 Good afternoon. It is my honor to get to introduce the people who are going to talk on this panel because there is more talent for Analytic ability sitting on this table, and it's not just the analysis It's also these people have not only been the people in their their cadre that rose to the top because of their analytical ability, but also for their management skills and their their oversight of many many many different projects So it's my great pleasure to start by introducing Karen Wagner. Karen Wagner is currently the undersecretary for Homeland Security Intelligence and Analysis She started there in 2010. Before that she was on the House Permanent Select Committee on Intelligence. She managed two different things that are almost completely Disaggregated. She was the budget director at the same time being the cyber security coordinator to her to her left is I mean just her left is Tracy Reinhold who is the Assistant Director for the FBI Directorate of Intelligence. He is a 20-plus year veteran of the of the FBI He's held many different positions to include being the director's special assistant and least but last but not least he is a Marine to his left is Phil Mudd. Phil Mudd is Currently the Senior Global Advisor for Oxford Analytics He is a career CIA veteran He was there for over 10 years and then made that one of the most unusual jumps for somebody before 9-11 But an understandable jump now He went to the FBI to be the Deputy Director for the National Security Branch and started that transition of intelligence and law enforcement He went back to the agency and then went back as a senior intelligence analyst To his left is Mark Lowenthal. He is currently the president of intelligence and security academic academy He was the assistant DCI for analysis and production when he was In the agency then he went to be deputy assistant secretary for intelligence He went to the Congress to be the staff director for the HIPPSE and as we all know he is the author of intelligence from secrets to policy which has taught a generation of college students about what analysis is and The moderator for your panel today, I'd like to introduce you to Shane Harris. He's a writer for the Washingtonian magazine He also has written a book called the Watchers Which was a book about national security professionals and how they did their job and what they did which is now in my personal reading list and He has won many awards to include the Gerald Ford Prize for for distinguished performance Great. Thank you very much and thank you all for being here So our task today is to get at the issues of analytic tradecraft for homeland security Intelligence and what I hope to do in the course of this discussion is at least a couple of things at the high level One is to better understand what we mean when we say homeland security Intelligence how it's different from other kinds of intelligence and really how you what the tradecraft of that looks like and we're very fortunate That we have four people here who have been practitioners In this field sometimes in the name of homeland security intelligence But really have been doing it for their entire careers even when it might have been called something different So what we're going to do to start is the panelists will give some brief opening remarks And then we're going to move into a question-and-answer period It's it's important that we get feedback also from you all so there are folks circulating through the audience That have cards on which you can write questions And then those will come up to us and we will make sure we leave plenty of time for your questions at the end of the session Which will stop at around 415 so I'm going to turn this over first to Karen Wagner for some opening remarks And then we will go down with the other panelists Thank you very much Actually still looking around the audience and picking out old friends, so which is nice Happy to be here and to talk about this topic. I think we're going to have a pretty lively Conversation based on my knowledge of my my co-panelists. I hope that's the case I just want to say a few short things I want to try just to hit the wave tops and provide some hooks because I think it would be better to do more discussion as was mentioned I Head up Intelligence and analysis within DHS. We you know that it's a new department Ina is a relatively new office We're a little younger than the department itself since we've morphed several times since the department was formed probably only been More or less as we are now for the last four or five years Just to let you know what we're all about our primary focus is on information sharing and on information sharing a Two-way flow we provide information to State and local law enforcement to the private sector to other non-title 50 members of the federal government We support the oh there the components of our own department We do do some original analysis, but we don't do a lot of that We try to focus on the homeland nexus and we try to tailor other people stuff augment other people stuff downgrade and declassify and push it out so that it's actionable and Another important mission that I have as the chief intelligence officer of the department as well as being the head of INA is to try to integrate the intelligence efforts of the other Components of the department together. They're a pretty capable and powerful bunch And so a lot of what I say today will be focused on the DHS intelligence enterprise Which is the sum of all of those activities rather than just on INA? But just I want to share our mission statement with you because I think it does define what we're all about and We say that our mission is to equip the homeland security enterprise with the intelligence and information It needs to keep the homeland safe secure and resilient the enterprise is big It comprises all those people that I just mentioned plus an alert and engaged American public And it's about intelligence and information and it's not just about CT because the department's mission is obviously a lot broader than that keeping the nation safe secure and resilient so that's what we're all about I did want to comment on the proposed definition of homeland security in the INSA report that was that was released today Information that upon examination is determined to have value and assisting federal state and local tribal and private sector decision-makers in identifying or mitigating threats residing principally within US borders and I don't I don't necessarily disagree with that definition but the one thing I thought I would point out is that We're concerned about Threats to the homeland that emanate from overseas So and we work those issues closely with our partners at NCTC and CIA and NSA. We're also very concerned about Homegrown and domestic threats to the homeland We work those in very close partnership with our colleagues at the FBI But the one thing that might maybe get lost a little bit in this definition is DHS's unique role at the intersection of overseas and domestic the borders what we call sometimes the transit zone That is sort of the department's bread and butter And it's one of the things that that one of the main things we do for the American public Which is facilitating the free flow of legitimate goods and services while trying to safeguard our virtual and physical Borders and this analogy works pretty well for cyber to actually as well as the physical world What we do is use IC information to help keep out people who would do us harm At the same time as again letting this the free flow of goods and services happen And then we collect a lot of information in the course of those encounters at our physical and virtual borders That we then share in a way that is appropriate with privacy and civil rights and civil liberties with the intelligence community and law enforcement to allow them to To use that for intelligence and law enforcement purposes, so That key border element I think is very central to what the department does and that's the one thing that I think may get lost a little bit in the definition There's a data is central to what the department does. We have a lot of it We we try to analyze it in new and better ways. We share it with our partners. We're working on Getting new sources of data with our partners again the Department of Justice and the FBI Through things like the National Suspicious Activity reporting initiative the secretary see something say something campaign We are also sending reports officers out to the fusion centers to work with them on information that they Have things that they know that they don't have the time necessary to sit down and write a report on to share more Broadly to make