersfocusontheissuesofsecurityandterrorismmore,because“knowing” made them feel responsible.57 Former high-ranking intelligence policymakers interviewed for this report agree that regular briefingsof politiciansonCTchallengesareof essence.They,however,advocateforalessfrequent,albeitregular,briefingscheduleoutsideoftimeofmajorcrisisas that of 9/11 or the 2005 London bombings. The responsibility of policymakers’ to understand the nature of threat and the work of their intelligence apparatus is crucial to the latter’s work. For instance,accordingtoreports,Belgiumhadaskedforanincreasedintelligencebudgetafter9/11butthiswasrejected.IntheNetherlandsaboutone-thirdofthebudgetfortheGeneralSecurityandIntelligenceservicewascutin2012.Inbothcountries,thiswastheresultofadisengagedpoliticalculture.58

To reinvigorate thepolitical ownershipof the responsibility to combat terrorism, citizens canusethe fact that the Lisbon Treaty states security is the responsibility of MS to pressure states which represent “the weakest link”. This national responsibility which extends to intelligence can now be usedtopointatMSandtellthemthattheyneedtoreformtheirpractises,legislation,andengageintraining to adopt new 21st century standards. Weaker nations need to be encouraged at the political levelandtoseegreaterliaisonasequatedtosharedcommonborderswithintheEU,andgreatertransatlantic cooperation.According to aministry of interior representative of an EUMS, someEuropean countries will simply not share or improve their capabilities unless they are forced to by external political pressure.

57 Roundtable,15April2016. 58Roundtable,15April2016.

24


4.3.5. The Politics of CT Intelligence ReformMoreover,therearediscrepanciesinEuropeannations’attitudetowardsCTreforms,whichwouldencompass changes within the realm of intelligence as well as law enforcement. A senior European intelligence official recently stated that while some nations have pushed for the EU to take theleadonthesystematicreformofintelligenceoperations,andinparticularintelligenceliaison,theyhavehadtheir“knuckleswrapped”byanothermajorEuropeannationunhappyaboutsharingCTintelligence in a multilateral environment.59 This has forced a re-assessment of what is currently politicallypossible in this regard,and thedilutionofcurrentproposals.TherearesimilarpoliticaldivideswithintheEUitself.TheEUCommission,ledbyPresidentJean-ClaudeJunker,isdrivingforwardwithplanstobetterintegrateEUintelligenceliaison,asevidencedbyitsrecentinformationsharing roadmap and Junker’s September speech calling closer EU cooperation on defence and security. However, theEUCouncil, which directly representsMS governments and their interiorministries,remainsfarmorecircumspectaboutsuchproposals.Assuch,therearepoliticalfaultlinespreventing better integration both between EU MS and within the EU itself.

4.3.6. Transnational Threat and Risk Assessment DeficitFinally,Europeanandtransatlanticintelligenceandlawenforcementagenciesneedtoknowwhattheyareupagainst,intheshort,medium,aswellasthelongterm.AtransnationalCTstrategicthreatand risk assessment is necessary for identifying gaps and problems of how agencies operate and cooperate.Theseassessmentsarecriticalforprioritisingthreats,generatingeffectiveCTstrategies,andfocusingeffortandallocatingresources to fulfil thesestrategies.Remarkably,according toaseniorEuropeanlawenforcementofficial, inthemidstofthecurrentsurgeinterroristactivity,theEU has not invested in producing such an assessment. This seems to be largely caused by the lack ofcoordinationat thetopof theEU.Todate, it isunclearwhethersuchassessmentshavebeenconsideredorcommissionedbyotherexistinginternationalnetworks,suchastheCdB’sCTGroup.

59 Interview,17August2016.

25


Intelligence challenges related to CT are profuse and some are not easy to tackle within the short-midterm timeframe. Hence, in the following section, this report discusses a number of existingintelligencemodelswhichhavebeensuccessful,couldbeused to tackleCTchallenges,andbeexportedfromthenationaltothetransnationallevel.Moreover,italsodetailssomeofthewaysthesemodelscouldbeusedtofightthecurrentwaveofterrorisminthetransatlanticspace.

