T2 B24 Working Papers Re Warning 2 Of 2 Fdr- Entire Contents- Articles And Reports- 1st Pgs For Ref

The Three Episodes in Perspective: Lessons To Be Learned About the Intelligence/Policy... Page 1 of 7

e

CENTER for the STUDY of INTELLIGENCE

The Three Episodes in Perspective: Lessons To Be Learned About the Intelligence/Policymaking Relationship (1) The mixed picture of CIA performance illustrated in these episodes should not obscure the generally good analytic record the Agency chalked up on Vietnam in the years under review. From the early 1950s onward, CIA's assessments in the main proved more accurate than those of any other US Government entity, and CIA's analytic record on Vietnam compares favorably with its endeavors in the counter-insurgency field. CIA officers fairly consistently insisted their analyses showed that military force alone would not win the war; that our South Vietnamese creation, the GVN, was not proving adequate to the political-military task; that we should not underestimate the enemy's covert presence throughout South Vietnamese society; that we should not underestimate the enemy's staying power; that US bombing efforts were not appreciably slowing the enemy's progress in the South; that the enemy would try to match US escalation rather than meaningfully negotiate; and that ill-founded official claims of great progress distorted reality to the detriment of policy objectives.(2) CIA's record of candor is all the more remarkable because CIA officers often had to brave pressures from senior political and military officers to "get on the team" and to support the war effort with more optimistic findings and estimates. That overall record must be tempered, however, by the fact that on the three occasions under review in which Agency assessments had a chance to affect key US decision points in Vietnam—how to assess and deal with a failing Diem regime, whether and how to "go big" in Vietnam, and how to assess the enemy's subsequent capabilities and intentions—the character of CIA's intelligence input was mixed. In our first episode, 1962-63, because DCI McCone brought heavy pressure on the Board of National Estimates and the Intelligence Community to produce a more optimistic National Intelligence Estimate than they felt the evidence supported, because the Board caved in to that pressure, and because that NIE fed the confidence of policymakers that the war effort was going fairly well, those policy managers were wholly unprepared to deal with the sudden collapse of political stability in South Vietnam only days after the definitive NIE was issued. The judgment must be made, as we have seen in the statements of the authors of The Pentagon Papers, that in the case of that NIE senior decisionmakers were influenced by an Intelligence Community product; the problem was that, thanks to the intervention of policymakers and program managers, this particular input was misleading. Director McCone's subsequent cautions concerning the wisdom of overthrowing Diem proved well taken, but they failed to counter the original impetus or the momentum that gathered around that impulse. Equally unfortunate, the sorry outcome of the unilateral Harriman-Hilsman-Lodge initiative had the ironic result of leaving CIA with much of the blame for the disaster, obscuring the fact that the CIA Director had tried his best to persuade the White House that that course would breed disaster.

http://www.odci.gov/csi/books/vietnam/epis3a.html

8/7/03

EARNING OF TERRORIST ATTACK

Page 1 of 3

WARNING OF TERRORIST ATTACK THE CASE OF 9-11 AND THE FUTURE A Statement Submitted for the Record Prior to Informal Testimony to The 9-11 Commission

By Fritz W. Ermarth 12 August 2003 It is a privilege to give testimony to this Commission on its grave subject matter, which involves understanding the causes of the tragedy of 11 September 2001 and the ways our nation can avert such attacks in the future. I understand my testimony has been prompted by an article I published about a year ago in the internet journal In the National Interest. It has been submitted separately. My resume, supplied to Commission staff, describes my background, mostly as an intelligence officer, for offering this testimony. In this written statement, I wish merely to summarize a few points that are most vital to the issue of warning of terrorist attack. First, warning is only part of the larger task of combating and defending against terrorism. That battle requires active, offensive overt and covert measures on many fronts to disrupt, suppress, and eliminate threatening entities, such as Al Qaeda, but by no means only Al Qaeda. Prior to 9-11 such measures were modest, episodic, and clearly ineffective. Since then, they have been much more vigorous. The more effective offensive measures are against terrorist entities, the less burden must a warning system bear, or the less risk that it will be breached. But because the threat of terrorist attack cannot be provably eliminated, the requirement for a robust warning system will continue to exist however successful we are in the war against terrorism. Moreover, any hostile entity with resources and access to operational capability can use terroristic tactics or covert attack to hurt, weaken, or disrupt the United States. Second, prior to 9-11 the United States could have had and should have had a real warning system against terrorist attack. But, while having many of the elements of such a system, it did not have a real warning system. By that I mean we did not have a structured, tested, routinely exercised-system for integrating the elements of real warning. These elements embrace the following: Strategic intelligence, i.e., information about the existence, hostility, and capabilities of an enemy, in this case Al Qaeda. According to the findings of the Joint Inquiry of the intelligence oversight committees of Congress, we had plenty of strategic warning intelligence but there was inadequate strategic analysis of its meaning and implications. Operational intelligence, i.e., warning-applicable information about how the enemy is contemplating and then planning to attack. Again, according to the Joint Inquiry, we had numerous indicators that the enemy was contemplating and indeed preparing (via flight training) for an attack using planes as bombs. Tactical intelligence, i.e., actionable warning information about the timing, targets, perpetrators, and method of attack. Despite a preoccupation with exactly this kind of warning, our intelligence and law enforcement entities failed to "crack the plot" of the 9-11 attack. But there were leads of

http://kinesis.swishmail.com./webmail/imp/view.php?thismailbox=INBOX&index=1381&id... 8/13/03

