Office of the Director of National Intelligence Washington, DC 20511 SEP 2 9 2015 Steven Aftergood Federation of American Scientists 1725 De Sales Street NW, Suite 600 Washington, DC 20036 Re: ODNI FOIA Request DF-2011-00039 Dear Mr. Aftergood: This is in response to your 3 February 2010 email to the Office of the Director of National Intelligence (ODNI) (Enclosure 1 ), in which you requested, under the Freedom of Information Act (FOIA), a copy of the releasable portions of the report resulting from a review of intelligence lessons learned from the Fort Hood shooting, the Christmas Day bombing attempt, and other incidents. Your request was processed in accordance with the FOIA, 5 U.S.C. 552, as amended. A thorough search of our records and databases located material responsive to your request (Enclosure 2). Upon thorough review, the material was found to contain information that is currently and properly classified under Executive Order 13526, Section 1.4(c), and is therefore withheld pursuant to FOIA exemption (b)(1). Information was also withheld pursuant to the following FOIA exemptions: - (b)(3), which applies to information exempt from disclosure by statute, specifically: o the National Security Act of 1947, as amended, 50 U.S.C. 3024(m)(1), which protects, among other things, the names and identifying information of ODNI personnel, and o the National Security Act of 1947, as amended, 50 U.S.C. 3024(i)(l), which protects information pertaining to intelligence sources and methods. If you wish to appeal our determination on this request, please explain the basis of your appeal and forward to the address below within 45 days of the date ofthis letter. Office of the Director of National Intelligence Information Management Office Washington, DC 20511 The document was also coordinated with other agencies-their redactions are noted in the document. If you have any questions, email our Requester Service Center at DNI-FOIA@,dni.gov or call us at (703) 874-8500. Sincerely, I J/ . /;~'hhLne internal and one external to the Intelligence Communityto speculate on what terrorists might consider next, and how the intelligence and law enforcement communities can anticipate those challenges. We incorporated some of their ideas in formulating our recommendations. - Finally, we brought in four external experts to review the draft and offer comments on its logic, clarity, and recommendations. (U) Despite our best efforts, our work remains incomplete: new information continues to arrive that refines, clarifies, or challenges our understanding of both events. We had limited access to some materials related to the Fort Hood incident, some of which undoubtedly would affect our judgments; agencies and departments varied highly in the level of detail they provided; and we had only 90 days to research and draft this report. - W c focused more on the 25 December incident because the implications and responsibilities ofthe Intelligence Community were greater than in the case of Fort Hood and because both the Department of Defense (DoD) and the FBI had commissioned outside reviews concerning Fort Hood. Where possible, we relied on information gathered for these and other studies, such as the ODNI 30-day review. - FBI Headquarters asked us not to interview field agents because the Army team responsible for prosecuting Hasan indicated that these agents are possible witnesses in the military prosecution. - Similarly, we were unable to obtain the restricted annex of the DoD Independent Review Group's report on the Fort Hood Incident, referenced in media reports discussing derogatory information on Hasan that was not included in his official DoD personnel filcs.3 (UHFOUO? It is very important to note that what follows is written in the spirit of critical, objective self-evaluation that has characterized the Intelligence Community. Our posture is one of assessing these events dispassionately and clinically, fully aware that the shortcomings are not typical of the Intelligence Community's counterterrorism performance. Our aim is simple: to develop a clear-eyed, independent understanding of what we need to improve in order to make the Community's performance even lsive. ~lte was quickly subdued by fellow passengers and taken into custody upon landing. (U) What. foll()WS .aze tactual account$ OfWlaatthe intelligence and law enforcem.ent ~ties aid in the nmup to these events~ These are not~ to be exhaustive. These accounts highlight, based~ . available data, what the Community knew; when and how it knew it, and where the Community night have bad an opportuni~ to affect the coo.tse of.CVQ~ts. {U) This assessment was prepared for the Director . .QfNational Intelligence by the Intelligence Community Review Panel. (U) . b For additional detail on the facts and circumStances leadiitg up to the shootings at Fort Hood. see the DoD, FBI. and ODNI Preliminary Review of Intelligence Olll!i Intelligence.~ on Niddl Malik HfJStlliPrlor ftJ lhe Fort Hood *Shoot.,* submitted to tbe White House on 30 November 2009, the DoD West-Clark report.. Protecting the, Force. *Lessons from P:ortllood,* and the forthcoming Iq)01't by Judge Webster~ who~ kading an independent reView oftbe FBI's acti.tins With respect to ## Top Seoretj/Fig&Iswjorcon/T40Forn.. LNnnnt" - Easing standards to place more suspected terrorists on the No Fly/Selectee lists carries clear tradeoffs, such as a likely surge in false positives. Allowing collectors to nominate suspected terrorists on partial names-increasing the likelihood of detecting their travel-risks compromising collection programs when individuals are linked with aliases used only in their covert communications, while better information sharing with foreign governments or the airline industry inCt'eases the risk of compromising sensitive information. - Requiring the airline industry to do more to support the Intelligence Community-such as sharing passenger lists earlier than 30 minutes before takeotf-cottld require earlier check-in times for travelers, undoubtedly an unpopular move. 65 Requiring that airline companies tilfonn the US Government whenever an individual on the No-Fly List tries to purchase a ticket probably would meet with complaints that.the US Government is imposing eostly additional bmdens on the industry. - Instituting a minimum waiting period to acquire a US visa, which would give State Department and the Community more time to research suspicious applicants, would undoubtedly prompt complaints and perhaps even in-kind retaliation from some foreign governments. (S/INF) ## Missed Opportunities: The