27.04.2017

False Start: Identifying the wrong suspect after a terrorist attack

Two hours after the bomb attack against the Saint-Petersburg subway that left eleven dead and over 50 injured, the picture of a man was circulated in various media outlets and massively on social media. He was described as the possible suspect and wanted man for the attack, although no valid confirmation could be found. Seeing himself on TV, the man turned himself in to Russian authorities to claim and validate his innocence.

While some may blame Russian media for acting too quickly, the situation repeated itself following the attack on Westminster bridge and the UK Parliament that left six dead and over 50 injured. Indeed, within hours of the attack, many media outlets, securrty experts and social media platforms claimed the attacker was Terry Brooks aka Abu Izzadeen, a man known, arrested and detained for his support of terrorism.

Terry Brooks aka Abu Izzadeen

The information that Brooks was a suspect made the rounds and even some usually reliable sources like SITE and other counter-terrorism experts shared this information, which again had no official confirmation. The problem with Brooks being the attacker was that he was in prison when it happened:

And because all good things come in threes, identifying the wrong suspect happened again following the shooting of four people on April 19 on the Champs Élysées in Paris. Again, the false accusation had hours to circulate, before the real attacker was identified and the rumour that Youssouf el Osri – who turned himself in when someone told him he was suspected – was the attacker could be debunked.

The mix of social media and terrorist attacks has always been a dangerous combination, as witnessed by the various rumours of casualties, shots heard and attackers on the loose that immediately follow an attack. It is one of the reasons why security personnel and ministers always ask their populations to restrain themselves from sharing unofficial and unconfirmed information after terrorist attacks, even imposing blackouts in some cases. This is done to limit the risk of panic and additional dangers that can occur during and after a terrorist attack.

While a certain degree of understanding can be given to the vast majority of a stricken population, whose jobs are not related to information sharing, security or counter-terrorism, no such courtesy can be extended to media, security and counter-terrorism workers who disseminate such rumours. It is simply unacceptable, regardless of the motives.

As the circulation of false suspects following a terrorist attack appears to become a trend, it is important to remind ourselves why restraint and professionalism are essential when dealing with terrorism related information.

The full extent of the attack is not immediately known

The attacks on the Boston marathon, the Bataclan in Paris, the Berlin Christmas market and on the Charlie Hebdo offices in Paris are all examples of suspects remaining on the loose for days after committing an attack. All of the attackers were armed and dangerous and committed more violent crimes as they fled. The same applies to a lesser extent to the attacks on the Canadian parliament or the Munich shopping mall as the attackers moved around for a significant time after their initial attack, increasing the chances of adding more casualties.

Additionally, the investigations later revealed that the attackers had accomplices and safe houses, people that could relay information to them and provide protection if necessary. Hence, by broadcasting locations, possible flight paths and suspect pictures from non-official sources, the risks of helping the suspect run away or distracting the police away from the actual suspect – as it happened in Berlin – significantly increase. Furthermore, some terrorist plots take into account the movements of panicked or misinformed crowds into their attack plan, which means creating a panic with false information is exactly what some terrorists are counting on. As anything can create a movement of panic during and after a terrorist attack, spreading wrong or false information can rapidly lead to more casualties.

A neglected aspect of terrorism is that it plays out in the long term, with short and mid term goals and plans. It is seldom an isolated event, and even if attackers acted alone, there are still connections to be found that reveal the larger picture. Without the latter, it is impossible to properly assess the extent of the terrorist threat and determine how to counter it.

The investigation is ongoing

In the rush to “break the news”, many forget that the suspect has connections. People that either helped him prepare or carry out the attack, provided a car, money or shelter, or that are part of a larger organisation – not necessarily terrorist – whose dealings are probably also under investigation. While the expression “known to authorities” has become a cynical term to describe the failures of the security apparatus, we do not know how or why he was known and or monitored by the authorities. Was he a drug trafficker or a weapons dealer? A known radical? Above all, we do not know the extent of the monitoring. Was he a “small fish” – as former French counter-terrorist judge Jean-Louis Bruguière described Charif Kouachi – to be used as a lure to bigger fish and therefore not the priority of the investigation? Was the same thought process applied to Anis Amri when the Berlin criminal police decided the monitoring was no longer justified?