This paper takes the position that the reform of current intelligence architecture and practises from the bottom-up is the most pragmatic approach. While we are aware of the work being undertaken by theEUCommissionon its InformationExchangeRoadmapof6June2016,andbyEuropol,tobetter integrateCTefforts,anumberofcomplementarysuggestions forpractical improvementare examined below.60 Within this process the distinction should be made between the three forms of intelligence: strategic (which is less sensitive and routinely shared); operational (more sensitive and therefore less frequently shared); and tactical (which is the most sensitive and currently mainly sharedbetweenFiveEyesPlusonaregularbasis,andwithothersintheaftermathofanincidentor on an ad hoc basis). While appreciating that there are other – strategic – seams in the current Europeanandtransatlanticintelligencearchitecturecrucialtolongtermsecurity,thefollowingsectionfocuses on selected short term CT tactical and operational solutions to the problems within the realm ofintelligenceandlawenforcementidentifiedbythisreport.

Inordertoreactwiththerequiredspeedandcoherencetomitigatethecurrentterroristthreat,theGIRI Initiative proposes a set of practical improvements. Our aim is to uniformly raise capabilities inMSandbeyond,andtopromotemoreefficientanalysisandsharing.Theserecommendationsaredesignedtotreatsomeofthekeyproblemsidentifiedabove.Theyarepredominantlybasedonexistingmodelsproventobeeffective,butalsopresentnovelsolutions,especiallyintermsofCTintelligence liaison.

5.1. Existing ModelsToday,many–butnotall–EuropeannationshavejointCTanalysiscentres.Oneoftheoldestsuchcentres is the United Kingdom’s Joint Terrorism Analysis Centre (JTAC). Established in 2003 and housedintheMI5’sheadquarters,JTAC’sroleistoanalyseandassessallintelligencerelevanttothecountry’sCTefforts–domesticallyaswellasabroad.Inadditiontosettingthreatlevels,JTACproduces substantive analysis on various terrorist networks and their capabilities. Its strength lies in itscapacity to integrateCTexpertise from16relevantgovernmentdepartments, including lawenforcement and the country’s intelligence agencies, to jointly analyse and processCT-relevantinformation. The Centre’s head reports to the Director General of MI5 who reports on JTAC’s activities to the government’s Joint IntelligenceCommittee (JIC). Its efficiency and quality of itsassessmentsaremonitoredbyanofficialOversightBoard,chairedbytheCabinetOffice.61Similarly,whenScotlandcreatedits“CrimeCampus”,sixagenciesco-located,collaboratedandcoordinatedtheir intelligence, resources and trainingwhich led to significant improvements acrossScotland.Verysoonthenumberofagenciesgrewto16asthoseoutsidethe“club”sawtheobviousbenefitsofjoining;individuallytheyweregoodbutcollectivelytheywereevenmoreeffective.

Another suchmodel in place today is theDutch joint intelligenceanalysis centre knownasTheNetherlandsCounterterrorism InformationBox,orCT Infobox.Establishedafter the2004Madridbombings,theCTInfoboxisafusioncentrehousingelementsoftenDutchagencies,includingthe

60 “Roadmap to enhance information exchange and information management including interoperability solutions in the Justice and HomeAffairsarea”,Council of the European Union,6June2016http://statewatch.org/news/2016/jun/eu-council-info-exchange-interop-erability-roadmap-9368-rev1-6-6-16.pdf,retrieved11October2016. 61JointTerrorismAnalysisCentre”,https://www.mi5.gov.uk/joint-terrorism-analysis-centre,retrieved11October2016.

