Assistant Commissioner for Intelligence Analysis Rebecca Ulam Weiner manages counterterrorism and cyber intelligence analysis and production for the New York City Police Department’s Intelligence Bureau. She is one of the principal advisors to the Deputy Commissioner of Intelligence and Counterterrorism and she shares responsibility for Bureau-wide policy development and program management. Assistant Commissioner Weiner coordinates and integrates intelligence analysis and operations and represents the NYPD in matters involving counterterrorism and intelligence. She was the first local law enforcement representative to the Office of the Director of National Intelligence’s National Intelligence Council, in the Office of Transnational Threats. She also served as Legal Counsel to the Intelligence Bureau’s Intelligence Analysis Unit and as Team Leader for the Middle East & North Africa, overseeing intelligence collection and analysis related to threats associated with those regions.
Director of Counterterrorism Intelligence Analysis Meghann Teubner oversees strategic and investigative analysis for the New York City Police Department’s Intelligence Bureau. In this capacity, she directs intelligence analysis and production on terrorism developments and trends around the world and potential threats to New York City in support of NYPD leadership as well as the counterterrorism missions of public and private law enforcement and security partners. Prior to joining the NYPD, Director Teubner was an analyst and senior representative with the National Counterterrorism Center (NCTC). As NCTC’s representative based in New York, she ensured the integration of effort between NCTC and its federal, state, local, and tribal partners in the northeast region, facilitating information sharing and collaboration in support of all partners’ counterterrorism missions. As an analyst in NCTC’s Directorate of Intelligence, Ms. Teubner developed strategic terrorism analysis on al-Qa`ida-related issues and the evolution of the terrorism threat landscape.
Below is the transcript from one of the sessions for law enforcement and military personnel during the National Counterterrorism Center’s symposium in New York City
CTC: You head up counterterrorism intelligence analysis for the NYPD. What role does this play in the police department’s wider counterterrorism efforts?
Weiner: Post-9/11, then-Police Commissioner Ray Kelly created a robust counterterrorism program, housed in two bureaus: the Intelligence Bureau, where Meghann and I work, and the Counterterrorism Bureau. At its most basic, the Intelligence Bureau is charged with intelligence collection and investigations, relationship building—through 14 liaison officers posted overseas and four domestic liaisons—and analysis, all for the purpose of prevention. The Intelligence Bureau’s investigators gather intelligence in support of terrorism investigations and have disrupted dozens of terrorism threats against New York City. The Counterterrorism Bureau supplies over a hundred detectives to the FBI-NYPD Joint Terrorism Task Force, which focuses on prevention as well. These two entities work independently of one another, but collaborate and coordinate hand-in-glove. The Counterterrorism Bureau also deploys our frontline forces, the CRC [Critical Response Command] teams you see with the heavy vests and long-guns protecting key targets and the Bomb Squad. This is all through the lens of overt target hardening and preparedness, as well as response and mitigation.
The intelligence analysis components, which we oversee, are like the hub of a wheel, with all of the various collection mechanisms as the spokes. We have a team of civilian analysts and uniformed investigators whose job is to take in all the information that comes our way—whether it comes from our human sources and other investigative resources, our partners, or the public via our leads hotline—and turn it into intelligence, both tactical and strategic.
Teubner: Our intelligence products inform not only investigations but also the preparedness of the Department. If there’s an incident domestically or overseas, we’ll put out an analytic report that provides context and focuses on implications to the threat environment here in New York and that helps play into a preparedness response here. The analysts draw insight from information and expertise provided by our overseas liaison posts, who are stationed strategically in police departments across the globe. Even when we do not assess that an incident poses a direct threat to New York, we may put additional resources at similar targets locally, say, a transit hub. After an incident like the [December 11, 2018] Strasbourg Christmas market attack, we tend to deploy additional resources to send an overt message especially to New Yorkers that we’re thinking strategically and tactically about what is happening globally and how that might impact New York. And we want to make sure that you feel safe going about your day-to-day business.
Weiner: While the core mission of our unit is informing the investigators and officers that we’re partnered with about the threat landscape as it changes—which is ultimately a very tactical job at its core—it is also about informing our partners, and the public.
CTC: When it comes to the jihadi terrorist threat, how are you seeing that threat evolve when it comes to New York City?
