Counterintelligence – the Best Defense for Critical Infrastructure

This write up is based on a presentation delivered to senior staff and commanders at USNORTHCOM, as well as the U.S. Naval Postgraduate School.

The 9/11 Commission Report stated the key failure for the occurrence of the twin tower attacks was a lack of imagination. After 11 years little has changed. Is it likely that current hiring practices, inability to connect the dots, lack of imagination, justification of rents, agency sniping and unwillingness to communicate between agencies, and, as well as other factors will put us in harms way, again. Regardless of cause the U.S. should be bracing for another terrorist attack.

On February 2, 2009 DNI Dennis Blair, in a senate hearing responded to Senator Dianne Feinstein, Democrat of California and chairwoman of the Senate Intelligence Committee, regarding the possibility of an attempted attack in the United States in the next three to six months [i.e., by the end of July]. Director of National Intelligence Blair replied, “The priority is certain, I would say” — a response that was reaffirmed by the top officials of the C.I.A. and the F.B.I. Citing a recent wave of terrorist plots, including the failed Dec. 25 attempt to blow up an airliner as it approached Detroit, Mr. Blair and other intelligence officials told a Senate panel that Al Qaeda had adjusted its tactics to more effectively strike American targets domestically and abroad.

Although there is suggestive evidence that terrorists could have control of material to construct a nuclear device or even possess suit-case style nuclear weapons procured after collapse of the Soviet Union, a great deal of attention has been focused on possible threat scenarios by DoD, DHS, FBI, CIA, and other agencies. While cutting the head off the serpent, in this case decapitating the U.S. government by exploding such a device in the heart of Washington, D.C. has merits and is worthy of serious attention, this singular type focus leaves us weak – exposed in many other areas. What is the key to detecting potential-attack scenarios – Counterintelligence?

This should come as no surprise. The adaptive nature of terrorists, due to small numbers and asymmetric methods, which they continually adapt, along with their flexibility, make them extremely dangerous. And now, to the mix of transnational terrorists, add dometic terrorists who are becoming more and more distraught with the federal government (Tindall and Moran, 2012, in press). As the reader is well aware, terrorists are also highly imaginative; despite the fact their leaders and planners are over 45 years old generally – at the other end of the spectrum from current U.S. agency hiring practices, these individuals put a great deal of thought into potential attacks that will yield best results, but attacks that, through time, have used the simple mechanisms as the catalyst, i.e., small arms, IED’s, RPG, etc (common tools). Thus far, WMD’s, while likely desired and should not necessarily be ruled out, have not been used in an attack. However, the common tools of the terrorist are more than sufficient to cause catastrophic consequences to society at large.

Imagine you are a terrorist witnessing the results of hurricane Katrina – it would be great if you could mimic such a small to mid-scale natural disaster through a conventional attack. Guess what, terrorists can come fairly close by picking the proper target, and perhaps even cause failures on a larger scale than Katrina. While terrorists generally have access to more conventional type weapons, homemade IED’s or other explosives such as C4, they also have access to RPGs and more dangerous weapons, especially bio weapons. How could they maximize their attack efficiency and results? This is something terrorists contemplate every day while planning their next assault. A terrorist could easily maximize attack efficiency by the correct choice of targets and timing using only small numbers and lack of sophisticated weaponry. Yet constantly, we see the hand of those who manage our national security overplayed through creating fear of WMD’s on U.S. soil. Let us assume Director Blair is correct, what would their primary targets likely be?

There are so many possible targets. However, those that would yield maximum failure as a result of a well planned attack would be against critical infrastructure, which is so vast all of it cannot possibly be protected, even using the 80/20 rule (20 percent of the most important assets are hardened while 80 percent receive little improved protective measures). Additionally, most critical infrastructure targets are at the edge or decades past what their life span was supposed to be. Already in a weakened state, it would require very little to cause catastrophic damage to the U.S. and its economy. As an example, Hoover Dam was made more vulnerable to attack by constructing a bypass parallel to its face. But no matter, there are much easier ways to take it out than through a coordinated explosive attack

Potential Critical Infrastructure Targets

Following are a few examples of potential terrorist targets that would be relatively easy to attack and that could potentially have major cascading failure effects. Terrorists are already well aware of them. After all, terrorists are not the poor underprivileged depicted by some pundits, but more often are trained chemical, electrical, and mechanical engineers capable and certainly innovative enough to cause catastrophic damage with minimum input – 9/11 proved this.

