Saturday, November 2, 2019

Finding terrorist needles in the Internet haystack - Nadav Shragai


by Nadav Shragai

Former head of the Shin Bet security agency's cyber department Arik Barbing discusses how the organization had to re-invent itself to get ahead of lone, unaffiliated terrorists and shares insights on metal detectors on the Temple Mount and the "security vacuum" that exists north of the security barrier in Jerusalem.


Finding terrorist needles in the Internet haystack
Arik Barbing in the Old City of Jerusalem: "If there were metal detectors on the Temple Mount, there would be fewer terrorist attacks" | Photo: Oren Ben Hakoon

Arik Barbing is still hurting from the murderous terrorist attack that an Islamic Jihad cell carried out on the Worshippers Way in November 2002. Twelve Israelis were murdered in the narrow alleyway that leads from Kiryat Arba to the Cave of the Patriarchs: Nahal soldiers, Border Police, members of the Kiryat Arba security team, and even Barbing's good friend, then-commander of the regional battalion, Col. Dror Feinberg. The fact that the three perpetrators of the attack, all members of the Palestinian Islamic Jihad, were eventually killed, is small comfort.

Barbing, who at the time was in charge of field coordinators for the Shin Bet security agency for the southern part of the West Bank, says, "Not to mince words: in the Shin Bet we call it a 'sh*tty terrorist attack.' It was a cell we missed."

At the same time, Barbing recalls the hundreds of operations and thwarted attacks he was involved in, especially the eradication and arrest of leaders of Hamas in Hebron who were behind a long series of bombings in Jerusalem, Netanya, and Haifa that killed dozens of Israelis. The jewel in the crown of the operation was the killing of a senior Hamas figure in Hebron at the time: Abdullah Kawasme, who was responsible for the deaths of 30 Israelis and hundreds more wounded in shootings and suicide bombings.

"Taking out the Hebron leadership prevented a lot more casualties," he says. "Just like the arrest of Hamas official Ibrahim Hamad in Ramallah, who was responsible for the deaths of about 80 Israelis [including those killed in the bombings at the Moment and Hillel cafes in Jerusalem]. Hamad is still in prison in Israel," he says.

Finding the ugly duckling 

Barbing served in the Shin Bet for 27 years and made it to the top ranks of the organization. Prior to resigning last January, he served as head of the cyber division and later as head of the Jerusalem and Judea Samaria district. He was there from the end of the First Intifada, followed "the development of Hamas' murderous armed wing in Judea and Samaria"; the period of the Oslo Accords and the IDF's departure from the West Bank; and led many operations in those years throughout Judea, Ramallah, Bethlehem, and Hebron. He also remembers Israel returning to the area in Operation Defensive Shield in 2002.

Now, in his first interview, Barbing lays out his insights, discoveries, information, and memories of terrorism and the war against it. He focuses on the latest iteration of terrorism, which might not be over – the attacks carried out by unaffiliated individuals. He says that handling that form of terrorism "requires the Shin Bet to reinvent itself in an area that was 'unknown territory' – the Internet and social media; to create warnings, deterrence, and defeat this kind of terrorism, too."

"Young and underage terrorists, who are not affiliated with any [terrorist] organizations, have forced us to change our traditional methods, which were fitted to fighting organized terrorism, as well as adopt new working methods and collect intelligence about individuals," he says.
"There is political despair, a lack of faith in the PA, which is seen as corrupt, infected with fanaticism and as an entity that does not benefit the Palestinian public"
Barbing says there are many and varied inspirations for lone wolf terrorism. "Often, the attackers take action because of personal and financial distress, while social media has increased the strength of inspiration [for attacks] and become a platform where the spark kindles and spreads quickly."

Q: Personal distress? 

"Indeed. About 60% of the unaffiliated individuals who carried out attacks in 2014-2017 were primarily motivated by personal problems, and with women, it was close to 90%."

Q: What motivates an 18-year-old to commit a terrorist attack? 

"Sometimes they're the ugly duckling or the black sheep of their family. Sometimes it's disappointed love, sometimes it's young people who are sick of their lives for various reasons. With women, the reason is often the parents' refusal to allow their daughter to marry, or a woman or girl who dishonored her family. For them, the terrorist attack becomes a way to improve their status in Palestinian society and secure social, and especially national, recognition. A young man or woman with troubles like these says, 'Well, my life isn't worth much, anyway.' Then rather than slitting their wrists, they prefer to die by sacrificing their lives to Islam and their people, bringing honor to their families and the surrounding that currently reject them."

According to Barbing, this also explains the recent sharp decline in the number of regular suicides in the Palestinian Authority. "Committing suicide the standard way is less respectable, so they commit suicide in a national-religious context. Often, we make a point of publicizing these motives to gnaw away at the aspect of heroism."

