• National program to train individuals in public safety and the private sector to facilitate the flow of information from local to federal law enforcement operations
• Works closely with local fusion centers to serve as a “conduit through which homeland security and crime-related information flows from the field to the Fusion Center for assessment and analysis”
• May be a peace officer, firefighter, state investigator, federal agent, military investigative personnel, or anyone working closely within the public safety/homeland security community
• Reports on legal activities to secret government databases

The Terrorism Liaison Officer (TLO) is designed to be a nationally interconnected program of designated law enforcement officers, firefighters, military, and other first responders that attend an approved and accredited course of instruction. This shared learning experience prepares the TLOs to fill a specific role within their organization as a link or “liaison.”

As envisioned, the TLO was designed to not only liaison between various inter-departmental entities, but also with other law enforcement agencies. TLOs liaison with identified stakeholders and all other elements of the community. The TLO is a collaborator, a coordinator, and a conduit, an instructor and facilitator, a person with the answers to questions concerning terrorism and the resources to retrieve those answers if not immediately known.¹

The TLO program was initiated in California via the Commission on Peace Officer Standards and Training (POST) around 2005-2006 by a Anthony Lukin.  According to several proposals for the program, Fusion Centers in California “utilize the Terrorism Liaison Officer (TLO) Program to foster communication and collaboration amongst the fire service; law enforcement; the federal homeland security and intelligence communities and public safety stakeholders. The  TLOs serve as the conduit through which homeland security and crime-related information flows from the field to the Fusion Center for assessment and analysis. The network also serves as the vehicle to carry actionable intelligence from the Fusion Center to field personnel. This information flow provides for increased safety and security for fire department personnel as well as the communities served.” ²

Extent of the TLO Program

As of 2008 Colorado, California and Arizona were among the first states to deploy TLOs after establishing their own state-run fusion centers, which initially relied on tips from private citizens. Federal security agents now sit in 25 of those centers, including Colorado’s. Florida, Illinois, Tennessee, Wisconsin and Washington, D.C., also have deployed TLOs, and authorities in dozens of states are reportedly preparing to do so.

Contrary to the program’s self-representation as limited to law enforcement and first responder personnel, there are many members of the private sector who have also become TLOs.  In one solicitation from the Los Angeles Regional Terrorism Threat Analysis Center, a TLO is defined as “any peace officer, firefighter, state investigator, federal agent, military investigative personnel, or anyone working closely within the public safety/homeland security community, who has been properly certified by the appropriate Regional Terrorism Threat Assessment Center (RTTAC).”³  A 2008 article in the Denver Post stated that at least 181 TLOs existed in Colorado at the time and that their positions ranged from paramedics to “utility workers”:

Hundreds of police, firefighters, paramedics and even utility workers have been trained and recently dispatched as “Terrorism Liaison Officers” in Colorado and a handful of other states to hunt for “suspicious activity” — and are reporting their findings into secret government databases.

It’s a tactic intended to feed better data into terrorism early-warning systems and uncover intelligence that could help fight anti-U.S. forces. But the vague nature of the TLOs’ mission, and their focus on reporting both legal and illegal activity, has generated objections from privacy advocates and civil libertarians.

“Suspicious activity” is broadly defined in TLO training as behavior that could lead to terrorism: taking photos of no apparent aesthetic value, making measurements or notes, espousing extremist beliefs or conversing in code, according to a draft Department of Justice/Major Cities Chiefs Association document.

All this is anathema to opponents of domestic surveillance.

Yet U.S. intelligence and homeland security officials say they support the widening use of TLOs — state-run under federal agreements — as part of a necessary integrated network for preventing attacks.

“We’re simply providing information on crime-related issues or suspicious circumstances,” said Denver police Lt. Tony Lopez, commander of Denver’s intelligence unit and one of 181 individual TLOs deployed across Colorado.

“We don’t snoop into private citizens’ lives. We aren’t living in a communist state.” ⁴

The same article goes on to report on some of the noteworthy work done by the Colorado TLOs, including reporting on graffiti showing a man holding an AK-47 rifle, overheard threats, as well as men filming a dam.

