Sicurezza, Terrorismo e Società – 2/2015
Author: AA.VV.
Date: 2015-12-08T23:00:00+00:00
Publisher: EDUCatt

Sicurezza, terrorismo e società
international journal – Italian Team for Security, Terroristic Issues & Managing Emergencies

ISSUE I – 2/2015

Direttore Responsabile:

Matteo Vergani (Università Cattolica del Sacro Cuore – Milano e Global Terrorism Research Centre – Melbourne)

Co-Direttore e Direttore Scientifico:

Marco Lombardi (Università Cattolica del Sacro Cuore – Milano)

Comitato Scientifico:

Maria Alvanou (Lecturer at National Security School – Atene)

Cristian Barna (“Mihai Viteazul” National Intelligence Academy– Bucharest, Romania)

Claudio Bertolotti (senior strategic Analyst at CeMiSS, Military Centre for Strategic Studies – Roma)

Valerio de Divitiis (Expert on Security, Dedicated to Human Security – DEDIHS)

Chiara Fonio (Università Cattolica del Sacro Cuore – Milano)

Sajjan Gohel (London School of Economics – London)

Rovshan Ibrahimov (Azerbaijan Diplomatic Academy University – Baku, Azerbaijan)

Daniel Köhler (German Institute on Radicalization and De-radicalization Studies – Berlin)

Miroslav Mareš (Masaryk University – Brno, Czech Republic)

Vittorio Emanuele Parsi (Università Cattolica del Sacro Cuore – Milano)

Anita Perešin (University of Zagreb – Croatia)

Giovanni Pisapia (Senior Security Manager, BEGOC – Baku – Azerbaijan)

Iztok Prezelj (University of Ljubljana)

Eman Ragab (Al-Ahram Center for Political and Strategic Studies (ACPSS) – Cairo)

Riccardo Redaelli (Università Cattolica del Sacro Cuore – Milano)

Mark Sedgwick (University of Aarhus – Denmark)

Arturo Varvelli (Istituto per gli Studi di Politica Internazionale – ISPI – Milano)

Kamil Yilmaz (Independent Researcher – Turkish National Police)

Munir Zamir (Fida Management&C7 – London)

Sabina Zgaga (University of Maribor – Slovenia)

Ivo Veenkamp (Hedayah – Abu Dhabi)

Comitato Editoriale:

Gabriele Barni (Università Cattolica del Sacro Cuore – Milano)

Alessandro Burato (Università Cattolica del Sacro Cuore – Milano)

Alessia Ceresa (Università Cattolica del Sacro Cuore – Milano)

Barbara Lucini (Università Cattolica del Sacro Cuore – Milano)

Davide Scotti (Università Cattolica del Sacro Cuore – Milano)

© 2015 EDUCatt - Ente per il Diritto allo Studio Universitario dell’Università Cattolica

Largo Gemelli 1, 20123 Milano - tel. 02.7234.22.35 - fax 02.80.53.215
e-mail: editoriale.dsu@educatt.it (produzione); librario.dsu@educatt.it (distribuzione)

web: www.educatt.it/libri

Associato all’AIE – Associazione Italiana Editori
isbn edizione cartacea: 978-88-6780-958-5
isbn edizione ePub: 978-88-6780-959-2
copertina: progetto grafico Studio Editoriale EDUCatt

Table of contents

Research articles

Matteo Vergani, Ana-Maria Bliuc

The evolution of the ISIS’ language: a quantitative analysis of the language of the first year of Dabiq magazine

Claudio Bertolotti, Andrea Beccaro

Suicide Attacks: Strategy, from the Afghan War to Syraq and Mediterranean region. A triple way to read the asymmetric threats

Analyses and commentaries

Laris Gaiser

Intelligence economica: una proposta per l’Italia

Giovanni Giacalone

Islamic extremism from the Balkans emerges in Italy

Focus: Web Intelligence

Marco Lombardi, Alessandro Burato, Marco Maiolino

Dalla SOCMINT alla Digital HumInt. Ricomprendere l’uso dei Social nel ciclo di intelligence

Alessandro Burato

SOCial Media INTelligence: un nuovo spazio per la raccolta di informazioni rilevanti

Mauro Pastorello

How cyberspace is used by terrorist organization: possible threats to critical infrastructures? The most recent activities of cyber counterterrorism

Focus: Grandi Eventi

Giovanni Pisapia

A Case Study Analysis of the Implementation of GIS Technology for Safety and Security Planning during Major Sport Events

Executive Summary

Research articles

The evolution of the ISIS’ language:
a quantitative analysis of the language
of the first year of Dabiq magazine

Matteo Vergani1, Ana-Maria Bliuc2

Abstract

In this article we investigate the evolution of ISIS by analysing the text contained in Dabiq, the official ISIS’ internet magazine in English. Specifically, we used a computerized text analysis pro-gram LIWC (Linguistic Inquiry and Word Count) to investigate the evolution of the language of the first 11 Issues of Dabiq. First, our analysis showed that affiliation seems to be an increasingly important psychological motive for the group. Secondly, ISIS has been increasingly using emotions, which are an important mobilizing factor in collective action literature, in a strategic manner. Thirdly, ISIS language presents an increasing concern with females. Last but not least, our analysis shows that ISIS has been increasingly using internet jargon (net-speak), which shows how the group tries to adapt itself to the internet environment and to connect with the identities of young individuals.

ISIS is of particular concern as it seems to be more successful at recruiting foreign fighters than other jihadist groups (such as al-Qaeda). This aspect is difficult to quantify because reliable it is hard to access data about the exact number, demographics and affiliation of the foreign fighters who joined those organizations. Yet according to reports by the European Union there is a concerning increase in recruitment rates and patterns, with ISIS being more successful at recruiting young individuals from Western countries than any other jihadist group (Archick, Belkin, Blanchard, Hemud, & Mix, 2015). Scholars suggested that the majority of newly recruited jihadists prefer ISIS to other jihadist groups (Karmon, 2015; Klausen, 2015; Peresin, 2015; Peresin & Cervone, 2015; Turner, 2015)and journalists reported that existing members of al-Qaeda even abandoned the group to join ISIS (Dilanian, 2015; Miller, 2014). Moreover, a 2015 report from the International Centre for the Study of Radicalisation and Political Violence based at London King’s College stated that the number of jihadist foreign fighters in Syria and Iraq from 2011 to 2014 has surpassed the total number of jihadists who went fighting in Afghanistan against the Soviets, when al-Qaeda emerged.3

ISIS seems also particularly able to connect with Western foreign fighters, and more in general the conflict in Syria and Iraq has been attracting relevant numbers of foreign fighters from the EU, the US and Australia: according to the King’s College report Western jihadists in Syria and Iraq are about 4,000. This may be explained by many factors among which the ease to reach the conflict zone, the expected good living conditions (which appear from the images that circulate in the social media of glamour jihadists eating Nutella, using new technologies and posting tourist-like pictures), the desire for adventure, and other factors (Klausen, 2015; Peresin & Cervone, 2015). News reports announced the birth of a unit, the Anwar al-Awlaki Battalion4, exclusively composed of English-speaking foreign fighters5.

We argue that part of ISIS’ success can be investigated by examining the psychological aspects of the group, which can be researched by looking at the structures of the language. In this article we would like to address the following question: has ISIS’ language evolved since its declaration on June 29, 2014?

1. Methods

We decided to investigate our research question using a rich source of data: the text contained in Dabiq, the official ISIS’ internet magazine in English. Dabiq is in fact one of the few original sources of data that directly comes from ISIS. Specifically, we used a computerized text analysis program LIWC (specifically we used the new version LIWC2015) (Linguistic Inquiry and Word Count) to investigate the evolution of the language of the first 11 Issues of Dabiq. LIWC is a software developed in the early 1990s by Pennebaker and colleagues, and further revisions undertaken in 1997 and 2007 to streamline the dictionaries were included (Tausczik & Pennebaker, 2010). The program automatically opens and analyses text files calculating the percentages of each LIWC category present in the dictionary in the chosen unit of analysis, which in our research was the article. We believe that LIWC is particularly appropriate to investigate ISIS language because it captures aspects of the structure of the language that can reveal implicit motives, emotions and objects of interest, which emerge from the analysis of relevant quantity of text. We acknowledge that Dabiq is a propaganda tool for ISIS, and therefore we have to analyse and interpret its content with caution and appropriate methods: we argue that LIWC offers a unique tool of analysis that unveil latent psychological dimensions and goes beyond the traditional content analysis of the manifest content of the communication.

We considered in our analysis the first 11 Issues, from Juley 2014 to July 2015 (Table 1).

Table 1: The issues of Dabiq that we considered in the analysis.

Issue (date)

Date

Number of words

1

July 2014

10105

2

July 2014

12585

3

October 2014

14045

4

October 2014

20261

5

November 2014

12914

6

December 2014

28397

7

February 2015

35786

8

March 2015

30652

9

May 2015

32705

10

July 2015

43224

11

September 2015

34288

First of all, table 1 shows that the publication of Dabiq Issues has become less frequent: the first 6 Issues were published in the first 6 months (between July and December 2014), and the last 5 Issues in the following 9 months (between January and September 2015). Moreover, the intervals between Issues have changed: the first two were published in the same month (July 2014), and the second two again in the same month (October 2014). Yet the last four Issues have been regularly published once every two months between March and September 2015. The number of words per Issue has been generally increasing over time.

We decided to use only a few LIWC dictionaries to analyse the text of Dabiq, which we believe relevant to understand the propaganda of a group like ISIS. Specifically we analysed:

• Group motives that can explain the mobilization strategies to achieve collective action through the mobilization of political identities (achievement, affiliation, power),

• Emotions expressed in the language (anger, anxiety, emotional tone),

• Concerns about particular objects of interest (death, females, religion),

• Language jargon (netspeak).

2. Results

The following figures (Figure 1 to Figure 10) present the visualization of the analyses. The horizontal axes shows each Issue of Dabiq from number 1 to number 11, and the vertical axes indicates the percentage of words per each Issue that capture the relevant object of the analysis. For example the vertical axes of Figure 1 shows the percentage of words expressing the achievement motive, Figure 2 the percentage of words expressing the affiliation motive, and so on. Higher sores indicate higher percentages. The bigger the circles are, the higher the percentage of words for that specific Issue of the magazine. The line plotted in the graphs indicate the smoothed conditional mean.

Figure 1: Achievement motive.

Figure 2: Affiliation motive.

Figure 3: Power motive.

Figure 4: Anger.

Figure 5: Anxiety.

Figure 6: Emotional tone.

Figure 7: Death concern.

Figure 8: Females concern.

Figure 9: Religion concern.

Figure 10: Netspeak.

Achievement, affiliation and power are defined in LIWC2015 as core drives and needs, yet previous literature defined them as motives (i.e. individual or group tendencies or strivings towards a goal) that are associated with aggression and the language of terrorist groups (Smith, 2008; Smith, Suedfeld, Conway, & Winter, 2008). Figures 1, 2 and 3 show the presence of those motives in each Issue of Dabiq from the 1st to the 11th. The achievement motive tended to decrease, especially after peak in the first Issue. Power fluctuated and in the last three Issues stabilized at a level not distant from the first issues. Affiliation also fluctuated, but also showed an increase over time.

Anger, anxiety and emotional tone indicate the amount of emotions, with a focus on negative emotions, expressed by the language of Dabiq. Emotions are important factors that explain collec-tive action and influence political behaviour: for example anger is known in the collective action literature as a mobilizing emotion (Van Zomeren, Postmes, & Spears, 2008) especially linked to violence and aggression (Skitka, Bauman, Aramovich, & Morgan, 2006), anxiety is associated to isolation and risk aversion (Huddy, Feldman, Taber, & Lahav, 2005). More in general, emotional language is considered to be effective in mobilizing individuals, especially in the radicalization literature (Cottee & Hayward, 2011). Figures 4, 5 and 6 show that anger fluctuated, had peaks in Issue 4, 5, 7 and 9, and it appears to have stabilized in the last two issues at average levels. Anxiety, after a peak in Issue 3 and 4, and high levels in Issue 9, returned to the low levels of the first two Issues. The general emotional tone however showed a clear “u” shape: it started with higher level in Issue 1, it decreased over time and it came back to higher levels in the last few Issues.

Concerns with death, females and religion capture three important ideological aspects of the propaganda of ISIS. The concern with death has been indicated as one of the most important as-pects of the group, which has been called “death cult” in many different occasions (Lentini, 2015). Figure 7 shows that the concern with death, after a peak in Issue 3, 4 and 5, has stabilized to lower levels: it doesn’t therefore seem to be an increasing concern with the language of Dabiq. The con-cern with females is very important because the public debate has been increasingly focusing on the strong capacity of ISIS to recruit women: the stories of young women leaving their countries to become “jihadi brides” have been increasingly reported in the media (Wahid, 2015). This important focus on women mobilization is confirmed by the increase in concerns with females that appears in Figure 8. The concern with religion, which is undoubtedly the most important aspect of ISIS ideology, at least in its selective and biased version, is captured in Figure 9, which shows how this concern, after a peak in Issue 1, has remained steady in all the subsequent Issues.

Finally, we wanted to capture the change in the jargon used by ISIS, and especially the informal language typical of the internet (for example abbreviations like “btw”, “lol”, thx”). We found very interesting the increase showed in Figure 10, which suggests that ISIS language has been adapting to internet jargon, which probably makes it more effective in establishing a communication with the youngest generations of potential recruits.

3. Discussion

We believe that the brief analysis of the language that we conducted in this pages shows a mobi-lizing strategy of ISIS. Firstly, the analysis of ISIS core motives shows that affiliation seems to be the most important for ISIS. Specifically affiliation captures the concern with maintaining group cohesion and group identity, which may have been one of the most important challenges during his first year, due to the multiple jihadist groups competing for the leadership of the jihadist movement both at a global level (e.g. al-Qaeda) and at a local level (e.g. al-Nusra front).

Secondly, the analysis suggests that ISIS uses emotions, which are an important mobilizing fac-tor in collective action literature, in a strategic manner. The evolution in the use of emotions may suggest that, after 1 year of existence, ISIS was coming back to a language that was similar to the first issues of Dabiq: more emotional, but less focused on anxiety (which is a paralysing emotion). This might suggest that ISIS needs to attract new recruits, and that ISIS needs to come back to use a more “mobilizing” language after an attempt of institutionalizing and rationalizing the language in Issues 2 to 10.

Thirdly, the most interesting aspect emerging from the analysis of ISIS concerns is the increasing concern with females. This is consistent with the current literature: Peresin and Cervone’s study of Western women joining ISIS in fact concluded that the number of those women, more than 200, “is much higher than in any previous jihadist mobilization of Western foreign fighters” (Peresin & Cervone, 2015). We believe that this is especially important because it shows that ISIS needs to attract not only fighters but also women in order to create a society that is not only composed by warriors but also by families, where people can live an “ordinary” life. This is a cornerstone of ISIS’ “utopian” narrative, which is a very important radicalization factor (C. Winter, 2015a, 2015b).

This is not to say that death or religion are not issues of interest for ISIS. For example religion in absolute terms is more present than the other two concerns, which is consistent with what we know of ISIS. Although we acknowledge that the interpretation of Islam proposed by groups like ISIS is established upon selectively literal interpretations of the Qur’an that are not shared by the greatest majority of Muslims (Lentini, 2013), we also believe that religion (in its selective and distorted version) is the key source of legitimacy for a jihadist group like ISIS, and arguably the core motive of recruits who join the group. Although we know from previous research that individuals who join jihadist organizations usually do not come from a strong religious background, and their understanding of religion is limited (Rinehart, 2006), we agree with Ganor when says that religious intransigence is a key factor in explaining ISIS’ success in recruiting young Western foreign fighters because of the group claims to be the only real interpreter of the Prophet’s original will (Ganor, 2015). Also, existing studies on ISIS affiliates’ Twitter use showed that religious discourses, jihadist dogmas and images of religious leaders are prominent among foreign fighters (Carter, Maher, & Neumann, 2014; Klausen, 2015). Also, previous research suggested that ISIS feels more comfortable than other terrorist groups broadcasting high level of graphic violence (Klausen, 2015) and the group has been using and showing off indiscriminate violence with more ease than other jihadist groups like al-Qaeda: ISIS is for example less restrained in sentencing anyone who does not believe in its extreme version of Islam to takfir (excommunication) and death (Hashim, 2014), and it has conducted extremely violent campaigns against Muslims, which have been criticized by charismatic senior al-Qaeda members such as bin Laden, al-Zawahiri, Ghadan, and al-Libi (Turner, 2015). Death reminders are therefore and important part of the group’s communication.

Last but not least, our analysis shows that ISIS increased its use of the internet jargon. We be-lieve that this suggests how ISIS is able to adapt itself to the internet environment, where it has demonstrated an impressive capacity to connect with the identities of young individuals all over the world as the cases of terrorist plots involving individuals as young as 14 demonstrate (Cooper, 2015; Mitchell, 2015).

We believe that the analysis of ISIS language with LIWC categories is particularly interesting because it offers insights about the motives, emotions and concerns of the terrorist group, which can also reveal some aspects of the motives, emotions and concerns of the target audience. Research in the field of psychology of political leadership showed that the success of a leader depends on a match between the personal characteristics, the historical context and the followers’ psychological characteristics (D. G. Winter, 1987). The psychological structures of a text can generate identification in the audiences that recognize themselves in such structures and motives: for example the fact that ISIS is more concerned about females, means that ISIS is trying to connect with females and with people concerned with females. Also, the fact that ISIS uses more internet language means that the groups wants to connect with people who use the same language.

To conclude we presented a general overview of the development of ISIS language that does not want to offer a deep understanding of the meaning that is hidden behind each of the LIWC dictionaries that we used. Further research should investigate more deeply the meaning of LIWC categories, using a comparative perspective to compare the language used by different terrorist groups. However we believe that this paper offers preliminary findings that can be used to generate new research questions and stimulate debate among scholars who are studying terrorist groups such as ISIS.

References

Archick, K., Belkin, P., Blanchard, C. M., Hemud, C. E., & Mix, D. E. (2015). European Fighters in Syria and Iraq: Assessments, Responses, and Issues for the United States. In C. R. Service (Ed.), CRS Reports (pp. 46). Bruxelles: EU Congress.

Carter, J. A., Maher, S., & Neumann, P. R. (2014). #Greenbirds: Measuring Importance and Influence in Syrian Foreign Fighter Networks. In I. C. f. t. S. o. R. a. P. Violence (Ed.). London: King’s College.

Cooper, A. (2015). Terror accused wrote death plans hours before raid, court told. Victoria News. Retrieved 5/10/2015, from http://www.theage.com.au/victoria/terror-accused-wrote-death-plans-hours-before-raid-court-told-20150526-gh9vdz.html#ixzz3neuYclWC.

Cottee, S., & Hayward, K. (2011). Terrorist (E)motives: The Existential Attractions of Terror-ism. Studies in Conflict & Terrorism, 32(12), 963-986.

Dilanian, K. (2015). AP Exclusive: 20,000 foreign fighters flock to Syria, Iraq. Retrieved 15/09/2015, from http://bigstory.ap.org/article/012821b6bf25439da403890e694f984f/ap-exclusive-20000-foreign-fighters-flock-syria-iraq

Ganor, B. (2015). Four Questions on ISIS: A “Trend” Analysis of the Islamic State. Perspectives on Terrorism, 9(3), 56-64.

Hashim, A. S. (2014). The Islamic State: From al-Qaeda Affiliate to Caliphate. Middle East Poli-cy, 21(4), 69-83.

Huddy, L., Feldman, S., Taber, C., & Lahav, G. (2005). Threat, Anxiety, and Support of Anti-terrorism Policies. American Journal of Political Science, 49(3), 593-608.

Karmon, E. (2015). Islamic State and al-Qaeda Competing for Hearts & Minds. Perspectives on Terrorism, 9(2), 71-79.

Klausen, J. (2015). Tweeting the Jihad: Social Media Networks of Western Foreign Fighters in Syria and Iraq. Studies in Conflict & Terrorism, 38(1), 1-22.

Lentini, P. (2013). Neojihadism : Towards a New Understanding of Terrorism and Extremism? Chaltenham: Edward Elgar Publishing Inc.

Lentini, P. (2015). Demonizing ISIL and Defending Muslims: Australian Muslim Citizenship and Tony Abbott’s “Death Cult” Rhetoric. Islam and Christian–Muslim Relations, 26(2), 237-252.

Miller, G. (2014). Fighters abandoning al-Qaeda affiliates to join Islamic State, U.S. officials say, Washington Post. Retrieved from https://www.washingtonpost.com/world/national-security/fighters-abandoning-al-qaeda-affiliates-to-join-islamic-state-us-officials-say/2014/08/09/c5321d10-1f08-11e4-ae54-0cfe1f974f8a_story.html

Mitchell, G. (2015). Parramatta shooting: Teen gunman Farhad Khalil Mohammad Jabar’s al-leged links to extremist group Hizb ut-Tahrir. NSW News. Retrieved 5/10/2015, from http://www.smh.com.au/nsw/parramatta-shooting-hizb-uttahrir-links-to-teen-gunman-farhad-jabar-khalil-mohammad-alleged-20151004-gk10wh.html#ixzz3nesjleFZ

Peresin, A. (2015). Fatal Attraction: Western Muslimas and ISIS. Perspectives on Terrorism, 9(3), 21-38.

Peresin, A., & Cervone, A. (2015). The Western Muhajirat of ISIS. Studies in Conflict & Terrorism, 38(7), 495-509.

Rinehart, J. F. (2006). Apocalyptic Faith and Political Violence: Prophets of Terror New York: Pal-grave MacMillan.

Skitka, L. J., Bauman, C. W., Aramovich, N. P., & Morgan, S. G. (2006). Confrontational and Preventative Policy Responses to Terrorism: Anger Wants a Fight and Fear Wants “Them” to Go Away. Basic and Applied Social Psychology, 28(4), 375–384.

Smith, A. G. (2008). The Implicit Motives of Terrorist Groups: How the Needs for Affiliation and Power Translate into Death and Destruction. Political Psychology, 29(1), 55-75.

Smith, A. G., Suedfeld, P., Conway, L. G., & Winter, D. G. (2008). The language of violence: distinguishing terrorist from nonterrorist groups by thematic content analysis. Dynamics of Asymmetric Conflict, 1(2), 142-163.

Tausczik, Y. R., & Pennebaker, J. W. (2010). The Psychological Meaning of Words: LIWC and Computerized Text Analysis Methods. Journal of Language and Social Psychology, 29(1), 24–54.

Turner, J. (2015). Strategic differences: Al Qaeda’s Split with the Islamic State of Iraq and al-Sham. Small Wars & Insurgencies, 26(2), 208-225.

Van Zomeren, M., Postmes, T., & Spears, R. (2008). Toward an Integrative Social Identity Model of Collective Action: A Quantitative Research Synthesis of Three Socio-Psychological Per-spectives. Psychological Bulletin, 134(4), 504-535.

Wahid, O. (2015). Britain’s jihadi bride groomer: Schoolgirl radicalised in London mosque re-cruited her three classmates to join ISIS in Syria. News. Retrieved 10/08/2015, from http://www.dailymail.co.uk/news/article-3182561/Britain-s-jihadi-bride-groomer-Schoolgirl-radicalised-London-mosque-recruited-three-classmates-join-ISIS-Syria.html

Winter, C. (2015a). Documenting the Virtual ‘Caliphate’. London: Quillam Foundation.

Winter, C. (2015b). The Virtual ‘Caliphate’: Understanding Islamic State’s Propaganda Strategy. London: Quilliam.

Winter, D. G. (1987). Leader Appeal, Leader Performance, and the Motive Profiles of Leaders and Followers: A Study of American Presidents and Elections. Journal of Personality and Social Psychology, 52(1), 196-202.

1 Itstime – Catholic University (Milan) and Monash University (Melbourne).

2 Monash University (Melbourne).

3 http://icsr.info/2015/01/foreign-fighter-total-syriairaq-now-exceeds-20000-surpasses-afghanistan-conflict-1980s/ (Ac-cessed on 17/07/2015)

4 Anwar al-Awlaki was a senior figure of al-Qaeda in the Arabic Peninsula (AQAP) killed in 2011, famous for being a recruiter and media specialist for the jihadist organization. The fact that ISIS named the English-speaking battalion after him highlights one more time the intertwined stories of the two groups.

5 See for example: http://www.ibtimes.com/isis-creates-english-speaking-foreign-fighter-anwar-al-awlaki-brigade-attacks-west-1791400 (Accessed on 17/07/2015).

Suicide Attacks:
Strategy, from the Afghan War to Syraq
and Mediterranean region.
A triple way to read the asymmetric threats

Claudio Bertolotti, Andrea Beccaro

Key Words

Afghanistan; Iraq; Asymmetric Warfare; Suicide-attacks; Strategy; NATO.

Parole chiave

Afghanistan; Iraq; Guerra asimmetrica; Attacchi suicidi; Strategia; NATO.

Suicide attacks are one of the most important aspects of modern conflicts. According to Tosini (2009; 2012) between December 1981 (date of the first suicide attack) and December 2010 date of the end of the scholar’s research there have been 2.713 suicide attacks worldwide, which have caused about 28.000 deaths. Afghanistan and Iraq play the biggest role: between March 2003 and May 2010 there have been 1321 attacks of this kind in Iraq which have caused more than 13.000 deaths. Since 1981 Afghanistan and Iraq have been reaching 68% of all suicide bombings and 55% of all casualties together. These figures show how big an impact the suicide tactics had during the first seven years of the Iraq war. Moreover, suicide attacks played an important role in other conflicts such as the ones in Lebanon, Israel, Sri Lanka, Kashmir, Turkey, which were carried out by PKK, worldwide attacks can be linked to the global organization of al-Qaeda, Afghanistan. Objectives, political and war situations are very different in these countries, thus the various features of suicide bombings make finding a single explanation for this phenomenon difficult. According to Tosini there is not one theory that can explain the phenomenon because it is a result of different actors who operate and co-operate during the conflict.

Generally speaking, scholars explain the importance of the suicide phenomenon using sociological, psychological or similar explanations. All of these are interesting and important explanations since a suicide-attack involves people who want to kill themselves and others, but our research focuses on something else, i.e. in the changed (and changing) strategic context. But before we analyse the subject strategically, we need to explain how we use the term “suicide attack” and “terrorism”. From our point of view it is important to recognize “contemporary terrorism” as a military “action” and as a “reaction”, this would allow one to consider a “suicide attack” as a technique of armed opposition or an act of resistance and not as a product of tout court terrorism. It is therefore possible to consider terrorism as a “consequence”, paying attention to the semantic value of the term and to the meaning in an evaluation that comprises causes that are both political and social, but also military (Bertolotti, 2010). Nowadays terrorism is a word with a negative meaning; in Afghanistan, as well as in Syraq (Syria and Iraq), suicide attacks mainly aim at military and institutional targets, while non-combatants are indirectly involved, the so called “collateral damages”. The organizations or the subjects are terrorists, perpetrators of the shameful and publicly condemned act, which is never justified. We therefore kept a neutral standpoint. This is why we decided to use the words such as “suicide-attacks”, “tactics” or “bombings” instead of “suicide terrorism”; “armed opposition” to indicate a phenomenon based on typical actions of guerrilla, “suicide-fighter” instead of “suicide-terrorist” and “armed opposition groups”1 (but also mujahidin, rebels, freedom fighters) to describe subjects generally called, with a rather partial approach, terrorists2.

As mentioned above the point of view of the present study is strategic, we chose it mainly for two reasons. Firstly, in the last few years the suicide attacks have become an important tactic on contemporary battlefields, so it is crucial to understand the phenomenon in its war context. Secondly, during the last three decades numerous ideas about how the war has changed have emerged helping us better understand suicide attacks.

The present study is thus divided in two parts. The first one deals with the strategic debate on the transformation of war, reading it in two ways: one comprehends all theories about the importance of technology and the central role of information technology, that is RMA; the other one is centred on the perpetrators of the violence and underlines the fact that today wars are fought by non-state actors, as a consequence the way that violence is inflicted is changing. From this new strategic context many characteristics, which could help explain why suicide attacks are so important nowadays, emerge. Finally we are going to focus on a particular battlefield and its characteristics, i.e. urban battlefield.

In the second part of this study we are going to analyze the Afghan theatre of war both to give a context to all the theory we have illustrated in the first part and to see the practical results of suicide-attacks. In the last decade, the Armed opposition groups (AOG) have begun employing a new tactic the use of which was increased progressively on the Afghan battlefield: the suicide attack, a military technique based on a political strategy. Can we conclude that it is a successful technique? We propose an original approach to data analysis, the «triple way reading method: «Actions-Events-Subjects». Thanks to this innovative process and to the «Afghanistan Suicide Attacks Database» (ASA) created by one of the authors (based on 66 categories and subsections and more than 31.500 single information data) it is now possible to understand new trends and developments of the Afghan phenomenon, analyzing, furthermore, direct and indirect results obtained on strategic, operational and tactical levels.

1. Suicide Bombing and Strategic Thought3

1.1 RMA and Suicide Bombings

In the paragraphs below we seek to understand from a theoretical point of view why suicide attacks are so important on the battlefield today. For this purpose we are going to use three different approaches: drawing parallels between suicide attacks and the Western concept of RMA; studying the current debate on the transformation of war; carrying out a brief analysis of how a special feature of modern conflicts, urban warfare, could affect the increasing use of suicide attacks.

Generally speaking, what is known as “western way of war” is about high technology and RMA. The entire debate dates back to the 70s, and we have to emphasize some of the concepts as we can trace them in the strategic logic of suicide tactics. A parallelism between a suicide bombing and RMA is not new (Lewis, 2007; Hoffman, 2004), but here we want to underline some aspects which can help us understand the phenomenon better in the light of modern strategic thought. The roots of RMA lie in the idea that the American Army had fewer troops and weapons than the Soviet Army, for this reason new weapons capable of going undetected and being failure-proof in striking a target more in depth and precisely were needed. Moreover, weapons had to have a good survivability (Shimko, 2010).

The precision of the strike is a very important feature because it is a way to obtain the desired result with lower costs, in other words precision optimizes cost-benefit analysis. Suicide attacks can cause large damage at a low cost because the attacker does not need a specific and long training, the explosive device is not very complicated and the explosive can be found around the theatre of war or on the black market. Furthermore, with suicide attacks the cost, in terms of risk, is lower than any other attack tactics because the fighter can not be arrested and interrogated4 giving the organization a better survivability to enemy investigations (Hafez, 2007). According to Bunker and Sullivan, another important aspect is that in order to plan a suicide attack the terrorist organization needs neither an elaborate plan nor an escape, which historically has been one of the most complicated and difficult plan to realize. A suicide fighter, like a cruise missile, can not be defused or removed by the enemy who can only wait to be attacked. Even when the regular army are able to identify the threat, he/she could be attacked in any case because the suicide fighter can detonate himself/herself before reaching the right target. But a suicide fighter has an advantage compared to a smart bomb as he/she can choose the target based on the current tactical situation. If the selected target is too well protected, the attacker can turn around the corner and detonate himself/herself in a market. This way the chosen target will be safe, but the attack will be successful, nevertheless, because it will have attracted media attention anyway as the organisation or the individual hoped it would. Studying the Afghan case in the second part of the essay we will see how this change in the objective of attack could affect the understanding of the phenomenon in the theatre of war. Moreover, a suicide fighter can walk inside and around the target, making adjustments and choosing the right moment and place to attack. In this sense the suicide fighter, and not the cruise missile or the JDAM, is the only real smart bomb (Bunker, Sullivan, 2004).

