Nicholas Rasmussen was sworn in as Director of the National Counterterrorism Center (NCTC) in December 2014. He previously served as Deputy Director since June 2012, after returning from the NSC where he served as Special Assistant to the President and Senior Director for Counterterrorism from October 2007. Mr. Rasmussen previously served at NCTC from 2004-2007 in senior policy and planning positions. From 2001 to 2004 he served on the NSC as Director for Regional Affairs in the Office of Combating Terrorism.
CTC: Fourteen years after 9/11, what is the terrorist threat the United States now faces?
Rasmussen: When you look at the potential for a catastrophic mass casualty attack of the sort that al-Qa`ida carried out against our country at the time of 9/11, clearly we’ve had great success at substantially reducing the chances of that kind of attack recurring. We’ve done that not only with aggressive CT action against core al-Qa`ida in South Asia and around the world but also through an array of defenses we’ve erected as a country. The counterterrorism and homeland security infrastructure that exists gives us much greater defense, disruption, and mitigation capabilities that we did not have at the time of 9/11. And that’s something that is very, very important and something worth keeping in perspective when you think about the sense of threat we feel as a country. That said, the array of extremist terrorist actors around the globe is broader, wider, and deeper than it has been at any time since 9/11. And the threat landscape is more unpredictable. So I think it’s fair to say that we face more threats, coming at us from more places, involving more individuals than we have at any time since 9/11. It’s also worth remembering that the scale of the capabilities of these extremist actors does not rise to the level that core al-Qa`ida had at its disposal at the time of 9/11.
CTC: As you sit here at the NCTC, what threat trends and changes in the strategic and operational environments are most concerning to you?
Rasmussen: I would highlight two trends in the threat environment that give us the greatest concern. First is the increasing ability of terrorist actors to communicate with each other outside our reach. The difficulty in collecting precise intelligence on terrorist intentions and the status of particular terrorist plots is increasing over time. There are several reasons for this: exposure of the techniques we use to collect intelligence; disclosures of classified information that have given terrorist groups a better understanding of how we collect intelligence; and terrorist groups’ innovative and agile use of new means of communicating, including ways which they understand are beyond our ability to collect. FBI Director James Comey has spoken of the challenges that we face with end-to-end encryption.
Second, while we’ve seen a decrease in the frequency of large-scale, complex, even multi-year plotting efforts, we’ve seen an increase in much more ubiquitous, more rapidly evolving threat or plot vectors that emerge simply by an individual being encouraged to take action and then quickly gathering the resources needed and moving into an operational phase. This is something I would tie very much to the modus operandi of ISIL-inspired (Editor’s Note: also known as the Islamic State or ISIS) terrorists. The “flash to bang” ratio in plotting of this sort is much quicker and allows for much less time for traditional law enforcement and intelligence tools to disrupt or mitigate potential plots. ISIL has figured this out. Individuals connected to ISIL have understood that by motivating actors in their own locations to take action against Western countries and targets, they can achieve the kind of effect they want politically. In terms of propaganda and recruitment, they can generate further support for their movement without carrying out catastrophic, mass-casualty attacks. And that’s an innovation in the terrorist playbook that poses a great challenge.
CTC: There has been a large rise in the volume of jihadi social media. How do you adapt to cope with this new environment and keep track of it?
Rasmussen: Well, first and foremost, we’re devoting a great deal more effort to analyzing and assessing what we call PAI, publicly available information, that potential terrorist actors may be putting out that is available to anybody who has the capability to monitor social media. That is a paradigm shift for many in the Intelligence Community. I can remember previous instances in which we’ve looked at particular terrorism incidents or events in which we have focused almost exclusively on clandestinely collected intelligence, either signals or human intelligence collected by one of our Intelligence Community partners. That is no longer the primary way of doing business as we think about plots. There will always be a critically important role for traditional intelligence, but we need greater capability to monitor huge volumes of social media information and to make sense of that information in real time so that we can enable the operational agencies—here in the homeland, that would be FBI, and overseas, CIA and DoD—to turn it into actionable intelligence. I would not argue that we are anywhere close to being as adept and agile yet at that task as we need to be. Just the sheer volume of threat information that we see every day in social media communications suggests that we need to increase our capacity to make better use of this information.
