Predictive profiling

Predictive profiling is a method of threat assessment designed to predict and categorize the potential for criminal and/or terrorist methods of operation based on an observed behavior, information, a situation and/or objects.

Description

Predictive Profiling (also known as Proactive Threat Assessment) offers a unique approach to threat mitigation that begins from the point of view of the aggressor/adversary and is based on actual adversary's methods of operation, their modus operandi. This method is applicable to securing virtually any environment and to meeting any set of security requirements.

In Predictive Profiling, one uses only the operational profile (not racial or statistical profile) of a terrorist or criminal as the basis for identifying suspicion indicators in a protected environment. When predictively profiling a situation, person or object one identifies suspicion indicators that correlate with an adversary's method of operation. For example, if a security officer observes a person walking with an empty suitcase in an airport (the suitcase appears very light; it bounces off the floor) he may identify this suspicious behavior as an indication of a possible terrorist or criminal method of operation because:

• The person may be involved in theft or shop lifting (using the empty suitcase to stash what he would steal)
• The person may be involved in surveillance activities (the suitcase is only a prop to fit the airport environment)
• The person has dropped a bomb somewhere in the airport and is now exiting

Predictive Profiling differs from racial profiling which uses race and ethnicity as the only factors against which to evaluate potential threat. In fact, proponents of Predictive Profiling would dismiss the use of racial profiling as ineffective in counter terrorism or security because focusing on one part of the population as a tool for identifying potential threat can be illegal and it can also be counterproductive.

Indeed, a terrorist or criminal can use security measures which are solely based on racial profiling against a security system by choosing an identity and appearance that is not associated with the targeted race or ethnicity. Once, on May 30, 1972, three members of the Japanese Red Army, on behalf of the Popular Front for the Liberation of Palestine (PFLP), attacked an Israeli Airport (Lod Airport massacre). The Japanese attackers took advantage of the fact that at the time, the Israeli border security system was geared towards focusing on Arab and Muslim populations as potential terrorist threats.

Predicting profiling is proactive in nature, used to prevent and/or mitigate threat before it evolves into an attack or criminal event. Putting resources into emergency response is of course prudent, but clearly preventing an event from occurring is preferable both in terms of public safety and often, security costs.

What we need to do better is be predictive. We have to be proactive. We have to develop the capability to anticipate attacks. We have to develop the capability of looking around corners. And that is the change...

— May 30, 2002, FBI Director Robert S. Mueller

Adversarial Methods of Operation (AMO)

Predictive Profiling (Proactive Threat Assessment) uses the method of attack and its correlating Suspicion Indicators as the basis for threat assessment. The method of attack, from a pickpocket to a terrorist, remains constant and it includes the Marking to Getaway stages:

• Marking of the target
• Intelligence Gathering
• Surveillance
• Planning
• Tooling Up
• Rehearsing and Training
• Execution and …
• Getaway

Knowing the method of attack or method of operation of the terrorist or criminal, we can be more threat-oriented in protecting our environment. It allows us to be able to identify situations, objects or people as suspicious in a context of the method. Sometimes Predictive Profiling is referred to as conducting a situational threat assessment.

Suspicion Indicators

Suspicion Indicators

A suspicion indicator is an indication based on known (or predicted) terrorist or criminal methods of operation or deviation from a typical profile that may lead one to believe that an observed situation (persons and/or objects) may have the potential for harming the protected environment and its inhabitants.

These indicators are derived from any aspect that relates to what we broadly term behavior. This would include among other things attire, accent, affect, identity both as reflected in an individual's documentation and by who they say they are, their 'cover story'.

Because suspicion indicators correlate directly with the AMOs associated with a given protected environment, there is no single definitive list. There are infinite examples of suspicion indicators, and perhaps the most poignant are those associated with the testimony of U.S. Airways agent Michael Tuohey, as regards the events of 9/11. Tuohey, who had worked for the airlines for over 30 years, 18 of which in Portland, checked in Mohamed Atta and Abdulaziz al-Omari who were flying from Portland, ME to Boston, MA. He noticed the following suspicion indicators in Atta and al-Omari’s actions and behavior on the morning of 9/11:

• The terrorists arrived to check in only 30 minutes before departure.
• Atta and Omari were meandering in the checkin area although their flight was due to depart in 30 minutes.
• Omari never responded verbally to questions asked by Mr. Touhey; he just shook his head.
• Atta was looking at Mr. Touhey with anger.
• Both terrorists carried a full fare business class ticket.
• The tickets for both terrorists were one way.