sure that that happens And we're also trying to figure out new and better ways to present data Geospatially where that makes sense And in and across the whole range of our mission areas. There's a lot of art to producing Largely unclassified intelligence. I won't go into all of that now because I Anticipate that that will come up in the Q&A session and we'll talk a lot about that But there's also so there's some art forms There are some new forms of tradecraft that I think we need to think through And the other thing is is we are making I think new progress and New sort of breaking new ground in terms of collaboration and coordination in the community Particularly in how we work together with FBI and NCTC to try to prevent present a unified threat message from Washington to the field and Well, I think it's far from perfect at this point We've made a lot of progress and I think that's something that we owe to our customers That is in itself in and of itself in art form on how you do that in a way that That maintains the freshness of the information And and and does that and does the job while protecting again investigations and sources and methods So I'll stop with that and turn it over to Tracy. Okay, good Tracy. Please go ahead. Great. Thank you very much a couple of things As Karen alluded to I am responsible for all intelligence activities in the FBI And the uniqueness of our situation is that we have sort of a bifurcated mission between law enforcement and national security So in order to accomplish both of those missions We have to utilize the intelligence apparatus of the FBI to effectively gather collect and analyze and disseminate information that provides The opportunity for operational counterparts to address the most significant threats facing the country It's not enough for us to collect information or intelligence through the utilization of humid or through the analysis of SIGINT or other sorts of ints It is more important that what we do collect and disseminate is relevant to the customers that we're looking to it affect So the very best analytic product if it doesn't resonate with the workforce that we're charging with mitigating threat is irrelevant So one of our big challenges in the FBI as well as the intel community is to ensure that the information that we discern from Variable sources is actionable and that it resonates with those operational entities either in the FBI or other parts of law enforcement Or the intel community who are responsible for mitigating the threat In order to do that we have about 3,000 analysts that are assigned all over the world The vast majority of them are either here at headquarters or in our 56 field offices across the United States We also have intelligence analysts assigned to some of our legal attaché offices abroad to ensure the free flow of information From our international partners back into the Continental United States I think Karen hit on it when she talked about the definition of Homeland Security intelligence She talked about the difference between threats that emanate overseas and our ability to mitigate those threats before they manifest themselves here in this country In order to do that we have to have the ability to collect the information from disparate sources Analyze it and disseminate it as quickly as possible. I will tell you that the FBI Just like DHS is incapable of doing this alone It is a collaborative effort that involves all members of the USIC as well as our 18,000 state, local and tribal law enforcement partners across the country I will save going through the details of what we do on a day-to-day basis and the definitions of analytic tradecraft For hopefully the Q&A session that goes forward That's as Karen said that's the wave tops of what we do for a living and with that Phil I will turn it over to you Thanks, we sort of got this backwards, which is why we're here today and why we're struggling with this so much When I grew up as an analyst at CIA, let's say you're looking at something like the Iranian nuclear program That's an overseas program Where access is limited the information you're again going to gain is highly classified at a minimum at a secret level and probably at the top secret level The customer is at the national level within the beltway sort of a vertical customer That is going from a place like CIA up to the Oval Office the White House The delivery is going to be sort of a paper product, especially in the most sensitive products that we have And you're going to focus to be blunt on collection first and civil liberties second I'm not that concerned about it and Iranian scientists access to a court in the United States to argue why we didn't have a reason to put a human source next to So we go to the domestic environment obviously that's largely within the United States So as Karen said there has to be a lot of overlap in the age of globalization Classification should start at the unclassified level maybe at the FO you all level and not the reverse the customer is typically outside the beltway It's everybody from Disney security after Mumbai. What just happened? What can you tell me to a police chief to a Homeland Security advisor the delivery is almost by definition not going to be paper And it's also going to be accessible to an adversary. I'd say blackberries. It's gonna say palm pilots, but I think they're kind of toast And you know one of the great values of The purple program that the DNI has is people like me who thought foreign intelligence was like domestic intelligence go to the Bureau and Realize that common word intelligence is really misleading civil liberties come first in collection doesn't So you go to a case like Mumbai and my view would be okay I need a product within 24 hours. It goes to Disney security based on analysis by people like Security expert structural experts saying here's a graphic of what just happened how they breach the walls What happened on the inside why Indian security had such problems? With the people who got into that building, but nothing to do with top-secret information about what we're intercepting from the cell etc The problem is the people who grew up in the first system are the people who helped oversee the second people like me and So as we look forward and I'll close here I think you have to understand the requirement has to be some of the language is the same the requirement has to be Set by the by the customer intelligence is simply information that helps you understand a problem It ain't secrets if you go to New York intelligence is Zagats. Where do I eat? And I'm not kidding So intelligence from Mumbai is for the Las Vegas police chief or for Disney is what just happened in that facility CIA NCTC you can do the cell I want to know what happened to the facility and how I might mitigate the threat to my physical environment that I have to Deal with it ought to be delivered on a blackberry It ought to start out at the unclassified level the analysts might not be a terrorism analyst It might be a structural analyst civil liberties are Primary in other words if we are looking at human activity in the United States the first question is what should we do not what can we do? Again as an intelligent professional. I can't tell you the significance of that difference But we have to sort of think of every category that I grew up with differently And we have to grow people like Karen who start as Homeland Security Professionals I said Homeland Security and say Homeland Intelligence I don't like using intelligence a homeland because intelligence is pursuing information Not starting out with civil liberties Homeland Security professionals have to grow up in an environment as I did with see at CIA that starts with domestic no Classification the customer is outside the Beltway the delivery is not paper the delivery is on a device That's probably accessible by an adversary and the first question to have is what's right to do in this country? That's it. I recommend I recommend the second Avenue deli Except it's on 3rd Avenue It's on 3rd and 33rd, but you like it so much for the Zagats Whenever we in my company whenever we're teaching a course on the intelligence community We discuss the definition of intelligence in the ERPA National intelligence is defined as foreign domestic and homeland Inevitably this happened to be yesterday in scum somebody says I'm sorry What's the difference between domestic and homeland and the answer is yes? Because it's not defined anywhere in the law So I think I want to agree with Karen here that I think the INSA paper Does a tremendous service and at least trying to attempt to define in a practical sense what we mean by homeland intelligence as