16.5 Antiterrorism
Key Takeaways
- The Air Force Office of Special Investigations is the lead Air Force agency for collection, investigation, analysis, and response to threats from terrorists, criminal activity, foreign intelligence, and security services.
- Reportable contacts or information must be reported to AFOSI immediately — within 30 days of the contact — either verbally or in writing.
- The random antiterrorism measures program introduces uncertainty to defeat surveillance attempts and make Air Force actions difficult for a terrorist to predict.
- The four human intelligence threat areas are espionage, subversion, sabotage, and terrorism.
- Terrorism is defined as the calculated use of unlawful violence or threat of unlawful violence to inculcate fear intended to coerce or intimidate governments or societies in pursuit of political, religious, or ideological goals.
The Antiterrorism Effort
The Air Force seeks to deter or limit the effects of terrorist acts by: collecting and disseminating timely threat information, providing training to all USAF members, developing comprehensive plans to deter and counter terrorist incidents, allocating funds and personnel, and implementing antiterrorism measures.
| Level | Responsibility |
|---|---|
| Headquarters Air Force | The Deputy Chief of Staff for Intelligence, Surveillance, Reconnaissance, and Cyber Effects Operations (HAF/A2/6) and the Director for ISR and Operations ensure timely collection, processing, analysis, production, and dissemination of foreign, current, and national-level intelligence on terrorist activities and force protection |
| AFOSI | "The lead USAF agency for collection, investigation, analysis, and response for threats arising from terrorists, criminal activity, foreign intelligence, and security services." Primarily focused on countering adversary intelligence collection activities, and acts as the USAF single point of contact with federal, state, local, and foreign nation law enforcement, counterintelligence, and security agencies |
| Commanders | Conduct terrorism threat assessments identifying the full range of known or estimated terrorist threat capabilities, including CBRN and high-yield explosives, and encourage personnel to report information on individuals, events, or situations that could pose a threat |
Antiterrorism training. At least annually, commanders conduct comprehensive field and staff training exercising antiterrorism plans, including physical security measures, continuity of operations, critical asset risk management, and emergency management plans. Training should use terrorism scenarios specific to the location based on current enemy tactics, techniques, procedures, and lessons learned. Additionally, the current baseline through force protection condition "Charlie" measures shall be exercised annually at installations and self-supported separate facilities.
The Random Antiterrorism Measures Program
Installation commanders shall develop and implement a random antiterrorism measures program that includes all units on the installation.
The intent: "to provide random, multiple security measures that consistently change the look of an installation's antiterrorism program."
Why it works: random measures "introduce uncertainty to an installation's overall force protection program to defeat surveillance attempts and to make random antiterrorism measures difficult for a terrorist to accurately predict our actions."
Three implementation rules:
- The program shall tie directly with all force protection conditions, including force protection condition "normal," to ensure continuity and standardization
- Times for implementation, location, and duration shall be regularly changed to avoid predictability
- Execution shall be broad based and involve all units and personnel
The inclusion of FPCON "normal" is the detail most often missed — random measures are not reserved for elevated threat conditions.
Transportation and Travel Security
Ground transportation. AFH 1 opens with the underlying threat logic: "Criminal and terrorist acts against individuals usually occur outside the home and after the victim's habits have been established. Your most predictable habit is the route you travel on a regular basis."
The measures:
- Always check for fingerprints, smudges, or tampering of the interior and exterior of your vehicle, including the tires and trunk. If something is out of the ordinary, do not touch anything — immediately contact the local authorities
- When overseas, travel with a companion
- Select a plain car and avoid using government vehicles when possible
- Do not openly display military equipment or decals with military affiliations
- Keep doors locked at all times
- Do not let someone you do not know direct you to a specific taxi
- Ensure taxis are licensed and have safety equipment (seat belts at a minimum)
- Ensure the face of the taxi driver and the picture on the license are the same
Commercial air travel overseas. Before traveling, consult the Foreign Clearance Guide, and get the required "area of responsibility" threat briefing from your security officer, antiterrorism officers, or the appropriate counterintelligence or security organization within three months prior to traveling overseas.
Additional measures: use office symbols on travel documents if the word description denotes a sensitive position; use military contracted flag carriers; avoid traveling through high-risk areas; do not use rank or military address on tickets; do not discuss military affiliation; do not carry classified documents unless absolutely mission essential; dress conservatively; wear clothing that covers military or United States-affiliated tattoos; carry plain civilian luggage; and do not wear or carry distinct military items.
The three-month threat briefing window is the numeric fact most likely to be tested from this passage.
Suspicious Packages or Mail
AFH 1 supplies a long indicator list. Group it to remember it:
| Category | Indicators |
|---|---|
| Addressing | Unusual or unknown place of origin; no return address; misspelled words; differing return address and postmark; handwritten labels; incorrect titles or title with no name; special instruction markings such as "personal, rush, do not delay, or confidential" |
| Physical | Abnormal size or shape; protruding strings; aluminum foil; wires; unusual or unbalanced weight; springiness in the top or bottom; inflexibility; crease marks; excessive security material |
| Sensory | Excessive amount of postage; unusual odor; discoloration or oily stains; ticking, beeping, or other sounds |
Handling rules:
- Be vigilant for evidence of powder or other contaminants
- Never cut tape, strings, or other wrappings on a suspect package
- If the package has been moved, place the package in a plastic bag to prevent any leakage of contents
- If handling mail suspected of containing chemical or biological contaminants, wash hands thoroughly with soap and water
- Report suspicious mail immediately and make a list of personnel who were in the room when the suspicious envelope or package was identified
The personnel list requirement is the step candidates most often omit, and it is the one that supports later medical follow-up.