Context Ud The Cousequeoces (U) As the panel reflected on these events; we wete acutely a'Wal"e that hindsight always brings greater clarity. We also readily concede tbatourjudgments are in some ways provisional, because new information wi11 probably emerge in the coming months. We learned this lesson in (b )(1) (b)(3) NSA - These events did not occur in a vacuum; the operational tempo and workflow for the Intelligence Community were heavy and sustained throughout 2009 and in the lead-up to both incidents. Both cases had novel aspects not previously seen by the Intelligence Gommunity; the 25 December incident was the first attack against the homeland by an al- Qa'ida affiliate. - Nonetheless, the intelligence reporting that could have led the Community to identifY Umar Farou.k as a potential terrorist threat before 25 December merited greater scrutiny-although Intelligence Community follow-up actions would not have necessarily have kept him off the ajrplane. - Causes of these "missed opportunities" ranged :from human error to poor decisionmaking; heavy work volume; an occasional lack of individual inquisitiveness or understanding about who was responsible for driving an issue through to its resolution; ambiguous roles and responsibilities; a lack of understanding of key databases; and information technology systems that do little to help officers and agents find and correlate key bits of reporting amidst a sea of data. (TSNSI/~) During our review, Ml' were consistently impressed by the pttce, scope, breadth, and depth of the Community's counte'*"orism efforts throughout 21HJ9, IIIIJY of which produced 1llllhle SllCCesses. - During ~period, analysts were tracking net-~emhtJt~l!ftisietH~~tT could be doing:.....tb.is is true . But ooosider 'Miat woUld ja.ve~~if~l'f'~~~-cU') 1he Community to assist with nominations fer watddisting: - A system with the sophistieated entity resolution capabilities oouldautomatieany .build'8m\i~TmE dossiers based on data available to NCTC. - An algorithm could give these dossiers p.relimiuaey"score~t~tlle~'of~~ criteria, taking into account presence ofdle necessay~(iil'l~ dllteo~ ete:hatf~cOf associated derogatory (i.e . membership in a temmst ~). ' "' - These computer-generated doSsiers would flow to the watchtisting aoaiysts for processing. with the relevmt biographic and probable derogatory data bigb1igbted. AB new infOmlation came in, the~ would highlight it in the dossiers pushed to the analysts. - While we cannot be sur:e without expetimentation, we think it likely that ovm time the algorithms also could be trailled to identitY the probable watchtisting criteria. tbst the dt:Jssier fits. {S#NF) ...,..,(b-)( __ 7,...,.,)(E""'")--,j - Analysts need to use 11DE as a primary repository of intelligence rather than merely as a step in the watchlisting process. In focusing on placing suspected terrorists on the No Fly list, the Community appears to have missed opportunities to use TIDE as a powerful tool for aggregating all derogatory and identity reporting on suspeered terrorists; we recommend that NCTC take ~lead in a Community-wide training progi'8Jn to help 'all agencies understand the purpose of TIDE, been fed into other watchliSt databases. The fragmentary nature of counterterrorism reporting makes it imperative that analysts lean forward in populating TIDE with derogatory and partial identity intelligence rather than waiting to assemble a comprehensive intelligence package that meets all of the criteria for No Fly status. - The Community needs a standardized training program on the specif:cs of *watchlisting.* We have seen some. review groups claill1 that the 25 December incident proves a need for centralized analytic tradecraft training, but in our view a more pressing n~e clearly related to the Flight 253 incident-is a common and~ understanding of the watchlisting process. IfTSC remains the final voice in the No Fly/Selectee decision, it should be the lead agency to direct such a training effort. so that its standards are clear to all nominators. (:!1/M') To Slllfl1tftlriz. tlll1' recommentlotiom, the Commtmity shollhl: )- Use 1111-soiii'Ce hol4ings for searcltes on terrorist identities; let1ert1tfe techMiogy such flS "fu;::zy logk" fOr lfll1tfe wuilmts, *and* ~disctwertibillt" tllwtlUltVes when there is relevant information in lllltJtlrerlocation; train oflkers to use all the Sil&nt details tltllt Cllllfii17'0W IM search and identih im lndividllaL )- Clarify the criterillfor waichlisting in a way tlult does not become excessivezy specific, OltDOilS, and legalistic. };;> EsttdJJish a t1'tlining program that will J1"ff"itk greater cltnity on the purpose of TIDE, the roks and respun.sibiliti of agencies that may popu/Gte it, and how TIDE }its into the larger watchlisting process. };;> Instruct analysts to populate TIDE with partial derogatory information---mtJking TIDE "the place to build a dossier" -rather tlum tl'eflting it flS a library of completed watc11/ist nomintdions. (CtiNF) ## Information Technology: Managing The Signalsto-Noise Volome Inadequate information technology runs through both the Fort Hood and the NW Flight 253 narratives, particularly the inability of IT systems to he)p analysts locate relevant reporting in a sea of fragmentary data or to correct for seemingly uWro:r human errors. The Intelligenee Community's IT tools-wbicb generally lag several years behind those of private industry, and even f.artherbebind tDosc available to home users-did not help io1e1Ji8ence officers and agents correlate data that could have increased the probability of Abdulnmttalab and Hasan rising above the noise. Indeed, the incidents highlighted what we assess are the two main technological problems facing counterterrorism offiCers: - Limited visibility and accessibility of counterterrorism data that are distributed across multiple, discrete databases and *systems.* NCfC analysts, for example, have access to more than 28 separate databases and systems, each of whicho for the most part, has a separate log-on. This means analysts have to search. each.