Example 1

Wolf Creek Dam: The city of Nashville, Tennessee, which lies along the Cumberland River, has a metro population of over 1.6 million. It is similar in population size to New Orleans when hurricane Katrina struck. Wolf Creek Dam, in Kentucky, controls flow along the Cumberland River and is about 150 miles northeast of Nashville. It is an earthen dam that has been a problem for years; almost since construction was completed in 1951.


The dam and its adjacent reservoir reside upon a heavily Karst bedrock foundation. Karst formations are large void spaces lying beneath seemly solid species of limestone bedrock. Karst formations are created when limestone bedrocks are, over time, attacked by water through natural precipitation seepage. Rain and snowmelt water contains dissolved carbon dioxide from the atmosphere, which, in solution, forms a weak carbonic acid. That acid attacks the limestone rock dissolving it, and thereby leading to the voids (empty spaces) within the rock formation. When a reservoir of 100+ feet in elevation is raised above this type of foundation, the hydraulic pressure of the water easily dislodges the cementing clays that are in the cracks and void spaces of the under-laying Karst foundation. This results in severe weakening of the earthen dam and in large amounts of seepage.

Although construction is currently underway to shore up the dam, in remains in a weakened state, a terrorist explosives attack, heavy rainfall, or an earthquake to which the area is prone, could cause far more damage than hurricane Katrina. If the earthen dam failed, the water quickly rushing through the failed area would cut a trough about 600 feet wide and 200 feet deep allowing the Cumberland River to flow uncontrolled. Moving about 40 feet per second, it would take about 2.5 days to reach Nashville, which would be buried beneath 20 feet of water. Not just portions of it, but the entire lower lying areas, significantly more in area than New Orleans during Katrina. Because the dam is also a hydroelectric facility there would be wide spread loss of power along with many other cascading failures. However, before flooding Nashville the small towns of Celina, Gainesboro, Carthage, and Hartsville would be flooded.

Using nature’s assistance for maximum impact, the best time for terrorists to strike this dam would be from March through September. Although storms occur throughout the year, the highest precipitation months are March followed by May through July (averaging over 4.4 inches monthly precipitation each month). They could attack the earthen portion of the dam which would require minimum effort or, even other parts of the dam. Heavy rainfall would reduce detectability of their presence and also erase trace evidence left behind making it almost impossible to track the terrorists.

Example 2

Sacramento Levees and California Delta Area: Sacramento has less than 100-year flood protection, the lowest of any large urban area in the nation, according to the Sacramento Area Flood Control Agency. Large portions of the 2,300 miles of levees along the Sacramento, American and San Joaquin rivers and the Sacramento-San Joaquin Delta were built by farmers or settlers as much as 150 years ago and have been little repaired since. These levees help protect the California Delta.


The Sacramento-San Joaquin River Delta is an example of an inverted river delta, one of only a few worldwide. The delta consists of myriad small natural and man-made channels (locally called sloughs), creating a system of isolated lowland islands and wetlands defined by dikes or levees. An extensive system of earthen levees has allowed widespread farming throughout the delta. The nineteenth century levee system allowed farmers to drain and reclaim almost a half million acres of the Delta, then a tidal marsh. Once the rivers were confined to their riverbeds, the peat soil of the former tidal marsh was exposed to oxygen. As the oxygen-rich peat soil decomposed and then released carbon dioxide, profound subsidence of the land resulted. Now, most of the Delta is below sea level, and a great deal of the western and central Delta is at least fifteen feet below sea level.

A report from the Army Corps of Engineers and the Federal Emergency Management Agency indicates a 60 percent chance of a levee breach in Sacramento’s fastest-growing area – halting development. A levee break would inundate (with about 12-20 feet of water) the surrounding area including the Sacramento airport. One to three breaches in the correct locations could cause cascading failures of many others.

