Acquiring & Exploiting Knowledge for Predicting Acts of Terrorism

1. Acquiring & Exploiting Knowledge for Predicting Acts of Terrorism Rocky Termanini. PhD, CISSP Software Process Improvement Network (SPIN) Northrop Grumman, E2 Conference, Redondo Beach, CA April 6; 9:00 – 12:00 AM

2. The US Government is learning it the hard way: Predictive Models do not work unless you have been deeply involved in the fabric of the culture and religion of the country…

3. The US Government Did not pay much attention to the History of Egypt

4. Step one: dump everything we know about a country like Iraq, and “create systems that mirror the actual communities.”  Step two: in the CEWPS plan: to realistically represent the social, cultural, and behavioral theories” about why people act the way they do”. Step three: let commanders run mock battle plans against these modeled Iraqis, to see how they might react.

5. A noble mission to explain the anatomy of Al Quada

6. Event E(t) Attack Prior Attack Post Attack

7. Objective Event E(t) We’re building an is artificially intelligent reasoning machine that extract knowledge from historical bombing episodes and offer solid prediction and combat upcoming attacks... Attack Prior Attack Post Attack

8. Objective Specifically speaking, creating a Knowledge database of past attacks; identifying trends in the attacks; determining the correlation between attacks using analysis to calculate the probabilities of future attacks and their location.

9. CEWPS Holistic vision CEWPS™ offers four robust advantages: • Early Warning Prediction of incoming attack. • Early Warning Detection • Evidential Reasoning to improve degree of certainty • Memorizingattacks for future similar attacks

10. Early Warning Rationale Early-warning is not about predicting the future … It is about preventing specific events (terror attacks) from happening at the right time

11. Terrorism What is It? Why do we worry about it What can we do to circumvent it

12. Let’s define some term Jihadism: Originally had a significant meaning to represent Islam expansion…Now, it has a twisted meaning to represent Islamic terrorism الجهاد المجاهدين Mujahedeen: Radical warriors who practice Islamic terrorism under the name of Jihad. They are dedicated to destroying anything that is not Islamic. They believe their action will win them the Paradise.

13. Dedication to a cause

14. Even a Camel is part of Jihad

15. Suicide Bombing can take any form

16. Another Kind of Mujahedeen:

17. Another mission to to call for Holy War

18. U.S. RECOGNIZED TERRORIST ORGANIZATIONS WORLDWIDE Abu Nidal organization (ANO) Abu Sayyaf Group (ASG) Al-Aqsa Martyrs Brigade Ansar al-Islam (AI) Armed Islamic Group (GIA) ‘Asbat al-AnsarAum Supreme Truth (Aum) AumShinrikyoBasque Fatherland and Liberty (ETA) Communist Party of Philippines/ New People’s Army (CPP/NPA) Al-Gama’a al-Islamiyya (Islamic Group, IG) HAMAS (Islamic Resistance Movement) Harakatul Mujahidin (HUM) Hizballah (Party of God) Islamic Movement of Uzbekistan (IMU) Jaish-e-Mohammed (JEM) Jemaah Islamiya (JI) Al-Jihad (Egyptian Islamic Jihad, EIJ) Kahane Chai (Kach) Kongra-Gel (KGK, formerly Kurdistan Workers’ Party, PKK, KADEK) Lashkar-e-Tayyiba (LT) Lashkar I Jhangvi (LJ) Liberation Tigers of Tamil Eelam (LTTE) Mujahedin-e Khalq Organization (MEK) National Liberation Army (ELN)—Colombia Palestine Islamic Jihad (PIJ) Palestine Liberation Front (PLF) Popular Front for the Liberation of Palestine (PFLP) Popular Front for the Liberation of Palestine–General Command (PFLP-GC) Al-Qaida Real IRA (RIRA) Revolutionary Armed Forces of Colombia (FARC) Revolutionary Nuclei (RN) Revolutionary Organization 17 November (17 November) Revolutionary People’s Liberation Party/Front (DHKP/C) 135Salafist Group for Call and Combat-GSPC SenderoLuminoso (Shining Path or SL) United Self-Defense Forces/Group of Colombia (AUC)

19. 60% Shi’a 30% Sunni 10% Misc.