~ separarely before trying to identify connections among their results. - Search capabilities do not allow foil exploitation of existing data. In most cases, users must know in advance what to look for using Boolean searches to find terms in individual reports as they are received by the Community. This approach is intolerant of even simple mistakes in the queries and does not enable questions like: list everyone that is potentially affiliated with AQAP and bas a passport or visa that would permit entty to the United States or UK. (SI/1'W) In our view, these shortcomings are the result of a fundamental problem in the Community's approach to IT -there is no accepted and comprehensive, Community-wide strategy. The Intelligence Community lacks a common vision of a desired end state, a common understanding of the potential benefits, and a coherent Community-wide strategy for development and acquisition. - Continuing the CUJT\mt course willbecome even more problematic as tbe amount of data increases and almost certainly ensures additional incidents in whiclt.~~Con.ummity~ .. aftel~ &1 it\bad access f()cfaf.a~.have enabled detection and PotentiallY dist:UI)tion of an attack. - As the preparations for attacks are concealed more and more effectively, the planning periods decrease, and terrorists adopt new modes of attack improved information technology will be vital. The existing processes, policies, and operations will not suffice. ~).. We propose three sets of recommendations-near;., mid-, and long-term-that seek to enable fuster adoption throughout the Community ofiT solutions that will reduce our reliance on human beings' inherently limited ability to sift and correlate vast amounts of data in their heads. Our recommendations range from incrementally upgrading existing applications to fundamentally reimagining the Intelligence Community's IT infrastructure; many can be accomplished in parallel. - These recommendations are intended to serve only as a starting point. IT is a moving target, but waiting and debating in search of a comprehensive, perfect solution is dangerous; the importa[lt thing is to get started. - When implementing these recommendations or taking any other steps to enhance the Community's IT infrastructure, it will be important to adhere to four key methodological principles: invest in computing capacity ahead of need, embed developers with users, adopt a modular approach based on separation of applications, data, and infrastructure, and experiment. Details of our proposed methodology for implementing these recommendations are found in Appendix C. (S/INF} We assess agencies' desire and need to protect some of their information will be the primary obstacle to implementing these recommendations, but this barrier is surmountable if policy, tecluiology, and operations can co-evolve. Technologists need to demonstrate capabilities that instill confidence that access can be limited to authorized users, thereby addressing the concerns underpinning current information rna .. (b)( 1) (b)(3) CIA shows that assessments of this tradeoff can change as new technologies are introduced. - Many of the people we interviewed assessed that policy on handling US Persons data,97 1aw enforcement data, and sensitive source data was limiting the Intelligence Community's ability to aggregate and exploit available data, especially information pertaining to critical domestic-foreign nexus issues. - There is no perfect solution to the risk/benefit tradeoff on enabling correlation of data from the ## J(B)(?)(E) I Community's most sensitive sources, but the counterintelligence calculus on terrorism data should be looked at through the prism of risk entailed in the event a terrorist act is not detected. (S/~W) Moving Forward on *Information Technology.* Our recommendations fall into three categories: near-term changes with limited resource implications, intermediate changes that require more time or resources, and longer-term efforts that we view as essential for the Intelligence Community to at least match capabilities already widely available outside the Community. - Many of our recommendations are not novel. Several have been discussed for decades, and some already are underway.~M We emphasize them here because we view them as essential for the Community to increase the likelihood that the right "signals" emerge from the "noise." - For our recommendations to be effective, they need to be followed with particular urgency and fidelity by the four Intelligence Community entities with the broadest responsibilities for counterterrorism- CIA, FBI, NCTC, and NSA. There are no organizational barriers to these four agencies to collaborate to improve their ability to exploit data that they already share. (U/fFOUO) In the near term, the Intelligence Community must address the problem-as evidenced in both incidents-that many officers do not know what data they are accessing, what other relevant data exists, or how to exploit it. - Greatly increase online documentation related to datasets by, for example, tagging and registering them. This information should be easily accessible and include what data are available, how to get access, who has access, and tips from experienced users. - Enable authorized users to access and use all-source data and applications from anywhere and at anytime, except when reasonably prohibited by security concerns. The 25 December incident highlighted that officers in the field sometimes are best positioned to separate signal from noise. - Search capabilities should default to the use of fuzzy logic. Had this been the case in November, the State Department's Visas Viper cable, despite the misspelling, would have prompted discovery of Abdulmutallab's active US visa. - Embed IT specialists in fast-moving analytic and operational groups to handie simple support requests immediately_ The Community should not continue to allow mundane IT problems to interfere with its mission. ## - (B)(1) (B)(3) Cia In the midterm, but sooner rather than *later,* the Intelligence Community must enable persistent search, exploit query logs, attach analytic insights to data, facilitate continuous IT improvements, and bridge the data divide-while building toward the long-term vision: To do this, the Community must: - Augment current search capabilities with usercontrolled alerting services that would flag incoming traffic - Enable officers across the Community to see who else has looked at a given intelligence report and to electronically attach informal insights and view comments by others. This may have enabled broader discussion among analysts interested in a Nigerian affiliated with AQAP or in Hasan and Aulaqi. - Embed developers with users to provide continuous improvements to mission applications. This would foster innovation by giving developers-who can imagine what technology can deliver-a better understanding of end-users' requirements. - Incorporate application programming interfaces (APis) into all existing programs so that they can be accessed, as appropriate, through other programs. This would, policy permitting, enable officers