Reading the problem of suicide attacks in this light, Bunker and Sullivan underline two features of the tactics included even in the RMA concept of stand-off weapons. First of all, the suicide fighter is invisible to the defender who knows they are under attack only when the explosion has occurred. This way the suicide attack is a surprise attack and represents the most important tactics in an irregular war. Secondly, suicide bombings could be absolutely precise, enabling the attacker to hit difficult and well protected targets, and they are flexible enough to change target or attack procedure if necessary (Bunker, Sullivan, 2004).

Another common feature between modern weapon systems and suicide bombing is the ability to project force. Cruise missiles, aircraft like F117 or B2 and so on were designed to penetrate in depth in enemy territory due to their “invisibility”, a suicide fighter can carry out the same deep penetration allowing the terrorist organization to strike in territories which are far beyond classic terrorist tactics and traditional capabilities of such organizations. One of the original ideas that each terrorist has, is to strike everywhere it is possible in order to create fear and to undermine state authority. With suicide bombing this aspect becomes simpler and it can have a greater impact (Lewis, 2007). In Iraq and in Afghanistan the insurgents were able to strike important facilities using suicide bombing as a battering ram for a more complex attack. Other examples of crossing battlefield borders are Chechens suicide attacks in Moscow or attacks linked with al-Qaeda, an organization without a real and territorial base but able to strike worldwide with suicide attacks.

According to Lewis, suicide bombing is not simply a metaphor of technology, it is a kind of technology: “In this light, suicide bombing appears as a technological solution to a practical problem” (Lewis, 2007). While the United States, in particular, have spent billions and billions on technological research and innovation, terrorists use what they have in a new and unexpected way. The same idea was expressed by two Chinese colonels in the middle of the Nineties. Their book, Unrestricted Warfare, was very famous a decade ago, and even if it has some its limits their idea to strike the enemy in new and unpredictable ways is exactly what suicide bombing did and well before the colonels’ book (Qiao, Wang, 1999).

But which way do terrorists use the technology in an unexpected way? According to Lewis, while the United States install in their bombs or missiles devices able to guide them precisely to the target, terrorists, who have not the same technology, money and research possibilities, use a “human device” for the same purpose. This point has been also underlined by both Bruce Hoffman, who introduced the definition of “human weapon system”, and Boaz Ganor for whom the suicide-fighter is the thinking vector of a destructive device (Ganor, 2000). Using a “human device” is even better than the technological device because he/she can change plan while travelling to the target, make adjustments, thus it has a bigger flexibility and produces better results than traditional technology. Indeed, as Lewis notes, during al Aqsa Intifada Palestinians used “dumb rockets” to strike Israel cities and only two years later the first attack they were able to kill someone. Instead, using suicide bombing, Palestinians increased their attack capabilities: suicide bombing were only 0.5 percent of the total attacks but killed 50 percent of the casualties. According to Lewis (2007), from a technical point of view, there are little, if none, differences between classic rockets, like Qassam 2, and suicide vests, on the contrary the former have more explosive power than the latter. The biggest difference lies in the “human guidance system” which enables to strike the target accurately. But this does not mean that terrorists, insurgents and the like are not able to use high technology for their purposes. As we will see below speaking about Hybrid Warfare, irregulars use high technology but in ways which are considered strange by westerners; the attacks of 9/11 are the most famous example, although not the only ones (Jessee, 2006).

There are also two big differences between western ideas tied to RMA and suicide bombings. Firstly, the entire debate around RMA is concentrated on technology trying to eliminate human beings from the battlefield. The “absolute precision” of the strike, the “perfect knowledge” envisioned by RMA and so on exclude the human dimension from the war. On the contrary, suicide bombings are profoundly tied to the human dimension of war; they are tied to will, determination, hate, violence. This way suicide bombings are more clausewitzian than RMA because those elements represent one of the three elements of the “wonderful trinity” of the war. Secondly, it seems that suicide bombings have been able to get over the biggest problem tied to technology, which is the fact that sooner or later a new device can be invented and that it can counter the first device. At the moment a tactic or a technological device capable of countering suicide bombings does not appear to exist.

1.2 Suicide bombings and the debate
on the transformation of war

In the last three decades a huge debate emerged around the idea that warfare is changing or has already changed. These theories highlight how Western powers, focusing on technology and classic state versus state warfare, have forgotten other kinds of war which have been followed by western adversaries. One of the most famous definitions is Creveld’s LIC (Low Intensity Conflict) (1991): generally fought in underdeveloped countries; not fought by regular armies but by irregular fighters sometimes against a regular army; not fought with advanced technological weapons; and finally their causalities are mostly civilians. After few years, Creveld Kaldor’s New Wars (1999) stressed the idea that modern wars are new5 for three reasons: the aim, because new wars are not fought for some political ends but for identity politics and so religion or ethnicity play a more important role; the fighting method, as fighters try to achieve their goals through the control of the population obtained with violent practices like rapes and deportation; the new war economy with close links to globalization and its consequences. Another interesting theory is Lind’s Fourth Generation Warfare (Lind, 1989). Historically speaking it presents problems, but it underlines some important features: the 4th generation removes the distinction between civilian and military (as in Creveld and Kaldor theory) so the entire society becomes a battlefield; the logistic is less important; manoeuvre is a key factor because contingents are smaller; destroying the enemy from the inside is more important than destroying it on the battlefield. Hence the 4th generation theory highlights unwittingly two important aspects of the suicide bombings the targets of which are mostly not military: firstly there is not a distinction between civilians and military; secondly, a separation between civil society and battlefield does not exist because the civil society is the battlefield, and for the same reason it is important to affect the media.

A more recent theory is Hoffam’s Hybrid Warfare theory. In this case the regular and irregular characteristics are mixed giving irregular fighters better capabilities and more possibilities to stand and fight against the regular army (Hoffman, F., 2007). This definition is very interesting because it was coined after the Second Lebanon War in 2006 and it stems from the analysis of the reality of that war (Biddle, Friedman, 2008), where Hizballah showed its unique and significant military capabilities. Indeed Hizballah had large ground forces, which Itai Brun (2010) assesses at around 10,000 fighters, that fought and operated like guerrilla forces. It is true that Hizballah had stock of long and short range rockets, anti ship, tank and aircraft missiles, even an air force able to strike with some UAVs, but at the same time Hizballah operated in a guerrilla style, trying successfully to create an attrition war and to win by not losing.

This aspect leads us to take into account ideas of Brigadier General Itai Brun who shows that the western technological RMA was not the only possible revolution. If the western RMA has its roots in the Vietnam war, Cold war and technological innovation, the O-RMA (Other-RMA) devised between 1978 and 1982 when several conflicts and revolutions took place in the Middle East (The Iranian revolution, the Soviet war in Afghanistan, the Israel war in Lebanon, the Iran-Iraq war and so on). The collapse of the Soviet Union, which was the first provider of weapons and doctrine to many Middle Eastern states, and the Gulf War in 1991 forced those states to change their strategic view and operational doctrine and to find new and different ways to fight. According to Itai Brun three organisations were the first to do that: Hizbollah, Hamas and Al-Qaeda. Not surprisingly the three of them have used suicide tactics in their operations. Moreover, in the last few years even inside jihadi groups a huge thinking has taken place in order to use violence in a better and more functional way (Adamsky, 2010).

While Western RMA was the product of new technology, ORMA, as Itai Brun (2010) notes, was the product of the limited possibilities (a classic situation in irregular warfare history) of Middle East states and of irregular groups and their analysis of the American (and Israeli) “way of war”. In this regard the priority that Western powers gave to airpower, and PGM during the war against Iraq in 1991 is particularly important. That conflict and other like those fought by Israel and United States in Somalia, in the Balkans and so on also highlighted the weaknesses in the western “way of war”, that the western leaderships are highly sensitive to public opinion and to the number of casualties on both sides. This issue was well analysed by Martin Shaw (2005), who points out even the important role of media in building the consensus or in hiding the deaths. This way we can understand suicide bombings not only as an attack tool but also as a means to exploit weaknesses of Western strategy and western strategic thought.

The guerilla theme is important for other theories of modern warfare. Due to wars in Afghanistan and Iraq several scholars and analysts, referring to modern warfare, have started talking about insurgency and counterinsurgency (COIN). These two concepts highlight important features of the modern wars and tie them to the long military history in which guerilla warfare takes an important role (Kilcullen, 2005; Metz, 2007; Rid, Keaney, 2010).

With this theoretical background we can identify some characteristics of the modern warfare which are important to understand the problem of suicide bombings from a strategic point of view. Almost every scholar agrees that today wars are fought by irregular fighters sometime against a regular, conventional army, sometimes against other irregular groups. Technology is important but not in the way envisioned by RMA theories, instead it is important because it gives irregular fighters more fire-power, more and faster communication capabilities and more possibilities to build their own bombs and weapons.

From the debate on the transformation of war illustrated before, it is clear that modern warfare is some kind of a modern irregular war6 and, historically speaking, one of its typical characteristics is that the irregular force tries to win against a stronger opponent using cheaper tactics or rather tactics which can achieve the goal the irregular force wants without spending too much economic resources, time and men. Therefore in this kind of war there are many ambushes, raids, hit-and-run tactics and the irregular force uses small weapons (assault rifles, machine guns, RPG etc.). Nowadays these tactics remain valid and widely used but in modern warfare the use of mines, IEDs, car bombs and suicide attacks has grown. P.W. Singer highlights that ships loaded with explosives have been used since 1500s and mines since the American Civil War, but, even if they represent an early version of modern IED, they were used in small quantities in the past and they never had strategic consequences. Singer highlights that since IEDs demonstrated their ability to strike, their use will increase and they will not be a weapon only for insurgents. Similar to suicide bombing, “IEDs present increasingly difficult balance-of-costs problems”. U.S. have spent $17 billions on anti-IED gear, but one IED costs much less (Singer, 2012) since, according to Dietz (2011), 80% of Afghan IEDs were “made using home-made explosives (HME) developed from farm fertilizer, ammonium nitrate”. According to Brooking Institute (2012) data the U.S. Armed Forces counted 1756 casualties due to IEDs, that are the 39,2% of all the casualties in Iraq7.

This aspect leads us to another interesting theory of the current transformation of war: in “Open source Warfare” John Robb (2005) stresses the idea that modern fighters can communicate their successes and failures more rapidly than conventional forces and so they are always a step ahead of their enemy. But “Open source warfare” identifies another important aspect, that is the strategic impact of tactics. In the second part of the essay we are going to examine this aspect further with the Afghanistan case study, but now it is important to note that in Iraq insurgents were able to undermine the Iraqi economy targeting pipelines, power lines and other facilities of this kind. Robb (2007) calls this type of attacks systems disruption, which means using “sabotage of critical systems to inflict economic costs on the target state”. Insurgents do not try to destroy the entire system but only to keep the infrastructure to a level below what is needed. Robb’s idea is interesting because he underlines that such attacks are relatively simple and cheap but they create a big economic damage which can be long to resolve. The Brookings Institution (2011) counts 469 attacks against pipelines in Iraq between March 2003 and 26 April 2008 only, without taking into account similar operations against other facilities. The same logic could be applied to suicide attacks which, generally speaking, are not able to destroy military units or big targets but they can seriously damage and change the order of priority of regular forces affecting the enemy’s OODA loop as western theories of RMA try to do.

The background of these definitions leads us to understand ORMA band suicide bombing better. According to Itai Brun (2010), the ORMA originated from an analysis of weak points of western RMA because the understanding of these points allowed the weaker technological side to turn the tables in their favour following a strategy which has common features of irregular warfare in general. Firstly, irregulars “need to significantly improve their ability to withstand attacks in order to prolong their absorptive capacity” and this is a typical characteristic of irregular and guerrilla warfare which, according to Kissinger (1969), “wins if he does not lose; the conventional army loses if it does not win”. Throughout history, irregulars have always tried to prolong the fight in order to weaken the other side and destroy the will to continue the war. This way the conflict could be won not with more numerous, powerful and technological advanced weapons but with a stronger will and determination. In fact, according to Cassidy (2003), “irregular” warfare has six paradoxes which make more difficult for the great power to win in this context and one of the paradoxes is just linked to the will to fight, which is always stronger in the irregular side than in the regular side. So irregulars “need to move from a decisive win strategy to a strategy of attrition [...] due to Western sensitivity to continuous war and casualties”. Attrition means a long war and a long war means that the perception of a dead end situation can become stronger and stronger and at the end it leads to a public opinion’s request for withdrawal. So, while the West seeks a quick, clear and decisive victory, irregulars seek only to survive and to prolong the war in order not to lose it. But the suicide attacks highlight the difference with the history of guerilla warfare because unlike classic ambushes used by guerrillas which could cost a lot of casualties as a result of better training and fire power of regular infantry, suicide attacks minimize the casualties for the attackers (Michael, Scolnick, 2006).

Itai Brun (2010) indicates six vulnerabilities which irregulars were able to identify analysing the western way of war: emphasis on survivability of the fighting forces achieved by using bunkers, tunnels, camouflage, deception etc.; emphasis on high-trajectory weapons because they are technically simple, low cost, able to penetrate deep into enemy territory and difficult to find because they can operate from mobile launchers; confronting areal superiority with the use of active and passive means. But for our research purposes other two vulnerabilities are more important. Firstly, the emphasis on media and media centred propaganda, internet and so on in order to influence not only the local population (it is an important aspect since this kind of war is often an insurgency where the support of the population is central), but even the international community8. As a result of the revolution in telecommunications, media operations and perception management have became ever important and from the irregulars’ point of view suicide bombing has became the perfect propaganda tool due to its “horrific and sensationalistic effects” (Michael, Scolnick, 2006).

For the purpose of our study the greatest weakness is related to “the use of weapons and methods of operation that can lead to a high number of casualties”. In this vulnerability we can include both the IED and suicide bombers. Although the first suicide bombings were at the beginning of the ’80s, an important turning point seems to be the Second Intifada because Hamas discovered that “suicide bombings not only created a ‘balance of terror’ with Israel, but also provided advantages to the Palestinians”. In front of this threat Israel lacked “any deterrence or offensive capabilities [...] Israeli technological supremacy could not come to terms with Palestinians’ determination and willingness to sacrifice their men and women” (Brun, 2010). We can trace the same logic in Iraq against the Coalition forces leaded by the United States and it is clear that behind this logic there is the will to conduct a war of attrition (Beccaro, 2013).

1.3 Urban Warfare

Historically speaking, if the weaker side wants to follow an attrition strategy and to establish a credible deterrence capability, he has to fight in areas where the regular armies experienced more problems in the way they operated. For our analysis this aspect is really important because it opens a reflection on the urban warfare which helps us explain the development of suicide attacks. For this reason Itai Brun pinpoints another vulnerability, the sixth, of the western way of war on the emphasis on “close battle” where technological advantages are less crucial. In urban warfare the fighting is very close, in fact the physical characteristics of the cities push the two sides closer together compared to a traditional battle on an open battlefield. Streets, monuments, buildings (destroyed or not) limit weapon’s range and force the army to operate in small squads and to conquer each building (Scales, 2005). Because of all this, urban fighting takes time (helping the irregular in his prolonged war) and requires a lot of ammunition and more soldiers on the ground. Urban terrain balances the differences between regular army and irregular fighters because it generates close fighting at platoon level or smaller in which the technology plays a minor role (Grau, Kipp, 1999; Peters, 1996; Thomas, 1999). The idea to push western armies inside cities in order to prolong the war and to balance the technological differences between the two sides is not new, Peters highlighted it in 1997 and Scales showed in 2005 that this is not a possibility but it is a reality of modern battlefield because the enemy understood the need to fight in cities in order to undermine western power. Since in this kind of battlefield troops have to be divided to operate (Morrison Taw, Hoffman, 1994), this means that irregulars can choose more objectives to strike and more objectives mean less protection for everyone.

Thus, the third way we have tried to understand suicide attacks is represented by the increasingly growing phenomenon of the urbanisation of conflicts. Here we can neither explain the reasons of this trend nor try to demonstrate it, but some scholars9 have started to highlight how modern conflicts are fought more often inside cities. There is a demographic explanation to this trend because during the last decades an increasing number of people started living live in cities. According to the World Urbanization Prospects 2011 now about half of the world population lives in cities and this statistic is very impressive because it is the first time in human history that the urban population has the same number of rural population. But even more important the World Urbanization Prospects 2011 indicate that in 2050 urban population will be more numerous than rural population.

From our point of view, strategic, operational and military explanations to the urbanization of conflicts are more important than the demographic one. In this respect we can deal with the problem in two different ways. First, historically regular Armies have always had problems fighting inside cities for several reasons: complexity of urban terrain, civilian presence, lower to high (importance) technology weapons and so on. Secondly, urban terrain is perfect for irregular warfare tactics and terrorism in general. Hoffman (2006) noted in his book Inside terrorism that every terrorist group used urban terrain to carry out its attacks. Irgun in Israel used terrorist attacks to attract international attention on Israeli issues, the same idea was used by Grivas in Cyprus and in Algeria. The best way to do this is to carry out some big attacks under media eyes and the places where they are more present are cities. Moreover, in cities there are numerous targets to attack of different nature from a political one to an economic one. For the security forces it is simply impossible to defend every possible target so suicide bombing can attack the least defended building or place without losing the possibility of attack. The irregulars understood the importance of cities as Practical Course for Guerrilla War by ‘Abd Al-’Aziz Al-Muqrin, an Al Qaeda’s practical war manual of Al-Qaeda, demonstrates. Its contents are not very original compared to traditional guerilla manuals but it has some pages on how to operate inside cities, and it stresses the importance of cities because here there are a lot of objectives first of all economic ones. The manual indicates twelve advantages of urban operations including media coverage which helps the group to be known around the world (Cigar, 2009).

Another important aspect which helps us understand suicide bombing is again linked to invisibility. A suicide fighter is a civilian, dressed like a civilian, in a city full of civilians, he/she is only one of thousand or million of people living, walking or driving around. Just like other “irregular” tactics, e.g. snipering and IED, suicide attacks are very effective in cities because there it is invisible to the defender. On a classic battlefield, an open terrain where there are two armies confronting each other, a civilian walking around could be simply identified as a possible threat, but in a city this is simply impossible. The suicide fighter is completely visible to the defender but not his nature and the threat that he is carrying, so the human bomb is invisible and can attack when, where and how he/she wants.

2. Suicide-attacks in Afghanistan.
A triple way reading of the phenomenon10

The topic of this article section concentrates upon is the result of an analytic research where a number of complementary sources have been analyzed: on the one hand, the field research lasted around two years, on the other hand the open sources information and data analysis.

The theoretical approach we have chosen to adopt is based on the definition which indicates suicide-attack as an offensive or defensive action in a context of asymmetrical war, that for its own nature entails the irrefutable death of the attacker and the consequences of which could have repercussions on different levels: political, strategic, operational, tactical and psychological.

In Afghanistan the phenomenon of the suicide attacks is relatively recent; since 2001 it has been evolving on a technical and military level becoming a real threat across the country. Even if there are types of methods used in the Afghan war and classified as suicide tactic, including the so called “green on blue” attacks (or “insider attacks”, actions carried out by insider attackers within the Afghan security forces), we have taken into account solely the ones with the use of explosive equipment conventionally called IED (Improvised Explosive Device).

Aside from the ideological implications, the cultural justifications and the individual motives – on strategic, operational and tactic fronts, what contribute can the Afghan suicide-fighter give on the battlefield?

On the basis of the field research, following the analysis of the gathered data from the ASA11 database, (reporting 1264 attacks registered between 2001 and 2014), it was possible to answer the aforecited question, shedding some light on the technical evolution and on the role of the suicide-attack conducted by an Afghan shahid.

2.1 An approach to the phenomenon

The Istishhadi is an “independently chosen martyrdom”, the Shahid – “the living martyr” – is the individual who consciously decides to die for the cause.

Numerous studies have dealt with this phenomenon – often called “suicide terrorism” – Since the 90s. Few of these, have focused on the Afghan case, partially and in a limited manner. The limited availability of in depth studies is principally due to: the difficulty of gathering primary data on the field, because of the chronic state of war and the consequential precarious safety conditions and the consequence of the relatively innovative suicide attacks in the Afghan war emerged as a phenomenon since 2005.

Although a part of the scholars deals with the social causes and the suicide-fighters’ individual motives, this research concentrates on the possible reasons behind this phenomenon, as well as the tactical-operational and strategic factors. This is therefore an approach which looks at a number of attacks and not a single action.

Boaz Ganor asserts that this is not a new phenomenon, but that it is growing exponentially. It imposed itself as a modus operandi typical of the contemporary terrorist movements. The premise on which the correct analysis ought to be based is the concept of suicide-attack, as an “operational method” in which the real deed of the attack depends on the attacker’s death. Ganor’s contribution (2000), although not adding very much theoretically, contributes to define what an attack really is and gives an insight in his analysis of the operational potentialities of the suicide-attack tactic, that he defines as “the most sophisticated”; aside from individual reasons and religious radicalism what have caused the evolution of the phenomenon is simply the fact that this tactic has proved effective (Dershowitz, 2002; Pape, 2005) and allows them to reach immediate results on the battlefield and in terms of impact on the media coverage. Besides what Ganor insists on is the nature of this phenomenon: not a simple personal initiative, but the result of an “organized” process.

Bruce Hoffmann (2006) also offers a fine reading of this phenomenon, no longer analyzed as a way to obtain immediate results on a tactical level, but an objective of strategic nature, such as mass media amplification; the suicide attack tactic becomes an instrument of psychological warfare (Juergensmeyer, 2000). Besides Hoffman (2006) recognizes the suicide attacks a rational and simplified nature, as they do not impose the study of an escape plan.

Scott Atran (2004) offers an important contribution as far as the relationship between action and reaction is concerned: the repeated attacks would show how the tactic countermeasures based on the adoption of passive protective solutions would not result in a reduction of the phenomenon. This does not appear to be so, fast adaptability and flexibility would lead the Armed Opposition Groups (AOGs) to adopt more productive tactics and procedures. Atran believes that the presence of the foreign armies – in line with Pape’s opinion on the subject – does not contribute to containing nor contrasting the phenomenon effectively.

In contrast with this approach to the phenomenon, the literature on the evolution of the Afghan case is unfortunately rather limited and the report of the institutional organizations address the problem within their area of activity and they fail to analyze the tactical nature of the phenomenon in depth, and its operational evolution (and partially the social evolution) and, lastly, the strategic developments of the Istisshadi in Afghanistan.

What is still missing – not exclusively in the Afghan case – is a method to read the phenomenon, which takes into account all the information and the data, both the open source and the classified; the approach we propose and we are going to illustrate – thanks to the valuable database of information and data on over thousand attacks – has as objective the analysis of all the information components through a «triple way reading» which supplies the reader with a different perspective for each of the observation point (“attacks-events-subjects”) [see point 4].

2.2 Lexicon and methodology

In order to proceed with the study of this phenomenon it is convenient to choose the appropriate lexicon to define the problem.

As anticipated in the article introduction, recognizing terrorism not only as an “action” but as a “reaction” would allow one to consider it as a violent act and not as a product of tout court terrorism, but an act of resistance or a technique of armed opposition.

Nowadays terrorism is a word with a negative meaning used by one side of the conflict to define the other; and in Afghanistan suicide attacks mainly aim at military and institutional targets, while non-combatants are indirectly involved individuals, the so called “collateral damages”. The organization or the subject are terrorists, perpetrators of the shameful and publicly condemned act, which is never justified. We therefore kept a neutral standpoint.

Lastly, the three levels we concentrated on to analyze the effects of suicide attacks: strategic, operational, tactic.

1. Strategic level: It entails a long term strategy for the planning and consequently for the coordination of the actions intended to reach a specific objective and for the formulation of military plans. It is essentially the ability to reach macro objectives – i.e.” victory” – arranging resources, both actual and virtual (e.g. direct and indirect use of the mass-media, public opinions and propaganda), and deploying equipments and vehicles, for the purpose.

2. Operational level: It relates to the theater of war /overall outcome of the military operations in the operational area and the aim of which is to reach, on a strategic level, the desired outcome; it is based on the results achieved on the battlefield and on the coordination, on a tactical level, of the actions/operations. The repetition of the successful tactics is functional to reaching the operational objectives. At this level we talk about an “emerging strategy”, a collection of decisions that single groups, either with the other groups or singularly, act upon as a response to changes of external circumstances and to the way strategy is interpreted.

3. Tactical Level: Strictly speaking, it is the battlefield and it refers to the deployment of vehicles and equipments and the employment of military resources in order to reach a partial objective or a series of intermediate successes. It is a selection of actions aimed to reaching a specific aim and it deals with the deployment of forces, adapting the tactics, the procedures and to conform the results obtained to the desired outcomes. In all tactics – among which the suicide attacks – strategy, as a whole, is the logical basis and conditions them giving them a common aim.

3. Sources and methodology

As the quantitative nature of this phenomenon can be observed empirically and it is functional to the definition of the phenomenon dimensional boundaries, the research has moved in this direction taking advantage of the primary data gathered on the scene of the attacks, open source information (institutional reports, unclassified information, mass-media and propaganda) and classified data available on Wikileaks (2009). The information, broken down, categorized and processed, has contributed to a more complete and reasoned way of deciphering the armed opposition and the results obtained by suicide attacks.

4. The database

One of the most significant limits in the analysis of this phenomenon is the shortage of data and information from explorative studies; this is a real limit when trying to deal with the Afghan case as a phenomenon. Besides, the security organizations – local and international – have limited and often non-coherent cataloguing methodologies that we had a chance to assess personally. The NATO-ISAF studies and research products are often approximate and rarely show results that enable the understanding of the problem in its complexity. Recent publications have partially – although sectorially – filled the “knowledge gap” about the Afghan case; but this is still not enough.

A more in-depth assessment cannot leave aside the statistics on the frequency of the attacks, the analysis of the tactics and of the objectives, the evaluation of the geographical implications, the direct and indirect effects on the so-called battlefield, and the consequences of the mass-media exposure. What is still missing is a database built on these data and criteria, detailed and shared among the security and cooperation organizations. This is what we have tried to accomplish.

The methodology for qualitative research utilized partial data, often incomplete, supplied by the Afghan Ministry of the Interior (UNAMA, 2007). On a quantitative level, in spite of the theoretical information, the results have yet to prove appropriately used for the study of this phenomenon and its effects on different levels: tactical, operational and strategic. The simple possibility of theoretical access to a significant wealth of information does not represent the ideal tool for the study of this phenomenon, however it is its use that contributes to an effective analysis of the problem. We therefore proceeded processing the data and the information selecting them accurately and ultimately organizing and synthesizing them. Following on Pape (2005), Moghadam12 (2006b) and Tosini’s (2009; 2012) footsteps we wanted to analyze the Afghan phenomenon through an empirical research and a statistical study of the information available on each attack. The contributions of this research are mainly the quality and the comprehensive information, and a fundamental categorization and compartmentalization of collected data; specifically we wanted to draw the attention on the 647 cases registered in the database WITS (Worldwide Incident Tracking System) of the National Counterterrorism Center (NCTC)13, on the 545 cases that Pape cataloged for the Chicago Project on Security and Terrorism (CPOST)14 and the registration work carried out by the Global Terrorism Database (GTD)15; Authors’ archive of suicide attacks (ASA database) carried-out in Afghanistan (including the failed attacks and the ones classified as peripheral and therefore not included in the ordinary statistics) contains data concerning 913 single cases (period 2001-2012). There is a substantial difference between the methods, this enabled us to show more reliable results and conclusions that thanks to their breaking down and organization into subcategories led to three very distinct ways to read-of the Afghan suicide attacks phenomenon in contrast with the one way reading of the other databases, as they classify the attacks as separate, regardless of the number of suicide-fighters, attacks and simultaneous targets (see further on). We therefore devised a database of all the data gathered from three different sources: open source information, classified and unclassified reports, revendications/propaganda from the AOGs. What we have collected is, originally partial and incomplete, information that thanks to a process of systematization have contributed to what can be considered the most thorough database of the Afghan suicide attacks since 2001. What sets this database apart from the ones currently available (WITS,CPOST,GTS) is not the quantity of the information processed, but the analysis of each piece of information, that way it has been broken down and differentiated of the single data structured in informative macro-areas. Analyzing the Afghan suicide attacks phenomenon, it is the participation to the action or the event that becomes significant; while the aforementioned databases show the direct effects (typology of objectives, tactic and damage to the enemy). The analysis of the data, becomes of paramount importance, whose aim is the definition of how many individuals contribute to reaching the tactical-operational objectives and hence to understand the evolution and the participation to the phenomenon. Here are listed the nine macro-areas of information on which the reading and the analysis of the information gathered, filtered and systemized, is based:

1. “Temporal” area (Date, day of the week, time);

2. “Spatial” area (Province, district, town, village, military headquarters)

3. “Technical” area (SVB-IED, SBB-IED, commando, unreported tactic);

4. “Action” area (Total of attacks, events, attackers);

5. “Personal” area (Gender, age, nationality, province/town/village, education, ethnicity)

6. “Group” area (AOG responsible for the attack, revendications, etc...)

7. “Effect” area (Dead and wounded, ANSF, ISAF-NATO, civilians, contractors, civilians/soldiers ratio, etc,...)

8. “Target” area (ANSF, ISAF-NATO, government targets, UN, ONG/PSF, non-military targets, locations, etc...)

9. “Outcome” area (Failure, success, functional stop, impact on mass media)

The analysis which followed shed light on an evolutive trend of the phenomenon on a quantitative level (number of attacks) and on a qualitative one (techniques improvement and flexible adaptation to countermeasures), but also on the social level (increase in the number of suicide-fighters and expansion of the recruiting pool).

5. Data and analysis

5.1 Evolution of the phenomenon

From the single cases in 2001 and 2002 the number grows and reaches 25 suicide attacks in 2005; the following year the events unfold on a weekly basis, and in 2007 the attacks are three to four a week and its yearly total reaches the number of 159. In 2008 165 suicide attacks are registered and from this year – with a fairly constant frequency until 2011 – they level out with high figures, while the number of attacks levels off, the number of the suicide-fighters grows. From a spatial point of view, suicide attacks have progressively spread across the territory. Although the southern and eastern regions have been hit by the violence of the attacks, the phenomenon evolved in the northern, western and central areas of the country, becoming an efficient and functional tactic. The regional subdivision chart (Fig.1) highlights the higher number of attacks in the southern provinces, followed by the southeastern and central regions. Kabul represents a different case. In the last few years the attacks have increased exponentially concurrently to the introduction of a new policy adopted by the radical groups operating under the banner of the Islamic Emirate (in primis the Haqqani network). The main roads and the most crowded urban areas are places where, in percentage, most of the attacks take place. The strategy of carrying out spectacular actions is a priority for the AOGs and the fact that they choose to hit with a high concentration of (local and foreign) security forces, as well as journalists and reporters, is a symptom of their will to hit symbols of the enemy on the battlefield, but also ideologically (Bertolotti, 2011), while trying to attract media attention.