Teubner: We’ve seen the threat evolve from al-Qa`ida, from the externally directed threat, which NYPD Deputy Commissioner of Intelligence and Counterterrorism John Miller has described as very deep, very complex, but very narrow1 to a much more diverse threat across the ideological spectrum from a range of actors with varying degrees of connectivity to groups or networks. And while the threat actors overseas became more dispersed, we saw a shift in the threat landscape via the use of propaganda—I’m thinking specifically Anwar al-Awlaki and the launch of Inspire magazine to encourage lone actors and provide specific guidance for successful attacks. ISIS took that model and exponentially intensified it through use of multiple social media platforms and range of messages to appeal to the widest possible audience.
We assess that that lone-actor threat is the most prevalent threat to New York City and will likely continue to be so. These lone actors consume extremist and violent content primarily online and on social media and construct their own narratives, which may include personal grievances, emotional stress, and violent extremism, to radicalize, to mobilize-to-violence. There is a vast amount of available propaganda, whether it’s older or repackaged al-Qa`ida and Anwar al-Awlaki messages or the consistent propaganda that we see from ISIS and the group’s sympathizers.
Weiner: We undertook a project earlier this year that looks backwards to 2001 at threats against New York City and from that projects forward to 2023—an Intelligence Estimate for New York City.2 A couple dominant themes emerged. One is what Meghann was just describing, which is a shift from externally directed plots to lone, often local actors, which really starts in 2009-2010. The second is a marked uptick in pace.
We counted 29 publicly disclosed plots against New York City since 2001. From 2001 through 2009, there were 12. Two of them were the product of lone actors, and 10 were externally directed. Since 2010, we have seen 17—14 of which can be attributed to lone actors, versus three that were externally directed. That’s a pretty dramatic flip-flop.
So far as the pace is concerned, since ISIS’ declaration of the caliphate in the summer of 2014, we’ve had 12 disrupted plots and attacks in New York City. Four of the 12 were in some respects successful. You had Zale Thompson, who attacked a group of police officers with a hatchet in Queens in [October] 2014, which was a few months after the declaration. And then more recently, [September 2016 ‘Chelsea bomber’ Ahmad] Rahimi, [alleged October 2017 ‘West Side Bike Path truck attacker’ Sayfullo] Saipov, and [December 2017 ‘Port Authority’ bomber Akayed] Ullah.
Accompanying the shift to lone actors, we see a blurring of ideology with other more idiosyncratic drivers. And often a blending of disparate, sometimes even mutually exclusive, ideologies. The idiosyncrasy of a lone actor plays out in the terrorism landscape more visibly now than it used to, and that’s because individuals leave strongly imprinted social media footprints that give us insight into the nuance of their motivations more than ever. In many cases, the violence of lone actors is justified in their minds by ideology more than driven by it. That’s why we see neo-Nazis become jihadists or [we see] black separatist extremist ISIS adherents.
CTC: Notwithstanding the attacks in late 2018 in Strasbourg and Manchester, there seems to have been from late 2017 some reduction in the threat from jihadi terrorism in Europe because of the demise of the Islamic State caliphate, the removal from the battlefield of many of the group’s external operations planners,a and perhaps, though it’s difficult to measure, because of a diminution in the enthusiasm of Islamic State sympathizers in Europe. Have you seen a fall-off in plotting activity when it comes to New York City since the Islamic State lost territorial control of its caliphate?
Weiner: No, we haven’t seen much of a fall-off, because of the rise in plots inspired by jihadi terrorist groups. And we expect that to continue in the near-term. It’s important to note that the two terrorist attacks New York City suffered in 2017 were carried out after the liberation of Mosul and Raqqa. Even though directed and enabled terror plots can sometimes involve more dangerous capabilities, we need to treat the ‘inspired’ threat very seriously—look at the Pulse nightclub attack in Orlando in 2016. You don’t need to have been trained by ISIS or to have been communicating with them to kill a lot of people using readily available weapons against soft targets of opportunity.
It is true, however, that we don’t see as many ISIS members overseas who are enabling of the kind of plotting that we saw in 2015. What you do have is consistent guidance for people to stay home and carry out local attacks. The diminution in enthusiasm plays out much more in the traveler landscape for us than in the attack landscape. People are being actively discouraged from traveling, so although the overall pool of mobilized recruits may be diminished, a higher percentage of those who remain want to carry out a kinetic attack locally.
