Article appears with permission of the Kansas Association of Private Investigators
October 16, 2001
The Wheatstalker

Investigative Analysis of WMD Threats

by John W. Ellis, B.S., M.A.J.
Licensed Private Detective

In the current anthrax threat situation, many investigative or security firms are receiving or will receive requests from clients to investigate or respond to threats concerning various forms of weapons of mass destruction as defined by 18 U.S.C. 2332a or biological weapons as defined by 18 U.S.C. 178. Here is a short primer of the procedures for analysis of this type of threat and a few Internet sites for more information.

The investigative analysis of WMD or biological threats considers four assessment areas or subjects:

The analysis process overlaps, tending to be simultaneous rather than being sequential. The key is to consider all four areas and their interrelationship in order to reach a valid conclusion of the actual risk.

Terrorist groups or criminal individuals who engage is the use of WMD tend to have certain common psychological traits which can be developed into a profile with a little work. The most common of these are a 'detached' viewpoint of the target whether it is a business, country or individual. There is a tendency by them to view the target as unworthy of consideration as real people or legitimate businesses. The terrorist groups or individuals are usually acting out of their belief in extreme viewpoints or are, simply, true psychopaths or sociopaths. There is usually a feeling of powerlessness on their part which is equalized by their action. The motive is frequently revenge oriented while simultaneously being covert so as to avoid accountability for the action. These are people who are typified by their inability to stand face-to-face in any confrontation.

After assessing the probable motive, the purpose of the terrorist group is then examined. WMD attacks tend to be used for strategic effect rather than for specific tactical effect at the point of attack. Frequently, the point is just to terrorize, disrupt, or prompt a response. All waste resources of the target business, country or individual. Usually, the target chosen helps identify the likely attacker based on current politics, business-worker relations, etc. The attack form then leads to conclusions of the skills and support structure necessary to mount such an attack.

Obviously, building a biological weapon or bomb requires the possession of certain skills. A skill as simple as knowing what an anthrax germ looks like under a microscope helps identify who could mount the form of attack experienced or expected. Each type of WMD has its own skill set and each group or individual would have to have these skills in order to accomplish it. Examination of the individual's job, work experience, education, etc help build the profile of a group's capability.

Assuming that an individual has the skills, he then needs certain things to accomplish it. This is an organizational structure assessment which measures support capability such as finances, business locations, vehicles, etc. that might be used to assist in an operation. It also evaluates access to hazardous materials, special equipment or similar items needed to assemble a WMD. The depth of this assessment varies considerably from situation to situation.

The second assessment area of the threat analysis examines the actual device presented or threatened. The complexity of the device gives an indication of the skill level needed to mount the attack and some indication of its effectiveness. Generally, the more complex the device, the greater the skill level of the attacker and the greater the likelihood that it will operate effectively. The device design will indicate whether the attack is directed at an individual, a small group or a large group. It may also be a noncasualty device which is intended simply to harass or interfere, a form of revenge or denial of service attack giving indication of the attacker's motive or purpose. The different types of attack may be associated with certain personality or social factors. The complexity also indicates the extent of the required support to manufacture or procure it. The less complex the device, the less support that is required to produce and deploy it.

In the third area of assessment, the target of the attack is examined. The role of the business, governmental operation or individual gives strong indication of the probability of being the focal point of an attack, and gives strong indication of the probable motive or purpose of an attacker. That, in turn, gives strong indication of the skill set, weapon complexity, etc. that is needed to accomplish an attack on that target. Certain locations will be more vulnerable to specific types of attacks than others. This favors the usage of those attacks and affects the skill set, resources, etc necessary to accomplish the purpose of the terrorist group or individual involved. Obviously, the attractiveness of the target is dependent upon the combination of its role or significance, its vulnerability to attack, and the terrorist capability to mount that type of attack.

The effect upon the target can be forecast by examining the personal security features (such as alarm systems), the building design, the building utilization, employee locations, etc. During this, you also evaluate the preparation of response forces in the area, both public and private. The greater the vulnerability to attack and the lesser the preparation, the more favorable the target is for an attacker.

The final area of assessment is situational background. Certain types of attacks are more likely in certain situations. The historical trend over the last five years in the United States showed that an anthrax attack was unlikely; actual incidents had not occurred, but many incidents of threats had occurred. Within the last month, however, such an attack has become much more probable. Terrorist groups and criminal individuals tend to follow current trends; parameter setting events are unusual. The Tylenol product tampering case in the 1980s and the use of hijacked aircraft as attack weapons are parameter setting events. Prior to each, the probability of their occurrence was low; now it is much higher. The evaluation has to consider what is 'hot' at the time of the evaluation. This is done in terms of business, politics, personal relationships, etc. as appropriate to the target being considered.

The final evaluation is the summation of the probabilities of each assessment. It recognizes that certain types of attacks are the most probable and concentrates the most resources or preparation on those attacks. While recognizing that other attacks or attackers are possible, the assessment evaluation usually plays the odds. The exception to that is when the effects of the 'long shot' is a catastrophic event. Then, some resources must be devoted to that possibility as well. There are seldom simple answers or solutions in this area. It requires decisions and evaluations on partial or ambiguous information. Practical experience is of value, but hard to obtain in this skill area.

In making the investigative threat analysis, access to information will be of assistance to the private detective. Here are some sources for information that may be of assistance in working out the various evaluations:

Charles C. Thomas, Publishers, LTD. Books on weapons of mass destruction, investigations, terrorism, etc. Here are a some of them:

Go to:

Several government publications are avaliable at the government bookstores. Here are a couple of critical ones for this area:

Also recommended is:
 "Jane's Chem-Bio Handbook" by Sidell, Patrick and Dashell.
Other sources or texts could be recommended. Advance study and preparation for this type evaluation is strongly recommended.