Summary of Actions
Subcommittee of Intelligence
Soumyo Dutta, Tanguy Hubert, Abdollah Shafieezadeh
The goal of the subcommittee of Intelligence is to evaluate the extent of evolution of intelligence,
screening and security procedures, and infrastructure protection in the aftermath of 9/11 and to
characterize their impact on the safety of civil aviation in the United States. The scope of aforementioned
subcategories is explained and their most important yet sufficient constitutive parameters/scenarios/cases
are identified. As of October 25, 2011, the following documents have been prepared. The full report can
be found in the attachment.

Civil Aviation Security Intelligence Gathering (Agency-based) by Som
Primary types of intelligence gathered by agencies are summarized including signal, human,
imagery, measurement and signature, and open source intelligence. Each one these intelligence
sources is explained and particular cases when available are presented. In addition, involved
agencies at national, federal, state, and local levels are outlined and their duties are explained in
detail. Emphasis has been placed on how the roles of the agencies have evolved from pre-9/11
days.

Spatial/Profiling-based intelligence gathering by Tanguy
Learning about the intention of people in spatio-temporal domains immediately preceding or
following a flight is discussed in a framework that considers four distinct processes: collecting
information, verifying information, passing along/sharing information, and finally analyzing
information and drawing conclusions. Detailed steps involved in this subject covering all
processes mentioned above are presented.

Risk-based intelligence gathering (Identification of threats) by Abdollah
Primary sources of terrorist hazards to civil aviation are identified which include passengers, air
cargo, airport and airline staff, laser targeting of aircrafts, shoulder fired surface-to-air missiles
(SAMs), unauthorized access to aviation computer systems, and finally airport access control.
The nature of each of these threats is explained in very detail and the level of threat they impose
on civil aviation is discussed qualitatively and if available quantitatively. This set of information
provides estimates of the probabilities of civil aviation failed being protected conditioned on the
occurrence of the above threats. These probabilities can be used in the total probability
framework for overall risk assessment of civil aviation against terrorist hazards.
Additional work planned for the future includes characterizing screening and security procedures used at
airports. This would include the technology used for screening, humans and animals involved in the
various security procedures, the various locations of the airport where screening can be performed and the
training procedures necessary to make all human assets effective in screening.
-1-
Civil Aviation Security Intelligence Gathering (Agency-based)
Soumyo Dutta
Types of intelligence gathered by agencies:
1. SIGINT: signal intelligence – interception of communication
2. HUMINT: human intelligence – on-site assets, foreign governments, businesses etc.
a. Airport managers dependent on information from local law enforcement agencies
b. Local law enforcement: keep track of criminal activities in the area
c. Groups established where local and federal law enforcement agencies meet regularly to
discuss local threat information
d. Some similar groups existed pre 9/11 called Threat Assessment Groups (TAG) teams
e. Airports can collect intelligence through information from IDs of airport employees and
other airport travelers; airport employees can also become information gathering sources
3. IMINT: imagery intelligence – images from imaging platforms (manned or unmanned)
4. MASINT: measurement and signature intelligence – that is data gathered from sensors at security
and check-in areas – limited role with regard to intelligence gathering about terrorists
5. OSINT: open source intelligence – analyzing openly available intelligence such as that provided
on the Internet; also lead to electronic leads that provides more SIGINT
a. Airport Law Enforcement Agencies Network (ALEAN) – existed before 9/11 too, but
restructured after 9/11
i. “Facilitate the rapid exchange of information concerning airport-related crimes”
ii. Conduit for open-source information for airport law enforcement managers
b. Other transportation agencies: American Association of Airport Executives (AAAE),
Airports Council International-North America (ACI-NA) and Air Transport Association
(ATA)
i. Allow flow of information from airport and air-related communities
ii. Do not gather intelligence directly; conduits for flow of facts
c. State-level agencies can share information with airports about criminal behaviors
Agencies involved:
1. Director of National Intelligence
a. Position established by Intelligence Reform and Terrorism Prevention Act (IRTPA) of
2004
b. Reports directly to the President of the United States
c. Coordinates intelligence agencies by working with the directors of individual federal
intelligence agencies (such as the CIA, FBI, NSA etc.)