Personal, Home, and Family Security
"Individual vigilance is integral to the antiterrorism program, whether stateside or overseas."
General personal protection measures include: dress and behave in a way that does not draw attention; be inconspicuous and avoid publicity; travel in small groups; avoid spontaneous gatherings or demonstrations; be unpredictable; vary daily routines to and from home and work; be alert for anything suspicious; avoid giving unnecessary personal details; be alert to strangers on government property for no apparent reason; refuse to meet with strangers outside your workplace; always advise associates or family members of your destination and anticipated time of arrival; report unsolicited contacts; do not open doors to strangers; memorize key telephone numbers; be cautious about giving information regarding family travel or security measures; and when overseas, learn and practice a few key phrases in the local language.
Home and family security measures include: restrict the possession of house keys; lock all entrances at night including the garage; keep the house locked even if you are home; destroy all envelopes or other items that show your name, rank, or other personal information; remove names and rank from mailboxes; watch for unfamiliar vehicles cruising or parked frequently in the area, particularly if occupants remain for extended periods; and post or preprogram emergency telephone numbers.
On threatening phone calls: report all threatening phone calls to security officials and the telephone company, making note of any background noise, accent, nationality, or location.
The recurring theme across all three lists is the removal of rank and affiliation — from mailboxes, envelopes, tickets, luggage, vehicles, and clothing. That is the thread to follow if a specific measure slips your memory.
Human Intelligence and Counterintelligence
Human intelligence is "a category of intelligence derived from information collected and provided by human sources and collectors, and where the human being is the primary collection instrument." Counterintelligence is "information gathered and activities conducted to protect against such threats."
| Collection effort | Definition |
|---|---|
| Interrogation | "The systematic effort to procure information to answer specific collection requirements by direct and indirect questioning techniques of a person who is in the custody of the forces conducting the questioning" |
| Source operations | Trained collectors develop information through the elicitation of sources, including "walk-in" sources who make first contact without solicitation, developed sources met over a period of time, and unwitting persons with access to sensitive information |
| Debriefing | "The process of questioning cooperating human sources to satisfy intelligence requirements." The source usually is not in custody and is usually willing to cooperate |
| Document and media exploitation | Captured documents and media may reveal adversary plans and intentions, force locations, equipment capabilities, and logistical status. Not a primary human intelligence function, but may be conducted by any intelligence personnel with appropriate language support |
Interrogation versus debriefing is the reliable discrimination: interrogation involves a person in custody; debriefing involves a cooperating source usually not in custody.
The Four Threat Areas
| Threat | Definition |
|---|---|
| Espionage | "The act of obtaining, delivering, transmitting, communicating, or receiving information about national defense with intent or reason to believe the information may be used to the injury of the United States or to the advantage of any foreign nation" |
| Subversion | "An act or acts inciting military or civilian personnel of the Department of Defense to violate laws, disobey lawful orders or regulations, or disrupt military activities with the willful intent thereby to interfere with or impair the loyalty, morale, or discipline of the U.S. Armed Forces" |
| Sabotage | "An act or acts with intent to injure, interfere with, or obstruct the national defense of a country by willfully injuring or destroying, or attempting to injure or destroy, any national defense or war material, premises, or utilities, as well as human and natural resources" |
| Terrorism | "The calculated use of unlawful violence or threat of unlawful violence to inculcate fear intended to coerce or intimidate governments or societies in the pursuit of goals that are generally political, religious, or ideological" |
The terrorism definition is the most frequently quoted in the entire chapter. Its distinguishing elements are calculated, unlawful violence or the threat of it, to inculcate fear, aimed at coercing or intimidating governments or societies, for political, religious, or ideological goals.
Incident Reporting
AFI 71-101, Volume 4, Counterintelligence, requires individuals who have reportable contacts or acquire reportable information to "immediately (within 30 days of the contact) report the contact or information either verbally or in writing to AFOSI."
AFOSI initiates and conducts all counterintelligence investigations, operations, collections, and other related activities for the USAF, coordinating with the Central Intelligence Agency and the Federal Bureau of Investigation when appropriate or overseas. It is also the installation-level training agency for counterintelligence awareness briefings and the sole USAF repository for the collection and retention of reportable information.
"Contact" is defined as any exchange of information directed to an individual, including solicited or unsolicited telephone calls, e-mail, radio contact, and face-to-face meetings. Examples of reportable contacts:
- Contact with a foreign diplomatic establishment
- A request by anyone for illegal or unauthorized access to classified or unclassified controlled information
- Personal contact with any individual who suggests that a foreign intelligence or terrorist organization may have targeted him or her or others
- Receipt of information indicating military members, civilian employees, or DoD contractors have contemplated, attempted, or effected the deliberate compromise or unauthorized release of classified or unclassified controlled information
"USAF antiterrorism enlists the eyes and ears of all USAF military, civilians, contractors, and dependents," and each installation outlines procedures for receiving and logging suspicious activity reports and suspicious incident reports and passing them expeditiously to their servicing AFOSI.
Protection of the President and others. Per AFI 71-101, Volume 2, Protective Service Matters, and a formal agreement between the Department of Defense and the U.S. Secret Service, individuals affiliated with the Armed Forces have a special obligation to report information regarding the safety and protection of the U.S. President or anyone else under Secret Service protection — including the Vice President, the President- and Vice President-elect, and visiting heads of foreign states or governments. In most cases, former Presidents and their spouses are also afforded lifetime protection.
Within what period must a reportable contact be reported, and to whom?
How does AFH 1 define terrorism?
An Airman finds a package with no return address, excessive postage, and an oily stain that has already been moved to a different desk. What does AFH 1 direct?