Post on 09-Apr-2018
8/8/2019 Homeland Security Threat Overview
1/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
The Overall Classification of this Briefing is:The Overall Classification of this Briefing is:UNCLASSIFIED//FOUOUNCLASSIFIED//FOUO
Homeland Security
Threat Overview
Office of Intelligence and Analysis Office of Intelligence and Analysis Analysis Analysis and Production Directorate and Production Directorate
8/8/2019 Homeland Security Threat Overview
2/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Office ofIntelligence &
Analysis
Secretary ofHomeland SecurityFraud Detection
and NationalSecurity
USCIS
U/SManagement
Security
US SecretService
IntelligenceDivision
MaritimeIntelligence
Fusion CenterAtlantic
MaritimeIntelligence
Fusion CenterPacific
US Coast Guard
IntelligenceCoordination
Center
U/S S&T
National BiodefenseAnalysis and
CountermeasuresCenter (NBACC)
CBP
Office ofIntelligence
Border PatrolField Intelligence
Center (BORFIC)SectorIntelligence Units
Border PatrolSectors
ICE
Office ofIntelligence
IntelligenceBranch
Federal ProtectiveService
TSA
Office ofIntelligence
TacticalIntelligence
Branch
Federal AirMarshals Service
(FAMS)
Tactical Intelligence Center Field Intelligence Units
DHS IntelligenceDHS Intelligence
Key
DHS HQ ElementMember of the IC Quasi-Intelligence Element
DHS Intelligence Component
Non-Intel Sub-HQ Component
ChiefIntelligence
Officer
8/8/2019 Homeland Security Threat Overview
3/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Chief of Staff(CS)P/DUS-IA
US-IA/CINT
DUS-IAMission Integration
InformationSharing
&Knowledge
Management(IM)
Plans&
Integration(PI)
DUS-IAIntelligence
CollectionRequirementsManagement
(CR)
ProductionManagement
(PM)
Watch andWarning
HomelandEnvironment
ThreatAnalysis(HETA)
Borders andCBRNEThreat
Analysis(BCTA)
CriticalInfrastructure
ThreatAnalysis(HITRAC)
I&A StructureI&A Structure
8/8/2019 Homeland Security Threat Overview
4/27
8/8/2019 Homeland Security Threat Overview
5/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Al-Qaidas Global Jihad Priorities Al-Qaida has focused on several key areas of
importance to the group to further spread its goalof global jihad Iraq AQ in Iraq is committed to removing US and Coalition
troops and returning Iraq to an Islamic state governed withSharia law
Africa AQ has sought mergers with groups in Africa to furtherits agenda and has made frequent statements on the importanceof Sudan and Somalia as fronts in the global jihad.
Afghanistan AQs former safehaven and a key component ofthe groups strategy in promoting global jihad.
8/8/2019 Homeland Security Threat Overview
6/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
AQs strategic reach is increasing in NorthAfrica, Europe, and Iraq AQ Deputy Leader Ayman al-Zawahiri announced last
year that the Salafist Group for Preaching and Combat
(GSPC) a group based in Algeria - merged with al-Qa`ida and is now called the al-Qa`ida in the Lands ofthe Islamic Maghreb (AQIM).
AQ will probably seek to leverage the contacts andcapabilities of al-Qa`ida in Iraq as its most visible andcapable affiliate and the only affiliate known to haveexpressed a desire to attack the US homeland.
Al-Qaidas Expanding Global Outreach
8/8/2019 Homeland Security Threat Overview
7/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis AQ Intent on Attacking
ONG Infrastructure (U//FOUO) Al-Qaida continues to
demonstrate its intent and capability to targetoil and natural gas infrastructureexploitingmedia to promote attacks in sector Video messages Jihadi websites
(U//FOUO) Targets identified in 2006 Oilfatwa: Oil pipelines Oil facilities Oil industry-related individuals (including
soldiers guarding facilities) Not permitted: attacks on oil wells
8/8/2019 Homeland Security Threat Overview
8/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Saudi Extremist Networks (U//FOUO) Saudi Arabian Ministry of the Interior (MOI) continues to arrest
suspected and AQ-affiliated terrorists. Arrested 172 militants in a 6-9 month period; 7 terror cells uncovered:
Operational support cell; 9 members; gathering weapons andinformation on petroleum facilities
Group of 5 individuals associated with the 24 February 2006Abqaiq attack
(U//FOUO) On 5 June the ministry announced the arrests of 3 AQmembers responsible for recruiting youths on the internet and encouragingattacks on Saudi oil facilities.
( U//FOUO) Some individuals associated with these cells remain at large and continue to represent a threat to Saudi Arabias ONG infrastructure; threat levels remain high as al-Qaida and insurgent groups have an enduring interest in attacks targeting oil facilities.
8/8/2019 Homeland Security Threat Overview
9/27
8/8/2019 Homeland Security Threat Overview
10/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Pakistan
Pakistan Pakistan - - Federally Administered Tribal Areas Federally Administered Tribal Areas
The The Maghreb Maghreb
Source: dailykos.com
AQ Senior Leadership remains activeIncreased extremist activity in FATA areasTribal leaders agreed to keep foreigners from
the regionReduced military presence afforded AQ anopportunity to reconstitute
Stand-off between Pakistani governmentforces and mosque leaders turns violent
Increased suicide attacks since assault onmosqueAl-Zawahiri calls for Pakistanis to join the jihadto revenge attack by government forces
Al-Zawahiri increasingly active in issuingpropaganda statements Recent UBL statement contained old clips, butmeant to reassure the followers that he remainsactive and in charge of AQ
8/8/2019 Homeland Security Threat Overview
11/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Soft Targets: Away from hardened, well-protected facilities towardsattacks on more accessible and vulnerable sites of public access or massassembly
Commercial and Government Facilities: Vehicle borne improvisedexplosive devices
Mass Transit and Rail: Use of carried or placed improvised explosive
devices Mumbai, India - 11 July 2006 London, UK - 7 July and 21 July 2005 Madrid, Spain - 11 March 2004
Casings and Surveillance: Barot casings demonstrate high level ofsophistication UK Gas Limos Project
NY/NJ financial institutions
OVERSEAS TRENDS
8/8/2019 Homeland Security Threat Overview
12/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Terrorist Threat to the HomelandAl-Qa`ida is intent in striking the US homeland andthe US will face a persistent and evolving terroristthreat over the next three years
AQ pushing other extremist Sunni communities to mimic its efforts and tosupplement its capabilities.
Al-Qa`ida homeland plotting is likely to continue tofocus on prominent political, economic, andinfrastructure targets with the goal of:
Producing mass causalitiesVisually dramatic destructionSignificant economic aftershocksFear amongst US population
8/8/2019 Homeland Security Threat Overview
13/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Terrorist Threat to the HomelandAQ will continue to try to acquire and employchemical, biological, radiological or nuclear
materialLebanese Hizballah may attempt to attack theHomeland
Existence of radical, self-generating cells suggestthat the US is not immune to what we judge is anexpanding radical and violent segment in the westNon-muslim, single-issue groups will probablyconduct attacks
8/8/2019 Homeland Security Threat Overview
14/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Threats to Infrastructure Al-Qaida and affiliates likely continue to have interest in attacking Homeland infrastructure to inflict casualties, instill
fear in the public, and to damage our economy Iconic and highly symbolic Homeland sites likely remain enduring targets
Terrorists likely remain interested in conducting attacksagainst U.S. mass transit sector and the aviation sectors Relative ease and success in which similar attacks were conducted in
Madrid, London and Mumbai bombings
Improvised explosives , carried or vehicle borne, are thedevices that are the preferred attack method againstinfrastructure targets
HITRAC
8/8/2019 Homeland Security Threat Overview
15/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Terrorist Threat to Food and Agriculture DHS lacks credible information to indicate planning for an
attack against the Food and Agriculture sector, but continues to
pay great attention to this threat Al-Qaida documents recovered from Afghanistan in 2002 indicate
interest in animal and plant disease agents , while discussions
among Islamists demonstrate general awareness of potentialeffects of introducing animal and plant diseases
Al-Qaida has shown an awareness of chemical and biological
agents utility as food contaminants , while discussions amongIslamists and terrorist training manuals show interest in foodcontamination as an attack method
HITRAC
8/8/2019 Homeland Security Threat Overview
16/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Terrorist Threat to Food and Agriculture While the biochemical industry is the main focus of animal
rights extremists, and environmental extremists have a
tangential focus on food and agriculture, both groupscontinue to show interest in targeting food and agriculture
Animal rights extremists have targeted agricultural research
facilities, as well as food products that experiment on animals, andsome recent actions have been tied to frustrations over recentlegislation targeting these extremists
Environmental extremists have targeted USDA Forest ServiceResearch facilities, while the broader anarchist movement has alsoshown an interest in targeting food and agriculture
HITRAC
8/8/2019 Homeland Security Threat Overview
17/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Recent terrorist plots show theimportance of insiders to gain accessto targets
AQ planner Barot had tasked a cell member tosecure employment at a hotel in the UK to learn
how to deactivate fire and security systemsJFK plot leader had been a cargo handler at theairport. He used his job-related knowledge toconduct surveillance and plan the attack
The Fort Dix Six used a family members pizzarestaurant to gain access to the post in 2006and conduct preoperational surveillance
Insider Threats to Infrastructure
Dhiren Barot
JFK plot lead
HITRAC
8/8/2019 Homeland Security Threat Overview
18/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
SAR proven utility for investigative purposes Potentially useful for Trend and Pattern Analysis
However no baseline to evaluate Incomplete data set Inconsistency with data collection
Exercise that requires federal and statecooperation
Suspicious Activity Overview
HITRAC
8/8/2019 Homeland Security Threat Overview
19/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Suspicious Activity Analysis Electric Power Dams Oil & Gas Chemical Nuclear Transportation related activity
Data is inconsistent, nonstandard and not reliable for developingjudgments and assessments. We need a more comprehensive plan to incorporate State data.
HITRAC
8/8/2019 Homeland Security Threat Overview
20/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Categories of Data StudiedPHOTOGRAPHY
OBSERVATION
THEFT
EXPRESSED THREAT
WEAPONS DISCOVERY
OTHER
ELICITING INFORMATION
BREACH / INTRUSION
ATTEMPTED INTRUSION
SABOTAGE/ TAMPERING/VANDALISM
CYBER ATTACK
FLYOVER
HITRAC
8/8/2019 Homeland Security Threat Overview
21/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
10K lbs of ammonium nitrate reportedly stolen from a truck driver
Fort Peck dam reportedly going to be attacked by an IED inJanuary 2008
Both reports are serious in nature and were investigatedpromptly by authorities
Both reports were found to be not terrorism related
Recent Suspicious Activity
First reports are generally vague, incomplete and often inaccurate!
HITRAC
8/8/2019 Homeland Security Threat Overview
22/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
Bulk Cell Phone Purchase Activity Local and State law enforcement agencies received numerous
calls reporting suspicious bulk cell phone purchases.
In retail locations throughout the U.S., cell phone purchasers: Visited multiple locations and purchased hundreds or thousands of
phones. Attempted to conceal their identity.
Were described as Middle Eastern. Used gift cards or cash.
DHS and FBI assessed that most individuals engaged in suchpurchases were taking advantage of discounted prices in the U.S.
and reselling the phones for profit overseas. DHS and the FBI determined some buyers were associated to
terrorist networks. The suspected motive was fundraising.**DHS/FBI Joint Homeland Security Assessment 7 February 2006
HITRAC
8/8/2019 Homeland Security Threat Overview
23/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
HITRAC Critical Infrastructure Threat Analysis
High degree of detail and awareness of sitevulnerabilities, security operations, and law
enforcement and emergency responseExtensive use of open sources to obtainbackground information on targets,employees, and building structure
Illustrates AQs interest in financial industry
facilities as targetsCommercial facilities, mass transit and rail are oftenco-located with financial institutions in Chicago, NewYork, Washington, DC, and other major cities
Suspicious Activity: AQ Casing Reports
Dhiren Barot
8/8/2019 Homeland Security Threat Overview
24/27
HITRAC
8/8/2019 Homeland Security Threat Overview
25/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
Critical Infrastructure Threat Analysis
Suspicious Activity: Some Conclusions Interesting convergence of incidents; but no definiteterrorism nexus
Foreign intelligence may provide valuable start points fordata evaluation
No discernable patterns or trends emerged to date tosuggest preoperational activity
Building increased relationships with Private Sector Useful in outreach and evaluation of their security
Cross sector evaluation challenges but potentiallybeneficial
HITRAC
8/8/2019 Homeland Security Threat Overview
26/27
26
Critical Infrastructure Threat Analysis
Al-Qaida Priorities U.S. is still the Brass Ring Other Western countries and
Western interests are validTargets
Aiming for the Spectacularor the Achievable?
HITRAC
8/8/2019 Homeland Security Threat Overview
27/27
UNCLASSIFIED//FOR OFFICIALUSE ONLY
Critical Infrastructure Threat Analysis Conclusions
Al-Qaida remains intent on attacking the Homeland and US interestsoverseas Opportunities may be reduced through increased security, but not
eliminated al-Qaida continues to adapt to security environments
Homeland-specific operational planning continues Affiliated Sunni extremists and like-minded individuals also harbor
intent to conduct mass-casualty attacks in the Homeland An attack by domestic extremist elements or affiliates (to include
homegrown extremists) will be viewed by al-Qaida as a success
DHS lacks credible information to indicate transnational terroristplanning for an attack against food and agriculture, But al-Qaida and other Islamist groups have shown interest in targeting
the food and agriculture sector
Food and agriculture is not the primary focus of domestic animalrights and environmental extremists, They have attacked food and agriculture-related targets in the past, and
likely will continue to show an interest in the sector