TLO Course Curriculum Design

The TLO Course Curriculum was developed to support the anticipated duties and responsibilities of the TLO. POST considered in detail the knowledge, skills, and abilities (KSAs) needed to perform these functions.

Consequently, the proposed course curriculum was designed to include necessary training components to address the identified KSAs, including:
• The Terrorist Threat
• Force Protection
• Community Information Networking
• Fourth Generation Warfare
• International Terrorism
• Militant Islam
• Informational Terrorism
• Domestic Terrorism
• Critical Incident Stress Management
• Cross Cultural Communications
• Related Agency Roles and Responsibilities
• The National Emergency Management System
• Connecting and Working with the Private Sector
• The Role of the Office of Domestic Preparedness
• Developing Community Anti-Terrorism Awareness Progress

The TLO Course curriculum is designed to be delivered in four eight-hour days (32 hours). It allows for some optional curriculum on the fifth day to provide an additional one-half day or one full day of instruction, lengthening the class to 36 or 40 hours.

On May 29-31, 2007, POST staff met in South San Francisco to review and revise the Terrorism Liaison Officer (TLO) Training Program. The five-day TLO course has been in existence for more than three years and, in accordance with federal recommendations, was due for review.

The Committee consisted of active TLOs, TLO coordinators, and TLO commanders. Also present were Office of Homeland Security officials, the current course presenters, and other state and federal stakeholders.

The Committee recommended consolidating the five-day TLO basic course into a three-day core course, with additional flexible and complementary modules to address local needs. Also recommended was the development of a one-day training module for Basic TLO Awareness for those agencies that utilize the TLO “shift officer” structure. Additional courses in Advanced Terrorism Intelligence Training were also recommended.

The following certification and requirements information is from a solicitation put out by the Los Angeles Regional Terrorism Threat Analysis Center:

Certification Process:

1. The prospective TLO must: Obtain approval (verbal or in writing) from his/her unit commander or designee to participate in the program.
2. Attend the appropriate California RTTAC specific, POST certified 8-hour TLO course, (minimum training standard), with the understanding that the 24 hour POST certified classroom training (3-Day RTTAC TLO Intermediate course) is recommended.
3. Understand and sign FOR OFFICIAL USE ONLY (FOUO) non-disclosure agreement.

Sample Primary Duties and Responsibilities:

1. The TLO’s primary function is to help line staff identify terrorism related situations and share intelligence related to terrorist activity.
2. TLOs serve as the point-of-contact within their agencies for questions and information regarding terrorism, and terrorism-related tips and leads.
3. In most cases the TLO position is a collateral duty. TLOs shall not independently investigate tips or leads unless directed to do so by the proper authorities i.e. Federal Bureau of Investigation (FBI), Joint Terrorism
Task Force (JTTF), Fusion Center, etc., and stay within the responsibilities of their assigned duties.
4. A TLO is to have a working relationship with the local RTTAC, designated Intelligence Center and JTTF, to help facilitate the movement of terror related information to and from field personnel.
5. A TLO shall disseminate terrorism-related information and intelligence to personnel within their agencies’ in an efficient and lawful manner. TLOs are responsible for verifying that all personnel with whom they share
terrorism-related information have a valid need- and right-to-know the information.
6. TLOs are responsible for educating personnel within their agencies’ regarding the procedure(s) for submitting tips and leads to the proper investigative authorities. For purposes of efficiency, it is not ideal for TLOs to
function as the collection point for tips and leads.
7. TLOs are encouraged to pursue advanced level Homeland Security training courses as recommended and provided by their respective RTTAC.
8. The TLO should be flexible to fulfill other expectations and/or functions that may be determined by each individual RTTAC.⁵

Criticism of TLO

A 2008 thesis authored by Ryan Burchnell at the Naval Postgraduate School is strongly critical of the centralized structure of the TLO program, which hinders, he argues, information flow throughout necessary parties.