Threat vs. Risk

Sometimes the terms "threat" and "risk" are used as though synonymous. But in fact these two ideas are very different, and that difference is reflected in Predictive Profiling methods.

Risk is measurable, it has levels. For example, car insurance premiums are calculated based on measurable, past behaviors and events. Threat, on the other hand, is not measurable. It either exists, or it doesn't. This is why the Homeland Security Alert Systems that many countries have adopted are not really meaningful.

Following this logic, the goal of predictive profiling is to determine whether or not a person, object or situation represents a real threat. The logic of predictive profiling continues insofar as our security efforts are confined to real threats versus a larger, random sampling of threats in the form of people or objects. Why, for example, should we waste time screening everyone, or a random sampling of a larger set, when we could rather focus our attention on those suspicion indicators that reflect actual, potential threat?

Another way to define threat is as suspicion that has not been refuted.

Detect - Determine - Deploy

The proactive security process that is employed using Predictive Profiling consists of three steps:

• Detect suspicion (technology or human)
• Determine method of operation (human)
• Deploy against the AMO (human)

Predictive Profiling (Proactive Threat Assessment) relies heavily on the human element in security. While detection can be accomplished with technology, the determination or analysis required to identify a suspicion indicator and its related AMO is something only a trained human can do. This general kind of analysis is actually natural to us; we make similar determinations in our lives all the time. A husband arrives home later than usual and smelling of a scent not familiar to his wife. She observed suspicion indicators (tardy and unusual scent) and automatically seeks to determine whether or not they correlate to the AMO (that he is cheating on her) by asking probing questions (where have you been?) to decide if the threat is refutable (his story pans out).

Use of Technology in Profiling

In security and homeland security management, a strong emphasis is placed on technology: CCTV cameras, detection devices, scanners and the like. And while technology has its place, note that there are no known instances of a terrorist being caught using detection technology alone. Predictive Profiling (Proactive Threat Assessment) is more concerned with identifying intent than a weapon. A well trained and motivated criminal or terrorist is capable of death and destruction using improvised weapons. Just as an individual with a potentially lethal weapon who has peaceful intentions, does not pose a threat.

History of Profiling

The methodology is based primarily on methods used by El Al Israel Airlines Ltd, and other Israeli security agencies. In Predictive Profiling (Proactive Threat Assessment), these methods have been adapted to western cultural, social and economic conditions that differ from those of Israel.

Methods similar to that of Predictive Profiling, focused on assessing threat contextually, have been in use by a wide variety of agencies, around the world. Border and Custom agents have been using profiling for decades as a means of targeting those individuals or cargo that might be involved in smuggling, trafficking or criminal operations.

This kind of targeting has proven very effective and has resulted in the prevention of many illegal activities. The sheer number of people and freight passing through borders requires that the focus be on identifying indicators of intent. This is accomplished via targeting and behavioral observation.

Hindawi affair

The Hindawi affair was the attempted bombing of an El Al flight from London to Tel Aviv in April 1986 and its international repercussions.

On the morning of April 17, 1986, at Heathrow Airport in London, Israeli security guards working for El Al airlines found semtex explosives in one of the bags of Anne Mary Murphy, a pregnant Irishwoman attempting to fly on a flight with 375 fellow passengers to Tel Aviv. In addition, a functioning calculator in the bag was found to be a timed triggering device. She was apparently unaware of the contents, and had been given the bag by her fiancé, Nezar Hindawi, a Jordanian. He had sent her on the flight for the purpose of meeting his parents before marriage. A manhunt ensued, resulting in Hindawi's arrest the following day after he surrendered to police. Hindawi was found guilty by a British court in the Old Bailey and received 45 years imprisonment, believed to be the longest determinate, or fixed, criminal sentence in British history.

Racial Profiling

Racial Profiling is the use of ethnic or racial characteristics to identify and associate an individual with a (typically criminal) behavior. Legal cases have been brought against law enforcement officers who allegedly focused disproportionately on members of minority races. It is a hot button issue, and often a point of contention in Homeland Security policy discussions.

After a terrorist event, media attention and public debate on counter terrorism methods spike. After the Christmas Day attempt to blow up a plane in midair, ABC News covered the issue of 'Predictive' versus Racial Profiling.