CTC: And it’s difficult to tell who’s just sounding off and who’s a true threat.
Rasmussen: Exactly. Carrying out mitigating and disruption activity involves resources, and you cannot throw resources at every social media claim, tweet, or utterance you see. But at the same time, you have to quickly determine whether there is capability behind the words. One of the things we’re challenging our analysts to do is to try to move more quickly to the phase where we’ve identified a specific individual and then we can make an assessment about that individual’s capabilities that will help law enforcement and intelligence agencies prioritize their resources to monitor and disrupt those threats.
CTC: But the concern is if they’re going dark to some degree, then you don’t see the whole picture.
Rasmussen: Yes, and you’ve identified the very same set of problems we’ve identified as an Intelligence Community. We’re deep in the process of confronting that very challenging problem now. I wish we had better solutions to that problem of going dark than we currently do.
CTC: This special issue of the CTC Sentinel focuses on the evolution of the al-Qa`ida threat. How do you view the current threat from al-Qa`ida and its affiliates?
Rasmussen: With all the media focus on ISIL, what’s sometimes lost is that we still view al-Qa`ida and the various al-Qa`ida affiliates and nodes as being a principal counterterrorism priority. I’m reluctant to tier the priorities in a way that would in any way downgrade al-Qa`ida in favor of greater focus on ISIL. That’s sometimes lost a little bit in the public conversation right now. When we are looking at the set of threats that we face as a nation, al-Qa`ida threats still figure very, very prominently in that analysis.
Starting in South Asia we’ve clearly achieved a tremendous degree of impact in degrading core al-Qa`ida’s ability to carry out significant, large-scale attacks aimed at the West. The steady attrition of al-Qa`ida senior leaders has put more and more pressure on the few that remain, and yet we believe we have both constrained their effectiveness but also constrained their ability to recruit, train, and deploy operatives from their safe haven in South Asia. None of that means that the threat picture from South Asia from the core al-Qa`ida resident in the tribal areas of Pakistan or in eastern Afghanistan has been eliminated entirely.
Now, as you try to assess what may happen a few years down the road as the U.S. military and intelligence footprint in South Asia becomes smaller as a part of the drawdown in Afghanistan, as intelligence professionals we’re left trying to understand what level of risk we may face over time that al-Qa`ida may regenerate, find renewed safe haven, or be able to restore lost capability. It’s my view that we will retain sufficient capability to be able to place sufficient pressure on that core al-Qa`ida network so that that won’t happen. We will, as an Intelligence Community, be very much on the alert for signs that that capability is being restored, and I think we would have adequate ability to warn against that should we find ourselves trending in that direction. All that said, I’m still not ready to declare core al-Qa`ida as having been defeated in the classical sense of the word where the capability has been removed.
Al-Qa`ida will remain a threat as long as they have the potential to regenerate capability. The other interesting feature of the South Asia landscape with al-Qa`ida is the increasing competition between extremist actors within South Asia itself, between and among the Taliban, ISIL’s branch in South Asia, and al-Qa`ida. So that’s an additional factor that we’re still trying to understand. On the one hand, you look at any conflict among your terrorist adversaries as being potentially a good thing as it distracts them from their core mission of plotting attacks against Western targets. On the other hand, it introduces a degree of uncertainty into the terrorism landscape that raises questions that I don’t think we have answers to yet. It’s something that we’re going to be watching very closely.
Turning to al-Qa`ida affiliates, with al-Qa`ida in the Arabian Peninsula (AQAP), the ongoing conflict in Yemen, and the lack of robust U.S. presence in the country, significantly complicates our ability to carry out counterterrorism operations inside Yemen. When we don’t have the same intelligence, military, and diplomatic footprint in a country that we traditionally have had, we are disadvantaged. That said, I think in recent months we’ve still been able to achieve some degree of success in disrupting significant AQAP targets. I think we would all feel much better, however, if we were able to achieve a resolution to the political conflict in Yemen. With a fully functioning Yemeni state we could, once again, count on being able to have traditional liaison relationships to train, advise, and assist activities on the ground under DoD direction aimed at empowering our partners inside Yemen. All of that is a much more difficult and challenging enterprise right now. I think we’re all hoping over the coming months that there’ll be some move towards a restoration of the status quo ante in Yemen, at least politically, so that we can get back to a more stable counterterrorism platform there.