Analysis of Competing Hypotheses Software for Intelligence Analysis and Policy Decisions—Has Unique Features Never Done Before. Reduces Surprise > Graphics provides new visual warnings. > Highlights specific information that could lead to the surprise. > Calculates the probability of being surprised or blindsided by an unexpected event. For a given situation, for example, it might determine that the chance of being blindsided/surprised is 18%. (This is one of the software's most popular features.) o Provides probabilities for Known-Unknowns, Unknown-Unknowns. Promotes Resolution of Disagreements and Disputes About Major Policy Decisions 5> Helps achieve a novel, innovative solution better than either side had at the start. o Helps get the opposing sides beyond their bias for their own side, so both sides see the full, complete picture, often for the first time. Better options and better decisions suddenly open up. Improves Decisions > Helps reduce bias because matrix exposes it so it is more easily seen. > Ensures the exploration of alternatives so it is less likely to miss something important. > Faster and easier because one chart presents what previously took pages of text. Cuts Complaints and Criticism: > By reducing error, bias and surprise, the results better withstand criticism. Pilot in use at NSA, DIA. Article about it in the National Strategy Forum Review Here are excerpts from e-mails written from people in the intelligence community: ".. the software you are developing presents an extremely user-friendly, even inviting, way to track "indications" of foreign policy opportunities or of dangerous international scenarios... " "I have finally found the time to read your paper. It reveals an impressive and innovative approach to the analyst's problem. " " ...the model is something that all analysts should have available to them / was fascinated as I watched the graphs do visually what I struggled to see in my mind's eye. ...I truly believe this application is something that should be on all intelligence analyst's workstations. " Based upon research performed at The University of Chicago by Prof. Willard Zangwill. > Better: Beats other approaches in head-to-head controlled tests (details below). > Stand alone pilot completed.

Helps move the process of intelligence analysis and policy decisions towards the ideal. Willard Zangwillj 9/11 personal privacy distribution, not for general dissemination.

|willard.zang\vill(g>gsb.uchicago.edu. Restricted

WARNING AND SURPRISE: A FIRST STEP TO A STRUCTURED ANALYSIS An Application of The Analysis of Competing Hypotheses Software for Intelligence Analysis and Policy Decisions "History is merely a list of surprises. " -Kurt Vonnegu

t "Gentlemen, you can be sure that of the three courses open to the enemy, he always takes the fourth. " - Prussian Field Marshall Helmuth von Moltke The ACH software helps provide warning and reduce surprise because it: > Calculates the probability of being surprised or blindsided by an unforeseen event. With that information, people often identify warning and surprise possibilities they might have missed. (This really works, see quotes from actual users below.) > Exposes assumptions. Surprising actions by an opponent frequently occur because one makes a critical assumption that turns out to be wrong. With both the assumptions and the analysis clearly displayed, erroneous assumptions and erroneous reasoning are spotted more easily, helping to prevent tragic surprises. > Automatically highlights conflicting evidence. Conflicting evidence frequently reveals a hidden surprise. Displaying the conflicting evidence should help provide alerts and warnings. > Provides a graphical plot to clearly show changes in an ongoing situation. By making changes graphical and more obvious, one can better respond to new or more current information. > Instantly accesses human wisdom and experience. The software will have a data base which contains encapsulated human wisdom. A list of situations will be given, and one then merely clicks on the relevant situation. Immediately will pop-up hints and suggestions from experts about how to examine that type of situation and what not to miss. > Measures progress. For example, at the very start it might indicate that the uncertainty surrounding a situation is 70%, meaning that almost nothing is known. Over time as one gathers evidence and information about the situation, that number should drop. The progress measure is novel and provides dynamic insight into how much is known about the situation at any point in time. All of these features work together to create a synergistic package. As one adds evidence and information over time, the graph displays how the situation is changing. That provides visual alerts and direction as to what additional information should be obtained. Encapsulated expert wisdom is also providing hints to ensure one does not overlook something. In addition, the software is identifying specific clues that may indicate a possible surprise. Meanwhile, the progress measure indicates the uncertainty remaining as well as the progress already made.

The various features thus reinforce each other towards the overall goal of imparting better warning and decreasing the likelihood of an unpleasant surprise. Willard Zangw^/ii Personal [email protected]. Restricted distribution, not for general dissemination.

COMMISSION SENSITIVE WARNING - THOUGHTS (4 Aug 03) "Warning is THE mission of intelligence." Rice has commented that she/NSC/President/policy makers got "no warning" before 9/11. She continues they had no specific information as to date, time, place, method of the attacks. The DCI and Armitage have said the DCI declared war on Al Queda in 1998 and went all around town constantly and especially in the spring/summer of 2001 "warning" an attack was imminent. These comments reflect a misunderstanding of "warning" that was fatal. The intelligence community will not be able to provide unambiguous warning and will seldom have specifics as Rice desired. And, strategic and operational "warning" of the kind the DCI promulgated was probably seen by OMB (he claims OMB stymied his attempts to get resources in the President's budget or through Congressional appropriations) and others as simply a play for resources for intelligence and CA. There appears to have been no concerted effort to connect this to the NIO for warning or any organizational change, system, process, or product (NIE, Threat Analysis, vulnerability assessment, etc) to his efforts. His one effort "The Plan" was not comprehensive or "warning" oriented. OUTLINE - Ermarth o We need a new I&W scheme for international, non-state sponsored terrorism (and changes in technology) like we do for the traditional Cold War military system. It must be connected to response options and action plans. o We needed an NIE and an active NIO - McCarthy o Need for Analytical rigor and proper communication of the warning (proper analytical training) - Holl o Need for Warning-Response Framework (Why warning is a problem and how to fix it). - All emphasize accountability of the analysts and 1C as well as policy makers Other - Lani Kass, NWC, Surprise and Denial and Deception Bard O'Neill, NWC, Terrorism/Terrorists and a framework for analysis Ernest May, Historical Failures Note: Phillip and members of Commission mentioned in last meeting something that is important to this discussion. Intelligence officers and avoided policy (they think it taints their analysis) and "recommendations" and policy makers have typically received their briefings and wait until the analysts leave the room to discuss policy options. As in Holl above, the intelligence officers/analysts should be part of the policy response discussion

Warning Intelligence on the Internet Review, 18 October 2000

http V/cialinkl .cpas.di.cia/new_nic/watch_warn/WIIR/2000wik/WIIR51 .h

attacks from ballistic missiles, cruise missiles, and other armaments, so too are the shipping lanes, chokepoints, and pipelines that are so important to our allies and us. Here is another opportunity for the witch's brew amalgam of hostile powers-and for more unconventional thinking at our end.

