Tactical Realities of the Toulouse Shootings

By Scott Stewart

Mohammed Merah, the suspect in a string of violent attacks culminating with the March 19 shooting deaths of three children and a rabbi at the Ozar Hatorah School in Toulouse, France, committed suicide by cop March 22 after a prolonged standoff at his Toulouse apartment. Authorities believed Merah also to have shot and killed a paratrooper March 11 in Toulouse and two other paratroopers March 15 in Montauban.

While Merah's death ended his attacks, it also began the inevitable inquiry process as French officials consider how the attacks could have been prevented. The commissions or committees appointed to investigate such attacks normally take months to complete their inquiries, so the findings of the panel looking into the Merah case will not be released in time to have any impact on the French presidential election set to begin April 22. However, such findings are routinely used for political purposes and as ammunition for bureaucratic infighting.

Like the suspects in many recent terrorist attacks in other countries, Merah had previously come to the attention of French authorities. He reportedly traveled at least twice to the Afghanistan/Pakistan border region and was interviewed by authorities upon his return to France in November 2011. Some media reports have even suggested that Merah had worked as an informant for French authorities. Merah's older brother, Abdulkader Merah, also reportedly was investigated in 2007 for helping French Muslim men travel to Iraq to fight. These facets of the case will certainly be examined in detail.

While it will be many months before the official reports are published, already we can draw several conclusions from this case. This is because the same essential problems occur whenever a Western government attempts to pre-empt vague, potential threats posed by an amorphous enemy. Indeed, these issues surfaced several times following attacks by Islamist militants in the United States, the Netherlands, Spain and the United Kingdom. They also were seen in the July 2011 attacks in Norway.

In short, government bureaucracies do not deal well with ambiguity -- and terrorist actors, particularly at the grassroots and lone-wolf levels, are nothing if not ambiguous. They tend to be insular and dedicated, and they might not be meaningfully connected to the command, control and communication mechanism of any known militant group or actor. This makes them exceedingly hard to identify, let alone pre-empt, before an attack is carried out.

As the political debates in London following the 2005 attacks (and in Washington following 9/11) have shown, that governments somehow are expected to prevent all terrorist attacks. When one occurs, political investigations into the cause of intelligence failures ensue and, on occasion, considerable finger-pointing and agency reorganizing. The public, after all, needs to feel secure.

But the uncomfortable truth is that there is no such thing as complete security. Given the nature of the terrorist threat and terrorist actors, no intelligence or security service in the world could identify every aspiring militant who lives in or enters a country or could pre-empt their potential acts of violence. This is impossible even in states that employ draconian security measures, and the challenge is obviously amplified in societies that value civil liberties and due process. The challenge is especially pronounced in cases where the subject is a citizen who has not yet broken any laws, or there is not sufficient evidence to support prosecution for any violations. A distinct tension exists between security and individual liberties.

Within that context, then, the tactical challenges and expectations faced by counterterrorism agencies are useful to consider.

Puzzles

Certainly, when the Merah case is reviewed in hindsight and in isolation it will become obvious that there were clues -- pieces of a puzzle -- that could have been fitted together to indicate Merah posed a threat and warranted focused intelligence and investigative efforts. As noted above, a few of those clues already have appeared in the press, and there are sure to be other clues revealed as the investigation progresses.

Anyone can be a brilliant investigator after the fact, but solving a puzzle in real time is very difficult -- especially considering that Merah did not exist in isolation but was one of myriad potential threats French authorities faced. France is not North Korea, a homogeneous society where the few resident foreigners easily can be monitored. France is a huge, multicultural country that is home to many religious and political dissidents and refugees. Moreover, France's Muslim population may number as many as 5 or 6 million, which equates to somewhere between 8 and 10 percent of the total population. Thus, even if one were to use profiling techniques, which can be problematic in their own right, identifying radical Islamists -- who make up only a small percentage of France's Muslim population -- would be a tremendous undertaking.

Even if one were able to positively identify all the radical Islamists in France, there would be a further challenge of differentiating between what could be called "jihadist cheerleaders" -- radicals who voice political or ideological support for the jihadist cause but are not actually violent -- from those militant jihadists willing to commit attacks. The most vociferous are not always the most likely to conduct an attack, but their heated rhetoric usually draws a lot of scarce government resources. Even among those willing to wage physical jihad, there is an additional difference between those who believe they can fight only in Muslim lands and those who believe they can conduct attacks in the West.

Sorting through the galaxy of potential suspects is a daunting task for the French government. Obviously, if there is intelligence that a suspect is directly linked to al Qaeda or another known terrorist group, it is easy to classify that individual as a high-priority intelligence target. Such a suspect would then merit 24/7 physical and electronic surveillance, an endeavor that could tie up as many as 100 people, including surveillance operatives, supervisors, technicians, photographers, forensics experts, analysts and interpreters -- and this would be to monitor only one suspect.

But in the real world, intelligence is seldom, if ever, so black-and-white. And quite often, investigators and analysts are left to work with bits of partial information. This problem is compounded by the very structure of the jihadist movement, which consists of al Qaeda, its franchises, grassroots sympathizers and lone wolves. The jihadist landscape has been described as a "network of networks" or a "network of relationships," a characterization that has become even more apt as the capabilities of the central al Qaeda group have been degraded. In application, this means that when considering any particular plot, there may not be any clear-cut chain of command or communications networks on which to focus intelligence resources. The network within which jihadists operate is difficult to delineate, as are the targets they choose to attack. This same ambiguity also exists in the non-jihadist realm as seen in attackers such as Anders Breivik, Timothy McVeigh, Theodore Kaczynski and Eric Rudolph.