CTC: Is there consensus that AQAP is growing in strength?
Rasmussen: There’s no doubt that AQAP has taken advantage of the political turmoil and the conflict going on in Yemen between Yemeni government forces and Huthi forces. There’s no doubt that AQAP has taken advantage of that and feels less pressure in large areas of Yemen than it felt at an earlier stage. That said, AQAP is an active participant in the fight on the ground in Yemen, and that is shaping AQAP’s domestic strategy as they try to engage on the ground against what they feel are enemy forces inside Yemen. However, AQAP in the past has effectively planned external operations during times of internal conflict. So even if the larger AQAP group of terrorists is heavily engaged in a conventional military conflict on the ground in Yemen, we still worry very much about that small set of actors who are focused on external operations.
CTC: Including Ibrahim al-Asiri and aviation targets?
Rasmussen: Yes.
CTC: And what is the concern about the Syrian al-Qa`ida affiliates?
Rasmussen: In Syria, we’ve been worried for some time now about the group of al-Qa`ida veterans who have taken up refuge in Syria. They brought to the conflict in Syria a set of skills, contacts, capabilities, and experience that could cause problems for us in a number of ways. First, it would advance the efforts of extremist groups like Jabhat al-Nusra inside Syria and advantage Jabhat al-Nusra in the conflict. We remain concerned that this set of actors had a particular interest, over time, in developing the capability to carry out external operations either aimed at Western Europe or potentially U.S. targets as well. This ultimately led to the U.S. decision to carry out military action inside Syria aimed specifically at degrading and disrupting the external operations capability of the so-called Khorasan group. We have had some success in mitigating and disrupting the external ambitions of those particular al-Qa`ida-linked individuals operating in Syria. But I wouldn’t by any means argue that the job is complete on that front. We continue to be concerned and to watch, along with our partners, for signs that plotting is advancing.
CTC: Are there indications Khorasan is providing specifically tailored bomb-making training to Western extremists—like al-Qa`ida did previously in the tribal areas of Pakistan—so they can be sent back for attacks in the West?
Rasmussen: Without getting into the specifics of intelligence, what I would say is we know that among this Khorasan set of actors there are individuals with specific terrorism-related skills that cause us great concern. I wouldn’t want to necessarily compare it to the kind of plotting that was emerging out of the Federally Administered Tribal Areas (FATA) or emerging out of Yemen under AQAP’s auspices other than to say that again, we are very careful to monitor particular individuals who we know have particular skills and their ability to pass and share these skills with other actors.
CTC: What is the assessment of the relationship between the Khorasan group and Jabhat al-Nusra?
Rasmussen: It’s a complicated story. What you have are actors who are playing multiple roles in the environment in which they find themselves. In many cases we believe these individuals that we are identifying as the Khorasan group play a role alongside or as part of Jabhat al-Nusra in carrying out action inside Syria to advance the goals of the opposition in Syria against the Assad regime and against ISIL. At the same time, this is a self-selected group of individuals who also have designs beyond the Levant, beyond Iraq and Syria, and so in a sense I look at them as being individuals capable of playing a multitasking role of having more than one agenda, and of having the sufficient capability to work along multiple lines of efforts. Membership in these particular organizations is not always a clean, distinct, or definable proposition; we are often left to assess how the leadership of these various groups actually interacts. Again, as I talked about earlier with respect to Yemen, we continue to be significantly disadvantaged. In Syria, we are not physically present on the ground and not able to collect the kind of intelligence that we have typically collected in places where we’ve had a much larger physical presence. That makes the challenge of putting the pieces together on the threat emanating from Syria all the more difficult.