5. Recommended Reforms

26


prosecutor’soffice,police,securityandimmigration,intelligence,financialcrime,and,innovatively,socialwelfareservices.AllCTInfoboxpersonnelworkonthesamecorridor,aresubjecttothesamelevel of screening as well as the same security regime. The CT Infobox is not a direct information exchangeplatformbetweenparticipatingbodies,meaning that informationsharedheredoesnotleavetheCTInfoboxandflowbacktotheindividualservices’headquarters.Infact,itcouldratherbedescribedasasafespace,ora“closedbox”,whichenablestheparticipatingpartiestoshareinformationin-house,conductjoint-multidisciplinaryanalysisofsuspectsandsubsequentlyformulatejointrecommendationsonhowaparticularsuspectshouldbedealtwith.Theserecommendationsare passed onto the relevant organisations and they are ‘advised’ to act on it and speak with other agencies on certain cases. The Infobox monitors whether its recommendations are implemented andiftheyarenot,itisreadytoconsideralternativeapproaches.Crucially,whenputtingsuspectsonitslist,itfollowsso-called“placementcriteria”andif,forinstanceovertime,thesubjectceasestofulfilthese,theyare“de-listed”fromtheCTInfobox’slist.AMarch2015assessmentoftheCTInfobox’s success found the mechanism particularly helpful in terms of its ability to: processes data quicklyandefficiently;andconductcomprehensiveassessments,basedonvariousviewpointsandexpertise,ofinformation.TheseareallareasidentifiedaboveasproblematicwithintheEuropeanand transatlantic CT intelligence context.62

TheCT Infobox is ledby theHeadof theCT Infobox. ItsCoordinatingBoard,whichconsistsofoneboard-levelrepresentativefromeachoftheparticipatingbodies,isinchargeofstrategy,policyissues and oversight.63 Its work is overseen by a three-person steering board that reports on an annualbasis,with theCT Infobox’shead reporting to itonaquarterlybasis.Thesteeringboardactsasawatchdogespeciallyintermsofprivacylegislation,althoughinrealitythepresenceoftheprosecutor’sofficeintheInfobox,andtheexperienceoftheInfobox’sleader,meanstheyrarelyhaveto take action in this regard.

Inpractice,theprocessisthefollowing.AstheCTInfoboxdoesnothaveacentraldatabase,eachrepresentative to the Infobox manages and controls information from his/her mother service. They alsoremainthedataownerforallinformationplacedintheCTInfobox.Hence,whenaninvestigationbegins,eachrepresentativelooksforrelevantinformationonthesubjectwithintheirhomesystems.Relevant informationobtained from thesehomechannels is thenput intoan “in-house system”,available to all Box personnel to access as well as update. This pooling of relevant information into one system helps create a coherent picture of the subject, carry out a comprehensive riskassessment, and propose adequate actions aimed at mitigating the threat. Data in the systemcancontain informationonsources,ornot,according to thedataowner’sdiscretion.Crucially, ifany agency wants to extract information from the Infobox it must ask the data owner’s permission. Althoughithasneveroccurred,anytransgressionwouldresultintheoffenderbeingremovedfromtheInfobox.Accordingtothe2015assessment,“thechosensystemofcommunicationrevealspossibleresponses which might not have been devised had the underlying information only been viewed from asingleperspective…creativethinkingwillresultinnovelformsofintervention.”64Notably,havingbeen inexistence for12 years, andwith staff serving four-year termsat a time, theCT Infoboxhas developed such high levels of inter-agency trust that a single permanent database using the informationintheInfoboxisnowinoperation,allowinguserstotrackhistoricalrecordsofrelevantcases.However,atpresenttheCTInfoboxitselfhasnoformalliaisonwithEuropolortheCdB,asthis is usually the responsibility of each service.

At the national level, another successful CT hub has been Scotland’s Strategic Multi-AgencyResponse Team (SMART). SMART is a multiagency forum for the mutual exchange of intelligence leading to the creation of a number of products, varying from strategicmulti-agency threat and

62 dePoot,C.J.andFlight,S.(2015),Ruimte om te delen. De CT Infobox tien jaar in werking,TheHague,MinisterievanVeiligheidenJustitie,p.76-85.63 Ibid. 64 Ibid.

