2 discussion responses 150 words each and 1 response to the professor

THREAT ASSESSMENT GUIDE

Evaluating and Analyzing Criminal Extremist Groups

Updated April 2002

Jerry Marynik, Supervisor Group Analysis Unit

Intelligence Operations Program Division of Law Enforcement

CALIFORNIA DEPARTMENT OF JUSTICE

i

TABLE OF CONTENTS

PREFACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii

INTELLIGENCE PROCESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7 Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3

Personal Contact . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Criminal Justice System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Regulatory Agencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Public Databases and Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3

Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Source Reliability Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Information Validity Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Collation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5 Matrix/Link Diagram Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5 Evidence Recognition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-6 Tactical and Strategic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Dissemination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-7

“Need to Know” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 “Right to Know” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

CHARACTERISTIC EVALUATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-10 Group Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-10

Ideology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Field of Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-9 Tactics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Membership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-10

RISK ANALYSIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-17 Criminal Predicate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-13

Types of Crimes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Capability Factor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Probability Factor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Violence Potential . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Warning Signs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-15 Weapons and Explosives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Cellular Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Military-Style Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Intimidation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-15

Potential Targets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-17 Target Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-16 Probability of Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Damage Potential . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Consequence of Intervention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-17

ii

THREAT ASSESSMENT GUIDE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18-23 Group Characteristics Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Criminal Predicate Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18-19 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Target Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19-20 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Comprehensive Threat Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20-23 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Threat Assessment Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

BIBLIOGRAPHY

iii

PREFACE

Criminal extremist groups threaten or commit acts of violence and other forms of terrorist-related crime in pursuit of their goals or beliefs. Law enforcement authorities aware ofthese groups must maintain an ongoing process of evaluation and analysis regarding the groups in order to assess their threat potential. This process can be achieved through the development of threat assessments.

Threat assessments evaluate the characteristics, analyze the risks, and measure the violence potential associated with criminal extremist groups. These assessments are used for tactical and strategic purposes by law enforcement authorities to target and neutralize the groups, hopefully before they commit crimes of violence.

Law enforcement authorities need a plan to collect reliable information focusing on the groups, the ability to skillfully interpret the information, and a method to accurately assess the groups’ threat potential based on the interpreted information. This guide provides a suggested collection plan, analysis formula, and evaluation technique for assessing those groups.

To be effective, threat assessments must be proactive and not reactive. They must combine an examination of factors including -- but not limited to -- the groups’ capabilities, determination, motivation, intentions, commitment, violence potential, and targeting practices. This examination can often be difficult since many of the groups strive for secrecy and clandestine activity.

There are several types of threat assessments. Some analyze specific individuals, groups, and events while others evaluate general patterns of criminal activity and new dimensional terrorist- related issues such as nuclear, biological, and chemical weapons of mass destruction. A good assessment contributes to the detection, investigation, and prosecution of criminal extremist groups while protecting the First Amendment rights of others.

For the purpose of this guide, criminal extremist groups are defined as domestic groups that create (or law enforcement authorities have reasonable suspicion to believe will create) a climate of fear and intimidation by endorsing or resorting to criminal activities that involve force, loss of life, extensive harm to persons, or damage to property in order to further its goals or beliefs, thereby causing concern for the personal safety of others. Domestic groups can be evaluated and analyzed by state and local authorities who have access to a variety of sources, both overt and covert. International groups are best assessed by federal authorities who, by the virtual extension of their agencies worldwide, have counterparts or operations in other countries and access to foreign intelligence information.

The information in this guide was derived from a variety of reports, documents, and publications that deal with the intelligence process, evaluation of group characteristics, and analysis of risks. That information was combined with the day-to-day operational work products expected from analysts assigned to the California Department of Justice’s Gangs/Criminal Extremists Unit. The blend of that information and those work products has resulted in the development of this comprehensive and systematic guide to preparing threat assessments.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-1-

INTELLIGENCE PROCESS

The foundation of any threat assessment is the intelligence process. The basic premise ofthe process is that systematic exploitation of criminal-related information can lead to acomprehensive evaluation and analysis of criminal extremist groups. Without such a process, threat assessments can be unpredictable and unreliable.