2. Attack on the USS Cole: An Intelligence Warning Failure? "USS Cole: An Act of War," was the title of an opinion piece in theWashington Post on 15 October 2000 by John Lehman, Secretary of the Navy in the Reagan administration. Wequote: From media reports it appears that the skipper of USS Cole did all in his power to protect his ship and crew, and his leadership apparently saved lives. President Clinton described the attack on Cole as an act of cowardice and of terrorism. It was of course neither. It was a well-planned act of war by obviously brave and disciplined warriors almost certainly supported by one or other enemy states who view America and Israel as mortal enemies. The truth is inconvenient to the "peace process," and will be put in the memory hole, just as it was after Syria killed 241 American Marines in Beirut. We will instead blame it on Osama bin Laden or some mythical person. Other than President Clinton's traditional lobbing of a few cruise missiles, we can be certain that there will be no retaliation. Another inconvenient fact sure to be stuffed down the memory hole is the obscene failure of intelligence. Obviously our vast centralized intelligence bureaucracy did not warn the skipper of Cole of the severe danger. But of course, no one could be surprised by intelligence failure. In fourteen years of government service in three administrations I observed many historic crises, and in every one the consolidated product of the intelligence bureaucracy either failed to provide warning, as in Kuwait, or was grossly wrong in its assessment, as in the Yom Kippur War. Every national security adviser and every tactical commander from Elliott Abrams to Norman Schwartzkopf has deplored this scandal, but nothing is ever done. Cole is the latest victim of a $30 billion jobs program that takes the most wondrous products of space and electronic technology and turns them into useless mush. If Cole had been warned, the ship would have avoided this notorious port. If for some reason and armed with warning, they were needed in harm's way tried-and-true measures can be taken to protect stationary ships. We kept many ships off Beirut for years without a successful attack, although there were several attempts. But why was this single ship sent to Aden at the height of an anti-American crisis, in a nation notorious for harboring terrorists sponsored by Iraq and other rogue states? As Nimitz famously signaled to Halsey, "The world wonders." While state departments in every administration want to treat naval ships like so many cost-free chess men, in recent years the profligate willy-nilly deployments have been running all of the services into tatters. During the Reagan years of Cold War activism, the Navy was deployed to crisis areas beyond ordinary deployments an average of 5.5 times per year, which fully stretched a Navy of nearly 600 ships. Over the same time span in the Clinton years, the Navy deployed out of the routine 12.25 times per year with a fleet that has been slashed to only 318 ships. This has not only destroyed morale, retention, and family life, but it also has exposed a less-ready, thinned-out fleet to many more hazardous duty stations. As the Navy learned at Okinawa, where thirty-five ships were sunk by kamikazes, it is impossible to protect completely against suicide attacks. The only defense is good intelligence and the will to retaliate against the source. The American government has neither. 3 of 11

7/10/03 10:58 AM

James R. Schlesinger Chairman, Board of Trustees, The MITRE Corporation Senior Advisor, Lehman Brothers Counselor and Trustee, Center for Strategic and International Studies Chairman of the Executive Committee, The Nixon Center Current Activities Consultant, U. S. Department of Defense Member, Defense Policy Board Commission on National Security/21st Century Panel to Assess the Reliability, Safety, and Security of the United States Nuclear Stockpile Threat Reduction Advisory Committee, Department of Defense Global Position System Independent Review Team, U.S. Air Force Member, Advisory Committee, National Nuclear Security Administration, Department of Energy Education and Academic Career Harvard University: AB summa cum laude, (1950), AM (1952), Ph.D. (1956) Assistant and Associate Professor, University of Virginia 1955-63 Prior Positions Secretary of Energy, 1977-79 Assistant to the President, 1977 Secretary of Defense, 1973-75 Director of Central Intelligence, 1973 Chairman, Atomic Energy Commission, 1973 Bureau of the Budget (later OMB), Acting Deputy Director, and Assistant Director, 1969-71 Director of Strategic Studies and Senior Staff Member, RAND Corporation, 1963-69 Consultant, U. S. Bureau of the Budget, 1967-68 Consultant, Board of Governors of the Federal Reserve System, 1962-63 Academic Consultant, U.S. Naval War College, 1957 Other Activities Publisher, The National Interest Director, BNFL, Inc. Director, Peabody Energy Director, Sandia Corporation Director, KFx Inc. Fellow, National Academy of Public Administration Member, American Academy of Diplomacy Fellow, Phi Beta Kappa Fellows Trustee, Atlantic Council, Center for Global Energy Studies, and Henry M. Jackson Foundation Served on the President's Commission on Strategic Forces, 1982-83; the Governor's Commission on Virginia's Future, 1982-84; President's Blue Ribbon Task Group On Nuclear Weapons Program Management (Vice Chairman), 1984-85

/

John M. Deutch John Deutch is an Institute Professor at the Massachusetts Institute of Technology. He served as Director of Central Intelligence from May 1995-December 1996. From 1994-1995, he served as Deputy Secretary of Defense and served as Undersecretary of Defense for Acquisition and Technology from 1993-1994. Dr. Deutch has also served as Director of Energy Research (19771979), Acting Assistant Secretary for Energy Technology (1979), and Undersecretary (1979-80) in the United States Department of Energy. In addition, Dr. Deutch has served on the President's Nuclear Safety Oversight Committee (1980-81); the President's Commission on Strategic Forces (1983); the White House Science Council (1985-89); the President's Intelligence Advisory Board (1990-93); the President's Commission on Aviation Safety and Security (1996); the President's Commission on Reducing and Protecting Government Secrecy (1996-1997); and as Chairman of the Commission to Assess the Organization of the Federal Government to Combat the Proliferation of Weapons of Mass Destruction (1998-99). He was a member of the President's Committee of Advisors on Science and Technology (1997-2001). Dr. Deutch serves as director for the following publicly held companies: CITIGROUP, Cummins, Raytheon, and Schlumberger Ltd. He is a director or trustee of the Council on Foreign Relations, Resources for the Future, and the Urban Institute. He is an overseer of the Museum of Fine Art in Boston. Dr. Deutch has been a member of the MIT faculty since 1970, and has served as Chairman of the Department of Chemistry, Dean of Science and Provost. Dr. Deutch has published over 160 technical publications in physical chemistry, as well as numerous publications on technology, energy, international security, and public policy issues. B.A. - History and Economics, Amherst College B.S. - Chemical Engineering, MIT Ph.D. - Physical Chemistry, MIT

