The Jihadist Threat and Grassroots Defense

FROM STRATFOR

The Jihadist Threat and Grassroots Defense
August 13, 2008


Graphic for Terrorism Intelligence Report

By Fred Burton and Scott Stewart
Related Links

* The Devolution of Al Qaeda
* Terrorist Attack Cycle
* Surveillance and Countersurveillance

It has been a rough couple of weeks for the Egyptian al Qaeda contingent in Pakistan. On Aug. 12, Pakistani security sources confirmed that an Aug. 8 operation in Bajaur resulted in the death of al Qaeda leader Mustafa Abu al-Yazid, aka Sheikh Said al-Masri. Some posters on jihadist message boards have denied the reports, but al Qaeda itself has yet to release a statement on the issue. Al-Yazid was reportedly al Qaeda’s operational commander for Afghanistan, and some reports also claim he was responsible for planning attacks within Pakistan, such as the June 2 attack on the Danish Embassy.

If confirmed, al-Yazid’s death came just 11 days after the July 28 missile strike in South Waziristan that resulted in the death of al Qaeda’s lead chemical and biological weapons expert, Midhat Mursi al-Sayid Umar, also known as Abu Khabab al-Masri. The strike against al-Sayid also killed three other Egyptian al Qaeda commanders. In an ironic twist, the official al Qaeda eulogy for al-Sayid and his companions was given by al-Yazid.

Unconfirmed rumors also have swirled since the July 28 attack that al Qaeda No. 2 Ayman al-Zawahiri was either killed or seriously wounded in the same operation. An audiotape in which al-Zawahiri speaks out against Pakistani President Pervez Musharraf was recently released in an odd manner, in that it was given directly to a Pakistani news channel rather than via al Qaeda’s usual release pattern of having As-Sahab Media upload it directly to the Internet. The tape, in which al-Zawahiri speaks in English for the first time in a public pronouncement, is not convincing proof that al-Zawahiri was not wounded or killed. Obviously, al-Zawahiri’s loss would be another serious blow to the organization.

Al Qaeda’s current problems are nothing new. In fact, the United States and its allies have been attacking al Qaeda’s operational infrastructure consistently since 9/11. While the United States has not yet located and killed the al Qaeda apex leadership, it has done a very good job of eliminating senior operational commanders — the men in the al Qaeda hierarchy who actually plan and direct the militant Islamist group’s operations. The nature of their position means the operational commanders must have more contact with the outside world, and therefore become more vulnerable to being located and killed or captured.

Because of this campaign against al Qaeda’s operational infrastructure, Stratfor has been saying for some time now that we do not believe the core al Qaeda group poses a strategic threat to the U.S. homeland. However, that does not mean that the United States is completely free of danger when it comes to the jihadist threat. While the core al Qaeda group has been damaged, it still poses a tactical threat — and still can kill people. Furthermore, as the jihadist threat has devolved from one based primarily on al Qaeda the organization to one based on al Qaeda the movement, al Qaeda’s regional franchises and a nebulous array of grassroots jihadists must also be accounted for.

With al Qaeda’s operational structure under continued attack and the fact that there are no regional franchises in the Western Hemisphere, perhaps the most pressing jihadist threat to the U.S. homeland at the present time stems from grassroots jihadists.
Beyond the Cliches

There are many cliches used to describe grassroots jihadists. As we have long discussed, grassroots operatives tend to think globally and act locally — meaning they tend to be inspired by events abroad and yet strike close to home. Additionally, these operatives tend to be a mile wide but an inch deep — meaning that while there are many of them, they are often quite inept at terrorist tradecraft. These cliches are not just cute; they have a sound basis in reality, as a study of grassroots jihadists demonstrates.

There are two basic operational models that involve grassroots jihadists. The first operational model is one where an experienced operational commander is sent from the core al Qaeda group to assist the local grassroots cell. This is what we refer to as the “al Qaeda 1.0 operational model” since it literally is the first one we became familiar with. We saw this model used in many early jihadist operations, such as the 1993 World Trade Center bombing and the 1998 U.S. Embassy bombings in East Africa. It has also been employed in a number of thwarted plots, such as Operation Bojinka in 1995 and the millennium plots in 2000. This model also was used in the thwarted 2006 Heathrow airliner plot.

