« Separating fact from Able Danger fiction | Main | Able Danger details reported in 2003? »
September 19, 2005
Testimony of Kie Fallis from 2002
This seems especially relevant in light of need for the DIA to "reconstitute the Able Danger capability" which it apparently never reconstituted after 9/11. (The new project is Able Providence).
This part in particular sounds a lot like the "Able Danger" tool set:
FALLIS: In my case, Senator, what I did is, I began to notice there was a voluminous amount of information, as others have testified, regarding Al Qaida. Most of it appeared to be unrelated to other pieces of information. It appeared to be almost chat. By using a piece of software that I was able to put these small snippets of information into, and graphically represent them as well, I was able to, over a course of many months, to determine certain linkages between these items -- linkages that would never be apparent without the use of this tool. It would be lost in the weeds. And there were a lot of weeds to look through.
Statement of Kie Fallis to the Joint Intelligence Committee on October 8, 2002 during the investigation into 9/11:
FALLIS: Thank you, Senator Roberts.Mr. Chairman, members of these committees, I'd like to tell that it's a great honor for me to come before you today to have a discussion about the subject at hand. And I would also like to say that it's a great honor for me to be a part of this group of distinguished Americans at the table here, as well.
That said, my comments today will be strictly from the perspective of a former terrorism analysts, employed at the Central Intelligence Agency. What I'd like to do is to briefly summarize my written statement. And I want to move, sort of immediately, to this part on terrorism analytical issues complicating improved future performance.
The single most important issue that will affect future performance is the experience out of the analysts. While this certainly applies to all intelligence analysts regardless of subject area, it is even more critical for those trying to prevent the next terrorist attack. In the case of an analyst responsible for tracking a Middle Eastern terrorist group, this person will need to be -- will need to have an expertise or at least a good working knowledge of terrorism itself, the group that they have for an account, regional and country issues present in the group's operating area, which can be quite extensive, and Islamic history, culture and the sex there of.
This sort of required level of expertise is rarely going to be found outside the intelligence community and is instead going to be recruited from academia and then developed in-house through training programs and mentors.
Coupled with this issue of experience comes the ability to place current intelligence reporting in the context of historical perspectives. In the period leading up to the 1998 East Africa bombings, and the 2000 attack against USS Cole in Yemen, terrorism analysts, nearly across the board, incorrectly assessed that a group would not conduct an attack in an area where it was able to operate with relative ease. Additionally, there appears to be a continued reluctance to correctly assess and evaluate the nature of cooperation between many Sunni and Shiite Islamic extremist groups. Both of these examples, and there are certainly others, occurred despite over a decade of credible reporting to the contrary.
The other significant issue complicating future analytical performance against terrorists is the tendency of the FBI to compartment all pre and post-attack investigative information. I realize this committee has spent a great deal of its time looking at the many legal and other aspects of this problem, and I am not qualified to comment on those findings. However, as a former terrorism analyst and liaison officer to the FBI, I can tell you that having this information is critically important to being able to predict a future event.
If the communities' analysts are left in the dark about how a group puts an attack together, and each group does tend to do things a little differently, how will those analysts be able to pick up on future indicators of a future attack? Quite frankly, it's nearly impossible.
The investigative -- as an example, the investigative results of the 1996 Khobar Towers bombing were not disseminated until almost two years after the event, and then only to a few select analysts and agencies.
Another issue would have be what have occurred right prior to the 1998 East Africa bombings, and that's -- U.S. agencies had conducted a vigorous investigation to include a physical search of the Al Qaida cell leader in Nairobi almost a year prior to this bombing. Almost all of the results of this effort weren't shared with the terrorism analytical community due to concerns -- legitimate concerns about the criminal case. Most of the information was never properly exploited. And after the embassy bombings, the post-attack investigative results were not shared.
Now as a result, by failing to share the information, bin Laden analysts were unable to build a correct modus operandi for Al Qaida attacks. And like the Khobar Towers example, they were unable to attach the proper level of importance to those culpable individuals still at large. This directly contributed to most analysts having only a moderate level of interest in the January 2000 Malaysia meeting of Al Qaida operatives, when in fact the same node that has organized the meeting in Malaysia was in fact responsible for a great deal of the planning for the East Africa bombings.
Moving on to my conclusions, the collection of additional information, further reorganizations and the hiring of additional analysts is unlikely to significantly effect any of these issues. The central hub in our nation's past, present and future failure or successes in the counterterrorism arena will rest squarely on the shoulders of the working level, all-source analysts in both the law enforcement and intelligence community.
These men and women are the hard-working patriots who will have to try and find that single piece of hay in a stack of needles, and then try to tie it to another disparate piece of information in a timely manner. This will never be an easy job for them to accomplish, but the leadership of America's intelligence and law enforcement communities must provide them with the training, tools and information to accomplish the mission.
The information they need to successfully predict and prevent the next terror attack is probably already contained in one or more databases inside the U.S. intelligence and law enforcement community. The only question is whether experienced, working level analysts will be given access to that information and will properly integrate that material into an accurate advisory warning.
Thank you and that will conclude my remarks.
You can read the transcript of the question and answer portion below.
