Finding fault with security intelligence and law enforcement agencies and personnel is a bit of a sport, I find.
Second guessing and armchair quarterbacking seem to appeal to many who latch on to any mistake, real or perceived, to case aspersion on the efforts of those who are supposedly there to keep us safe. “What a bunch of dolts”, they say, “a veritable collection of Keystone Kops!”
Phil Gurski
Radicalisation and homegrown terrorism specialist
What where they thinking?
Where I do draw the line, however, is when the hoi polloi and ‘instant experts’ raise their voices in the wake of a terrorist attack when it turns out that the perpetrator was once on the ‘radar’ of security intelligence and/or law enforcement agencies but was dropped only to go on to commit an act of extremist violence. A recent example comes to us from Sweden where last April’s terrorist driver was being watched by SAEPO, the Swedish Police Security Service, only to have the investigation terminated three months before his attack on the Drottninggatan in Stockholm. What was SAEPO thinking? A lot closer to home we have the case of Aaron Driver, the Islamic State wannabe who was on a peace bond (a Canadian version of the UK’s control orders) and yet who made a martyrdom video as well as two (lousy) bombs but who was stopped only thanks to a tip-off to the RCMP by the FBI. What was the RCMP thinking?
Why would you stop looking at someone who clearly poses a threat to national security?
Any spy service or police force can launch an investigation (for the purposes of this blog I will limit myself to terrorism ones) if it has reasonable grounds to suspect or believe someone is involved in threat-related activities. Depending on what the initial investigation finds, the investigating agency can recruit and run human sources/agents, apply for a court warrant to monitor communications, carry out physical surveillance, and ask for help from other partners, both domestic and international. All of the information (intelligence or evidence) collected is analysed to determine what next steps, if any, are needed. In an ideal scenario the threat posed is clear, the data is robust and action is taken to ensure the subject does not succeed in doing what he is planning.
In the real world
The situation is, alas, seldom ideal. Information is almost always piecemeal, fragmented and often contradictory. There is never just one investigation at any given moment to consider but rather dozens (or hundreds if the organisation is large enough and the threat level is high enough). Each investigation demands resources and agencies are forced to re-evaluate all those efforts continually. Decisions are made based on what is known at a particular juncture and which threat is deemed to be more serious. Resources – whether they be investigators, surveillants, linguists or other support staff – are finite and people can only work so many hours in a day. As a result, some investigations are dropped.
All the algorithms, methodologies and theories out there are inadequate and always will be.
Most critically it is very rarely crystal clear just what a person of interest intends to do. In my experience every person we investigated while I was at CSIS ‘talked the talk’ (of violent extremism) but very few ‘walked the walk’ and ended up carrying out an attack (or planned to but were thankfully stopped before they could). Furthermore, all the algorithms and methodologies and theories out there on the relationship between radicalisation and mobilisation, as the transition is now called, are inadequate and always will be.
I am not saying that there are no useful indicators that have come out of good researchers armed with real data, but the bottom line is that no one can offer advice with any degree of certainty that person A is just a poser while person B is the real McCoy. There is far too much variability in human behaviour and decision making to allow for a foolproof diagnostic.
We cannot have it both ways
So, in the Swedish case SAEPO undoubtedly made the decision to stop investigating Rahmat Akilov in January 2017 because there were either higher priorities at that time or there was not enough information to warrant more work on his case. I find it ironic that many who chastise security and law enforcement agencies for not stopping every terrorist attack are also those who criticise those organisations for looking at people of interest in the first place, seeing their effort as some kind of violation of civil liberties. We cannot have it both ways: we either let our protectors do their jobs – and they will interdict the vast majority of plots although some will sneak through – or we don’t and more bad stuff happens. It’s up to all of us as citizens, taxpayers and voters to decide which is better. My money is squarely on the former, for what it is worth.
Why would you stop looking at someone who clearly poses a threat to national security and why aren’t these people simply arrested and put away?
Please leave your thoughts in the comment section below.
Phil Gurski
President and CEO of Borealis Threat and Risk Consulting. Phil worked as a strategic analyst in the Canadian intelligence community for over 30 years, including 15 at CSIS, with assignments at Public Safety Canada and the Ontario Provincial Police. He specializes in radicalization and homegrown Al Qaeda/Islamic State/Islamist-inspired extremism. borealisrisk@gmail.com