CTC: Switching to the threat from the Islamic State, the group has a lot of territory and a lot of resources and money so there must be concern about what it could achieve if its leadership prioritized launching attacks against the West. Belgian officials tell me they believe the leadership of the group had a significant hand in the terrorist plot thwarted in Verviers, Belgium, in January. What is the concern about Islamic State-“directed” plots against the West, with the leadership sending recruits back?
Rasmussen: Your question suggests a framework that we have used for a number of years now. On one hand, there are plots directed or guided by a leadership cadre of an organized, coherent terrorist organization. And on the other hand, you have plotting or attack activity that is inspired or motivated by terrorist organizations. The suggestion is that those are two polar opposites. We’re increasingly reaching the conclusion in the Intelligence Community, at least at NCTC, that that is much more of a fluid picture than one that is characterized by polar opposites. The distinction between a plotting activity that is motivated or inspired on one end or directed or guided at the other end is blurry; so we are a bit more careful than we used to be in making such distinctions.
There is no doubt that ISIL views itself as being in conflict with the West. It is reasonable to judge that over time they will look to carry out attacks against Western targets beyond those available to them in the Levant region. The very factors you describe in your question—access to resources, both personnel and monetary resources; control of territory, which allows for the creation of a safe haven—those are the ingredients that we traditionally look at as being critical to the development of an external operations capability. We are very concerned and focused on ISIL’s trajectory in this regard. That said, at this stage, we do not have clear signs that ISIL has chosen to prioritize this line of effort over and above other endeavors that they are deeply engaged in—winning the war on the ground in Syria and Iraq, which remains, we believe, a top priority for the ISIL leadership; advancing their effort to establish provinces of the caliphate in various locations outside of the Levant region.
I would describe, as much as anything else, a “watching brief” that we are maintaining on ISIL’s external operations capability and more specifically to their interest in carrying out larger-scale homeland attacks. Certain individuals associated with ISIL have successfully demonstrated that they can achieve some level of effect with lower-level attacks carried out by individuals motivated or inspired by ISIL, people without a great deal of resources, people without a great deal of training, and so some of the political effect that ISIL seeks to achieve might be achievable in their eyes by means other than an effort to carry out a large-scale, catastrophic, external attack.
Again, I’m sure they’ve gone to school somewhat on the experience of al-Qa`ida. They know the inherent difficulty in trying to develop, organize, and ultimately execute complex plots that may take many months to organize and implement, and they understand that our collection and disruption capabilities are still very formidable. They may have reached the conclusion that it is not worth the candle at this point in their organizational history. But I don’t, for a minute, set aside concern over the potential for a larger-scale threat posed by ISIL aimed at the homeland.
CTC: And how did that plot disrupted in Belgium in January play into the analysis here on the ISIL threat?
Rasmussen: The discussion you had with Belgian officials very much mirrors what I learned from our Belgian colleagues regarding their concern about the links back to ISIL leadership inside Iraq and Syria. And that, of course, was something that we had not seen with previous ISIL-branded attacks that took place in the West. Prior to that, what we saw were instances in which individuals claimed they were doing something on behalf of ISIL and they may have had some linkage to an ISIL individual at some point in their own personal communications. But it would not have been accurate to say that ISIL had played an organizing or guiding role in pushing that attack. The Belgium experience put into play the idea that there may be an external operations agenda that ISIL leadership is interested in advancing. All of that highlights how much more we need to learn about ISIL’s organizational trajectory and strategic direction.
CTC: The NCTC has been credited with significantly improving U.S. coordination between counterterrorism agencies. You were there when it was founded in 2004 and, in your second tour, are now the director. What for you are the key contributions NCTC has made in making the United States safer?
Rasmussen: I’m extremely proud of NCTC’s role and mission as a part of the counterterrorism community. What we’ve talked about is our effort to become a center of gravity for the nation’s counterterrorism enterprise. And I firmly believe we have achieved that kind of place within our community. And I say that largely from an information and analysis perspective, certainly not from an operational perspective. Our partners across the CT community clearly have the operational lead—DoD, the CIA, the FBI.