27


riskassessmentstooperational“PreventProfessionalConcerns”,whereanindividualofconcernisdiscussedandanactionplan formulatedand ledby themostappropriateagency. Inaddition,aCurrent, Emerging andResidualThreatAssessmentwas completed for each of the 32 LocalAuthorityAreasinformingthemofthetransnational,national,andmoreimportantly,localthreatsandrisks.Thisallowedtheauthoritiestobriefandeducatetheiremployeesastowhattolookfor,allowinghundreds of thousands of people to know and understand the threats in their communities. This in turn allowedthemtoidentify,harvestanddisseminateintelligence/informationwhichultimatelymonitoredcommunity tensions and matters out of the ordinary. It is accepted that not all this will develop into CTintelligencebutitservedtodeliverconfidencethatthestaterecognisedthatcommunities’healthis important and that it wants to identify vulnerabilities prior to exploitation by those who would seek to take advantage.

Couldthesemodelsworkatthetransnationallevel?AccordingtoanassessmentoftheCTInfobox,oneofthemostprominentreasonsforthesemodels’efficiencyisthecommonunderstandingoftheseverity of the terrorist threat among all parties and their willingness to contribute to this common goalevenifthisdoesnotresult innewgainsforeachparticipatingservice.Whilequalityofdata,standardisation and professional capacity would all pose initial issues in adapting a CT Infobox to the transnationallevel,itsbasicprinciplesofdataownership,separatedsystems,andoversight,whichareallconducivetoslowlydevelopingtrust,seemespeciallyimportant.Crucially,itallowsaccesstomore relevant information,and thepenalty for transgressions is removal,with itsownpoliticalconsequences.Moreover,ideally,atransnationalCTInfoboxwouldneedahit-no-hitsinglesearchinterface with both Europol and CdB databases.

5.2. Recommendation 1: CORE TRANSATLANTIC CT HUB AND TASK FORCESThe Initiative does not propose the establishment of new institutions. Yet, it does advocate forcreating/strengthening existing networks and task forces which would enable better CT coordination through a perception of shared threat and the development of mutual trust.

5.2.1. Core Transatlantic CT HubWe recognise that “the best of the bilateral relationships work very well; the worst don’t work at all.”65 The first proposal calls for the establishment of amore permanent CoreTransatlantic Counter-TerrorismHub,initiallyconsistingofacoregroupofnationswhichhavehighintelligenceandlawenforcement capabilities and are willing to share multilaterally on a routine basis.66 This would initially need to be based around nations with high degrees of trust and the political appetite to share large amountsofsensitiveinformation.Unliketheso-called“AllianceBase”,apublicallyunacknowledgedWestern Counterterrorist Intelligence Centre (CTIC) based in Paris operating between 2002 and 2009,theCTHub’semphasiswouldbeonCTliaisonandsettingcommonstandards.

Following the successfulmodels discussed above, the proposedCoreCTHubwould representthefirststeptowardsasecurespaceto linkexistingnationalCTcentres fromEuropeandNorthAmerica.IntheEU,theECTCatEuropolandtheCTGshouldbeinvolved.Moreover,thefoundingmemberswoulddevelopcommondefinitions/procedures foralertingand threatwarning,secrecyandcapabilityrequirements.Thesuccessofthiscore,andtheaccesstoinformationwithinit,wouldencouragelesscapableand/orwillingnationstoimprovetheirservicesinordertojoin.Forexample,aUS-UKCThubcouldformthenucleiaroundwhichothernationssuchasFrance,Germany,the

65 Comments,formerintelligenceagencychief,3October2016. 66 Interview,16April2016.

28


NetherlandsandItalycouldjoiniftheycommittoappropriateinvestmentandstandards.Whilethisprocessislikelytobegradual,itwouldpotentiallycreatepoliticalpressureandincentivesforbetterintelligence capabilities across Europe and the transatlantic space.