James B. Steinberg James B. Steinberg joined the Brookings Institution on September 1, 2001 as vice president and director of the Foreign Policy Studies Program, after a year as senior adviser to the Markle Foundation. Mr. Steinberg held several senior positions in the Clinton administration, including deputy national security adviser to the President from December 1996 until July 2000, where he also served as the President's personal representative ("Sherpa") for the 1998 and 1999 G-8 Summits. His other senior positions included director of the State Department's Policy Planning Staff, from March 1994 to December 1996, and deputy assistant secretary for Intelligence and Research from September 1993 to February 1994. Prior to joining the State Department, Mr. Steinberg worked as a senior analyst at RAND in Santa Monica, California (1989-1993) and as senior fellow for U.S. Strategic Policy at the International Institute for Strategic Studies (IISS) in London (1985-1987). He also served as Senator Edward Kennedy's principal aide for the Senate Armed Services Committee (19831985); as minority counsel, U.S. Senate Labor and Human Resources Committee (1981-1983); special assistant to the U.S. Assistant Attorney General (Civil Division) (1979-1980); law clerk to Judge David L. Bazelon, U.S. Court of Appeals for the D.C. Circuit (1978-1979); and special assistant to the assistant secretary for Planning and Evaluation, U.S. Department of Health, Education, and Welfare (1977). Mr. Steinberg received his B.A. from Harvard in 1973 and a J.D. degree from Yale Law School in 1978. He is a member of the D.C. Bar. He is also a member of the board of directors of the Pacific Council on International Policy, the Educational Foundation for Nuclear Science, the International Advisory Board for the International Programs Committee of the Governing Board of the National Research Council, and the President's Council on International Activities of Yale University. Mr. Steinberg is the author of and contributor to many books on foreign policy and national security topics, as well as domestic policy, including Protecting the American Homeland, published by Brookings Institution Press, and An Ever Closer Union: European Integration and Its Implications for the Future of U.S.-European Relations, published by RAND.

Richard J. Kerr Richard J. Kerr is an international consultant. From 1989 to 1992, Mr. Kerr was the deputy director of Central Intelligence. As such, he had responsibilities in the Intelligence Community and assisted in the direction of the Central Intelligence Agency (CIA). From September 1991 to November 1991, he served as acting director of Central Intelligence. From 1986 to 1989, he directed the CIA component that conducts political, military, economic, and social intelligence analysis and produced finished intelligence for U.S. policymakers. In 1986, he became deputy director for intelligence. In July 1982, the director of Central Intelligence appointed Mr. Kerr associate director for intelligence. From 1976 to 1982, Mr. Kerr was the director or deputy director of several analytic offices within the Directorate of Intelligence. In 1976, he was named the deputy director of the office responsible for political analysis worldwide. He was also the director of the Office of East Asian Analysis and the director of the office responsible for producing the daily intelligence products, including briefing books for the president of the United States. In Cuba during the 1962-1963 missile crisis, he analyzed information on Soviet forces and was the CIA representative to the commander-in-chief, U.S. Pacific Command. He also headed a task force planning for the use of new collection systems. Mr. Kerr also served as the deputy and chairman of the committee responsible for imagery requirements and exploitation and later as the executive officer for the Intelligence Community Staff. In 1960, Mr. Kerr joined the CIA serving as an intelligence analyst primarily working on issues related to the Soviet Union. He has received two National Intelligence Distinguished Service Medals for work in the Intelligence Community and two Distinguished Intelligence Medals for work in the CIA. President Bush gave him the Citizen's Medal for his work during Desert Storm. Mr. Kerr holds a bachelor of arts degree in history from the University of Oregon, where he also did graduate work. Mr. Kerr joined MITRE's board of trustees in February 1994.

Mary O. McCarthy Dr. Mary O. McCarthy, a CIA officer, is currently a Visiting Fellow at the Center for Strategic and International Studies, researching and writing on intelligence matters. Previously (from 1996-2001) she had served) as a Special Assistant to the President (Clinton and Bush) and Senior Director for Intelligence Programs on the National Security Council Staff. Prior to moving to the White House, Dr. McCarthy served on the National Intelligence Council as National Intelligence Officer for Warning, and Deputy NIO for Warning. She began her career at CIA in the Directorate of Intelligence in analytic and managerial positions in the areas of Africa and Latin America. Prior to beginning her government service, Dr. McCarthy spent time in the private sector as a Director, then Vice President of BERI, S.A., a Swiss-based company conducting risk assessments for international businesses and banks; and in academics, teaching at the University of Minnesota and serving as Director, Social Science Data Archive, at Yale University. Dr. McCarthy has lectured and written on the relationship between policy and intelligence, on the problem of intelligence warning, and on numerous topics involving the risks associated with international business. She has also published a book on the social history of Ghana. Her Ph.D. in history is from the University of Minnesota.