CTC: Al-Qa`ida and its affiliates in the past few years seem to have focused more on building up its capabilities locally rather than on targeting the West. But in late December 2018, U.K. Security Minister Ben Wallace warned that, “Al-Qaeda are resurgent. They have reorganised. They are pushing more and more plots towards Europe and have become familiar with new methods and still aspire to aviation attacks.” In 2018, al-Qa`ida leader Ayman al-Zawahiri appeared to ratchet up his threat rhetoric against the United States and released an increased number of statements. A decade since the 2009 al-Qa`ida-directed Najibullah Zazi New York subway bombing plot was thwarted, is al-Qa`ida reemerging as a significant threat to New York City?
Teubner: We continue to assess [that] al-Qa`ida maintains the strategic intent to conduct an attack here in the U.S.—potentially in New York—underlined by disseminated official propaganda by the group and its affiliates. We remain concerned that the group’s legacy plotting may continue to advance despite counterterrorism pressure and the removal of al-Qa`ida and affiliate leaders from the battlefield, leaders such as Ibrahim al-Asiri, AQAP’s innovative explosives expert who allegedly died in late 2017. In recent audio messages, Hamza bin Ladin, Usama bin Ladin’s son, stated that America remains the group’s priority target and further encourages supporters to conduct attacks using any means necessary.
In 2018, we saw the formation of Syria-based, al-Qa`ida-affiliated Hurras al-Din; we assess this represents a potential external operations threat to New York City due to its composition of experienced al-Qa`ida fighters, some with connections to veteran al-Qa`ida members with a legacy of planning attacks in the West, demonstrated battlefield bona fides, and access to foreign fighters in Syria.
CTC: Switching gears, there’s rising concern on both sides of the Atlantic and particularly here in the United States about extreme right-wing terrorism. There was that terrible attack on a synagogue in Pittsburgh in October 2018. There was the car-ramming attack in Charlottesville in August 2017. When you guys get to the office in the morning, how much part of your concern set now is that extreme right-wing terror threat to this city?
Teubner: When we’re looking at the lone-actor threat, we specifically are looking at it agnostic to the ideology because what we have found is that a lot of the drivers are similar.
If you look at our numbers, we have experienced more salafi-jihadi extremism directed or inspired plots here in New York. That being said, is far right-wing violent extremism of concern to us? Absolutely. We’ve had two incidents here over the last two years of lone actors likely inspired in part by violent extreme-right rhetoric espoused online: James Harris Jackson who allegedly came from Baltimore to conduct an attack targeting African Americans in New York, specifically wanting to conduct his attack in New York to garner more attention for that attack; and Cesar Sayoc’s alleged mailing of multiple improvised explosive devices to victims across the U.S., with three specifically in New York City.
Extreme far-right and far-left networks or groups generally limit their activity in New York City to First Amendment-protected activities such as rallies and protests; however, we do assess a small number of those they inspire may conduct acts of violence in support of their respective ideologies. Our concern is that there is the same kind of echo chambers in the extreme right-wing terrorism ecosystem that we have in the ISIS and al-Qa`ida landscape, in that you have individuals that get on social media platforms, they share their violent ideology, they seek out like-minded individuals, and they radicalize and mobilize each other.
Weiner: What’s interesting about both [the alleged Florida-based October 2018 package bomber Cesar] Sayoc and [the Baltimore-based] Jackson is that they were both lone actors who allegedly chose New York as a target in order to amplify their message. Sayoc didn’t just choose New York, he chose a news organization here in the city, the media capital of the country. Jackson also specifically said he was seeking media attention in New York.
Online, we do see an increase in white-supremacist activity. And it has a different manifestation than the ISIS-inspired type, because you don’t have the formal group structure that’s at the basis of international terrorist organizations. The extreme-right environment is much more inchoate.
It’s also worth noting that neo-Nazi propaganda actually increasingly looks like ISIS or AQ propaganda, with the same slick production value, the same themes, the same aesthetic styles.