Inadditiontosharingintelligence,thisCoreCTHubcouldserveasahubformoreintensesharedanalyticefforts.ForthosetransatlanticpartnerswhoareyettoestablishjointCTcentresorareinneedof reforming theirexistingCT frameworks,anumberofmodelscouldserveasa template.Ultimately,however,nationsmustchoosethemodelthatsuitsthembest.

Finally, a joint transatlanticCTStrategicThreat andRiskAssessment (STRA) could be createdbased on the fusion of intelligence from invested member states. Such an assessment would assist ininformingpoliticiansandpractitionersofthecollectiveknownsand,insodoing,identifythemostpressinggapsandproblems.Oncethe“knowns”aswellasthe“unknowns”havebeenidentifiedandunderstood,theCTHubwillbeequippedtocreateandpushtheirmemberstoadoptadequateintelligencerequirements,tofillthosegaps.Inessence,theSTRAwouldbeastrategic,longterm,forward-lookingdocumentthatidentifies,assessesandprioritisesthethreats,risksandopportunitiesfacing intelligence and law enforcement agencies in the CT domain. It would present and interpret thefindingsofintelligence/informationanalysis,setprioritiesandallowrelevantstakeholdersinCTHub member states to understand terrorist trends and how these impact relevant agencies. Such an assessment would also drive the tactical and operational response though multi-agency tasking and coordinating.This,initself,wouldcontinuetoenhancetrustthoughoperationalrelationships.

5.2.2. Case-Based Task Forces Onamoreoperationallevel,GIRIrecommendsthatCase-BasedTaskForcesbesetupwithintheHub,designed to reactadhoc toemergingCTchallenges.Such task forcesmightbesetup toaddressoperationalissuesrelatedtoaparticularterroristgroup,beital-Qa’idaorISIL;oranissue,suchasradicalisation,terroristrecruitment,tonamebutafew.Suchtaskforceswouldpromotejointexecutionofintelligence-ledoperationsaswellasthebettersharingofpersonaldata,asiscurrentlybeingdonethroughEuropol.Taskforceswouldfollowthefusioncentremodel,andwouldbebasedonvoluntaryentrywhereMSwithspecificinterestsineachcasecouldrequesttojoin.Thesmallernumbers of MS who share the same concerns would be more conducive to trust. Once given the requisiteclearance,thesefunctionalgroupswouldhavetheabilitytorapidlysharemultilaterallyandbe highly connected to the relevant law enforcement and CT agencies in their respective countries. Informationwouldthereforeflowbothwaysandberapidlysharedwithinthetaskforce.Forexample,a counter-ISIL group consisting of member states who have opted-in would help centralise responses and, if successful, begin toactasabenchmark forothers tacklingother intelligence issuesandsharing.Thesetask forcescould forma joint investigativeunithostedbyoneof theparticipatingnations.

5.3. Recommendation 2: SINGLE SEARCH INTERFACESThe GIRI Initiative calls for a single search interface to enable real time information exchange that wouldinturnencouragebilateralco-operationandtrust.Asdiscussedpreviously,manynationsarescepticalofmultilateralpersonaldataandespeciallyCTintelligencesharingplatforms,beitwithintheEUorbeyond.Hence,GIRIproposesatransatlanticversionofEuropol’sFinancialIntelligenceUnit(FIU)model,whereeachnationholdsitsdatabutencryptedsearchingidentifiesinformationorpatterns to follow-up.

Although there are suggestions that all-EU terrorist watch list could soon be set up within one of thecontinent’sexisting intelligencestructures, resistance to thisdevelopmentcouldbeofsimilarmagnitude to that seen in the case of sharing PNR data.67Hence,amodelbasedontheFIU,whichprotectssourcedataandyetallowsusers toreachout topartnersandfollow-upon leads,could

67 Interview,7March2016.

29


be a welcome, workable solution. We understand Europol is currently developing an integrated model of the FIU system, based on identifying data connections through a secure portal of source anonymisations.