opposed to? You have the types of intelligence, but this does underlie the basic problem that I think we still have despite having been at this from Us ten years and that is what is it we mean by Homeland Security intelligence and what do you do with it? How do you do it functionally? How do you do it as an analytic tradecraft? I think we do a lot of courses in my company for a mixed audience of first responders and Federal Homeland Security officers of various agencies and they are still to my amazement very separate communities They know each other exists. They don't have they're not carrying around stereotypes of each other anymore They know that each side is a bunch of nice guys and girls, but they still are in many respects Totally separate communities and I find that a little bit disturbing at this point in the story as for info sharing Some of you will remember George Akin who was this Republican senator from Vermont during the 60s and 70s and during the depths of the Vietnam War He said let's declare victory and go home. Well, I think that's what it's time to do with information sharing to clear victory We got it and we got it about as good as we're going to get it But to constantly flog this issue and to suggest that well if we just have a hundred percent perfection No bad things will happen anymore is absolutely ludicrous But that is part of the way the conversation goes and the thing that worries me most about this in terms of analytical Tradecraft is that I think this really begins to breed risk aversion in the analysts It's the analysts that become so concerned that I haven't seen everything That I better not file the report with God forbid I missed that one cable that has the variant spelling of Abdul Mutalib that would have told me everything I needed to know I better keep reading and I thought it was fascinating that in the aftermath of the Detroit underwear bombing attempt The solution was put more more data in the database I thought at a certain point that had become the problem But that seems to be the recurrence solution and that's not the solution I really think we need to declare victory on information sharing and move on to something else It says Karen said I think we've got that what we don't have is the doctrine for Homeland Security What is it really about and it seems very often to be don't let bad things happen That's hardly a compelling analytical doctrine And so we still have to work on what it means to do effective efficient Homeland Security and part of this Goes back to something that Suzanne Spaulding said During the last panel we are not going to manage risk avoidance We're gonna have to do risk management I thought it was wonderful when Jim Clapper was testifying in front of the Senate committee for his confirmation and Senator Feinstein was back on the information sharing and the Detroit thing again And she said so we're not gonna have any more of those, right? And Jim said well, if that's the standard let's just quit now And this is the problem is we keep chasing this nirvana that we can reach this perfect state Which will somehow magically bring us back to the morning of September the 10th 2001 and let me assure you we're not going back there anymore the past is a foreign country So I think we've made some progress in the information sharing We've made progress in hiring a bunch of people who I think have pretty good capabilities Beyond the fact that they can't write very well, which they can't because they spend all their day doing this Which leads to a sort of tanto-esque prose me here where you Eat soon And I see this in my students at Hopkins, which is very appalling, but we still have to figure out the doctrine What does it mean to do? Really good homeland security analysis and how do you then distribute that as Karen said just to the people who need to know it In a timely fashion still understand what they're reading. So we're closer, but we still have some work to do Okay, great very good opening remarks mark. I wish it could have been more provocative, but I try maybe in the Q&A You actually have a great setup for right where I want to go with my first question That is to really get into something that Involves tradecraft and hopefully we can understand what the state of tradecraft is We have had a number of near misses if you want to call them that in the past few years We've had the printer cartridge plot. We've had the Times Square plot the New York subway plot Christmas Day 2009 you teed up at that very nicely There was a lot of after-action assessment and a lot of looking at what happened and that was obviously Mandated by the White House, but I take it that throughout the committee a community Sorry, there was a lot of let's look at this event and what can we learn from it? So I want to ask about what the lessons learned from that were what did we get right? What did we get wrong and what did you know? You all as practitioners learn about the tradecraft because it strikes me that this goes to the definition that you're talking about with homes like Homeland Security Intelligence threat emanating from abroad it comes here. It's now your responsibility So talk about that event and what we have learned or are beginning to learn Okay, well, I'll I'll talk about it from from the department's perspective probably as much as from the intelligence communities and one and let Tracy sort of fill in some of the from the FBI perspective From the department's perspective, which is really an operational perspective and one of some of the interesting things that we learned was how we respond to Ongoing events of this type when you don't know if it's the only one And you know this is a common a common theme when you see you know You've seen al-Qaeda in the past has had a pattern of doing two or three You're simultaneous kinds of activities. You're never quite know whether you've got one or more The department had to do a lot of soul searching there to figure out. What's the best way? operationally to respond to that and we've made it we made a lot of changes in how we How we look to the intelligence community to to support us in an active ongoing operational response one of the Analogies that our deputy secretary likes to use is the is for those of you that are military or formal military The supported supporting paradigm is that in that kind of a of a you know playing Some potentially more planes in the air What how do we make sure that the intelligence community is focused on? DHS as being the supported command and figuring out how to quickly and rapidly feed them anything that they might need to know To manage the ongoing operational scenario, so we've been having those conversations over the last You know year or two on on how do we do that better? How do we implement sort of quick reaction capabilities to make sure that TSA, you know Who's the truly supported command here is getting all of that all of that focus on it and helping it manage the response So I would say from the department's perspective That was the the number one most interesting lesson learned and it was new to me as an intelligence professional operating in that environment and And then there's a follow-up and did you find that it was the support was where you needed it to be or it was not optimal It was I think that Based on how little we knew About this that I think the support was as good as it probably could have been but it was a new mindset For the community to think about well gosh We immediately convened to civets but the people that were actually running the immediate crisis weren't on it necessarily So those are the kinds of things that we've now learned I think to do better And I would say that the connections between the operating elements of the department who need that intelligence focused on them and the rest of The community have gotten steadily stronger, so I think yes Is it safe to say and anybody can answer this and that that event was The first big test in terms of how close it actually came and the fact that the threat was Nearly in it the first big test that we've had since 9-11 of how this entire system functions together or have there been others That have been more or equally instructive No way man. No way. I mean we sat there when I went back to the agency from the White House in January of 2002 Dealing with the threats civets and that was a creaky machine The real test was in nine years and what I took away one of the things I took away from the I'm the battalion event in nine years Nothing significance happened And that and you know sitting at the threat table for nine years with director Muller and director tenant neither of whom is a low-energy dude And you're dealing with I'd