Figure 1: Geographical distribution of the phenomenon
(per ISAF Regional Command)

With regards to the indirect effects, the number of victims is growing progressively, although the attacks are concentrated mainly on military and government targets, the victims are mainly civilians. In 2007 suicide attacks killed 497, 282 of whom were civilians, 28 foreign soldiers and 169 Afghan soldiers and police officers (Afghan National Security Forces, ANSF). If we compare it with the data statistics of the previous year, 307 killed of whom 216 civilians, this shows an increment of victims of 31%. The total of people killed grows in 2011, too; a total of 449 civilians, 235 Afghan soldiers and police officers, and 18 foreign servicemen (Figs. 2 & 3). The reason for this escalation may be interpreted as the result of a winning strategy in primis economically, thanks to the costs of the tactic and on a communication level, thanks to the ability to attract the media attention.

On the basis of the media attention rate trend of these operations – besides the tactical success – (Fig.9) it is possible to identify a pretty constant trend of an offensive phase, where the attacks are going to have a significant role and can be marked by a greater number of suicide-fighters.

Figure 2: Trend of civilians and soldiers’ deaths:
Civilian collateral damages versus ANSF and ISAF/CF members killed

Figure 3:Percentage of civilians and soldiers’ deaths

5.2 Techniques and attack procedures: Suicide Body Born-IED,
Suicide Vehicle Born-IED and Suicide-commandos (SC-IED)

The increased frequency of the actions is a clear indicator of the enhanced ability and technical expertise, and it is proof of how their belief in its benefits from an opposition and insurgency strategy perspective has matured and is not simply a tactic to be used on the battlefield. In such context an evolutive process of this phenomenon has emerged and reached 2014 through an amplification of an increasingly more spectacular and structured offensive.

Between 2005 and 2007 the AOGs used mainly two tactics: the “Suicide Body Born-IED” (SBB-IED) and the “Suicide Vehicle Born-IED” (SVB-IED); the period 2008-2014 marked the beginning of an increasingly more widespread use of the suicide-commando-IED (SC-IED) tactics that we have analyzed further in the following sections (Trend confirmed in 2012-2014).

A seesaw like trend in the use of the tactics started emerging in 2006. In the first months of that year the statistics show a substantial decrease of the SVB-IED technique, reaching 63% of the total of the attacks, lowering to 58% in 2007 (Fig.4). The percentages have followed a decreasing trend between 2008 and 2011(61% in 2008, 59% in 2009, 43% in 2010, 36% in 2011 and 33% in 2012) concurrently to the disappearance of the multiple suicide-commando attacks, the third and latest tactics adopted in the Afghan conflict; finally, during the period 2013-2014 the percentages are 46% and 44%.

The data referring to 2008 shows a new situation also in the SBB-IED (single suicide-fighter) attacks. While they represent 40% in 2007, the following year the percentage is down to 32% to increase progressively from 29% to 33% in 2009-2010, to 45% in 2011. 2012, 2013 and 2014 percentages are respectively 36%, 29% and 30%16.

In 2008 a new tactics appeared in the Afghan war: the commando units, flanked and supported by fighters and support elements. A tactics that has proved efficient reaching 12% of the actions in 2009, settling between 22% and 19% in 2010-2011, 31% in 2012, 22% in 2013 and 26% in 2014. This is an efficient tactics – the result of two classic methods of SBB-IED and SVB-IED alongside the conventional tactics of the armed attack based on the coordination of one or more suicide-fighters (often divided in sub-units or echelons) supported by a close protection unit. The generational change at the summit of the insurrection may be at the origin of the introduction of the new combat tactics, while the cooperation among different groups led to the concentration of this kind of attacks in the areas of Kandahar, Helmand and Kabul in particular, concurrently with the rapid expansion of the Kabul Attack Network of the Haqqani Group. Kabul evidently represents an important target, strategic and symbolic at the same time; here where the opportunities to hit high profile targets are high and warrant an amplified media-eco, in the last four years the cooperation among the opposition would be the reason of a significant augmentation of the so called “spectacular attacks” (Bertolotti, 2010, 2011).

Figure 4: Comparison of the attacks SBB-IED, SVB-IED and SC-IED, 2001-2014

5.3 A triple way reading: “attacks-events-subjects”

Conventionally, a suicide-attack is an action, the success of which is the consequence of a conscious dying of the suicide-fighter. This classic and widely accepted definition might lead to consider a single attack as an isolated event – regardless of the number of suicide – fighters and targets hit. How would one behave in front of the so-called multiple attacks (suicide-commandos), against a single or multiple targets simultaneously?

To answer this question a painstaking process of collection, reading and analysis of all the elements available is needed, as the method used to read the information has a significant effect on the interpretation of the data, hence the analysis of the problems and its solutions. The approach we propose is based on the principle of data compartmentalization, therefore we consider it appropriate to proceed with the analysis of the events classifying each act through a triple way reading (cf. Fig 8), a method that allows the observation of the phenomenon from three different points of view. This is a study method different from Pape’s method (CPOST) – which lacks in classifications on the basis of the type of attack and composition of the group of assailants, and different from the approach of the U.S. National Counterterrorism Center (WITS database), as the latter does not consider the number of participants to each action or event.

Thanks to the triple way reading illustrated in this section, the attacks (including the enumeration of acts with at least one suicide-fighter reported as death) are registered, interpreted and classified on the basis of three categorization processes.

1. The first category is the “attacks” category. This includes attacks reported at a specific time and circumscribed place, regardless of the number of suicide-fighters and targets hit. It tends to coincide with general and undetailed information from the media (open source).

2. The second category called “events” category comprises the number of simultaneous single actions that have been strictly coordinated, or linked to the same organization, group or mandant and it includes every single attack that has been carried out simultaneously against different targets (in this case the suicide-commando operations are counted on the basis of the targets hit). This data is the result of the analysis of not classified information as open source (TV reports, newspaper articles, news) and classified reports as originating from ISAF/Coalition Forces (available from Wikileaks) and secondarily from the web revendications of the insurgency groups and the security forces’ information activities.

3. The third category is the “subjects” category. The subjects are the suicide-fighters who carry out the attack(s). Its reading and even more its analysis takes into consideration the statistical and, although not strictly speaking, the social aspects. Its calculation is not limited to the single or multiple acts (actions and events), but to the number of suicide-fighters who carry out the attack (excluding the arrested and the survivors). Also in this case along with the analysis of the texts the AOGs and the Security Forces’ statements contribute to the information.

One example, in brief. The 9/11 attacks to the United States: 1 attack, 4 events17, 19 subjects.

The results of the data classification are three different methods for the reading of the information, coherent to each of the approaches to the phenomenon, and enabling the reader to analyze them with three different outcomes. They are as follows:

1. “Attacks” trend (Fig. 5): This method allows a positive general assessment, when lacking a rational process of categorization, by inserting a simple data in the graph this will give a result corresponding to a significant decrease of suicide attacks between 2008 and 2012 (and, more in general, a low number of attacks).

The first approach lends to a positive interpretation of the trend tending to show a progressive reduction of the suicide actions in the period 2008-2012 (cf Fig. 5). This methodology – also used by Pape (cf. CPOST database) – is currently used by NATO-ISAF and by the Afghan government organizations and it is functional to the need of presenting this phenomenon in a phase of containment and reduction; this in order to show how efficient the countermeasures are, capable of reducing threat significantly.

What does not exist is a real counteroffensive strategy and, effectively, what can be deduced, analyzing the procedures adopted by the security forces, is an effort centered on the short term and limited to force protection measures at tactical level: at present no common counteroffensive appears to have been used on the battlefield. On an analytical level, being a methodology based on the observation of partial data, the result would be a consequence of an incomplete and misleading reading, that could show the situation to be the opposite than the real one, a potentially incorrect interpretation of the phenomenon. We have called this an “opportunity method” – incomplete therefore not reliable – useful to demonstrate results in the countermeasures and the problem solving that actually have never been materially obtained.

“Events” trend (Fig.6): This approach to the data analysis obtained from the calculation of the single actions carried out simultaneously, or coordinated among each other, allows the examination of the evolution of suicide-attacks from a different perspective: the one of complexity and operational intensity. Thanks to this approach it is possible to read the phenomenon as relatively stabilized: using this kind of analysis would lead to an assessment of the situation in a phase of “containment”, hence it is functional to demonstrate a partial effectiveness in the threat containment process.

2. The second approach was inspired by the constructive criticism on Pape’s methodology by Moghadam (2006b) in his analysis of the suicide attacks phenomenon.

This method, that we might call “operational”, contributes significantly to the attempt to answer the question on the evolution of this phenomenon through a reading of the data based on the analytical examination of the events, although Moghadam himself does not refer to it in the WITS database; this method is centered on an in-depth approach of analysis, although limited to the direct effects on the battlefield, as it takes into account the contemporary and coordinated events (reported appropriately as single events in the “action” category). Thus the graphic transposition of the data gives a perceptibly different picture compared to the result obtained with the first method, with a relative stabilization of the phenomenon (cf Fig.6). The attacks, in contrast with the interpretative analysis of the first method, don’t decline, but they stabilize on high figures as of 2008, showing, on the one hand, the ability of the AOGs to maintain a high operational level, on the other hand, it would contribute to a negative assessment of the countermeasures adopted by the security forces. It is a method, although partial, that contributes to the description of the phenomenon evolution on a temporal and also on a tactical progress level.

“Subjects” trend: The third reading method is certainly the most interesting one; it describes the phenomenon as growing sensibly and suggests notwithstanding the absence of an effective counteroffensive strategy. Hence, thanks to this observational method, the phenomenon – whose magnitude and potentiality would be highlighted by a growing operational and social recruitment pool of suicide-fighters – can be read as in constant evolution.

3. The third approach, that we called “para-social” – as a social study activity would have needed a qualitative research methodology based on a representative sample of subjects18 –, it takes into account the total number of individuals that take part and carry out suicide attacks. Using this method to read the data highlights an interesting side of the Afghan phenomenon, showing its evolution in quantitative terms (i.e. ever enlarging recruitment pool, increasingly more developed organizational ability of recruitment teams, efficient connection and coordination work) and qualitative (training level, equipment, technical evolution, etc.). The number of would-be suicide-fighters is growing, it even doubles year on year (see Fig. 7) until 2011 with a decrease in 2012 – the year of the operational reduction of US-led coalition troops – and a new increase in 2013-2014: the results are surprising and show, also in this case, the lack in reliability of the first method as it is based exclusively on reading the actions, and at the same time it shows how tenuous and ineffective a prospective prevention and counteroffensive strategy can be. This different approach supports the analysis and the threat assessment in the medium to long term, highlighting adequately aspects such as individual participation (i.e. number of suicide-fighters) and the insurgency’ operational ability (i.e. recruitment, indoctrination, information gathering by tactical-logistic support groups). This method, along with the “operational” reading that the second method warrants, has proved to be more functional to research, as it gives a more complete overall picture of the Afghan phenomenon, its progress and its potential developments both on a military level and on a social one.

Figure 5: Graphic representation of the “attacks” trend between 2001 and 2014

Figure 6: “Events” trend graph for the period 2001-2014

Figure 7: “Subjects” trend graph for the period 2001-2014

Having demonstrated how unreliable is the analysis based on a first reading method (i.e. “attacks category”), it is possible to assert that the second approach (i.e. “events category”) enables a significant contribution to the understanding and definition of the suicide attacks role on the medium term and on an “operational” level; as regards the reading and analysis of the “strategic” and “social” role of the suicide attacks and with a third more comprehensive approach, the third method (i.e. “subjects category”) contributes significantly to the forecasting and assessment on the long term. See Fig. 8 for the results obtained with the three reading methods.

Figure 8: The 2001-2014 “triple way reading”: “Attacks”, “events”, “subjects” trend comparison.

5.4 Failure and success: effects of the suicide attacks

From an operational viewpoint, suicide attacks have proved to be a successful technique on different levels. Primarily from a mass-media attention rate perspective, year on year the Afghan AOGs – firstly the Taliban – have managed to direct the media attention on the Afghan war thanks to a rational strategy centered on media-attention grabbing actions, such as the multiple suicide attacks (commandos) against government infrastructures in main urban areas, targeting high profile politicians, leading attacks against international military bases, etc.; this takes place regardless of the tactical outcome they reach. This is not new in the study of suicide attacks; the Japanese in the Pacific Ocean during World War II, the Chinese in Korea and the Vietcong in Vietnam, just to list a few recent ones, have all used suicide-commandos. With the exception of the Vietcongs who infiltrated the U.S. Embassy in Saigon during the TET offensive, lacking an international media-eco, their importance was purely tactical; of the latter, just like for the Taliban commandos, we remember the torn bodies that shocked the American audiences as the media – yesterday like today – showed those images around the world.

Secondarily the Afghan insurgency obtained positive results from an operational functionality perspective. The rational approach of the AOGs emerges from the results they obtained on the battlefield where the majority of the attacks, besides the direct and the immediate effects and the coalition forces’ public statements, reached a tangible goal: the “functional stop” (or “operational stop”). This definition indicates all the events that had a significant impact on the operational level of the security forces (i.e. vehicle and building damages, wounded soldiers and police officers, movement limitation, etc.); these effects have direct repercussions on the security forces’ activities and are capable of limiting access to certain areas, imposing longer times and limiting the ability of maneuvering following classic schemes and standard times and also reducing efficiently the technological advantage and the operational potential. There have been tangible results and, between 2009 and 2012, the attacks success was relative (functional stop) on average in 78% of the cases (88% in 2012, 72% in 2013 and 75% in 2014); this was calculated taking into consideration the damages, direct and indirect, caused to the targets, independently by the presence of victims.

In addition to that, the ability to affect the troops’ morale sensibly has to be considered: the psychological effect of suicide-attacks, or simply its potential threat, represents another concrete result. Less than half the attacks have hit foreign military targets, needing a high contribution of suicide-fighters for a result that was a relative failure in terms of international forces soldiers’ deaths. But what appears as a failure at first sight, actually can prove to be an important goal: the martyrdom tactic has been capable of conditioning significantly the force-protection measures of the security forces raising the cost of war, in spite of the moderate material and human costs. Therefore it is possible to assert that suicide-attacks tactic is a tactical weapon capable of inflicting significant repercussions and costs. The results obtained to the detriment of the security forces would confirm the validity of this tactic; even if not in quantitative terms, it is possible to hypothesize that the AOGs are going to use this tactic further, incrementing the numbers of would-be suicide-fighters, improving the quality of the equipment and perfecting the technical operators’ training in order to be able to strike more efficiently. Furthermore what can be deduced by analyzing this phenomenon on the whole is that today the AOGs, thanks to a good level of information-sharing and the use of technological instruments, are able to learn and share new techniques and tactics far more quickly that they used to.

On the basis of these factors, will the impact of the suicide tactic contribute to the cost increment of the mission for the Afghanistan western armies? The results obtained have enabled the AOGs to adapt the explosive devices to better fit their tactical needs. As far as update and adaptation are concerned, the AOGs anticipate the Afghan security forces and the coalition forces. This happens because the insurgency’s adaptability is a lot faster than the conventional forces: it is faster and cheaper to increase the suicide attacks’ offensive ability and its destructive potential than projecting more armored and high technology vehicles and equipments; in comparison to the inexpensive suicide-fighter kit, international security forces invested billions of dollars in new equipments19 and incremented the number of security officers20. An augmentation in the level of protection translates in the need for more powerful devices in order to cause damage: a vicious circle influencing significantly the statistics of collateral damages, the civilian victims, that Taliban (as well as the NATO) rationally consider a calculated risk – although formally the opposite happens21.

More than thousand22 “Afghan cases” have been registered and categorized in order to analyze the evolution of the phenomenon. On a military level we can assert that the relevance of the suicide actions is partially significant, it is also evident an increased advantage on the battlefield: ability in recruiting and training would-be suicide-fighters. This would show that the AOGs have made important progress on the “social battlefield”, the “human terrain” contended with the supporters of the counterinsurgency doctrine as a solution for the Afghan war (Petraeus, Amos, 2006). Lastly, it is evident that suicide attacks represent a successful political choice on an operational level and from the perspective of its media success. In brief (cf. Fig 9):

• On the strategic level, suicide attacks caught the attention of the regional and International media in 78% of the cases while the multiple actions/commandos attracted 100% of the media attention; a clear and pursued media success that has a great impact on the recruitment campaign of would-be martyrs, whose numbers grow as time goes by, “stoking” the potential pool of suicide-fighters, the number of whom is greater than the number of actions carried out (Fig.7).

• On the operational level, suicide attacks caused a functional stop to security forces in 8 out of 10 cases (78% on average, 88% in 2012, 75% in 2014) causing material damages, reducing the operational potential, limiting the army and the police’s operational capabilities and freedom of moving and maneuvering.

• Lastly on the tactical level (i.e. the real battlefield) – conceded that the objective is to cause the enemy’s death (in the majority of cases local and foreign security forces’ members) –, suicide attacks do not reach the chosen target on average 42% of cases (including all the attacks between 2001-2014). We should take into consideration how such a long period of time has a significant effect on the margin of error; evolution of the last examined period of time (2009-2014) shows an improvement trend and an increase of the attacks with a positive outcome. The results in the last year (2014), in particular, show how a tactical success was reached in 54% of cases while 26% of them were formal failures.

Figure 9: Media attention, Functional Stop and Tactical success:
effects of the attacks trend (normalized data on total of attacks).

Analysis of available data would attest that suicide attacks are important as much on an operational level (i.e. reduction of the security forces’ operational capabilities) as on a media attention level; the latter is exploited for political and propaganda purposes as shown by the media attention statistics both regionally and internationally. We can therefore talk about assessed political-military strategy, the objects of which in order of priority consist of:

• Attracting media attention regardless of having reached the tactical objective (i.e. killing of the enemy/destruction of a target) in order to influence the governments taking part to the international security mission (in order to push foreign contingents to disengage from the war and to oblige the sole Afghan security forces to oppose the AOGs);

• Contributing to the imposition of an operational stress condition (particularly through the use of a “functional stop”) aiming to influence indirectly the current political and negotiation processes that would lead the insurgency movements (Taliban, Haqqani network and Hezb-e Islami Gulbuddin Hekmatyar) to an advantageous position at the negotiating table obtaining a formal recognition;

• Creating a state of general insecurity (thus demonstrating the inability of the local and international forces to warrant a minimum level of security) with significant repercussions on the public opinion, internal social condition and on the struggle for the local power (the latter is used as a tool for the AOGs to rise to the status of mediators-resolvers in the local conflicts).

All the objectives, in particular the first and the second one adhere to the idea of contrasting the “direct” military occupation and the foreign interference; a local-nationalistic struggle, disengaged from the qaedist pan-Islamism (Tosini, 2012), as a conflict with a revolutionary nature (i.e. deposing of the Kabul government and establishment of an Islamic Emirate).

It is assessing that suicide-attack tactics would not be chosen for military reasons, because a lack on results at tactical level; on an operational level there are significant results although it is the strategic level – similarly in other theaters of war – that benefited from the devastating effects of the suicide attacks. Lastly, on a social level, what one can observe is that in the period 2009-2012 there has been a reduction in the total of attacks (in particular in 2012) but in contrast with a doubled number of suicide-fighters registered in the period 2008-2011.

Finally, suicide attacks have newly increased during the period 2013-2014, in parallel with the foreign troop’s reduction and the AOG’s offensive concentrated on the ANSFs and the Afghan governmental objectives.

6. Conclusions

The suicide attacks strengths are the low costs and the immediate and amplified effects; a tactic that, unsuccessfully countered, enabled the AOGs to reach significant results on different levels: strategic, operational and not negligible tactical.

The continuous techniques and operational procedures changing and adaptation highlight the strategic rationality of the AOGs, that have been able to counterbalance the medium to long term successes with the collateral damage (See Fig. 3); while the security forces have adopted countermeasures in order to fight the direct effects systematically, but not the main causes of this muted strategy (Hoffman, 2006).

Tactically, the security forces appeared to be concentrated where the AOGs seem less interested in reaching tangible objectives. On the force protection front – defense and security measures – the delimitation of secured “green areas” with a limited access represented the first and most obvious containment action, but it was not sufficient to fight the threat, as it is a military countermeasure, with tactical effects in the short term, demonstrating not to take into consideration the political-strategic aspects; not a strategic response is being adopted at the moment and it is likely that intensity, quantity and lethal nature of the attacks will proceed in parallel with the political and military conditions.

Figure 10: 2001-2015 NATO/ISAF-OEF/Vigilant Sentinel military presence
in Afghanistan

Finally, on the one hand, AOGs registered in 2012 qualitative results in Afghanistan (as well as in Syraq): augment of “functional stop” effect, increase in killed security members, and more media attention (a decrease of the international media attention in 2015-16 should be assessed as the consequence of the foreign disengagement from Afghanistan). On the other hand, the quantitative decrease of actions and events in 2012 should be effect of the reduced military pressure, of the diminished military presence and capability in rural and peripheral areas and of the political decision to disengage the main part of US-led coalition combat troops from the Afghan conflict23. In line with Pape’s (2005) theory regarding the correlation between «foreign military occupation» and suicide-bombings phenomenon, in Afghanistan suicide attacks 2001-2012 trend proceeded in parallel with US-led coalition troops level, as observable in Figure 10; in 2013-2015 the main targets of the attacks remain the ANSFs and the Afghan institutions indicated as “puppets” of the foreign invaders by the Taliban propaganda.

Aim of the research was to describe the military aspect and results of suicide attacks tactic introducing the «functional stop» category and considering the strategic and political results through the interpretation of media outcomes – with direct and indirect effects on public opinions and political decisions.

This is an important and innovative contribute, applicable to different study-cases and functional to tactical, operational and strategic analysis of the different modus operandi applied in the contemporary asymmetric conflicts – in particular the guerrilla/insurgency actions, the complex ambushes based on Improvised explosive devices combined with direct fire.

It is an analysis and assessment study which represents an important contribution for the researches focused on offensive tactics used in asymmetric conflicts, on their effects, results and the possible conclusions.

Broadening the analysis on suicide-attacks to asymmetric conflicts is a key factor in order both to better understand this kind of conflict and to examine in depth the suicide-attack tactics. Indeed, if we look at the Mediterranean Region we can see that mainly ISIS (Islamic State of Iraq and Syria) uses in a systematic way suicide-attacks and it has integrated them in its warfare. ISIS used this tactics since the insurgency against U.S. troops in Iraq when the group was named Al-Qaeda in Iraq (AQI). They used suicide-attacks in order to strike civilians and to create the conditions of a civil war between Sunnis and Shias. After the surge of 2007 the violence in Iraq has dropped as well as the use of suicide-attacks (according to the Brookings Institution data suicide attacks in 2009 were 51 against 172 in 2007) but they did not disappear: for example during 2009 electoral campaign on 25 October two suicide-attackers (one in a small bus and one in a minivan) targeted the Ministry of Justice and the Baghdad Provincial Council building killing 155 people.

It was after the U.S. withdrawal at the end of 2011 that suicide-attacks have taken a “new” form. It is noteworthy that the strategic situations in “Syraq” and what we have analyzed in Afghanistan are different because there insurgents fought against local and U.S./Western forces, in “Syraq” and in other asymmetric conflicts in the Mediterranean Sea (Libya, Sinai, Lebanon) the fight is sometimes between a conventional army and irregular fighters and sometimes between different irregular fighters. Starting from 2011 the security situation in Iraq begun to worsen and AQI to strengthen changing its nature in addition to its name. Thanks to the civil war in Syrian the group was able to consolidate and to build up its political and military structure, to gain new war experiences and then to penetrate again in Iraq where it has launched the Breaking the Walls campaign (July 2012-July 2013) with at least three goals: first, to liberate former group members from Iraqi prisons in order to strengthen its organization; secondly, to improve its military capabilities and to gain terrain; thirdly, to show and to demonstrate Iraqi military and political weakness. In order to achieve these goals AQI used a mixture of different tactics some more related to the guerrilla some other more related to terrorism creating a new “hybrid” form of war that has became the ISIS way of war.

During the Breaking the Walls campaign AQI not only changed its name in Islamic State of Iraq and al Sham (8th April 2013 following the military victory in al-Raqqa in Syria) but also it “executed 24 VBIED waves that showcased the technical, logistical, and training capacity underlying AQI’s VBIED program” (Lewis, 2013). Within this campaign AQI increasingly used suicide-attacks mainly starting from April 2013, and even if they did not overwhelm non-suicide operations, the increase indicated two important factors: the increase of foreign fighter activity and an organizational shift toward operations that could be better executed by suicide-attacks. Indeed, an ISIS suicide-attack is not simply a bomb-attack with a suicide bomber, but it is a different tactical operations involving sophisticated support teams.

Consequently, ISIS has increasingly integrated suicide-attacks in its military operations and so they are becoming just a part of a more complex military operation that encompasses tactical coordination with other units, small units movements, using different weapons (from small arms to artillery). We can cite several examples of this kind of cooperation and of operation but the most recent happened in May 2015 in Ramadi where after one year of attacks ISIS conduced a series of suicide-attacks outside the compound that housed the city’s main police station and governor’s office and then seized control of all the city.

When ISIS uses suicide-attacks in this military way it uses special vehicles because in these cases it does not need to hide them in the civilian traffic. Indeed, especially after the conquer of Mosul (June 2014) ISIS has improved again its suicide-attack capabilities using Iraqi military vehicles, such as HUMVEE, or heavy vehicles such as trucks or bulldozers (Naylor, 2015). Online it is possible to find a plenty of images about this kind of vehicles which are very often heavily modified with more armour plates in order to resist to small-arms fire and to anti-tank grenade or missiles. ISIS needs this kind of “military” vehicles because they have to survive in a true battlefield, moreover these vehicles are often equipped with heavy metal structures on the front in order to break defence lines and to go off inside the building- or defence structure- target. In this way the suicide-attacker is like a PGM or a cruise missile as we said in the first part of the paper, because he is able to strike precisely the target and blow himself only when he is on or inside the target. Peshmerga and Shia militias have started to extensively use against this kind of threat anti-tank missile (Milan or AT-4) with success but the tactics remains valid and extensively used by ISIS.

Thanks to a combination of targeted killing, suicide-attacks, guerilla operations, media and political campaign ISIS was able to conquer a wide space between Iraq and Syria and smaller space in Sinai, Libya and Lebanon becoming a strategic and geopolitical threat in the Mediterranean Sea.

Bibliography

Adamsky D. (2010). Jihadi Operational Art: The Coming Wave of Jihadi Strategic Studies. Studies in Conflict & Terrorism, 1: 1-19.

Ashworth S., Clinton J.D., Meirowitz A., Ramsay K.W. Design (2008). Interference and the Strategic Logic of Suicide Terrorism. American Political Science Review, 102: 269-273.

Atran, S. (2004). Trends in Suicide Terrorism: Sense and Nonsense. Erice: World Federation of Scientists Permanent Monitoring Panel on Terrorism.

Beccaro A. edited by (2012). Charles Edward Callwell, Small Wars. Teoria e prassi dal XIX secolo all’Afghanistan. Gorizia: LEG.

Beccaro A. (2013). La guerra in Iraq. Bologna: il Mulino.

Bertolotti C. (2010). Shahid. Analisi del terrorismo suicida in Afghanistan. Milano: Franco Angeli.

Bertolotti C. (2011). Attacchi suicidi in Afghanistan. Eurasia – Rivista di Studi Geopolitici, 1: 99-107.

Bertolotti C. (2013). Attacchi suicidi in Afghanistan. Tattica militare e strategia politica tra fallimento e successo. Torino: University of Torino, Ph.D. Thesis.

Biddle S., Friedman J. (2008). The 2006 Lebanon Campaign and the Future of Warfare: Implications for Army and Defense Policy. Carlisle: Strategic Studies Institute.

Brooking Institution report 31 December 2009.

Brooking Institution report 28 February 2011.

Brooking Institution report 31 January 2012.

Brun I. (2010). ‘While You’re Busy Making Other Plans’ – The ‘Other RMA’. The Journal of Strategic Studies, 4: 535-565.

Bunker R.J., Sullivan J.P. (2004). Suicide Bombings in Operation Iraqi Freedom. Arlington: The Institute of Land Warfare, Paper n. 46.

Callwell C.E. (1996). Small Wars. Their Principles and practice. University of Nebraska Press: Bison Books.

Cassidy R. (2003). Russia in Afghanistan and Chechnya: Military Strategic Culture and The Paradoxes of Asymmetric Conflict. Carlisle: Strategic Studies Institute.

Charette R.N. (2007). Open-Source Warfare, http://www.spectrum.ieee.org/nov07/5668.

Cigar N. (2009). Al-Qaeda’s Doctrine for Insurgency. ‘Abd Al-’Aziz Al-Muqrin’s A Practical Course for Guerrilla War. Washington: Potomac Books.

Crenshaw M., Campbell C., Campbell N. (2000). Suicide Terrorism in Comparative Perspective. In Ganor B. Countering Suicide Terrorism. Herzliya: Insitute for Couter-terrorism.

Creveld M. van (1991). The Transformation of War. New York: The Free Press.

Davis D.E. (2009). Non-State Actors, New Imagined Communities, and Shifting Patterns of Sovereignty and Insecurity in the Modern World. Contemporary Security Policy, 2: 221-245.

Dershowitz A.M. (2002). Why Terrorism Works. New Haven: Yale University Press.

Desch M.C. edited by (2001). Soldiers in Cities: Military Operations on Urban Terrain. Carlisle: Strategic Studies Institute.

Dietz S.A. (2011). Research report. Countering the effects of IED systems in Afghanistan: an integral approach. Small Wars and Insurgencies, 2: 385-401.

Enders W., Sandlers T., Cauley J. (1990). UN Conventions, Technology and Retaliation in the Fight Against Terrorism: An Econometric Evaluation. Terrorism and Political Violence, 1: 83-105.

Evans M. (2009). Lethal Genes: The Urban Military Imperative and Western Strategy in The Early Twenty-First Century. The Journal of Strategic Studies, 4: 515-552.

Ganor B. (2000). The rationality of the Islamic Radical Suicide attack phenomenon. In Ganor B. Countering Suicide Terrorism. Herzliya: Institute for Couter-terrorism.

Glenn R.W., Paul C., Helmus T.C., Steinberg P. (2007). “People Make the City”, Executive Summary. Joint Urban Operations Observation and Insights from Afghanistan and Iraq. Santa Monica: Rand Corporation.

Grau L.W., Kipp J.W. (1999). Urban Combat. Confronting the Specter. Military Review, 4: 9-17.

Hafez M. (2007). Suicide Bombers in Iraq. The Strategy and Ideology of Martyrdom. Washington: United Institute of Peace.