The “who,” “what,” “where,” “when,” and “how” of criminal extremist groups are closely related. Intelligence efforts produce reliable answers or, at the very least, informed judgments to these questions. The answers or informed judgments are only as good as the information that is collected and the skill that is used to interpret the information.

The intelligence process is made up of the following six functions: collection; evaluation; collation; analysis; reporting; and dissemination:

Collection

The need to collect criminal-related information is recognized by all law enforcement authorities. To be credible, the collection effort must be planned and focused. Collection must take into account the information on hand, and the need to ensure that additional collection efforts are directed toward gaps in existing information.

Collection plays an important role when evaluating and analyzing criminal extremist groups that organize for a common purpose. Usually, members of the groups tend to develop stereotypical structures and forms of behavior that are repeated with consistency and recognizable patterns. They often act purposefully in such a way that their overall goals or beliefs take on a characteristic shape. The groups generally establish trends that distinguish them and their activities from other groups, and certain actions and group dynamics become identifiable with the groups. Collection efforts must focus on these trends, activities, actions, and dynamics.

Multiple sources of information need to be collected in order to learn about the criminal extremist groups’ organizational structure, characteristics, motivation, commitment, patterns of behavior, determination, and trends. Some sources include personal contact, associates, the criminal justice system, and public databases and sources.

Personal Contact

< Conduct personal interviews with the groups’ members whenever possible.

< Collect material created or possessed by the groups’ members -- including fliers, journals, letters, books, and magazine articles.

< Attend the groups’ rallies, gun shows, and public meetings whenever possible.

< Interview associates who know -- or have known -- the groups’ members.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-2-

Criminal Justice System

< Collect current record or archival information -- including police, court, probation, and correctional data.

< Local

< Police and sheriff departments

< State

< California Department of Justice

< Central Intelligence File < Automated Criminal History System < Automated Firearms System

< California Highway Patrol

< LEIU

< RISS

< INTERPOL

Regulatory Agencies

< Many regulatory agencies have contact with members of criminal extremist groups.

< Motor Vehicles

< Fish and Game

< Tax

< Parks and Recreation

< Forest Service

< City clerks and county recorders

Public Databases and Sources

< Query open sources such as libraries, newspapers, and periodicals.

< Internet

< CDB Infotek

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-3-

< Nexus/Lexus

< Clipping services

< Southern Poverty Law Center/Klanwatch

< Anti-Defamation League

Evaluation

Information is evaluated for evidence of conditions and behaviors that may be consistent with the existence of criminal extremist groups. Evaluation seeks to determine whether the groups have an ideology, a field of operations, tactics, and a membership that appears to be moving toward a threat or an act of violence.

Information collected for threat assessments should be evaluated to (1) measure the reliability of the source; and (2) estimate the validity of a particular piece of information. Information will often consist of unverified allegations, hence evaluating the source and information will directly measure its usefulness and accuracy. To ensure uniformity, information collected for threat assessments can be evaluated according to the following criteria:

Source Reliability Table

SOURCE RELIABILITY

Class Label Description

A Reliable Source’s reliability is unquestioned or has been well- tested in the past.

B Usually reliable Source’s reliability can usually be relied upon as factual. The majority of past information has proven to be reliable.

C Unreliable Source’s reliability has been sporadic.

D Unknown Source’s reliability cannot be judged. Authenticity or trustworthiness has not been determined by either experience or investigation.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-4-

Information Validity Table

INFORMATION VALIDITY

Class Label Description

1 Confirmed The information has been corroborated.

2 Probable The information is consistent with past accounts.

3 Doubtful The information is inconsistent with past accounts.

4 Cannot be Judged The information cannot be evaluated.

Collation

Collation is the separating of fact from fiction and the sifting out of useless and nonrelevant information regarding criminal extremist groups. This process of elimination is followed by the orderly arrangement of the remaining information so relationships between apparently disconnected elements can be established.