But I think NCTC has grown to occupy a critically important role as the hub of an information and analysis architecture that serves the counterterrorism enterprise all across the country, not just at the federal level but with state, local, and tribal partners as well. The kind of challenges we faced in the period before 9/11 and certainly immediately after 9/11 in terms of sharing information, putting information into forms where it could be disseminated quickly and shared with our partners who need it the most to carry out counterterrorism responses—I think a lot of those obstacles have been removed.
What was revolutionary at the time is now taken as established and commonplace. I cannot remember the last time we had a significant disagreement within the Intelligence Community about an information-sharing issue or a collecting agency holding back on intelligence that they collected. That simply doesn’t happen anymore.
Beyond that, NCTC is playing an increasingly important role in engaging with state, local, and tribal law enforcement and government authorities all across the country to understand the threat of homegrown violent extremism and to develop appropriate responses to those threats. Increasingly, NCTC is partnering with the Justice Department, the Department of Homeland Security, and the FBI in an effort to bring as much information as possible to communities about extremism, the homegrown violent extremist threat, the process of radicalization, indicators that an individual may be moving towards violence, and potential opportunities to disrupt individuals before they reach the stage of being terrorist actors. We’re much more involved in that conversation than we were a few years ago. It’s an appropriate role for NCTC to play and it’s one I’m very proud of.
CTC: And that’s one of the ways you’ve been adapting to this change in the operating environment with the volume and the speed of social media; it’s getting more engaged with the community, sending staffers to meetings in the community.
Rasmussen: Exactly. As a counterterrorism community, we’ve realized that it’s not the most likely outcome that an FBI agent or an intelligence officer working in Washington will be the first person to identify a developing homeland plot or threat. What is far more likely is that the threat will be identified by a member of the local community, a member of local law enforcement, a member of local government, or simply a peer, family member, or friend of an individual who has become a homegrown violent extremist. They are, in a sense, the first-line responders in our effort to deal with the homegrown violent extremist problem. Our responsibility at the federal level is to empower that set of actors with as much information as we possibly can. I would argue that, as a counterterrorism community, we’re making great progress in this area, but there is a need for us to scale up our efforts; the work that we’re doing in ten cities, we should be doing in 50 cities. We are trying, over time, to increase the level of resources we devote to this effort.
Currently, I don’t think that anyone would argue that federal and local agencies are adequately resourced to deal with the homegrown violent extremist threat that we face all across the country. The effort here at NCTC is focused on providing the analytic underpinning that supports our engagement with local communities, but also having officers and analysts actually go around the country and engage in conversations, in briefings, in constructive discussions about not only the problem as we see it, but what are possible off-ramps, what are possible disruption opportunities before something reaches the point where a law enforcement outcome is the only outcome.
CTC: One of the things the CT community has struggled with is measuring effectiveness in this fight. How can we develop measurable and useful metrics to assess the effectiveness of our CT efforts? What metrics are most useful to you in determining whether the United States’ CT actions are having the desired impact on the adversary and on our security more broadly?
Rasmussen: There’s no doubt that metrics are a challenge for counterterrorism professionals. Plots disrupted, arrests made, terrorists removed from the battlefield are all raw metrics that aren’t particularly useful in assessing where you are in terms of your broad trajectory over time in trying to degrade a particular terrorist organization. In another sense, we only have one true metric and that is zero tolerance for attacks that cause loss of life.
It is difficult for us to apply a crisp, precise metric to the business of degrading a group like al-Qa`ida in the Arabian Peninsula. There are periods when we have a good feel for how much we’ve done to degrade an organization’s capability or how much we’ve constrained their ability to carry out their more ambitious external operations of the sort that we’ve seen in the past. But I would look at that more as a sine wave, as something that ebbs and flows over time.
I don’t spend a great deal of time trying to identify specific numerical metrics. The strategic documents that we all operate under as part of the U.S. government speak to desired end states. And those desired end states can be looked at pretty subjectively sometimes. I think we contribute with our analysis to that collective U.S. government picture of how we’re doing in our effort against al-Qa`ida, in our effort against ISIL. But from a narrow Intelligence Community perspective, I don’t feel that there’s a ready, tailor-made set of metrics that applies to the very important work we’re doing.