The Terrorism Liaison Officer (TLO) program developed by Anthony Lukin through the California Commission on Peace Officer Standards and Training is an excellent example of failing to understand knowledge flows. His attempt to “improve the communication, cooperation and coordination between local, state, and federal law enforcement agencies” is counter-productive to producing a sustained increase in knowledge flow. The program is designed to build a national interconnected program of designated law enforcement officers to attend a course of instruction and fill the specific role of “liaison” for all terrorism related issues handled within their department. By designating a single person within a policing agency that is the “person with the answers to questions concerning terrorism,” Lukin’s concept stifles knowledge flow. It does so by creating a “knowledge clump.” A knowledge clump is defined by Nissen as “knowledge that collects at some isolated coordinate” and is symptomatic of flow pathology to be found within an organization where knowledge flow is not being properly addressed. Lukin indirectly recognizes that isolating such vital knowledge in one individual is problematic, because he suggests a strict selection criterion that includes selecting an individual that will stay in the TLO position for at least 2 years. However, by doing so, he may also be advocating for someone to fill a knowledge critical position that is not expected to stay in the position for more than two years and provides no technological solution to fill the gap. This is likely to further exasperate the issue of knowledge flow within those organizations. If the person selected for the TLO position leaves after two years, the knowledge that he gained to do the job and by actually performing the job leaves with him. Knowledge flow, therefore, ceases and the process has to be started again from the beginning. The TLO program is conceptually sound regarding the need to train local and state law enforcement officials in counter-terrorism. However, its concepts lack recognition of the importance of knowledge dynamics and sustained knowledge flow. What homeland security academics and professionals must focus on when developing these types of programs is not just creating knowledge for a short period of time, but creating sustainable knowledge that can be continually leveraged over time to create a competitive advantage for the United States. ⁶

Complete Course Outline

The following course outline is for the Basic TLO course as taught in California.  It was taken from a Terrorism Liaison Officer (TLO) Proposal that is believed to have been published sometime in early 2010.

Module 1 INTRODUCTION

I. Introduction and Administration

A. Instructor Introductions
1. Each Instructor’s Agency, length of service, present assignment in the Fusion Center

B. Course Information
1. Course purpose
2. Course Content overview, module by module
3. What the student can expect to learn by the end of course

C. Administration
1. Discipline Rosters
2. Networking Roster

D. Course Acronym Briefing
1. TLO – Terrorism Liaison Officer
2. RTTAC – Regional Terrorism Threat Assessment Center
3. JRIC – Joint Regional Intelligence Center
4. DHS – Department of Homeland Security (Federal Level)
5. OHS – Office of Homeland Security (State Level)
6. SLFC – State and Local Fusion Center
7. TEWG – Terrorism Early Warning Group (It’s purpose)
8. BZPP – Buffer Zone Protection Plan
9. ACAMS – Automated Critical Asset Management System
10. PCII – Protected Critical Infrastructure Information

E. Why are we here?
1. Combat terrorism, both International and Domestic
2. Develop relationships which facilitate the flow of information.

F. Student Introductions.
1. Name
2. Agency
3. Years of service
4. How long as a TLO
5. Information regarding student’s agency’s TLO program.

G. Pre Test
1. Name on Test
2. Time restriction.
3. Collect tests
4. Advise tests will be re-issued, to confirm information has been covered.

Module 2 ROLE OF THE TLO

I. Program Organization

A. TLO/TLO-C Selection
1. Sole discretion of agency head
2. Certification letter requirement

B. TLO Program Structure Flow Chart (see PPT)

C. Role of TLO
1. Information Sharing
2. Terrorism Collection Manager
3. Education within Department
4. Communicate with Public

D. Role of TLOC – in addition to above…
1. Communicate w/TLO network, TLO-C
2. Coordinate intel gathering/reporting to RTTAC
3. Supervise TLO’s within own agency
4. RTTAC Consultant
5. TLO recruiting
6. Agency training