All this being said, the threat landscape faced by New York City has been dominated by jihadi terrorism—26 of the 29 plots and attacks from 2001 have been in the al-Qa`ida/ISIS directed, enabled, inspired sphere. We had one Hezbollah plot recently, too, with the arrest of Ali Kourani in June of 2017, and we are watchful over that potential threat, too.
When we say the threat landscape is diversifying, we mean across the ideological spectrum. And we assess that New York City will remain a draw for violent extremists across that spectrum.
CTC: So what I’m hearing is that still the majority part of the concern and attention here in New York City—given the metrics you’re dealing with, the threats you’re dealing with—is on the jihadi terror side of the ledger. But in recent months and years, extreme right-wing terror has become a greater concern and more analysis and resources are going into it. Would you say than ever before?
Weiner: More than ever before, absolutely. And responsive to the threat as it changes. And that’s how our program was designed to be.
CTC: Given there is a large Jewish community in New York City, presumably the Pittsburgh attack only added to your concerns?
Weiner: I would say Pittsburgh is the manifestation of a lot of our concerns rather than the initiator of them. An attack of this sort is something that we’ve been protecting against for many years. We now have evidence of why that’s been so necessary. We had the resources in place in the immediate aftermath of Pittsburgh to surge vehicles and officers and other target-hardening measures across New York City to protect the Jewish community. That’s been what we’ve been doing and training for the past 17 years in response to incidents of terrorist violence regardless of the target.
Teubner: Our investigators and analysts have also had robust engagement with the Jewish community, sharing information on the current threat environment for situational awareness.
CTC: Do you assess the threat to media organizations has gone up?
Teubner: I think that the threat to news organizations has not necessarily increased, but the threat has become more diverse. The threat to media organizations has been relatively consistent and around for a while; we saw the targeting of the Danish newspaper Jyllands-Posten and the French satirical magazine Charlie Hebdo. Part of what is likely making the threat more diverse now is the persistent and pervasive us-versus-them narrative that is playing out in the body politic of the United States and globally, which can potentially lead to radicalization when exploited by extremists to encourage violence.
CTC: And social media is creating an echo chamber for all spectrum of ideological motivation, right? And providing people with a sense that there are other people like them who think like them and might support what they might want to do, and this can propel people to action more quickly.
Weiner: I think that’s true. Organized groups and lone individuals both realize that the best way to amplify a message is to attack the media. With social media, that’s been even more easily done. In 2013-2014, we started to notice a trend that we call “dying live,” where people look to social or conventional media to livestream their acts of violence, whether directed against themselves, others, or both. There was an incident in Virginia where a newscaster was killed on camera in the middle of a broadcast. In France, a police officer was killed and his three-year-old son was on the couch while the perpetrator livestreamed his manifesto confession online. The unhappy convergence of violence and social media has created a very ripe operating environment for groups to turn up the volume.
CTC: Let’s turn to the question of unconventional threats against New York City. Back in 2003, there was an aborted al-Qa`ida plot to launch a poison-gas attack targeting the New York subway. With the rise of the Islamic State, we’ve seen a terrorist group that has used and developed chemical weapons. In the summer of 2017, we saw an alleged terrorist plot thwarted in Sydney, Australia, by a cell that allegedly not only plotted to blow up a passenger jet but also was in communication with an Islamic State controller in Syria on how to make a poison-gas dispersal device. And in June 2018 in Cologne, Germany, we saw the thwarting of an alleged plot involving an extremist who allegedly managed to make a significant quantity of ricin. The alleged Cologne plotter was suspected to be in touch with at least two Islamic State-linked figures overseas and to have received advice on how to make ricin, as well as most likely consulting an online jihadi video tutorial. Is there growing concern from your perspective over the threat that terrorists could target New York City with such types of weapons?
Teubner: There is a lot of thought that goes into this threat within the Intelligence and Counterterrorism Bureaus. Disrupted plots and arrests in the U.S., Germany, and France over the summer of 2018 highlight continued interest in conducting attacks using ricin by extremists motivated by ISIS and the group’s propaganda. We’ve seen some propaganda posters and some propaganda messages that encourage chemical, biological type attacks, and in some cases we’ve seen that direct guidance on how to make ricin which allegedly occurred in the disrupted plot in Cologne, Germany.