Such a hit-no-hit search function would begin as a standard platform for sharing basic structured data, such as PNR, criminal history, travel, and immigration information. This could engage a wider group of countries very quickly. The mid-term aim would be, however, to technical solutions to create a capability for searching through unstructured data in an encrypted form.

5.4. Recommendation 3: TRANSATLANTIC CT CENTRE OF EXCELLENCEThere are a number of multilateral intelligence education courses in existence that provide useful examples for a CT Centre of Excellence (CoE). For example, the EU’s Agency for Law Enforcement Training (CEPOL), in liaison with Europol, runs short courses and exchanges for border and police forces. The courses, many of which are delivered online, mainly focus on criminality, but some cover operational intelligence analysis. Meanwhile, NATO’s HUMINT Centre of Excellence, based in Romania, provides another potential blueprint for the CT CoE. The CoE runs HUMINT courses and promotes best practice amongst its nine MS members. It evolved out of a recognition amongst some NATO MS that they lacked HUMINT capacity on military operations. As a result, in 2009

MS initially joined the CoE; in 2010/11 another three followed suit, and in 2013 the US also joined, indicating the of the voluntary, ad hoc approach to intelligence training. Moreover, the Five Eyes’ “Leadership in Counter Terrorism” (LinCT) programme brings together law enforcement, military and security services from these nations informally. It is a basis for enhanced social relations and the cross fertilisation of ideas, thinking and experiences that build trust.

In order to uniformly raise capabilities and capacities of transatlantic partners, we recommend that a transatlantic CT Centre of Excellence (CoE) is eventually established. Crucially, the CoE, which would not necessarily launch as an institution but could initially coalesce around the transatlantic Core CT Hub or a focused Task Force, would bring empowered representatives from existing platforms and institutions together. Within this virtual network, best practises can be agreed, syllabuses and training material shared, and relevant courses introduced. The value of joint standardisation and training, which the CoE would design and run, would rest in bringing civilian and military, intelligence and law enforcement professionals together around CT issues and increase trust among participants and gradually their organisations. Once established, the CT CoE could work in concert or informally coordinate with the relevant EU and NATO bodies (which could also possibly provide as well as the CdB’s CTG. With its foundations in a shared perception of threat, and supported by strong political will, the CT CoE’s primary goal would be to build trust, mutual understanding and promote standardisation.

A number of nations have been improving their training and education of their analysts and investigators. One notable step forward in professional intelligence education has been undertaken in Norway, where the Norwegian foreign intelligence service has established an intelligence university. This runs a three year course to train its operators in the theory and practice of intelligence, language, area studies, standardisation, operational analysis and techniques. One of the university’s innovations has been the introduction of a short course specifically designed to inform senior politicians and decision makers about what intelligence can and cannot do, and what should be expected of intelligence agencies. In the Netherlands and Sweden there are comparable initiatives. The US also runs its National Intelligence University to accredit security personnel and allow them to study classified/top secret subjects. Other areas that have proven useful is the involvement of specialised academics in wider critical thinking on open source intelligence and security issues, such as what is the West’s ISIL end game?

30


Werecommend thatstandardisation isakeycompetencyofanyCTCoE. Inparticular,commonterminology is needed throughout the intelligence cycle for the understanding and prioritisation of threats, faster analysis and dissemination, and compatible standards for assessing information/intelligence.TheBrusselsandParisattacksalsorevealedtheneedforcommondataentryprocedures,especiallyintermsofArabicnames.Atabroaderlevel,theCoEcouldprovidebenchmarkingofMS’intelligencecapabilitiesinordertoallowentryintoanycoretaskforcessuchasthatoutlinedabove,whilst also encouraging best practice in intelligence oversight and liaison.

AfurtherkeycompetencyoftheCTCoEshouldbetraining.Numerousexpertshaveidentifiedthatthereneedstobestrongpoliticalwilltoaddresskeygapsinthecurrentintelligencearchitecture,andthattheymustbestaffedandattendingby“Agrade”intelligenceofficersiftheyaretobecredible.CTCoEtrainingshouldfocusonbestpractisesandshouldtargetcollectors,analysts,anddecisionmakers. It could also be used to address emerging technologies and the EU could contribute funding for its members.