to access multiple databases, across multiple networks, through a single software interface. - Incorporate into new and existing programs the capability ## Odni In the long term, we make three recommendations to help ensure the Intelligence Community provides its counterterrorism officers with state-of-the-art capabilities for search and correlation. Several technical leaders in the Community are working on ideas similar to or consistent with these; we offer our perspective to encourage and help shape these efforts. (U) First, enable a federated and cross-domain search. This would be a minimal step toward modernizing the Community's search capabilities and ameliorating some of the problems posed by the proliferation of databases across networks. Developers would place a thin layer over existing databases that would provide a single point of entry to query-through an API- each database to which they are authorized access. This would minimize the extent to which officers must remember where to search for what data and simplifY officers' synthesis of the results. (U) Second, separate applications from data and infrastructure. This would enable authorized intelligence officers to access and use any data, anytime, from any workplace, with any tool, except as policy prohibits it. The most important initial step is to establish the virtual equivalent of the nowcommon Community badge: a common way of identifying individuals and their access permissions together with tagging of the data to deseribe the rights needed to access it. - We endorse the joint effort of various. agencies, - working through their chief infonnation.ofijcers, to build toward a common IT infrastructure and identify common data services, such u those for collaboration, access, discovery, audit, processing, and storage; - A common infrastructure for all data would have many advantages, including enabling the use of sophisticated search algorithms such as those used on the Internet, instead of the outdated Boolean searches currently used on most Intelligence Community systems. Another benefit would. be the capability to allow. a user to file all relevant data on one interface. rather than on a. system-by-system basis. (U/IF()U()} Thitd, build computing clouds and data centerswhich will enable dispersed, enterprise data sharing and processing-as the basis for the Community's IT infrastructure. The resultant computing capacity will allow "data to .talk to data," identify relationships, produce results that analysts now have to put together by hand, and do it before an officer has even thought to make an inquiry: Routine use of this kind of processing almost certainly would have helped identify Abdulmutallab for watchlisting. - Additional advantages of a cloud-based approach include lower overall costs, greater tlexibility in the use of resources, ease of maintemmce, and easier portability ofinnovations. Private-sector technology leaders such as.Microsoft, Amazon, and Google build their systems using clouds. - As the Intelligence Community moves toward the cloud, it will need to adopt-at the Commllllity level-hardware, operating systems, and networks. All new systems shoUld be expected to use this common base. (S/~) l Organizatiqna/ responsibilities should *play* to . the compartllive lldvantage of etlCh otganiz.ation. In practice, this mesns thllt NCTC's relatlunships with FBI and JJHS, its legislative alilkorilies, and its, tie-in to the homeltmd make it the 1Ullllrtd lead on 1111 threms with the potential to reach US soiL CTC, on the other hand, is the lfllllrtlllefld on terrorist operations abroad, jJarlicularly involving sUpport for operators anti collectors. Focusing on this approach would, we suspect, reduce the time-consuming tilT,{ disputes over PDB authorship. ~ Wherever InteHigence Community ktzders draw the "lanes in the 1'0ild,., some component must focus tirelessly and exclusively on folltnving 1111 repOrting that involves threats to *the* us~ Tltis needs to be a primary focus of NCTC,s new pursuit groilp, as it deve/opsfragmenklry data that raise concerns abolit tem iSm but lack specijiclly. ~ To improve seamlessness thT'OIIghout the intelligence and law enforcement communide$, agencies should increase the rotation of offrcers among these organizations. (CifNil). Clearing the Way for Properly Sharing US Person Information Throughout our interviews, we were impressed with the great care taken by the Community to protect inferma.tion about US Persons. m toJ We noted. however. that US Persons issues manifested themselves in several ways in these cases. - Sharing US Person information with foreign partners, and tasking them to - Intelligence officers in both the 25 December and the Hasan cases worked hard to stay within authorized guic:ielilll~ In general, we noticed a strong belief among collectors and analysts that restrictions on collecting, disseminating, accessing. and analyzing data on US Persons impede, mission performance. A high-level NCTC official listed enhanced authorities related to US Persons as the nn11nher- We also saw a surprising level of disagreementeven among experienced practitioners-on whether current US Person authorities allow intelligence officers to accomplish their missions, or whether new legal authorities are needed. (b)( 1) (b)(3) NSA TOJI ecRI!'ffiHCSIS~~OONINOFORtt **...** j(b)(7)(E) I - Similarly, NSA officers noted that if they were swveiling a suspected terrorist overseas whom they thought to be a non-US Person. and they later learned that he was a US Person. they had to cease coliection while they sought separate court authorimtion to re-ini.tiate collection, resnlting in another collection gap. Panel members with deep experience on FISA and related matters provided a different perspective. They believe that current authorities, when clarified and fully leveraged, should enable the government to accomplish its counterterrorism mission. - For example, they believe that the Community's current authorities enabled the government to adequately swveil US Persons globally and suspected terrorists inside the United Statesand to share lawfully collected telephone numbers in shared databases--'-while also protecting privacy and civillibexties. - The experience of these panel members leads us to believe that the government must develop more efficient processes to make effective use of existing authorities, especially ones that focus on - In general, the law and the Community's governing Executive Order (EO 12333) provide the government with the operating room to be effective; most of the burdensome