E. Program Flexibility
1. Extent of participation is sole discretion of each agency head
2. May serve as TLO/TLO-C from any rank as determined by agency
3. TLOs encouraged to educate co-workers

F. RTTAC Advisory Meetings
1. TLO-C serves as RTTAC consultant
2. Roundtable format
3. Fluid agenda (training needs, op concerns, regional/jurisdictional
specific issues)
4. Specialized training if needed

G. RTTAC Regional Concerns
1. De-confliction
2. Reduce redundancy in intelligence reporting
3. Sustained TLO involvement

H. RTTAC Goals
1. Sharing information with partners
2. Disrupt and dismantle terrorist activity

I. Examples of Local incidents reported by TLO network
1 Specific/Ongoing submissions

J. How to report
1. RTTAC

Module 3 FUSION CENTERS

I. Fusion Center Strategies – National Scope

A. Definition

1. A collaborative effort of two or more agencies that provide resources, expertise, and/or information to the center with the goal of maximizing the ability to detect , prevent, apprehend and respond to criminal and terrorist activity.

B. Functions
1. Compile, blend, analyze, and disseminate information of various types
2. Support efforts to anticipate, identify and prevent criminal or terrorist activity.
3. Federal Government can influence – not mandate – creation, organization, and processes.

C. DHS Program Objective
1. Create partnerships with all State and Local Fusion Centers (SLFCs) and major cities to improve information flow between DHS and the centers, and to improve the effectiveness of the centers as a network
2. DHS support effort provides people and tools to the SLFCs to create a web of interconnected nodes across the country – creating a National Fusion Center Network.

D. Analytic Mission
1. Provide timely, tailored, actionable threat-related intelligence and analysis to DHS policymakers, operators, & acquisition elements, and federal, state, local, & private sector partners to support their efforts in:

E. People and Tools
1. DHS personnel deployed to SLFCs are assigned after deliberate consultations with the States to be tailored for success.
2. HSIN-Intel, an unclassified portal, is a trusted Community of Interest to post all relevant state, local, and federal intelligence reporting
3. SECRET network access is provided by the Homeland Secure Data Network (HSDN) and will be installed everywhere we have an officer
4. State and Local Fusion Center Regions
5. Display U.S. map showing current and proposed fusion Centers.

II. Fusion Centers – California

A. California’s OHS strategy
1. Partnerships with federal, state, and local public safety Agencies
2. Four RTTAC Centers for information fusion

B. California RTTACS
1. Cornerstone for California’s terrorism prevention strategy
2. Sharing and analysis of relevant information to identify threat elements
3. Support federal law enforcement activities to deter and disrupt terrorism and criminal operations before they occur

C. OHS Grants
1. Administer federal (DHS) grant $ to state/local entities
2. Require TLO/JRIES connectivity

D. RTTAC/JTTF Map

E. The RTTAC Role
1. The RTTACs will develop a regional threat assessment Picture
2. Have analytical functions and will directly connect to each Other
3. Share information and produce assessments, reports and other threat and warning products.
4. Not a primary investigative entity (terrorism and criminal investigations will be referred to the FBI/JTTF or other appropriate federal agencies

F. Each RTTACs Specifics
1. Area served
2. Define size and scope

G. Each RTTACs Goals
1. Cultivate/Maintain relationships with Federal, State and Local Intelligence agencies.
2. Develop a highly trained network of TLO’s within the different public safety disciplines (law, fire, public health).
3. Develop the TLO network by encouraging partnerships with the public/private sector and provide relevant training (Integrate TEWG/Infraguard).
4. Produce critical infrastructure, buffer-zone, ACAMS reports for target hardening
5. Produce analytical products based on information obtained via TLO networks and critical infrastructure needs
6. Fully integrate information intake, vetting, analysis/fusion, and synthesis as part of the National and State Model.