Withintheciviliansphere,thecloserinvolvementoftheprivateandthird(voluntary)sectorsshouldalso be considered. The private sector can bring great insight into technology and the internet of things;technologyitselfisnotaproblem,buttheoperationalisingandunderstandingofthattechnologycanbe.Inaddition,manyvoluntaryorganisationsalreadyhaveacloseinterfacewithhardtoreachcommunities through their enhanced social relations over many years. This trust is a huge enabler and can assist in mitigating potential threats prior to them being exploited and indeed coming into thejusticesystem,whichinitselfincreasescapacityandcapabilities.Theseorganisationsonlyknowwhattheyknowandifbetterequippedtheycouldbevaluableresources.Similarly,theCTCoEcouldbe used to reach out to mental health services to better integrate them into CT efforts.

Viaitsactivities,theCoEwouldaimtopromotetheenhancedsecuritycultureofpartneragencieswhichcanenhancetrustandinformationsecurity,identifiedasakeyproblemthroughthisreport.Theintegrationofprocessesandthepersonaldata/intelligenceexchangearenecessarytoprogress,butwill only happen if the donor of that information has belief that the recipient is taking steps to protect that information. A strong security culture is hence the backbone of organisational resilience and the CoE’s member states would be encouraged to promote and develop a positive organisational and securityculture,whichwillinturnleadtoapositivechangeinorganisational-relatedbehaviourbystaff. This can result in enhanced organisational resilience and increased employee engagement; reduced risk and vulnerability; reduction in theft of materials or MS information; reduced risk of reputationalorfinancialdamage;low-costinterventionsandimprovedorganisationalperformance.

31


This paper has drawn on the vast experience of senior and tactical intelligence and law enforcement officialsfromacrossEuropeandNorthAmerica.IthasclearlyshownthattheSalafistjihadistthreathasevolvedrapidly.Since2014,increasingnumbersofsmall,informaloverlappingnetworksofviolentextremists have conducted both sophisticated and crude terrorist attacks across the transatlantic space.Crucially,thesenetworksareincreasinglyblendingcriminalitywithterroristintent.AndgiventheintentofISILandal-Qa’idatotargetEuropeandNorthAmerica,thisthreatislikelytoendureforsometimetocome.Moreover,therecentattackshavealreadyexposedsomenations’inabilitytoeffectivelyintegratetheirCTintelligenceandlawenforcementfunctions,andissuesofcapabilityandcapacitywithinthesefunctions.Atthetransnationallevel,despitethegoodprogressmadebyEuropolandInterpolinintegratingCTlawenforcement,andbytheCdBintermsofCTintelligence,thereiscertainlypotentialforbetterliaison,bothwithinthesefunctionsandbetweenthem.Ofcourse,trustremainscriticaltoincreasingliaison.Buildingonbestpractisesandexistingnetworks,wehaveshown how a Core Transatlantic CT Hub and Case-Based Task Forces could begin to develop trust and set standards for CT intelligence liaison. It would also generate transnational multi-agency CT security and risk assessments. The better integration of hit-no-hit single search interfaces that use existing information safeguarding technologies to link existing databases is another area where CTliaisoncapacity,andhenceoperationalcapability,canbeincreasedrelativelyeasily.Tofurtherencouragestandardisation,trust,bestpractisesandpoliticalinvolvement,aCTCentreofExcellence– initially organic to the Core Transatlantic CT Hub – should also be considered.