Matrix/Link Diagram Model

One method for displaying established relationships is the matrix/link diagram model. This model provides a meaningful way to reduce written information that is either extensive or disorganized -- or both -- to a visual format. The purpose of such a format is to clarify information describing associations among members of criminal extremist groups.

A matrix document -- with a dot -- known associations among members of the groups; and with a circle, the suspected associations among members of the groups using the following format:

A link diagram converts the dots and circles from the matrix into a visual representation using

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-5-

solid lines to represent the known associations and dotted lines to represent the suspected associations in the following format:

Evi dence Recognition

It is always important to be on the lookout for evidence during the collation function of the intelligence process. Always treat the groups as criminal enterprises and be cognizant of their criminal predicate and, in particular, all relevant evidence. Evidence recognition may lead authorities to a quick resolution of a potential threat or act of violence.

The principal difference between intelligence and investigation is that intelligence alerts, warns, and provides advance information about criminal activity while investigations are basically evidentiary in nature. Investigations are geared toward presenting statements on assembled information acquired under rules of criminal procedure, and in a format that satisfies the elements of proof needed for a successful prosecution.

Threat assessments do not have prosecution as its main objective. These assessments are intended to focus law enforcement authorities in the direction of potential criminal activity and to alert the authorities of the criminal extremist groups’ future threats or trends that may require a tactical response.

Analysis

The core of the intelligence process is the analysis function. It converts the bits and pieces of information collected from many sources into a threat assessment that has meaning. The goal of analysis is to develop the most precise and valid inference possible from available information. Without analysis, a piece of information remains just that -- a piece of information.

Tactical and Strategic

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-6-

There are two broad, and sometimes overlapping, categories of analysis: tactical and strategic.

Tactical - Tactical analysis contributes directly to an immediate objective and is geared toward a specific criminal activity with the goal of neutralizing it. It may be the supplying of an investigative lead, the compilation of a list of potential surveillance subjects, or some small fact about the activities of a certain suspect. Tactical intelligence can take many forms, but it is mainly used in the assembling of a file on a suspect with a view toward investigation.

Strategic - Strategic analysis is a blending of facts that produces an informed judgment. It describes a criminal extremist group’s ideology, tactics, membership, capabilities, vulnerabilities, and violence potential. Strategic analysis deals with the major issues that concern law enforcement authorities and allows for long-range planning to investigate criminal extremist groups before they become a significant problem.

Reporting

Intelligence reports or, in the case of this guide, threat assessments must be objective and written in a manner that demonstrate clear connections between the facts and informed judgments. Carefully prepared threat assessments must provide unbiased information and not fuel unjustified fears. In those areas where intelligence information is ambiguous or absent, then the report, or threat assessment, must take into account the criminal extremist groups’ past behavior -- whether the groups have the motivation and capability for such activity and whether the activity is a logical extension of the groups’ intentions and commitment.

Documentation of information and reasoning at every stage of a report, or threat assessment, is essential. A carefully constructed report, or threat assessment, may be criticized for imperfect information collection or flawed analysis; but such a report, or threat assessment, also demonstrates both thoughtfulness and good faith. It is always better to look into the future with imperfect vision than not to look at all. No-fault intelligence is acceptable. See page 23 for a sample Threat Assessment Report.

Dissemination

The primary function of dissemination is to distribute credible and timely intelligence reports or threat assessments. Information that remains locked in the intelligence system fails to fulfill its primary role -- that of leading to the identification of particularly violent criminal extremist groups.

Dissemination of the reports, or threat assessments, is determined by the purpose of the information and the recipients of the information who have a “need to know” and a “right to know.”

“Need to Know”

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-7-

Law enforcement authorities seeking the information need the criminal intelligence information in order to execute their official responsibility.

“Right to Know”

Law enforcement authorities seeking the information have the legal right to obtain the criminal intelligence information.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-8-

CHARACTERISTIC EVALUATION

Criminal extremist groups are typically small and clandestine. The possibilities of thesegroups making threats followed by acts of violence are limitless, depending on thegroups’ motivations and intentions. The validity and seriousness of these threats are often complex and uncertain. Violence that follows threats may seem random, indiscriminate, or symbolic; or it may be complex, well planned, and precise.

