Thwarting an attack before it takes place

How is it that the Shin Bet manages time and again to in identify the individuals and organizations involved in terrorist attacks so quickly?

Nadav Argaman, the man named to head the Israel Security Agency (Shin Bet) (photo credit: Courtesy)
Nadav Argaman, the man named to head the Israel Security Agency (Shin Bet)
(photo credit: Courtesy)
This week, the Shin Bet made it public knowledge that it had located the culprits responsible for two separate serious terrorist attacks that took place in recent months. The first incident involved Hamas’s organizing of east Jerusalem and Bethlehem residents who were behind the attack on an Egged No. 12 bus in the capital on April 18. The second incident took place just a few weeks ago on the evening of Remembrance Day and involved two minors from east Jerusalem who stabbed women in the city.
How is it that the Shin Bet manages time and again to in identify the individuals and organizations involved in terrorist attacks so quickly? How does it uncover such a tremendous amount of information? These successes most certainly do not occur by chance. It’s extremely rare that security forces succeed in foiling a terrorist plan as a result of information they just happened to come upon. The Shin Bet succeeds in gathering excellent intel because it invests extraordinary amounts of energy and time in training its agents and planning its strategies over long periods.
The Shin Bet’s primary mission is to thwart terrorism before it takes place. National security is achieved by engaging in espionage and political subversion. The security service’s first ambition is to prevent terrorist activities, spying and political subversion before they occurred or caused serious consequences of acts against national security. Many times, Shin Bet operators succeed in infiltrating terrorist cells and preventing an attack from being executed in the first place. Although such activity is not generally reported in the media, it takes place on an almost daily basis.
The Shin Bet faces a number of complex challenges.
Unfortunately, there are times when the agency does not succeed in preventing an attack. Oftentimes when an individual who is not connected to any terrorist cell or organization decides to carry out a “lone wolf” attack, in these cases the Shin Bet has no way of accessing intel that could have helped predict the occurrence of the attack. And yet, when a terrorist attack does take place, Shin Bet operators immediately begin collecting information about the perpetrators and then do everything in their power to bring the individuals responsible for the attack to justice and to break up any organizational activity so that future incidents cannot occur.
The moment an attack takes place, the Shin Bet immediately sets into motion all the teams that work together to gather intel, and they work around the clock until their mission has been accomplished.
Each incident receives its own code name and all the relevant information gets channeled electronically to the agents involved in the mission.
In this way, the organization operates extremely efficiently and with complete transparency at all levels.
The first step is to commence an investigation on the ground. Agents collect evidence, sweep the crime scene, identify the variables, and collect all forensic evidence. Next, forensic experts carry out any tests necessary in their labs, and agents investigate further until the identity of the perpetrators has been uncovered.
Shin Bet operators speak with all eyewitnesses and suspects, and make great efforts to clearly identify terrorists’ modus operandi prior to the attack and where they come from.
This gathering of intel at the scene of the crime is of paramount importance.
For years, the Shin Bet has been building up its HUMINT database (intelligence gathered by means of interpersonal contact) which is capable of providing information about specific surroundings that helps to prevent incidents from taking place, as well as to solve cases after the fact. Because of this HUMINT database, Shin Bet agents are able to identify signs of suspicious activity.
Of course, the Shin Bet also heavily relies on SIGINT (signals intelligence) when carrying out investigations.
Israeli forces have the most up to date technological tools that help them process a crime scene and build a primary suspect sheet.
The professional coordinating desk, which receives, analyzes and disseminates all the information, knows how to process an incredible number of details and draw a greater intelligence picture. It then makes decisions and sends teams into specific locations in order to further their investigation.
The coordinating desk is extraordinarily experienced at locating previous intel that is relevant to the current case, which helps create a clearer picture of the situation. The desk’s database is constantly being updated with more information, from both HUMINT and SIGINT.
In most cases, Shin Bet officials are able to identify within hours a specific location and initial suspects or individuals thought to be involved in the planning of an attack. Assessments are carried out often, so that any changes can be made to the plan as the investigation progresses.
The main idea is to reduce the list of suspects to a minimum so as to minimize the investigative circle as much as possible. By focusing in this way, Shin Bet operators are able to properly interrogate suspects and achieve results in a timely manner.
During these interrogations, Shin Bet operators are not just trying to thwart a specific attack, but also to gather as much general intel as possible to add to their database so that it can be used in the future. They aim to understand the bigger picture of how the terrorist cells are put together and what their plans are for the future.
The coordination between the Shin Bet operators, technology experts, and desk coordinators is continuous and fluid. Intel gathering takes place through computers, agents in the field, interrogation of suspects, and discussions in the situation room.
Updates are sent out in real-time to relevant parties, including in certain situations the head of the Shin Bet, enabling quick decisions and flexibility during arrests, interrogations and field operations.
The secret to their success lies in the Shin Bet’s ability to synchronize the actions of each branch of the organization, to rapidly build a report from all the little pieces of intel gathered, to bring together Shin Bet operators with senior officials and desk operators so that the interrogations can take place quickly and professionally.
All of this takes place in the hope that they will succeed in thwarting a terrorist attack before it takes place.

The writer is a former brigadier-general who served as a division head in the Shin Bet (Israel Security Agency).
Translated by Hannah Hochner.