This means that, without hard intelligence indicating a link between a particular suspect and a known militant group or network, government agencies often place suspected operatives into lower priority categories, which means they receive less investigation and intelligence monitoring. Indeed, it is often nearly impossible to gather hard intelligence about a person's thoughts and intentions, and this is the crux of the dilemma facing the French and other governments as they attempt to assess the threat posed by individuals and small, insular groups.

Not all puzzles are equal. Investigating an attack after the fact is a matter of identifying the puzzle pieces and placing them together to form a complete picture of what happened. But identifying plotters and their plans before an attack occurs is far more difficult. It is more like sifting through the pieces of thousands of different puzzles, all jumbled together in one big pile, and then attempting to create a complete picture, without knowing what the end result -- the attack -- will look like.

Tools and Limitations

Several tools can be used to identify and pre-empt terrorist attacks. These are human-intelligence sources, signals intelligence, investigation and analysis. All of these tools are useful, but none are perfect.

Recruiting human sources from the communities in which militants are likely to live and move is invaluable, but any source can see only what is within his or her field of vision, and many sources exhibit biases that can cloud their collection. Militant cells are built on relationships and trust -- often based on familial or tribal connections -- which are difficult to establish quickly. And when the concern is about militants at the grassroots or lone-wolf level, the universe of people with whom human sources would need to establish close relationships becomes very large indeed. Moreover, even if a source is well-placed, it can be difficult to judge a suspect's motivations and intentions unless one knows him or her intimately. In the Merah case, even some who claimed to have known the suspect well were surprised to learn of his alleged involvement in the attacks.

The utility of signals intelligence can also be limited, especially in light of past successes. Signals intelligence does not work well when suspects practice careful operational security (such as foregoing the use of satellite telephones, email or cell phones). Even a fairly moderate and intuitive amount of operational security can increase the difficulty of detection by orders of magnitude. In the case of grassroots operatives, escaping scrutiny simply means not committing acts that would bring someone to the attention of authorities, such as communicating with known members of terrorist groups or visiting radical Internet sites.

A potential suspect can be investigated, as was apparently the case with Merah, as well as suspects in past attacks such as London bomber Mohamed Siddique Khan, Norwegian bomber and shooter Anders Breivik and Fort Hood shooter Nidal Hassan. However, due to the large numbers of potential suspects it is very unlikely investigators will conduct a full probe unless they note obvious signs of criminal intent or activity during their preliminary inquiry. Certainly, attackers are bound to the terrorist attack cycle, but unless they exhibit such behavior while being investigated, chances are the authorities are going to miss it even if the attackers are practicing sloppy tradecraft.

In any setting, intelligence is little more than raw data until analysis is applied -- but drawing the correct conclusions is difficult if one has incomplete data, is given the wrong kinds of material to analyze or lacks the proper mindset and training to make useful inferences. Bias, assumptions and preconceptions also pose significant problems. In the Breivik case, authorities noted his acquisition of large quantities of fertilizer but discounted him as a threat after interviewing him. It appears that as a white Norwegian, he did not fit the investigators' preconception of a potential threat. In other words, they were envisioning the wrong finished picture for that particular puzzle.

The fact is the resources available for investigations; physical and electronic surveillance; recruiting and handling human sources; and completing analyses from the field are finite for any government. In the French case particularly, one problem was that authorities had to devote significant resources to monitoring the "jihadist cheerleaders" (although some of those individuals are now being rounded up; the French government announced April 2 that it was deporting five radical Islamic preachers).

Monitoring and deporting cheerleaders does not fully address the problem of distinguishing those intending to conduct an attack from a host of potential attackers when the government has not been able to collect hard intelligence pertaining to that intent and activity. It is from this constellation of individuals that Merah and several other successful attackers have arisen in recent years. For the authorities, it is a question of justifying the expenditure of limited resources to monitor an individual or group whose connections to terrorism are questionable while staying fully engaged in monitoring others with solid connections to terrorism. This is how grassroots jihadists and lone wolves can, and will, slip through the net, sometimes with deadly effect.

At this time, it is impossible to tell how many individuals or small cells are or might be planning attacks in France, Britain or the United States. There are many variables involved, and no government agency should be expected to provide complete security against potential -- but unknown -- threats. Moreover, with each arrest, each intelligence find, each videotaped speech or warning, the game changes: Each side shifts, adjusts and adapts to the moves being made by the other side in order to attain or maintain an advantage. This type of shift was clearly illustrated by the calls by jihadist leaders in recent years for sympathizers to conduct simple attacks close to home with readily available weapons.

None of this is intended to argue that the missions of intelligence and security agencies are futile, that funding should be cut or efforts abandoned. In a world where complete safety is not possible, the question becomes one of aligning resources to prevent the most serious threats to a society and mitigating the effects of attacks that cannot be prevented. Such an approach stands in stark contrast to that of attempting to guard every potential target against every conceivable threat.

Indeed, acknowledging that it is impossible to prevent all acts of violence could provide a starting point for a more meaningful discussion of effective counterterrorism tactics. Knowing there is a limit to what governments can do can lead to smarter ways of doing things -- focusing efforts and resources, collecting information and turning that information into actionable intelligence while safeguarding individual liberties.

Read more: Tactical Realities of the Toulouse Shootings | Stratfor