Hills A. (2002). Deconstructing Cities: Military Operations in the Urban Era. Journal of Conflict Studies, 2: 99-117.

Hoffman B. (2004). The Logic of Suicide Terrorism. In Howard R.D., Sawyer R.L. Defeating Terrorism: Shaping the New Security Environment. Guidford, CT: McGraw Hill.

Hoffman B. (2006). Inside Terrorism. New York: Columbia University Press.

Hoffman F. (2007). Conflict in the 21st Century: the Rise of Hybrid Wars. Arlington: Potomac Institute for Policy Studies.

Jessee D.D. (2006). Tactical Means, Strategic Ends: Al Qaeda’s Use of Denial and Deception. Terrorism and Political Violence, 3: 367-388.

Johnson T., DuPee M. (2012). Analysing the new Taliban code of Conduct (Layeha): an assessment of changing perspectives and strategies of the Afghan Taliban. Central Asian Survey, 1: 77-91.

Juergensmeyer M. (2000). Terror in the Mind of God. The Global Rise of Religious Violence. The Regents of the University on California: University of California Press.

Kaldor M. (1999). New and Old Wars: Organized Violence in a Global Era. Cambridge: Polity Press.

Kaldor M. (2003). Global Civil Society: An Answer to War. Cambridge: Polity Press.

Kilcullen D. (2005). Countering Global Insurgency. The Journal of Strategic Studies, 4: 597-617.

Kilcullen D. (2013). Out of the Mountains: The Coming Age of the Urban Guerrilla. (New York: Oxford University Press.

Kissinger H. (1969). The Vietnam Negotiations. Foreign Affairs, 2: 211-234.

Kramer M. (1998). The Moral Logic of Hizballah. In Reich W. Origins of Terrorism: Psychologies, Ideologies, Theologies. States of Mind. Washington: Woodrow Wilson Center Press.

Lewis J.D. (2013). Al-Qaeda in Iraq Resurgent. The Breaking the Walls Campaign, Part I. Washington: Institute for the Study of War, available at http://www.understandingwar.org/sites/default/files/AQI-Resurgent-10Sept_0.pdf.

Lewis J.W. (2007). Precision Terror: Suicide Bombing as Control Technology. Terrorism and Political Violence, 2: 223-245.

Lind W.S. (1989). The Changing Face of War: Into the Fourth Generation. Marine Corps Gazette, 10: 22-26.

Lombardi M., Alvanou M., Fonio C. (2009). Terrorismo suicida. Milano: Franco Angeli.

Merari A. (1998). The readiness to kill and die: Suicidal terrorism in the Middle East. In Reich W. Origins of Terrorism: Psychologies, Ideologies, Theologies. States of Mind. Washington: Woodrow Wilson Center Press.

Merari A. (2004). Suicide Terrorism. In Yufit R., Lester D. Assessment, Treatment, and Prevention of Suicidal Behaviour. New York: Wiley.

Merari A. (2010). Driven to Death: Psychological and Social Aspects of Suicide Terrorism. Oxford: Oxford University Press.

Metz S. (2007). Rethinking Insurgency. Carlisle: Strategic Studies Institute.

Michael G., Scolnick J. (2006). Strategic Limits of Suicide Terrorism in Iraq. Small Wars and Insurgencies, 2: 113-125.

Moghadam A. (2006a). Defining Suicide Terrorism. In Pedahzur A. Root Causes of Suicide Terrorism. London: Routledge.

Moghadam A. (2006b). Suicide Terrorism, Occupation, and the Globalization of Martyrdom: a critique of Dying to Win. Studies in Conflicts & Terrorism, 8: 707-729.

Morrison Taw J., Hoffman B. (1994). The Urbanization of Insurgency. Santa Monica: Rand Corporation.

Naylor S.D. (2015). The Islamic State’s Best Weapon Was Born in the USA. How the militant group is turning the Iraqi security forces’ Humvees into their worst nightmare. Foreign Policy, online edition https://foreignpolicy.com/2015/06/04/hell-on-wheels/?utm_source=Sailthru&utm_medium=email&utm_term=Flashpoints&utm_campaign=New%20Campaign.

Pape R. (2005). Dying to Win: The Strategic Logic of Suicide Terrorism. New York: Random House.

Peters R. (1996). Our Soldier, Their Cities. Parameters, 1: 43-50.

Peters R. (1997). The future of Armoured Warfare. Parameters, 3: 50-59.

Petraeus D., Amos J. (2006). FM 3-24 Counterinsurgency. Washington: Headquarters Department of The Army.

Qiao L., Wang X. (1999). Unrestricted Warfare: China’s Master Plan to Destroy America. Bejiing: PLA Publishing House.

Rid T., Keaney T. edited by (2010). Understanding Counterinsurgency. Doctrine, operations, and challenges. London: Routledge.

Robb J. (2005). The Opens-Source War. The New York Times, October 15.

Robb J. (2007). Brave New War. The Next Stage of Terrorism and the End of Globalization. Hoboken: John Wiley & Sons.

Robertson W.G. edited by (2003). Block by Block: The Challenges of Urban Operations. Fort Leavenworth: U.S. Army Command and General Staff College Press.

Rosenau W.G. (1997). Every room is a new battle: The lessons of modern urban warfare. Studies in Conflict & Terrorism, 4: 371-394.

Scales R.H. (2005). Urban Warfare: A Soldier’s View. Military Review, 1: 9-18.

Schmitt C. (1972). Le categorie del politico. Bologna: il Mulino.

Shaw M. (2005). The New Western Way of War: Risk-Transfer War and its Crisis in Iraq. Cambridge: Polity Press.

Shimko K.L. (2010). The Iraq Wars and America’s Military Revolution. New York: Cambridge University Press.

Singer P.W. (2012). The Evolution of IED. Why our countermeasures fail to keep up with the growing threat. Armed Forces Journal, online edition http://www.armedforcesjournal.com/2012/02/.

Smith A. (2011). Improvised Explosive Devices in Iraq, 2003-2009: A case of operational surprise and institutional response. Carlisle: Strategic Studies Institute.

Spiller R.J. (2001). Sharp Corners: Urban operations at century’s end. Fort Leavenworth: U.S. Army Command and General Staff College.

Thomas T.L. (1999). The Battle of Grozny: Deadly Classroom for Urban Combat. Parameters, 2: 87-102.

Tosini D. (2009). A Sociological Understanding of Suicide Attacks. Theory, Culture & Society, 4: 67-96.

Tosini D. (2012). Martiri che uccidono. Il terrorismo suicida nelle nuove guerre. Bologna: il Mulino.

UNAMA (2007). Suicide Attacks in Afghanistan 2001-2007. United Nations Assistance Mission to Afghanistan.

Wikileaks, Afghan War Diary, Coalition forces classified information, 1 January 2002-31 December 2009, available at http://wikileaks.org/afg/.

1 In line with Assaf Moghadam critique, see Moghadam 2006a.

2 Authors decided to approach to the study of the phenomenon from the military point of view not adopting terms as «Terrorist» and «Terrorism», largely utilized by scholars and academics in accordance with different specific approaches (psychological, political, sociological, etc); see, for example Ashworth et al. 2008; Atran, 2004; Crenshaw et al. 2000; Dershowitz, 2002; Enders, et al. 1990; Hoffman, 2006; Juergensmeyer, 2000; Kramer, 1998; Lombardi et al. 2009; Merari, 1998; Merari, 2004; Merari, 2010; Pape, 2005.

3 This section has been written by Andrea Beccaro.

4 Clearly not all suicide attacks end with the detonation because of malfunctions or other reasons, in these cases the suicide fighter can be arrested and interrogated, but this is not very common.

5 The use of the adjective “new” is controversial for this reason Kaldor (2003) tried to clarify her ideas some years later but this aspect here is not important because we are more interested in the reasons why professor Kaldor thinks that the wars are different.

6 Finding a definition is really difficult, Callwell (1996, 2012) said that small wars, which can be considered synonymous of irregular war, “include all campaigns other than those where both the opposing sides consist of regular troops”. In this case regular is a synonymous of state army, as in Carl Schmitt (1972) who defines the concepts of regular and irregular in the light of the kind of the political organization, i.e. the state.

7 To analyse the IED in Iraq and American response see also Smith, 2011.

8 Hoffman (2006) notes that this aspect is a feature of terrorism in general and in particular of terrorism after the Second War World.

9 Rosenau, 1997; Desch, 2001; Spiller, 2001; Hills, 2002; Robertson, 2003; Russell et al., 2007; Davis, 2009; Evans, 2009; Killkullen, 2013.

10 This section is written by Claudio Bertolotti. The original article was presented and discussed by the Author, Claudio Bertolotti, in occasion of the «International Relations Strat-Group» launch panel (From Afghanistan to Libya: The “political science” of Western military intervention) at the annual SISP conference, 13-15 September 2012, University of Roma Tre. It represents the main chapter of the Author’s PhD Thesis (Bertolotti, 2013).

11 ASA, «Afghanistan Suicide Attacks» database created by the Author.

12 The authors want to express their warmest thanks to Ashraf Moghadam for his advice.

13 Worldwide Incidents Tracking System database (WITS), created by the U.S. National Counterterrorism Center (NCTC) https://wits.nctc.gov/federalDiscoverWITS.

14 Chicago Project on Security and Terrorism (CPOST) database available at http://cpost.uchicago.edu.

15 See the Global Terrorism Database, created by the University of Maryland, available at http://www.start.umd.edu/gtd.

16 Author’s database.

17 Two of the planes were flown into the Twin Towers of the World Trade Center in New York City, a third plane hit the Pentagon outside Washington, D.C., and the fourth plane crashed in a field in Pennsylvania.

18 The higher the numbers of subjects analyzed, the more representative the sample. The majority of suicide attacks end with the assailant’s death, while the ones who fail attempting the attack are just a small percentage. For this reason it is necessary to proceed cautiously with the definition of the subject as an assailant-martyr purely on the basis of the interviews.

19 Mainly mine-resistant armors, jammers to stop signals used to activate IEDs, detectors and neutralization systems, robots and unmanned aerial vehicles (UAVs).

20 45 billion U.S. dollars were used for the MRAP (Mine Resistant Ambush Protected) project. Besides since 2006 the anti-IED task force has spent further 17 billion dollars in counter-IED activities.

21 The Layeha, the rule-book of the Taliban mujahidin, forbids – as much as possible – the involvement of civilians in war actions. (Johnson, DuPee, 2012).

22 Total cases analyzed are 1256 (period 9th of September 2001 – 31st of December 2014).

23 It is important to underline the evolution of further offensive tactics the Taliban began to develop during the last four years – concomitantly with the suicide attacks’ decrease: the «green on blue attacks» (incidents in which ANSF members attack Nato/Isaf coalition soldiers) and the «assassinations campaign» against difficult targets (like district governors, police chiefs, high public officials): what is most important is the trend of decreasing suicide attacks and corresponding increase in green on blue attacks and assassinations events.

Analyses and commentaries

Intelligence economica:
una proposta per l’Italia

Laris Gaiser

1. Lo Stato Strategico

La fine del confronto bipolare ha portato con sé negli anni Novanta del secolo passato una profonda trasformazione dei sistemi statali e delle logiche di confronto internazionale. La vittoria delle democrazie sui regimi comunisti, il conseguente affermarsi delle economie di mercato, la scomparsa (quasi totale) delle economie socialiste pianificate ed il sopravvivere per lungo tempo di una sola grande potenza mondiale quale quella rappresentata dagli Stati Uniti ha portato le strutture statali a ripensare se stesse. Dopo un periodo storico nel quale sembrava inevitabile lo sgretolamento dello Stato di concezione westfaliana, siamo oggi testimoni di una tendenza che riporta gli enti sovrani per eccellenza a rientrare in possesso delle proprie prerogative. Gli Stati ritornano ad essere attori primari delle relazioni internazionali mostrando una dinamicità e una capacità d’adattamento che molti pensavano persa nei meandri dei processi della globalizzazione. L’attuale fase storica li vede affrontare e gestire contemporaneamente due spinte tra loro antitetiche: quella centrifuga e quella centripeta. A primo acchito esse potrebbero sembrare tra loro inconciliabili ma alla luce di un’analisi più attenta e ragionata risultano essere il prodotto logico dell’ evoluzione storica e dell’attuale situazione economica.

Lo Stato, pur delegando – senza rinunciarvi – parte della sovranità ad istituzioni sovranazionali ed entità sub statali, sta dimostrando una resistenza, ed una capacità di reazione nei confronti delle spinte disgregatrici sorprendente e rimane l’attore principale nell’attuale ricerca di un nuovo ordine mondiale. Una ricerca caratterizzata da forte fluidità.

Il capitale finanziario, assieme al commercio estero, è uno dei fondamentali fattori di cambiamento. Grazie ad esso le diverse comunità locali, più o meno favorite dalla posizione geografica, sono in grado di trarre profitto dall’economia mondiale. I fenomeni di devoluzione delle quote di sovranità verso entità regionali o sovrastatali, in verità, appaiono sempre più chiaramente, quali “concessioni” da parte del principe hobbesiano, per ragioni che esso stesso ritiene opportune, al fine di garantirsi la propria sopravvivenza. Il “Sovrano”, cioè lo Stato, è costretto ad articolarsi in senso verticale ed orizzontale devolvendo quote di potere a favore della periferia la quale però, formalmente, rimane rispettosa della sovranità originaria. Questa resta qualitativamente centrale ma, contemporaneamente, si diffonde acquisendo ulteriore legittimazione per il fatto d’essere esercitata da altri destinatari a cui comunque, in caso di necessità, può essere tolta. Così agendo lo Stato riesce ad autotutelarsi dalle spinte disgregatrici e difendere più efficacemente il Potere – superiorem non recognoscens – che giuridicamente gli appartiene quale soggetto di diritto e di fatto.

Non ci troviamo quindi di fronte ad un progressivo “ritiro dello Stato” ma più semplicemente di fronte ad una “correzione di rotta” che lo sta portando ad affrontare con maggiore efficacia le sfide contemporanee, lungi dal renderlo obsoleto. In un contesto internazionale post Guerra Fredda e post unipolare che cerca una nuova cornice di stabilità, ovvero di relazioni basate su un più chiaro balance of power, gli Stati tornano ad essere gli agenti attivi primari del grande gioco mostrando una grande capacità di adattamento. Il Paese che non riesce ad essere competitivo è destinato a soccombere o a divenire ininfluente sulla scena mondiale. I sistemi-Paese quindi abbisognano di mezzi più raffinati, precisi ed organizzati per rimanere credibili, attraenti per gli investimenti, stabili strutturalmente e vincenti nelle scelte economiche. Le conquiste territoriali e i controlli diretti di parti del globo sono, oltre che politicamente difficili da accettare da parte delle opinioni pubbliche democratiche, economicamente dispendiosi. Oggigiorno potere e benessere economico vanno di pari passo in un contesto internazionale in cui il vassallaggio delle piccole e medie entità statali è la regola con la quale si ripropone il concetto di “sovranità limitata” di sovietica memoria. Alle armate del Paese tutore si sostituiscono legami finanziari e commerciali. Essere in possesso di una buona “macchina da guerra economica”, sia nella sua forma attiva (penetrazione mercati altrui e vantaggio competitivo), che passiva (difesa del proprio interesse nazionale), sostenuta da una struttura statale credibile è una priorità assoluta. L’intensificarsi continuo del flusso di scambi internazionali, insieme alla crescente interdipendenza tecnologica ed al flusso continuo delle informazioni, influenza pesantemente le relazioni internazionali nonché i sistemi economici.

Negli anni Novanta del secolo passato, Edward Luttwak lanciava l’idea che le guerre militari sarebbero presto divenute un ricordo del passato sostituite da quelle economiche. Egli ritiene che le minacce militari e le alleanze hanno perso la loro importanza con la pacificazione degli scambi internazionali. Le priorità economiche non sono più occultate e passano in primo piano. Nel futuro sarà la paura delle conseguenze economiche che regolerà le contestazioni commerciali e sicuramente gli interventi politici saranno motivati da ragioni strategiche. Geoeconomicamente parlando è passato il tempo delle guerre guerreggiate per la conquista dei territori e per l’influenza diplomatica. L’obiettivo centrale deve essere quello di aumentare il lavoro molto qualificato nell’industria di punta e nei servizi ad alto valore aggiunto al fine di conquistare ovvero preservare una posizione invidiata in seno all’economia mondiale. Sempre secondo lo studioso statunitense i capitali investiti dello stato sono l’equivalente della potenza di fuoco, le sovvenzioni allo sviluppo dei prodotti corrispondono ai progressi dell’armamento, la penetrazione dei mercati con l’aiuto dello Stato sostituiscono le basi e le guarnigioni militari ostentate all’estero ed anche l’influenza diplomatica (Luttwak 1993). Pur essendo innegabile che l’approccio ivi descritto ha permesso di comprendere meglio le dinamiche contemporanee delle relazioni internazionali riteniamo non si possa affermare che la guerra quale ultima ratio regis sia scomparsa dalle opzioni a disposizione dei vari “Sovrani” per la difesa del proprio interesse nazionale. Ci sembra più corretto affermare che si è ridotto il suo spazio di manovra ovvero di possibile utilizzo il quale viene automaticamente ad essere riempito dalla competizione geoeconomica. Il ricorso alla coercizione diretta è sempre possibile ma assai più limitato (Gaiser 2015). Oggi il sistema internazionale è un complesso di spazi economici nel quale il concetto di territorio perde la sua importanza, poiché attori statali e grandi corporazioni competono per acquisire quote di mercato massimizzando i profitti. Tutto ciò però non è un fenomeno nuovo sconosciuto alle passate generazioni. Durante il divenire della storia i soggetti internazionali hanno sempre giocato un ruolo attivo nell’economia. La diversità tangibile si riscontra nell’intensità e nelle modalità d’azione determinate dalle epoche e dalle strutture di potere del passato, e dal fatto che se prima era più l’economia ad essere al servizio della potenza politica, ora i ruoli sono in parte invertiti. Il mondo contemporaneo dell’economia non può essere analizzato solamente dl punto di vista delle classiche teorie di mercato. Le classiche teorie economiche sugli scambi internazionali non rispecchiano tutti gli aspetti delle relazioni economiche internazionali nelle cui decisioni si può spesso ritrovare l’eco delle tattiche e delle strategie di Sun Zu e Macchiavelli e tali decisioni spesso dipendono in maniera importante da fattori non di mercato. (Csurgay 2009). Alcuni di tali fattori sono per l’appunto le strategie di informazione, influenza, sostegno statale indiretto a privati, controllo delle valute o forme di protezionismo occulte. Lo Stato per sopravvivere si vede costretto a competere in un ambiente altamente sofisticato e per fa ciò si trasforma secondo, la definizione di Gyula Csurgai, in “stato strategico” il cui compito è quello di preservare o incrementare la propria posizione privilegiata nel mondo economico e politico internazionale attraverso la creazione di una cornice geoeconomica di successo. I concetti di protezione del territorio, forze armate e controllo dei confini si devono necessariamente adattare all’apertura vero l’esterno, riorganizzandosi in modo tale da attrarre investimenti, forza lavoro qualificata, trasferimenti di tecnologia e concretizzare strategie di amalgama tra settore privato e pubblico, che permettano la conquista di posizioni privilegiate nel mondo geopolitico e geoeconomico odierno. Tutto ciò non significa che si debba ritornare a logiche di stampo collettivista che la storia ha già archiviato come fallimentari, ma significa che lo “Stato strategico” è una delle unità chiave dell’economia contemporanea ed ha il compito vitale di sviluppare adeguatamente il concetto di intelligence economica che massimizzi le capacità di ogni attore ad acquisire quote di mercato. A sua volta lo sviluppo dello stato-strategico sarà sempre necessariamente influenzato dalla cultura, dalla storia e dalle percezioni antropologiche dei vari attori – pubblici e privati – coinvolti nei processi decisionali geoeconomici, ovvero di sviluppo e sicurezza dell’economia. Compito dell’intelligence economica è quello di gestire strategicamente l’informazione per permettere allo Stato di controllare, anticipare e gestire l’evoluzione dei vari mercati, dando vita a scelte politiche, sia offensive, che difensive. Più gli interessi di un Paese sono estesi, più la strategia deve avere un respiro globale. Ciò significa che gli apparati d’intelligence devono essere disegnati in maniera tale da coprire ogni possibile settore d’interesse e – cosa ancor più importante – avere una capacità di sintesi ed elaborazione tale da permettere agli attori politici scelte complesse e multilivello. Col passare del tempo i servizi di informazione avranno sempre maggiori compiti di sintesi della realtà. Alle consolidate attività tipiche del passato di spionaggio militare e politico vengono ad aggiungersi prepotentemente le esigenze di copertura nel settore economico.

2. Intelligence economica: tornare a Venezia?

La competizione per il controllo dei mercati, e quindi per il potere indiretto sulle nazioni, sta subendo un aumento esponenziale sostenuta dallo sviluppo delle tecnologie informatiche e comunicative che hanno agevolato tale influenza su persone e territori sottoposti ad altrui sovranità.

Alle agenzie d’informazione per la sicurezza degli Stati si richiedono avanzamenti di qualità e quantità nelle analisi geoeconomiche tali da permettere agli oltre duecento soggetti sovrani presenti sul pianeta di agire con successo sul mercato globale. I Paesi devono avere la capacità di correlarsi ed interagire con organizzazioni sovranazionali ed istituzioni tipiche del mercato globale contemporaneo, quali ad esempio le agenzie di rating, che hanno la possibilità di erodere quote di sovranità di alcuni Stati, aumentando quelle di altri, e le grandi multinazionali della finanza, che in pochi secondi possono influire sulle loro capacità economiche. Le agenzie di valutazione e le società finanziarie sono oggi ciò che erano in passato le bocche di fuoco delle vecchie cannoniere. Fungendo da meccanismo di potenziamento delle scelte geoconomiche, esse hanno la capacità di comprimere gli spazi di manovra delle politiche fiscali, monetarie ed economiche degli Stati-nazione. Tanto nel mondo professionale quanto in quello accademico non esiste una definizione univoca di intelligence economica. Le teorie e i nomi sviluppati sono tanto numerosi quanti sono i sistemi implementati in giro per il globo. Riteniamo che la più appropriata e certamente quella maggiormente rispondente alla realtà dei fatti possa ritenersi quella data da Carlo Jean e Paolo Savona secondo cui l’intelligence economica è la disciplina che, studiando il ciclo dell’informazione necessario alle imprese e agli Stati per effettuare scelte corrette di sviluppo, si prefigge di affinare le abilità cognitive e decisionali applicate alle complessità del contesto competitivo globale (2011). L’intelligence economica è quindi la raccolta e la trasformazione d’informazioni inerenti il settore economico atta ad effettuare scelte operative, che si prefiggono sia scopi attivi, che passivi. Essa è rappresentata dalle attività volte ad ottenere dati dalla sorveglianza della concorrenza, dalla protezione delle informazioni strategiche, dalla capitalizzazione delle conoscenze al fine d’influenzare, delineare e controllare l’ambiente economico globale. Essa è uno degli strumenti di potere a disposizione dei sistemi-Paese. L’analisi dei rapporti di forza economici all’interno di situazioni concorrenziali deve essere un settore di primaria importanza per ogni apparato statale. Tuttavia anche entità private hanno bisogno di una specializzazione in tale settore in modo da ponderare le proprie scelte sui mercati internazionali. La loro attività può essere di grande beneficio ovvero può influenzare scelte di interi sistemi-Paese, e viceversa. Le due sfere, quella privata e quella pubblica, sono quindi intersecanti e comunicanti. Il ritorno all’economia, come principale terreno di competizione tra nazioni, spinge lo Stato ad agire in modo da proteggere e promuovere i propri attori economici, siano essi imprese pubbliche o private, organismi territoriali, gruppi di interesse, associazioni od organizzazioni non governative. Lo Stato deve proteggerli dalle minacce esterne, in quanto «bene della collettività» ed aiutarli a conoscere tutte le opportunità di sviluppo in una logica di continua sinergia Stato-impresa, prestando particolare attenzione al ruolo dei servizi segreti la cui competenza, nel contesto dell’intelligence economica, deve trovare rafforzamento. L’intelligence economica è una misura collettiva, offensiva, formata dall’insieme delle azioni coordinate di ricerca, trattamento, diffusione e protezione dell’informazione, ottenuta legalmente o attraverso sistemi «legalizzati», da attività statali, in quanto l’accesso all’informazione segreta diviene lecito nel momento in cui è autorizzato. Tutto ciò presuppone l’organizzazione di reti e specifici strumenti all’interno, nonché di influenza all’esterno poiché il suo scopo è quello di preservare ovvero aumentare la potenza geoeconomica di uno Stato e il suo spazio di influenza.

Nel momento in cui la logica dei rapporti di forza regge l’economia mondiale le imprese sono l’avanguardia, i soldati, ed il ruolo dello Stato nella guerra economica è triplo, cioè istituzionale, strumentale e pedagogico, oltre che di definizione del quadro giuridico nel quale si muovono gli attori. A quest’atteggiamento difensivo, la maggior parte degli Stati aggiunge una postura offensiva per aiutare le proprie imprese (Gagliano 2014).

I governi devono essere lucidi nel definire le strategie e gli obiettivi da perseguire considerando le imprese quali creatori di ricchezza e sostenendo la coesione interna – patriottismo economico – per portare innanzi una politica espansiva all’estero. I sistemi nazionali devono garantire l’ambiente adatto al successo delle proprie imprese – siano esse pubbliche o private – e lo scopo dell’intelligence economica di Stato è anche quello di cambiare le regole del gioco della competizione mondiale adattando i mercati alle proprie esigenze senza sostituirsi agli attori economici ma creando le condizioni per il loro successo anche in condizioni d’inferiorità. La costruzione di un ambiente favorevole nel quale si possano imporre le proprie regole del gioco agli altri attori sottintende l’utilizzo delle informazioni come arma per influenzare o neutralizzare la concorrenza. Le guerre di conquista economiche presuppongono campagne culturali e guerre dell’informazione che invertano i rapporti di forza. I bisogni dell’intelligence prettamente pubblica divengono pertanto maggiormente complessi. L’interesse nazionale, oramai legato a doppio filo all’economia e caratterizzato dalla capacità di agire come attore geoeconomico, può essere perseguito decentemente solo con il riposizionamento delle strutture statali riadattate al contesto internazionale. È lo scontro geopolitico a pretendere capacità d’adattamento e flessibilità. Un settore d’intelligence economica efficacie è la premessa sine qua non per poter partecipare, usufruendo in modo reale dei benefici, alla fase contemporanea della globalizzazione dei mercati.

Nella fase attuale delle relazioni internazionali segnate dalla frammentazione statale, dalla multipolarità economica e da contrastanti sfide geopolitiche un modello di gestione delle complessità potrebbe rinvenirsi nello studio del modello di intelligence sviluppato dalla Repubblica di Venezia la cui politica aveva finalità prevalentemente mercantili ed in cui le informazioni erano al servizio del commercio. L’esistenza della Serenissima dipendeva dalla stabilità degli scambi economici i quali a loro volta dipendevano dalle capacità geopolitiche della Repubblica. Con l’avvio delle crociate tra l’XI ed il XIV secolo lo spazio economico mondiale venne a modificarsi profondamente. In tale periodo si intensificarono gli scambi tra Europa e Levante, si migliorarono le conoscenze tecnologiche, quelle logistiche nonché gli strumenti per la misurazione del tempo, dei pesi e delle distanze. Il benessere incominciò a diffondersi su scala più ampia e Venezia seppe cogliere il momento opportuno per divenire una potenza commerciale e finanziaria nella quale la simbiosi tra aspettative del settore privato e quelle del settore pubblico divenne quasi perfetta, esattamente come la simbiosi tra il concetto di intelligence offensiva, cioè basata principalmente sullo spionaggio, e quella difensiva, atta a difendere i segreti della Repubblica, quale per esempio il vetro di Murano. La Serenissima rappresenta davvero il primo sistema statale geoeconomico in cui l’apparato formato dalla rete consolare, diplomatica e commerciale, diviene la spina dorsale di un’intelligence con grandi capacità di raccolta, analisi ed utilizzo efficiente delle informazioni e all’interno del quale la guerra è vista inequivocabilmente quale ultima risorsa possibile per la difesa dell’interesse nazionale. Le navi della Laguna infatti venivano armate nell’Arsenale solamente in caso di estremo bisogno.

Sfera d’influenza, stabilità geopolitica, controllo delle risorse, ricchezza economica, capacità di intelligence e proiezione militare furono categorie fattuali per secoli familiari ai Dogi e al patriziato lagunare. Un ulteriore argomento a favore dello studio di questa realtà da parte del mondo accademico e professionale odierno deriva anche dalla tesi di Fernand Braudel secondo il quale il maggiore danne alla potenza di Venezia non arrivò in verità mai manu militari via mare ma dalla guerra economica sferrata dal 1570 in avanti da parte dei mercanti nordici. Questi, utilizzando l’artificio della concorrenza sleale, invasero i mercati di Venezia con prodotti contraffatti a basso prezzo recanti il celebre timbro veneziano. La durata e la violenza dell’offensiva fece in modo che l’industria mediterranea una fetta consistente della sua clientela e la Serenissima buona parte della sua reputazione (Braudel 1952). Il danno all’immagine a cui la Repubblica a sua volta non seppe rispondere con un’adeguata campagna di infowar fu tale da penalizzare gravemente le future mosse geopolitiche.

In un contesto internazionale caratterizzato negli ultimi decenni da forti innovazioni tecnologiche e marasmi geopolitici in cui le guerre commerciali avanzano a passo di marcia parallelamente agli scontri cibernetici e alle guerre informative è importante tener presente che l’intelligence economica deve saper gestire fenomeni eterogenei appartenenti al settore pubblico e privato. La business intelligence e la competitive intelligence del settore privato devono potersi fondere con le capacità pubbliche, con l’analisi dei Big data, con i risultati dello spionaggio industriale, con il controspionaggio, con le attività dei fondi sovrani e con il formarsi di una cornice legislativa favorevole allo sviluppo economico del Paese. Esattamente come avveniva, mutatis mutandis, nella Repubblica di Venezia.

3. L’intelligence economica in Italia: una proposta

Oggigiorno gli Stati possono classificarsi in tre categorie ben precise: quelli che possiedono un apparato di intelligence economica, quelli che seppur in ritardo cercano di colmare la lacuna e quelli che non intendono dotarsi di un sistema economicamente competitivo. I primi sono protagonisti degli equilibri geoeconomici mondiali, i secondi riusciranno a gestire i danni subiti e controllare gli sviluppi futuri mentre i terzi sono destinati a soccombere ovvero a divenire terra di conquista da parte delle potenze sviluppate. Se Stati Uniti, Gran Bretagna, Giappone, Francia, Germania e Cina – tanto per citarne alcuni – fanno parte a pieno titolo della prima categoria mentre possiamo posizionare l’Italia nella seconda.