Criminal Profiling

Criminal Profiling attempts to associate a criminal's attributes and methods of operation to a specific crime. The main difference is the profiling occurs after the crime, in an attempt to find the criminal. It's not usually used to prevent a crime, except in the case of a serial offender.

Where Predictive Profiling is Used

Predictive Profiling as a security method is applicable to a wide range of environments.

Aviation

Predictive Profiling (Proactive Threat Assessment) is a particularly useful component of an aviation security toolbox. Given the success of the El Al model, and the events of 9/11, there has been a good deal of interest in this methodology. As for any densely populated, open area, Predictive Profiling lends itself to effectively securing everything within an aviation environment.

The U.S. Transportation Security Administration (TSA) has been perusing a variety of security models and methods, especially in the aftermath of 9/11. CAPPS and SPOT are examples of profiling programs the TSA has adapted as part of its mandate to make aviation more secure.

Maritime

The Diplomatic Conference on Maritime Security held in London in December 2002 adopted new provisions in the International Convention for the Safety of Life at Sea, 1974 and the ISPS Code (International Ship and Port Facility Security Code) to enhance maritime security. These new requirements form the international framework through which ships and port facilities can co-operate to detect and deter acts which threaten security in the maritime transport sector. Following the tragic events of 11 September 2001, the twenty-second session of the Assembly of the International Maritime Organization (IMO), in November 2001, unanimously agreed to the development of new measures relating to the security of ships and of port facilities for adoption by a Conference of Contracting Governments to the International Convention for the Safety of Life at Sea, 1974 (known as the Diplomatic Conference on Maritime Security) in December 2002. Preparation for the Diplomatic Conference was entrusted to the Organization's Maritime Safety Committee (MSC) on the basis of submissions made by Member States, intergovernmental organizations and non-governmental organizations in consultative status with the Organization. Predictive Profiling was one of the new requirements adopted by the ISPS Code: "recognition of characteristics and behavioural patterns of persons who are likely to threaten security"

Mass transportation

Whether it be a train station, bus depot, or airport terminal, these mass transit hubs are desirable targets for terrorists. Attacking areas where large numbers of people congregate results in higher fatalities and disabling public transportation causes commercial losses, all of which enhances the terror effect.

The character of mass transit, and the fact that it represents an open environment, makes protecting against this kind of terrorist attack a major challenge. Physically conducting a complete check of every traveler and passenger is infeasible, given the numbers. And spending time checking the 99.9% of people who do not present a threat is a waste of time and resources. Screening a random sample of a given population – for example, passengers passing through a checkpoint – ignores the subject of "threat" altogether, whereas using predictive profiling, screening activity is focused only on those people, objects or situations that draw suspicion because they may reflect a real threat.

Law Enforcement

Law enforcement agencies around the globe have been and continue to use elements of Predictive Profiling (Proactive Threat Assessment) in their daily activities. Any officer 'on the beat' understands suspicion indicators, and how certain behavior, objects or situations stand out from the norm with which the officer is intimately familiar. Law enforcement officers make situational assessments and conduct behavioral observation all the time. The main point of departure from predictive profiling is that an officer's primary mission is to enforce the law, which means that he is foremost concerned with proving a case that will play out in court. This necessitates focus on finding a weapon and fingerprints(evidence), and less so finding intent.

Open Environments

Large retail malls, private and governmental office buildings, recreational centers and stadiums are open environments that are particularly enticing targets for a terrorist. These are areas where large numbers of people congregate and they often symbolic of something that can be politicized by an opponent. The World Trade Center represented the financial dominance of the United States in the world, for example.

Military Applications

For soldiers fighting against insurgent populations and terrorism, Predictive Profiling (Proactive Threat Assessment) is an extremely effective tool. Military personnel appreciate the ability to prevent or mitigate an attack by assessing and acting against possible threats before they occur.

U.S. Army units preparing for deployment have turned to Predictive Profiling as another tool in their arsenal for identifying threat in the field.

The U.S. military is vulnerable for being a training ground for terrorists, be they homegrown, independent or working for foreign agencies. Given the pressure to recruit to fill ranks, and the fact that troops are operating in foreign, unfamiliar cultures, effective vetting of personnel needs to take into consideration the operational profile of a would be terrorist. Predictive Profiling can be applied not only to individuals but to procedures, for example - military recruitment activities.