Module 4 INTELLIGENCE for TLOs

I. Intelligence

A. Overview
1. What is the Intelligence Community?
2. What do the different agencies do?
3. What is the director of National Intelligence?
4. How does the Intelligence Community relate to law enforcement?
5. What do you get?
6. What do you provide?
7. Ongoing reform within the community

B. The U.S. Intelligence Community.
1. EXPLANATION OF FLOW CHART…

C. The office of the DNI (Director of National Intelligence)
1. EXPLANANTION OF FLOW CHART

D. From Foreign Intelligence to National Intelligence
1. The Intelligence Reform and Terrorism Prevention Act of 2004.
2. Bridge the divide that previously existed between foreign and domestic
intelligence.

E. The Director of National Intelligence was not intended to:
1. Run Individual Agencies.
2. Run Operations
3. Run Domestic Intelligence, but…
F. How the IC relates to you

1. EXPLANANTION OF FLOW CHART

G. What you receive.
1. Interagency Players
2. Information Sharing

H. What you collect.
1. Identifies national trends.
2. Contributes to analysis
3. Informs Policy Makers
4. Directs further collection.

I. Reform Underway – Changes at DOJ, FBI and DHS
1. DOJ is creating a new Assistant Attorney General for national security
2. FBI has created a National Security Branch to integrate its counterterrorism, Counterintelligence and intelligence programs.
3. DHS is in the process of implementing major changes.

J. The JTTF (Joint Terrorism Task Force).
1. Established by the FBI to facilitate real time coordination between state, local, and tribal agencies to combat terrorism.
2. Comprised of members of the FBI, state, local and tribal law
enforcement, and other state Federal and local agencies.
3. Every FBI field office has a JTTF.
4. Coordination and guidance by National Joint Terrorism Task Force
(NJTTF).

K. Anti-Terrorism Advisory Council (ATAC)
1. U.S. Attorney led.
2. Complements the JTTF
3. Facilitates anti-terrorism training in an unclassified environment
4. Organizational, not operational

L. ATAC/JTTF Contrasts
1. DISCUSS CHART

M. FBI’s Field Intelligence Group (FIG)
1. The FIG is :

N. Regional Terrorism Threat Assessment Centers (RTTACs)
1. Four RTTACS in California
2. Centralized intelligence sharing mechanism for terrorism related information in California.

O. Intelligence Research Specialist (IRS) Mission
1. Information (situational) awareness
2. Information Sharing
3. Intelligence Support

P. Everyone plays a role in the intelligence cycle
1. Gone are the days of separate intelligence and law enforcement spheres
2. Many federal, state and local entities have intelligence components that handle foreign intelligence information
3. Collection starts from the ground up

Module 5 COLLECTION and SHARING of INTELLIGENCE

I. What is Intelligence?

A. At the most basic level is information, that when collected appropriately, is combined with other collected related factors for analysis, in order to provide law enforcement with important tactical, investigative, and strategic decision making information.

B. Criminal Intelligence
1. Information that once analyzed is determined to be:

C. Types of Intelligence
1. Tactical- focused, concrete information, often used in a short time period. Most often used for raid planning, or redirection of resources to address an immediate spike in certain types of crime.
2. Operational- broader in time and scope. Information used to link criminals, assist in fostering coordinating investigations. NOT necessarily PC based information rather, “Reasonable Suspicion.”
3. Strategic-broadest type of intelligence. Used for gathering information about the nature and scope of problems. Analyzed for the purpose of determining the appropriate strategic response

D. Investigation vs. Intel
1. Purpose of collection
II. Collection of Intel in California

A. Regulated by federal law (28 CFR Part 23) and the Calif Attorney Generals “Criminal Intelligence File Guidelines”.
1. Both 28 CFR and CaAGG’s created for the purpose of insuring all criminal intelligence systems and operations are utilized in conformance with the privacy and constitutional rights of individuals.
2. Sets forth who can collect, where/how collection can be stored, who has access to the collection and when the information must be purged.

B. 28 CFR Part 23 (Summarized)
1. Both 28 CFR and CaAGG’s created for the purpose of insuring all criminal intelligence systems and operations are utilized in conformance with the privacy and constitutional rights of individuals.
2. Sets forth who can collect, where/how collection can be stored, who has access to the collection and when the information must be purged.