The second grassroots operational model involves operatives who launch attacks themselves without external funding or direct operational guidance. This is what we refer to as the “al Qaeda 3.0 operational model.” Examples of attacks committed using this model include the November 1990 assassination of Rabbi Meir Kahane in New York, the July 21, 2005, London bombings, the July 2002 armed assault of the El Al Airlines ticket counter at Los Angeles International Airport and the botched June 2007 bombing attacks in London and Glasgow.

Something of a gray area exists around the borders of these two operational models, and at times it can be difficult to distinguish one from the other. For example, Mohammed Siddique Khan, the leader of the cell that carried out the July 7, 2005, London suicide bombings, had attended training camps in Pakistan with another member of the cell. While there, he had at least some contact with al Qaeda, since al Qaeda released a copy of the martyrdom videos the two made during their time in Pakistan.

Notably, these attacks show that most of these grassroots jihadists, whether as part of a 1.0 or a 3.0 structured cell, selected targets in close proximity to their place of residence. Even when such cells have established safe houses to store chemicals, to manufacture improvised explosive mixtures or to construct improvised explosive devices, those safe houses quite often have been close to the target and the attacker’s residence. Grassroots jihadists really do think globally and act locally.

A second notable aspect of several of these attacks is that these operatives lack terrorist tradecraft such as operational security and surveillance techniques. Blunders in these areas have frequently led to the groups being identified and nabbed before they could launch their attacks. Plain old police traffic stops have exposed jihadist cells such as the Virginia Jihad Network and have helped to thwart several other terror plots.

Even when a grassroots group is able to execute its attack without detection, it often has been hampered by a lack of bomb-making skill. The failed July 21, 2005, London bombings and the June 2007 London and Glasgow attacks exemplify this flaw. Grassroots groups simply do not have the same level of training and operational experience as the professional operatives comprising the core al Qaeda group. Operationally, they are a mile wide and tend to be an inch deep.

Another consideration that comes to light while contemplating past grassroots cases is that lacking funding from al Qaeda core, grassroots operatives are likely to indulge in petty crimes such as credit card theft, cargo theft or armed robbery to fund their activities. For example, in July 2005, a grassroots cell in Torrance, Calif., was uncovered during an investigation into a string of armed robberies. After arresting one suspect, Levar Haney Washington, police who searched his apartment uncovered material indicating that Washington was part of a militant jihadist group planning to attack a number of targets in the Los Angeles area.

Truthfully, most grassroots operatives are far more likely to commit a criminal act such as document fraud or receiving stolen property than they are to have telephone conversations with Osama bin Laden. When they do commit such relatively minor crimes, it is local cops rather than some federal agency that will have the first interaction with them. This means that local police are an important piece of the counterterrorism defenses — they are, in essence, grassroots defenders.
Beyond Grassroots Jihadists

A recent study led by Brent Smith of the Terrorism Research Center at the University of Arkansas’ Fulbright College suggests that these trends extend beyond the grassroots jihadist threat. In a July article in the National Institute of Justice Journal, Smith noted that his research team studied 60 terrorist incidents in the United States over the past 25 years. The terrorist actors were from a cross-section of different ideological backgrounds, including domestic left-wing, domestic right-wing, domestic single-issue and international terrorists.

In the study, Smith and his colleagues identified the residences of 431 terrorist suspects and found that, overall, 44 percent of the attacks were conducted within 30 miles of the perpetrator’s place of residence and 51 percent were conducted within 90 miles of the residence. When broken down by type, the numbers were actually highest for international terrorists, with 59 percent of the suspects living within 30 miles of their target and 76 percent of the suspects residing within 90 miles.