say in the matrix. I see all this TV crap. There's probably I don't know 10 15 a day Or it's not 50, but you know you're tested every day So we missed one what I learned and I'll close here is that in these debates that we're hearing and I guess it's some of This is on TV tonight about you know should we start pulling away from the war on terror This country is still so brittle after 10 years of success that one mistake and everybody's gonna say you guys Suck and here's whose head's gonna roll Unbelievable Well, how do you three are three other lessons learned? Yeah, and then I want to ask about how do you manage that X number one? The enemy has a will of his own I'm sorry, but he gets to decide where he engages from time to time and like Phil said you know shit Okay, we'll declare the war on terror is over somebody better tell the other guy Because if he doesn't agree that the war on terror is over you still got a warrant error The second the second lesson learned is they're still fixated with airplanes. They're absolutely they are not that brilliant No, I'm serious. They are absolutely fixated with aircraft, which is a good thing. I mean you don't want to lose an aircraft I spent a lot of time in them. I want them all to land safely But um it helps localize the threat the other other lesson learned from both Detroit and the Times Square event is We have an increasingly vigilant lawful public Public citizens in Times Square are said to the cops We got a problem this car shouldn't be here and it's smoking and on the aircraft They pummeled the you-know-what out of Abdul Maltalib. They didn't lynch him They didn't kill him but they disabled him and that is one of the things that you want to have happen in a war against Terrorists which is a good thing. So I think those are the lessons learned from that a couple of comments I think when getting back to your original question is that what did the Maltalib attack teach us? I think that we all agree that the FBI is incredibly good at hunting what we know So give us a bad guy, right? And we'll use Shazad as an example, right? 52 hours I think is what Commissioner Kelly said right soup to nuts. We know everything about the guy Mm-hmm. What reinforces though is that we need to get better at getting ahead of the threat Whether it is through our liaison with foreign intelligence services or whether it is here in the domestic United States Our ability to get ahead of those threats through the utilization of tripwires That gives us the indication that we have problems emerging and you contrast the issue in New York The Shazad case with the recent to issue down Lubbock, Texas That isn't that's an instance where tripwires work where we are able to get ahead of the threat It doesn't get near the media that Shazad gets for obvious reasons But to me there are literally hundreds of those success stories that never meet the never meet the media threshold And I think that is probably the most indicative sign of the progress that the US government has made Since 9-11 and I think Phil hit the nail right on the head You know I spent every morning with the director of the FBI and you're right definitely not a low-energy guy And still a prosecutor He will drill into the issue like nobody you know But I will tell you right now that every morning the volume of threat information that we look at every day And the fact that this stuff doesn't hit the radar screen is a testament to the collaborative effort of the USIC and getting ahead of those threats It's about retraining our 800,000 state and local and tribal law enforcement officers to think proactively How do we get ahead of the threat not what do we do once it happens? And I think that they all have gotten this message from the federal level down to the tribal level everybody understands that and everybody is engaged in what I like to call as law enforcement ent So how do we train our state local tribal law enforcement officers to be intelligence collectors? Because at the end of the day that is the tip of the spear the guy that is on patrol that afternoon Who knows that he needs to look for signs that are indicative of something bad going to happen and takes proactive action to keep that from reaching fruition and I think that that reinforces what it is that the transformation that the government has made since 9-11 Mark, let me ask you then you train people for a living this is what you do. You're an educator So how do you train me? I mean we've heard lots of people say this is the you know has to be down to the frontline levels Do they get it yet? I mean has that mission as that who's the day people at the frontline levels? I mean the local law enforcement understand truly where they fit in this entire enterprise not entirely in my experience not entirely because there's still a disjuncture between them and the FBI and DHS and the other entities not not because anybody's not doing Their job, but they're two different cultures and they speak variants of the same language It's like you know British English and American English You know the second floor and the first floor ain't the same thing in both places And so that's part of it and part of it also is that um like we have not been successfully attacked in Ten years. This is a good thing as Phil said it's very hard for the state and locals to keep a lot of people doing terrorism When there's nothing happening, they want to go back and do crimes They want to keep the crime level down and so they get pulled away And they rotate people in and out and so don't have a cadre the way Karen has a cadre and the way Tracy has a Cadre because that's not how their system works now up in New York. You can get away with this I want to disagree because Dave Cohen has enough people where I just noticed too many people going in and out in and out We're having too many other Distractions for wholly legitimate reasons because of what they do for a living if you're if you're on these, you know State or local, please you got other things you got to give another perspective. Yes, please and now for a different point of view So Well, I think that we have I'm not sure that's completely true I think maybe that was true and I would certainly welcome Tracy's view on this But I think that we have made that's one area where we have made significant progress in the last few years is Working very closely with state and local law enforcement, particularly through the fusion centers at this in the states and the major urban areas to make to clarify sort of their role as part of the extended Homeland Security Enterprise and to To it to empower them to we look upon them as being part of our network And we want them to create their own network within their states and they're in the urban areas through Programs like the terrorism liaison officer program, which is which is something that is is being used more widely So that they bring in people train them and then send them back out to the local Sheriff's office and the local police department and so that we've got we've done a lot of training We've done a lot of outreach. We have conferences. We jointly DHS and FBI and NCTC spent a lot of time and I honestly believe that if we were to go out and ask them Right now if they felt like they understood their role I think that we would they would mostly say yes, you're not gonna get a hundred percent certainty because we've got a lot of different You know levels of maturity and personalities and everything else But I think we've I really think that that's enough. No, I don't disagree I'm not saying this that there has been absolutely no progress But I think the state and locals are finding it harder and harder to stay on this in the absence of an event Or for example when they when so many states are consumed by natural disasters, and it's sometimes the same people I mean state police forces local people ain't that big? So a lot of these people get get pulled in many directions. They're gonna defer tip O'Neill was right Well politics is local at the end of the day and so a lot of these people just find it hard to hold on to this other mission Which is of concern, but not as compelling as something that's actually happening in your locality So let me just One of the things that you'd said sort of maybe kind of chuckle a little bit about the cadre of resources that the FBI has at its disposal First let's put this in the perspective We have 56 field offices if I am in Biloxi, Mississippi the cadre that you speak of is tiny So without the relationship that we have with our state and local partners those are part of that cadre There is we don't make a distinction. We've got 102 joint terrorism task forces across this country That