The guidance for how to make ricin is out there and is relatively simple. When we’re looking at this analytically, we think the best way to counter this threat is not only to track the propaganda and available guidance, but provide situational awareness for our customers, both internally and externally, for preparedness and resiliency against the threat. We prepare tactical assessment products that we push out for all uniformed members of service as well as our private and other federal, state, and local partners.
When we’re talking about the Sydney plot specifically, that’s when partnership really comes into play and our relationships with foreign partners developed by our overseas liaison officers as well as the FBI and other partners through the Joint Terrorism Task Force; it’s all vital for maintaining awareness of the overall threat environment and the plans and intentions of terrorist groups and their sympathizers.
Weiner: Within the American landscape, it’s a pretty competitive marketing environment for terror. After Sandy Hook, after Parkland, after Las Vegas—and those aren’t even ideologically driven acts of terrorism—how do you continue to up the ante to shock people and horrify them? A chemical attack has a potency in people’s imagination wherever it’s deployed that’s unique. We saw that in the U.K. with Salisbury. ISIS understands that fully. If they can do DIY to chemical weapons the way they’ve done it with more conventional terrorism tactics, that would change the playing field substantially.
CTC: It seems that the 2017 Sydney plot, even though it was a bit of an outlier, was a potential game changer because according to Australian authorities the aviation attack dimension of the plot involved the Islamic State successfully arranging for bomb components—essentially a partially constructed device—to be airmailed to the cell in Australia. I’ve referred to this new development as an IKEA-style of terrorism. Wannabe terrorists don’t need to go off and get training in a jihadi encampment overseas if they can just get the parts sent to them. The combination of people in the West willing to carry out attacks and people able to get them the bomb parts could change the nature of the threat.
Weiner: We view Australia as one of those outliers that might be an augury of things to come. Whereas the average violent extremist will still take it upon him or herself to do something a lot more readily accessible than to make a mubtakkar device, you have skilled folks out there who are able to take on this much more specialized knowledge, perhaps with the help of people overseas, and this poses a significant concern.
Teubner: The Australia plot in particular forced us to shift our thought on the threat of an external operation from ISIS, or any terrorist group; in this case a directed plot that does not involve deployed operatives but is instead extremists based in country receiving parts from overseas and possible online, remote communications. This could potentially increase an individual’s capabilities and lethality, and further challenges law enforcement capabilities to detect and disrupt by obfuscating some of the indicators of an advancing plot.
CTC: Speaking of unconventional weapons, the Islamic State has developed and used drones within Syria and Iraq as weapons. We have not yet seen a single attack in the West using drones. But there is rising concern about the potential threat that they could pose. From a New York City perspective, what is the threat assessment from your office about drones and what can be done to mitigate the threat and to protect against it?
Teubner: The same way that we would put out awareness products for ricin or terrorist incidents, we do the same for the potential for weaponized remotely piloted aircraft (RPAs)/drones. There’s a lot of work and information sharing between the analysts and the officers that are looking at this from the mitigation point of view. From the analytic perspective, we not only review reports of terrorist groups’ use of drones in conflict zones but also reports of a variety of actors, from criminal gangs to opposition groups, who have attempted to use weaponized RPAs for violence. What we haven’t seen yet from terrorist groups is the guidance for weaponization of drones, and we’re consistently looking for it.
CTC: Guidance to do it or how to do it?
Teubner: How to do it. How to weaponize a drone, how to use a drone for violent incident. We’ve definitely seen the propaganda from the conflict zone demonstrating their capability, but less so in that package of specific step-by-step guidance, in the same way that we saw guidance for vehicle rammings, knife attacks, and IEDs.
CTC: According to one counter-CBRN specialist we recently interviewed, what is absolutely vital in terms of mitigating the impact of a potential unconventional weapons attack is educating the public about the threat and that this can help prevent a dangerous stampede, or excessive panic and fear.
Weiner: Yes. We do extensive red-cell exercises, tabletop exercises, particularly around exactly what you’ve just described, which is how do you manage your incident response and marry that up with your outward-facing communication strategy. We do extensive training for just that, especially in an unconventional attack.