John C. Gannon Current Position (March 2003-) House of Representatives, Staff Director of the House Select Committee on Homeland Security. Formed arid managed staff for fifty-member committee with responsibility for oversight of the new Department of Homeland Security. (Reference: Committee Chairman Christopher Cox, 202.225.5611.) Previous Positions Department of Homeland Security Transition Planning Office, August 2001-January 2002. Headed team standing up the Information Analysis and Infrastructure Protection Directorate. Proposed organization and budget priorities for FY 03 and FY 04. (Reference: Secretary Tom Ridge, 202.456.1621) Vice-Chair man of the Intellibridge Corporation, Washington (Georgetown), D.C. Provided web-based analysis to corporate and government clients; supervised all analytical and client services for the company. (Reference: Former National Security Adviser Anthony Lake, 202-687-9151) Chairman of the National Intelligence Council, July 1997-June 2001. Produced Community-coordinated estimates for President's national security team on top-priority regional and global issues. Published Global Trends 2015, a strategic look at the world in the next generation, in collaboration with outside experts (see www.odci.gov/CIA/Publications/pubs.html for the document). (Reference: DCI George Tenet, 703-482-6363) Assistant Director of Central Intelligence for Analysis and Production, July 1998June 2001. Coordinated analytic programs of eleven intelligence agencies represented in National Intelligence Producers Board. Initiated first baseline assessment of Intelligence Community analytical resources and the first Strategic Investment Plan for Intelligence Community (Reference: John McLaughlin, Deputy Director of Central Intelligence, 703482-6464) Deputy Director for Intelligence at CIA, July 1995-July 1997 Supervised all CIA analysts and oversaw preparation of the President's Daily Brief. Inaugurated the first Strategic Plan for the Directorate of Intelligence, and its first major reorganization since 1981, flattening management and promoting technology. (Reference: Former DCI John Deutch, 617-253-1479) Military Naval Officer in South East Asia (Engineer Officer on an amphibious landing ship) on active duty from 1967-70 and later in the Naval Reserve as an instructor of navigation at Navy OCS in Newport, Rhode Island; retired from the Naval Reserve (commanded two units) as a Captain in 1990.

Statement of John C. Gannon Staff Director, Select Committee on Homeland Security before the National Commission on Terrorist Attacks Upon the United States October 14, 2003

Thank you for inviting me to testify before your commission on the subject of "Warning of Transnational Threats." You have an historic opportunity to help improve the performance of the US Intelligence Community and the broader US Government against terrorism and other transnational threats. I know you are committed to doing so. I want to help you in any way I can.

It is a special pleasure to be here on a panel with Dick Kerr and Mary McCarthy, who are my colleagues and friends of many years in the Intelligence Community. You could not have chosen two people more knowledgeable or experienced in the practice of intelligence, including the critical warning function. I have looked forward to their testimony.

I want to structure my written remarks, Mr. Chairman, in direct response to the nine questions you provided in your letter of invitation. Before I do that, however, let me briefly share with you my concept of warning, which, as I will explain, is a broad one affecting analytic tradecraft across the board. This is the view that I have applied in managing or developing analytic programs in senior intelligence positions, in the Homeland Security Transition Planning Office, and in my current job as the Staff Director of the Select Committee on Homeland Security.

1

Thomas H. Kean CHAIR Lee H. Hamilton VICE CHAIR

October 1,2003 Mr. Richard Kerr

Richard Ben-Vcniste

9/11 Personal Privacy

Max Cleland Frederick F. Fielding Jamie S. Gorclick Slade Gorton John F. Lehman Timothy J. Rocincr James R. Thompson

Philip D. Zelikow EXE^TI TIVE DIRECTOR

Dear Mr. Kerr: The National Commission on Terrorist Attacks Upon the United States will hold its fourth public hearing on October 14, 2003, to receive testimony regarding "Intelligence and the War on Terrorism." The hearing will be held in the Russell Senate Office Building, Room 253. We thank you for your willingness to testify in this proceeding, which will be an important part of the Commission's efforts to produce an authoritative account of the terrorist attacks of September 11, and to develop recommendations to prevent future terrorist attacks. The Commission will consider the topic of "Warning of Transnational Threats," and your panel will begin at approximately 1:15 p.m. Please focus your remarks on the following questions: •

What are the essential methods or principles that have been developed over the years for analyzing and preparing warnings of a surprise attack?

•

Before 9/11, were these methods or principles properly applied to the danger of a catastrophic terrorist attack?

•

What is right and wrong with the current system of warning? What is— and should be—the role of the Director of Central Intelligence, the Secretaries of State and Defense, and the National Security Adviser?

•

Who is in charge of warning of terrorist attacks against the United States today? The National Intelligence Council? The Directorate of Intelligence in the CIA? The Department of Defense? The CIA Counterterrorism Center? The Directorate of Information Analysis & Infrastructure Protection in the Department of Homeland Security? Or the recently established Terrorism Threat Integration Center? Who should be in charge?

301 7lh Street SW, Room 5125 Washington, DC 20407 T 202.331.4060 F 202.296.5545 www.9-1 lcommission.gov

Mr. Richard KenOctober 1,2003 Page 2

•

Has the Congress met its responsibility in establishing priorities, providing resources and providing oversight of the Intelligence Community? What changes in its role do you recommend?

•

What needs to be done to improve our ability as a government to provide better warning?

The Commission asks that you submit comprehensive written testimony on these issues and any other you deem pertinent to a full understanding of the government's conduct of the war on terrorism and the role of intelligence. Please send your testimony via e-mail to Ms. Melissa Coffey at mcoffey@91 lcommission.gov by 9:00 a.m. on October 7. Your full statement will be made part of the record and carefully studied by the Commission. Because of time constraints, we ask that you limit your oral remarks to 5 minutes and focus on the aforementioned areas. Our purpose in limiting opening remarks is to highlight what we expect will be a highly fruitful interchange with you and other members of your panel. The agenda for the hearing is enclosed. Please plan to arrive 30 minutes prior to the beginning of your testimony. If you have any questions please contact Mr. Kevin Scheid at (202) 331-4069. We look forward to your participation. With best regards,

