When authorities recognize that they do not have sufficient information or adequate capability to destroy a terror cell or network, preemption should transition quickly to preventing the attack. Knowing precisely when to transition from “Preemption” to “Prevention” is often subjective—and for those officials who have extensive experience in law enforcement and counter-terrorism, it can also be instinctive—but there are key indicators that guide a decision to move toward “Prevention.” Intelligence plays a dominant role in this decision-making process. Intelligence reports that indicate terror cells have established a presence within our borders are the best signs. Other signs include the increased volume of SIGINT “chatter” and known movements of terror leaders. A general absence of information and intelligence may also push decisionmakers to “Prevention” as an operational precaution to save lives and preserve property. In these cases, authorities must ask difficult qualitative questions about the information on hand. They must also review their capability to actually preempt the attack.
If the decision is to retain preemption as a key objective, warnings can be expanded to a functional audience. Following this course of action generally implies a tightly controlled warning to need-to-know audiences with the stated goal to preempt a terror network, and with the minimum goal to prevent an attack. When preemption is no longer a realistic option, the warning can be expanded to a broader sector-wide audience such as the airline or petrochemical industry, or a national region, wherever the threat is perceived to exist.
As warnings are expanded, a cautionary note must be struck within interagency discussions: balancing the public’s need-to-know with the intelligence community’s mandate to protect sources and methods will always represent a challenge for crisis managers. Political leaders and intelligence operatives, and crisis managers will need to ask whether the two concerns are mutually exclusive, and which takes precedence. Other questions to consider: Does the public always have a need to know when such a situation arises? What can the government do if a public warning would elicit mass panic and gridlock?
Nowhere are the “red-lines” posed by these questions more immediately apparent than in the White House Situation Room environment. When a crisis occurs, the Homeland Security Council most frequently meets in the White House Situation Room. Officials who occupy seats around the table include principal decision-makers or their deputies when they are not available. One official who is often not invited to these discussions when terrorism is involved is the White House Press Spokesperson (who has Assistant-to-the-President commissioned officer rank and Top Secret SCI clearance/access). He is, at times, actually disinvited to be present in crisis management discussions. Deciding when to invite the press spokesperson into a crisis management discussion is therefore one of the most immediate outward physical manifestations of when the Preemption Phase transitions to the Prevention Phase.
One such decision to expand warning, while not coordinated with this overt purpose in mind, occurred in June and July 2001:
On June 28, [Richard] Clarke wrote [Condoleeza] Rice that the pattern of al Qaeda activity indicating attack planning over the past six weeks "had reached a crescendo." "A series of new reports continue to convince me and analysts at State, CIA, DIA [Defense Intelligence Agency], and NSA that a major terrorist attack or series of attacks is likely in July," he noted. One al Qaeda intelligence report warned that something "very, very, very, very" big was about to happen, and most of Bin Ladin's network was reportedly anticipating the attack. In late June, the CIA ordered all its station chiefs to share information on al Qaeda with their host governments and to push for immediate disruptions of cells.
The headline of a June 30 briefing to top officials was stark: "Bin Ladin Planning High-Profile Attacks." The report stated that Bin Ladin operatives expected near-term attacks to have dramatic consequences of catastrophic proportions. That same day, Saudi Arabia declared its highest level of terror alert. Despite evidence of delays possibly caused by heightened U.S. security, the planning for attacks was continuing.
On July 2, the FBI Counterterrorism Division sent a message to federal agencies and state and local law enforcement agencies summarizing information regarding threats from Bin Ladin. It warned that there was an increased volume of threat reporting, indicating a potential for attacks against U.S. targets abroad from groups "aligned with or sympathetic to Usama Bin Ladin." Despite the general warnings, the message further stated, "The FBI has no information indicating a credible threat of terrorist attack in the United States." However, it went on to emphasize that the possibility of attack in the United States could not be discounted. It also noted that the July 4 holiday might heighten the threats. The report asked recipients to "exercise extreme vigilance" and "report suspicious activities" to the FBI. It did not suggest specific actions that they should take to prevent attacks.
In hindsight, a cogent question to consider is whether expanding the warning outside official channels to a broader public audience might have successfully prevented the 9-11 plot.
Once the decision is made to move fully to “Prevention,” an expanded public warning can serve to either potentially disrupt or delay a terrorist attack. Maximizing awareness through public warning—raising the HSAS protective condition to orange for a threatened sector or region, for instance—may well have the desired affect of delaying an attack; but if crafted thoughtfully and deliberately, expanded awareness could also physically disrupt an attack if it leads to the arrest of one or more operatives in a terrorist network.