2. Federal level
a. Central Intelligence Agency: Federal level, foreign intelligence
b. Dept. of State’s Bureau of Intelligence and Research (INR): also federal, foreign
intelligence
c. National Security Agency (NSA) – obtain foreign intelligence
d. Department of Defense (DoD) intelligence agencies – obtain foreign intelligence
-2-
e. Federal Bureau of Investigation (FBI): domestic intelligence gather and coordinate other
domestic law enforcement agencies
3. State level
a. State Bureaus of Intelligence: more of a law enforcement perspective for
intelligence; track and investigate criminal enterprises
i. State-level or Regional Domestic Security Task Force
1. Links information from security and law enforcement people
ii. State-level Department of State for Law Enforcement has tip line for statewide
intelligence
1. State emergency management publishes regular status briefings for
emergency management and law enforcement officials
4. Local-level (includes the individual airports)
a. Airport Security Coordinator (ASC) – analyzes intelligence about threat at a specific
airport or general threats to civil aviation and makes security-related decisions for
individual airports
i. Data often ad-hoc rather than in a coordinated, process driven approach to
information sharing
ii. What type of data to use is often a problem: openly acquired information or
classified information, useful or merely repetitive; data classification and lack of
standardization or consistency limits intelligence usage
b. Airport Law Enforcement Agencies Network (ALEAN) – existed before 9/11 too, but
restructured after 9/11
i. “Facilitate the rapid exchange of information concerning airport-related crimes”
ii. Conduit for open-source information for airport law enforcement managers
c. Other transportation agencies: American Association of Airport Executives (AAAE),
Airports Council International-North America (ACI-NA) and Air Transport Association
(ATA)
i. Allow flow of information from airport and air-related communities
ii. Do not gather intelligence directly; conduits for flow of facts
d. Local law enforcement agencies
i. Can be involved with ASC in the form of TAG teams or other information
sharing measures
-3-
“Pre-Flight”/”Post-Flight” Intelligence
Tanguy Hubert
Purpose: Learn about people’s intentions in spatio-temporal domains immediately preceding or following
a flight.
Four aspects:
1. Collect information
2. Verify information
3. Pass along/share information
4. Analyze information and draw conclusions
Steps:




Information gathered from previous visits to the US
Travel patterns
o travel patterns over the last months
o other stops made on the way to an American airport
Immigration clearing procedures for international passengers
o Electronic System Travel Authorization (ESTA)
o or: Visa
o or: Permanent Resident Card
Ticket booking procedure
o Collect information on a passenger:
 name
 gender
 date and place of birth
 passport details: nationality, number, date of expiry
 redress number if available
 contact information
 address of the first night spent in the US
 form of payment used
 single or round-trip ticket
 passenger traveling alone or with others
 luggage to be checked-in: yes/no
 Passenger may be asked to enter additional information in the Advance Passenger
Information System (APIS)
o Create a Passenger Name Record (PNR) in the airline's Computer Reservation System (CRS)
with all this information
o Compare this information against records
 Passenger information (in the PNR) for incoming flights is sent to the US 48 hours in
advance. Typically consulted only by Customs and Border Protection agency
officials, minutes before the airplane takes off/once the plane is in the air.
-4-





What records?
 no-fly watch lists
 intelligence reports
Pre check-in at overseas airport for passengers heading to the US
o Check reasons for travel
o Check passport validity (against database?)
o Check visa/immigration document validity (against database?)
o Check name against no-fly list (?)
o Look for suspicious behaviors
Check-in desk at the airport
o Check required personal information has been entered in the system
o Check consistency between passport and ticket
o Check passport validity (against database?)
o Check-in luggage if any
o Look for suspicious behaviors
Immigration services for entry/exit of persons of interest
o Check reasons for travel
o Check passport validity (against database?)
o Check visa/immigration document validity (against database?)
o Check name against no-fly list (?)
o Look for suspicious behaviors
At boarding gate just before/after the flight
-5-
Terrorist Hazards to Civil Aviation
Abdollah Shafieezadeh
1. Passengers1
Several million passengers and their baggage must be checked each day2 for articles that could
pose threats to the safety of an aircraft and those aboard it. Concerns have long existed over
screeners’ ability to detect and prevent dangerous objects from entering secure areas. Each year,
weapons were discovered to have passed through one checkpoint and have later been found
during screening for a subsequent flight. For instance in 1978, screeners failed to detect 13
percent of the objects during FAA tests. In 1987, screeners missed 20 percent of the objects
during the same type of test. Test data for the 1991 to 1999 period show that the declining trend
in detection rates continues3. Furthermore, the recent tests show that as tests become more
realistic and more closely approximate how a terrorist might attempt to penetrate a checkpoint,
screeners’ ability to detect dangerous objects declines even further.
It has been reported that TSA considers the likelihood of a terrorist bombing of a passenger
airplane to be between 35% and 65% based on 2002 intelligence reports
2. Air Cargo Security4
Undetected explosive or incendiary devices placed in air cargo are potential threats to aircraft.
Experts have warned that air cargo may be a potential target for terrorists because screening and
inspection of air cargo is currently not as extensive as required screening of passengers and
checked baggage. In 2002, it was reported that TSA computer models estimated that if full
physical screening is implemented, only 4% of the daily volume of freight at airports could be
processed due to the time that would be required to breakdown shipments, inspect them, and
reassemble them for transport. Since that time, considerable progress has been made to increase
the amount of cargo placed on passenger airliners that is screened and advance screening
technologies to address concerns over the screening of cargo.