This is why the authorities refuse to immediately announce the identity of the suspect. The consequences of identifying a suspect need to be assessed first. Identifying a suspect can destroy months and years of work, because once the identity is known, those possibly connected will disappear or cover their tracks in a way that the evidence that will get them jailed will be lost. Worse if it’s the wrong suspect and he is still criminally active.

To this we can add the tactic of waiting out the first move, as the British government did following the attack on Westminster bridge, to see if some organisation will claim the attack without a formal identity. In this case it worked, as IS claimed the attack before Khalid Masood was formally identified by the authorities. However, if the false rumour that suspect X with ties to Y is disseminated, it complicates the use of this tactic, as terrorist groups have been known to be opportunistic with their claims.

The identity of a terrorist – even if dead – is a key investigative, tactical and strategic element of counter-terrorism. It is not immediately revealed for a reason and that reason, namely to determine the extent of the threat, must be respected. Identifying false suspects impedes the work of security forces and no marketing needs and desires can justify this.

The stigma of a false accusation

In the west, there is arguably no label worse in this century than being branded a “terrorist”. Terrorists are considered inhuman, barbaric and to many forfeit any right as a person once they engage in terrorism. The label is also politically so charged that it is used in many countries to describe opponents of a government and acts as a carte blanche to enact security measures that severely restrict freedom and privacy. The label “terrorist” is nothing less than a weapon in itself and makes a pariah out of anyone publicly identified by it.

This context makes falsely identifying someone as a terrorist extremely dangerous and bears severe consequences for the victim. It is possible to argue that for Terry Brooks the consequences were minimal, as he has been known for years as a supporter of terrorism. But for Youssouf el Osri and the Russian man mentioned at the beginning – both described as having nothing to do with the attacks – the consequences are much worse. They are now forever linked to a terrorist attack, accused falsely of taking part in it, which in the court of public opinion always carries more weight than in a real court room. Although we will likely never know for sure, it is not unrealistic to think that these victims of “over-enthusiastic” need for information rapidly fell victim to comments, insults, stares and awkward periods since their faces were put online. In their own way, they are also the victims of a terrorist attack. This is why I chose to post only the picture of Terry Brooks for this piece, regardless of how the pictures of the others are available on the internet.

I am well aware of the highly competitive environment of the media. We get calls to comment on attacks within minutes of one occurring. I am also aware that social media provides “security experts” a very unique opportunity to offer live analysis of an attack and showcase their skills. Nevertheless, the consequences of disseminating false information or poor analysis likely due to lack of facts has very real and serious consequences. It can disrupt an investigation, allow terrorists to flee, people to panic or people to be labelled terrorists when they are not.

In a situation where each second matters, any impediment to the work of security personnel created by the circulation of false rumours amounts to helping terrorists with their plans and puts more lives at risk. This amounts to de facto being an accessory to an act of terrorism. We must understand that an investigation is a house of cards, and false accusations or sharing false information can make it crumble in no time. While we all want answers after an attack, the strategic and security implications of an investigation require patience and timing, and security professionals and media should be fully aware of it, no matter how important being the first to break the news can be.

The latest trend of publicly identifying false terrorism suspects is dangerous and idiotic. There is no reason for reporters or security experts to be unaware of the power of their words and the consequences of their actions. They should know better, and it is imperative that we be all held to higher standards of professionalism, especially when dealing with terrorism. As I like to remind security students at events, in our line of work poor analysis, poor and/or uninformed decision making, lack of or false information and publicly sharing this leads to casualties. People get hurt. People die. And as the three recent cases that are the focus of this post restated, the need for professionalism, restraint and accountability with information has never been stronger.