Security Weekly: Searching for Connections Amid Terrorist Threats May 9, 2012

By Scott Stewart

In past Security Weeklies we have often noted how analyzing terrorism is like assembling a puzzle. After an attack has transpired, it is easier to piece the disparate clues together because you have the luxury of knowing what the finished puzzle should look like. You know the target, the method of attack, the time, the place, etc. These factors frame your approach to the bits of evidence you gather and allow you to assemble them into a cohesive, logical framework. While there will certainly be missing pieces at times, having the reference point of the attack itself is helpful to investigators and analysts.

On the other hand, analyzing a potential threat before an attack takes place is far more difficult. It is like sifting through pieces of thousands of different puzzles, all jumbled together in one big pile, and attempting to create a complete picture without knowing what the end result -- the attack -- will look like. Sometimes pieces look like they could be related, but it is often difficult to determine if they really are without having the picture of the finished attack and the important framework for investigative reference: target, method of attack, time and place. It is often easy to look back after an attack and criticize authorities for not making a critical connection, but it is difficult to piece things together before the attack occurs without the assistance of hindsight.

Over the past few weeks we have been studying a number of interesting puzzle pieces pertaining to potential threats to U.S. interests by transnational jihadists. It is currently unclear if they all fit together to form a seamless narrative, but the implications of a potential convergence are too big to ignore. We feel compelled to write about this potential convergence in much the same way we did in September 2009, when we discussed the possibility of al Qaeda in the Arabian Peninsula (AQAP) using innovative bomb designs to bring down passenger aircraft rather than to assassinate individuals. The earlier convergence came to fruition on Dec. 25, 2009, when AQAP attempted to destroy a Northwest/Delta flight from Amsterdam to Detroit using an improvised explosive device (IED) concealed in the suicide operative's underwear. Time will tell if the current grouping of events is a true picture of what is about to happen or is simply a false positive.

The Pieces
The pieces of the current case began emerging a few weeks ago, before the May 2 anniversary of Osama bin Laden's death. Reports began to surface that AQAP's lead bombmaker, Ibrahim Hassan Tali al-Asiri, had been seen again. American officials originally said al-Asiri was killed in the Sept. 30, 2011, airstrike that also resulted in the death of AQAP's English-speaking ideologue, Anwar al-Awlaki. A few days after the strike, reports surfaced that al-Asiri had in fact survived the attack, but he has maintained a low profile since then.

While al-Asiri is certainly not AQAP's only bombmaker, he is an innovative, out-of-the-box thinker. Not only was he behind the device that his brother, Abdullah al-Asiri, used in his suicide bombing attempt against Saudi Deputy Interior Minister Prince Mohammed bin Nayef on Aug. 27, 2009, and the underwear bomb used in December 2009, he was also responsible for the attempted attack against two U.S. cargo aircraft in October 2010 using IEDs hidden in computer printer ink cartridges. Indeed, he is the technical author of every AQAP transnational attack attempted so far. Even though all of those attacks have failed, he is still considered a threat. This fact was highlighted by the May 7 reports of a thwarted bomb plot using an improved version of al-Asiri's underwear device.

A second, AQAP-related piece of the puzzle surfaced on May 2, when the group published two editions of its English-language Inspire magazine, ending the publishing hiatus that began after the magazine's editor, Samir Khan, died in the same Sept. 30, 2011, airstrike that killed Anwar al-Awlaki. AQAP watchers wondered why the group released two editions of the magazine so closely together, and the revelation of a plan for another transnational bomb plot directed against American aircraft appears to provide the answer to that question.

Last week, we wrote about the third piece of the puzzle: the proliferation of Libyan shoulder-fired surface-to-air missiles, also known as MANPADS, among jihadist militants in Africa and perhaps elsewhere. Many of these missiles are older SA-7s that have limited utility against modern military aircraft equipped with countermeasures, but they could be employed effectively against a commercial airliner during the vulnerable takeoff or landing phases of a flight. While this threat has existed for some time, we are hearing recent reports of missile dissemination and planning discussions.

Another important piece of the puzzle is the ongoing trial of Khalid Sheikh Mohammed before a military tribunal at Guantanamo Bay, Cuba. Mohammed, better known by his initials KSM, is the captured al Qaeda operational planner who was named the principal architect of the 9/11 operation in the 9/11 Commission Report. He was also involved in a number of other plots prior to 9/11, including the 1994 Operation Bojinka plot in the Philippines, the 2001 shoe-bomb plot and the 2002 Library Tower plot. 

KSM's operational style had several distinctive hallmarks, including the frequent choice of aircraft as targets; the notion of multiple, simultaneous strikes; and the use of modular IEDs smuggled aboard the aircraft. Although KSM was arrested in March 2003, he continued to influence other jihadist planners. This influence was clearly seen in the August 2006 Heathrow liquid-bomb plot, which targeted nine American airliners. AQAP's cargo bombing attempt, which targeted multiple aircraft, reflected KSM's preference for multi-pronged plots, and the reports of the thwarted May 7 bombing attempt indicate that aircraft are still considered desirable targets for jihadist groups.