Cargo carried aboard passenger aircraft may be at particular risk since passenger aircraft are
generally regarded as highly attractive targets to terrorists and have been attacked in the past.
TSA believes that cargo is either likely to become, or already is, the primary aviation target for
terrorists in the short term. However, other terrorism experts regard placing explosives in air
cargo as less appealing to terrorists because typically a specific flight cannot be targeted without
the assistance of an individual with access to aircraft. Furthermore, experts generally believe
that all-cargo aircraft are less appealing targets to terrorists because an attack against an all-cargo
1
Vulnerabilities in, and Alternatives for, Preboard Screening Security Operations, Testimony Before the Committee
on Governmental Affairs and Its Subcommittee on Oversight of Governmental Management, Restructuring and the
District of Columbia, U.S. Senate, September 25, 2001.
2
In 2001, over 2 million passengers flew each day
3
Information on FAA tests results is now designated as sensitive security information and cannot be publicly
released
4
Air Cargo Security, CRS Report for Congress, July 30, 2007.
-6-
aircraft is not likely to generate the degree of public and media attention that a bombing of a
commercial passenger aircraft would have.
3. Airport And Airline Staffs5
Individuals with access to aircraft may pose a risk of potential hijackings and aircraft sabotage.
Instances of hijackings by individuals with access to aircraft have been extremely rare, but
include two examples of particularly violent incidents by disgruntled individuals who had access
to aircraft that facilitated their plots – hijacking of FedEx DC-10 aircraft on April 7, 1994
crashing in Memphis and PSA regional jet on December 7, 1987 crashing near San Luis Obispo,
California. Without full screening of air cargo and airport personnel, the potential still exists for
persons with access to aircraft to pass weapons inside the secured areas of airports. Under
recently imposed regulations, all-cargo operators must take steps to prevent unauthorized
individuals from accessing aircraft and to ensure that crewmembers and individuals carried
aboard large all-cargo aircraft are prevented or deterred from carrying weapons, explosives, or
other destructive items on board aircraft.
Sabotage by individuals with access to aircraft is also a potential risk, although generally not
considered a significant threat because of the high level of knowledge regarding aircraft systems
needed to sabotage flight critical systems, the levels of redundancy of flight critical systems on
modern transport category airplanes, and the existing capabilities to detect sabotage attempts
through aircraft systems checks and pre-flight inspections. While numerous cases of sabotage by
disgruntled employees have been documented, these incidents of aircraft tampering have
typically been discovered during pre-flight inspections resulting in aircraft groundings and
delays and costly repairs, but have not resulted in catastrophes. Such incidents have not been
linked to terrorism.
4. Laser Targeting Of Aircrafts6
The misuse of laser devices poses a serious threat to aviation safety. Aviators are particularly
vulnerable to laser illuminations when conducting low-level flight operations at night. Federal
Aviation Administration researchers have compiled a database containing more than 3,000
reports of aircraft laser illumination events over a 20-year period. These reports describe the
illumination of military and civilian aircraft by lasers, including law enforcement and medical
evacuation flights. No accidents have been attributed to the illumination of crewmembers by
lasers, but given the sizeable number of reports and debilitating effects that can accompany such
events, the potential does exist.
5. Terrorist Missiles: Shoulder fired surface-to-air missiles (SAMs) referred to as Man-Portable
Air Defense Systems (MANPADS)7
Shoulder-fired surface-to-air missiles (SAMs), also known as MANPADS (man-portable air
defense systems), developed in the late 1950s to provide military ground forces protection from
5
Air Cargo Security, CRS Report for Congress, July 30, 2007.
Laser Hazards In Navigable Airspace, Federal Aviation Administration
7
Homeland Security: Protecting Airliners from Terrorist Missiles, CRS Report for Congress, February 16, 2006
6
-7-
enemy aircraft, are receiving a great deal of attention as potential terrorist weapons that might be
used against commercial airliners.
Shoulder-fired SAMs have been used effectively in a variety of conflicts ranging from the ArabIsraeli Wars, Vietnam, the Iran-Iraq War, to the Falklands Conflict, as well as conflicts in
Nicaragua, Yemen, Angola, and Uganda, the Chad-Libya Conflict, and the Balkans Conflict in
the 1990s. Some analysts claim that Afghan mujahedin downed 269 Soviet aircraft using 340
shoulder-fired SAMs during the Soviet-Afghan War and that 12 of 29 Allied aircraft shot down
during the 1991 Gulf War were downed by MANPADs. These missiles can be classified into
three categories:
a) Infrared (IR): Infrared shoulder-fired missiles are designed to home in on a heat source
on an aircraft, typically the engine exhaust plume, and detonate a warhead in or near the
heat source to disable the aircraft. These missiles use passive guidance, meaning that
they do not emit signals to detect a heat source, which makes them difficult to detect by
targeted aircraft employing countermeasure systems.
b) Command Line-of-Sight: Command line-of- sight (CLOS) missiles do not home in on a
particular aspect (heat source or radio or radar transmissions) of the targeted aircraft.