steps appear to be internal to the government's implementing procedures-which could cause the collection gaps and other issues described to us. - Fixing these procedures is not solely the responsibility of any single agency or of the DNI. This requires the Department of Justice continuously to engage with the DNI, both to calibrate on an ongoing basis how to craft the procedures so that they clearly and straightforwardly implement the Community's governing legal requirements, and to provide assurance that when the Community complies with those procedures, it is following the law. ~'INfL We believe that the Community's culture of carefully protecting US Person infonnation is vital for earning and maintaining the trust of the American people and of oversight bodies. The Community must have that trust so that it can make the most of existing authorities-and obtain new ones as needed-to counter a rapidly evolving terrorist threat. - Indeed, we believe that in that light, it is all the more important to streamline and clarify policies and procedures-to ensure they are being used to protect privacy and civil liberties interests and implement legal requirements, rather than to serve other purposes. - To be an effective part of the intelligence mission--and not be an "impediment"-policies and procedures must be focused, clear, easy-tounderstand, and consistent across agencies where feasible. We believe much work lies ahead to achieve that tsHN*-) Callectively, these US Persans issues can and must be addressed *in the near term.* Some involve closing the breach between the perceptions and realities of current US authorities; others entail changing internal procedures of individual agencies. All involve focused leadership frem the DNI, in concert with the Department *:of* Justice. We understand that this important work has already begun (see Appendix B). (U) We see a need to simplify, harmonize, update, and modify the Community's procedures tela:ting to US Persons. We also see a clear need for standardized, continual Community-wide training and guidance on how to address US Person issues. - The goal of such efforts is twofold: First, to make use of the Intelligence Community's authorities to the full extent intended, so that the Community can more efficiently manage the information in its possession and correlate data as envisioned by the IT recommendations. Second, to help intelligence officers better understand what they need to do to collect and share inforination with confidence that their actions are consistent with legal and privacy requirements. - It is especially important that these efforts focus on working-level analysts and collectors who are most directly affected by US Persons considerations, to dispel any misperceptions, and to elicit areas where training, guidance, and updated procedures could facilitate intelligence operations while still protecting privacy and civil liberties interests. For example, working-level officers should be provided a consistent, clear, authoritative-and preferably online-:gu.ide, with the assurance that following it provides a "safe harbor" on US Persons issues. (U) We also recommend that the DNI establish a Community-wide, inter-disciplinary process for determining whether new authorities may be needed, on emerging issues, such as radicalization, new technological developments, and new fonns of terrorist communication. The goal would be to provide clarity and confidence to operators and analysts so that they know how conduct their missions in a way that properly protects privacy ## To~: and legal interests, clearing the way for decisive action. - If, as we suspect, terrorist means of );;> Protecting US Person injormtztion is vital for IICCOiflp/iShJng the intelligena ltli8slon; t/u! raks ftJI' doing so IIUISt - foctiSell, dear, eflSY-to-lllltlerstimll, *and* ~IICI'Oss agencies wMre feaible. communication increase in sophistication and self-radicalization inside the United States becomes a more pressing concern, it will be increasingly urgent to regularly bring together analysts, collectors, and attorneys to discuss whether current authorities and guidance are keeping pace with the evolving nature of the terrorist threat );;> The DNIIIUISt, in concert with DOJ, IIJad a CUIIUIUUiity-wide effort to pro11i4e Wining and gllitlance on 1JS Person polldes and procedures, and to sbnplib, strl!llllne, updote, tmd haTIIIOnize them where feasible, with t1U! gOIII of providing Co,munity oper1110rS and amdysts the confidence they need to do tbei7 jobs knowing tlult they are properly protecting privacy and complying with the lllw. );;> The Commlmity should engage with liaison services to cltlri,h and stret1mline its procethiTeS *for* pr~ coiJecting tllnd sharing US Person infomuzlion. - Regarding working with liaison partners, we recommend all agencies actively engage key liaison partners to develop plans to ensure collection in a way that is consistent with any protections for US Persons. The Community will benefit from a review of procedures for sharing with liaison services when it has authority to collect on US Persons and is ~ liaison assistance in such cooperation. - Our recommendation in this area is an expansion of sscrs sensible guidance that NSA should conduct such an effort with its foreign partners. (S!,N)- );;> The DNI should establish tm interdisciplinllry process for providing guidance tmd clarity on emerging issues rehzting to US Persons, sach a radictll4otUJn, new teclmologies, and new forms of commutriclltion. fS.{LNPJ ## A~Jrdw~Bi .. Llab,Baao, And~ (U) Despite the IJl8DY dif'fCnmces ~ ~.~ ineKkmts, 104 a common thread through both of them was what the Inte~ COdrnnm1ty~~~~n During ournwicW, we came away 'With four recommendations related to ttns is&Oe. (U#F()GO) First, the Community shoutdaeedemteits eftDrts to Ul1derstand ~.~ This is a~:MDgthe areas from wbicll intenigence SU1:ptise CWspriag in tbe abseaee of a template to iDfmm the. ~s collection and~ a point~ byeutside exports. While the,Conmiunity basi~ mitiAWves to study radicalization overseas. its <:flbrts to understand homegrowa, ra6:aliDtion are more nascent. Developing a. grasp. of the iSsue may.~.., types ofex:pertiseand ~.~the Community. as the Un.i=d .s.t;es piOVides a.~ aotf.'~cavironmeut for ~iDtion. It will also requite.ll robust understanding o( and~ ft>r. ~~and liberties. "(C'INF) Seeoud, we agree witA tllie ~-ctm8Ulied who recomnteBded that the Community.$hatpcn itsfeeus on reeruiters'and~~ how~~ mdicalize(tbttJugh gtOups, in prisons, aD tbC\'IDtemet). :and howtiley'~a'~~~to~Opemtional. Assame.amftyst5pointedoattt>~"Sdf" !1ldicalization maybe a misnOmer.