Smith’s study also noted that many of the preparatory actions for the attacks occurred close to the attack site, with 65 percent of the environmental terrorists and 59 percent of the international terrorists studied conducting preparations for their attacks within 30 miles of their target sites. Of course, some preparatory actions, such as preoperational surveillance, by their very nature must be conducted within close proximity to the attack site. But still, the percentage of activity conducted near attack sites is noteworthy.

One other interesting result of Smith’s study was the timeline within which preparation for an attack was completed. For international groups, the preparation could take a year or more. But environmentalist and left-wing groups proved to be far more spontaneous, with a large portion of their preparation (88 and 91 percent, respectively) completed within two weeks of the attack. This means that prior to an attack, international terrorists are generally vulnerable to detection for far longer than are members of a domestic left-wing or environmentalist group.
Application

While there are always exceptions to the percentages, with people like Timothy McVeigh and Mohammed Atta traveling long distances to conduct preparatory acts and execute attacks, most people conducting terrorist attacks tend to operate in areas they are familiar with and environments they are comfortable in.

When we examine the spectrum of potential terrorist actors — from domestic people such as McVeigh and Eric Rudolph to international figures such as Mohammed Atta and Ahmed Ajaj — it is clear that a large number of them have had no prior interaction with federal law enforcement or intelligence officials and therefore no prior record identifying them as potential terrorism suspects. That means that even if they were stopped by a local police officer (as Atta was for driving without a license), any national-level checks would turn up negative. Because of this, it is extremely important for police officers and investigators to trust their instincts and follow up on hunches if a subject just doesn’t feel right. The Oklahoma state trooper who arrested McVeigh, the New Jersey state trooper who nabbed Yu Kikumura, or the rookie Murphy, N.C., officer who apprehended Eric Rudolph are all examples of cops who did this.

Of course, following your instincts is difficult to do when management is pressuring police officers and agents investigating cases such as document and financial fraud to close cases and not to drag them out by pursuing additional leads. Indeed, when Ahmed Ajaj was arrested in September 1992 for committing passport fraud, the case was quickly closed and authorities pretty much ignored that he had been transporting a large quantity of jihadist material, including bomb-making manuals and videos. Instead, he was sentenced to six months in jail for committing passport fraud and was then scheduled for deportation.

Had authorities taken the time to carefully review the materials in Ajaj’s briefcase, they would have found two boarding passes and two passports with exit stamps from Pakistan. Because of that oversight, no one noticed that Ajaj was traveling with a companion — a companion named Abdel Basit who entered the United States on a fraudulent Iraqi passport in the name Ramzi Yousef and who built the large truck-borne explosive device used in the 1993 World Trade Center bombing.

While many state and local departments have specialized intelligence or counterterrorism divisions, training on how to spot potential terrorist preparatory activity often does not go much further than those officers specifically assigned to the counterterrorism portfolio. In some jurisdictions, however, law enforcement managers not only give investigators the leeway to investigate potential terrorist activity, they also encourage their street officers to do so — and even provide training on how to identify such behavior.

In many jurisdictions, serious problems in information sharing persist. Much has been written about “the wall” that separated the FBI’s intelligence investigations from its criminal investigations and how that separation was detrimental to the U.S. government’s counterterrorism efforts prior to 9/11. The FBI is not the only place such a wall exists, however. In many state and local law enforcement departments, there is still a wide gulf separating the intelligence or counterterrorism division officers and the rest of the department. This means that information regarding cases that general crimes investigators are looking into — cases that very well could have a terrorism angle — does not make it to the officers working terrorism cases.

As the shift toward grassroots operatives continues, information pertaining to preparatory crimes will become even more critical. Identifying this activity and flagging it for follow-on investigation could mean the difference between a thwarted and a successful attack. As the grassroots threat emerges, the need for grassroots defense has never been greater.

Tell Stratfor What You Think

This report may be forwarded or republished on your website with attribution to www.stratfor.com
This analysis was just a fraction of what our Members enjoy, Click Here to start your Free Membership Trial Today!
If a friend forwarded this email to you, click here to join our mailing list for FREE intelligence and other special offers.
Please feel free to distribute this Intelligence Report to friends or repost to your Web site linking to www.stratfor.com.