ROBERTS: Let me just follow up with a question if I might. How did the use of the analytical software tools and the databases that you put together, that gave you insight, in regards to the draft that you tried to prepare improve your ability to produce the intelligence assessments on various terrorist groups? And how do we get that information to the analysts as you have just described?FALLIS: In my case, Senator, what I did is, I began to notice there was a voluminous amount of information, as others have testified, regarding Al Qaida. Most of it appeared to be unrelated to other pieces of information. It appeared to be almost chat. By using a piece of software that I was able to put these small snippets of information into, and graphically represent them as well, I was able to, over a course of many months, to determine certain linkages between these items -- linkages that would never be apparent without the use of this tool. It would be lost in the weeds. And there were a lot of weeds to look through.
FALLIS: The reason it makes it easier by using this, and it makes it much easier to collaborate with other analysts in the intelligence community, in the FBI, CIA and others, to bring your findings, share their findings, and then work together towards a common goal of preventing the next attack.
ROBERTS: We've heard from Mrs. Hill -- or pardon me, Ms. Hill in another hearing so if we often do not anticipate these attacks, how can we do better?
FALLIS: By making better use of the information that we've already collected, quite frankly. There's a -- we have literally a treasure trove of intelligence information spanning back decades. And the proper examination of that information, the proper databasing and building of relationships among -- with that information, I think, will give us the results, not all the way to the extent that we might want them, but it will take us a lot further than we are now.
ROBERTS: We've heard that in order to get the warnings out the right people, that it would represent a flood to the policy makers and others with what we call constant vague warnings or warning fatigue. How can we ensure that that doesn't happen?
FALLIS: That's a very difficult thing to accomplish, because too few warnings and the information's not going to get across, too many and you induce warning fatigue. I think the answer lies in the analytical efforts against terrorist groups to be conducted more efficiently and effective, to gather the details, mined from the data that are there, put them together into a collaborative assessment, and then produce better and more correct and more thorough warning products, perhaps fewer, but more pressing and more accurate.
ROBERTS: Senator Rudman called for bringing in outside experts on a more regular and systematic basis. And our inquiry has heard from others that some in the intelligence committee, at times, lack the expertise. Can these experts be found? And can they be brought in to improve analysis?
FALLIS: Oh absolutely, and that was done routinely. And frequently individuals in the counterterrorism center, the leadership there, would attempt bring in academic experts and others. And I would say that they contributed a lot to the effort of the communities' analysts.
ROBERTS: I want to ask you a question, and it appears to be, you know, perhaps too basic, but -- how do you do your job? It's a lot like when my daughter asks me, when she knew I was a Senator, and she said, "Well, daddy, what do you really do, you know, when you go to work?" I want to know how you do your job. Can you describe the type of information you use and how you put it together and what happens to it then? Just give us an idea from a typical, although you're an atypical analyst from your background and your work. And I thought it was pretty assent, but I understand now that it is prescient. But at any rate, to that ability that you have -- what do you do when you get up in the morning and you go in and you're an analyst?
FALLIS: The first thing I would generally, Senator, would be to look through all of the national products that would be available to me in message queue, in a computer terminal that would be sitting on my desk, to sort of set the ground for what had been happening in the previous 24 hours.
From that point, I would move to a message traffic handling system where I had built a profile of certain key words that would hit on certain messages being brought in. You then sometimes have up to 200 messages a day to read through. From those, I would try to pick out the most compelling information, the most accurate, the best- sourced to begin populating my database with.
Then throughout the day you'd be talking to your counterparts at the CTC and/or the FBI. And putting together assessments or other products as directed. It could be exciting, and at times it could be mind-numbing.
ROBERTS: Is this what we call rocket science? Is this really hard work? You know, we hear about the analyst who has to have all this expertise and background, et cetera. You have that. You're fluent in Farsi. You're a student of that part of the world. In terms of recruiting and training, how tough is this?
FALLIS: The act of producing -- of doing analysis and producing assessments is not -- it's certainly not rocket science and it certainly isn't pushing any intellectual boundaries. It does require time to build the experience to become what we would call a working- level or a journeyman-level analyst. There's nothing special about it. As I related to both committees, I certainly did nothing special in the period leading up to the attack on the USS Cole. I think all I did was consistently read all of the traffic I could. And then instead of just moving onto something else, taking the traffic and trying to exploit every piece of information in it to see where that would take me.
ROBERTS: Bottom line, do you have a recommendation in regards to -- in behalf of all your analyst colleagues out there who are doing the hard-working work, as opposed to all of the very important and necessary officials that we normally have here who testify?
FALLIS: I would say that we need -- we need two things increased -- two areas of concern that are going to have to be addressed, and that is the ability of analysts across the community to collaborate on their efforts, and in doing this collaboration, to have the most possible information available to them.
Obviously, we have to be concerned about whether people are properly cleared. They have to be in order to receive certain information, read into certain programs, but by reaching that sort of apex of good, experienced, hard-working analysts with the tools they need to do the job, I think that we will -- we will have a lot of the information to predict their next act of terrorism.
And more importantly, even now, looking back at the information that we had, many people will say, "Well, that was too vague. That wasn't quite enough. That didn't point to this." And that's absolutely true, but if it had been put together, and if the gaps had been properly tasked out to collectors to follow up on and to exploit, there's no telling where that could have led to.
Posted by Mike at September 19, 2005 02:28 AM
Trackback Pings
TrackBack URL for this entry:
http://www.topdog08.com/cgi-bin/mt-trackback.cgi/768
Comments
Post a comment
Thanks for signing in, . Now you can comment. (sign out)
(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)