It is virtually impossible to ensure complete protection from these threats and acts of violence, but law enforcement authorities can reduce the odds by evaluating the groups’ characteristics. Systematic evaluation of the characteristics will contribute to the overall threat assessment.

Group Characteristics

Several characteristics are generally evaluated to identify the existence and type of criminal extremist groups. The four main characteristics used in this guide are (1) ideology; (2) field of operations; (3) tactics; and (4) membership.

Ideology

< Do the groups exist; and, if so, why and when did they form?

< Are the groups determined, motivated, and focused?

< Do the groups have conspiratorial beliefs that the government is becoming more tyrannical and attempting to reverse constitutional guarantees?

< Do the groups base their organizational philosophies on anti-government rhetoric? Do they have an “us” versus “them” mentality?

< What type of literature, i. e., Turner Diaries or the Anarchist Cookbook, seems to be helping shape the groups’ characteristics?

< Do the groups believe the use of indiscriminate violence or the overthrowing of government is required?

< Do the groups believe killing and maiming members of the public are “acceptable sacrifices?”

Field of Operations

< Do the groups have geographical areas of activity and access to targets?

< Are the groups exclusively based in rural areas with fixed bunker-style camps, and do they view survivalist camps as necessary?

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-9-

< Are the groups based in urban areas, providing an opportunity to strike at the very seat of capitalism and offering the anonymity of the crowd as a safe haven for their members?

Tactics

< Do the groups have patterns of behavior or preferred methods of operations?

< Can the groups obtain resources, training, and weapons?

< Are the groups stockpiling food and medicine?

< Are the groups faced with a paradox of needing both secrecy and publicity? Does their criminal nature require a clandestine existence at the same time members engage in political and propaganda activity to elicit public support?

< Do the groups choose to build popular support by creating “survivalist camps” and allowing members to bring families to live in the compound?

< Do the groups adopt the use of cellular structures, safe houses, mail drops, and other clandestine tactics that maintain the anonymity of group members?

< Do the groups maintain a defensive posture with plans for violent action contingent on perceived government provocation; or do the groups maintain an offensive posture with detailed plans for conducting overt acts such as testing explosive devices, gathering counter- intelligence information, and identifying and conducting surveillance of potential targets?

Membership

< Who are the leaders, or is the leadership fluid?

< Whom has the most influence in the group?

< Are the members organized and motivated with a strong leadership, or is the group a “group of one?”

< Are the members committed to the groups; and, if so, do the members have the capability of committing acts of violence in support of the groups’ goals or beliefs?

< Is there an active effort to recruit new members?

< Are there members who could commit acts of violence without the groups’ consent?

Of special interest to threat assessments are those members who, alone, may pose a threat on a personal level. The identification of these particular members can best be evaluated by professional profilers; but there remains the basic need for threat assessments to recognize -- if possible -- the fanatic, extremist, asocial, or nonsocial members.

Extremists - Extremist members advocate excessive measures and hold inordinate views.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-10-

Fanatics - Fanatic members are moved by a frenzy of unreasonable enthusiasm or zeal.

Asocial - Asocial members reflect a person who is alone not by choice but because of societal segregation.

Nonsocial - Nonsocial members tend to be “loners” because they often feel no one else is good enough to be around them.

See Group Characteristics Evaluation Table on page 18.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-11-

RISK ANALYSIS

Once the criminal extremist groups’ characteristics have been evaluated, then attentionmust be given to the risks associated with the groups. A comprehensive threatassessment analyzes those risks, or warning signs, posed by the groups. Information adapted from the National Institute of Justice, Threat Assessment: An Approach to Prevent Targeted Violence, September 1995, suggests individuals -- or groups for the purpose of this guide -- threaten for many reasons; only some of which involve the intention or capacity to commit violent acts. However, groups can present a grave threat without articulating it. Knowing the distinction between making and posing a threat is important. Terror is not always terrorism.

< Some groups that make threats ultimately pose threats.

< Many groups that make threats do not pose threats.