are comprised mostly of state and local law enforcement officers who have been Segunded to the FBI to address this mission We also have the same relationship with the state fusion centers and with our field intelligence groups where we leverage the local and Municipal police officers and their sworn and non sworn members to make sure that we get that message out So if I am in a resident agency in a small town where I have three FBI agents If I don't have the relationship with my state and local partners I there is no way that I can keep touch with the threats that emanate there So what what makes this work is that it's not? counterterrorism-centric The FBI's mission crosses both criminal and national security and one of the challenges that we have is this cross-programmatic Look at threat. So if a threat So I'll give you a quick example if if the Sena Loa drug cartel is moving Narcotics up into middle America and they're using Somali street gangs to disseminate those drugs for them It's not much of a stretch to talk about what's about the rest of the Somali population in that a or area of Responsibility and what sort of penetration do we have that community to determine whether or not there's a threat? Because you're right everything is local and guess who has the best contact there So it's that collaboration between state local and federal that allows us that visibility into a threat community to determine whether it actually exists or not and I think that the fact that there hasn't been a Significant issue since 9-11 is not a fluke it is through that collaboration and through the training and the partnership that we have Across the country that has allowed us to at least keep that day the threat that faces us I'm not saying that it's perfect, and I think Phil you hit it earlier There have been near misses there have been issues Abroad against you as interests, but at the end of the day I will stack the partnerships that we have up today Against anything we had having worked these issues before 9-11 It's it is a night and day difference out there The relationships that exist today versus the relationships that existed pre 9-11 Understanding that the FBI has you know been involved in state and local law enforcement since we began in 1909 But the relationship has morphed post 9-11, and I think that it has made us a better organization And it has made the community safer Well, I want to ask a question to fill in to follow on this Let's say I'm a local police officer in Topeka, Kansas And I see something suspicious that I think might be caught the related to terrorism Am I calling you at the FBI first or am I calling Karen at the DHS first? I mean on a practical level where is the interface? Where does that data get gathered up at that very granular level? And how does it move and then eventually get to the people who need to act on it? It doesn't matter who they call first my judgment is you're that's an investigative issue And I would call jgtf you're you're seeing you're seeing you're not just seeing suspicious activity To me you're seeing something a step above that and the jgtf has a classic responsibility to deal with it They also have state local representatives so you can get a what tracer was talking about the interface I would argue at that that you're making this a little too black and white if I'm sitting at the table One of the questions you're asking is what kind of activity do we see and do we have to pull out? I put out a bulletin to other state locals. That's going to be a joint DHS FBI Maybe even nctc bulletin that says here's what we're seeing. You know we're seeing alterations and gas canisters So to me, you know You have an investigative responsibility that has to mitigate threat the first question you have is Security of people so I want to mitigate that threat immediately I want to get somebody on that and figure out if we're going to take this guy off the street But I also have responsibilities in terms of fusing Do we see this kind of threat elsewhere in terms of informing? So I I'm not sure I see the world that black and white Okay, let me bring it Up a bit with a question from the audience Someone points out that a lot of this discussion has been about operations and reaction about tactical issues This person wants to know what is this type of work that we're talking about done to affect strategic and national intelligence? analytic tradecraft capabilities Does anybody want to take you know, it's a broad question obviously, but let me take a quick shot go ahead When we're sitting at the threat table In about I'm going to go back to shoot. I don't remember maybe 06 or 07 or so We knew we had a fundraising problem for Shabab in this country It's a pretty interesting investigative work. I thought it was actually brilliant the question that came up Over time was your responsibilities to to ensure that you're preventive The quality of your investigation of Somali fundraising for Shabab in this country is nice The real question is as Tracy would say why didn't you know that there was also some recruitment that led to kids Now several dozen who went to Mogadishu So, you know, I think one of the real changes have been expectations And some of them are subtle because people will say at the same time Well, make sure you don't spy on us, but make sure nothing bad ever happens That's pretty cool Um, it's I would I would go to that example is one of the classics that explains or that that really Characterizes some of how expectations and changes have happened. Why didn't you know? Can I add to that one of the things that I think is different That that we do that I that I find is is sort of spreading a little bit is that as as Tracy said The point of the stuff that we put out is it has to be actionable. It has to be useful It has to help law enforcement or the private sector plan on where they're going to allocate their resources what kind of Countermeasures they're going to pay for or employ There has to be a so what to it. So every product that we put out does that But that's not necessarily the norm for the rest of the intelligence community's analytic products But as we team more with Particularly with nctc, but we've even done a joint seal product with the cia, which i'm pretty proud of only one But it was cool But it was uh, we we blended those two things of of okay What what's the threat here and now what are we telling people that we can or should do about it? It was a new thought process and I think people are starting The point filmmakers is very valid people are starting to take it to that next level of the so what And and dig and it's not just why didn't you know? But why don't you dig a little deeper and maybe ask some of the other people? Like the fusion centers or the folks that are out even in the communities about is there more to this? And one of the we're actually learning some interesting Techniques from the production that's coming out of the fusion centers themselves Some of which are producing some really interesting Products that are combining national information and local information with a strong nexus to you know Why why should my local law enforcement care? What should I do about this? So I think that is Shane from a from a little bit of a higher level if we have 56 field offices if the the country decides a qap is a significant threat to the homeland So If an office wants to tell me we don't have that threat The first question going back to what you said is well, how do you know that? How do we establish the methodology? From a national perspective that allows our mitigation centers our 56 field offices are 72 fusion centers to say I know definitively. I don't have this threat So what we've done is you know historically we've been very reactive in nature So now what we want to do is we'll look at the demographics look at your critical infrastructure Look at your the issues that you have in your area of responsibility and then come back and tell me This is why I know I don't have this This is why I know this is not a threat or I this is a threat But I am unfamiliar with it and now I need to take action that then informs the national picture About what the posture is of this country to collect against a specific threat It's one thing to say you have an aqap threat The the bigger question is that's great. Now. How are you going to collect against it? Where are your population centers? Where are your specific targets of interest? If we have airplane threats for lack of a better term What what are the areas that we need to look at which agency is best posture to collect against that? Collectively and then bringing that back in for a national collection strategy that tells us You