KSM's trial began May 5, three days after the anniversary of bin Laden's death. With the trial in the world's media spotlight, it is quite possible that jihadists are planning an operation in homage to KSM and bin Laden, and that KSM's operational hallmarks could be seen again.

Paradigm Shifts
Of course, this is nothing new. Commercial aviation has been threatened by terrorism for decades now, and as discussed above, airliners have been under constant threat from jihadist groups because they are highly visible targets that are readily associated with specific nations, and a successful attack generates a large number of casualties and a high level of press coverage.

But as airline security measures have shifted in response to threats, so too have the modes of attack. When security measures were put in place to protect against Bojinka-style attacks in the 1990s -- attacks that involved modular explosive devices smuggled onto planes and left on board -- the jihadists adapted and conducted 9/11-style attacks. When security measures were put in place to counter 9/11-style attacks, jihadists quickly responded by shifting to onboard suicide attacks with concealed IEDs inside shoes. When that tactic was discovered and shoes began to be screened, they switched to camouflaging containers filled with liquid explosives. When security measures were adjusted to restrict the quantity of liquids that people could take aboard aircraft, jihadists altered the paradigm once more and attempted the underwear bombing using a device with no metal components. When security measures were taken to increase passenger screening in response to the underwear bombing, AQAP decided to attack cargo aircraft with IEDs hidden in printer cartridges.

It is notable that, after the failed underwear-bomb attack in December 2009, air security measures began to include additional pat downs and an increased use of body scanners that have the ability to identify items hidden under passengers' clothing. As with the previous changes in security procedures, al-Asiri and AQAP's operational planners likely accounted for these changes while planning the devices for the latest plot. They would need to use a device that would not be detected by a pat down or a body scanner. The reports indicate that they attempted to do this by creating a more form-fitting device hidden inside briefs.

Another way planners could evade detection is by using devices that are either implanted inside a suicide operative or hidden inside a body cavity. The advantage to using a body cavity to smuggle the device is that the device could then be removed from the body and detonated in close proximity to a critical component of the aircraft. Removing it from the body would also prevent the body from attenuating the force of the blast, which is what appeared to have happened in the Nayef attack. Creating security measures to search for devices hidden inside a potential bomber's body would be difficult and more intrusive than current procedures.

The original underwear IED reportedly contained less than three ounces of pentaerythritol tetranitrate (PETN), a high explosive. One could fabricate five such devices with a single pound of PETN, and explosives have always been extremely easy to acquire in Yemen -- even more so now that the country has been ravaged by civil war and AQAP and tribal elements have ransacked government arms depots. To date, al-Asiri's imaginative bombs have been successfully deployed in the underwear-bomb, printer-bomb and Nayef plots, but they all failed to destroy their targets. If AQAP is able to address this quality-control issue, the only thing effectively limiting AQAP from launching multiple suicide IED attacks is the availability of operatives who are willing to conduct such attacks and able to travel abroad.

Since the suicide operative is a critical node in this type of operation, the United States and its allies have a place to focus their efforts. If they can find the suicide operatives before they depart Yemen, the threat can be minimized. It is worth noting that the suicide operative involved in the plot disclosed May 7 was reportedly a double agent. It is unclear if the purported bomber in the recent threat case was a plant sent in to penetrate AQAP, a loyal jihadist who was intercepted and turned, or an operative that simply got cold feet -- something we have seen in the past. It is also not clear if the group hoped to deploy more than one of the devices in a KSM-style, multi-pronged attack, as it did in the printer-bomb plot. We have noted recent reports of European citizens arrested in Yemen for having ties to AQAP, but we have seen no indication that they are related to this threat.

An attack against multiple airliners would be the type of spectacular terrorist strike that would have international repercussions and would deeply affect international air transportation. If such an attack was coordinated with, or followed closely by, an attack against multiple airliners using MANPADS, it could have an even deeper impact. This would affect the American people -- and, consequently, the American government -- especially given that 2012 is a presidential election year in the United States, and President Barack Obama would almost certainly take measures to demonstrate that he was tough on terrorism. We stress the impact on the United States because, as the latest edition of AQAP's Inspire magazine indicated, the United States remains the prime jihadist target and U.S. airliners will likely be targeted again in any plot. 

Of course, it would not be easy for AQAP to recruit multiple suicide operatives and transport the operatives and their IEDs out of Yemen without detection. (Although it does appear the operative in the thwarted plot was able to successfully get the device out of Yemen.) It would also be quite difficult for different al Qaeda franchises to coordinate their attacks in either a multi-pronged or parallel attack scenario. We have not seen them take such an approach in the past, although we have in recent months seen increased indications of communication and coordination between AQIM, Boko Haram, al Shabaab and AQAP. This lends itself to the idea of a convergence, especially one related to the MANPADS threat, but it does not provide any direct evidence.

Still, with so many puzzle pieces suggesting some sort of merging of threats is taking place -- even if it is only accidental -- a possible convergence is worth discussing because of the significant consequences it could have