C. Intelligence Requirements for Local, State, and Tribal Law Enforcement (Terrorism).
1. LSTLE Intelligence Requirements: Personnel.

D. Training, Skills, and Collaboration by Suspect Groups
1. Training received: type, location, provider, curriculum, facilities

E. Material
1. Explosives, Illegal arms trade.
2. Source of material

F. Mobility
1. Use of commercial transport/courier/shipping services and carriers
2. Use of private/noncommercial carriers, couriers

G. Finances
1. Illegal arms trade, theft, sales, smuggling of aliens or prohibited items
2. Shell companies, charity, humanitarian sponsors and covers

IV. Information Dissemination

A. Right to know vs. need to know
1. Right to Know standard is established when a requester is acting in an official capacity and has the authority to obtain the information being sought
2. Need to Know standard is established when the requested information is pertinent and necessary for initiating or furthering law enforcement activity.

B. Third Agency Rule
1. If the information does not originate from you, you have no right to discuss or pass that information to others without the express permission of the originator.

V. Security Clearances

A. Types of Security Clearances
1. TS/SCI
2. TS
3. Secret
4. LES
5. U/FOUO

VI. The Intelligence Cycle

A. What happens with your provided “Intelligence” information.

B. Method for Passing Intelligence
1. If there is something you need to move forward ASAP
2. What happens with your intel?

VII. Non Disclosure Document

A. Distribute the RTTAC information Handling Document.

B. Discuss the document and its contents

C. Have students complete the document, sign and hand in to instructor.

Module 6 DOMESTIC TERRORISM

I. Domestic Terrorism Overview

A. Terrorism Defined/Review
1. Activities that are violent or dangerous to human life
2. Intended to intimidate or coerce a civilian population, influence
government, or affect conduct of a government.
3. Territorial jurisdiction of the U.S

B. Areas of Focus
1. Animal Rights
2. Environmental
3. Anarchists
4. Militia, Sovereign Citizens, et al
5. Hate groups
6. Other Special Interest Groups

II. Animal Rights Groups

A. Specific Groups
1. Animal Liberation Front
2. SHAC
3. SHAC7
4. WAR

B. Animal Liberation Front Guidelines
1. To liberate all animals
2. To inflict economic damage to those who profit.
3. To reveal the horror and atrocities committed against animals by performing nonviolent acts
4. To take all precautions against hurting any animal, human or non-human

C. SHAC
1. Stop Huntingdon Animal Cruelty
2. Tactics
3. www.shac.net/financial/dumpedhls.html
4. More than 268 companies: Customers, Financial support, and Suppliers
5. Animal Enterprise Terrorism Act

D. Clearcutting Green Activists
1. Andy Stepanian, Lauren Gazzola, Kevin Kjonaas, Josh Harper, Jacob Conroy, Darius Fulmer

E. WAR
1. Win Animal Rights
2. Camille Hankins

III. Environment Rights / Eco Justice

A. Specific Groups
1. ELF
2. Earth First!
3. Earth Liberation Front

B. ELF / ECO tactics
1. Arson
2. Incendiary devices
3. Monkey wrenching
4. Vandalism
5. Local Case Studies

C. EarthFirst!
1. EF was started in 1980. Fed up with mainstream environmentalists, the group pledged “No Compromise in Defense of Mother Earth!”.
2. Global in scope
3. Anti-GMO is first priority / logging second
4. Lawsuits – Bari / Cherney

D. Anarchism
1. Black Bloc: What it isn’t
2. Support for Multiple issue

F. Anarchists Tactics
1. Organized
2. Affinity Groups
3. Legal team
4. Medics
5. Street Theater

G. Anarchist Profile

H. Forecast for future events:

I. Militia / Sovereign Citizen Extremists
1. Threats and Intimidation toward L.E
2. Assault
3. Illegal possession of firearms