know we send this out and it tells us from our 56 nodes That we have these pockets of the population So if you've got 6200 Yemenis in your in your little town the next question is what do you know about them? Are we utilizing madrasas for radicalization? Do we have nodes of radicalization there? Do we have any penetration of that community that gives us the visibility inside of that threat to either say yes or no? As opposed to yes, we have it if you remember early after 9 11 the utilization of huwala's There was a misconception if you were utilizing a huwala, you were a terrorist. It's ridiculous So educating the workforce about the relevance of issues and then providing that posture that allows us visibility into that threat So that we can position our resources To the most effective manner. I think that's one of the things that it's taught us Collectively, so you both have described a way that sort of the system optimally performs Now I want to ask people who are outside the system. Is it working that way? I mean, is it working that well where all of these fusion centers and the field offices and the task forces Are completely collaborating and we see the threats in a way that you're describing Nothing works optimally Well, how close are we then? No, I mean I think I think Karen and Tracy me said in my early remarks I agree with them that we have made a lot of progress We really have but I still when I'm seeing this at the teaching level I still see two distinct communities that are still having trouble Totally comprehending each other for reasons that I think are totally understandable So I think we you know, it works pretty well a lot of the time and the fact that we have not been attacked And there have been a lot more near misses than most people know about Some of which have been hinted at in the newspaper is a sign of success And the the number of attacks that get disrupted is a sign of success The operations that have exceeded overseas are a sign of success I think it's premature to declare a new strategic victory like the secretary defense did But clearly we have done a lot of damage to the original inspiring group That hurt us But I mean, I but one of the things that we learned is that these people morphs You have to morph with them So the real question is are we morphing at the same rate that they're morphing? Are we back where Tracy said? And are we reacting and I think it's probably a little bit of both But I think we have some reason to to take some pride in what we've done Knowing it's always an imperfect system and we can never assure the American public Never gonna happen again, right? Right? No, I mean, I I think that mark spot on and here's the issue that you have and to address whether we're We're treading water or we're moving forward I'm one of the challenges in transforming the FBI for example To being this intelligence led threat focused organization is that in times of crisis human nature is that you will always revert back to where you're the most comfortable And where are you the most comfortable is what you came up with if you are a reactive law enforcement type That's where you're the most comfortable So our challenge is to continue to set the bar higher and higher and make sure that we push every day We like to say that every day is a vest day Because if you seed any ground at all it's it's you never gain that back So every day you have to fight To solidify the gains that you've made in transforming the organization and to integrating the community Are there frictions? Well, of course there are Is it optimally positioned? Probably not But I will tell you right now that the relationship is better than it has ever been And it wasn't too terribly long ago where Phil's a former home and mine didn't really see eye to eye And I will tell you that bringing phil into the bureau Really great step on your part. Yeah, it was a good time too. I gotta tell you you said it best It's about risk management. It's not about risk avoidant And in order to manage risk you have to assume some And the problem is is government as a whole is relatively risk adverse. That's being kind I'm in pushing the edge of that envelope every day is what makes us successful And it is a very uncomfortable position for people to be in But it is critically important that we push that a little further every day Because the people that are depending on us don't want to hear about risk avoidance They want to go to bed and they want to wake up in the same world They went to bed in last night without any horrible things happening. And that's our job So I think that we're way way further than we have ever been We still have a ways to go, but I would say we're definitely making progress Let me switch gears a bit and talk another tradecraft question We're getting a number of questions that have to do with Technology some are touching on the civil liberties issues. I want to talk about a potentially valuable source of information That is social media. This is obviously something that you all as analysts are having to grapple with talking about morphing Right, so we know that in many of the cases of homegrown extremism and foreign plots as well Some of these perpetrators have posted on facebook hints about what they were about to do There is sort of a signal trail that maybe we pick up later I mean obviously law enforcement and intelligence agencies have various authorities that they can use To monitor social media to try and learn from it Talk to me about the role that that is playing in this whole mix Because it seems to me that that is sort of if you're talking about modes of communication The threat is migrating in that direction. You're you're shaking your head Yeah, this is a this is a problem because the american people think that security services are pervasive In my experience as an intelligence officer the gap between what a security service can do In terms of collection whether it's facebook or whatever and that relates to gang gangs are up on facebook And the and what they actually do is growing I could look algorithmically at activity around the world who's accessing websites I want to uh rotating every three month list of the most active websites I want people who are on at least three of them at least nine times a month I want to see if those people have ever bought a ticket to pakistan I want to see if they're between the age of 16 and 40 by the way None of those criteria, which are pretty sound criteria represents illegal activity That's so I I think as general Hayden made a great point at lunch When you walk out of this building When somebody says I want to look at your bag, you're gonna say I'm not going to use what he wanted to say You're going to say a heck no If you you know, I'll be in an airport monday, and I'm going to say, you know, what do you want to see? On this highway, I suspect a lot of people are saying well, heck, why aren't you looking at websites? I assume you're looking at websites seeing who's talking about jihad. Well, heck a lot of people are that's a free speech issue But if you're involved in procuring explosives for a group Then I can look at people we haven't defined what lanes we can look at those lanes of data getting bigger and bigger And I think at some point there's going to be have have to be a national dialogue as there is on physical security You go to an airport. You're going to take your damn shoes off There's that that dialogue is not there and we are not even close to exploiting what we could I'm not saying we should I'm saying I think people probably Radically misunderstand where we are in terms of thinking that we're farther ahead than we actually are Not farther ahead, but but more aggressive and more pervasive as you said Yeah, and that the and that the reaction of people on the inside isn't I mean I found it very cautious as it should have been Karen and Tracy address where this you know this you know Social end to whatever you want to call it fits into that to the whole mix Well, I mean they're differing as you pointed out levels of authorities and ours are quite different and more limited than the bureaus and we have the authority to do sort of overt collection of open source Which is near not pretending to be somebody else and not going into you know password protected sites But fill fill raises a good point is that it's very difficult sometimes to connect what you see on those sites with actual intent Or anything that anybody's actually going to do we've had an interesting time even figuring out for example You know the inspire magazine that's put out by a qap people want to know well, how is that resonating well? This community has resin has had a hard time trying