~- AbdlUtm:rtaUab ~ ~ byradit:als-Aulraqi"inbeth cases. but to differing exn:ms-e.nd:by the IntCmet..wbich will ptqan ~role mradi~'r Dlay be ~Outside the di1ect comtDaDd and eontroi' of organized groups. The Community,~ faces a signals-to-noise chellenge with such individuals overseas, and must find ways tO~ such indMduals inside the United States while respecting civil rights andlibcrtiC$-t!lld ~-eDiiSting the support of'loeaJ COJDBtU11it:ies. ~ Third, the lessonS leatadtrotn ~damdWal~ andsel~efUS~ Hasan-shotildbe ~-~into~ and US Govemmtmt persoDIJCII<:potieies, which are typieal)y ~To~'~state-~spying. - When government employees are involved. bri1lging co~ pl!Ofessionals into the investigative process early can signifiamtly inorease the probabitity ofdemcting at-risk individuals." - As in other counterintelligcmee cases (Ames, Hanssen).. the Hasan episode underscores the importance of documenting and maintaining in an individual's permanent record"all relevant information about his or her performance. 1o5 {1/Nf) Finally, we believe it is vital to properly align orgaaizational responsibilities rolated to radicalization with each agency's strengths and authorities. Ncrc. FBI, and DHS must play their respective parts in close collaboration with one another. FBI's unique stnmgtbs include robust legal authorities and direct experience investigating domestic and intemationalterrorism inside the United States; those ofNCTC include a.aalyzing radicalization. bridging the foreign/domestic divilk; and aceessing intelligence ftom across the Commuu.ity. DHS is uniquely positioned to focus on aualysis zelevant to~ vulnmabitities and domestic protective measures; aggregating data uniquely available to DHS for use by the counterterrorism community; and working with state, local, trihal, and private-sector customers. We recommend that the Community reassess its assignment of radicalizatmn..~ ~ amoag these key orga:aimtions to ensure that they are bringing to bear their Ullique stlcDgtbs and authorities onlhis critical issue. (S{/Nf) ## Blue Sky Ideas (U) The foregoing recommendations cover much of what the panel was asked to address. We have focused on recommendations that, wbile difficult. are still achievable within an individual agency or with DNI lead authority. Consistent with the third task assigned to the Review Panel, we offer several additional "blue sky" recommendations-ideas that we have not seen surfaced by other review groups and that would entail more radical changes. These ideas are deliberately provocative, and more disruptive to personnel resources and organizational structures, requiring more study before attempting. - A Manhattan Project for *information* techn~~Jogy and *sharing.* To break the gridlock and the everelusive search for the perfect IT architecture, we propose the chief information officers from the key intelligence agencies-along with their budgetsbe pulled together into one unit with the goal of implementing a common infrastucture across the Intelligence Community. The Commmtity has been wrestling with data-sharing adjustments for years with scant progress. one way to lev1~re | (b | |--------| | (b)(3) | | CIA | strengths of CTC and NCfC while reducing redundancy. A matrixed group can consist of analysts from CIA, NCfC, DIA, FBI, and NSA, who sit side-by-side with collectors and operators from the NCS, DoD, and NGA, all worlcing under a This model works best targeting specific issues involving a blmry line between domestic and foreign components and where there are relatively few analysts in relation to the workload. Using the matrix model also reduces redundancies related to dual publications, representation at interagency meetings, and responses to taskings. j(b )(?)(E) - ~the e;xpertise of INR *antli)HS/I&A.* In our discussions of the Intelligence CQmmunity' s counterterrorism efforts, we heard only few refemtees to the State Department's Bunlall of Intelligence and Research and DHS's Office of Intelligence and Analysis as key playem. An institutional division of labor, in whi-. INR. and DHSII&A have lead responsibility on some regil)D or aspect of terrorism. could tap their expertise and increase efficiency in the Intelligence Community. DHSII&A, for example, is uniquely positioned to assess US vulnerabilities-infrastructure, telecommunications and energy grids, and information-sharing gaps between national and local law enforcement. - ExpmuJ the Intelligence Community's role in the visa is~t~tmce *proce8$.* DHS could play~ esgecially important role in the visa issuance process. Prev'enting terrorists from entering the us ho~ is a top national security C0l1tem, so it makes little sense to place the visa issUaDoe process in the bands only offoreign service oflit;em. This responsibility should belong in the homeland security apparatus. If the suggestion is too burdensome for DHS, then consideration ought to be given to ensuring that all visa issuances reqUire Community concurrence or are passed~ the Community for ex.amination. - Bllildaco~ *"~'hace Cmtml. " Identity information is currently pocketed across the Intelligence Cotnmunjty in various databases, meaning ll() ooe QftieeE in any agency can successfully access it. To remedy this, create a single unit, staffed by coontedeuerism ~s,from thro~ut the ~ty cleared for access to an relevant SOlli'CCS, responsible for countertefrorlsm-related name traces. Names traces would be conducted against holdings of all intelligence and law enforcement databases. (S/tm) ## Expert Perspectives: The View From "Insiders" And "'Utsiders" (U) We convened two expert roundtable sessions, one internal and ~ne external, to stimulate our tbinlcing about the Intelligence Community's postme to address issues beyond those surfaced during our review. The internal group of experts focused on threats that could sutprise the Commumty and threats ofwhich it is cognizant but not prepared to address. Among their key concerns were: - ## (B)( 1) pane~s thiltking by driving hoe several key points. AIIWng the111: We asked the external group to address how the terrorist threat to the United States is changing; what terrorists could do to surprise the Intelligence Community or elude US colDltermeasures; what more the United States could do to protect itself; and to identify aspects of the terrorist problem that the United States is not focusing on, but should (U/~~ Those experts emphasized the following issues: - The terrorist threat is heterogeneous-there is no longer a single "they," if there