We have to have coordination. We have to make sure that information that is sensitive is protected, but that as much information as possible is disseminated to the public. The Department has done a really good job of toeing that line very carefully. Even if you look at what happened [on December 13, 2018] with the series of emails threatening explosions throughout the country, Bitcoin ransom demands, NYPD was one of the first to publicly say “this is our assessment of the threat. We don’t view it as credible.” We recognize the need to speak to the public early and often in the course of an incident, in the aftermath of an incident, and in preparation for the next potential incident. That helps the public be more aware and more resilient and have the trust that we know what we are doing so they can focus on living their lives.
Teubner: And we do assessments before all major events in the city. Our analysts consider the event in the context of the current threat environment, to include any recent incidents that may impact the security situation and think through the potential tactics that could be used against that event, to include CBRN. We get that assessment out to the uniformed officers for their awareness—and we also provide potential indicators of a threat that they might see beforehand. We also produce a version of that event assessment for our private-sector partners through the NYPD Shield website, so that that assessment gets out to the widest possible audience for their awareness and preparedness and also as a force-multiplier for potential early detection and disruption.
CTC: Women have played vital roles in U.S. counterterrorism efforts. You’re both in senior leadership positions at the NYPD. What is your message to women who are thinking about embarking on a career in counterterrorism?
Weiner: My deep and abiding message would be one of encouragement. The counterterrorism mission—which keeps us up at night and wakes us up in the morning—is as rewarding as it is demanding. It is important for younger women who are starting out in their careers to recognize that they have female mentors and role models, more than ever before. It is, of course, challenging, as with any other busy job where you have to balance work life with home life. But to know that the work that takes you away from your family supports a mission that people’s lives and loved ones depend on is intensely rewarding. There is no better career path, in my view.
Teubner: I agree. I strongly encourage young women to get into the field of national security, counterterrorism, and to recognize that there are different roles to play. I think that there are women that are going to want to be engaged at the very granular level, operational level, to be out in the field, engaging. And then there are women that will want to do the analysis and take a strategic look at the threat. And hopefully, as more women get into counterterrorism work, they will have role models in senior leadership and recognize that there are many different pathways to success in this field. Rebecca and I started out in different positions, and we have different backgrounds, but we ended up here working together and can show hopefully younger analysts and younger women that there [are] many different ways to break into this field. I have had the privilege of working for and with some really wonderful, smart, inspiring women throughout my career. It is a field in which there is a camaraderie that comes out of that that is, I think, hard to find in other careers. That sense of purpose is very rewarding and helps drive you every day.
CTC: What keeps you up at night?
Weiner: There are many ways to wreak havoc and import mayhem into our daily operating environment. You have your parade of terribles. At the far end of the spectrum would be a drone flying over New York City airspace that’s been weaponized by some kind of chemical agent. At the other end of the spectrum is something we have already seen and expect to keep seeing—such as a vehicle ramming or edged weapon attack. The fact is that holistically, all of these elements have to be properly resourced to provide for mitigation opportunities, and we do that. We try to make sure that we spend our days thinking about this parade so that we don’t have to spend our nights dealing with them.
CTC: What makes you sleep better at night?
Weiner: Something that really needs to be emphasized is that NYPD is unique—and particularly so among municipal law enforcement entities. It has two dominant strengths that have allowed us to understand threats as they evolve and mitigate them. First is the diversity of the Department, which became majority minority in 2006. This is unparalleled within similar agencies across the country. Second is the domain knowledge of the analysts and the investigators that support our operations—knowledge that enables us to understand cultural norms, differentiate signal from noise, and detect anomaly quickly enough to respond to it.
CTC: You’re saying it’s a police department that reflects and understands not just the city but the world.
Weiner: Exactly. And that’s a really important part of the story of what we do and all of the efforts that support what we do analytically.
Teubner: Just to build on that point—because the threat is so diverse—we recognize the importance of partnerships, collaboration, and information sharing. It builds not only a better understanding of the threat environment here and globally, but it builds resiliency throughout the community, throughout the city. Having the trust of the community is important. We want to know what the community is sensing, what they’re feeling, what they’re seeing. That’s why we stress so strongly “see something, say something.” It helps us understand what’s happening on the street in a much broader way, making us well-positioned to counter the threat. And we’re always looking to adapt and evolve.
Weiner: The threat is diverse, but so are we. The threat is dynamic, and so are we.