Adjacent to these levees is the California Delta. Land subsidence renders unstable the Delta’s system of protective levees, instigating levee failure and subsequent flooding. Land subsidence also allows saltwater intrusion into the Delta, which is compounded by water diversions that remove 40 percent of the freshwater flowing into the Delta.

Another part of the problem is Clifton Court Forebay (CCF), an artificial lake in the San Joaquin River Delta of Contra Costa County, California, 17 miles southwest of Stockton. The reservoir was created in 1969 by inundating the 1,000 ha (2,500 acres) tract as part of the California State Water Project, and serves as the mile zero intake point for the California Aqueduct for conveyance to Southern California, and feeds the Delta–Mendota Canal to recharge San Joaquin Valley river systems. If the levees break, salt water would be pulled south flooding CCF with 300 billion gallons of salt water, which provides water for 23 million Californians to the south via the 440 mile long aqueducts down to the Los Angeles area. Clifton Court Forebay would be forced to shut down and operate on freshwater reserves. An ensuing water rationing could perhaps stretch reserves for 6 to 12 months, but for drinking only, all agriculture and industry would cease. However, the delta would not return to normal for 2 to 3 years, which could leave southern California a wasteland as all water users would be forced to significantly reduce water use. Because agriculture and energy are the largest water users the results would be dire. Terrorist attack or not, there is a 66 percent chance of levee failure within this decade via natural disaster, i.e., earthquake. A 6.7 earthquake in the right area would cause catastrophic failure of this system. Further, given the current state of the California economy, the state would certainly be plunged into bankruptcy causing widespread debilitating economic effects across the nation.

About $70 billion dollars have been proposed by Governor Schwarzenegger to strengthen the system. However, with California’s current budget deficit it is unlikely a solution to the problem with be forthcoming in the near future, leaving the entire area significantly vulnerable and at risk to a terrorist attack or an earthquake.

The time at which the system is most vulnerable is from January through March, the wet season, which averages over 3.5 inches per month declining rapidly in later March. The levees would be most at risk of collapse during this period; it is also a vast area and difficult to protect with guards, gates, and guns.

Example 3

Delaware Aqueduct: This aqueduct conveys water from the Rondout Reservoir through the Chelsea Pump Station, the West Branch Reservoir, and the Kensico Reservoir, ending at the Hillview Reservoir in Yonkers, New York. This feed forms the bulk of New York City’s drinking water supply. It was constructed between 1939 and 1945, and carries approximately half of NYC’s 1.3 billion U.S. gallons per day water demand. The Delaware Aqueduct leaks up to 35 million gallons per day. At 85 miles long and 13.5 feet wide the Delaware Aqueduct is the world’s longest continuous underground tunnel. Although New York is in the process of strengthening and rebuilding portions of the aqueduct, it remains vulnerable.


The aqueduct is actually three distinct pressurized tunnels through bedrock, built from 31 vertical shafts at depths from 300 to 1,550 feet below the surface. One of these tunnels, the Rondout-West Branch Tunnel (RWB Tunnel) conveys water from Rondout Reservoir in Ulster County, New York, under the Hudson River to the West Branch Reservoir in Putnam County, New York. The RWB Tunnel is the Delaware Aqueduct’s centerpiece.

The aqueduct leaks so badly that there has been a severe problem, via a process called capillary rise, into homes (basements) and yards for years in the town of Wawarsing. There is no system providing any redundancy, as is the case with the previous two cases, to the Delaware Aqueduct, which means that if the water was drained from the Delaware Aqueduct’s water tunnels in order to fix the leak or, there were a terrorist attack, there would be no other system to carry the Delaware Aqueduct’s water to New York City – New York’s water supply would be cut in half.

The average flow rate is about 2.9 m/s or 6.5 miles per hour thus, water released from Rondout Reservoir would take about 16 hours to arrive in New York City. The aqueduct could be a perfect conveyance system for submerged canister-type bombs filled with either explosives or bioagents. Canister bombs (floating bombs) capable of carrying 15-20 kg of explosives could be released into the aqueduct and timed to explode at certain locations – the buoyancy of these types of explosives can be adjusted so that they float a specific distance beneath water surface – simple yet effective. Other explosives devices could also be used with little logistical problems in terms of planning, transportation, and implementing an attack. These type devices are not unlike a self-propelled Autonomous Underwater Vehicle (AUV) such as the ULIISYS that was used for Underwater Linear Infrastructure Investigation System and removed 16 hours later near the West Branch Reservoir in Putnam County to survey leaks and damage to the aqueduct.

