Security Expert: Investigators Seek Bomber's 'Signature'

Security Expert: Investigators Seek Bomber's 'Signature'
http://www.npr.org/blogs/thetwo-way/2013/04/16/177488042/security-expert-inv
estigators-seeking-bombers-signature?ft=1&f=1122

by
April 16, 2013 3:27 PM
Boston firefighters talk with FBI agents and a crime scene photographer
Tuesday at the scene of the Boston Marathon explosions.

Boston firefighters talk with FBI agents and a crime scene photographer
Tuesday at the scene of the Boston Marathon explosions.
Charles Krupa/AP

As investigators combed through evidence in the deadly Boston Marathon
bombings, seeking both motive and perpetrator, we turned Tuesday to a
security expert for guidance on how the investigation may be unfolding.

Bryan Cunningham, a former CIA officer, assistant U.S. attorney and deputy
legal adviser for the National Security Council, served in both the Clinton
and George W. Bush administrations. He is now a senior adviser at the
consulting firm the Chertoff Group, co-founded by former Homeland Security
Director Michael Chertoff.

NPR: What have investigators been doing to determine the source of the
explosions?

Cunningham: "They're looking for any little pieces of wire and powder
residue from the explosives, anything to help re-create the device. You can
figure out the type of explosive. Was it gunpowder or fertilizer like
Timothy McVeigh used in the Oklahoma City bombing that would suggest a
less-sophisticated device? Or plastic explosives that suggest you're dealing
with someone better trained and with access to more sophisticated materials?

"If they can recover parts of the device, there may be a fingerprint, or
some DNA. It's unlikely, but it happens. After the first [1993] trade center
attack in New York City, they pieced together enough of the truck that
exploded to identify it."

Once they have evidence of the type of device and explosives used, what
might that tell them?

"Big time professional, international bomb-makers often have a signature -
sometimes it's intentional and sometimes it may just be that they were
trained a certain way. There are very extensive databases that contain
information on these 'signatures,' and you can quickly determine if the
device carries the signature of a bomb-maker in those databases. Obviously,
you can have someone not in a database. It's not foolproof, but it's very
helpful."

What else are they looking for that will provide clues as to whether this
was an act of domestic or international terrorism?

"Obviously, national intelligence and law enforcement officials [will be]
looking at all electronic communications in the last 30 to 60 days. They'll
be searching for code words like 'marathon,' and 'Boston,' as well as
heightened chatter. Were there people who knew about it overseas?

"The device signature will also be another really important clue.
Historically, multiple devices detonated very close in time suggest that
al-Qaida was involved. But early reports suggest that the devices appear to
be relatively unsophisticated. They reportedly had nails and ball bearings
in them - items you can get at any hardware store."

that the explosives may have been contained in 6-liter metal pressure
cookers filled with nails, ball bearings and shards of metal. How small
could the receptacle containing explosives be to have caused the type of
injuries inflicted Monday?

"It could very easily have been the size of a pipe bomb, just a foot or so
long and certainly something small enough to be contained in a duffel bag.
And there's enough fog out there, I wouldn't necessarily rule out that
investigators don't have another [undetonated] device. There's been enough
reporting on both sides of that. That detail is really something that the
FBI doesn't want the bad guys to know."

There are also reports that an electronic circuit board that may have been
part of a timer used to detonate the explosive was found at the site. But
what other potential triggering devices might they be looking for?

"In trying to determine if the device was triggered by a cellphone, they can
get phone records for hours leading up to the event. When looking for a bomb
trigger, they can use analytical software to help rule out anything other
than very short communications with another number that's no longer active."

How helpful might amateur photographs and videos taken near the marathon
finish line before and after the explosions prove to be?

"This is one of the huge advantages we have today that we didn't have five
or 10 years ago. That was one of the most photographed sites on the planet
yesterday. Investigators will have access to surveillance video, police
video, images from fixed cameras, data from automatic license plate readers,
as well as everything the public turns in. The holy grail, of course, would
be a photo or video of an individual planting the device. There is software
that can analyze video and photo images."

What type of existing, ongoing official surveillance might investigators
have access to?

"Domestically, we don't do the kind of blanket surveillance we can do
overseas, and for legitimate issues of privacy rights. There will be a few
domestic targets that the FBI will have probable cause to run surveillance
on all the time, but it won't be many - not like we can do overseas.
National agencies will also be looking at all the entries into the country
over the last several months, although that can be pretty flawed, given the
easy ways into the country from Canada and Mexico."

What reality might this type of attack suggest to investigators and homeland
security officials going forward?

"The loss of life is terrible. The terror in Boston is terrible. And now
you're ... going to have a lot more homegrown terrorists who can make
something like this work. I'm afraid other people will try. You can't
install a magnetometer every 10 feet for 26 miles."

==========================================
(F)AIR USE NOTICE: All original content and/or articles and graphics in this
message are copyrighted, unless specifically noted otherwise. All rights to
these copyrighted items are reserved. Articles and graphics have been placed
within for educational and discussion purposes only, in compliance with
"Fair Use" criteria established in Section 107 of the Copyright Act of 1976.
The principle of "Fair Use" was established as law by Section 107 of The
Copyright Act of 1976. "Fair Use" legally eliminates the need to obtain
permission or pay royalties for the use of previously copyrighted materials
if the purposes of display include "criticism, comment, news reporting,
teaching, scholarship, and research." Section 107 establishes four criteria
for determining whether the use of a work in any particular case qualifies
as a "fair use". A work used does not necessarily have to satisfy all four
criteria to qualify as an instance of "fair use". Rather, "fair use" is
determined by the overall extent to which the cited work does or does not
substantially satisfy the criteria in their totality. If you wish to use
copyrighted material for purposes of your own that go beyond 'fair use,' you
must obtain permission from the copyright owner. For more information go to:
http://www.law.cornell.edu/uscode/17/107.shtml

THIS DOCUMENT MAY CONTAIN COPYRIGHTED MATERIAL. COPYING AND DISSEMINATION IS
PROHIBITED WITHOUT PERMISSION OF THE COPYRIGHT OWNERS.