It’s now one week since the Paris attacks happened. We know a lot more about the individuals responsible and how the attacks unfolded. But along the way, we’ve seen inaccurate or unsubstantiated information temporarily dominate the media cycle.
This is not unique to the aftermath of terrorist attacks. But getting it wrong in this context has significant implications. Both in the short-term – identifying attackers and if there is a current threat – but also the long-term, in shaping policy towards everything from refugees to surveillance powers.
So why has information emerging from the investigation (officially and unofficially) been so unreliable? I thought it might be helpful to share a personal insight into how intelligence agencies respond to this type of attack.
Firstly, there’s the sheer volume of information. In the Paris example, you have multiple attack sites; multiple attackers; recovered electronic media; eyewitness accounts, liaison reporting. The list goes on.
From a practical perspective, working through this data requires people and structure: analysts to do the work; analytical leads to coordinate work against particular strands or individuals; and intelligence coordinators to funnel information to the people who need it, and ensure the different parts of the team share their progress.
And all of this needs to feed into a continual re-assessment of the threat, and the extent to which different individuals and leads overlap.
The number of analysts required means that many will work on targets or subjects outside of their expertise. It takes time to get up to speed on individuals, networks, and the language and methodology associated with a particular terrorist threat.
Sometimes in intelligence, you have time to methodically work through a static dataset before arriving at an answer. But in this scenario, you’re under pressure to quickly make sense of what has happened from a standing start – who, why and how? And is the threat ongoing?
Senior management, politicians, partner agencies and the media all need regular updates. And they want answers that are as easy to understand and definitive as possible.
As you and your team sift through the intelligence, there will be countless false positives, analytical dead-ends and promising leads that turn out to be irrelevant. Some, you can dismiss quickly. But others persist for hours or even days. Intelligence is rarely as definitive as people think. You make your best assessment based on available data.
In the wake of an attack, you err on the side of caution when ruling out individuals or theories. And even when you do include nuance and probability in your assessments, these are often lost in the search for sound bites and conclusive answers. It is in this context that the media and general public should interpret ‘off the record’ statements or leaks.
By this stage of the Paris investigation, long hours, working 24/7 shifts and the emotional impact of the attacks will be taking their toll. This level of intensity can only be maintained for so long. Adrenaline levels will be dwindling.
In the short-term, there is no sign of a reduction in the threat to France, Belgium and the rest of Europe. Those staff, and the reinforcements that the French Government will no doubt recruit, are in this for the long haul. And they will need to remember that if errors were made in the months preceding the attacks, their response may have prevented further attacks taking place.
In an ideal world, intelligence agencies are proactive and strategic, looking at the next set of threats. But in responding to this sort of crisis, ‘surging’ staff inevitably means that other priorities are under-resourced. Intelligence agencies in France and elsewhere will need to ensure that their response to the attacks does not have a negative longer-term impact elsewhere.
David Wells worked for UK and Australian intelligence agencies between 2005 and 2014, specialising in counter-terrorism.