< Some groups that pose threats never make threats.

Some criminal extremist groups are more methodical then others, but most of their crimes are purposeful -- however random and senseless they may appear. Different groups have different priorities. Because of the clandestine nature of their activities, these priorities will usually remain concealed until the overt acts occur. Threat assessments must ascertain the priorities in advance of the acts in order to inform law enforcement authorities of the suspected or known threats posed by the groups and the consequences of intervention, if any, authorities may encounter when tactically responding to the threats.

Three factors must be determined when analyzing prospective threats posed by criminal extremist groups. The first factor addresses the criminal predicate associated with the groups; the second factor reviews the warning signs that point to potential danger; and the third factor assesses the target(s) of the groups’ ire. A systematic examination of these factors can lead to an orderly risk analysis:

Criminal Predicate

The determination and capability to commit crimes in support of their goals or beliefs are driving forces identifying the groups as “criminal extremist groups.” Based on “reasonable suspicion” standards, threat assessments measure the magnitude of threatened harm, the likelihood of occurrence, and the immediacy of the threat. Analysis of these suspicions, along with the groups’ prior and/or potential criminal predicate, can lead to an assessment of the risks -- particularly those that are violence oriented -- associated with such groups. Know the criminal predicate options, and treat the groups as criminal enterprises.

This guide suggests the following four categories to analyze criminal predicate:

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-12-

Types of Crimes

< Are the groups involved, suspected of being involved, or demonstrating a willingness to become involved in crime?

< What are the crimes associated (known or suspected) with the criminal extremist groups?

< Are the crimes “group” driven or “individual” driven?

< Do the crimes include attempts to provoke confrontation with government officials, including law enforcement authorities?

< Do the group’s activities include “paper terrorism” such as the threat of frivolous liens or subpoenas from a common law court?

< Are the groups willing to use secondary crimes as a diversion for committing a primary crime?

< Are the groups’ goals or beliefs directed toward some particular target; i. e., are the crimes symbolic, instrumental, or infrastructure in nature?

Symbolic - The target represents an issue that is being opposed by the groups. It may be a date, such as April 15 representing tax issues; or it may be industry related, including animal research centers or meat packing plants. In many cases, there is a wider purpose than the mere harming or destruction of the target. It is hoped the act will serve as a focus or rallying point for the forces of opposition.

Instrumental - The focus on the target must produce tangible results. Assassinations, kidnapings, and other indiscriminate acts of violence are examples of instrumental targets of serious criminal extremist groups. The groups are concerned less with propaganda aspects than with concrete results.

Infrastructure - The target is the nerve center for critical operations. Disruption of operations -- such as electrical power and water supply, gas and oil storage and transportation facilities, and emergency services, including 9-1-1 -- could create temporary havoc or devastation for government and large businesses.

Capability Factor

< Are the groups capable of criminal activity, and is there a pattern or history of criminal predicate -- especially prior violence?

< Are the groups able to accomplish a threat, act of violence, or some other form of criminal activity; and, if so, what is the likelihood of occurrence?

< Do the groups have the means and skills to commit these crimes?

Probability Factor

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-13-

< Is there a reasonable probability the groups will commit crimes?

< Do the groups have the opportunity to commit crimes?

< Have arrests curtailed or deterred crimes?

< Is contact expected; and, if so, when (what is the immediacy of threat)?

Elements analyzing the “when” include the following considerations:

< When the time is ripe

< When the groups consider themselves ready

< When the resources are available

< When associated with some event

< When retaliation is felt necessary

< When considered to have the most impact

Violence Potential

< Who or what is the threat source; what is the threat; and what makes it dangerous?

< Are the groups merely talking about violent action, or are they actually planning to commit it?

< If the groups have stated intentions of committing acts of violence, then is there a real threat of violence?

< Do the groups have a propensity for committing acts of violence?

< What is the magnitude of threatened harm, and is there reason for concern?

< Do the groups place a low value on human life?

< Do the groups propose kidnapings or the taking of hostages where an issue for responding law enforcement authorities is the likelihood of the groups killing the hostages if demands are not met?