Analizzando le Relazione al Parlamento degli ultimi anni si nota facilmente che la sicurezza economica dello Stato sta divenendo una parte sempre più importante dell’attività del Sistema di informazione per la sicurezza della Repubblica. Senza voler qui entrare nel merito delle varie analisi riteniamo comunque doveroso sottolineare che nella Relazione del 2013 il DIS ha avuto il coraggio di prendere una posizione pro-attiva sentendosi in dovere di porre l’attenzione del Legislatore sulla necessità d’esaminare la possibilità di creare un’infrastruttura legale che, oltre ad assicurare la tutela passiva delle realtà economiche nazionali, permetta anche l’attrazione di investimenti esteri, la corretta allocazione delle risorse ed il sostegno alla competitività nazionale all’estero. Il decisore politico infatti dovrà prima o poi prendere atto della necessità di una strategia complessiva di intelligence economica che assicuri la competitività del nostro sistema-Paese facilitando l’osmosi tra il settore pubblico e quello privato, la loro reciproca comprensione e collaborazione. Senza un impianto chiaro si rischia di mutilare gli sforzi portati innanzi dall’AISE e dall’AISI in tale campo e di rimanere per sempre ancorati ad una gestione passiva della sicurezza economica danneggiando gravemente lo sviluppo futuro dell’Italia. L’intelligence economica deve divenire un bene pubblico.

La legge 124/2007, insieme alle modifiche apportate nel 2012, racchiude in sé una potenziale multidisciplinarietà che fino ad ora mancava. Essa favorisce una certa flessibilità di azione nel perseguimento dell’interesse nazionale della Repubblica, cioè di ogni livello della nazione e non più, come in passato, del solo Stato. L’interesse della Repubblica è anche quello dei cittadini e delle sue imprese che desiderano poter incrementare il proprio benessere attraverso le attività economiche. Dallo Stato essi si attendono un ruolo centrale di sostegno attraverso una strategia di geopolitica economica chiara ed efficace che sia al servizio delle ambizioni economiche del Paese ovvero sappia farle emergere, incanalandole propriamente. L’attore Stato, conscio della reciproca utilità, deve avere il compito di operare insieme agli attori economici del Paese appoggiandoli nelle loro ambizioni ed esigenze. Una chiara visione di geopolitica economica deve basarsi sulle analisi di tipo commerciale in un contesto nel quale il Governo mira a proteggere l’economia nazionale garantendone lo sviluppo, favorendo l’acquisizione di nuove tecnologie e conquistando nuovi segmenti del mercato mondiale, poiché il rafforzamento economico e sociale del Paese diviene misura del suo potere e della sua importanza internazionale. L’intelligence economica è lo strumento con il quale tutto ciò si realizza e con il quale si fornisce una nuova missione ai politici e ai funzionari assillati dai problemi della continua erosione di sovranità nazionale connessi alla globalizzazione.

In tal senso la legge di riforma dei Servizi di informazione segna certamente un punto di svolta non solo attribuendo urgenza alla sicurezza economica del Paese, ma anche prevedendo possibili sinergie tra le varie parti dell’Amministrazione statale. La sicurezza “partecipata” è la premessa necessaria per il superamento di vecchi schemi di ragionamento a “compartimenti stagni” e di mentalità economiche passive.

Philippe Baumard rifacendosi all’esperienza francese in un articolo pubblicato nel 1992 sulla Revue Politique et Parlementaire elencava sette fattori capaci di rallentare lo sviluppo dell’intelligence economica (citato in Gagliano 2014,236):

1. la mancanza di comunicazione, interazione e coordinamento tra l’insieme dei sottosistemi che costituiscono il tessuto nazionale dell’intelligence;

2. la separazione tra raccolta, elaborazione, analisi e utilizzo dell’intelligence economica nelle nazioni;

3. il reclutamento limitato delle risorse, la mancanza di formazione e sensibilizzazione nazionali sia a livello delle imprese sia delle amministrazioni;

4. l’incomprensione dei media nei confronti delle poste in gioco dell’intelligence, che portano invece le nazioni a una gestione crescente delle capacità nazionali di intelligence;

5. la gestione maldestra del segreto, soprattutto nelle nazioni occidentali;

6. la gestione disordinata delle conoscenze e dei patrimoni culturali delle nazioni;

7. la limitata capacità di utilizzare e valorizzare l’informazione immediatamente disponibile nel breve periodo.

I punti riportati sono ancora oggi generalmente validi per l’Italia soprattutto il primo, il terzo ed il sesto. Senza il dialogo tra i vari sottosistemi del tessuto nazionale, la mancanza di preparazione in materia dei settori pubblico e privato, e la comprensione delle potenzialità del know how o delle tecnologie residenti nel Paese è perfino assurdo pensare di poter dar vita ad un processo istituzionalizzato di gestione delle risorse che deve essere innanzitutto una visione collettiva.

Qualora il Legislatore italiano volesse iniziare a disegnare le linee guida di un eventuale riforma del settore dovrebbe innanzitutto legittimare l’intelligence economica ancorandola alla Costituzione. Essa, come si sa, è un prodotto giuridico del secondo dopoguerra caratterizzato dal compromesso di diverse culture politiche e racchiude in sé la tradizione liberale, quella cattolica e quella marxista-comunista. Queste correnti di pensiero hanno trovato per decenni nella Costituzione un comun minimo denominatore che ha permesso all’Italia, divenuta terra di confine, una certa stabilità nel periodo della Guerra Fredda. Pur nelle sue manchevolezze, venute alla luce soprattutto con il cambiamento degli equilibri planetari degli anni Novanta, la Carta ha rappresentato un compromesso di buona qualità. Sul piano tecnico, pur esibendo alcune incertezze, ha permesso nel complesso di risolvere i problemi istituzionali della democrazia italiana e sul piano politico-sociale ha dato vita ad un sottostrato di valori che per lunghi anni nessuna parte politica ha messo in discussione. La Legge Fondamentale, pertanto, ha saputo porsi come strumento di stabilità per lo sviluppo del Paese e per la sua crescita economica. Volendo proporre una riforma sistemica della struttura economica dell’Italia, ovvero suggerire concretamente l’istituzione di un complesso di intelligence economica, che potenzialmente può incidere profondamente sulla società e sulle sue dinamiche, è corretto ricercare un ancoraggio nella Costituzione del Paese e, mancando la sua modifica, si deve riuscire ad interpretarla positivamente. Fissare il concetto alla radice del sistema legale facilita la sua successiva accettazione.

Il primo articolo della Costituzione afferma che “L’Italia è una Repubblica democratica, fondata sul lavoro”: tale impostazione è frutto della proposta in sede costituente portata innanzi dall’On.Fanfani che permise di rifiutare la formulazione del cosiddetto principio lavoristico proposta dall’On.Togliatti il quale avrebbe preferito la formulazione “L’Italia è una Repubblica democratica fondata sui lavoratori”. Fanfani, nell’illustrare la sua proposta, escluse che il concetto potesse essere inteso in senso limitato, cioè nella sola sfera materiale. Egli lo identificava con il diritto-dovere di ogni persona ad essere quello che ciascuno può, in proporzione dei talenti naturali. Per interpretazione della Giurisprudenza il principio lavoristico è un principio supremo, motivo per cui esso non può essere sovvertito o modificato nel suo contenuto essenziale neppure da leggi di revisione costituzionale o da altre leggi costituzionali. A tale presupposto si deve aggiungere l’interpretazione della dottrina che vede nella frase “fondata sul lavoro” racchiuso il concetto del progresso materiale e spirituale della società in cui qualsiasi tipo di lavoro, comunque svolto, sia esso subordinato, autonomo, imprenditoriale, privato o pubblico (Miscione 2001). Constatato che il lavoro inteso in senso ampio è alla base della nostra Repubblica non possiamo tralasciare i significati derivanti dall’interpretazione del successivo art. 4 Cost. secondo cui “La Repubblica riconosce a tutti i cittadini il diritto al lavoro e promuove le condizioni che rendano effettivo questo diritto. Ogni cittadino ha il dovere di svolgere, seconde le proprie possibilità e la propria scelta, un’attività o una funzione che concorra al progresso materiale o spirituale della società”. Ebbene il “diritto al lavoro”, secondo la Giurisprudenza, costituisce il presupposto per l’esercizio di ogni altro diritto costituzionalmente garantito, nonché il fondamento stesso dell’intero ordinamento costituzionale. Esso non solo è un diritto inviolabile ma, anche un “diritto sociale” ovvero uno dei quei diritti che pretende una prestazione positiva da parte dello Stato. I pubblici poteri sono chiamati ad intervenire nell’economia per favorire le condizioni di pieno impiego nell’interesse generale ed hanno il divieto di porre limiti discriminatori a tale libertà. Al tempo stesso hanno l’obbligo di indirizzare ogni attività alla creazione di condizioni economiche, sociali e giuridiche che consentano l’impiego di tutti i cittadini idonei al lavoro (Baldassarre 1989).

La Costituzione così interpretata dalla Giurisprudenza e dalla dottrina fornisce delle buone basi alla legittimazione dell’intelligence economica. Come abbiamo avuto modo di vedere fin qui, l’intelligence economica è un mezzo attraverso il quale lo Stato ha modo di migliorare l’ambiente economico ovvero il benessere e la sicurezza dei cittadini dando loro a disposizione un apparato di sostegno dello sviluppo e dell’imprenditorialità. Ciò significa che un corpo di norme che istituzionalizzasse l’intelligence economica potrebbe trarre la sua piena legittimità dalla Carta Costituzionale. Lo Stato, o meglio il Legislatore, non farebbe altro che dar applicazione alle previsioni costituzionali secondo le quali esso deve fare il possibile per favorire lo sviluppo materiale e spirituale della società. In soccorso a tale interpretazione viene infine anche l’art.3 Cost. che alla Repubblica ascrive il compito di “rimuovere gli ostacoli di ordine economico e sociale, che, limitando di fatto la libertà e l’eguaglianza dei cittadini, impediscono il pieno sviluppo della persona umana e l’effettiva partecipazione di tutti i lavoratori all’organizzazione politica, economica e sociale del Paese” senza dimenticare che la Repubblica stessa ex art.2 Cost. ha l’obbligo di adempiere ai “doveri inderogabili di solidarietà politica, economica e sociale”. Adempiere ai doveri inderogabili di solidarietà economica, eliminare le barriere di sviluppo economico che impediscano la piena realizzazione sociale del Paese sono tutti quanti compiti che possono, e devono, essere attuati con un approccio legislativo confacente al periodo storico in cui viviamo. La Carta Costituzionale, nata sulle ceneri del Secondo conflitto mondiale e prodotto di un compromesso tra le tre diverse filosofie politiche allora maggioritarie, può essere ancora flessibilmente interpretata e rappresentare l’imprescindibile caposaldo sul quale continuare l’opera di formalizzazione dell’intelligence economica.

Compreso che la Costituzione fornisce il primo punto di appoggio di un’eventuale struttura di sicurezza economica e che la legge 124/2007 può esservi inserita a pieno diritto come secondo pilastro già esistente dato che pone obiettivi compatibili alle Agenzie per l’informazione e dato che queste devono specificatamente lavorare per il bene generale della Repubblica, cioè di tutti, si rende ora necessario comprendere quali sarebbero gli ulteriori passaggi necessari per avere in Italia una piramide informativa efficiente che porti a sinergie positive tra pubblico e privato. Per fare ciò è bene innanzitutto avere ben presente la struttura economica del Paese. L’Italia è una delle maggiori economie del mondo, prettamente orientata al commercio estero ha il nono prodotto interno lordo nominale e la sua composizione per settori è piuttosto equilibrata (Figura n.1).

Figure 1: Composizione PIL italiano (fonte: ISTAT)

La bilancia dei pagamenti,dopo aver goduto di un buon surplus del conto corrente per la maggior parte degli anni Novanta del secolo precedente, registra dal 2000 continui disavanzi il che stride col fatto che la produzione del Paese è fortemente orientata al commercio verso l’estero e dominata dalle piccole e medie imprese (PMI). L’Italia da sola possiede 3.813.805 PMI che impiegano più di dodicimilioni di persone e 3.253 grandi imprese che ne impiegano poco meno di tre milioni.

Il dato significante, tuttavia, viene galla nel momento in cui questi numeri vengono paragonati con quelli dell’Unione Europea. L’UE con ventisette membri contava – secondo le statistiche disponibili nel 2012 – 20.355.839 PMI, impiegava 86.814.717 lavoratori che insieme producevano un valore aggiunto del 58% circa (Gaiser 2015). Se ne deduce che il 21,5% del totale delle imprese manifatturiere dell’Unione Europea si trova in Italia e nello specifico, secondo lo studio realizzato dall’istituto Guglielmo Tagliacarne (2012), ben il 21.8% delle micro imprese (meno di 10 addetti), il 22,9% delle piccole (10-49 addetti) ed il 12,5% di quelle di medie dimensioni (50-249 addetti).

Le esportazioni incidono per circa il 30% sulla formazione del PIL del nostro Paese, il che è leggermente superiore ai valori di Francia e Regno Unito che si attestano al 26% circa, ma notevolmente più basso del 40% tedesco. La Germania ha un’economia basata principalmente sulle aziende di grandi dimensioni, che costituiscono quasi un quarto di tutte quelle presenti nell’area EU. Le stesse in Italia raggiungono a malapena lo 0,1%, percentuale assai simile, ancora una volta, a quelle francese. La produzione manifatturiera Italiana è pari al 14,5% del totale europeo, la Francia detiene il 13,3%, ma entrambe sono ben lontane dal 27% tedesco.

Un ruolo centrale gioca in Italia anche la dimensione regionale della presenza imprenditoriale. Se secondo il rapporto di ricerca IRES (Istituto Ricerche Economiche Sociali) del 2011 risulta chiaro che la percentuale delle microimprese nel Meridione Paese è superiore al 90%, “rispetto alla media italiana dell’82,3%, di contro sono soprattutto le regioni del Nord Est e la Lombardia (in parte anche il Piemonte) ad avere una composizione dimensionale più “importante” sia per quanto riguarda le piccole imprese che quelle medie. La categoria delle prime dieci imprese nazionali per volume di fatturato potrebbe essere divisa in quattro sottoinsiemi. Il sottoinsieme bancario-assicurativo con il Gruppo Generali, Unicredit ed Intesa San Paolo, il sottoinsieme energetico composto da ENEL ed ENI, il sottoinsieme dei servizi con Poste Italiane e Telecom Italia ed infine il gruppo composto da Finmeccanica e FIAT.

Tale panoramica permette di constatare come l’economia italiana riceve nutrimento da una vasta gamma di settori e come, perciò, sia importante per il sistema-Paese predisporre una struttura che favorisca senza discriminazioni ogni tipo di impresa, sia essa grande o piccola. Tra di esse esiste una rete d’interconnessioni reciproche assai fitta nella quale ognuna di esse apporta benefici al benessere economico generale e allo sviluppo comune. Tutte le categorie di cui sopra, sono orientate anche al campo della Ricerca e Sviluppo (R&S) e contribuiscono in tal modo per l’1,25% alla formazione del PIL. Secondo i dati ISTAT nel triennio 2008-2010, il 31,5% delle imprese italiane con almeno 10 addetti ha introdotto sul mercato o nel proprio processo produttivo almeno un’innovazione. L’industria si conferma il settore più innovativo, con il 43,1% di imprese innovatrici contro il 24,5% dei servizi e il 15,9% delle costruzioni. La propensione all’innovazione è maggiore nelle grandi imprese: il 64,1% delle imprese con 250 addetti e oltre ha introdotto innovazioni, contro il 47,1% delle imprese con 50-249 addetti e il 29,1% di quelle con 10-49 addetti. Il 48,1% delle imprese innovatrici ha innovato sia i prodotti sia i processi produttivi. Il 27,2% ha scelto di investire unicamente in nuovi prodotti, mentre il restante 24,7% ha adottato soltanto nuovi processi di produzione. Nel 2010 le imprese italiane hanno investito complessivamente 28 miliardi di euro per l’innovazione. Oltre l’85% della spesa è costituito dalle attività di Ricerca e sviluppo (R&S) e da investimenti in macchinari e apparecchiature (ISTAT 2011).

In tale contesto è giusto riflettere su un ulteriore dato ovvero quello dell’importanza dei cosiddetti cavalli da parata nazionali nella formazione di strategie di intelligence economica. Riportare i dati di ogni grande impresa strategica del Paese porterebbe ad un’ eccessiva farraginosità di questo articolo, ma è certamente conveniente prendere come termine di paragone una grande impresa orientata internazionalmente in diversi settori e sottoposta alla concorrenza di comparabili imprese estere: il Gruppo Finmeccanica. Nel 2011 il solo Gruppo Finmeccanica ha speso 1,3 miliardi di euro in Ricerca e Sviluppo, contribuendo, da solo, al 6,6% del totale della spesa di settore in Italia. Il valore aggiunto prodotto da Finmeccanica insieme al suo indotto si attesta intorno ai 10 miliardi di euro e garantisce alle casse dello Stato un gettito fiscale annuo di 4,1 miliardi di euro (Finmeccanica Magazine 2013). Un’azienda come quella avente sede in Piazza Monte Grappa a Roma dovrebbe avere senza alcun ombra di dubbio la possibilità di dialogare con le strutture della sicurezza economica statale in piena autonomia e all’interno di schemi normativi chiari. Una società di tale importanza, operante in settori altamente specializzati in cui la concorrenza internazionale è non solo aggressiva, ma molto spesso sostenuta in maniera aperta dagli Stati competitori, non può essere privata del sostegno di un apparato d’intelligence economica efficace. Ogni operazione sul mercato di Finmeccanica è una risorsa per l’Italia, come lo è un’operazione della Siemens per la Germania oppure dell’EADS per la Francia. La garanzia che il manager addetto alla sicurezza o alle informazioni possa tranquillamente dialogare e scambiare informazioni con una controparte, precostituita, a ciò ufficialmente delegata dal settore pubblico, le cui funzioni sono riconosciute dalla legge, è garanzia di stabilità e sviluppo futuro, di cui entrambe potranno giovare.

Ad oggi, tanto per le grandi aziende quali Finmeccanica, quanto per le PMI, ossatura portante del sistema-Paese, nulla di tutto ciò è predisposto. Le azioni di sostegno delle attività imprenditoriali ovvero il flusso positivo d’informazioni verso le strutture della sicurezza statale sono basate sull’estemporaneità e sull’opportunità, senza alcuna garanzia di continuità o legalità che possa facilitare il definirsi di un sistema accettato. Per far ciò è pertanto necessario che il Legislatore delinei al più presto un impianto chiaro e permanente seguendo, se non latro, l’approccio utilizzato per la sicurezza cibernetica il cui campo operativo per molti versi si sovrappone, completandolo, a quello dell’intelligence economica.

L’economia Italiana, stante le constatazioni di cui sopra, pur avendo un numero maggiore di PMI della Francia potrebbe essere a questa facilmente paragonata sia sulla base del PIL, che nella formazione di questo.

Dato che l’Italia non sarebbe certo la prima tra le principali potenze commerciali mondiali a dar vita ad un sistema di intelligence economica potrebbe essere utile, innanzitutto, trarre beneficio dall’esperienza di un Paese simile al nostro e quindi procedere in maniera comparata nella definizione delle esigenze ovvero delle possibili soluzioni. Con la Francia l’Italia per esempio non condivide solamente molte affinità nel campo economico, ma vi è una certa vicinanza anche nella stratificazione sociale, nel percorso culturale e nello sviluppo storico. Entrambe le società conoscono approcci economici, legali ed istituzionali simili cui certamente non può ascriversi una eccessiva corrispondenza con la ricerca di soluzione pragmatiche e convenzionali tipiche del mondo anglosassone oppure di sistemi-Paese quali la Germania o il Giappone, formati in una mentalità organica nella quale il bene pubblico tendenzialmente prevale su quello individuale.

Avendo un tessuto imprenditoriale assai diffuso sul territorio nazionale, ed essendo questo parcellizzato tra le migliaia di PMI, l’Italia, esattamente come hanno fatto i cugini d’Oltralpe, non può esimersi dal far partire la propria piramide dell’intelligence economica dalla base territoriale. Se lo scopo dello Stato deve essere quello di garantire il successo delle sue imprese e se queste sono in maggioranza PMI disperse sul territorio nazionale la formazione della strategia deve iniziare da questo dato di fatto. Come proposta fattibile potrebbe prendersi in esame la possibilità di aprire sportelli di intelligence economica presso tutte le Camere di Commercio. Queste rappresentano una realtà capillare nella penisola e sono un punto di riferimento solido per i settori produttivi nazionali. Il vantaggio rinchiuso nell’idea di coinvolgere le Camere di Commercio – enti di diritto pubblico – viene alla luce nel momento in cui si considera che gran parte delle attività necessarie per il sostegno “alla base” del sistema di intelligence economica è già svolto ovvero ascritto ad esse le quali lo svolgono tramite una struttura complessa formata da 105 Camere di commercio, 1 Unione italiana, 19 Unioni regionali, 16 Società di sistema, 146 sedi distaccate per l’erogazione di servizi sul territorio, 144 Aziende speciali per la gestione di servizi promozionali e infrastrutture, 607 partecipazioni con altri soggetti pubblici e privati in infrastrutture, 9 Centri per il commercio estero, 65 Eurosportelli, 74 Camere di commercio italiane all’estero, 32 Camere di commercio italo-estere. Tale rete fornisce oggi servizi di statistica, d’informazione utile all’internazionalizzazione e di sostegno promozionale che convoglia virtualmente su un’unica piattaforma dati inerenti l’economia locale e quella internazionale dimostrando l’esistenza di un’esigenza concreta e l’ effettiva ricerca di una soluzione da parte delle istituzioni preposte.

Sfruttando questo humus positivo si dovrebbe procedere ad un’ulteriore ufficializzazione della questione specializzando uffici appositi da porre in costante contatto con i responsabili dell’informazione economica e della strategia all’interno del tessuto imprenditoriale. Lo scambio d’informazioni tra le aziende e il preposto ufficio all’interno delle Camere di commercio dovrebbe essere continuo, sia nel senso del “dare”, che nel senso del “ricevere”. Le imprese territorialmente presenti devono poter contare sulla presenza di un interlocutore in grado di rispondere alle loro domande e capace di inoltrare a superiore istanza le informazioni o le richieste particolari, anche sensibili dal punto di vista della sicurezza, ricevute, ma soprattutto impegnato a sottomettere loro informazioni potenzialmente utili pur in mancanza di un’apposita petizione. Gli uffici di intelligence economica territoriale così predisposti dovrebbero poi essere collegati tra loro in maniera verticale attraverso un apposito dipartimento a livello di Regione.

La Costituzione italiana prevede che le Regioni (art.131 Cost.) siano uno dei cinque elementi costitutivi della Repubblica e attribuisce loro esplicitamente, ed implicitamente (art.117 e 118 Cost.), il dovere di realizzare il principio di sussidiarietà, cioè di delegare al livello territoriale più vicino al cittadino – in questo caso alle imprese – le funzioni amministrative. Come ampiamente dimostrato dai contributi della riflessione strategica francese il livello regionale può giocare un ruolo fondamentale nel miglioramento delle capacità di attrazione delle varie realtà locali. La competizione a livello sia europeo, che globale, basata sulla specializzazione delle regioni o sulla predisposizione di particolari distretti imprenditoriali, può divenire uno dei grandi valori aggiunti di riqualificazione dell’economia nazionale unitamente allo sviluppo locale. Avendo l’Italia già a disposizione una struttura amministrativo-politica appropriata, sarebbe insensato non far passare attraverso le Regioni la verticale dell’intelligence economica, soprattutto nel momento in cui è proprio il secondo comma dell’art.117 della Costituzione a chiarire che sono materia di legislazione concorrente con lo Stato – il che significa anche di corresponsabilità – le seguenti materie: rapporti internazionali, commercio con l’estero, tutela e sicurezza del lavoro, ricerca scientifica e tecnologica e sostegno all’innovazione per i settori produttivi, governo del territorio, porti e aeroporti civili, grandi reti di trasporto e di navigazione; ordinamento della comunicazione, produzione, trasporto e distribuzione nazionale dell’energia, armonizzazione dei bilanci pubblici e coordinamento della finanza pubblica e del sistema tributario, valorizzazione dei beni culturali e ambientali e promozione e organizzazione di attività culturali, casse di risparmio, casse rurali, aziende di credito a carattere regionale, enti di credito fondiario e agrario a carattere regionale. L’elenco chiarisce in maniera abbastanza semplice le ampie possibilità di contributo che le Regioni potrebbero portare a favore del settore dello sviluppo economico una volta che lo Stato centrale abbia fissato le linee strategiche generali. I venti dipartimenti d’intelligence economica così creati, oppure i ventuno dipartimenti se si tiene conto della particolare autonomia delle Province di Trento e Bolzano, dovrebbero essere da una parte le camere di compensazioni tra le direttive e le informazioni ricevute dallo Stato e quelle provenienti dalla rete delle Camere di commercio, dall’altra parte dovrebbero essere in grado di dar vita a settori di analisi e proposta strategica tali, da orientare pro-attivamente le politiche economiche, la promozione e la competizione territoriale all’interno del quadro strategico nazionale ovvero riuscire ad indirizzarlo sulla base delle effettive esigenze o proposte. Si tratta di un approccio glocal in cui si pensa globalmente e si agisce localmente. Grazie al ruolo promotore delle regioni, agenti in coordinamento con le aziende ed in assonanza con gli input statali, si potrebbero dar vita a ciò che in Francia è noto con il nome di poli di competitività in cui le sinergie che si esprimono aiutano le PMI a migliorarsi e a conquistare nuovi margini di mercato. Avere dei poli di competitività italiani significherebbe offrire nuove opportunità di crescita all’industria nazionale.

In tal senso sarà assolutamente interessante seguire gli sviluppi dell’iniziativa presa dalla Regione Friuli Venezia Giulia nel corso del 2014 con lo studio e la pubblicazione del Piano Strategico FVG nel il quale si analizza il contesto socioeconomico regionale e si cerca di riposizionare strategicamente il Friuli Venezia Giulia dal punto di vista competitivo. Tra le priorità strategiche individuate per il periodo 2014-2018 rientra il rilancio del settore manifatturiero, lo sviluppo di nuove reti di comunicazione ed il potenziamento delle infrastrutture già esistenti in modo da migliorare il trasporto delle merci. La definizione da parte della Regione di 362 obiettivi strategici è un primo esempio di intelligence economica effettiva a livello sub-statale che potrebbe porre le basi per futuri sviluppi in tal senso da parte delle altre realtà locali e da parte dello Stato.

È innegabile l’importanza del “contributo che il sistema delle aziende nazionali può fornire, tanto alla definizione degli obiettivi di ricerca riguardanti le informazioni da acquisire per garantire alle aziende sicurezza e competitività, quanto all’incremento del patrimonio informativo a disposizione del Governo, tenuto conto delle conoscenze che le aziende stesse acquisiscono grazie alla loro presenza all’estero (Vecchiarino 2012).

Le imprese e gli Stati che saranno in grado di vincere la sfida della turbo-competizione saranno quelli capaci d’offrire le migliori condizioni di lavoro, sviluppo ed anticipazione degli eventi. Una piramide che coinvolga realtà già esistenti ha il vantaggio di non creare ulteriori voci di spesa, di non appesantire il già mastodontico apparato statale, ma di sfruttarne le potenzialità. L’infrastruttura deve essere flessibile, dinamica e costantemente presente il più possibile in vicinanza alle fonti del problema. Una verticalizzazione parallela delle analisi, effettuata attraverso una miriade di nuove istituzioni o enti, e la loro successiva collazione e dissemina a/da livelli superiori, aumenterebbe la pesantezza burocratica, nonché l’inefficienza complessiva. Per tale ragione, parlando di sicurezza in senso stretto, cioè della possibilità che si arrivi a constatare criticità nelle infrastrutture oppure il fatto che le imprese incorrano in pratiche negative di guerra cibernetica, di spionaggio industriale o in atteggiamenti di condotta sleali da parte di soggetti esteri, ovvero ne vengano a conoscenza sia sul territorio nazionale che straniero, sarebbe opportuno prevedere personale qualificato a trattare tali informazioni, gestendole anche a livello orizzontale, presso le Prefetture. Una piramide, che preveda alla base le realtà territoriali e al tempo stesso predisponga una strategia il cui vertice si trova, ad esempio, in un motore unitario istituito presso la Presidenza del Consiglio, non duplica e non appesantisce l’impianto statale, ma porta alla sua razionalizzazione.

Gli uffici regionali preposti a loro volta potrebbero avere la propria linea comunicativa direttamente dipendente dal Nucleo Intelligence Economica, istituito presso la Presidenza del Consiglio, dove le rappresenterebbe il responsabile per l’intelligence economica del Ministero per gli Affari Regionali. Tale organo, il cui presidente assumerebbe la posizione di consigliere del Presidente del Consiglio dei Ministri per l’intelligence economica, dovrebbe essere il vero e proprio motore del dispositivo d’intelligence economica nazionale. Al suo interno avrebbero voce, oltre all’Autorità delegata per la Sicurezza della Repubblica e all’Ufficio del Consigliere Militare presso la PCM (responsabile della sicurezza cibernetica), il rappresentante del CISR, gli incaricati del Ministero degli Affari Esteri, del Ministero dell’Economia e delle Finanze, del Ministero dello Sviluppo Economico, del Ministero degli Interni, del Ministero delle Infrastrutture e dei Trasporti e del Ministero per l’Agricoltura e le politiche alimentari ovvero di ogni Ministero che col tempo, sulla base della presa d’atto di tale necessità, dovesse avere al suo interno una propria struttura dedicata all’intelligence economica. Qualora il Legislatore decidesse in futuro di dar vita ad una vera e propria riforma del settore sarebbe altresì auspicabile che le unità – dipartimenti – regionali, sempre all’interno di una logica di condivisione efficacie delle informazioni, possano comunicare, presentandosene l’esigenza, anche direttamente con le varie unità di intelligence economica ministeriali. Ogni Ministero coinvolto nella strategia dell’intelligence economica avrà così il compito di raccogliere, analizzare e condividere dinamicamente con le altre unità ministeriali, o con i preposti apparati di sicurezza, tutte le informazioni utili ad una politica di sviluppo, promozione e difesa dell’interesse economico nazionale, permettendo al Nucleo per l’intelligence economica di concentrarsi sugli aspetti essenziali della politica di pianificazione e coordinamento. L’ufficio di vertice presso la Presidenza del Consiglio rappresenterebbe il cuore pulsante nel quale si amalgamano le esigenze di ogni dicastero, di tutti gli organi della Repubblica responsabili dell’intelligence economica e delle grandi aziende strategiche di rilevanza nazionale quali possono ad esempio essere ENI, Fimeccanica o altre realtà, pubbliche o private, considerate di grande interesse. Realtà imprenditoriali che a livello nazionale esprimono un indotto particolare e, come punte di diamante dell’ economia italiana all’estero, sono portatrici di informazioni ed interessi di rilevanza nazionale, hanno esigenze particolari che non possono essere rimesse ad uffici d’interfaccia secondari, ma soprattutto sono imprese la cui sicurezza può essere tutelata solamente con un’azione coordinata di vertice. Le grandi strutture aziendali hanno inoltre unità di business intelligence e sicurezza proprie. L’interscambio informativo da parte dello Stato con queste dovrebbe essere formalizzato in modo da avvenire in maniera continua. Ciò apporterebbe vantaggi reciproci alla sicurezza del Paese e allo sviluppo armonizzato dell’economia. Tuttavia perché un eventuale impianto di intelligence economica possa funzionare in modo efficace diviene di non secondaria importanza la questione dell’interlocutore qualificato. Una volta che dovesse venire ad esistere una legislazione in materia, non ci si potrà esimere dalla constatazione che il funzionamento dell’intero impianto avrà la necessaria fluidità solamente nel caso in cui le persone designate a comunicare “parlino la stessa lingua”. Tanto le imprese quanto gli organi pubblici coinvolti dovranno avere persone abilitate e designate ufficialmente a interagire tra loro. La legge dovrà prevedere che tutte le aziende, di qualsiasi dimensione, e gli organi pubblici definiscano i responsabili per il campo dell’intelligence economica e comunichino sempre attraverso il loro tramite. L’argomento non è irrilevante se si tiene conto dei danni che un dialogo tra figure non qualificate può portare in termini di reciproca comprensione, velocità e adeguatezza delle discussioni. La codificazione del ruolo del manager addetto all’intelligence economica è una necessità. Nelle PMI la difficoltà principale sarà quella di trovare, nella già ristretta cerchia dirigenziale, la persona maggiormente sensibile a tale tipo di coordinamento. Nelle imprese più strutturate invece una soluzione semplice e condivisibile potrebbe essere quella d’utilizzare figure già esistenti.