Weaker areas with the potential of creating the most damage would of course be where the aqueduct is leaking heavily. Specifically, two leaks in the Rondout-West Branch Tunnel, located at Wawarsing and Roseton, already threaten the aqueduct with significant water loss and catastrophic collapse and yet, there are others as well. Collapsing this aqueduct, especially in several locations would cut off half of New York City’s water supply for months. The population of New York City proper is 5.3 million; the population for New York City metro areas is 19 million. The 2003 NYC blackout caused $10 billion in damages thus, one could imagine the consequences of such a collapse that would deny water supply for several months or more.

The aqueduct flow is constant throughout the year; a terrorist strike could occur at any time and conceivably coincide with a multiple attack scenario across the U.S. Additionally, New York is a very diverse and mixed culture populace which would allow terrorists, domestic or transnational, to easily blend in, escaping immediate or obvious detection.

Other Examples:

There are literally hundreds of examples that could be listed. The electrical power grid would be a prime target. Even discounting computer hacking the U.S. power grid is one of the most vulnerable in the world and susceptible to a multiple array of cascading failures that would be compounded from other critical infrastructure sectors. As an example, a key target is located in the western U.S. and is unprotected. Destroying or damaging it significantly would cut off power supply to 8 western states.

The August 14, 2003 blackout was caused by a short circuit of a power line that was short circuited tree limbs in Ohio. Power was rerouted through older stations with insufficient capacity. The resulting overload caused cascading failures in which 6 states, including New York City, in the U.S. and Ontario Canada lost adequate power for 2 to 2.5 days. Electricity makes modern life possible, from pumping and treating of water to every modern convenience and necessary ones that drive our economy. Without the grid, the U.S. would technology be pushed back to the 1890s so, don’t throw your books away just yet.

Other prime targets are water systems. Some commentators believe that risks to water systems are small because of the logistics required to introduce sufficient quantities of agents to cause widespread harm. However, this threat reduction is too sanguine, as the relevant characteristics of a biological agent’s potential as a weapon include its stability in a drinking water system, virulence, culturability in the quantity required and resistance to detection and treatment. Depending upon the chemical or biologic agent used, this benign assessment of logistics is not only untrue; it is misleading and can result in catastrophic failure. Terrorists already possess the necessary agent for this. The potential targets mentioned are a mere sampling; the actual supply of targets is almost limitless and would do far more damage than a suicide bomber wearing a vest in a movie theater or other crowded location and result in much less chance of the terrorist being detected and captured.

Why Counterintelligence?

Having served in various private sector positions including Chief Technology Officer, a position where I built a competitive, business intelligence group, I would like to address CI from a private sector view point.

Let us note the following facts:

Terrorists already have in their possession the bio-agent for a successful attack. The effects would be catastrophic. Lake Meade that is controlled by Hoover Dam and supplies drinking water to 22 million people, the Delaware Aqueduct that provides 50 percent of the drinking water to New York City, and multiple other systems would be easy targets and serve as adequate examples. Additionally, transnational terrorists are apparently committed to aiding domestic terrorists if you consider this video has merit (Kuwaiti Professor Abdallah Nafisi):
There is neither sufficient manpower nor resources to protect these large systems. Counterintelligence is likely our very best tool, coupled with other forms of intelligence. Time is on the terrorist’s side; enough planning will almost always result in success thus, penetration of terrorist groups and related counterintelligence functions will be our shortest and best pathway to success. But this can only occur if U.S. intelligence agencies cease arguments about who should run domestic intelligence and whether or not there should be a dedicated domestic intelligence agency.
A comparative analysis indicates that eight terrorists could carry out three of the attacks listed above for about $500,000 USD, perhaps much less since this price is based on black-market costs for explosives and other necessary equipment. Given current terrorist tactics, they could plan and carry out such an attack completely undetected.
From a business perspective these issues would play havoc with the bottom line, likely rendering a single firm bankrupt – dependent upon the firms industry.