See Criminal Predicate Analysis Table on page 19.

Warning Signs

Some of the more distinguishable risks that help measure the violence potential of criminal

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-14-

extremist groups include the following warning signs focusing on weapons, cellular structure, military-style training, and intimidation:

Weapons and Explosives

< Do the groups own and/or are they acquiring and stockpiling weapons and explosives?

< Do the groups practice with weapons and explosives?

< Are the groups involved in carrying concealed weapons?

< Have the groups followed or approached potential targets while carrying weapons?

< Are the groups involved in the illicit sale of weapons and/or the illegal modification of weapons?

< Do the groups own or are they purchasing body armor?

Cellular Structure

< Have the groups formed into cells and strive for secrecy and clandestine activity?

< Do the cells use safe houses, mail drops, and propaganda fliers?

< Are members of particular cells willing to sacrifice themselves for the benefit of the group?

< Do the groups have smaller, or isolated, fringe groups -- not necessarily cells, that want to pursue a more aggressive strategy?

Military-Style Training

< Are the groups involved in paramilitary training and exercises?

< Do the groups use and store military equipment?

< Do the groups rely on military-style regulations for security and discipline?

Intimidation

< Are the groups involved in the intimidation of others; have they made threats of a violent nature; and have they considered and/or attempted harming others?

< Do the groups demonstrate antagonism toward certain representatives of governmental agencies and verbally indicate a willingness to hurt these people?

< Are the groups involved in counter-surveillance tactics such as photographing public officials, recording license plate numbers of law enforcement authorities, monitoring emergency response or police radio frequencies, and/or accumulating other information that tends to profile an official or authority?

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-15-

Potential Targets

Potential targets can be (1) symbolic in nature including business facilities, research centers, or prominent landmarks; (2) instrumental in nature such as kidnaping and assassinating corporate officers or threatening and intimidating public officials and law enforcement authorities; or (3) infrastructure in nature such as air traffic control, major financial centers, telecommunication grids, and the continuity of government.

Threat assessments identify conflicts between criminal extremist groups and potential targets. There will always be plenty of targets, and it is often impossible -- with limited law enforcement resources -- to protect all of them. Consequently, a process for analyzing the targets and their vulnerability, probability of attack, and damage potential -- along with consequences for law enforcement intervention -- can be implemented to help reduce the likelihood of target victimization.

This guide offers the following five suggested steps to assist in that analysis process:

Target Identification

< Is group activity directed toward specific individuals or institutional targets?

< Who or what are the targets (including people, agencies, and buildings) that have the potential of being victimized?

< Is group activity indicative of preparing for acts of violence against potential targets?

< Are the potential targets readily identifiable; or does it appear the groups, if considering violence, have yet to select potential targets?

Vulnerability

< Are the potential targets vulnerable or susceptible to acts of violence?

< Do the potential targets have an Achilles heel?

< Are there sensitive building plans available to the public; careless disclosure of itineraries by the intended target; public revelations of some exploitable weakness; or disaffected insiders prepared to provide information?

Vulnerability refers to the degree a target is susceptible to acts of violence or the amount of resistance that can be anticipated before a target succumbs. Two key features that help analyze vulnerability are target access and attractiveness. Targets are sometimes highly vulnerable simply because access is easy and uncontrollable. Other targets may be attractive because they represent symbolic issues. Vulnerability cannot be measured in a vacuum because it is not a fixed constant; its place on any scale may be altered by a variety of means -- some deliberate, others accidental.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-16-

Probability of Attack

< What are the realistic probabilities of the potential targets being attacked?

< Are the potential targets well known to the groups?

< Are the groups acquainted with a potential targeted individual’s work and personal lifestyle, patterns of living, daily comings and goings?

< Will the potential targets be attacked?

Damage Potential

< If attacked, could the damage to targets be significant; and, if so, what is the damage potential?

< Are the potential targets afraid of being damaged or harmed by the groups; and is the degree of damage or harm shared by family, friends, and/or colleagues?