Le grandi realtà imprenditoriali, come abbiamo ricordato, sono munite di strutture di raccolta ed analisi delle informazioni, ma anche di organi per sicurezza propri. Questi operano in senso olistico. Oggigiorno la sicurezza non ha più, come avveniva in passato, una dimensione fisica (per sole strutture o dipendenti). I CSO ovvero i Chief Security Officer sono veri e propri manager di gestione del rischio altamente qualificati a comprendere e governare la stabilità e lo sviluppo delle aziende operanti sui mercati mondiali. Come suggerito da Saccone essi potrebbero divenire l’interfaccia ideale per l’intelligence economica grazie alle loro capacità di fusione delle necessità derivanti dalla sicurezza e di quelle derivanti dello sviluppo dei mercati unitamente alla conoscenza delle debolezze e dei punti di forza dell’azienda (2014). Una siffatta “aggiunta di qualifica” per i CSO faciliterebbe anche l’interoperabilità, poiché il loro ruolo è codificato dalla Norma Italiana UNI 10459 – Funzioni e Profilo del professionista della Security Aziendale finalizzata alla valutazione e qualificazione di tale professionista. Il concetto di security aziendale è sintetizzato dalla normativa UNI 10459 come “studio, sviluppo ed attuazione delle strategie, delle politiche e dei piani operativi volti a prevenire, fronteggiare e superare eventi in prevalenza di natura dolosa e/o colposa che possono danneggiare le risorse materiali, immateriali, organizzative e umane di cui l’azienda dispone o di cui necessita per garantirsi una adeguata capacità concorrenziale nel breve, nel medio e nel lungo termine”. Sulla base di tale definizione è facilmente ascrivibile ai responsabili aziendali della sicurezza, certificati dalla normativa in esame, la qualifica di manager per l’intelligence economica visto che spetta loro lo sviluppo, studio ed attuazione di strategie utili per garantire le capacità concorrenziali all’azienda. Ad essi, comunque, dovranno affiancarsi specialisti dell’intelligence economica nei livelli intermedi e questo, certamente, porterà a una rimodulazione degli assetti interni attraverso la costituzione di sezioni interconnesse nelle quali si convoglieranno le funzioni deputate a elaborare le strategie di mercato, la pianificazione di breve, medio e lungo termine insieme all’analisi geopolitica e geoeconomica. Gli organi pubblici dal canto loro, nel disegnare l’architettura adeguata, predisporranno personale qualificato ad interloquire con il settore imprenditoriale in modo da garantire l’information sharing e il continuo accrescimento sostanziale del concetto di sicurezza partecipata. L’importanza del contributo che il sistema imprenditoriale nazionale può fornire, tanto alla predisposizione degli obiettivi di ricerca delle informazioni da acquisire per garantire alle aziende sicurezza e competitività, quanto all’incremento del patrimonio informativo a disposizione del Governo, tenuto conto delle conoscenze che le aziende stesse acquisiscono grazie alla loro presenza all’estero, è incommensurabile.

Il Nucleo predisposto presso la Presidenza del Consiglio non sarebbe altro che la controparte italiana del National Economic Council americano o del Comité pour la Competitivité et l’Intelligence Economique francese. Al suo Presidente spetterebbe in coordinamento con il Primo Ministro il compito di sovraintendere all’implementazione delle decisioni prese.

Ad oggi l’AISI e l’AISE gestiscono pragmaticamente il campo economico, ma obiettivi definiti e strategie condivise faciliterebbero l’operatività, e anche la legalità, degli organi di informazione per la sicurezza a favore della Repubblica sia in senso difensivo, oggi chiaramente maggioritario, che offensivo poiché solo dalla sinergia tra pubblico e privato si potrà realizzare un deciso salto di qualità del sistema-paese, sia nel senso di fronteggiare meglio rischi e minacce – definendo strategie per la protezione del patrimonio informativo delle imprese – che di sfruttare le opportunità che si presentano (Jean,Savona 2010).

Con una legge specifica d’istituzionalizzazione dell’intelligence economica, il Legislatore permetterebbe all’AISI e all’AISE di meglio gestire l’opera di collezione delle informazioni e di muoversi con maggiore certezza, sotto il coordinamento del DIS, dal punto di vista collaborativo.

Le due agenzie di sicurezza, all’interno del quadro strategico nazionale, devono essere messe nelle condizioni di svolgere:

• Attività di monitoraggio di settore e monitoraggio ambientale;

• Preparare analisi di breve, medio e lungo termine degli scenari di massima;

• Prevedere possibili azioni di promozione e sostegno delle imprese italiane;

• Proteggere la competitività internazionale delle imprese italiane;

• Contrastare, individuare e neutralizzare reti di spionaggio coordinate da governi o imprese esteri;

• Realizzare azioni di deception, ovvero inganno, e controinformazione, che possano falsare la rappresentazione della realtà agli avversari;

• Favorire la penetrazione tecnica ed umana nell’intelligence economica avversaria.

In un contesto internazionale caratterizzato dal confronto geoeconomico, il Governo ha il compito di creare i presupposti adatti affinché il sistema-Paese possa crescere e, nello specifico, facendo in modo che le agenzie preposte alla raccolta informativa offrano effettivamente un servizio alla comunità imprenditoriale. In tal modo si creerebbe una nuova utilità collettiva, ma soprattutto una vera e propria rivoluzione economica di un Paese, l’Italia, bisognoso di una maggiore dinamicità nel suo interno e di una nuova capacità di penetrazione verso l’esterno. In una prospettiva completa dell’intelligence economica non si deve nemmeno dimenticare che in tal modo si doterebbe l’Esecutivo dei mezzi necessari per confrontarsi con le problematiche poste dalla smaterializzazione dei mercati, cioè con la volatilità dei sistemi finanziari odierni che possono influire pesantemente sulla stabilità di un Paese.

Per ultimo è doveroso sottolineare che quanto fin qui proposto potrebbe portare, politici ed economisti, ad esprimere riserve legate all’intervento dello Stato in economia. Tali remore sono normalmente presenti in Paesi di tradizione liberale quali Stati Uniti e Regno Unito, lo sono di meno, o meglio sono quasi assenti, in un Paese come la Francia, che considera normale l’interventismo dello Stato nei campi economico ed industriale, e data la cultura industriale italiana non dovrebbero rappresentare un problema nemmeno nel nostro Paese, soprattutto considerando l’impianto economico della nostra Costituzione, che con gli articoli 41,42 e 43 fissa il ruolo dello Stato in economia. La Costituzione riconosce l’importanza del mercato, ma non lo considera sufficiente per il conseguimento dei superiori fini di utilità sociale e quindi giustifica ampiamente l’intervento pubblico in economia. La Carta non può certo definirsi liberista. Essa permette il ricorso a politiche economiche attive ed approva l’interventismo. Ciò in passato ha incluso misure protezionistiche, discriminazioni fiscali, svalutazioni competitive e premi all’industria nazionale, tutte azioni oggi proibite dai Trattati dell’Unione Europea. Nei confronti di questi ultimi il ruolo pubblico in economia è legittimato dal fatto che anch’essi, come la Costituzione italiana, considerano il mercato un’istituzione fondamentale per l’economia e la democrazia, ritenendo però necessario un intervento statale correttivo ed integrativo. Anche per l’UE il concetto di concorrenza, difeso nei Trattati di Maastricht e Amsterdam (che fondano la “costituzione economica europea”), non è affatto sinonimo di liberismo (Magliulo 1999).

Se lo Stato italiano quindi non deve temere critiche d’interventismo basate sulla legalità interna allo stesso modo, certamente, non dovrà preoccuparsi di pressioni derivanti da altri soggetti internazionali, esterni all’UE, in quanto, come abbiamo appurato, tutte le nazioni più importanti si sono dotate di un’architettura che favorisce attività di intelligence economica, la quale è lo specchio di una realtà fattuale sempre più pregnante dopo il ritorno in forza degli Stati nell’economia a seguito della crisi economica mondiale.

4. Conclusioni

L’intelligence economica è la risorsa base per affrontare la complessità dei rapporti di forza del post-Guerra Fredda. Per sopravvivere è divenuto essenziale riconoscere ed accettare la logica dei rapporti di forza geoeconomici. Tali confronti, se guidati con visione positiva, hanno una caratteristica intrinseca di bilanciamento che le guerre militari normalmente non hanno, poiché proiettate alla distruzione dell’avversario. Distruggere l’avversario economicamente invece, ha nella maggioranza dei casi effetti negativi per colui che, attraverso la massimizzazione del confronto economico, desidera affermarsi commercialmente e geoeconomicamente. Nel mondo odierno chi elimina un concorrente elimina un potenziale cliente o addirittura un futuro partner. Il confronto tra Stati basato sulle guerre economiche, che per forza di cose portano alla massimizzazione delle capacità d’intelligence economica, trova le sue fondamenta nell’ultima fase della globalizzazione capitalista dei mercati, cui siamo oggi testimoni.

L’intelligence economica pertanto non è una moda passeggera e l’Italia, se non vorrà soccombere nella competizione internazionale, dovrà presto adeguarsi. Nel farlo, comunque, non dovrà trascurare un fattore assai importante: l’omogeneità della classe dirigente e degli interlocutori. In questo senso la realtà italiana e quella francese si differenziano profondamente. La Francia, a differenza dell’Italia, possiede la tradizione delle Grandes Ecoles che formano l’elite politica ed imprenditoriale. Ciò garantisce reciproca comprensione e capacità di interscambio morbido, continuo, tra settore pubblico e privato che assicura l’osmosi all’interno del sistema-Paese. Affinché l’Italia possa creare eccellenze, dovrà porre in essere ogni misura necessaria per dotarsi di una classe dirigente competente, ma soprattutto capace di dar vita a sinergie tra i vari settori. La previsione legislativa che ascrive al DIS la promozione della cultura dell’intelligence deve essere considerata solamente come il primo passo nella giusta direzione. L’interazione tra Università, sistema pubblico e settore imprenditoriale dovrà in futuro divenire continua.

Riferimenti bibliografici

Baldassarre, Antonio. 1989. Diritti Sociali, in Enciclopedia Giuridica Treccani, XI. Roma

Draudel, Fernand. 1952. Civiltà e Imperi nel Meditteraneo all’età di Filippo II. Torino: Einaudi

Edward, N.Luttwak. 1993. The Endangered American Dream, New York: Touchstone

Finmeccanica Magazine. 2013. Finmeccanica, Italia e UK. Num.12

Gagliano, Giuseppe. 2014. Guerra economica, stato e potenza. Como: CESTUDEC

Gagliano, Giuseppe.2014. La geoeconomia nel pensiero strategico francese contemporaneo. Roma: Edizioni Fuoco

Gaiser, Laris. 2015. Intelligence Economica. Roma: Aracne

Gyula, Csurgay. cur. Otto Hieronymi. 2009. SWF: Strategies of Geoeconomic Power Projections in Globalization and the Reform of the International Banking and Monetary System. Basingstoke: Palgrave Macmillan

ISTAT. 2011. Ricerca e Sviluppo in Italia, Roma: ISTAT http://www.istat.it/it/archivio/105810

Istituto GuglielmoTagliacarne, LS Lexjus, Focus PMI 2012, Roma. http://www.newsmercati.com/Focus_Pmi_2012

Jean, Carlo, e Paolo Savona. 2011. Intelligence economica – Il ciclo dell’Informazione nell’era globale. Soveria Manelli: Rubettino

Magliulo, Antonio. 1999. La Costituzione economica dell’Italia nella nuova Europa. Un’interpretazione storica. Studi e Note di Economia 3:161-189

Miscione, Michele. 2001. Dialoghi di diritto del lavoro. Milano: Kluwer – Ipsoa

Regione Autonoma Friuli Venezia Giulia. 2014. Piano Strategico della Regione 2014-2018. Trieste: Regione Autonoma Friuli Venezia Giulia

Saccone, Umberto. 2014. Governare il rischio. Roma: Aracne

Vecchiarino, Domenico. 2012. Il Controspionaggio Economico in Italia. Documento SIOI. Roma

Islamic extremism from the Balkans
emerges in Italy

Giovanni Giacalone

Between 2014 and 2015 Islamic extremism from the Balkans started to emerge as a serious reality on Italian soil as several individuals from the other side of the Adriatic, residing in Italy, ended up under investigation for jihadist propaganda and recruitment, with strong ties in their home countries, which include Bosnia, Albania and Kosovo.

Operations “Martese” and “Balkan Connection” exposed the presence of jihadist cells while Tuscany, Lombardy and the North-East of Italy turned out to be areas of interest for Islamists from the Balkans, with several Islamic centers involved in organizing visits of radical preachers.

The connections among jihadist families is also an important element that characterizes both operation, as it can be notices by the Kobuzi-Baki-Sergio relations in the “Martese” operation and the Elezi-Balliu in “Balkan Connection”.

The “Balkanic network” began to attract the attention of the media in January 2014, when photos of Bosnian citizen Ismar Mesinovic’s dead body appeared on Facebook; it was soon discovered that the man had been fighting in an ISIS-linked jihadist group in Aleppo, Syria. A close friend of his, Macedonian citizen Munifer Karamaleski, also travelled to Syria and his whereabouts are still unknown, even though some rumors say that he might have been killed in combat1.

The two jihadists were both living in the north-east of Italy and investigators believe that they have been recruited by well-known Bosnian preacher and former El-Mujahid unit member Bilal Bosnic whom, on various occasions, visited local Islamic centers in Pordenone, Cremona, Bergamo, Monteroni D’Arbia. The preacher was arrested by SIPA in early September 2014, together with fifteen other jihadists, with the accusation of recruiting Bosnian nationals for Syria and Iraq, funding and organizing their travel to the two countries. They were also suspected of participating in armed conflicts in Syria and Iraq where they fought alongside radical terrorist groups and organizations, including Isis. Sipa also seized a large quantity of weapons in various Bosnian cities during the raids. Bilal Bosnic could also have taken a role in the departure for Syria of Macedonian citizen Elmir Avmedoski, who fled the town of Gorizia, in Friuli-Venezia Giulia, to join ISIS, possibly at the beginning of 20152.

Shortly before his arrest, in August 2014, Bilal Bosnic had released an interview to Italian newspaper Corriere della Sera where he claimed to support Isis, to have met Ismar Mesinovic while on a tour in Italy and he also justified kidnappings of Western citizens as part of jihad. Bosnic’s claim was confirmed by a photo were he appeared together with Mesinovic and Karamaleski.

Bosnic was not the only radical preacher active in Italy, as three other imam from the Balkans have been touring the country on several occasions, such as Idriz Bilibani, Shefqet Krasniqi, Mazllam Mazllami. Bilibani appeared in a 2012 video by the title “who are you siding with?” at Monteroni d’Arbia’s “Rastelica” Islamic center, together with Bilal Bosnic. Krasniqi was hosted in Grosseto’s Islamic center in December 2013 while Mazzlami in others near Mantova and Cremona.

The “Rastelica” center near Siena is considered by analysist a hotbed for Islamic extremism; as investigative documents claim, in July 2012 several of its members, including the imam, Sead Bajraktar, were intercepted by Kosovari police while performing a paramilitary training in the Dergas mounts, but no weapons seem to have been found.

1. Operation “Balkan Connection”

In March 2015 operation “Balkan Connection” was carried out simultaneously in Albania and in three Italian regions: Piedmont, Tuscany and Lombardy, involving the cities of Turin, Massa Carrara and Brescia. DIGOS, a special operations unit of the Italian State police, arrested three people on various charges involving jihadist terrorism, as well as confiscating mobile phones, tablets and other materials.

Two Albanians, 38-year-old Alban Elezi and his 19-year old nephew Elvis were charged with recruiting militants for international terrorism along the Balkan route, while the third, Elmadhi Halili, a twenty-year-old Italian citizen of Moroccan origin, was held for spreading extremist propaganda after publishing a 64-page pro-Caliphate document in Italian language on the internet3.

Alban Haki Elezi was arrested in the town of Kavaja, approximately 30 miles from the Albanian capital of Tirana, acting on an Interpol warrant issued by the Italian authorities, while Elvis Elezi and Elmadhi Halili were seized in Turin.

While Halili remains on house arrests, Elvis Elezi was later released by an Italian court because, according to the judge, the elements gathered by investigators were not sufficient for a preventive custody and is currently waiting for a further verdict as public prosecutor Leonardo Lesti appealed against the decision4,5.

Alban Elezi was extradited to Italy in June 2015 and placed in custody only to be released one month later for lack of evidence on his connections in Syria; after his released he was immediately expelled back to Albania6.

The Elezi were already known in Albania for their family link to Idajet Balliu, a jihadist who was killed in Syria in august 2014 while fighting in the ranks of the bloody Lavdrim Muhaxeri unit. According to Albanian sources, Alban Elezi was the one who helped Idajet Balliu leave for Syria. In addition, Alban seems to have accompanied Servet’s brothers, Hassan and Servet, to Tirana’s airport, on different dates, in an attempt to reach Syria, but they were blocked by Albanian authorities7.

2. Operation “Martese” and “lady jihad”

On Wednesday July 1st 2015 five jihadists were arrested in a counter-terror operation that took place between Italy and Albania, while five others are still wanted and currently hiding in the Middle East.

The raids took place in Inzago (Milan province), Scansano (Grosseto province), Treviglio (Bergamo province) and in the Albanian city of Lushnje and the ten accused of terrorism and propaganda are:

Buonfiglio Assunta (17.02.1955), her husband Sergio Sergio (20.06.1954), their older daughter Marianna Sergio (10.05.1984), apprehended in Inzago.

Their younger daughter, Maria Giulia “Fatima Az-Zahra” Sergio (23.09.1987) is still at large and currently in Syria, together with her husband, Albanian citizen Aldo “Said” Kobuzi (17.07.1991).

Coku Baki (19.09.1975), Aldo Kobuzi’s uncle, was arrested in Lushnje while visiting relatives, but he resident in Scansano (Grosseto), together with his sister Arta Kacabuni (23.03.1974), also arrested in the Tuscanian city.

In addition, two other Albanians are still at large: Aldo’s mother, Coku Donika (16.05.1971) and his sister Serjola (25.02.1996), currently hiding in Raqqa. Donika and her brother have both appeared in a 2010 INPS list of agricultural workers in Scansano, were they were resident. She was the first one of the family to become radicalized, after her former husband left for Italy and abandoned her. As for Serjola, she was previously married to an Albanian jihadist named Mariglen Dervishllari, who died while fighting for ISIS. Serjola later married another jihadist there. Dervishllari was radicalized by Albanian imam and recruiter Genci Balla and in Saudi Arabia while studying at the Islamic University of Medina, as registration documents for academic year 2010-2011 show8.

A Canadian citizen of Syrian origin who grew up in Bologna is also at large and wanted by Italian authorities; her name is Bushra Haik (30.07.1985). She left Bologna in 2012 for Riyadh, Saudi Arabia. Haik had a major role in radicalizing Maria Giulia Sergio and other young women through Quran, Tafsir and Aqidah lessons that she gave through Skype. She had a large number of followers and also taught Arabic and Quran recitation, all online with the Skype account Bushra_1. She is very well-known inside the Muslim community in northern Italy and she was a strong anti-Assad activist9.

It is clear that this Italian-Albanian jihadist group revolved around the pre-arranged wedding of Maria Giulia Sergio and Aldo Kobuzi and it is also evident that the couple could count on important links to ISIS both in Albania and Turkey, such as Ahmed Abu Alharith, a well-known ISIS recruiter and foreign fighters coordinator who gave them hints on how to safely reach Syria. Through his Turkish phone number, Alharith takes the calls of potential terrorists who want to reach Syria and gives them advices. He manages contacts with volunteers from many countries such as Afghanistan, Algeria, Bosnia, Albania, Morocco, Saudi Arabia, Georgia, Libya, Lebanon, France, Oman, Sweden, Iraq, Switzerland, Italy, San Marino, Russia. People call that number and there is always someone who speaks the required language and is able to give advices and directions to the volunteers going to Syria.

It is also important to recall that their trip to Syria was organized and financed thanks to the network of Genci Balla, head of the recruiting network in Albania and preacher Bujar Hysa, both currently detained in Albania. Aldo Kobuci’s brother in law, Mariglen Dervishllari, took care of putting him in touch with his mentor, Genci Balla, as recordeded in a phone tapping: “I’m sending you my brother-in-law. I gave him your phone number”10.

According to official sources, Aldo Kobuzi and Maria Giulia Sergio got married on September 17th 2014 in Treviglio’s Islamic center and left for Syria shortly after, together with Aldo’s mother, Donika. On September 21 their mobiles were detected at Rome’s Leonardo Da Vinci airport, while the following day in Turkish territory.

3. The role of Maria Giulia “Fatima Az-Zahra” Sergio
inside the family

As investigations moved on, it became clear that Maria Giulia Sergio was the one who dragged her whole family towards Jihad as she tried to convince her parents to leave the “land of misbelievers” and join her in Syria. As conversations tapping have shown, she did not hesitate to use harsh and threatening tones to convince them, recalling that “hijra” is an obligation in Islam and that the only alternative is to fight the “kuffar” back home. Maria Gulia even reached the point of threatening to abandon them as “her duties are towards nobody except Allah”. On one occasion she yelled to her family that a Muslim must hate misbelievers, even parents eventually. In order to convince her family to do hijra, she made them attend some online lessons taught by Bushra Haik, an expert in extremist propaganda and brainwashing11.

Maria Giulia has a strong and aggressive personality, she wants to be in charge of everything and she knows how to exploit situations. On one occasion she strongly reminded her father that in Islam the man is the one who takes decisions, which meant that if he wanted his family to move all the way to Syria, Assunta and Marianna had to follow. Maria Giulia convinced her father to give up work, take the liquidation money, sell house and furniture in order to leave their Italian life behind. She was also the one who was going to organize the trip for them, through the mujahideen, as she had all the required contacts12,13.

On July 7th 2015 Maria Giulia Sergio released an interview for Italian newspaper Corriere della Sera where she claimed that the Islamic State is perfect and that it is mandatory and fair to kill misbelievers, to cut hands, as ordered by Islamic law. The woman eventually became agitated when the journalist asked about her whereabouts and immediately tried to cut the conversation. Maria Giulia is well-aware about the situation of her family in Italy and she even repeatedly asked news about them to a journalist who interviewed her; according to Maria Giulia, the arrests of her relatives are unjustified.

4. Conclusions

The Sergio case attracted the attention of the Italian media as it became the first case of a whole Italian family that became radicalized and was ready to depart and seek a new life in the so-called “Islamic State”. Cases like this are frequent in the Balkans but not in Italy, were radical Islam remains a niche. Although, by going deeper in the analysis, it is possible to see how the main “engine” of the radicalization process was Maria Giulia, mildly followed back home by her sister Marianna and how the parents were somehow transported by the aggressiveness of their daughter in Syria.

However, Maria Giulia, in order to absorb a certain type of rhetoric to pressure her relatives, required the help of a well prepared indoctrinator such as Bushra Haik who gave her the basic “doctrinal tools” to pressure those who lacked proper religious knowledge and who was eventually engaged to brainwash her sister and parents as well.

The contacts to reach Syria through Turkey and to join ISIS were provided by the family connection that she developed after her combined marriage with Aldo Kobuzi, who belonged to a family that was already radicalized.

This shows how the radicalization and recruitment process for jihad, in order to be complete, requires two basic elements: indoctrination and connections. It is evident from the Martese case but also in the Balkan Connection where Idris Elvis Elezi provided was active with major propaganda through Facebook and his uncle, Alban, had contacts with people who were fighting in Syria, such as Idejet Balliu and, through Servet Balliu, with the Kaca clan from Dragostunje14. Contacts that were probably not as good as the ones that the Kobuzi had.

Even the Bosnians and the Macedonians cited at the beginning of the article, in order to become radicalized and join jihad, required the help of Bosnian indoctrinators who, in that case, were also active in recruitment and who did not hesitate in travelling to other countries in order to find new volunteers.

1 http://corrierealpi.gelocal.it/belluno/cronaca/2015/04/01/news/jihad-maestro-sloveno-per-mesinovic-e-karamaleski-1.11156990

2 http://www.rainews.it/dl/rainews/media/Gorizia-Isis-Muratore-macedone-padre-di-3-figli-il-terrorista-delle-porta-accanto-video-f8aba38c-6708-4053-a961-b9fc75219e3d.html

3 Ordinanze n. 22781/13 RGNR, e n. 20945/14 RGGIP

4 http://www.quibrescia.it/cms/2015/04/28/brescia-scarcerato-il-reclutatore-della-jihad/?rnd=23144509?rnd=2123234137?rnd=1291615517?rnd=1343996674?rnd=919722855?rnd=281815557?rnd=159810471?rnd=2096653080?rnd=1921913283?rnd=1662467175?rnd=691246532?rnd=1329836013?rnd=716929007?rnd=1384569503?rnd=2046988360?rnd=567586780?rnd=1840900279?rnd=1214035008?rnd=1957144628

5 http://www.quibrescia.it/cms/2015/09/15/elvis-elezi-libero-cassazione-annulla/?rnd=168274583?rnd=2143171739?rnd=1072167824?rnd=772545789?rnd=1382064837?rnd=6042663?rnd=79333760?rnd=992170184?rnd=632569098?rnd=37317902?rnd=1709684124?rnd=1611484801?rnd=200555116?rnd=2112818102?rnd=1350856627?rnd=1564293896?rnd=1859259640?rnd=1284834411?rnd=259551310

6 http://www.oranews.tv/vendi/ekstradohet-per-ne-itali-alban-elezi-rekrutonte-luftetare-per-ne-siri/

7 Ordinanze n. 22781/13 RGNR, e n. 20945/14 RGGIP

8 https://madeenah.wordpress.com/2010/08/09/list-out/

9 Ordinanze n. 56938/14 RGNR, n. 12285/14 RG GIP

10 Ordinanze n. 56938/14 RGNR, n. 12285/14 RG GIP

11 Serafini Marta, “Maria Giulia che divenne Fatima”, (Rcs,2015), p. 128-131

12 Serafini Marta, “Maria Giulia che divenne Fatima”, (Rcs,2015), cap. 6

13 Ordinanze n. 56938/14 RGNR, n. 12285/14 RG GIP

14 Ordinanze n. 22781/13 RGNR, 20945/14 RGGIP

Focus:
web intelligence

Dalla SOCMINT alla Digital HumInt.
Ricomprendere l’uso dei Social
nel ciclo di intelligence

Marco Lombardi, Alessandro Burato, Marco Maiolino1

Fin dalla loro comparsa come medium di interazione di massa nei primi anni del 2000, i social media sono rapidamente diventati una preziosa fonte di informazioni per ricercatori di tutti i campi. Le persone spendono sempre più tempo della loro vita su piattaforme come Facebook, Twitter, Instagram, ecc. Attraverso questi social media, il web è diventato uno spazio in cui gli utenti possono rappresentare loro stessi, interagire in diversi modi e produrre e consumare costantemente informazione.

Diversi sono gli aspetti che intervengono simultaneamente a rendere l’argomento degno di un approfondimento in termini di possibile utilizzo da parte dell’intelligence. Il primo e fondamentale elemento riguarda la moderna concezione delle identità reali e virtuali (Tosoni, 2004; Grimmelmann, 2006; Peachey e Childs, 2011), non da concepirsi come separate ed indipendenti ma, al contrario, come estremamente interdipendenti e capaci di influenzare relazioni, motivazioni e azioni individuali ugualmente nello spazio virtuale e in quello reale. Una relazione, questa, non ancora del tutto esplorata riguardo agli aspetti di ordine e sicurezza e che evidenzia importanti lacune in ambito legislativo2. Inoltre, sebbene sia forte la necessità di rinnovare il sistema di intelligence (Tomes, 2015, 2003; US Defence, 2009), a seguito principalmente dai fallimenti avvenuti in Afganistan e Iraq (Flynn et al., 2010), ancora si stenta a integrare nell’analisi delle informazioni provenienti dai social media, e in generale, dalle altre fonti di raccolta dati, le scienze sociali e più precisamente i processi umani. Tali processi si fondano sempre più su sistemi di relazione che si attuano anche nel web 2.0, e sono ormai un elemento fondamentale per sviluppare una efficace comprensione e prevenzione delle nuove minacce, costantemente in evoluzione.

Questo cambio di approccio e prospettiva sulle modalità di utilizzo e interpretazione dei dati che vengono raccolti dai social è infatti necessario per adeguare concetti, pratiche di sicurezza e di difesa alle sfide poste dalla Guerra Ibrida, una guerra diffusa, pervasiva e delocalizzata che è la cifra della moderna generazione di conflitti che superano il classico e geograficamente definito ingaggio di eserciti rivali, integrando una estrema liquidità alla presenza di nuovi attori ed innovativi campi di battaglia: «a sophisticated campaign that combine low-level conventional and special operations; offensive cyber and space actions; and psychological operations that use social and traditional media to influence popular perceptions and international opinions» (Hunter e Pernik, 2015).

Da una prospettiva legata all’intelligence, i social media hanno quindi la potenzialità di essere altamente importanti: più le nostre vite si collegano alla rete, più le nostre identità reali e virtuali si fondono, più informazioni rilevanti vengono condivise e sono quindi rintracciabili per elaborare analisi che siano le più complete possibili.