Rather than using the term counterintelligence, preference lies with the business term competitive intelligence because it better delineates needs in terms of inputs versus return on investment (ROI) used in the private sector. While federal CI is concerned about national security, the focus is more on gathering intelligence, after that, agency sniping, being on the defensive, ignoring analysis, lack of adequate training, poor hiring practices, and other issues take its toll on a very great group of people in the lower echelons who do the heavy lifting, only to pass the intelligence up the ladder to those incapable of making decisions for the majority, but instead focus on pecking orders and parking spots (Robert Baer, former CIA).

In the private sector, the business approach is always focused on ROI thus, we are always seeking ways to improve; one of the best ways is competitive intelligence. As an example, due to the bottom line, private firms will seriously study operational and continuity costs related to the firm and resulting consequences. The August 14, 2003 northeast U.S. blackout illustrates this clearly. The cost of that black out to the U.S. economy was about $7 to $10 billion over a total fluctuating outage period of 72 hours.

Although the cost of the blackout would not by itself prove devastating to the U.S. economy, it could very well prove so to a single firm. Thus, from a business perspective, which should be carried over into a federal one, it is important to understand that a terror-induced blackout could prove significantly more costly and have debilitating impacts on the affected region as well as the entire country. As the economy tries to recover from recession, a sabotage-related event that could affect such a large area of the country could also significantly increase the cost burden and prove fatal to recovery. The smaller the business firm, the more devastating the consequences could be.

Some of the added costs from a terrorist related transmission grid attack would be damage to equipment resulting in greater repair and time costs and also a hangover effect. The latter could be and issue like an economic burden borne by the tourism or other industry as people become nervous and avoid travel. The airline industry is a good example. It took 5 years after 9/11 to reach pre 9/11 passenger numbers. Thus, such an attack could lead to higher hotel, airline, and other service industry costs. From a private sector view point, interdependencies would be carefully scrutinized utilizing risk assessment, vulnerability analysis, and comparison to ROI. As an additional example, destroying the transformers at an electrical power plant that controls flow to the transmission lines with and RPG would require 3-6 months minimum for repair.

Therefore, the need is even greater for critical infrastructure assets and ways to improve security and reliability, particularly in regard to continuity of operations. A partial list would include (1) understanding the level of interdependency between infrastructures; (2) the need for increased redundancy; (3) identification of critical equipment stockpiles; (4) understanding co-linked technologies; and (5) analysis of risk faced due to critical failures. However for the private firm they should be a part of the security convergence process. As a note, counterintelligence or competitive intelligence should not be confused with security; the two are distinctly separate, but should be converged for economy of scale and efficiency. There is also the component part of systems thinking, which takes about a decade to learn well and that presupposes the individual knack to pick it up. Currently, DHS and other agencies responsible for these systems have almost no skill sets in these areas thus; we remain, using the old adage, behind the eight ball.

When a private firm therefore studies competitive intelligence (think counterintelligence as a fed for a comparison), one of the inherent problems is ensuring that the information obtained can effectively drive company change that will:

Strengthen your competitive position with an existing product
Discover new markets for that product
Create new products to meet unforeseen needs.
What does this mean? If CI is not producing revenue or leading to the revenue path, it may not be as worthwhile as believed. But, there is confusion in the federal sector because the results from professionals in the service actually do the same thing. They produce intelligence, i.e., a product, to protect national-security interests. If an attack is thwarted, there is a great economic savings. Metrics can determine how much and illustrate clearly related involved issues. This is also a good way to communicate the advantages of CI.

The second problem in the private sector, similar in some regard to the federal sector, is attempting to convince change agents, i.e., senior management, that the intelligence should be used to create business change. This is a very widespread problem that causes both companies and the federal government to under-leverage their CI efforts. Too often, the intelligence is judged as trivial. Was this the case with the Christmas-Day bomber? If intelligence confirms something that an executive already knows, the information can be quickly devalued and dismissed. If the intelligence shows something unexpected, too often it is dismissed because some executive knows better than a CI analyst. This is a problem in hiring, especially in the federal sector where jobs are given to young inexperienced personnel that ultimately initiates a lack of trust up the management chain. This problem is a minor issue in private firms.