20. 890 /year 3200/year 1200 /year

21. http://www.youtube.com/watch?v=bel7Trt49hE http://www.youtube.com/watch?v=KOTH_xv6O4o&feature=related

22. The History of Islam and its relation to Jihad

23. Let’s go back and review the chemistry of the four Terrorists

24. Abdul Rahman Ghazi Nationality: Iraqi, Kurd Sect: Sunni, Married two kids; engineer; Joined Al-Quada 2005; explosive knowledge- High Training in Pakistan. Jihadist Frequent visitor to UAE…brother works accountant Plan: Killing Shi’a Policemen Suicide in 2009 Baghdad…

25. Mustapha Hamwai Jalali Nationality: Yemeni, Sect: Sunni, Single; Accountant; Joined Al-Quada 2006; explosive knowledge- High Training in Yemen, Accountant in Iraq Jihadist Brother works in Dubai…HSBC bank Plan: Killing US troops Suicide in 2009 Basra, Iraq

26. Faysal Hasan Nationality: Iraqi, from Baghdad Sect: Shi’a, Single; Architect; Joined Muqtada al-Sadr 2006; explosive knowledge- High Training in Lebanon’s Hezbollah. Jihadist Plan: Killing US tourists Suicide in 2009 Mosel, Iraq

27. Mohammed Abdul Salam Nationality: Egyptian, Cairo Sect: Sunni, Single; Journalist; Married to a Palestinian girl Najwa, Joined Muslim Brotherhood 2004; Army officer, explosive knowledge- High Training in Mauritania. Jihadist, Radical Plan: Killing US troops in an Humvee

28. The Jihad War • Believe 9/11 is an inside job • Very savvy politically • Highly educated • Islamic war against enemies of God • Not afraid to die • Driven by radical Islamism • Residual anger and vengeance • Desire to go to Heaven • They only can do it “once” • They prefer to attack Americans outside the US

29. We can improve our Homeland security against suicide bombing, by learning from previous attacks, in the world...

30. So, What can we learn from previous Suicide Bombing Episodes?

31. Experience & knowledge Relationship Outcome Event Experience Knowledge Created by external sensation or internal reflection Store & Predict Neurological image of the experience in the brain

32. If we inject the human knowledge and experience into the machine, we will be able to build an intelligent system that employs expert judgment and extensible reasoning capability

33. There are many registries and data repositories on terrorism....but, they are disparate , non-normalized, non-correlative

34. GTD from the University of Maryland

35. Rand DB on Terrorism Incidents

37. FBI Terrorist Screening Center

38. Institute of Terrorism Research and Response

39. Most Episodes partially documented, incomplete and follow no standards

40. Analyzing a suicide Bombing Episode

41. attack attack attack attack attack attack attack attack Episode Episode Episode Episode Episode Episode Episode Episode • Attack Episodes have lots in common

42. They all have common features Episode Tstart Tend Each episode is a stochastic Process

43. A Plan • Actors • Target • Time • Location • Damage Episode A suicide Episode has 6 basic attributes

44. Casualties • Destruction • Disruption • Social Trauma Forecast Zone Emergency Response attack Planning Planning Recovery Φ1 Φ2 Φ3 Tstart Tend Each episode has three Phases

45. SB-T SB-1 SB-2 SB-3 Attack caught before detonation Predictor issued an alert Predictor had reliable data to predict positive Bombing where Prediction Failed Prediction Period M(t)0 P(t)0 A(t)0 M(t)1 M(t)3 M(t)2 P(t)1 P(t)2 P(t)3 The Process of Credible Prediction

46. SB-T SB-1 SB-2 SB-3 Attack caught before detonation Predictor issued an alert Predictor had reliable data to predict positive Prediction Period Bombing where Prediction Failed A(t)0 M(t)0 P(t)0 M(t)1 M(t)3 M(t)2 When prediction shorter, prevention gets better P(t)1 P(t)2 P(t)3 The Process of Credible Prediction

47. The Major Building Blocks Attack Collector (KM) Attack Analyzer Outcome Reasoner Early Warning Broadcaster

48. Bayesian Refinement Recursion By indicators Create Semantic Knowledge Build Bombing Patterns Build Reasoning Model Build Collecting grids Collect Bombing Episodes Normalize & Characterize Match Rules Analyze & Validate Dispatch & Alert Ontology Components& Semantic Rules Save Episode Analysis

49. Global Terror Episode Collection Grid Graph-G The Global Cyber Malware Data Collection Grid

50. Global Terror Steady Updates The Intelligence Data Grid Steady Updates The Activity Monitoring Grid Steady Updates The Demographic Grid Steady Updates The Cognitive Early Warning Prediction System (CEWPS™)