to figure out how that's resonating We don't know how to measure that and we don't know what it means if someone you know hits like on facebook Then I liked it well does it resonate or you know, I there's still a lot of art I think that needs to be a figured out here. We also Frankly haven't figured out well how to source things when we're doing all source analysis that we find Out in the you know what how do we know when something is is Is citable as a source we don't have a lot of of tradecraft or doctrine someone use that word There either so I think this is a it's a growth area, but there's a lot of pitfalls here And what we try to do is is focus the work that we do In the open source realm on on specific requirements that are tied to our to our analytic In production authorities and go look and then we report on what we find as hir's and that becomes sort of grist for the mill But I think the fbi obviously does a lot of more interesting and fun things The main thing before you get that is our dhs It's going to be clear our dhs analysts reluctant to rely on social media as sources I think that the The tradecraft Sort of rules of the road there are not particularly clear So we are I wouldn't say that we're reluctant because we use that we use it quite a bit But we're careful in qualifying what kind of conclusions we draw from what we see and It's just it's what I would say is a growth area when you're on twitter. So that's a step, right? Okay, not me personally. No So go ahead. Yeah. Yep. So here's the issue The fbi is responsible for the protection of the civil liberties of the american people Um and just what I what I want to say about utilizing social networking is this Is that if the fbi Loses the trust of the american people. We are incapable of doing our job So with that as the premise we are very very careful about the way that we exploit social media and whether or not And our in and whether or not the person is a us person or a legal permanent resident Those sorts of issues all come into play and when we look at obtaining court orders that allow us to do this We are not Surfing at will. Um, it's probably a really bad practice. I would suspect And our ability to penetrate social networks has to be predicated by something We have to have The underlying premise that allows us to move forward We can't just decide that we're going to now monitor all social networks in the country First of all would be physically impossible And secondly, I don't think it would be a good return on investment So you can't have an analyst sitting in an counterterrorism center Set up a twitter account and just sit there and watch what people are saying No, we have safeguards in place to make sure that we We follow the letters of the law and we follow doj policy to make sure That the rights of the american people are protected. I mean it's important to do that. Um, I would rather Um protect the civil liberties of the population Than to abuse the trust that has been given to us Because once you do that you can never get it back. Um, you can say you're sorry, but that's not going to cut it I mean, we're very very very careful in that respect and I think appropriately so It's it's it's a delicate issue With the fbi and with law enforcement, not just fbi. I mean if we're looking at nypd These are huge issues that have far-reaching consequences that sort of take precedent over the issue of the day The issue will come and go But if you lose the trust you'll never get that back and we will and I think mark you hit it earlier about saying we have a Well-informed and cooperative public if we lose that We will not be successful. Well, martin you talked earlier about students in your class and on Obviously texting and using community through social media. I mean so talk about its value Obviously as an intelligence source, but also I mean this isn't just the future. This is now I mean they're not going to relink this whole century is such a disappointment. Um I mean it I don't think we know yet How to successfully use it As an intelligence indicator for one thing. It's too large. It's too amorphous And so even if you would even if you were watching social media overseas Which you could do in the foreign intelligence community, you know if you wanted to watch what's going on in kairou or in tunis Even in a place like that where it's not california It's not the united states it is so large and so amorphous that I'm working with a colleague of mine on creating a model for how to do this And we're really at the beginning of the story here because it is a very amorphous kind of target And you'd have to do an awful lot of filtering For example, you'd have to do traces. All right, this guy has how many followers This guy just a lone nut who's did he you know tweeting away and nobody's listening to him Is this guy got 40,000 people listening to him? So I mean I think we have some of the basic understanding of it We don't really have our hands around it, but it is obviously going to have it's going to be Something we're going to have to use more and more of overseas will be fine. We'll know how to do it Although you'll get into this interesting conversation. Who should do it? Should this be People overseas should this be done by somebody here in the united states watching it should be an open source Is it a different source? And once you're in the united states though, you're in the land that tracy and villan's driving different set of rules So I just don't think we have it's not that it hasn't been with us that long. Let's be serious I mean how twitter is how old is it 10 years old? I don't think so. No couple years Okay, so I mean so the fact that we're still catching up to the technology isn't that surprising Um and understanding its value and how to mine it. I mean there are people working on it Like I said, I'm working somebody will tweet the exact date as we're yes, they will and I won't get it since I don't I'll get it and I'll let me know Yes, call me was I don't text either all right Someone it raises a very good question I want to use this to then lead into another question to stir up some debate here I'm this person remarks. I'm the commission of a terrorist act is a crime Do we still have a cultural parentheses or legal issue for law enforcement that counterterrorism is Anticipating a crime that has not yet been committed and along those lines I want to ask about what I know is one of your favorite metaphor for describing what it is that you do Which is connecting the dots Um, it's a useful metaphor. I've certainly made great use of it Um, but I want to know keeping in mind this audience members questions Which I think is a good one and it gets to this issue of prevention and preemption versus investigating Why doesn't connect the dots describe what it is that you all do And if it doesn't then what is it that you do and what is the metaphor we should be using to describe it You know, I connected the dots when I was four years old. Thank you the defense press Not well What was your error rate when you were six? What is twitter? He used to sit next to us at those five o'clock meetings. Yeah, but um, you know I don't want to be facetious. We're not stupid sitting around the table. We're not stupid So give an example that links your two questions together Um going back to the Somali example Um, so we see fundraising You know, I suppose somebody said well, look dummy You know, there's somebody who just traveled to Mogadishu. You should have known his travel records. I mean, well, you know There's thousands of investigations underway every day I you know, let me let me open the door a little what I should have said at the table And I this is one of the things I flogged myself about aside from going over to the bureau in the first place, but um But should have sat there and said, you know, maybe we have to start thinking about among all the subjects we have Getting into Whether, you know Linking up the foreign question you have African troops coming into a domestic environment Somali U. S policy is backing African troops and first generation kids in Minneapolis are reacting to that should have thought of that That's not just that's that's That's not a A Simple proposition. It's not a linear progression. That's right. That's not and then the question would have been among all the cases We have for example, since we already have access to it Maybe I should start talking or looking at issues like has any of this person Any of these people been using travel agencies in these areas and are any of the tickets from those travel agencies one way cash tickets And is that concentrating? Maybe I should geospatially array the purchase of those tickets Is