We have gotten ourselves into the trap of “how to gather CI issues” which we already have much expertise. The concentration should be focusing on making CI relevant, getting it noticed, and meshing with senior management needs or, in the case of the federal groups, national security needs. The prime areas of private sector CI focus include:

Strategic internal position of CI
Resource Allocation
Understanding and meeting senior management needs
Ensuring success – promoting your department would be good
Vehicles for communicating CI
Establishing metrics, i.e., measurable objectives or, ROI.
If the above private sector focus is compared to the six major challenges of the Director of National Intelligence regarding CI, there is a similarity:

Integrated threat perception – changing governance/policy, skills, etc.
Clear doctrine to drive change – requires extensive resource allocation
Allocate more resources – greater role of analysis
Break down agency barriers – vehicles for communicating CI
Technology and methodology – ensure success
Embed respect – can be done by developing metrics, i.e., show and tell.
The goals for improving CI therefore, whether for federal or private business, are similar in many respects. Too many areas need to be addressed however to adapt broad change at once. The best starting point is likely in the hiring process. In the private sector the employee is the most valuable resource and has an edge over the feds in this area. For example, in the private sector a good manager will seek broadly across the country to find the very best, give them the tools to perform their job, let them know what is expected of them and hold them accountable. Because of the basic process, a better trust of personnel is fostered more quickly. Comparatively, federal agencies rarely look outside the DC metro area, but nabs the closest warm body who generally has narrowly focused or singular skill sets, is unable to see the broad picture, receives little or no training (the CIA, DIA, NSA, and NGIA are exceptions), and are not held accountable.

One could argue that newer federal personnel (according to outgoing CIA, DIA, and DHS professionals) care more about mortgages and parking space pecking order than about the national security interests of the United States. They have cited examples that despite the many personnel hired in these and other agencies, the vast majority are too young, lack experience in their positions, and have an inability to be ‘creative’ in the right way, i.e., due to minimal experience. They surmise that current hiring practices may be the cause and lead to success of a catastrophic attack. Are Homeland Security and the Intelligence Community destined to repeat the errors of the dot com era? During that time many firms hired the very young for top and mid-level managers – they had little business or work experience. The result was thousands of firms ending in complete failure and bankruptcy according to Department of Commerce studies. Are our intelligence agencies following this same failed model?

It should also be noted that if imagination was considered the key failure for 9/11 then, we continue failing since imagination is necessarily limited with limited experience in a narrow niche. As an example, according to Bantam Books, the best novel writers are over 40 years old – they are more credible to their audience, have more experience with life and are more, not less creative than young writers. Because a private firms (such as Bantam Books) focus is on the bottom line, their perspectives for hiring, as it were, are considerably different than for an agency such as DHS. It is not about hiring a warm body, but about finding and developing skills that see the broad scope. In the private arena a life-long learner continues earning interest and dividends for the firm rather whereas dumb and yes personnel earn little past the first 3 years. Hiring is but a small tip of a colossal ice berg of problems in CI. Overall improvement is needed.

Regardless of what is done to improve CI, it remains the primary key to thwart the next terrorist attack against critical infrastructure, which is coming. Perhaps within the next 3 to 6 months as DNI Director Blair stated. A narrow focus on one piece of the puzzle is insufficiently to view the broad scope and necessary strategy for problems at hand. This will ultimately create CI failures that could lead to a catastrophe.

Perhaps the feds should rename counterintelligence to competitive intelligence because CI still remains a relatively undeveloped concept in either theory or implementation; it is also controversial, poorly executed, and poorly understood. Thus, while it may be the best tool to protect critical infrastructure, is the capacity present to connect the dots? Counterintelligence must be coupled with other intelligence; we need a bold, intelligence-based offense to be successful. What we now have falls short of the strong, yet integrated offense that is needed. Counterintelligence must think big to see big, but also have the capacity to drill down to the weeds and yet, resist the urge to remain there! A Picasso is best viewed as a whole, not through a microscope.

Finally, critical infrastructure should not be solely thought of as within U.S. borders since there are many potentially valuable targets outside U.S. borders in terms of the far-reaching activities of American business commerce and industry such as commodity supply lines – not unlike the ship supply lines during WWII that were attacked constantly by German U-boats.