Instead, the missile operator or gunner visually acquires the target using a magnified
optical sight and then uses radio controls to “fly” the missile into the aircraft.
c) Laser Bean Riders: Laser beam riding shoulder-fired SAMs use lasers to guide the
missiles to the target. The missile literally flies along the laser beam and strikes the
aircraft where the missile operator or gunner aims the laser. These beam riding missiles
are resistant to current countermeasure systems on military and civilian aircraft.
Approximately 20 countries have manufactured MANPADS or their components, and it is
estimated that a total of over 1 million of these systems have been manufactured worldwide.
Unclassified estimates of the worldwide shoulder-fired SAMs inventory are widely varied.
Published estimates on the number of missiles presently being held in international military
arsenals range from 350,000 to 500,000 but disparities among nations in accountability,
inventory control, and reporting procedures could make these figures inaccurate. Tracking
proliferation to non-state actors is considered even more difficult by many analysts. There are a
variety of means that terrorist organizations use to obtain missiles, including theft, black market,
international organized crime, arms dealers, and transfers from states willing to supply missiles
to terrorists. As in the case of military arsenals, estimates of shoulder-fired SAMs in terrorist
hands vary considerably. Estimates range from 5,000 to 150,000 of various missile types, but
most experts agree that the vast majority of them are IR guided and are likely SA-7 derivatives,
versions of which are reportedly possessed by at least 56 countries. Some examples attest to the
large numbers of these missiles in circulation. As of December 2002, coalition forces in
Afghanistan had reportedly captured 5,592 shoulder- fired SAMs from the Taliban and Al
Qaeda. Some of these included U.S. Stinger and British Blowpipe missiles believed to have been
left over from the Afghan-Soviet War. Shoulder-fired missiles continue to be seized routinely
during coalition raids, suggesting that Taliban and Al Qaeda forces operating in and around
Afghanistan still have access to an undetermined number of these systems. In Iraq, recent press
reports indicate that 4,000 to 5,000 shoulder-fired SAMs may be available to Iraqi insurgent
-8-
forces. Africa, the region where most terrorist attacks with these missiles have occurred,
reportedly also has a large quantity of shoulder-fired SAMs left over from Cold War
sponsorships and the numerous civil wars of that era.
6. Unauthorized Access to Aviation Computer Systems8
FAA’s computer-based air traffic control (ATC) system is an enormous, complex collection of
interrelated systems, including navigation, surveillance, weather, and automated information
processing and display systems that link hundreds of ATC facilities and provide information to
air traffic controllers and pilots. Failure to adequately protect these systems could increase the
risk of regional or nationwide disruption of air traffic or even collisions. Weaknesses in FAA’s
computer security stem from lacking or inadequate
a) background checks on thousands of contractor employees
b) assessment of many of its ATC facilities
c) risk assessments to determine the vulnerability of the majority of its ATC systems
d) development of service continuity controls to ensure that critical operations continue
without undue interruption when unexpected events occur
e) full implementation of an intrusion detection capability to detect and respond to
malicious intrusions
Some of these weaknesses could have led to serious problems. For example, as part of its Year
2000 readiness efforts, FAA allowed 36 mainland Chinese nationals who had not undergone
required background checks to review the computer source code for eight mission-critical
systems.
7. Airport Access Controls9
Controls for limiting access to secure areas, including aircraft, have not always worked as
intended. As reported in May 2000, special agents used counterfeit law enforcement badges and
credentials to gain access to secure areas at two airports, bypassing security checkpoints and
walking unescorted to aircraft departure gates. The agents, who had been issued tickets and
boarding passes, could have carried weapons, explosives, or other dangerous objects onto
aircraft. The Department of Transportation’s Inspector General’s staff conducted testing in 1998
and 1999 of the access controls at eight major airports and succeeded in gaining access to secure
areas in 68 percent of the tests; they were able to board aircraft 117 times. After the release of its
report describing its successes in breaching security, the Inspector General conducted additional
testing between December 1999 and March 2000 and found that, although improvements had
been made, access to secure areas was still gained more than 30 percent of the time.
8
Terrorist Acts Demonstrate Urgent Need to Improve Security at the Nation's Airports, Testimony Before the
Committee on Commerce, Science, and Transportation, U.S. Senate, September 20, 2001.
9
Terrorist Acts Demonstrate Urgent Need to Improve Security at the Nation's Airports, Testimony Before the
Committee on Commerce, Science, and Transportation, U.S. Senate, September 20, 2001.
-9-