< What factors are involved in a severity index of potential damage such as the existence of possible casualties; the number and/or type of casualties; and the dollar value of potentially destroyed or damaged property, activity, or service?

Consequence of Intervention

< What are the consequences or adverse implications, if any, authorities should know before they elect to respond tactically?

< Is there a confrontational, siege, or standoff mentality with the groups? Are they maintaining a defensive posture? Have they trained for such activity?

< Is there a possibility of members from other groups coming to the aid of a group should a standoff occur?

< Is there a possibility the group’s compound could be booby trapped with explosives or tripwires? Is there a possibility of diversionary explosives?

< Will responding authorities be confronted by members who are determined, motivated, focused, and believe killing and maiming are acceptable sacrifices?

< Have the groups stockpiled food, medicine, weapons, explosives, and/or body armor?

< Are the contemplated response actions necessary and risk effective?

See Target Analysis Table on page 20.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-17-

THREAT ASSESSMENT GUIDE

Threat assessments can take many forms and include several factors to evaluate and analyzecriminal extremist groups. The forms and factors suggested in this guide can be projectedonto four tables. Three of the tables systematically: (1) evaluates the characteristics of criminal extremist groups; (2) analyzes the risks posed by the groups; and (3) reviews the groups’ potential targets. A fourth table comprehensively assesses the groups’ overall threat potential.

Group Characteristics Evaluation

Summary

The first step in preparing threat assessments is to determine whether the groups are, in fact, criminal extremist groups. Four basic characteristics lend themselves to such a determination:

< Ideology - The groups exist and are determined, motivated, and focused.

< Field of Operations - The groups have a geographical area of activity and access to targets.

< Tactics - The groups have patterns of behavior or preferred methods of operations.

< Membership - The members are committed to the groups and have the capability of committing acts of violence in support of the groups’ goals or beliefs.

Table

Table 1 of 4

GROUP CHARACTERISTICS EVALUATION TABLE

Characteristics Yes No Maybe

Ideology

Field of Operations

Tactics

Membership

Criminal Predicate Analysis

Summary

The second step in preparing threat assessments is an analysis of the known, suspected, or potential crimes associated with criminal extremist groups. Four categories assist in that analysis:

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-18-

< Types of Crimes - The groups are involved, suspected of being involved, or demonstrating a willingness to become involved in crime.

< Capability Factor - The groups are capable of criminal activity, and there is a pattern or history of criminal activity.

< Probability Factor - There is a reasonable probability the groups will commit crimes.

< Violence Potential Level - The groups have a propensity for committing acts of violence and have stated intentions of committing violence.

Table

Table 2 of 4

CRIMINAL PREDICATE ANALYSIS TABLE

Types of Crimes Capability Factor* Probability Factor* Violence Potential Level*

* Low - Little, or no, threat

Medium - Threat exists but does not appear imminent

High - Threat is visible and distinctive.

Target Analysis

Summary

Analyzing or reviewing potential targets is the third step in preparing threat assessments. Understanding relationships between criminal extremist groups and targets help law enforcement authorities prepare for a tactical response. Five considerations must be given to analyzing or reviewing potential targets?

< Target Identification - Who or what are the potential targets? The groups’ activity is indicative of preparing for acts of violence against the targets.

< Vulnerability - The targets are susceptible to acts of violence.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-19-

< Probability of Attack - The targets will probably be attacked.

< Damage Potential - If attacked, the damage could be significant.

< Consequence of Intervention - There are adverse implications for law enforcement authorities responding to the threat.

Table

Table 3 of 4

TARGET ANALYSIS TABLE

Target Identification

Vulnerability Probability of Attack

Damage Potential

Consequence of Intervention

Comprehensive Threat Assessment

Summary

An amalgamation of the three systematic tables results in one comprehensive threat assessment, thus skirting the danger of “failing to see the woods for the trees.”

< Groups’ Character Evaluation

Ideology and Field of Operations - The groups exist; are determined, motivated, and focused; have a geographical area of activity; and have access to targets.

Tactics and Membership - The groups have patterns of behavior or preferred methods of operation; the members are committed to the groups and have the capability of committing acts of violence in support of the groups’ goals or beliefs.