J. White Supremacy
1. Older Structured groups waning
2. Resurgence of Klan?
3. Attempted to bring street groups under a unified umbrella

K. Anti-abortion Extremism
1. Incidents are decreasing in number
2. No fatalities in 2006, but there were assaults, arson, attempted. bombings, etc
3. Violence is not usually coordinated by groups

Module 7 INTERNATIONAL TERRORISM

I. International Terrorist Groups

A. Hezbollah
1. Background:
2. History :
3. What is the threat to you?

B. Hamas
1. Background:
2. Capabilities
3. What is the threat to you?

C. AL Qaeda
1. Background:

III. International Terrorist Groups

A. Known Terrorists in California
1. Ali Mohamad
2. Wadih El-Hage
3. Osman Kaldirin
4. Amad Ressam
5. Yazid Sufaat

B. Known Terrorist groups
1. AL Qaeda

IV. International Terrorist Groups Active in the U.S., and California

A. Jamiyyat Ul Islam Is Saheeh (JIS)
1. Background:

V. Details of Domestic Islamic Attacks (Since 9/11)

A. July 4, 2002: Hesham Mohamed Hadayet (Egyptian) opened fire at LAX [El Al ticket counter].
1. Killed (2) Israelis, wounded 4 others
2. Shot dead by security
3. Espoused anti-Israel views and opposed to U.S. policies in the Middle East.

B. October 2002: John Allen Muhammad and Lee Boyd Malvo carried out the 2002 Beltway sniper attacks.
1. Killed 10 people
2. On at least one occasion, stopped by patrol and asked to leave crime scene area (Fredricksburg Virginia)
3. Until 1999: member of Nation of Islam
4. 1999: Joined Jamaat al Fuqra (Islamic group)
5. Changed his name to Muhammad in October 2001
6. Police reports state that Muhammad advised that he modeled himself after UBL and AQ (Exhibit 65-043: Father and son portrait of Malvo and Muhammad. ‘We will kill them all. Jihad.’ “Exhibit 65-103: A lion accompanies chapter and verse from the Koran (‘Sura 2:190’): ‘Fight in the cause of Allah those who fight you and slay them wherever ye catch them.
7. Multiple phase attack plan (including IED attacks on school buses and @ police funeral).

C. October 1, 2005: Joel Hinrichs III blew himself up with a backpack containing TATP outside of a packed Oklahoma University football stadium
1. Believed that he tried unsuccessfully to enter stadium (backpack searches were being conducted @ stadium ingress pts).
2. Explosion heard 5 miles away
3. Tried to buy ammonium nitrate at a local feed store
4. Had a Pakistani roommate, reportedly was an Islamic convert, and attended a mosque close to his apartment
5. Possessed a significant amount of TATP in apartment

D. March 3, 2006: Mohammed Reza Taheri-Azar (Iranian) deliberately rammed his rented SUV into a crowd at the U. of North Carolina.
1. Called 911 calmly and stated he did it to “punish the government of the U.S. for their actions around the world”.
2. Confessed stating that he wished to “avenge the deaths of Muslims worldwide” and to “punish” the U.S. Government.
3. Wrote in a letter, “I was aiming to follow in the footsteps of one of my role models, Mohammad Atta, one of the 9/11 hijackers..”

E. July 28, 2006: Naveed Afzal Haq (Pakistani) went on a shooting rampage at a Jewish community center in Seattle
1. Shot 6 people/1 fatality
2. Had researched for “something Jewish” on the Internet
3. Legally purchased (2) handguns (also had knife and extra
ammunition).
4. Traffic ticket on the way to the shooting

F. August 6, 2006: Mohammed Ali Alayed (Saudi Arabian) slashed the throat of his Jewish friend (Ariel Sellouk) in Houston
1. Victim was almost decapitated
2. Alayed was receiving $60,000 from his family in Saudi for his
studies (reportedly had dropped out of school)
3. Alayed had a religious awakening approximately 2 years Prior
4. Alayed went to his mosque following the killing
5. Witnessed by roommate, no arguing taking place
6. Prosecutor/Defense could not find a motive

G. August 30, 2006: Omeed Aziz Popal (Afghani Muslim) intentionally drove into 19 pedestrians total in a spree ranging from Fremont to San Francisco, California
1. (1) Fatality
2. Attack ended in front of a Jewish community center
3. Reportedly heard during spree saying, “I’m a terrorist, I don’t care”.

