WORKING BACK FROM “WHAT IF?”

One advantage of the technique is that it mitigates cognitive bias by focusing attention on the indicators and variables that would lead up to the event rather than focusing on the consequences of the event.

“What If analysis” is a structured analytic technique employed by intelligence professionals to think about the future. To use the technique, an analyst assumes some future event of interest has occurred and then works their way back, plotting the course of events that would be necessary to get to that future point. What if analysis is a particularly useful tool for thinking about low-probability/high-impact events. One advantage of the technique is that it mitigates cognitive bias by focusing attention on the indicators and variables that would lead up to the event rather than focusing on the consequences of the event.

This article demonstrates the use of what if analysis by examining the possibility of a terrorist attack that weaponizes, a potent narcotic whose legal use is as a tranquilizer for very large animals. In the last few years, drug cartels have begun to lace narcotics such as heroin with fentanyl and its analogues, one of which is carfentanil. Among individual drug users, the potency of these substances has led to a widely reported and tragic increase in drug overdoses. This article considers another potential danger posed by carfentanil, its potential use as a method of attack by terrorists. This is precisely the kind of low-probability/high-impact event for which what if analysis is so well suited to analyze. It should be noted that this article is not based on any knowledge that such an attack is imminent. Indeed, drug cartels would have a strong interest in not allowing carfentanil to be used for terrorist purposes, because such an attack would inevitably lead to a strong response. This case is simply used to demonstrate a technique that might be of interest to readers.

What If?

The first step is to develop the overall structure that will help develop the different scenarios. In this case, the structure will be based on different indicators of attack planning, such as material acquisition, targets involved, and facilitation platforms. These indicators would vary according to two different variables– the scale of organization of the terrorists (from large group to single individual) and their level of technical sophistication.

The various combinations of these two major variables produces four scenarios differentiated by the scale of organization and the technical sophistication of the terrorists. The next step is to develop our understanding of the commonalities and differences among these four scenarios. The scenario generation method lends itself to organizing the analysis in two-by-two matrices. Two examples of these are depicted below. The first matrix lays out the characteristics of the attack and the attackers; the second matrix highlights the implications of an attack for each scenario. In combination, these matrices help the analyst develop a brief prose description of each of these scenarios. When developing these descriptions, the analyst also considered various indicators that would accompany the attack preparations. It is important to note that some of the indicators could be associated with more than one scenario.

Highly Sophisticated and Well Organized. If highly sophisticated and well organization threat actors carried out an attack using carfentanil, some of the indicators for law enforcement could include large purchases of carfentanil via the dark web or its precursors or sources reporting the purchasing of do-it-yourself lab equipment; the purchasing of carfentanil precursors; and surveillance by multiple individuals of multiple sites. This type of attack would likely see many attackers targeting a large venue or multiple locations, possibly through aerial dispersion using an unmanned aerial vehicle or dispersal through a ventilation system. If the attack was successful, medical emergency teams would likely be overwhelmed with large numbers of victims experiencing symptoms such as respiratory distress and lethargy.

Highly Sophisticated and Less Organized. In contrast to the previous scenario, an attack by a highly sophisticated individual (or small cell) would be quite different in both indicators and targets. Even someone with expertise in the development and dispersal of carfentanil would probably be limited to a “target of opportunity” rather than an extensively planned attack. Law enforcement would need to look for an individual with the technical training, potentially in chemical warfare, though such an individual would also likely have knowledge in how to acquire the materials so as to avoid law enforcement scrutiny. In short, an attack by a lone individual or small cell would be difficult to detect, particularly if they develop the carfentanil in their own laboratory. The individual could either focus on one target or perhaps attack multiple targets over an extended period of time.

Less Sophisticated and Well Organized. The third scenario — a large terrorist group but one lacking technical sophistication — would present another distinct set of indicators and targets. In this case, it is possible that some of the attackers would demonstrate symptoms of carfentanil exposure. They would also be likely to attempt to purchase carfentanil online because they would lack the ability to manufacture it. They may also lack skill in basic operations security and so provide more indicators for law enforcement. As with the first scenario, this group might try to attack multiple venues, but would lack the ability to employ a sophisticated dispersal method.

Less Sophisticated and Less Organized. The final scenario is an individual lacking technical sophistication. This actor would be likely to purchase the carfentanil online or on the street, which would offer an opportunity for law enforcement. It is also possible that they might inadvertently poison themselves or exhibit symptoms of carfentanil exposure. Otherwise, as with the second scenario, this kind of attack might offer few indicators. The attack would likely be small scale and might be rather spur-of-the-moment based on opportunity.

Conclusion

Obviously, an analyst could easily develop additional indicators and potential targets, or different variables for generating scenarios. Hopefully, this article has demonstrated the basic what-if analysis approach. It is a useful structured analytic technique and to act as a guidepost for use by the military, intelligence, and law enforcement communities.

Nate Huber is a former FBI Supervisory Intelligence Analyst who led a team responsible for providing strategic intelligence to FBI executives regarding current and emerging threats. He left the FBI in April 2022 and is currently a Customer Success Manager with Anomali, a threat intelligence solutions provider.

The views expressed in this article are those of the author and do not necessarily reflect those of the U.S. Army War College, the U.S. Army, or the Department of Defense.

Photo Description: Potential targets of the WMD attack described by the author, overshadowed by the carfentanil molecule.

Photo Credit: Top Left: via Flickr, Center: gigi_nyc, Top Right: alex grichenko, Bottom Right: Pixabay, Bottom Left: Anirudh Koul, Overlay: Mplanine via Wikimedia Commons