Q: But an ethno-religious attack can't be motivated by only personal reasons - there has to be a catalyst. 

"The way Palestinians see it, the catalysts are many and varied. Both the attackers with personal problems and those without draw a lot of inspiration from events on the Temple Mount, among others. Al-Aqsa is a Muslim symbol, and everything that happens there has a major role in shaping the Palestinian identity. The residents of east Jerusalem see themselves as the defenders of Al-Aqsa, which only strengthens the potential for things to light up. We can also add the total lack of faith in the Israeli government's intentions in generation and its activity on the Temple Mount, in particular."

'All of a sudden, he shaved his beard' 

Barbing observes that another trigger for terrorist attacks are Israel's operations in the Gaza Strip, which he says "evoke Palestinian identification [with the Gazans] and high emotional involvement."

"Of course, in the background there is the Palestinians' perception of themselves as a people under occupation, a sense of desperation, and a lack of hope, as well as economic difficulty. There are quotas on work in Israel and a high level of unemployment – over 50% among youth – and low salaries, under 4,000 shekels ($1,100) a month, on average. There is also the political despair, a lack of faith in the PA, which is seen as corrupt, infected with fanaticism and as an entity that does not benefit the public."

Q: How does the Internet help you locate potential lone attackers? 

"The young generation of Palestinians are hooked up to all the digital platforms. It's almost the only way they communicate, and it strengthens bonds of friendship, romance, study, and also unfortunately the planning of terrorist attacks and sometimes even declarations to carry one out. A few even publish 'wills' before setting out for the attack. In other words, the potential attackers leave 'digital signatures' online that characterize them: Likes on sites that support or glorify terrorism; repeated visits to sites of shahids [martyrs] or sites that are heavy on incitement; changes to or intensification in how they express themselves. Even online information about someone who was pious and suddenly shaves his beard is a signal of something that must be checked out in a hurry.

"At one end of this computerized system, there is always an analyst whose job it is to assess how dangerous that same youth is and recommend whether or not he be arrested, called in for questioning, or whether his parents should be called. Everything is examined in accordance with consultations and legal authorization."

Q: What is more complicated? Cracking organized terrorist infrastructure, or terrorism by individuals? 

"Sometimes it's relatively easy to crack terrorist infrastructure and bust it. We have spent many years studying and getting to know Gaza and Judea and Samaria. We have almost intimate knowledge of the clans, the customs, the organizational structure, etc. On the other hand, terrorism by individuals doesn't bring us to a single address, and usually there is not a database on the individual. Back in 2014 we realized that we wouldn't find an answer to the problem in our traditional databases, and we would need to develop new models that would provide alerts based on intelligence from new axes of information. Rather than looking for a model of the enemy's activity, we transitioned to identifying signs that indicate a change in behavior."

Q: What does that require you to do? 

"We need to gather posts, likes, responses, emojis, voice recordings, and technical symbols of places and times, rises and falls in the extent of [online] activity, new contacts, people joining suspect online communities. We comb the Internet and identify aberrant activity. That's how we identify alarms in a sea of information that traditional intelligence does not supply on individual attackers. Today, we already have Internet files and well-ordered databases."

Q: How many attacks do you think have been prevented as a result of your investment in online intelligence? 

"In the past three years – hundreds. With most of them, 50% of the initial intelligence came from the Internet and the rest from other intelligence sources the Shin Bet still has. It means handling an immense quantity of information. We've acquired the technological and professional skills to separate the wheat from the chaff and find needles in haystacks. From October to December 2015 we saw about 100 terrorist attacks committed by individuals, about one a day. Today, the phenomenon has been largely eradicated."
"The young generation of Palestinians are hooked up to all the digital platforms"
'My son has disappeared' 

Barbing recently published, with Capt. Or Glick, an in-depth article in the IDF magazine Between the Poles in which the two discuss the issue of deterring lone, unaffiliated terrorists. Barbing also assesses the benefits or harm in a number of "deterrent measures" that have been raised in the impassioned public discourse about terrorism by individuals these past few years.

He thinks that demolishing terrorists' homes is a method that has proven to be effective.

"There are dozens of cases that I know of personally in which fathers brought their sons to the Palestinian Authority or called the PA and said, 'My son is missing, I realized he's going to commit an attack, and I don't want them to demolish my home.' We've proved that in court."

Often, Barbing says, families voluntarily report potential attackers.

"The most obvious and painful tools are financial punishment, withholding funds for families of terrorists, refusal to grant permits to work [in Israel], and limitations to movement," he says.

Delaying the return of terrorists' bodies, however, does more harm than good, Barbing thinks. "At first, I supported it, but the more we delayed the return of terrorists' bodies, we learned that it created escalation and tension, and led to the opposite results and to greater danger rather than creating the deterrence we thought it did."