Thomas H. Kean Chair

Lee H. Hamilton Vice Chair

Testimony Before the National Commission on Terrorist Attacks Upon The United States October 14,2003 By Mary O. McCarthy1 Mr. Chairman, Governor, Commissioners: It is my privilege to be here today to contribute in any way that I can to your important work. In your quest to determine the points of failure in our Government that permitted our national tragedy of September 11, 2001, and thereby to shape remedies that will enable our citizens to have renewed confidence in their Government's ability to protect them in the future, you have rightly identified, as an area of inquiry, the question of the Intelligence Community's capabilities to provide persuasive and timely intelligence warning. It is on this question of warning capabilities that I wish to focus my remarks. The quick answer is that the Intelligence Community has an extraordinary workforce of talented and motivated public servants who are entirely capable of producing the best possible intelligence and analysis. The system that should exist to produce timely and credible warning information, however, repeatedly has broken down, as a brief review of history will show. Successive recommendations over the decades to construct and maintain a system by which the Intelligence Community can reliably warn of potential outcomes have faltered in the implementation. In my remarks today, I would like to provide a brief history to illustrate the cyclical nature of the warning reform issue, explain what is meant by "warning", describe a schematic for producing reliable warning intelligence that applies to the so-called conventional threats as well as transnational-threats, point out the dangers that arise if this kind of approach is not used, and offer some suggestions for breaking out of the cycle of review-of-failure followed by imperfectly-implemented-reform. The History It has been widely noted since September 11 that the Intelligence Community, shaped and grown as it had been during the Cold War to address a single threat, was ill suited to deal with the changed world of the early Twenty-first Century. During the Cold War, these observers maintain, the Intelligence Community developed sound systems for providing warning concerning the Soviet Union and other situations involving the mobilization of large militaries. In particular, this view suggests, until a dozen or so years ago, that the Intelligence Community hardly thought about the so-called transnational threats, or about other parts of the world except as they related to the Soviet

1 Bio attached. These comments reflect the professional views of Mary O. McCarthy and are not necessarily those of the Central Intelligence Agency.

COMMISSION SENSITIVE QUESTIONS FOR BRENNAN [It is unclear to me from reading GL's notes from the TTIC briefing how domestic information is integrated with foreign information? For example: • Who is accountable to ensure information developed by local law enforcement reaches TTIC in a timely fashion? • How many layers are there between TTIC and: o JTTF o 50 State Police agencies o ??? county and local police (number used is 650,000 state and local law enforcement personnel) • Is anyone passing watch list info to state and local agencies? • Is anyone clearing state and local officials to receive classified threat warning info? • Is there an ombudsman to ensure that US person privacy issues are continually addressed, reviewed, monitored, etc? •

What is the chain of command between you and the DCI? D/FBI? SecHLS? SECDEF? POTUS? D/CIA/CTC? C/CIA/CTC/OTA? DHLS/IAIP? FBI/Field Offices? JTTF? CIA overseas stations?

•

On what issues should D/TTIC be held accountable?

•

How is tactical warning?

•

What is your current level of staffing (projected to be >200 people in CIA Hqs by Sep 03 per briefing charts)?

•

Is it your intent to gain authority to hire analysts independent of any agency?

•

When TTIC identifies an intelligence gap how will action to collect information on that topic be translated into collection of information? To what degree do you/will you task or hold accountable collectors to respond to your identification of an intelligence gap?

•

What training programs has/will TTIC develop? Where does CT analytical training now occur? What programs/course exist? For whom?

•

What work does TTIC do on strategic issues? Who does it (from which USG components? Examples of strategic analysis?

•

Has Mr. Dick Kerr completed his assessment of the recommended division of labor between TTIC and other agencies? If so (or even if not) what are the preliminary ideas, suggestions, and recommendations?

COMMISSION SENSITIVE

COMMISSION SENSITIVE Who has responsibility for integrating threat and terrorism related information flowing into JTTF's from state and local law enforcement to national level? At what point might TTIC learn of information acquired at the state and local level? Will TTIC provide directly or indirectly to state and local law enforcement an evaluation of information acquired at the local level/?

COMMISSION SENSITIVE

O. Brennan Director, Terrorist Threat Integration Center

IWS - The Information Warfare

Search Site

Categories About iWS

Page 1 of 26

-iffoocsn

News

Lists j

Links i Sup

Site Mao

Statement for the Record of

John O. Brennan Director, Terrorist Threat Integration Center Before the House of Representatives Committee on the Judiciary and the House of Representatives Select Committee on Homeland Security Washington, B.C. Good afternoon, Chairman Sensenbrenner, Chairman Cox, Ranking Member Conyen Ranking Member Turner, and the Members of the Committee on the Judiciary and House Select Committee on Homeland Security. I appreciate the opportunity to join my colleagues from the Department of Homeland Security and the Federal Bureau of Investigation to discuss the mutually supporting relationship between the Terrorist Threat Integration Center (TTIC) and the Department of Justice/Federal Bureau of Investigation (DO J/FBI) and Department of Homeland Security (DHS). As the members of the Judiciary and Homeland Security Committees well know, international terrorism poses a serious threat to U.S. interests, both at home and abroa Al Qa'ida and other terrorist organizations continue to make plans to carry out attack against U.S. citizens and facilities worldwide. While many of these plans have been disrupted since the tragic events of 11 September 2001, constant vigilance and proactiv efforts on the part of many government departments and agencies are required to prevent the loss of additional U.S. lives in terrorist attacks. In recent years we have learned that terrorist threats that initially appear to be directed at overseas targets ma actually be threats against our homeland, with the reverse being possible as well. We need to have all of our efforts - both overseas and domestic - working together in a seamless manner. DHS is a critical part of that seamless effprt; TTIC is as well. A key ingredient of the U.S. Government's counterterrorism strategy is to ensure that the many government agencies and departments involved in the war on terrorism worl closely together and share threat information and analysis that could be used to prevei

http://www.iwar.org.uk/homesec/resources/ttic/brennan072203.htm

8/28/03

Statement of Larry Mefford - FBI

Search Site,

Page 1 of3

IWS - The Information Warfare

Go

Categories About svVS

:

fnfeeon

Reviews

Fwum

:Ne*$

Mailing Lists

Links I Sup

Site Map

Statement of Larry Mefford Executive Assistant Director, Counterterrorism and Counterintelligence Federal Bureau of Investigation Before a Joint Hearing on "The Terrorist Threat Integration Center and its Relationship with the Departments of Justice and Homeland Security" July 22, 2003

Good afternoon Chairman Sensenbrenner and Chairman Cox, I am honored to app< at what may be a very historic hearing. I cannot recall when a witness from the FBI 1 testified before a combined panel that encompasses over 80 distinguished Members of House of Representatives.