La Social media intelligence, o SOCMINT come è stata definita (Omand et al., 2012), è la più recente componente del ciclo di intelligence che si concentra sulla raccolta e l’analisi delle informazioni che vengono prodotte e scambiate attraverso i social media. A ogni modo, sebbene il potenziale della SOCMINT si riconosciuto, gli analisti e i professionisti di intelligence spesso criticano l’assenza di una strategia, di una dottrina o di pratiche assodate sull’utilizzo di questo strumento di analisi. Il cambiamento dinamico del panorama che caratterizza l’ambito legato ai social media rende infatti necessario un approccio flessibile, in grado di adattarsi sia ai cambiamenti tecnologici che alla cultura legata all’utilizzo degli stessi. È infatti condivisa la posizione secondo cui non esista un prototipo definito di utilizzo di questa disciplina che deve invece rivolgersi le seguenti domande: su quale piattaforma sta avendo luogo la conversazione? Qual è la natura dell’interazione? Qual è l’oggetto della ricerca? Domande che, attraverso le loro risposte, definiscono la natura strumentale della disciplina che non può prescindere da una visione più ampia, che coniughi il processo di analisi puntale delle informazioni con una contestualizzazione sociologica attraverso un processo sintetico che abbiamo definito DIGITAL HUMINT, connubio fruttuoso tra la pratica della Humint (Human Intelligence), parte costituente a pieno titolo e sin dalla sua origine del ciclo di intelligence, e l’approccio legato alle nuove fonti social.

In questa nota si citeranno solo alcune delle peculiarità comuni ai due ambiti per sottolineare le motivazioni della scelta, e dall’utilità, di una visione olistica dei singoli strumenti in una nuova disciplina, la DIGITAL HUMINT appunto.

1. Real world vs digital world?

Esiste davvero una contrapposizione tra il mondo digitale e quello reale? Se così fosse, a ragione, gli strumenti della SOCMINT e della HUMINT andrebbero considerati come declinati, il primo per occuparsi del mondo digitale, con le sue regole e le sue particolarità, e il secondo per il vero lavoro di intelligence, quello che ha a che fare con le persone e quindi porta a pezzi di informazioni più “autorevoli” e più facilmente “processabili” attraverso canali ormai rodati da parte dei servizi di informazione.

Aspetti, definiamoli pure sociali, come la rappresentazione, la comunità e l’interazione sono caratteristici della vita reale comune di chiunque, anche se (ormai la letteratura a riguardo ne è convita) definiscono anche tanto profondamente il comportamento on-line delle stesse persone che ugualmente sentono la necessità di creare una rappresentazione di sé nel mondo nel quale sono inseriti (reale o virtuale), di stringere legami con chi gli sta attorno (reali o virtuali), di interagire con coloro con i quali condivide esperienze (reali o virtuali).

1.1 La rappresentazione:
sei veramente chi vuoi far credere di essere?

Ammesso che nel mondo virtuale sia difficilmente raggiungibile una situazione di completo anonimato (Lapidot-Lefler e Barak, 2012), la rappresentazione di sé avviene in due momenti distinti: all’atto dell’apertura di un profilo (rappresentazione statica) e attraverso la costruzione progressiva dei contenuti che “popolano” il profilo stesso (rappresentazione dinamica). L’analisi delle due rappresentazioni, specie nelle loro discrepanze, è in grado di fornire elementi interessanti per l’elaborazione di un’analisi che tenga conto anche degli aspetti sociologici e non meramente dei dati aggregati circa le impostazioni dell’account o delle rilevazioni delle preferenze dell’utente.

Come di fatto dimostrato da alcune ricerche, esistono diversi ambiti in cui le inferenze deducibili dalla semplice analisi statistica non si dimostrano essere pienamente fondate: Kosinski, Stillwell e Graepelb (2013) hanno analizzato i like di Facebook di circa 58.000 volontari nel tentativo di analizzare la tipologia di informazioni che possono essere estratte da questa analisi e le inferenze che possono essere fatte dai dati raccolti. Raccogliendo una media di 170 like per ognuno dei partecipanti alla ricerca, lo studio ha dimostrato un’accuratezza nell’inferenza, a esempio, dell’etnia (Caucasico/Afroamericano) e del genere (Uomo/Donna) anche se ha evidenziato una carenza nella capacità di inferire sull’uso di alcool o droghe da parte degli utenti, comportamenti, tra l’altro, che fortemente risultano essere influenzati da una dimensione “sociale”.

Altro strumento altamente significativo per la rappresentazione di sé è l’uso e la scelta del linguaggio: come per il mondo reale, la condivisione anche online di un codice comunicativo è significativa dell’appartenenza a un determinato gruppo. Tutto questo è supportato dai risultati di diverse ricerche che hanno mostrato come l’utilizzo di determinate parole sia in grado di rivelare molto di più della personalità di un utente di quanto egli stesso possa immaginare (Summer et al., 2012).

1.2 Le comunità: creare e ricreare il proprio gruppo

L’individuo è un “animale sociale” e per questo si caratterizza come all’affannosa ricerca di intessere legami con altri individui. La letteratura relativa alla definizione di “comunità” in ambito virtuale ancora dibatte su quali siano le discriminanti perché un gruppo si possa definire tale. Ai nostri scopi è sufficiente che sia riconosciuto che per esistere una comunità coloro che la formano devono interagire tra di loro secondo delle norme condivise, una cultura digitale comune o altre caratteristiche rilevanti.

È evidente che aspetti come le modalità di creazione delle comunità on-line, il loro sistema di relazioni e la loro tipologia possono essere diversi rispetto a quelli che definiscono comunità o gruppi tradizionali. L’analisi delle comunità virtuali, quando volta a comprendere le motivazioni di appartenenza dei singoli individui, non può prescindere da considerazioni che riguardino questi aspetti. Per esempio, è necessario precisare ed essere consapevoli che esistono social pensati appositamente per ricreare una specie di copia della comunità reale (Facebook) e altri che invece creano gruppi che non hanno nessuna, se non minima, trasposizione effettiva e vera nel mondo reale. E’ proprio lo studio di queste comunità virtuali, a volte fortemente coese e con un alto grado di identificazione, spirito di appartenenza e condivisione delle finalità tra i propri membri, uno degli aspetti più complessi da affrontare ma al contempo altamente significativo che deve essere ricompreso nell’analisi della SOCMINT (Benthall, 2012).

1.3 L’interazione

Se con il termine interazione si intende tutto ciò che permette agli utenti di entrare in contatto l’uno con l’altro, condividere informazioni o collegarsi in qualche modo, nel momento in cui le persone decidono di entrare in contatto con altri individui nel mondo offline, esistono limitate possibilità di scelta circa gli strumenti per farlo: chiamare l’altro, mandare una lettera, presentarsi, ecc. Nel mondo online, strumenti come i retweet, i like, i preferiti e le condivisioni sono stati adattati per facilitare un insieme complesso di metodi indiretti di interagire con un individuo.

Boyd, Goldern e Lotan (2010) hanno condotto una ricerca circa le motivazioni per cui gli utenti utilizzano questo strumento:

– amplificare o diffondere il messaggio al pubblico,

– intrattenere o informare un pubblico specifico,

– commentare un tweet ri-postandolo e aggiungendo nuovi contenuti,

– dimostrare la propria presenza come un ascoltatore,

– dimostrare pubblicamente il proprio consenso,

– convalidare il pensiero altrui,

– dimostrare amicizia e/o fedeltà richiamando l’attenzione, spesso anche chiedendo di ri-postare,

– conferire maggior visibilità o persone o contenuti poco visibili,

– aumentare il proprio numero di contatti da un utente più visibile.

Dal punto di vista del processo di intelligence, in riferimento all’analisi dei profili individuali risulta assai interessante il tema della dimostrazione di amicizia e/o fedeltà. Utenti che vogliono rendere pubblica l’influenza che altri hanno su di loro, che vogliono dimostrare la loro stima nei confronti di individui dei quali condividono opinioni, spesso ri-postano questi contenuti per dimostrare tutto ciò in maniera indiretta. Questo rapporto, che non prevede un contatto diretto, incoraggia gli utenti a utilizzare gli strumenti della condivisione o del retweet scevri dal sentimento sociale dell’imbarazzo: la condivisione, infatti, rappresenta un’opzione a basso-rischio per interagire con un altro utente, con il quale probabilmente altro tipo di interazione sarebbe stato impossibile.

Complici di questi comportamenti sono due teorie distinte: l’observation effect e il disinibition effect. Il primo fenomeno, noto anche come il paradosso dell’osservatore, si verifica quando gli eventi in una determinata situazione che si vuole indagare risentono della presenza dell’osservatore. Gli utenti dei social network, nel momento in cui hanno la percezione di essere osservati, possono reagire cambiando il proprio comportamento online o nascondo informazioni interessanti ai fini dell’analisi (Heppner et al., 2007). Il secondo invece, riguarda il cambiamento di comportamento che viene assunto online dagli utenti che, avendo percezione di anonimato e non dovendo interagire faccia-a-faccia con il destinatario della loro azione comunicativa, tendono ad interagire di più e ad assumere toni anche più accesi di quelli che verrebbero utilizzati in caso di comunicazione offline (Lapidot-Lefler and Barak, 2012).

2. Conclusione

Le considerazioni riportate nell’articolo sono solo alcune di quelle necessarie affinché lo strumento della SOCMINT, efficace in termini di metodologia per la raccolta di “pezzi di intelligence” dal mondo virtuale, possa essere ricompreso in una disciplina più ampia in grado di contestualizzare meglio, sia in termini di efficacia che si comprensibilità, le sue potenzialità.

L’identificazione delle aree di interesse sulle quali focalizzare la propria indagine raggiunta grazie alla SOCMINT deve infatti arricchirsi della consapevolezza che non esiste una netta distinzione tra mondo reale e virtuale in termini di rappresentazione di sé e senso di appartenenza. Vanno dunque fuse la SOCMINT e la HUMINT favorendo la nascita della loro sintesi in una nuova disciplina: la DIGITAL HUMINT.

Riferimenti bibliografici

Benthall, S. (2012) “Weird Twitter” art experiment method notes and observations. Digifesto, [Online]. Disponibile su: http://digifesto.com/2012/10/18/weird-twitter-art-experiment-method-notes-and-observations/ [verificato 30 Settembre 2015].

Boyd, D., Golder, S. e Lotan, G. (2010) Tweet, Tweet, Retweet: Conversational Aspects of Retweeting on Twitter. Proceedings of the 43rd Hawaii International Conference on System Science, January 6.

Flynn, M.T., Pottinger, M. and Batchelor P.D. (2010) Fixing Intel: a Blueprint for Making Intelligence Relevant in Afghanistan, Voices from the Field, Centre for a New American Security.

Grimmelmann, J. (2006) Virtual Borders: The Interdependence of Real and Virtual Worlds, Peer-Reviewed Journal on the Internet.

Heppner, P.P., Wampold, B. E. e Kivlighan, D.M. (2007) Research Design in Counselling, Belmont: Thomson Higher Education.

Hunter, E. and Pernik, P. (2015) The Challenges of Hybrid Warfare, International Centre for Defence and Security, Tallin.

Kosinski, M., Stillwell, D. e Graepel, T. (2013) Private Traits and attributes are predictable from digital records of human behavior. Proceedings of the National Academy of Sciences of the United States of America, 110(15).

Lapidot-Lefler, N. e Barak, A. (2012) Effects of anonymity, invisibility, and lack of eye-contact on toxic online disinhibition. Computers in Human Behaviour, 28(2).

Omand, D., Bartlett, J. e Miller, C. (2012) Introducing Social Media Intelligence (SOCMINT). Intelligence and National Security, 7(6), 801-823.

Peachey, A. and Childs, M. (2011) Reviewing Ourselves: Contemporary Concepts of Identity in Virtual Worlds, Springer 2011

Sumner, C., Byers, A., Boochever, R. e Park, G.J. (2012) Predicting Dark Triad Personality Traits from Twitter usage and a linguistic analysis of Tweets. Proceedings of the IEEE 11th International Conference on Machine Learning and Applications ICMLA 2012.

Tomes, R.R. (2003), Informing US National Security Transformation Discussions: an Argument for Balanced Intelligence, Surveillance and Reconnaissance, Defence Studies, 3(2).

Tomes, R.R. (2015) Toward a Smarter Military, Socio-Cultural Intelligence and National Security, The US Army War College Quarterly Parameters, Contemporary Strategy and Land-power, 45(2).

Tosoni, S. (2004) Identità Virtuali: Comunicazione mediata da computer e processi di costruzione dell’identità personale, Franco Angeli, Milano.

US Defence Science Board Task Force (2009) Understanding Human Dynamics, Office of the Under Secretary of Defence for Acquisition, Technology and Logistic, Washington DC.

From SOCMINT to Digital Humint.
Re-frame the use of social media
within the Intelligence Cycle

Since their first appearance as medium of mass interaction, in the early 2000s, social media have rapidly become a precious source of information to researchers of different fields. People spends an increasing amount of their daily time on social platforms such as Facebook, Twitter, Instagram and so on. Through those social media, the web became a space within which users may represent themselves, interacting in different ways, and produce and consume information constantly.

Different are the aspects that simultaneously intervene to make the argument valuable to be deepen, in terms of possible use from the intelligence side. The first and fundamental element concerns the modern understanding of real and virtual identities (Tosoni, 2004; Grimmelmann, 2006; Peachey and Childs, 2011), which are not to be seen as separated and independent from each other but, quite the opposite, as extremely interdependent and able to influence relations, motivations and individual actions, equally, within the real and the virtual space.

This relation, that remains to be fully explored in relation to its security aspects, still presents important lacks in legislative terms3. Besides, although the need to renovate the intelligence system is strong (Tomes, 2015, 2003; US Defence 2009), mainly due to its failures in Afghanistan and Iraq (Flynn et al., 2010), still there is a kind of reluctance to integrate social sciences and particularly Human Dynamics within the analysis of the information gathered through social media and, in general, from other sources of data collection. These dynamics are increasingly based on systems of interactions that are activated on the web 2.0, and are, nowadays, a crucial element to develop an effective comprehension and prevention of new and constantly evolving threats.

This change of approach and perspective on the use modes and data interpretation that get picked up from social media, is in fact necessary to adapt security and defence concepts and practices to the new challenges posed by Hybrid Warfare, a diffused warfare, pervasive and de-localised, that is the mark of the new generation of conflicts. They overcome the classic and geographically defined engagement of rival armies, integrating an extreme liquidity to the presence of new actors and innovative battlefield «a sophisticated campaign that combine low-level conventional and special operations; offensive cyber and space actions; and psychological operations that use social and traditional media to influence popular perceptions and international opinions» (Hunter e Pernik, 2015).

From the intelligence perspective, social media have then the potential to be highly important: the more our lives connect to the web, the more our real and virtual identities merge up, the more relevant information get shared and, so, the more they become traceable and available to elaborate as the most complete analysis as possible.

Social media intelligence (SOCMINT, Omand et al., 2012), is the youngest component of the intelligence cycle, that is focused on the collection and analysis of information produced and exchanged through social media. However, despite SOCMINT value is recognised, analysts quite often criticise the lack of a strategy, a doctrine or best practices on the use of this specific instrument.

The dynamic change of the environment characterising the social media domain, makes necessary a flexible approach, that is able to adapt to technological changes and their utilisation culture as well. It is in fact shared the position according to which a defined prototype of the use of this discipline does not exist, it needs, instead, to be asked the following questions: Which is the platform supporting the conversation? Which is the nature of the interaction? What is the research object? Demands that, thanks to their answers, define the instrumental nature of the subject, that may not avoid a wider vision, integrating the process of developing a detailed analysis of the information gathered with a sociological framing, through a synthetic effort that we define as DIGITAL HUMINT, fruitful union between the HUMINT practice, primary constituent, since its very origin, of the intelligence cycle and the approach connected to social media sources.

Within this note, some peculiarities related to both of the domains will be discussed, with the aim of underlining the choice’s motivation, and the usefulness of adopting a holistic vision of formerly independent instruments within a new framework, DIGITAL HUMINT again.

1. Real world vs Digital world?

Does it truly exist a clash between digital and real world? If this is the case, reasonably, the SOCMINT and HUMINT tools should be considered as declined, the first to deal with the digital world, with its rules and specificities, and the second to the true intelligence business, the one that deals with people and hence leads to more authoritative pieces of information, more easily processable via known channels and information services.

Aspects, definable as social, such as self representation, community and interaction are classical of real life, common to everyone, even though (and the literature is sure about it) they also deeply define the online behaviour of the same people whom equally feel the necessity to create a self representation in the world the live in (real or virtual), to build up ties with who is around (real or virtual subjects) and to interact with the people sharing common experiences.

1.1 The representation: Are you actually the person
you want to make us believe to be?

Given that in the virtual world the achievement of complete anonymity is pretty difficult (Lapidot-Lefler and Barak, 2012), the self representation comes in two different moments: when a profile is opened up (static representation) and through the progressive construction of the contents featuring that very profile (dynamic representation).

The analysis of the two representations, especially about their inner discrepancies, is able to provide interesting elements to the elaboration of an outlook that takes into account the psychological aspects as well, and not merely the aggregate data related to the account settings or the preferences manifested by the user.

As effectively demonstrated by some researches, there exist different domains where the deducible inferences, from the simple statistical analysis do not demonstrate to be fully reliable: Kosinski, Stillwell and Graepelb (2013) analysed the Facebook likes of about 58.000 volunteers, attempting to understand the typology of information that may be extracted from that analysis and the inferences that may be done from the gathered data. Gathering an average of 170 like for each of the participants to the research, the study demonstrated an accuracy in the inference, for example, of the ethnicity (Afro/Caucasian), the gender (Man/Woman), even though denoting a weakness in inferencing over the abuse of alcohol or drugs from the users (behaviours that are strongly dependent on a social dimension).

Another highly significant instrument to self representation is the use and choice of the language: as for the real world, the also online sharing of a communication code is a valuable indicator of the belonging to a certain group. All this, is supported by the results of a number of researches that proved how the use of specific words is able to tell quite much about a user personality, surely a lot more than how much he may personally imagine (Summer et al., 2012).

1.2 Communities: create and re-create our groups

Human beings are “social animal”, and because of that they continuously look for connections to other individuals. The literature concerning the definition of “virtual community” still argues on the kind of discriminants under which a group may define itself as such. To our purpose is sufficient to recognise that, in order, for the community, to exist, its members must interact to each other following shared norms, a common digital culture or other relevant features.

It results evident how aspects as the modalities of online community creation, their relations system and their typology may be different from the ones defining traditional groups or communities. The virtual communities analysis, when devoted to the understanding of the belonging of their single individuals, may not forget considerations related to those aspects. For example, it is necessary to specify and be conscious of the existence of social media that are thought precisely to re-create a copy of a certain real community (Facebook) and others, instead, that create groups having only a minimum degree of transposition into the real world. It is right the study of these virtual communities, sometimes strongly united and featured by a high level of identification, spirit of belonging and goals sharing between their members, one of the most complex element to be faced but, at the same time, extremely significant and that must be re-considered by the SOCMINT analysis (Benthall, 2012).

1.3 The interaction

If, with the term interaction it is intended everything allowing users to get in contact with each other, sharing information or connecting in some way, when people decide to get in contact with other individuals in the offline world, there exists limited possibilities of choice regarding the tools to do it: calling, mailing, self introduction and so on. In the online world, tools such as re-tweet, likes and shares have been adapted to facilitate a complex system of indirect methods to get in touch with the other.

Boyd, Goldern and Lotan (2010) conducted a study on the motivations behind the users adoption of those instruments:

– to amplify or diffuse the message to the public

– to entertain or inform a specific audience

– to comment a tweet, re-posting it and adding new contents

– to demonstrate the presence as listener

– to publicly demonstrate consensus

– to validate the other’s reasoning

– to demonstrate fidelity and friendship re-calling the attention, often asking to re-post as well

– to give more visibility to people or contents that are hardly visible

– to increase the number of contacts from a more visible user

From the intelligence process point of view, referring to the analysis of individual profiles, it results to be very interesting the demonstration of friendship/fidelity theme. Users whom want to make the influence that others have on them public, whom want to demonstrate their respect to the individual of which they share contents, often re-post those contents to demonstrate their appreciation indirectly. This relationship, that does not foresee a direct contact, encourages users to use the sharing or re-tweet tools freed from the embarrassment sentiment: sharing, in fact, represents a low risk option to interact with another user, with whom another kind of interaction would have otherwise been impossible.

Two distinct theories are the drivers of such behaviours: the observation effect and the disinibition effect. The first, also known as the observer paradox, materialise when the events of a given situation, that needs to be detected, suffer from the observer presence. Social media users, when they perceive to be observed, may react changing their behaviour online or hiding interesting information to the scope of the analysis (Heppner et al., 2007). The second, instead, concerns the behavioural change assumed online by users that, having the anonymity perception and not having to interact face to face with the receiver of their communicative action, tend to interact more and more heartedly than if they would have faced the same situation in the offline world (Lapidot-Lefler and Barak, 2012).

2. Conclusion

The considerations reported within this article are only some of these necessary to allow the SOCMINT tool, already effective in terms of methodology and gathering of “intelligence pieces” from the virtual world, to be re-framed within a wider discipline better contextualising, both in terms of effectiveness and comprehensibility, its own potential.

The identification of the areas of interest over which to focus the research, reached thanks to SOCMINT, must be enriched with the consciousness regarding the fact that a neat distinction between real and virtual world, in terms of self representation and belonging, does not exist. SOCMINT and HUMINT need to be fused, facilitating the birth of their very synthesis: the discipline of DIGITAL HUMINT.

References

Benthall, S. (2012)“Weird Twitter” art experiment method notes and observations. Digifesto, [Online]. Disponibile su: http://digifesto.com/2012/10/18/weird-twitter-art-experiment-method-notes-and-observations/ [verificato 30 Settembre 2015].

Boyd, D., Golder, S. e Lotan, G. (2010) Tweet, Tweet, Retweet: Conversational Aspects of Retweeting on Twitter. Proceedings of the 43rd Hawaii International Conference on System Science, January 6.

Flynn, M.T., Pottinger, M. and Batchelor P.D. (2010) Fixing Intel: a Blueprint for Making Intelligence Relevant in Afghanistan, Voices from the Field, Centre for a New American Security.

Grimmelmann, J. (2006) Virtual Borders: The Interdependence of Real and Virtual Worlds, Peer-Reviewed Journal on the Internet.

Heppner, P.P., Wampold, B. E. e Kivlighan, D.M. (2007) Research Design in Counselling, Belmont: Thomson Higher Education.

Hunter, E. and Pernik, P. (2015) The Challenges of Hybrid Warfare, International Centre for Defence and Security, Tallin.

Kosinski, M., Stillwell, D. e Graepel, T. (2013) Private Traits and attributes are predictable from digital records of human behavior. Proceedings of the National Academy of Sciences of the United States of America, 110(15).

Lapidot-Lefler, N. e Barak, A. (2012) Effects of anonymity, invisibility, and lack of eye-contact on toxic online disinhibition. Computers in Human Behaviour, 28(2).

Omand, D., Bartlett, J. e Miller, C. (2012) Introducing Social Media Intelligence (SOCMINT). Intelligence and National Security, 7(6), 801-823.

Peachey, A. and Childs, M. (2011) Reviewing Ourselves: Contemporary Concepts of Identity in Virtual Worlds, Springer 2011

Sumner, C., Byers, A., Boochever, R. e Park, G.J. (2012) Predicting Dark Triad Personality Traits from Twitter usage and a linguistic analysis of Tweets. Proceedings of the IEEE 11th International Conference on Machine Learning and Applications ICMLA 2012.

Tomes, R.R. (2003), Informing US National Security Transformation Discussions: an Argument for Balanced Intelligence, Surveillance and Reconnaissance, Defence Studies, 3(2).

Tomes, R.R. (2015) Toward a Smarter Military, Socio-Cultural Intelligence and National Security, The US Army War College Quarterly Parameters, Contemporary Strategy and Land-power, 45(2).

Tosoni, S. (2004) Identità Virtuali: Comunicazione mediata da computer e processi di costruzione dell’identità personale, Franco Angeli, Milano.

US Defence Science Board Task Force (2009) Understanding Human Dynamics, Office of the Under Secretary of Defence for Acquisition, Technology and Logistic, Washington DC.

1 ITSTIME – Università Cattolica.

2 Tali lacune si riferiscono a processi giudiziari avventi in Italia, Germania, Paesi Bassi ed altre realtà nazionali europee, a seguito dei quali estremisti islamici sono stati rilasciati perché i processi di radicalizzazione on-line, definite come mero simpatizzare, e le prove relative alle attività effettuate da questi ultimi nel cyber spazio non costituiscono offesa per le varie legislazioni nazionali in questione.

3 These lacks refer to judicial processes brought about in Germany, Italy, the Netherlands and other national realities, that caused the release of Islamic extremists because the processes of radicalisation via web, defined as mere support, and the relative evidences gathered from their cyber activity, do not constitute any offence within the underlined legal frameworks

SOCial Media INTelligence: un nuovo spazio per la raccolta di informazioni rilevanti

Alessandro Burato1

ITSTIME Italian Team for Security, Terroristic Issues & Managing Emergencies

Keywords

SOCMINT, Social Media Intelligence, Information, Social Network, Intelligence, Terrorism, Analysis, Regulation.

Parole chiave

SOCMINT, Social Media Intelligence, Informazioni, Social Network, Intelligence, Terrorismo, Analisi, Regolamenti.

1. COSA è?

La SOCial Media INTelligence è una delle tecniche di reperimento di informazioni utili al ciclo di intelligence tramite il monitoraggio e l’analisi dei contenuti scambiati attraverso i Social Media [1]. Al momento il dibattito teorico ruota intorno alla possibilità di considerare come autonoma tale tecnica, oppure come strettamente dipendente e quindi quasi assimilabile alla Open Source INTelligence. Parte dei diversi ambiti e approcci alla ricerca di informazioni significative (Techint, geoint, sigint, Humint, Masint, Cibint, etc) la OSINT (Open Source INTelligence) si configura come la sistematica raccolta, analisi e disseminazione di informazioni che possano essere giustificate da una specifica necessità di intelligence. L’errore che frequentemente viene fatto è di pensare che tale pratica sia confinata solo al materiale accessibile online. L’OSINT si riferisce invece, non solo ad Internet, ma anche a radio e televisione, giornali e riviste, pubblicazioni istituzionali ed accademiche, ecc. Questo aspetto, spesso ignorato, definisce invece una linea di demarcazione chiara tra OSINT e SOCMINT: quest’ultima infatti vede come oggetto delle sue indagini unicamente le informazioni scambiate tramite i Social Media.

A tal proposito è necessaria un’ulteriore precisazione. Il panorama dei social media infatti non deve essere ridotto alla semplice considerazione dei social network: parte integrante e forse più nota dei media sociali, i social network sono solo una delle componenti del notevolmente più ampio spettro dei social media, da ognuno dei quali la SOCMINT è in grado di estrarre informazioni con diversi gradi di rilevanza e significatività [2].

2. COSA può ottenere?

È evidente che l’aspetto fondamentale attorno a cui ruota tutto il dibattito sulla SOCMINT è l’identificazione degli obiettivi che è in grado di raggiungere. Le finalità dell’indagine dei Social Media attraverso la SOCMINT sono diverse ma possono essere raggruppate, con il solo scopo di esemplificare alcune, in tre macro categorie [1].

Dapprima, i social media possono fornire informazioni crowd-sourced, ciò dati direttamente generati dal pubblico che, aggregati secondo determinati parametri, sono in grado di delineare il quadro generale di una situazione in tempo reale. Questa pratica è stata impiegata recentemente in svariati contesti, dalla pianificazione dell’intervento umanitario in emergenze di tipo naturali e sanitarie [3,4], all’utilizzo per ragioni di sicurezza in occasione di fenomeni criminali.

In secondo luogo, la SOCMINT, essendo considerata una fonte di informazioni utili ai processi di intelligence, viene prevalentemente impiegata nel tentativo di ridurre l’ “ignoranza” e migliorare la qualità del decision-making process fornendo al decisore un quadro informativo più dettagliato [5]. Questo aspetto è primario per la possibilità di migliorare la sicurezza pubblica. Se infatti lo spazio online viene sempre più frequentemente utilizzato per organizzare e coordinare attività criminali, i social media possono fornire uno strumento di inestimabile valore nella loro individuazione.

Nel caso specifico, i “pizzini”, hanno fornito un segnale spia per l’apertura di una indagine. Le immagini che sono circolate su account Twitter riprendevano questi fogli con la scritta “siamo nelle vostre strade” fotografati tenendo sullo sfondo oltre a luoghi sensibili tra i quali il Duomo e la stazione centrale di Milano come anche la bandiere con il logo Expo. Sotto l’hashtag #IslamicStateInRome queste foto sono diventate virali proprio quando le stesse erano oggetto di una approfondita indagine svolta nel tentativo di capire chi fosse l’autore dei messaggi. L’identificazione è avvenuta grazie alla fotografia scattata all’interno della stazione centrale, incrociando i dati visibili sul tabellone delle partenze/arrivi per capire quando era stata scattata e le videocamere di sorveglianza che ritraggono il sospettato scattarla.

Attraverso quindi l’utilizzo di diverse tecniche di indagine, dalle intercettazioni ai pedinamenti, gli inquirenti hanno formulato per i due le accuse di associazione con finalità di terrorismo anche internazionale o di eversione dell’ordine democratico. Infatti, l’analisi delle informazioni a disposizione ha rilevato l’intenzione di Briki e Waqas di partire per la Siria, dove avrebbero ricevuto l’addestramento militare necessario per poi tornare in Italia e colpire, oltre alla base militare di Ghedi, la stazione ferroviaria di Brescia e la ditta di ortofrutta presso la quale lavorava il tunisino come addetto alle pulizie.

Tuttavia, l’utilizzo operativo degli strumenti della SOCMINT non può prescindere dal loro approfondimento e studio in ambito accademico, ma non solo, attraverso programmi di ricerca volti alla comprensione delle dinamiche sociali che su questi mezzi si generano, con lo scopo di affinare la possibilità di identificare eventuali indicatori o condizioni favorevoli all’insorgere di attività criminali, a comprendere meglio quali siano i processi di radicalizzazione prendendo in analisi i diversi utilizzi e impatti che le comunicazioni scambiate possono avere sul pubblico e ad approfondire le possibili interazioni tra comportamenti individuali e collettivi online e offline. La declinazione della cultural intelligence, pratica o strategia applicata da sempre anche se teorizzata solo recentemente, secondo gli orizzonti social è infatti uno degli aspetti più significati di ricerca al momento, proprio per approfondire il legame tra significante e significato nelle diverse sub-culture che proliferano nel web.

