Besides Banning Accounts, What Are Tech Companies Doing in This War on Terror?

It's fair to say that the big-data counterterrorism American intelligence agencies rely on today was built by a bunch of Silicon Valley liberals who play Xbox and bike around the office.

At 7:58 a.m. on March 22, a young Belgian man named Ibrahim el-Bakraoui and an unidentified terrorist set off the bombs they were carrying, one after the other, in the international departures hall of Brussels Airport.

The two blasts, 37 seconds apart, blew out the terminal's windows, killed 10 people and injured more than a hundred.

At 9:11 a.m., inside the Maelbeek metro station in Brussels, Ibrahim's brother Khalid el-Bakraoui set off another bomb. It went off on a train pulling out of the station, killing 20 people and injuring 106.

Besides these three suicide bombers, Belgian police confirmed that at least one more suspect escaped from the airport and one more from the metro station.

Afterward the so-called "Islamic State" issued a statement through its affiliated Amaq News Agency, claiming that Islamic State "fighters" had carried out the attacks and that anyone who crossed the Islamic State would pay a price.

Before the attacks, police had already picked up some faint traces.

Both el-Bakraoui brothers who blew themselves up had criminal records, and Ibrahim had been arrested by Turkish police in June 2015. The day before the attacks, Belgian police had raided the room Khalid rented in Brussels and found Salah Abdeslam's fingerprints there.

A week before that, Salah — the only surviving key suspect in the November 2015 Paris attacks — had been shot and wounded by Belgian police, then arrested.

When people think about governments gathering intelligence, they tend to assume that in today's world of information the government gets everywhere: phone calls, email, wiretaps, security cameras. As if no secret could survive.

But none of these clues helped law enforcement stop the attack.

Terrorists Are Far More Careful Than You Are

Back in the early 2000s, when Edward Snowden was still in school, it was already no secret that intelligence agencies listened to everything.

In the words of a 2001 report on the American program 60 Minutes, the NSA surveillance operation codenamed Echelon could already monitor "almost every electronic conversation in the world." A European Parliament report that same year noted that the NSA's routine surveillance already covered "almost all email, telephone and fax traffic across Europe."

More than a decade later, the "PRISM" program Snowden exposed again had people gasping at how omnipresent the government was. Terrorists, though, had never forgotten it.

After last November's Paris attacks, local police found a white Samsung phone in a trash can. Registered in Belgium, it had been switched on only the day before the attacks, and its one and only call record was to an unidentified number. The other phones they found were the same; one had been in use for just a few minutes. Not one of the burner phones carried the slightest browsing history or any personal information.

A hostage in the Paris attacks also noticed that during the standoff with police, the computer the terrorists were using showed "nothing but rows of lines that looked like code, no pictures, no web pages." They may have been running some kind of dedicated encryption software.

As an ordinary citizen you might weigh whether WeChat or Telegram keeps more of your business private. A terrorist trusts neither. Their fear of modern technology has in fact reached the point of delusion.

In 2008, David Rohde, a New York Times war correspondent and two-time Pulitzer winner, was kidnapped by the Taliban in Afghanistan. In A Rope and a Prayer, the memoir he published after his escape, he wrote that whenever a drone passed in the distance, the Taliban guarding him drove him indoors, because they believed the drone could recognize his face from several kilometers away.

The Taliban, al-Qaeda and the Islamic State are often drawn as savages who live in caves and fight the US military with AK rifles and RPGs. But these people who fear modern technology are not primitive. They know it well.

Rohde's kidnappers, for instance, used Google to work out how important he was and set his ransom. They found news coverage of his kidnapping during the Bosnian war in the 1990s, matched it against information about the American diplomat who had helped free him then, and concluded that Rohde was a big fish.

As for the Islamic State, it has preached through social networks with great success, which has pushed the US Defense Department to build dedicated software to track the new accounts that keep popping up.

Terrorists Have Good Reason to Worry

Terrorists have good reason to worry. Picture a scenario.

Terrorist A takes part in an attack and is shot dead. Location data from a phone registered to his younger brother B shows that B once walked into a small convenience store run by C.

Two other intelligence agencies separately find that terrorists D and E visited C's store too, at different times.

A possible meeting place for terrorists is now on the radar. That sounds easy, but when the intelligence comes from different agencies and none of these people has any direct link to the others, no human analyst is likely to notice C at all. The faint trace surfaces only when the data is pooled and computer algorithms go looking through it on their own.

The US government once tried to do exactly that.

After 9/11, John Poindexter, a retired Navy rear admiral who had been national security adviser under Reagan, led the launch of a program called TIA, for Total Information Awareness. The plan was to digitize traditional intelligence so that computers could run big-data analysis on it.

This was the new consensus among Western intelligence agencies after 9/11: information had to be shared. Britain or the US, the secretive NSA or the not-at-all mysterious FBI, the military's Defense Intelligence Agency or the utterly unremarkable New York Police Department — everyone would pour all of their information into one system and let computers look for the links among countless fragments.