It is also an honor to share this table with several of our partners in this very import; initiative - the Terrorist Threat Integration Center (TTIC). During a speech at F Headquarters, President Bush emphasized that the "FBI has no greater priority than preventi terrorist acts against America." I want to ensure that everyone clearly understands that TTIC crucially important to the success of our mission in the FBI, and it will take us to the n<

http://www.iwar.org.ulc/homesec/resources/ttic/mefford072203.htm

8/28/03

What Is Intelligence Chatter, Anyway? By David Joachim

Page 1 of2

MSN Home | My MSN | Hotmail | Search | Shopping | Money | People & Chat

Get 3% back on purch«»»«!

Search the V

powered by I

Print | E-mail | Discuss | Alerts

explainer Answers to your questions about the news.

What Is Intelligence Chatter, Anyway? Home News & Politics Campaign 2004 Arts & Life

By David Joachim Posted Friday, September 12, 2003, at 2:45 PM PT

The State Department issued a "worldwide caution" Thursday, warning that the newly released tape of Osama Bin Laden and a recent increase in intelligence "chatter" might indicate an imminent terrorist attack. What kind of Intel counts as chatter?

Business Sports Technology Travel & Food Slate on NPR Output Options About Us Search Slate Advanced Search

When intelligence agencies monitor chatter, they examine not the content of communications intercepts, but the volume. Intelligence agencies won't define the term publicly because, they say, any disclosure might help the enemy deconstruct their methods and devise a defense. But those with knowledge of the agencies' tactics say that operatives pay attention to fluctuations in the number of messages sent and received over networks used by known and suspected terrorists. By itself, a volume increase isn't very meaningful. But when spies notice volume spikes on several networks and compare them with the content of recent communications intercepts, satellite observations, and information passed to spies on the ground, patterns emerge. In May, such patterns helped U.S. spooks zero in on Saudi Arabia as a planned target just before suicide bombers set off three blasts in Riyadh that killed 25 people and injured 200.

Prisoner of. Watching Bill Sofia Coppolc Translation (I Features), I f More News & Poll

The Flip-Flo Edwards Slate contini features on tl presidential c More Sports

Spies turn to such pattern analysis because it is more reliable than individual pieces of human intelligence. Enemy defectors often provoke credibility concerns: They know that if they say what U.S. officials want to hear and are convincing enough, they may receive asylum and a lifetime pension from the government. Because chatter is a measure of collective behavior, it tends to be a fairly dependable indicator. Intelligence agencies found it easier to monitor chatter during the Cold War. Back then, the enemy stayed in one place and used a dedicated military communications network: Everything U.S. spooks heard on these lines was military chatter. The United States could tell the Soviets were starting a military exercise whenever volume increased on the command circuits that connected missile silos to local military headquarters. But monitoring terrorist chatter is far more difficult today. For one thing, spies must contend with more numerous modes of communication—e-mails, cell phone calls, faxes, and computer data transfers among them. Complicating matters, terrorists tend to use the same circuits that civilians use. Only a tiny percentage of transmissions on these networks are useful for national security purposes, so spies must be able to identify with precision where suspects are and how they're communicating. And

http://slate.msn.com/id/2088261/

Wuss in Boc There's a mo book Enchant Exploitationof New Mexic TOP HEADLir

' PoweN warn: Iraq

9/14/2003

'The Terrorist Threat Integration Center (TTIC) and its Relationship with the Department... Page 1 of 2

search sit^| Horre \s j About; AS

r^]

infsoon j

Reviews j

Faaum

iw$ - The Information Warfare j News

Mailing bsts j

brrics ;

Sat

Site Map

JOINT OVERSIGHT HEARING COMMITTEE ON THE JUDICIARY AND

SELECT COMMITTEE ON HOMELAND SECURITY "The Terrorist Threat Integration Center (TTIC) and its Relationship with the Departments of Homeland Security" WITNESSLIST

* ***

Tuesday, July 22, 2003 1:00 p.m. in 2118 Rayburn House Office Building

John O. Brennan

Director Terrorist Threat Integration Center Larry Mefford

Executive Assistant Director Counterrorism and Counterintelligence Federal Bureau of Investigation U.S. Department of Justice