< Criminal Predicate Analysis

Types of Crime and Capability Factor - The groups are involved in criminal activity; have the capability of committing criminal activity; and there is a pattern of criminal activity.

Probability Factor and Violence Potential Level - There is a reasonable probability the groups will commit crimes; the groups have a propensity for committing acts of violence and have

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

-20-

stated intentions of committing violence.

< Target Analysis

Target Identification and Vulnerability - There are potential targets; the groups’ activity is indicative of preparing for acts of violence against the targets; the targets are susceptible to acts of violence.

Probability of Attack and Damage Potential - The target will probably be attacked; if attacked, the damage could be significant.

Consequence of Intervention - There are adverse implications for law enforcement authorities responding to the threat.

-21-

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremists Groups

Table Table 4 of 4

COMPREHENSIVE THREAT ASSESSMENT TABLE

GROUP CHARACTERISTICS

EVALUATION

CRIMINAL PREDICATE ANALYSIS

TARGET ANALYSIS CONSEQUENCE OF INTERVENTION

THREAT LEVEL Ideology and Operations

Tactics and Membership

Crimes and Capability

Probability and Violence

Targets and Vulnerability

Probability and

Damage

Low

Medium

High

< Low - Little, or no, threat. The groups are upset but involved in little focused action other than nonviolent protests. However, the groups should be continuously monitored for strategic evaluation and analysis purposes.

< Medium - Threat exists but does not appear imminent. The groups have a focused attention and may become violent. Law enforcement authorities need to be strategically aware of the groups’ crimes and prepared to tactically respond.

< High - Threat is visible and distinctive. The groups have a destructive cause. All law enforcement precautionary measures need to be employed and tactical response plans activated.

THREAT ASSESSMENT GUIDE - Evaluating and Analyzing Criminal Extremist Groups

THREAT ASSESSMENT GUIDE -22-

THREAT ASSESSMENT REPORT (Sample)

EXECUTIVE SUMMARY

REPORT

Group Characteristics Ideology Field of Operations Tactics Membership

Criminal Predicate Types of Crimes Capability Factor Probability Factor Violence Potential

Warning Signs Weapons and Explosives Cellular Structure Military-Style Training Intimidation

Potential Targets Target Identification Vulnerability Probability of Attack Damage Potential

Consequence of Intervention

CONCLUSION

RECOMMENDATIONS

BIBLIOGRAPHY

The following reports, documents, and publications were reviewed for information pertinent to developing this Threat Assessment Guide:

Basic Elements of Intelligence, Office of Criminal Justice Assistance, U. S. Department of Justice, 1971.

Combating Terrorism, U. S. Department of Army, Regulation (AR) 525-13, 1992.

Evaluating the Terrorist Threat Principles of Applied Risk Assessment, Cooper, H. H. A., International Association of Chiefs of Police, 1979.

Intelligence Collection and Analytical Methods, Drug Enforcement Administration, U. S. Department of Justice, no date listed.

Intelligence Requirements for the 1990s: Collection, Analysis, Counterintelligence, and Covert Action, Lexington Books, 1989.

Profiling Violent Crimes: An Investigative Tool, Holmes, Ronald M. and Holmes, Stephen T., 1996.

Role of Analysis in Combating Modern Terrorism, Gates, Daryl (former chief of police), Los Angeles Police Department, Federal Bureau of Investigation Law Enforcement Bulletin, 1989.

Tactical Response and Security, Vol. 7, No. 3, Varro Press, 1995.

Target Analysis-Part II: The Essential Component of Antiterrorist Operations, Wolf, John B., International Association of Chiefs of Police, 1978.

Terrorism in America: Pipe Bombs and Pipe Dreams, Smith, Brent L., 1994.

Threat Assessment: An Approach to Prevent Targeted Violence, National Institute of Justice, U. S. Department of Justice, 1995.

Understanding Terrorism: Groups, Strategies, and Responses, Poland, James M., 1988.

Urban Terrorism, Greenhaven Press, Inc., 1996.