TIA started badly, though. The name was far too blunt, and its head, Poindexter, had also been caught up in the Iran-Contra affair. In 2003, Congress shut TIA down.

The idea survived anyway. The people who finally built it were a bunch of Silicon Valley liberals who play Xbox and bike around the office.

In 2003, PayPal co-founder Peter Thiel, Alex Karp and others founded Palantir Technologies. These nerds nicknamed their Silicon Valley headquarters "the Shire," and the company's name likewise came out of Tolkien's Middle-earth: the palantír, or seeing-stone.

After selling PayPal in 2002, Peter Thiel was at a loss about what to do next. By 2003 he had his problem: terrorist violence was growing fiercer. Thiel got in touch with Alex Karp, an old classmate from Stanford, and tried applying the methods PayPal had used to spot online fraud to digging out intelligence on terrorist activity.

What they settled on was computer-driven big-data analysis: take in as much information as possible, then find the faint traces inside it.

Palantir got through the door fast, because its first outside money came from In-Q-Tel, the nonprofit investment arm the CIA set up.

Information You Can't Intercept, You Can Take in Person

Even Palantir's big-data network needed more intelligence underneath it.

Terrorists were already very careful, and simply intercepting their communications had become very hard. The answer was to take the intelligence directly — to overrun terrorist strongholds and seize the information.

To fight this new kind of war, the US military changed how it fought and how it collected intelligence. After 9/11, US special forces and intelligence agencies hammered out a new counterterrorism playbook: F3EAD — Find, Fix, Finish, Exploit, Analyze, Disseminate.

• Find – locate the target;
• Fix – confirm the target, then watch it further to prepare for the operation;
• Finish – kill or capture the target with special forces or a drone;
• Exploit – collect new intelligence while special forces are finishing the target;
• Analyze – analyze what was collected;
• Disseminate – share it with other agencies and allied countries, and start a new round of F3EAD on that basis. In practice, the more open this information is, the better the odds of finding the next target.

Mark Bowden, the nonfiction writer behind Black Hawk Down, revealed in The Finish, his book about the killing of Osama bin Laden, that to process data as fast as possible the US military built a dedicated data center at Camp Victory, its largest base in Iraq, at Baghdad International Airport.

Army engineers who write code for a living were also sent to train special forces units across the services in which items of intelligence value to carry away after each raid.

Everything they brought back could then be handed to Palantir. Palantir's later clients included at least 12 government agencies, among them the Defense Department, the CIA, the FBI, the Department of Homeland Security, the NSA and the CDC. The company is now valued at more than $20 billion.

Before bin Laden was killed, the Joint Special Operations Command (JSOC) had already run thousands of similar raids in Iraq, Afghanistan and Pakistan. A few units — the Navy SEALs among them — averaged a raid every night, and every raid was a chance to gather intelligence.

How much F3EAD and big data can do together shows up in how often al-Qaeda's number three has been replaced. Ranking just below the spiritual leader Osama bin Laden and al-Zawahiri, the number three ran al-Qaeda's day-to-day operations. The nature of the job meant he had to stay in touch with the outside world.

The first number three to go was 9/11 planner Khalid Sheikh Mohammed, captured in 2003. Over the next nine years, six more number threes were captured or killed.

Terrorist groups have changed in response. They no longer rely on one leader to establish authority; instead they push their values out over the internet to draw followers in the Middle East and elsewhere. Al-Baghdadi, head of the so-called Islamic State, has none of bin Laden's old appetite for the limelight.

And even though Abd al-Rahman Mustafa al-Qaduli, the Islamic State's number two, was killed in a US airstrike in the past few days, there is still no sign of a way out of the chaos in the Middle East.

Apple's Court Fight Is Part of This Too

Some tech companies, though, are making intelligence work harder — Apple, for one, which has spent this week facing the US government in court.

For the FBI and the other agencies, that one iPhone 5c is not the heart of the matter. The heart of the matter is whether tech companies have the right to keep strengthening encryption.

This time almost every tech company has lined up behind Apple, including Google, Microsoft, Amazon, Facebook and Twitter, giants with hundreds of millions of users each.

Since Snowden, American tech companies have put more and more weight on encryption and kept their distance from the US government. If Apple wins, there will be no ceiling on how far encryption goes.

Today it is the iPhone. Tomorrow it could be Android, the day after that every PC. In the future, far less intelligence will be left to seize once a raid is over.

Word is that one agency can crack that iPhone 5c given enough time. But intelligence has a shelf life. Once terrorists hear about a raid, they will obviously assume everything on hand has already been taken, and start reacting. Even if a tech company only slows decryption by an average of two hours, that can badly damage the effect of the strike that follows.

In the contest between public safety and personal privacy, the war on terror will go on.