http://www.iwar.org.uk/homesec/resources/ttic/

8/28/03

THE I&W PARADIGM AS APPLIED TO 9/11 Fritz W. Ermarth 25 September 2002 The revelations of recent months as to who knew and reported what and when, or did not, allow for the hypothesis that the attacks of 9/11 could have been prevented with the information we had. The public testimony of the Joint Inquiry Staff of the House and Senate intelligence committees released on 18 September fortifies this hypothesis considerably. Defining and testing this hypothesis should form a part of the agenda of inquiry as to whether there was an intelligence failure, where and when it occurred, and how to correct it for the future. The issue turns, first of all, on how the warning problem should have been and should be conceptualized to address the threat of terrorist attack. During the Cold War, with Pearl Harbor in recent memory, we worked massively on the "indications and warning" (I&W) problem, and very successfully. We erected an "industrial age" system for collecting strategic warning (there is an enemy who prepares energetically for war), operational warning (here is how he mounts up for war and how we can tell), and tactical warning or warning of attack (he is executing his attack plans). Moreover, and most importantly, this I&W system was tightly linked to military and other response options and action plans, such as alerting and dispersing forces, and, ultimately, war plans. Happily, this system worked well, not by averting a Pearl Harbor, which never came (even Cuba 62 did not involve intent to begin war), but by giving us confidence day by day that a Pearl Harbor was not in the offing, a confidence that allowed us to act calmly even in periods of tension, and not bring about war by overreaction and inadvertence. And the fact that our I&W system was very effective probably helped deter the enemy from gambling on surprise, to which his military doctrine assigned a very high value. The problem of terrorism and warning of it is vastly different from and far more difficult for intelligence to deal with by its very nature than warning of massive military attack. The whole point of the terrorist is to avoid giving warning by chosing operations and targets for which elaborate military-style preparations are not necessary. Yet he must make preparations that do or can give some warning. He must mobilize, motivate, organize, prepare, and execute...all the while feeding, fueling, funding, and cajoling his operation. So in very rough terms, the Cold War paradigm of strategic-operational-tactical warning, and connection to vulnerability and response, has some utility. Prior to 911, we definitely had strategic warning. We saw the enemy, Al Qaeda, forming up and growing in strength. We knew his hostile intent. We saw him preparing capabilities, especially in Afghanistan. We experienced his attacks on our overseas perimeter. We heard him proclaim determination to hit us at home, and saw him try it in 1993. Three DCIs and other authorities repeated that it was only a matter of time before major attacks were launched inside the US. We had a kind of operational warning in the summer of 2001. By then we knew something about the enemy's operational repertoire and knew or had strong reason to suspect that suicidal use of airplanes as bombs was in it. And we were hearing enough about something major in the works to conclude that the threat was mounting in the period immediately ahead. The recent Joint Staff testimony is eloquent on both counts Our challenge was to move beyond strategic and operational to tactical warning. Or, at the very least, to turn what we had in strategic and operational warning into a threat assessment on which preventive action could be taken. Most public commentary about intelligence failure before 9/11 focuses on the first construction of the challenge, and concludes that we were just not lucky enough or energetic enough to penetrate the enemy's immediate plans, to "uncover the plot" as FBI Director Mueller puts it. Or, put another way, there were not quite enough of the right dots to connect to make a precise threat picture.

Connecting the Dots

Pagel of 13

Connecting the Dots: The Challenge of Improving the Creation and Sharing of Knowledge About Terrorists Mark Sawyer July 2003

Mark Sawyer is a senior analyst at ANSER, with 14 years' experience in defense policy issues. For the past 22 months he has been analyzing the evolution of homeland security policy for ANSER's clients. He earned an A.B. degree from Dartmouth College and an M.A. from the Patterson School of Diplomacy and International Commerce at the University of Kentucky. The views expressed in this article are those of the author alone. They do not necessarily reflect the views of ANSER or its clients.

Introduction On 11 September 2001, al-Qaeda executed horrific attacks against the United States, and instantaneously the use of the term "connect the dots" exploded across the airways to describe what pundits said did not happen in the Intelligence Community prior to the attacks. It is universally accepted that the process by which the United States analyzes terrorist threats needs to be improved. Improving the system requires an understanding of what the process needs to be. "Connect the dots" is a useful term, and a useful point of departure, but only if we understand what we are really talking about: how do you recognize, collect, and share dots, connect dots, and share the knowledge created by the connection? Connecting the dots—the centerpiece—is just one aspect. The analytic process and the quality of the analysts are but a bright spot in the picture. How to get the right data to the analysts (sharing data) and how to best use their analyses (sharing intelligence) are the key questions. My intent is not to discuss the intelligence cycle1 per se but to discuss aspects of the cycle that need to be understood to improve terrorist threat analysis. There are three components of the process: 1. Identification, collection, and sharing of data (or dots) 2. Creating knowledge (or connecting the dots) 3. Sharing the created knowledge For the sake of discussion, I assume that the process is national, owned and run by the federal government, with state and local governments and the private sector as partners. A secondary assumption is that all the analysis is done at the federal level. Background

http://www.homelandsecurity.org/journal/Articles/Sawy er_Dots.html

12/17/2003

Studies In Intelligence Vol. 01 No. 1, 1997

Next

J

Previous

Page 1 of 9

Contents

A Blueprint For Survival

The Coming Intelligence Failure Russ Trayers

The year is 2001. The Intelligence Community (1C) budget has remained under pressure and manpower cuts have continued, but bureaucratic politics and legislative prerogatives have perpetuated about a dozen national-level agencies and forced a further division of analytic labor. By the turn of the century, analysis had become dangerously fragmented. The Community could still collect "facts," but analysts had long ago been overwhelmed by the volume of available information and were no longer able to distinguish consistently between significant facts and background noise. The quality of analysis had become increasingly suspect. And, as had been true of virtually all previous intelligence failures, collection was not the issue. The data were there, but we had failed to recognize fully their significance and put them in context. At a time when the interrelationship among political, economic, military, social, and cultural factors had become increasingly complex, no agency was postured to conduct truly integrated analysis. From the vantage point of 2001, intelligence failure is inevitable.

Part I: The Path to Failure Despite our best intentions, the system is sufficiently dysfunctional that intelligence failure is guaranteed. Though the form is less important than the fact, the variations are endless. Failure may be of the traditional variety: we fail to predict the fall of a friendly government; we do not provide sufficient warning of a surprise attack against one of our allies or interests; we are completely surprised by a statesponsored terrorist attack; or we fail to detect an unexpected country acquiring a weapon of mass destruction. Or it may take a more nontraditional form: we overstate numerous threats leading to tens of billions of dollars of unnecessary expenditures; database errors lead to a politically unacceptable number of casualties in a peace-enforcement operation; or an operation does not go well because the 1C is not able to provide the incredibly specific data necessary to support a new generation of weapons. In the end, we may not suffer a Pearl Harbor, but simply succumb to a series of mistakes that raises questions about an intelligence budget that dwarfs the entire defense budget of most countries.(l) The Community will try to explain the failure(s) away, and it will legitimately point to extenuating circumstances. But we are going to begin making more and bigger mistakes more often. It is only a matter of time before the results rise to the level of acknowledged intelligence failure. It will get so severe that the IC's relevance will be seriously questioned—far more than has been the case to date. The reasons will be simple: we have gotten away from basics—the collection and unbiased analysis of facts. When we do the postmortems and try to reconstruct the broader institutional causes for the failure, we will find them spread throughout the national security apparatus—some a function of this period of history, others a function of mistakes:

http://www.cia.gov/csi/studies/97unclass/failure.html

8/4/03