that concentrating in any particular areas of the city? Do we have access to a community leader who might say? Yeah, by the way, when people talk about you bob, that's the kind of If that's connecting the dots then I was pretty damn smart at four years old And you were All right, too many people in this room have heard me rant about this, but I'll do it really fast Um, it's not the way our intelligence comes When you connect the dots you get only the dots you need you don't get extra dots You're not missing dots. Well my the world that I lived in the world these guys live in Doesn't look like that and the dots are numbered sequentially. Well, isn't that convenient? I Somehow the incoming that I used to see every day that phil tracy carons. Don't work that way somebody twittered the conclusion and there you go My the two mosaics that I like best for what we do in analysis one is we're in the pearls business We slowly accrete data over time day after day Month after month year after year and we build a pearl I mean think about the soviet pearl as jim claver one said this is the mother of all pearls I mean this was a 50 year pearl this is a dom pearl was a 20 year pearl And we still got stuff wrong in both cases Or we we make mosaics you come into the office in the morning They give you a tray full of colored glass different sizes different shapes different colors And they say make a coherent pattern now make a picture Make a coherent pattern at the end of the day you have to give them the glass back because it's classified colored glass You can't take it home And you come in the next morning and they give you the tray back and they say We changed 30% of the pieces last night have a nice day That's basically the metaphor, but it ain't connecting the dots All right, so let me get back to the original question That was the original because I cannot do justice to what these two guys are talking about So let's talk about the anticipation of a terrorist act and how it affects law enforcement real quickly So that is a huge problem because you need a statutory violation in order to put somebody in handcuffs You can't do it because you think he's going to be a bad guy You have to build a case with him now This is the big challenge for us is law enforcement and intelligence collection at the same time And this is something that is really hard to get a handle on because you can't just unilaterally decide I'm going to pursue a criminal case because this is what I do. I put bad guys in jail That no longer works The challenge is how do you build a case at the same time that you're using that same platform for a collection of intelligence Because it may never reach the level But the question is where is that intelligence collection going to lead you and it may not be the guy that you originally thought was a bad guy He may be a third tier facilitator But that collection platform that you've established leads you to other Individuals engaged in nefarious activity that you can build a case on So the key is if it's not there, it's not because it's not there Maybe you don't see it and do you need to develop the tools necessary to do that? Not every case is going to end in prosecution The first challenge for us is how do we collect the intelligence so that we can mitigate threat If it means we break up this issue before it becomes a criminal violation, that's great. There's nothing wrong with that It's not it's about changing mindset. It's not about Quantitative statistics, how many arrests did we have? How many indictments did we have? How many convictions did we have? The real thing is how does this impact the lives of the people that we're supposed to protect And in order to do that, it's sort of a fuzzy science So you have to be able to train your employees to say you need to be looking at the criminal violations But at the same time you need to be looking at collection opportunities And this is where fusion centers joint terrorism task forces field intelligence groups Working with their state and local partners sort of change that mentality so that they understand that it's not just about that One of the challenges when I used to run task forces was You know, you'd get the beat sergeant that would say, what have you done for me today? And it takes a long time to build these cases. So really weaning them from that That you know, I need to see what you've done today because today you may not have shown any progress It's that pearl analogy like that. Yeah, okay So that's kind of what we're talking about here and our challenge for us on the law enforcement and intelligence side Is how do we marry those two up and not miss something and it's it's it's a tough nut Okay, we uh, uh, we'll only have just a few minutes left because i'm the d and i's here. So we're going to See the platform to him, but I want to very briefly ask for each of you a closing question I want you to tell me what you think is one of the great strengths It doesn't have to be the greatest or the worst But one of the great strengths and also the great weaknesses Among what i'm going to broadly call our homeland security intelligence core The analysts who are out there doing this and i'll let you go last Because you speak for them most directly But if you could just very very briefly give me you think is one of the great strengths and the greatest weaknesses among that group now We're hiring really good people Who are very eager they're very dedicated But they have no experience. So the strength is a weakness. These are really wonderful people I used to be the graduating speaker each class of ci analysts. They were fabulous But the numbers have worked in such a strange way That we probably have the least experienced analytical cadre that we've had since 1947 not because they're bad people But because the the numbers of new people are so much larger than the cadre of veteran people that There's a disproportion of experience inexperience that isn't in our favor right now So that that's sort of a strength and a weakness combined I think Okay Yeah, what he said the talent I saw at the bureau and at At the agency and when I was reading into dhs and at nctc. This is these 24 year olds. They're really good I'd I'd just experience a bit there. They lack experience. They also lack training the last thing I'd say is I shouldn't say in this audience, but uh my experience with uh first line and mid-level management is that they are not that strong Moving people up too fast. So when you have a new untrained workforce, they're learning from people who Um, I thought were mixed at best And will that just I mean is that improve over I think we should fire them all All right I tried with Tracy So integration of intelligence and operations I will tell you right now That's our greatest strength and it's our greatest weakness because it's our biggest challenge Is making intelligence relevant to the people that we're asking to mitigate that the fact that we have made that transition as far as we have It speaks volumes about the caliber of people that we have both on the op side and on the intel side Figuring out how it is that they mesh and how it is that they add value and relevance That is still our biggest challenge, but it's also I think our biggest success Um, I agree with with mark that the dedication to the mission. I think is the biggest strength We we have people who are just unbelievably motivated and and find the the mission challenging and energizing I also agree with what pretty much everybody else said about the weaknesses is the Mid-level management not probably all it needs to be and the bigger The bigger Challenge associated with that is that the mid-level and even the upper level management grew up in Either a cia traditional analytic culture Or a defense analytic culture and there's nothing wrong with either of those But they're We're trying to kind of come up with a new thing here and it's merging law enforcement and intelligence It's it's operating at the intersection of classification and unclassified and unclassified. It's national. It's local It's a new thing and we don't we don't yet have the doctrine. We don't have all the tradecraft We do we have a lot of enthusiasm We sometimes have people who either don't get it or don't want to get it because it's not the way they grew up So that's a basically a leadership challenge and also a challenge for all of us to put our thinking caps on on How do we grow this new? You know, homeland security intelligence, whatever it is Okay, that's all the time we have. Please thank the panelists with me for an excellent discussion And I guess you'll stay in your seats. We're going to move off and the d and i will join us momentarily