Barbing also touches on how continual use of one method or another loses its effectiveness, and offers the surprising insight that the glory assigned to martyrs has an increasingly short shelf life.

"Because of the increase in terrorist attacks in recent years and because the Palestinian public has become so used to shahids, their glory doesn't last very long now. Sometimes, only a few days or hours."

Q: Does the PA help prevent terrorism?

"Yes, although we need to emphasize that even without help from the PA, Israel knows how to handle terrorism in Judea and Samaria and Jerusalem. But often, especially because of operational considerations and Israel's national interests, we've preferred to coordinate with the PA and allow them freedom of action – deep inside village and refugee camps in Nablus, Jenin, and Qabatiya, for example."

Q: What percentage of terrorist attacks have been prevented thanks to the PA? Former Defense Minister Moshe Ya'alon said it was about one-quarter? 

"I would put it at about 20%."

Q: In your opinion, would toppling the PA be the right thing to do, as some have suggested? It helps us thwart terrorism, but also glorifies it and allows major incitement. 

"Israel 'invented' the PA, and the decision to topple it would be a political, not only a security and defense, issue. When I look at the last decade, in which the PA helped us prevent terrorism – unlike the period that preceded it – I'm not convinced that going back to a reality of military rule [there] would serve our interests. We could also wind up paying for it in blood. Going back in, especially when it comes to civil matters and the Palestinians' daily lives, would cause a much higher level of friction. The current situation is reasonable for Israel, but it might not last much longer. In the end, we will have to reach some kind of solution."

Barbing also discusses the Palestinian terrorists released in the deal to free captive soldier Gilad Schalit.

"From a professional point of view, releasing [them] to the West Bank was best. There, we can keep an eye on them and grab them whenever there is the slightest suspicion that they're planning something. In the West Bank there is also deterrence for the prisoners released in the deal. The terms of the deal said that anyone who resumes terrorist activity will serve the dozens of years in prison he would have faced  with 'interest.'"

Q: How many of the prisoners released to the West Bank have resumed terrorist activity thus far? 

"A few dozen have gone back to terrorism or illegal Hamas activity that does not include lethal terrorism."

Q: If you think it was best to release them to the West Bank, wasn't it a mistake to let some of them go to the Gaza Strip or Turkey? The entire leadership of Hamas in Gaza is now comprised of prisoners freed in the Schalit deal. 

"We didn't want them all in the West Bank, because then we'd have seen a resurgence of Hamas here. It would have done serious harm to the Palestinian Authority. So I'm not sure we made a mistake. I'd remind you that we were successful in deporting the terrorists who barricaded themselves inside the Church of the Holy Sepulchre during Operation Defensive Shield to Europe, even though they were terrorists from Fatah. They are completely inactive today."

The opposite is also true. Salah Arouri, who was deported from Israel, has made a career in terrorism and become a leading Hamas official. For years, he has been influential in terrorism while enjoying haven in various other countries. 

"Today, looking back at the results of his deportation, I would rethink sending him away. Even then, he was a leader, and I prefer to keep leaders like him closer to the Russian Compound in Jerusalem than the Blue Mosque in Istanbul."

'There are knives on the Temple Mount'

Last week, the Haifa District Court sentenced Amjad Muhammad Ahmad Jabarin of Umm al-Fahm to 16 years in prison for helping the perpetrators of the shooting attack on the Temple Mount in July 2017, in which two Israeli police officers were killed. Barbing remembers the "unusual, unprecedented, and difficult" event very well, as well as everything that followed. Even now, he thinks that the decision to place metal detectors at the gates to the Temple Mount – which was made hours after the attack – was not wrong.

"It wasn't a new idea. It was floated a few times in the past, and the political echelon decided that setting them up at the gates, or at least fairly close, would require a certain level of coordination with Jordan because of the sensitivity of the Temple Mount."

The moment the Shin Bet learned that the metal detectors were creating "seismic" unrest, "the understanding sunk in that it was better to be wise than to be right. The murder of the family in Halamish on the eve of Shabbat after the attack on the Temple Mount, and the terrorist's statements in his interrogation, made it clear that he had set out to murder Jews 'to defend Al-Aqsa.'"

Q: Is there an alternative to the metal detectors, which were removed? 

"There is better preparation in the field, with an emphasis on the gates, including body searches and pulling suspicious individuals aside. Intelligence has become more focused and there is early identification. But given the lack of thorough checks, in my opinion it's possible to bring knives into the Temple Mount. If there were metal detectors, I think there would be fewer plans and attempts to carry out a terrorist attack on the Temple Mount."

Q: At the time, the Shin Bet objected to outlawing the Northern Branch of the Islamic 
Movement. 

"It was the organization's original stance, but after we reconsidered everything, we agreed that it be outlawed. Today, the Northern Branch is weakened and has less influence, in part because we cut off its financial breathing tube.