ever was; - There are inherent difficulties in obtaining the key, plot-"specific information that would allow the Intelligence Comomnity to pull a thread that would Ul100Ver a plot. As a result, the Community will not always succeed-a terrorist will eventually get through US defenses; - Tradeoffs must be made-within and outside the Community-that have real consequences, such as those between civil liberties and increasmg the number of people on watchlists; - Ahnost ~foreign threat to the homeland that the United States has thwartedwas uncovered because of foreign travel or communication; we are too dependent on these and need to develop and refine new detection strategies; - The Intelligence Community shoUld focus more on the key people and networks that enable disaffected individuals such as Hasan or Abdulmuta.llab to become operational, i.e., Aulaqi-like figures that inspire, enable, or recruit; - The Community requires a well-developed model of~ tadiclllization process fi'om which it can ded\.te.~.~individuaJ.s~ity to adoptevrhlent~ We have Jl-e~'tlte for~~~'tllt-~ We d'onot bave one fur thehoD1eland. (U/JFOUO) To siiiiUITize, these two gTOIIJIS adtkd to the - The increasing rugeney of homelllnd-reltded threats--and the need for a more sustrdned, crossagency focus on this set of issues. - The increasing heterogeneity of the terrorist phenomenon, and therefore the growing clulllenge of detectiQn and disruption. - The fragility of many ofthe collection techniques that help account for the Community's success so far. - The lilcelihood that terrorists will continue to behave in "learning" nrode-ad}IISting their methods of operation, whethu successful or not, in response to what they see us doing. (SfiNF) ## Some Closing Thoughts (U) Constancy of support for the Intelligence Community is *crucial.* Intelligence stands apart from politics, but policy toward intelligence is formulated in a political environment We cannot emphasize enough that the pendulum swings and ebbing and flowing of support is an obstacle to mission performance. NCTC, for example, was slated to lose roughly 35 positions prior to 25 December. The post-Christmas reaction to Flight 253 has caused watchlisting nominations to skyrocket; warning has become so common that the Community risks creating its own signals-to-noise problem. We have seen the same pendulum swings on the collection side, where agencies---acutely aware of controversies since 9/11-have erred on the side of caution, sometimes unnecessarily, slowing the dissemination of valuable intelligence. The Community's Congressional overseers have a vital role to play in helping to stabilize counterterrorism policies and keep them on a steady course. (U) While we have limited our review to the Intelligence Community, we come away convinced that strengthening the United States' ability to prevent the next Fort Hood or 25 December-like attempt requires focusing on more than just the Intelligence Community: law enforcement, airport security, the policy community, foreign. partners, and even the private sector need to address the systemic issues that made the Fort Hood and 25 December incidents possible. At the risk of falling back on a cliche, we are reminded of the axiom that a chain is only as strong as its weakest link. Improved collection will not matter without sound analysis. Sound analysis will not matter without a robust watchlisting system. A robnst watchlisting system will not matter without effective airport screening technology. Better screening technology will not matter without skilled screeners. There are multiple variations one could make on this chain of events, such as the vital role of foreign screeners at airports abroad-but all would reinforce the same point: the Intelligence Community is only one of several layers ofhomeland defense. (U) To fmally defeat terrorism requires at least three things: destroying the leadership, denying it safehaven, and changing the myriad conditions that give rise to the phenomenon. The Intelligence Community can carry much of the burden on the first two-but very little on *the third.* (U) ## Appendix A Consolidated List Of Intelligence Community Review Panel Recommendations (U) Build Internal Processes That Help Find Terrorists In The Data (U) All agencies should . - Disseminate counterterrorism reporting promptly. - Update, standardize, and simplifY their dissemination lists and codes on a regular basis. - Search for terrorist identities against all of their available data holdings. - Use technology such as "fuzzy logic" for name variants and incorporate "discoverability" that advises when there is relevant information in another location. - Train officers performing identity searches to look for partial names, along with salient points such as the person's location, affiliations, passport numbers, schooling, or travel--details that can further narrow the search and identifY an individual:fS/~ The DNI should . - ClarifY the criteria and threshold for watchlisting. The Community needs a single set of transparent guidelines that enables analysts to determine whether and when they may nominate a suspected terrorist. We caution against criteria that become too specific and caveat-laden. - Establish greater clarity on watchlisting roles and responsibilities. Delineate roles that play to each agency's particular strengths and authorities, and make clear that the nominating agency should see a nomination through from start to finish. - Streamline watchlisting efforts and redirect the resulting savings. Reduce the duplication resulting from multiple agencies processing nominations and redirect the resources toward other pressing duties such as records enhancement. IT improvements can help simplifY this process. - Ensure analysts use TIDE as a primary repository of intelligence rather than as a step in the watchlisting process. The Community appears to be missing an opportunity to populate TIDE with fragmentary intelligence to build, identify, and shape dossiers on suspected terrorists. NCTC should lead a Community- wide training program to help agencies understand the pmpose of TIDE, its holdings, and criteaa for entry into TIDE. - Institute a Community-wide training program. to ensure a common and transparent understanding of the watchlisting process. If TSC remains the final voice in the No Fly/Selectee decision, it should lead ~h a training effort, so that its standards are clear to all nominators ~Sl!blE) We also emklrse - SSCI's recommendation that TIDE administrators accept nominations based on partial names. Terrorists rarely