Theserecommendationsofferreal-world,practicalsolutionstobeginaddressingtheseamsinthetransatlanticsecurityarchitecturethatjihadistshaveexploitedtoincurover1,000civiliancasualtiessince2014.Aswehaveshown,manyofthesecasualtiescouldhavebeenpreventedthroughbestpractisesandbetterliaison.Thus,civiliansacrossthetransatlanticspacehavetherighttodemandactionontheseissues,andpolicymakersthedutytorespond.Politicalwilliscrucialtothesuccessof these proposals, butwe argue that now is the time to adapt. For its part,GIRIwill continuetoworkwithin itsexpandingnetwork topromote this report’sproposedsolutions. Inparticular, inpartnership with industry it will strive to incorporate existing technological solutions to better integrate transatlantic intelligence and law enforcement in a secure and anonymous manner. It will continue to promotetrust,standardisationandcollectivetrainingthroughcontinuedengagementwithacademiaandtherelevantlawenforcementandintelligenceorganisations.Finally,GIRIwillaimtopromotegreater transparencyandoversightofCTactivities,andgreaterpublicawarenessabouthowtheintelligence and security agencies support public safety. Intelligence in some nations is often still viewedaspartofthe“deepstate”andthereforenottalkedaboutinpublicdiscourse.YetastheruleoflawiscentraltoCTefforts,governmentsmustdomoretoexplainthereasonsforneededchangestolegislation.Indeed,GIRIwillcontinuetoexplorethepossibilityofatransatlanticsummitbetweenNorth American and European nations to take these and other proposals forward.

6. Conclusion

32


Honorary Steering Committee:Hon. Michael Chertoff (Chair), formerSecretary ofUSDepartment forHomelandSecurity, co-founder and Chairman of The Chertoff Group.

Hon. Carl Bildt,formerPrimeMinisteroftheKingdomofSweden.

John, Baron Reid of Cardowan,formerHomeandDefenceSecretary,MemberoftheHouseofLords.

Dr. August Hanning,formerStateSecretaryintheFederalInteriorMinistryoftheFederalRepublicof Germany and Director of the Federal Intelligence Service (BND).

Research Team: Daniela Richterova,PoliticsandInternationalStudies,UniversityofWarwick.

Patrick Bury,StrategyandSecurityInstitute,UniversityofExeter.

Advisors to the GIRI Initiative:Dr. Cees Wiebes, intelligence scholar and former senior analyst at the Expertise & AnalysisDepartmentattheOfficeoftheNationalCoordinatorforCounter-Terrorism(NCTb)intheNetherlands.

Professor Sir David Omand GCB,VisitingProfessor,DepartmentofWarStudies,King’sCollegeLondon and former Director of the Government Communications Headquarters (GCHQ).

Honorary Justice Jean-Louis Bruguière,AntiterrorismExpert,CouncilofEurope,Paris.

Jean-Baptiste Carpentier,HeadoftheStrategicIntelligenceandEconomicSecurityUnit,Paris.

Dr. Kjetil Anders Hatlebrekke, Associate Professor of Intelligence, The Norwegian DefenceIntelligenceUniversityCollege,andSeniorVisitingResearchFellow,DepartmentofWarStudies,King’s College London.

Dr. Hans Wegmüeller,formerDirectoroftheSwissIntelligenceService.

John Cuddihy,formerDetectiveChiefSuperintendent,PoliceScotland,VisitingPracticeFellowatCoventry University.

Dr. Frank Foley, Counterterrorism and Intelligence Expert, Department of War Studies, King’sCollege London.

Prof. Shlomo Shpiro,Director-DivisionofIntelligenceandHomelandSecurity,Bar-IlanUniversity,Tel Aviv.

Dr. David Murphy,LecturerinStrategyandMilitaryHistory,NationalUniversityofIreland,Maynooth.

Brig. Gen. Ephraim Lapid,formerseniormilitaryintelligenceofficerandspokespersonoftheIsraelDefense Forces (I.D.F).

Henry Plater-Zyberk,formerUKMinistryofDefence’sConflictStudiesResearchCentre(CSRC),Prague.

GLOBSEC Policy InstituteKlariská 14

811 03 BratislavaSlovak Republic

[email protected]

table of contents - globsec · globsec intelligence reform initiative we recognise that while the...

Documents