H. February 12, 2007: Sulejman Talovic (Bosnian) opened fire in
a Salt Lake City shopping mall.
1. (5) Fatalities
2. Stated “Allahu Akbar” three times before being shot
3. Father reportedly previous member of Bosnian Muslim Army
4. Witnesses described him as a calm “average looking Joe”.

VI. “Homegrown” Islamic Terrorists

A. John Walker Lindh (California), Taliban
B. Jose Padilla (Chicago), AQ
C. Narseal Batiste (Florida)
D. Adam Gadahn (California), AQ Lieutenant
E. Joel Henry Hinrichs (Oklahoma)
F. Daniel J. Maldonado (Mass), AQ
G. Kevin James (California), JIS
H. Paul R. Hall (Arizona), AQ

VII Terrorism Attack Cycle

A. Follows a chain of events
1. Target Selection
2. Surveillance
3. Final Target Selection
4. Planning
5. Final Surveillance
6. Deployment of Attack Team
7. Attack
8. Post Attack

B. Surveillance Detection
1. Most effective way to prevent an attack
2. Look for…
3. Suspicious incident chart

C. Safe Houses
1. Verified through overseas raids/interviews
2. Utilized for covert op planning/surveillance
3. Constructing explosives
4. Storing weapons
5. Possible Safe House Locations
6. Safe House Indicators

D. “Dry Runs”
1. Used during final stages of op planning
2. Simulates attack plan
3. Exposes “strengths and weaknesses”
4. Assists in developing adaptations to plan
5. “Dry Run” indicators:

VIII Radicalization and Indoctrination

A. Pre-Radicalization
1. Point of origin (life situation)
2. Ordinary life, job etc.
3. Little or no criminal history

B. Self- Identification
1. Catalyst is frustration (losing job, alienation, family death)
2. Gravitate away from old identity
3. Explore radical Islam
4. Gravitate toward like-minded individuals

C. Indoctrination
1. Progressive intensity of beliefs
2. Current condition warrants action (Jihad)
3. Supported by “spiritual sanctioner”
4. Radical views are reinforced

D. Jihadization
1. Accept duty of Jihad
2. Self designation as “holy warrior”
3. Group begins op planning
4. Transformation is not triggered by oppression, suffering, revenge or desperation.
5. Seeking Identity, cause
6. Internet driven
7. Process incubators can be the internet, Mosques, cafes, prisons, MSA’s, book stores.

IX Attack Methods
A. Improvised explosive devices (IED)
B. Vehicle borne explosive devices (VBIED)
C. Small arms/kidnapping/hostage taking

D. Suicide bombing
1. The use of one’s body as explosive platform (low tech precision guided weapon)
2. Martyr Mindset /high commitment level
3. “Shaheed” in Arabic
4. Symbolism
5. Ability to gain access to intended target
6. “Alahu Akbar” Arabic for “God is great”

E. Suicide Bomber Indicators
1. Distracted stare
2. Loose clothing/inconsistent w/weather
3. Exposed wires
4. Palming
5. Unresponsive to salutations, officialCommands
6. Behavior consistent w/lack of future plans
7. Unnatural gait/posture

F. Vehicle Borne Improvised Explosive Devices (VBIED’s)
1. A vehicle such as a car, truck or van loaded w/some type of explosive.
2. Not always a suicide operation
3. Bomb in a car vs. the car is the bomb
4. Parked in an unusual location
5. Official looking vehicles for access to target
6. Potential Explosives Capacities

Module 8 WRAP UP

I. Overview

II. Post-test

III. Closing remarks

Share this:

Source notes: