Terrorist Indicators and Warning Signs

Terrorist Indicators and Terrorist Indicators and Warning SignsWarning Signs

Los Angeles County District Attorney’s OfficeBureau of Investigation, Anti-Terrorism Unit

Supervising Investigator Daewon KimSenior Investigator Britton Schaefer

Los Angeles County District AttorneyLos Angeles County District Attorney’’s Offices OfficeBureau of Investigation, AntiBureau of Investigation, Anti--Terrorism UnitTerrorism Unit

Supervising Investigator Daewon KimSupervising Investigator Daewon KimSenior Investigator Britton SchaeferSenior Investigator Britton Schaefer

“Success in warfare is gained by carefully accommodating ourselves to the enemy's purpose.”

-- Sun TsuThe Art of War

LES//FOUO 3

Rules of Combat

A Public Service Announcement from The Los Angeles District Attorney’s Office

and The Joint Regional Intelligence Center

First Rule of Combat:

Know your enemy…Collect intelligence…

Exploit opportunities…

LES//FOUO 6

Second Rule of Combat:

Always know the status of your weapon…

LES//FOUO 8

Third Rule of Combat:

Always check your equipment before engaging the enemy…

LES//FOUO 10

Fourth Rule of Combat:

Confirm your intelligence and do not rely on a singular source…

Fifth Rule of Combat:

Prior to taking action, always verify the validity of your intelligence…

Training Objectives

LES//FOUO 15

• Prevention and Preparation Concepts• Pre-incident Indicators• Country of Origin / Travel • Life Styles / Activities/ Financials• Associations/ Documents/ Communication• Prison radicalization and the blending of

IT/DT• Case Studies• Investigative Considerations and the role

of the TSC and Fusion Centers

LES//FOUO 16

Elements of a Terrorist Cell• The elements of a terrorist cell can be

organized and labeled depending on their purpose or intent.

TerroristCell

Foot Soldier(s)

Material Supporter(s)

Terrorist Leader(s)

The Value of Intelligence• Specific / Timely• Related to a particular focus• Used to evaluate, draw conclusions and effect

decisions

Intelligence is only valuable if it can be Intelligence is only valuable if it can be communicated to others or applied to the communicated to others or applied to the mission.mission.

Did intelligence effect the decisions made in the following situation?

LES//FOUO 17

LES//FOUO 18

Pre-Incident IndicatorsQ: How can you know if you are

dealing with a pre-incident indicator?

A: Ask yourself if the signs are there…Does it pass the test?

LES//FOUO 19

Does it pass the PSAT TEST?

LES//FOUO 20

Prison Radicalization/Islamic ConversionSuspicious Persons / Activities / CircumstancesAcquisition of Supplies (money, guns, equip., supplies)Training – paramilitary, martial arts, specialized/tech.Test of Security – attempts to penetrate, test reaction

time/protocols/resourcesElicitations - gathering intelligence and information by

mail, fax, phone, Q&ASurveillance - video, photos, personal, maps/diagramsTest Runs/ Rehearsals

LES//FOUO 21

Country of Origin / Travel

Country of Origin / Travel

• Saudi Arabia, Pakistan, Afghanistan, Jordan, Iraq

• Sunni Muslim• Jordan-Christian minority• Iraq-Shi’a majority, Sunni minority

• If radical: Al Qaeda ideology

LES//FOUO 22

Country of Origin / Travel

• Egypt, Sudan, Palestinian Groups• Sunni Muslim• Egypt-Christian minority

• If radical: Muslim Brotherhood, Hamas-Palestinian

• Goals: destruction of Israel

LES//FOUO 23

Country of Origin / Travel

• Morocco, Algeria, Libya, Tunisia• North African• Indonesia, Malaysia, Philippines• Sunni Muslim• Philippines-Christian majority

• If radical: Al Qaeda ideology

LES//FOUO 24

Country of Origin / Travel

• Iran, Lebanon, Iraq, Syria• Shi’a Muslim• Lebanon-Christian minority• Iraq-Shi’a majority

• If radical: Hizballah-Islamic Theocracy

LES//FOUO 25

Country of Origin / Travel/ Status

• Check all passports and Visas• Ascertain travel history and seek more

information• Determine if Visa is valid and if purpose

of their visa matches their travel

LES//FOUO 26

LES//FOUO 27Always Inspect Passports and Travel Documents

Visa and Travel Documents• If subjects have H1B (work visas) or H4 (spouse

or dependant of H1B visa holder) visas inquire as to where they work

• If your subjects have R (religious visas)determine what country they are from and where they are sponsored as an Imam

• If your subject has a B-1 or B-2 (travel visas)Visa determine if they have overstayed their Visa

• If your subject has a F-1 (student visa) determine if a student and where they go to school

LES//FOUO 29

LES//FOUO 30

Suspicious Lifestyles & Traits

• Group of individuals without jobs or families (i.e. young, single males with no professional ties)

• Unknown to law enforcement or intelligence services

• Subject has, or associates with others with burns to hands, missing fingers etc. (bomb making)

LES//FOUO 31

LES//FOUO 32

Suspicious Lifestyles & Traits• Presence of bomb making materials or explosives

precursors in unusual amounts or arrangements + absence of narcotics ingredients

• Common commercially available products can be used to manufacture explosives

• Some products can also be used for illegal drug manufacturing

• Bomb labs can look much like drug labs• Only limited by the bomb builder’s skill, materials

available and the ability to deliver deviceLES//FOUO 33

Suspicious Lifestyles & Traits• Arranged marriages to facilitate US

citizenship or permanent resident status• We have most often seen it done with

Hispanic women. Women usually paid $5,000-$10,000

• Middle Eastern man/Hispanic “wife” living at separate residences etc….

• Lifestyle not consistent with known, legitimate sources of income

LES//FOUO 35

Suspicious Lifestyles & Traits• Change addresses frequently, and/or use

multiple Post Office boxes• Possess large sums of money not

consistent with known income sources• Buy or rent goods, services, vehicles,

accommodations with cash or by fraudulent means, or otherwise use false identification or indirect ownership

• Fundraising for a “charity”

LES//FOUO 36

LES//FOUO 37

Suspicious Activities• Testing of security or probing• Airports, airplanes, government buildings,

military bases• “dry run” examples - Syrian musicians• JRIC examples• Increase in attempts to infiltrate borders

(actual detentions, Fort Dix Plot, illegal immigrants crossed the Mexican border, millennium bomber)

LES//FOUO 38

LES//FOUO 39

Suspicious Activities

LES//FOUO 40

• Activities in the United States do not match visa (F-1, H-1B, H-4, R-1, B-1 or B-2 etc)

• Evidence of inquiries to companies involved in the production or distribution of weapons or chemicals

Suspicious ActivitiesPossible Terrorist Recruitment• Frequent contact with disaffected

populations (i.e. prisoners, radical student groups, radical mosques) or youth camps, Internet blogs or virtual communities

• Sponsor or lead paramilitary training(paintball activities, weapons training)-especially with young males

LES//FOUO 41

Radical Imam-Anwar al Awlaki• Spiritual advisor to 9/11

hijackers while in the US• Anwar al Awlaki- US

born, Yemeni radical Islamic cleric

• Led paintball trainingwhile in San Diego

• Imam at Mosque in San Diego and Washington DC

Radical Imam-Anwar al Awlaki

• Ties to Fort Hood Terrorist Attack- NidalMalik Hassan and 9/11 hijackers

• Ties to Umar Farouk Abdulmutallab (2009 Christmas bomber)

• Abdulmatallab traveled to Yemen prior to mission-met with Awlaki

• Currently in Yemen and still alive-runs a global internet site that spreads Jihad and hatred of the West

Paintball and the MSA• Fall 2001 edition of MSA Link, the newsletter of the

National Muslim Students Association (MSA):

“FIREARMS: Prophet Muhammad said: ‘Indeed, power is shooting, power is shooting, power is shooting.’[Sahih Muslim] Though there are arms training available to the public, many of them are expensive. If you cannot get someone to teach you, buy books about shooting techniques. However, one can join a club or go to a local shoot range, usually located on the outskirts of any town… Paintball is an excellent way to learn about combat”

LES//FOUO 45

Radicalization- Seyyid Qutb

• Egyptian-Muslim Brotherhood• Wrote “ Milestones”-Sunni extremist “guide

book”• Emphasized learning small portions of

Qu’ran at a time-10 suras-then take ACTION

• “Action becomes easy, the weight of responsibility becomes light, become living examples of faith”

Case Study: Prison Radicalization Jam’iyyat ul-Islam Is-Saheeh (JIS)

Gregory Patterson - plead guilty -conspiring to wage war on US & firearm charge –sentenced 7/21/08 +12 ½ years federal prison

Hammad Samana - underwent psychiatric evaluation-found unfit to stand trial -receiving psychiatric care at federal prison facility

Kevin James - plead guilty-conspiracy to wage war on US – sentenced to 22 years federal prison (2009)

Levar Washington - plead guilty-conspiracy to wage war on US & use of a firearm during offense- Sentenced 6/23/08-22 years federal prison

Case Study: JISRecruitment• Members: African American inmates, Crips, Bloods, and BGF• Recruitment practices outlined in JIS protocol• New members required to sign oath of loyalty to James

Activities• Planned to attack U.S. military targets and Jewish centers• Plans and maps found during search of Washington’s

residence• Raised funds through robberies of convenience stores (8/05)• Collected materials for attacks including weapons and

ballistic vest

The JIS Protocol

LES//FOUO 51

Case Study: 12/2009 UCSD PD• Detective Melissa Collins arrested subject for 496

PC warrant• Typical gang affiliation profile• Recent prison incarceration + radicalization• Converted to Islam in prison• Stolen military uniforms (still in plastic wrapping)• Brochures of Cabrillo National Monument located

next to military base• San Diego area offers target rich environment

Al Aqsa MosqueAl Aqsa MosqueDome of the RockDome of the Rock

The Grand MosqueThe Grand MosqueCrescent and Star with scimitar Crescent and Star with scimitar

JihadJihad

Suspicious Activities• Specialized journal/magazine subscriptions

including aviation or scuba diving• Attendance at closed or secret meetings -

something you might see on surveillance (often occurs in restaurants)

• Variations in arrival/departure times/routes, use of counter surveillance/operational security (New York Plot)

LES//FOUO 55

LES//FOUO 56

Suspicious Activities• Spec. Training – scuba, flight or weapons• Foreign travel after Islamic conversion• Police report for “lost or stolen” passport or

other ID documents.

• Frequent use of rental cars (Zazi)• Exclusive use of cash (large purchases)• Name change / aka’s (op sec or conversion)• Name change to be “less ethnic” (Headley)

LES//FOUO 58

Case Studies:

1. Fort Dix Plot

2. Army Recruiter Murders

3. 9/11 Case Study

4. Traffic Stop – LASD Walnut

5. Muslims of America-Jamaat al-Fuqra

Fort Dix PlotBackground:• 05/07 six radical Muslims were arrested by the FBI

for plotting to attack Fort Dix, NJ with the intention of “killing as many soldiers as possible”.

• The men video taped their weapons training and were yelling “Allah Akbar” (God is the greatest) while firing semi-automatic weapons

Result:• 4 of the suspected terrorists were sentenced to life

in prison• 1 received 33 years, and 1 was acquitted

LES//FOUO 60

LES//FOUO 61

US Army Recruiter Murders- The Associated Press - Wednesday Jun 3, 2009

• LITTLE ROCK, Ark. — Carlos Bledsoe (aka Abdulhakim Muhammad), a Muslim convert who pleaded not guilty to killing a soldier outside a recruiting center had the firepower to take out many more while on a mission to “kill as many people in the Army as he could”

• Considered other targets, including military sites and Jewish organizations in the Southeast.

• “he would have killed more soldiers had they been in the parking lot.”

LES//FOUO 62

The Investigation:• Computer research multiple sites/different states • Was under (JTTF) investigation since return to

the US from Yemen- jailed in Yemen for using a Somali passport.

• Search warrants = weapons ammunitionincluding an SKS assault rifle believed to be used in the shootings, a .22-caliber rifle with a laser sight, other firearms, Molotov cocktails, homemade silencers and compact disks with Arabic writing on them.

• In truck = bottles of water, packaged food and a butane lighterLES//FOUO 63

LES//FOUO 64

Muhammad targeted soldiers “because of what they had done to Muslims in the past.”

Case Study: 12/2009 9/11 Lead• Current investigation – details withheld

Background:• Super Bowl Sunday (January) 2000 - police

officers/federal agents contact 15 Middle Eastern men near the San Diego/Mexico boarder in the desert

• Firearms training with automatic weapons(AK-47’s), some illegally modified to fire fully automatic (modified seers)

Case Study: 12/2009 9/11 Lead• Most of the men were wearing full traditional

Muslim beards (some did not)• Upon contact, the suspects spoke with a

“high level of intelligence” and could articulate their reasons for shooting etc.

• 16 passenger van loaded with a “significantly large amount of ammunition”

• All subjects released after questioning

Case Study: 12/2009 9/11 Lead

• After 9/11 - it was believed that 3 of the shooters were 9/11 hijackers (including Mohammed Atta -the 9/11 cell leader)

• It appears all could have been arrested for weapons charges

• Could 9/11 have been prevented / disrupted?• What about the wars Iraq and Afghanistan?

Case Study: Traffic Stop – LASD

• LASD Walnut – 01/03/2010 - traffic stop for minor traffic violation

• Investigation led to discovery numerous indicators

• How many do you see?

Case Study-Jamaat al-Fuqra

• “Community of the Impoverished”• Leader-Sheikh Mubarak Ali Gilani-

Pakistani• Established in US in 1980• Mostly African American converts who

converted to Islam in prison• Goals- Purify Islam through violence• AKA- Muslims of America (MOA)

Suspicious Associations• Subject appears in photographs with

known terrorist suspects or brags about associations

• Subject in photographs with individuals who are armed/ dessert environment/ weapons training

• Subject has photographs of known radical Islamic clerics or leaders Shi’a interview example

LES//FOUO 72

(Photos from 2010 Search Warrant)Martyred Hizballah Terrorists

Suspicious Associations

• Associations with clerics or institutions known to have affiliations with radical movements-radical mosques/ Muslim Student Associations (MSAs)-unmarked mosques/low profile/strip malls

• Association with known or suspected extremist sympathizers/supporters

LES//FOUO 74

LES//FOUO 75

Identification Cards

LES//FOUO 76

• Theft or disappearance of government or security uniforms, id cards, badges, license plates or vehicles

• Used for infiltration or surveillance• Surveillance on critical infrastructure-

photographs, maps, drawings etc.• San Diego lead/ Hoover Dam surveillance• Rental of storage units for suspicious

items

Jan 2010 CBP DetentionArmy Imposter

• Entered US from Columbia

• Possessed false set of orders

• Nervous demeanor-claimed to be in Columbia for paintball

• Possible connections to FARC

Jan 2010 CBP DetentionArmy Imposter

Proper uniform insignia.Top: Combat Infantry Badge 2nd AwardCenter: Master ParachutistBottom: Air Assault Badge

LES//FOUO 79

LES//FOUO 80

Case Study:

2009 LA FBI Case Hizballah Subjects

Case Agent: Sr. Inv. Carlos VillamayorLADA / FBI-JTTF Los Angeles

Subject #2Subject #1LES//FOUO 82

LES//FOUO 83

LES//FOUO 84

Subject #1

LES//FOUO 85

LES//FOUO 86

Flag of Lebanon

LES//FOUO 88

LES//FOUO 89

LES//FOUO 90

Subject #2

Flag of Lebanon

LES//FOUO 91

LES//FOUO 92

Hassan NASRALLAH, Leader of Hizballah

Subject #1

LES//FOUO 93

Hassan Nassrallah

LES//FOUO 94

LES//FOUO 95

Flag of Lebanon

LES//FOUO 96

LES//FOUO 97

LES//FOUO 98

LES//FOUO 99

LES//FOUO 100

LES//FOUO 101

Mecca

LES//FOUO 102

LES//FOUO 103

LES//FOUO 104Al-Aqsa Mosque, JerusalemProphet Muhammad’s Grandson

“Unbelievers”

Suspicious Documents

LES//FOUO 105

• Personal identification documents stored in other than the usual locations(desks, dressers, closets) or containers (lock boxes etc.) including on computers

• Possession of passport photos of other individuals (indicates illegal identification production)

Case Study: Shamsha Laiwalla

• Access to DMV, SSA, ID docs, court docs, birth certificates, U-Haul, PO Boxes

• Pakistan born (Nat. US Cit)• Devout Shi’a Muslim (Ismaili)• Frequent travel to Pakistan and

South Africa carrying large sums of money

• UC Buys: CDL, birth cert, SSN, veh title and plates, traffic school cert, smog certs

LES//FOUO 108

• Significant differences in a subject’s appearance and photographs in identity documents (pre immigration)

• Attempt to change appearance to not be recognized by governmental agencies with access to photographs

• Attempt to appear Westernized

• Subject possesses information on critical infrastructure (visits web sites relating to dams/water supplies; possesses a marked up map etc)

Suspicious Documents

Mohammed Atta, Leader of 9/11 Terrorist Cell

AfterBeforeLES//FOUO 109

Ziad Jarrah and Mohammed Atta

LES//FOUO 110

LES//FOUO 111

Jarrah was apparently the only 9/11 hijacker to have close family ties, including with his uncle Assem Omar Jarrah whose work permit would later be found in the wreckage with Ziad's passport. In his childhood, he had always wanted to fly planes, but his family discouraged this. "I stopped him from being a pilot," his father told the Wall Street Journal a week after the attacks. "I only have one son and I was afraid that he would crash."

Jarrah in a flight simulatorJarrah during flight training

Ajmal Amir Kasab, Captured Mumbai Terrorist (Nov 2008)

LES//FOUO 112

Suspicious Communications• Exclusive use of public telephones,

telephone cards by individuals who otherwise have an address or residence (protecting communication)

• VOIP or use of companies that provide long distance telephone lines (proxy servers) to the Middle East (Mumbai)

• Sudden discontinued use of telephone number, e-mail account or other means of communication (believing no longer secure) for operational security

LES//FOUO 113

LES//FOUO 114Always Inspect Postmarks and Addresses

Suspicious Communications• Discussions in chat rooms

catering to specific professional, cultural, religious or special interest groups

• Social Networking sites-My Space, Face Book etc.

• Posting of recruitment material on internet sitesLES//FOUO 115

Suspicious Communications• Arabic logo, company

based in UAE• Sat phones are small,

lightweight and can provide secure comms around the world

• Advance need for communications

Indicators of Other Criminal Activity• Multiple Identification Cards• Multiple Credit Card (different names)• Unaccounted Sources of Income• Fraudulent Activities

LES//FOUO 118

LES//FOUO 119

• Counterfeit Merchandise

• Suspicious Transfer of Funds (stored value cards)

• Fundraising for a “Charity”

• International Money Transfers (casa de cambios)

• Structuring• Hawalas

Indicators of Other Criminal Activity

LES//FOUO 120

Q: Who will protect us?Q: Who will protect us?Q: Who will protect us?

A: Law EnforcementA: Law EnforcementA: Law Enforcement

CT Mission and StructureMain mission is prevention1. Threat Squads to assess initial reports

(JTTF + Fusion Centers)2. DT Squads with emphasis on specific

groups or critical infrastructure security3. IT Squads with emphasis to a specific

group or a region4. Partnerships with local law

enforcement

LES//FOUO 122

Resources for Law Enforcement• Joint Terrorism Task Force (FBI JTTF)• Terrorism Screening Center (TSC)• Terrorism Liaison Officers (RTTAC)

– Contacts with other public safety agencies– Investigative support– Logistical support and resource allocation– Information / Intelligence assessment and

analysis

LES//FOUO 123

Case Study: CIA Interrogation• December 2009, authorities discovered

another Christmas terror plot• The CIA interrogated a detained suspect

in an undisclosed location• Identify the intelligence gained from the

interview • Identify the indicators• Is the suspect a TERRORIST?

LES//FOUO 128

Who will protect us?Who will protect us?Who will protect us?

The duty of protecting the U.S. from beyond our

borders, rests with our Military.

The duty of The duty of protecting the U.S. protecting the U.S. from from beyond our beyond our

bordersborders, rests with , rests with our our MilitaryMilitary..

The Role of Law Enforcement The Role of Law Enforcement The Role of Law Enforcement

The duty of protecting the U.S. from within our borders, rests

with Law Enforcement (and public safety

professionals).

The duty of protecting the U.S. from within our borders, rests

with Law Enforcement (and public safety

professionals).LES//FOUO 129

LES//FOUO 131

God Bless the United States of America

God Bless the United God Bless the United States of AmericaStates of America

Thank You

Stay Safe

Thank YouThank You

Stay SafeStay Safe

LADA Senior Investigator Britton Schaefer 213-379-1223 / bschaefer@da.lacounty.gov

LADA Supervising Investigator Daewon Kim213-216-1252 / dkim@da.lacounty.gov

LADA Senior Investigator Britton Schaefer LADA Senior Investigator Britton Schaefer 213213--379379--1223 / 1223 / bschaefer@da.lacounty.govbschaefer@da.lacounty.gov

LADA Supervising Investigator Daewon KimLADA Supervising Investigator Daewon Kim213213--216216--1252 / 1252 / dkim@da.lacounty.govdkim@da.lacounty.gov