"The Islamic Movement, which the Northern Branch is an offshoot of, has been confronted with the Islamic State for the past few years, which threatened its dominance in the struggle of the Israeli Arabs. We saw a transition from the Islamic Movement to the ideas of ISIS. Now its activity has been curtailed. The main problem is Europe. There, among the [Muslim] immigrants, there are plenty of ISIS cells who preach hatred of Christians and Jews."

Barbing also followed the process of the Israeli leadership's decision to increase the number of Jewish visitors allowed onto the Temple Mount in line with the status quo there. The Hebrew month of Tishrei saw nearly 6,000 Jews visit the Mount, the same number who arrived throughout the entire course of 2009. By the end of 2019, over 36,000 Jews will have visited the Mount.
"If there were metal detectors, I think there would be fewer plans and attempts to carry out a terrorist attack on the Temple Mount"
Q: How did the change come about? 

"First of all, there is the political leadership. Public Security Minister Gilad Erdan wanted it to happen, and Prime Minister Benjamin Netanyahu allowed it. The status quo and the arrangements on the Temple Mount allow [Jews] to visit, although not pray there. Erdan wanted to make the most of it. Second, a wider sector of Jews have become interested in visiting the Temple Mount in the past few years. Third, we took care to remove the Murabitun and Murabitat groups, which made it their goal to interfere with Jewish visits to the Temple Mount and created constant provocations. In the overly long time those groups were active there, fewer Jews visited, but in the end we woke up and took action against them."

Barbing describes himself as a "die-hard secularlist," but says, "I think it's unreasonable that a Jew who follows the rules on the Mount can't visit there freely. The moment the Murabitun was removed, the door was opened to more Jews. We took care to put the Waqf in its place and keep its people away from the groups of Jewish visitors. Top police officials, under former Commissioner Roni Alsheikh, pushed to allow many more Jews to visit the Mount."

Q: Do you think Jews will soon be allowed to pray on the Mount? 

"Moshe Dayan made the rules in 1967 and all the governments have upheld them. Right now, I can't picture a reality in which the policy changes. No Arab official will ever agree to that, and Israel would be accused of striking a major blow to the status quo, and it could send things up in flames."

'Not great at foresight' 

In his article in Between the Poles, Barbing describes a disturbing reality of a "security vacuum in the neighborhoods of east Jerusalem where Israeli security forces and PA security forces have no foothold."

Q: What neighborhoods are you referring to? 

"Mainly the ones to the north, beyond the security barrier – the Shuefat refugee camp and the Al-Ram, Samir Amis, and Kafr Aqab area. They don't allow the PA to operate there because most of the residents have Israeli ID cards. The police, who are supposed to be active there, have difficulty carrying out operations. Because of the high level of violence in those areas, almost every police action requires back up from the IDF. The army took responsibility for those areas because it had no other choice. All attempts to organize there demand that we change our viewpoint and operational tactics so we can improve our security and civil governability there."

Q: A lot of people there have guns. 

"In the parts of Jerusalem that are outside the security barrier there are a lot of weapons. In all east Jerusalem, on both sides of the security barrier, we're talking about hundreds, even thousands, of guns. Mostly homemade versions like the Carlo. We confiscate hundreds of guns there each year. In my time, we put an emphasis on locating weapons workshops that were active in making guns and spent less time chasing individual weapons.

When asked what Israel can expect in Judea and Samaria in the near future, Barbing doesn't rush to answer.

"We've never been great at foresight," he admits. "We never predicted an intifada. We didn't predict terrorism by individuals. So I think that the freeze in our relations with the PA, which is a kind of crisis management, with a minimum of casualties and a minimum of attacks, can't continue for very long without any political solution. It won't last. If [PA President] Mahmoud Abbas is removed under certain conditions or at a bad time, it could potentially lead to a flare-up of violence. In that context, we should keep tabs not only on Hamas but also on the various Fatah factions. They aren't all the same."

Q: In your opinion, what is the future of Israeli settlements in Judea and Samaria? 

"Factually speaking, all the Israeli governments have had a hand in establishing settlements, but everyone has his own political opinions. In this interview, I’m not going to get into politics. Professionally speaking, I can say there isn't a vacuum. There is no substitute for our security presence there and our freedom of action there, which has existed since Operation Defensive Shield, 365 days a year, including Yom Kippur. That freedom of action led to a dramatic drop in the scope and capabilities of terrorism. Currently, there are no political limitations to any ongoing activity anywhere in Judea and Samaria. From that perspective, the results of Defensive Shield were and remain no less important than the operation itself."


Nadav Shragai

Source: https://www.israelhayom.com/2019/11/01/finding-terrorist-needles-in-the-internet-haystack/

Follow Middle East and Terrorism on Twitter



No comments:

Post a Comment