use full, true names in their clandestine communications. - The White House's recommendation that NCfC develop a records-enhancement capability to build, locate, and track derogatory information on all individuals in TIDE: (S/INF) ## Develop Information Technology That Helps Separate Signals From Noise (U) In tlu! near term, all agencies should - Greatly increase online documentation related to datasets to show what data are available, how to get access, who has access, and to provide tips from experienced users. - Enable authorized users to access and use all-source data and applications from any workplace and at any time, except when reasonably prohibited by security concerns. The 25 December incident highlighted that officers in the field sometimes are best positioned to separate signal from noise. - Ensure that search capabilities default to the use of fuzzy logic. This would include the automatic incorporation of variant spellings and renderings of foreign names. - Embed IT specialists in fast-moving analytic and operational groups to handle simp~ support requests immediately. The Community should not continue to allow mundane IT problems to interfere with its mission.iCh'J'Wj In tlte midterm, all agencies should . - Augment current search capabilities with user-controlled alerting services that flag incoming traffic. and automatically correlate it with existing reporting. - Enable officers to see who else has looked at a given intelligence report and to el~nically attach informal insights and view comments by others. Such a capability may have enabled bro&der discussion among officers interested in a Nigerian affiliated with AQAP or in Hasan and Aulaqi. ln or had action on a specific issue. (U) 3 Protecting the Force: Lessons from *FoJ"'* HOO!i~rt ~fthe DoD Independent_R~~iew, t.O.~'~}. (U) .. Megan McCloskey, "CiVIhan pohce officer acted quickly to help subdue alleged gunman," Stars and Stripes (Mideast Edition), 8 November 2009. (U) 5 [Open Source I WASHINGTON POST ctRAS ID:OW5666743l I 200802271 (U) I CIRAS ID: OW56667431) 6 Hasan raised the same issues he pr-esented in his emails to Aulaqi in a June 2007 research paper, "lbe Koranic World View as it Relates to Muslims m the US Military," on file with the panel. Hasan cited the example of Sergeant Hasan Akbar's killing of fellow US soldiers to underscore the internal conflict faced by Muslim soldiers serving in the US military and that Hasan's paper goes on to say that Muslim soldiers who perceive the US military to be advancing the cause of ''American hegemony" rather than justice have "turned against fellow troops" and argued for the US mj]jtary to assign Muslim soldiers to religiously acceptable positions to avoid ''the potential for adverse events." TOP SEORE'fHHOSfSI~~OONINOFORN.- j(b )(?)(E) I 10 The agent bad been assigned the lead by his supervisor on 27 Februacy, but because of his workload he did not work on the case until27 May. Discretionary leads are generally required to be completed within 90 days of assignment. (S/INF) t I [FBIS I GMP20090610479002120090810 I (U/~ I CIRAS ID: FB5941323] 12 According to the FBI, neither they nor their UK counterparts were able to corrobomte these claims. (TS/fSIIfP'W). (S/,~W) 39 [Other 1 National Commission on Terrorist Attacks Upon the United States, The 9111 Commission Report. I 20041 (U) I CIRAS ID:] 4 Countmerrorism Mission Management, FY201 0 Counterterrorism Production Guidance, January 2010. fSffNi7 The publication date was January 2010 although the contents had been drafted befOre th~ 25 December incident (U) 41 "Top Frontbumerintelligence Issl1eS." September 2009. TOP 8~itE'fh'HCSISi GfFK!feROOl't/N()F{)ffit. (SIMF3 42 NIE MI'I2007-02HC. Memorandum to the Halders of NIE 2007-02HC, The Terrorist Threat to the US ## (B)(7)(E) Fbi (B)( 1) (B)(3) Cia (B)(3) Nsa (B)(7)(E) Fbi (B)(3) Nsa needs fewer dots," Washington Post, p. A21. (0) 49 Russell Goldman and Huma Khan, ''TimelinC of terror: Clues in Bomber Umar Faroo.k Abduhnutallab's Past," ABCNews.com, 3'0 December 2009. (U}. . so DJ~. Grady, Politics: Why HeadS ~ R.eceJnQer WlO; ,(U) 61 "Yement :flWU,US.Yemerti CitiZenTamgMore Operational ROle in Al-Qa'ida Groupt"(~NCTC Online. 5 May~ '('f'Dp- Seuit:ti~JhmFO'R:N1- ~ 62 Mimi Hall; 'Ubama.orders security~ T~. 8 ~ 2DfO, P AI. (U) 63 NIEMa200'1-02HC. ~trifie~ NIE 2007-02HC, The Terrorist Threaf.lli ... Homeland tfSMiCSI/Si'-6Jf'OfKJ1Rf( ' (stfl'~f) 64 TSA interviewees noted that the number '*''rise above 300 depend~ on the season ami the.~ is even higher once priVate airstrips arc included. (MNFT 65 We note that $ome legislators arc alrea4y~g at the idea that unspecified post-Detroit regulations could cause inconveniences that represent a "disservice to the traveling public. See Kara Rowland 8lld Nicholas K.ralev, "Obama pledges changes on security?" Washington *Times.* 6 January 2010, p. A.L..!,U). 66 CTC and NCTC produced mon: than ~B articles in2000 in.additronJo~-~-.~ .. -...~>'h. . ., ":.' . '' , ' ' ,.~:o&~a._pu.t .. ' .. ,-~, 8lld ~ ~1'15. -(&1.~ officership with respect to the alleged perpetrator. These individuals failed to demonstrate that officership is the essence of being a member of the military Erofession, regardless of the officer's specialty." (U) 6 Other officers in the FBI WFO, including the WFO supervisor, did know about the database, but the supervisor did not recommend to the DCIS agent that he 88 Terrorist Screening Center, "Protocol Regarding Terrorist Nominations: Guidance Regarding Application of the Minimum Substantive Derogatory Criteria for Accepting Nominations to the Terrorist Screening Database," February 2009. (U/~ 89 For example, during this approximate timeframe, TSC rejected a broad range ofNCTC "No Fly" requests even those (S7'J'Nft- 90 We focus more on the 25 December incident because the implications and responsibilities of the Intelligence Community are greater than in the case of Fort Hood. (U) 91 Memorandum from CIA Director Panetta to DNl Blair, "Readdressal of teporting in the Wake of j(b)(?)(E) I 92 Senate Select Committee on Intelligence, "Report on the Attempted Terrorist Attack on Northwest Airlines Flight 253," t.'T~tmcst~Iitoe 'fHF), 16 March 94 For example, not provide enough derogatory information on Abdulmutallab's extremist links to justifY submitting the information to TIDE. Using the exact same information with the same level of derogatory reporting, however, Department of State officers prepared a Visas Viper report that ensured that the information on Abdulmutallab was entered into CLASS, thereby creating a record in TIDE.-tSh'NI