Six Counterterrorism Analysis Pillars of Wisdom

on October 3 | in 9/11, Terrorism

Print Friendly

A former intelligence analyst colleague once provided me with what he described as “counterterrorism analysis pillars of wisdom.” These were nuggets of truth that he had learned over the course of his career. The pillars are valuable for anyone trying to understand both the business of counterterrorism and the way we talk about counterterrorism in the aftermath of terrorist attacks. I will likely refer to them frequently on Overt Action. Here is a short summary of each.

  1. Every day is September 12th, 2001, unless it happens to be September 10th, 2001: This pillar refers to the country’s tendency to vacillate quickly from ignorance to hypervigilance and then back when it comes to the terrorist threat. It characterizes our public debate and the cyclical nature intelligence and counterterrorism policymaking. In the immediate aftermath of a terrorist attack, we ask why we as a society didn’t do more. In the months and years following, once our attention has shifted elsewhere, we ask why we did so much, why we seemingly overreacted. This schizophrenic nature of intelligence debates is often so palpable to those inside the intelligence community because, to them, the terrorist threat is ever present and does not wax and wane with public sentiment.
  1. All the intel you need is in cable traffic: All the information necessary to unravel a terrorist plot, to find a particular al-Qaeda leader, or to understand al-Qaeda’s activities more broadly, has already been collected by the intelligence community. This has proven true time and time again. If an analyst digs deep enough in cable traffic, they can find the necessary ‘dots’ and can connect those dots. But this also implies that, when a terrorist attack occurs, and with the benefit of hindsight, intelligence analysts will be able to look back and find the evidence that could have allowed them to disrupt the attack. This means that every successful terrorist attack can and will be characterized as an intelligence failure. When an attack occurs, policymakers will almost certainly accuse the intelligence community of failing to “connect the dots.” September 11th, the Fort Hood shooting, and the Christmas Day bomber are all good examples of this phenomenon. The truth of this pillar is a result of the country’s extensive intelligence collection.
  1. An analyst’s job is not to be creative: This pillar is a refutation of the 9/11 Commission, which found that, “The most important failure [of 9/11] was one of imagination.” The Commission got this wrong. Again, whenever a terrorist attack occurs, it will likely be the case that someone will quote the Commission and accuse the intelligence community of a failure of imagination. This fundamentally misunderstands the nature of intelligence, which is intended to help policymakers respond to threats that actually exist rather than to map out the space of all possible threats. The best analysts are open-minded and intellectually curious, but imagination isn’t key to their job. The falsity of the “failure to image” line of thinking stems from the second pillar above; if it is the case that all the intel an analyst needs is already in cable traffic, then what is called for is stick-to-itiveness and smarts rather than imagination.
  1. They are all getting out: Many counterterrorism analysts, especially targeting analysts, dedicate incredibly long hours trying to find specific members of al-Qaeda. When that member is found and detained, by US forces or by allies working with us, it can be extremely satisfying for the analyst involved. But often the analyst then moves on to the next al-Qaeda member who represents a near-term threat. He or she quickly forgets about the previous target only to discover two or three years later that the target has somehow been released from detention and has rejoined al-Qaeda. There is a feeling of predictable surprise when one is reading cable traffic and finds references to a familiar target from years earlier: “Hey, that guy! Who let that guy out? Why didn’t I hear about this when they released him?” The lesson every counterterrorism analysts learns eventually is that virtually all detainees, other than those in Guantanamo, get released. This is why the senior leadership of most al-Qaeda affiliates is composed of individuals who were once in detention as a result of U.S. counterterrorism efforts.
  1. If you aren’t making someone angry, you aren’t doing your job: This is an important lesson for any analysts covering any topic, whether inside the intelligence community or elsewhere. Analysis is most important when it brings new information to the table that challenges the established point of view. That analysis will often make those who hew to the established view quite angry. If the analysis isn’t making someone angry, then it is probably at best not useful and at worst wrong. I believe in this pillar strongly—the best analysis that I have done has always gotten me in trouble. This doesn’t mean that when an analyst is making someone angry, that analyst is necessarily doing his or her job. Indeed, the worst analysis that I have done also got me in trouble! And this pillar shouldn’t diminish the importance of packaging analysis in a way that makes it the most palatable and impactful. It simply means that analysis is most valuable when it is controversial.
  1. Stupidity, coincidence, and weather have the most explanatory power: Analysts have a natural inclination to look for clean explanations for world events and to assume that those events reflect the rational, strategic thinking of others. In analyst-speak, this is called mirror imaging and the explanations it produces are typically wrong. Rather, the simpler explanations—stupidity, coincidence, and weather—often prove correct. Nonetheless, analysts (and policymakers) still fall into this trap. More intelligence collection doesn’t solve this problem because the comprehensiveness of that collection, combined with the dubious quality of some reporting, means that one can find evidence to support any particular theory of events. This pillar of wisdom applies both to intelligence analysis and to analysis of the business of intelligence. To those outside looking in, one can often find clean, monolithic, rational explanation for the actions of the intelligence community. These typically will paint the IC in a very negative light because they assume a level of strategic thinking that doesn’t actually exist.
Pin It

related posts

4 Responses to Six Counterterrorism Analysis Pillars of Wisdom

  1. […] threats nor ignore those threats entirely (see Mufti’s first pillar of counterterrorism wisdom here). Ignoring those threats, and unnecessarily eliminating valuable national security tools, is a sure […]

  2. […] story (and the New York Times’ telling of that story) serves as a great illustration of our counterterrorism analysis pillars of wisdom (pillar #2: All the intel you need is in cable […]

  3. […] story is an excellent example of the second pillar of counterterrorism analysis, which says that “all the intelligence you need is already in cable traffic.” I want to use […]

  4. […] attacks are a prime examples of the second pillar of counterterrorism analysis, which I first wrote about in October. It states that, “all the intelligence you need is already […]

« »