3. DOVE e PERCHÉ si applica?

La SOCMINT, come già riferito, si applica esclusivamente online. Questa peculiarità dello “spazio” all’interno del quale la raccolta e il monitoraggio delle informazioni si esplica pone la necessità di ripensarlo in merito alla sua distinzione tra “privato” e “pubblico”. È noto che online, e specialmente sui social media, la distinzione tra queste due “tipologie” di spazio sia andata sfumandosi tanto che, per esempio, materiali (dati) simili pubblicati sullo stesso social network vengono considerati talvolta pubblici, altre volte privati e nella maggioranza dei casi quasi-privati [6]. Questa mancanza di percezione, e di standardizzazione, di ciò che è considerato privato e ciò che invece viene ritenuto di dominio pubblico porta all’impossibilità di applicare la connotazione spaziale al diritto di privacy lasciando quindi questi media senza un riferimento normativo definito. L’acquisizione dunque di tali materiali da parte di soggetti terzi potrebbe portare alla diminuzione della percezione della sicurezza di questo “spazio speciale”, minandone il suo stesso valore.

Infine, non sono da sottovalutare, nelle considerazioni circa l’impiego di queste tecniche in ambiti relativi alla sicurezza, le pressioni pubbliche al loro sistematico impiego a seguito di indagini che, grazie all’utilizzo della SOCMINT, hanno ottenuto ottimi risultati.

4. COME può essere eticamente e legalmente supportata?

Il tema relativo alla privacy (o alla sua aspettativa) in ambito Social Media è già stata riferita. In generale ogni indagine di intelligence deve mantenere un buon equilibrio tra il benessere economico e sociale, la sicurezza nazionale, che si declina in ordine pubblico e sicurezza pubblica, e i diritti di libertà e di privacy [7].

Nella SOCMINT vengono teorizzati a questo scopo tre livelli di investigazione: il primo prende in esame tutti i contenuti open (quelli per esempio per i quali non è prevista nessuna restrizione imposta dall’utente in termini di privacy), senza concentrare l’analisi su un singolo individuo al solo scopo di analizzare gli andamenti generale del fenomeno di interesse.

Il secondo invece vede oggetto dell’analisi la stessa tipologia di dati ma focalizzati su un singolo individuo al fine di ottenere un numero maggiore di informazioni che lo riguardano. Questa pratica è definita meno intrusiva in relazione invece all’ultima tipologia di investigazione che prevedere l’intercettazione di comunicazioni private.

Ora, quando queste tipologia di indagine non rischiano di minare alla base i principi generali sopra enunciati? È possibile contraddire il proverbio africano secondo cui quando gli elefanti lottano, è sempre l’erba la prima ad andarci di mezzo? La giustificazione della scelta di uno dei tre stadi di intrusività dovrebbe essere giustificata dai diversi parametri tra i quali la causa sufficiente per la violazione della privacy, la proporzionalità dei metodi impiegati per il raccoglimento delle informazioni necessarie, l’idoneità dell’autorità che intraprendete l’azione e le sue autorizzazioni, congiuntamente alla ragionevolezza del successo dell’operazione stessa.

5. COME si inserisce all’interno del circolo di intelligence?

Altra questione fondamentale da dirimere per poter giungere all’applicazione delle tecniche della SOCMINT riguarda le modalità con cui essa contribuisce in ognuna delle fasi che costituiscono il percorso attraverso il quale un’informazione diventa, come dicono i professionisti, “intelligence”.

Primo step: ricerca delle informazioni. La raccolta del materiale condiviso attraverso i social media deve avere solide basi metodologiche: data l’enorme quantità di informazioni a disposizione la selezione del campione di quelle da analizzare riveste infatti un ruolo fondamentale. Purtroppo, questo processo, spesso demandato unicamente a persone con elevate competenze in sistemi informatici di filtraggio di dati, risulta più focalizzato sulla raccolta di campioni quanto più ampi tralasciando la rappresentatività degli stessi. Nelle scienze sociali, che dovrebbero trovare uno spazio maggiore nello sviluppo delle tecniche SOCMINT, il valore del campione prescelto è ritenuto di gran lunga più significativo del mero numero di dati raccolti che potrebbero non contenere informazioni rilevanti ai fini dell’analisi [8,9]. Un esempio della generale tendenza a sottostimare la significatività della rappresentatività del campione preso in esame, in particolare nell’analisi dei contenuti condivisi su Twitter, può essere riscontrata nella frequente identificazione degli hashtag quali barriere, già predisposte dallo strumento stesso, alle informazioni relative ad una specifica tematica. Recenti ricerche hanno dimostrato che solo una minor parte delle comunicazioni che si riferiscono ad uno stesso argomento viene “etichettata” attraverso l’utilizzo di queste parole, mentre la maggior parte del flusso resta fuori da tale logica [1].

Nel caso specifico oggetto di questo articolo, l’utilizzo dell’hashtag #IslamicStateInRome ha assunto un ruolo fondamentale per identificare l’oggetto specifico delle comunicazioni che venivano divulgate. Tuttavia, anche in questo caso, non è stato l’unico che ha coperto tutte le conversazioni sull’argomento: erano infatti utilizzati anche l’hashtag #Islamic seguito dalle parole State In Rome, e #Islamic_State_In_Rome.

Step 2 e 3: corroborazione e assegnazione di priorità alle informazioni raccolte. Con particolare riferimento alle sole risorse testuali (che costituiscono una parte del materiale analizzabile che comprende anche immagini e video) una delle tecniche impiegate per l’analisi è l’estrazione automatica del loro significato. Tale operazione consente infatti di isolare il materiale rilevante dividendolo in categorie utili alla corroborazione e all’impiego da parte dei decisori delle informazioni stesse [3]. Tuttavia il raggiungimento di tale obiettivo è reso particolarmente complesso da numerosi fattori tra i quali la valutazione del contesto e il concetto gruppo nello spazio online. Per quanto concerne il primo aspetto, contestualizzare l’informazione significa in primo luogo riferirsi al linguaggio come sua diretta espressione e dunque apprezzare nell’analisi l’intenzione, la motivazione, la significazione sociale ed eventuali aspetti denotativi e connotativi delle espressioni utilizzate. In altre parole, la rilevazione del contesto nel quale lo scambio di informazioni avviene passa attraverso la capacità di delineare la situazione e la cultura che lo hanno prodotto. Dall’altra parte, per completare quanto richiesto dagli step 2 e 3 può essere necessario scavare a fondo in merito al concetto che sottende all’adesione a gruppi virtuali [10]. L’idea di “membership” che li caratterizza non deve essere pedissequamente omologata a quella che definisce le adesioni a gruppi reali: spesso infatti non viene richiesto il pagamento di alcuna “quota sociale”, i legami tra i componenti sono più lassi e a volte dettati da pure ragioni opportunistiche. È significativo invece notare come alcuni gruppi online condividano una sorta di identità linguistica (abbreviazioni, modi di dire, espressioni comuni) che li rendono facilmente identificabili. A tal proposito la sociologia digitale fornisce ormai solide basi teoriche per la comprensione delle sub-culture che si sviluppano sui social media e i diversi utilizzi del linguaggio che li caratterizzano.

Ulteriore passaggio, legato a quello appena esposto, è quello espresso nello step 4: la validazione delle informazioni. Tale processo deve tenere conto di aspetti quali il “gaming” e l’“observation effect”. Il primo riguarda il rilascio intenzionale di informazioni errate o volutamente ambigue mentre il secondo si configura come la tendenza a cambiare il proprio comportamento qualora si sia consapevoli di essere osservati. Briki e Waqas, una volta che le immagini postate sono diventate virali, hanno infatti chiuso i propri account e hanno limitato al minimo le interazioni social. Una volta valutata la presenza di tali fenomeni l’informazione filtrata e isolata si arricchisce di livelli di confidenza che possono essere supportati da ulteriori verifiche tramite la triangolazione con altre fonti.

L’ultimo step, quello della disseminazione, deve essere pensato sicuramente in termini di condivisione dell’informazione estrapolata tra i canali di intelligence strutturati, ma eventualmente anche con il pubblico social.

6. Conclusione

Con diversi gradi di impiego e di penetrazione, la SOCial Media INTelligence (SOCMINT) viene utilizzata dai servizi di intelligence internazionali per raccogliere dati rilevanti al fine di fornire informazioni aggiuntive circa determinate minacce. Nel dibattito internazionale intorno a questo metodo di raccolta e interpretazione di dati provenienti dal web 2.0 sono chiare alcune posizioni fondamentali per riuscire progressivamente ad attestare questa che al momento è quasi unicamente una pratica applicata come una disciplina vera e propria cioè corredata non solo da obiettivi e mezzi ma anche e soprattutto da una riflessione metodologica.

Innanzitutto, è chiaro che la SOCMINT, e di conseguenza coloro che se ne occupano, non hanno alcuna pretesa che questa possa essere la nuova, migliore e sostitutiva modalità di acquisizione dati di tutte le diverse sfaccettature del ciclo di intelligence. Tuttavia, è innegabile che l’evoluzione delle modalità di comunicazione del terrorismo impongono ai servizi di intelligence di dotarsi di strumenti e competenze capaci di confrontarsi con questo fenomeno. Da questo punto di vista, le difficoltà maggiori riscontrare si riassumono in una “resistenza” generalizzata ad integrare questa tecnica alle altre, resistenza che è resa evidente dalla richiesta, da parte dei membri dell’intelligence stessa, di prove circa la sua efficacia. Come tutte le altre tecniche che compongono il ciclo di intelligence la SOCMINT è solo un ulteriore modalità di raccogliere dati che possano produrre informazioni che nello specifico, essendo prevalentemente presenti e diffuse online, sarebbero altrimenti difficilmente raggiungibili.

In secondo luogo, argomento spesso dibattuto sono le modalità con cui essa viene applicata. La SOCMINT, mutuata nell’ambito della sicurezza da quello del business, è da subito stata concepita come uno strumento di monitoraggio. Nata per verificare il posizionamento dei brand commerciali e fornire dati per la sentiment analysis, la SOCMINT si è concentrata sui processi di data mining rivolti a due principali aspetti degli ambienti “social”: i contenuti e le relazioni. I primi hanno dato origine a diversi studi sui cosiddetti motori semantici utili nell’analizzare e filtrare grandi stringhe di dati come sono quelle delle comunicazioni che “scorrono” sui social, i secondi si concentrano maggiormente sulle relazioni virtuali che intercorrono tra i diversi user avvalendosi delle moderne tecniche di visualizzazione dei dati per darne una visione più ampia ed immediata. Evidentemente, tali visualizzazioni non esauriscono la ricchezza di informazioni e significato dei dati che rappresentano e dal punto di vista delle scienze sociali si rendono necessari dei sistemi di verifica di affidabilità ed efficienza di tali strumenti.

Tuttavia, l’ambito di utilizzo della SOCMINT non si limita ad un livello “passivo” di monitoraggio ma viene utilizzata anche in maniera proattiva per interagire con i diversi soggetti della rete. Esperienze internazionali, più o meno efficaci, dall’America all’Europa riferiscono di interventi svolti da personale qualificato nelle reti oggetto di monitoraggio.

È evidente che entrambe le modalità di applicazione della SOCMINT pongono problemi etici che vanno affrontati e ricondotti ad un approccio di gestione bi-direzionale: uno top-down, ossia garantito da norme e leggi, e uno parimenti fondamentale bottom-up che riguarda la formazione del personale addetto a tale ruolo.

Il dibattito è aperto, la pratica lanciata a livello internazionale, ora manca che si conduca la SOCMINT da un piano puramente “empirico”, intendendo con il termine il fatto che la pratica è unicamente dettata dall’uso, ad un piano che maggiormente afferisca ad un disciplina sempre più formalizzata.

Le possibili linee di attività dunque si declinano nel reclutamento da parte dei servizi di intelligence di giovani nativi digitali che possano apportare nuove prospettive di interpretazione ed analisi, nella definizione di un panorama legislativo preciso in materia, che contribuisca anche a far capire ed accettare all’opinione pubblica le attività che vengono intraprese, definendo ad esempio quali sono i limiti di intervento e la possibilità di utilizzare tecniche di investigazione speciali nei confronti si individui che ancora non sono considerabili sospetti; ed infine in un investimento nella formazione, che anche in questo ambito riveste un ruolo fondamentale, diretta sia all’interno degli stessi servizi di intelligence per colmare l’eventuale “gap generazionale” nell’approcciare la SOCMINT, sia ai governanti e legislatori perché si rendano conto in quale ambiente i servizi di intelligence si trovano ad operare.

References

[1] D. Omand, J. Bartlett & C. Miller (2012), #Intelligence, Demos

[2] Omand, Sir David, Bartlett, Jamie, Miller, Carl, (2012). ‘Introducing Social Media Intelligence (SOCMINT), Intelligence and International Security

[2] Burato, A. (2015). Social Media & Engaged Public: Possibilities and Responsibilities. In: I. Apostol, J. Mamasakhlisi, D. Subotta, D.W.G. Reimer (eds) Engaging the Public to Fight the Consequences of Terrorism and Disasters. NATO Science for Peace and Security Series, IOS Press, pp 11-21

[4] Burato, A (2015). Ebola: is it real? The role of communication, information, regulation and training in managing emergencies. Sicurezza, Terrorismo e Società, 1, pp 83-98.

[5] A. Selamat, N.T. Nguyen, H. Haron (2013). Intelligent Information and Database Systems, 5th Asian Conference, ACIIDS 2013, Kuala Lumpur, Malaysia, March 18-20, 2013, Proceedings, Part I

[6] Bartlett, Jamie, Miller, Carl, Crump, Jeremy, Middleton, Lynne (2013). Policing in an Information Age, Demos, March 2013, [Online] Available at: <http://www.demos.co.uk/files/DEMOS_Policing_in_an_Information_Age_v1.pdf?1364295365> pp. 1-42, [accessed 2 September 2015]

[7] Cloke, P., Cook, I., Crang, P., Goodwin, M., Painter, J. and Philo, C. (2004) Practising Human Geography. London: Sage.

[8] Creswell, J.W. (2009) Research Design: Qualitative, Quantitative and Mixed Methods Approaches. 3rd eds. London: Sage.

[9] Bryden, J. and Funk, S. (2013) ‘Word usage mirrors community structure in the online social network Twitter’, Vol. 2, No. 3, 2013, [Online] Available at: <http://www.epjdatascience.com/content/2/1/3> [accessed 2 September 2015].

1 Università Cattolica del Sacro Cuore – Milano

Largo Gemelli 1, 20123, Milano, (IT)

ITSTIME – Department of Sociology

E-mail address: alessandro.burato@itstime.it

How cyberspace is used
by terrorist organization:
possible threats to critical infrastructures?
The most recent activities
of cyber counterterrorism

Mauro Pastorello1

Abstract

L’obiettivo di questo articolo è di mettere in luce le numerose criticità e vulnerabilità che possono essere sfruttate da organizzazioni terroristiche, che accompagnano la crescente importanza dell’universo cibernetico nella vita sociale quotidiana di ogni individuo e nei processi di business di ogni azienda.

Nella prima parte sarà messa in luce la convergenza dell’universo fisico con l’universo logico e verrà offerta un’analisi del cyberspace, utilizzando la Teoria di Clark e fornendo esempi di alcuni recenti casi di attacchi cibernetici. Il corpo centrale dell’articolo fornirà una breve descrizione della strategia italiana sulla sicurezza cibernetica e introdurrà il concetto di Infrastruttura Critica, evidenziando come, ad oggi, non si possa più parlare di infrastrutture meramente fisiche ma di Infrastrutture Critiche Informatizzate. Nella terza ed ultima parte, l’articolo fornirà un’analisi delle attività terroristiche condotte nel cyberspace, applicando la Teoria di Barry Collin ed il concetto di cyberterrorism, evidenziando in ultimo le strategie difensive ed offensive attuate da Stati Uniti e Gran Bretagna e offrendo spunti di riflessione sulla necessità di applicare in misura maggiore le tecniche di cultural intelligence.

The paper aims to highlight the critical issues and vulnerabilities that can be exploited by terrorist organizations, which grow with increasing importance of cyberspace in all business processes and on the daylife of each of us.

In the first part will be highlighted the convergence of the physical world with the cyber world, where the phenomenon of cyberspace is being analyzed, according to Clark’s Theory and providing some examples of recent cases of cyber attacks. The second part is dealing with a brief description of the Italian strategy on cyber security and introduce the concept of Critical Information Infrastructure, which means that we can no longer speak of merely physical infrastructure. In the last part, the paper will provide an analysis of terrorist activities conducted in cyberspace, according to Barry Collin’s Theory and introducing the concept of cyberterrorism, highlighting the latest offensive and defensive strategies implemented by the United States and Britain and offering insights reflection on the need to apply techniques of cultural intelligence.

Keywords

Cyberspace, Cyber-war, Cyber-weapons, Cyber-terrorism, Cyber-space, Cyber attack, Cyber security, Terrorism, IS, Critical Infrastructures, Social media.

1. Convergence of physical and logical security related domains

In the last 20 years, the massive introduction of computer systems to all business cycles has changed systems operations in many ways. This passage from the physical world to the physical-logical was initiated by the introduction of automation systems and remote controls. Attempts were made to minimize the risk in a cost-beneficial way, but concurrently physical systems security lost priority to the identification of new threats, arising from the cyber-world [29]. In these terms, we see a reduction in risk but also a shift [29]. Further, the evolution of critical infrastructure systems has brought to light the presence of a new layer to keep in mind: it is inseparably connected to the physical, works with and for it, and it brings new vulnerabilities to systems: it is the cyber layer [1, 25, 27, 29, 34]. We should also keep in mind that an internal information system could be damaged by malware introduced into the system by the synchronization of a manager’s smartphone, regardless of the nature of the malware present in the smartphone. As we can see, there are multiple and varied points of access to the system which require a new approach to security, that includes an understanding that a cyber-physical system is not just the connection between the cyber world and physical world but it is the loci of interaction between them which gives rise to a “new system” [1]. This new cyber-physical system integrates the activities of processing and communication to control the structure of the physical world connected to them [1, 34].

1.1 The most exposed domain: networks and cyber space

The term cyberspace refers not only to the space in which millions of data per second travel, but it also extends to the equipment that enables these connections, applications that process data and decode the information and users.

This “space” is not used only by simple users but also by government agencies that manage critical infrastructures; the difficulty in finding an unambiguous definition of cyberspace depends on the nature of that domain, created by man and as such, very complex [42].

Our description of cyberspace is based on the operating model proposed by Clark of four layers [10]:

1. physical entity that supports the logical elements, formed by all tangible entities: “PCs and servers, supercomputers and grids, sensors and transducers, and the Internet and other sorts of networks and communications channels”;

2. logical layer includes software, bits and components scattered throughout cyberspace that perform and give orders for actions and reactions. We can consider this level as an intermediate level, which transforms input sent by the operators through the hardware and transforms them into information ready to be transmitted or in actions;

3. information2 includes all traffic in the network of information of various kinds, from music and video to internet pages and so on;

4. users includes end users, who interact with the network and are responsible for each type of action carried out in cyberspace.

After this brief description of cyberspace, we must also identify the entities who act in this world and who can be a source of threats:

• Nation states: national actors such as government agencies that deal with cybersecurity, both offensive and defensive, play a very important role for their participation and for their investment in this area [37];

• Non-state organized threat groups: usually considered as “cyber-terrorists” [36], exploit the ease of attacking critical infrastructures through cyberlayers;

• Hacktivists: the term refers to an attacker that uses cyberlayers to cause damage to a system as a means of protest, usually politically motivated [37];

• Business-oriented attackers: are interested in cyberattacks to gain business advantages [37];

• Casual attackers: attack randomly websites for no apparent reason.

Another key element of cyberspace is that its inherent nature is the result of human mind, potentially unlimited and, therefore, has characteristics that can vary endlessly, changing the geography of the attack and the type of attack almost indefinitely.

Then, in a more tactical level, cyberspace allows great mobility of cyber weapons3 and high capacity to fire4; to keep in mind, however, that, once used in a specific weapon cybernetics, it can not be used again (the so-called “one-shot”) [13] because the potential victims will be aware of the “setting” of such a weapon and, thanks to the reverse engineering techniques, victims may postpone to the sender its cyberweapon.

They were provided different definitions of cyberweapon and, as stated by Rid and McBurney5, a clear and unambiguous definition of cyber-weapon is not easy to define.

According with Mele, a cyber-weapon is: “a machine, a device, or any set of computer instructions designed to illegally damage an information or computer system having the character of critical infrastructure, its information, data or programs contained therein or relevant thereto, or to favor the total or partial interruption or alteration of its operation” [22].

Considering also the cost of the cyber-weapons, we realize that there are significant advantages using cyber weapon than conventional weapons. Infact, a military plane can cost up to $ 120 million, with a cruise missile that is 1 to 2 million dollars; the average price of a cyber weapon ranges from 300 to 50,000 US dollars, ensuring anonymity and “silence” [22].

In a more technical level, each weapon Cybernetics consists of different types of codes, which depend on the type of intrusion and the launch path of the weapon. Specifically, the intrusion can be:

• direct, the intrusion is put in place using a device that transmits to the target system (USB, CDROM, etc..);

• Semi-direct, if sent by the network within the same system or from a domain connected to the target system;

• indirect, sent through cyberspace.

Any type of intrusion to exploit the vulnerabilities of the system; we can divide the vulnerabilities in technical and non-technical.

Technical vulnerabilities are divided into vulnerability of protocols, such as IP Internet protocol, Transmission Control Protocol (TCP), Domain Name System (DNS), Hypertext Transfer Protocol (HTTP), and vulnerabilities in the application layer, used for gaining privileged access to remote control systems and to lock systems [18].

Non-technical vulnerabilities are related to people and their processes and for this reason they are difficult to counter and the only method— closely related to an efficient application of the ISO 27001—seems to be providing “education” on how to behave at work (remember that Stuxnet entered the system through a hard disk connected via USB) [18].

From what has been said, we can say that cyberspace involves the presence of new strategic vulnerability for each country, allowing global operations extremely fast, with the possibility of not being able to trace and contain the economic costs.

Due of its nature, as anticipated above, this environment is created by man and his mind and, consequently, it can ensure a constant change of this space and of arms related to it. Operate in this context, however, it requires high level of expertise and strong links with the private sector by the competent authorities.

In this regard it should be noted the importance of partnership between the private sector and the public sector.

1.2 Stuxnet and ARAMCO attacks and
Tridium Niagara AX Framework

Stuxnet was a malware used in 2010 to attack Iran’s nuclear plant that had the capability of infecting and therefore modifying the behavior of the PLC used to run and control the power plant. The goal of the deployment of such malicious code was to sabotage the nuclear power plant’s process for enriching the uranium used for the production of energy by causing a permanent damage, especially at the physical level (possible explosions of the power plant with radioactive consequences) [37].

This worm exploited five different vulnerabilities of the SCADA system designed and manufactured by Siemens6 and infected 59% of computers in Iran, spreading to Indonesia as well (19% of computers were infected) and India (9% infected) [18]:

• RPC Vulnerability, allowed a remote user rights equal to a local user;

• LNK Vulnerability, allowed remote insertion of malware;

• Spool Server Vulnerability, allowed a malicious print request to take control of a server;

• Win32k.sys Vulnerability, opened vulnerability to executing kernel privileges;

• Siemens SIMATIC Win CC Default Password Vulnerability, use of known default password to access the system.

The attack against ARAMCO (National Oil Company in Saudia Arabia) was conducted by a worm called Shamoon, that gathered files from the system, sent them to the attacker and replaced files with an image (the US flag in flames). Fortunately, the attack hit only the administration system and it took a few weeks to restore all services.

In February 2013, a critical vulnerability in the Industrial Control Systems called “Tridium Niagara AX Framework”, used by the military and hospitals, was found. After a complete set of analyses and testing, the system was found to ber vulnerable to a specific zero-day vulnerability that permits complete control of machinery [2].

1.3 Cyber security strategy in Italy

The characteristics of the domain cyber show that there are no defined boundaries that define precisely the beginning and the end of an attack. For this reason, the security strategy has to be shared and implemented between the various Member States [20, 37].

The parties involved can be classified into three basic areas: Network and Information Security (NIS), law enforcement and defense [37]. The basis of the European strategy for cyber security is information sharing and involving private actors in cybersecurity [20, 37] but with different relations and exchanges between the actors involved, at the European level and the national level [37].

At the European level, ENISA (European Network and Information Security Agency) is responsible for implementing and facilitating information security related best practices and procedures; the CERT-EU (Computer Emergency Response Team), is responsible for the security of the IT systems of EU agencies and institutions and the EP3R (European Public-Private Partnership for Resilience) is involved in information sharing [37].

In law enforcement we have the EC3 (European Cyber Crime Centre), which provides analysis and intelligence [37].

Italy was late in implementing these measures and created the first working group that deals with the security of communications and network security as late as 1999. It later became the Osservatorio permanente per la sicurezza e la tutela delle reti e delle comunicazioni, within the Ministry of Economic Development and Ministry of Defense, the department of Public Service. The Department of Innovation and Technologies and Ministry of Productive Activities aiming to increase the level of knowledge and technological level on security of communications [36], transposed and implemented the Directive 58/2002 on the protection of privacy in the comunication sector in 2003.

This group has collaborated with the political-military unit called CITDC and a group founded in 2003, the Working Group on CIIP [37].

Closely linked to the protection of critical infrastructure is the CNAIPIC, a special unit formed within the Postal and Communications Police Service7 and the UACI (Unit for Cyber Crime Analysis), specialized in the study of cyber attacks [36].

A key role is played by COPASIR (Comitato parlamentare per la sicurezza della Repubblica), which has advisory jurisdiction on every regulatory scheme concerning the organization and management of entities involved with sensitive information and security affairs; it reports directly to the Prime Minister. And then there are the national intelligence services, AISI (Agenzia Sicurezza ed Informazioni Interna) and AISE (Agenzia Sicurezza ed Informazioni Esterna), coordinated by DIS (Dipartimento Informazioni e Sicurezza) with the aim of protecting the Republic against all kind of threats, from within the country and without [37].

Despite the evolution of our security apparatus and the work of numerous players, many experts criticize our choices, or rather criticize the lack of implementation of what was stated in various parliamentary hearings.

First of all, criticism is moved because in our country there is no GOV-CERT able to respond to emergencies and that interfaces directly with the government. Then, further criticism is leveled against the political class in general, accused of lacking the necessary skills in information security and apparently totally disinterested about it, ignorant of the fact that today the information warfare is real and waging in several countries because information has a very high value. More criticism is moved about the strategy adopted from Italy, which aims at a “mere defense” and omits the offensive aspect of information security, often proposed and promoted by military organizations involved. Italy is thus seeking a kind of total security, impossible by definition, without considering some substantial differences between this cyber universe and the classic “material” world to which we are accustomed: the goal here is not to steal something tangible and that then leads to easier detection of the attack and of what happened, but the target is to “copy” the information, and when you do not steal anything but simply copy, it is much more difficult to prevent or at least realize what has happened [6].

According to the Norton8 report, the cost of cybercrime in Italy is around €2.45 billion [37]. Despite these numbers, the resources to invest in the field of information security and protection of CIs, are few and mostly are seen as costs that add nothing to the business and business processes [38]. This situation hinders the creation of a culture of proactive action, essential to increasing the level of resilience and “robustness” of critical infrastructure [38]; quite often management prefers to invest few resources in preventive security, being forced to spend huge resources to restore interrupted service, neglecting that preventive spending to prevent an event X is less than the expenditure to be incurred at a later time to restore service.

1.4 Definition of Critical Infrastructures

Giving a clear definition of CIs is not an easy thing; this difficulty comes from the many definitions provided over the years from various countries, potentially affected by their national interests [26] and ithe definition depends on the type of infrastructure under consideration. We can say that the definition of ECIs is the result of a technical political process, which has as its basis the potential impact that can be generated by a fault or a destruction of an CIs [31, 35]. The international CIIP hand book of 2008-2009 defines CIs as: “Whose incorrect functioning infrastructure, even for a limited time period, may negatively affect the economy of individual subjects or groups, involving economic losses and/or even expose them to safety and security risk”[4, 33].

After the UN resolution 58/199 “Creation of a global culture of cybersecurity and the protection of critical information infrastructures” adopted by the UN General Assembly on December 23, 2003, the Plan of Action Combating Terrorism and the 2004 European Program for CIP in 2005, in 2008 we have the Council Directive on European Critical Infrastructure 114 wasenacted for the designation of ECIs.

Law no. 34 of 14/2/2003, which was enacted by the United Nations in December 15, 1997, and ratified the International Convention for the Suppression of Terrorist mediated use of explosives provides a first legislative identification of critical infrastructure that are identified as “any public facility or private entity providing public services, such as supplying water, the removal of waste water, energy, fuel or communications” [34].

Based on the Council document CS/2008/10934, the CIs ensure deliver of basic services and their destruction would have a strong impact on society; if these effects are trans-boundary we can refer to them as ECIs [3].
Directive 114/08 is therefore the first step toward using common criteria for identification of the CIs in all member states and to improve their protection [26]. To give a clear definiton of CIs, is very important in highlighting the difference between physical CIs and cyber CIs. For physical CIs we consider different system and facilities, closely related with the cyber world; cyber CIs are virtual and related with the IT world [31, 34].

According to Article 2 of this Directive, CIs are: “means an asset, system or part thereof located in Member States which is essential for the maintenance of vital societal functions, health, safety,security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions”.

1.4.1 The Italian case: from “Working group for Protection
of Italian Critical Infrastructure (PIC)” to Interministerial Technical Commission of Civil Defense (CITDC), National Anti-Crime
Computer Centre for Critical Infrastructure Protection (CNAIPIC) and Legislative Decree 61/2011 of the 11th of April 2011

In 2003, after the release of results9 from the “Working Group for the protection of Italian Critical Infrastructure”, the CITDC (Commissione Inter Ministeriale Tecnica della Difesa Civile) was designed to study the vulnerability of and threats to the CIs [4, 31, 34, 75]. After two years, the CNAIPIC (Centro Nazionale Anticrimine Informatico per la Protezione delle Infrastrutture Critiche), was established with the D.L. 155/2005; this center has the aim of collating and comparing all criminal activites against the CIs, working in collaboration with the different operators of CIs during and before a crisis [4, 31, 34, 35].

The Legislative Decree 61/2001 transposing European Council Directive 114/08 into Italian national law describes the procedures for designating ECIs located within the Italian territory and other CIs, located in neighboring member states, but with the interest of Italy for reporting as ECIs.

It also points out the need to expand the components of the NISP (Interministerial Nucleus Situation and Planning), by the exponents of the Ministry of Interior, the Ministry of Defense, Ministry of Economic Development and the Ministry of Transport; a necessary for the proper implementation of the Directive 114/08 is the creation of a responsible structure for the CIs, a role temporarily played by the Secretariat of the Interministerial Coordination for Critical Infrastructure [16]. This responsible structure must liaise with the other member states about possible detections of ECIs that may affect the various countries and inform the European Commission of the intention of establishing bilateral talks on one or more ECIs and, annually, indicate the number of CIs by sector inside the Italian territory; this structure is also in charge of identifying potential critical infrastructures and reporting them to the NISP.
Art. 2 of the Decree, gives us a definition of CIs:

CI is an infrastructure located in a Member State of the European Union, which is essential for the maintenance of vital societal functions, health, safety and economic well-being of the population, and the disruption or destruction of which would have a significant impact in that country, due to its inability to maintain those functions.

Alongside the CIs we find the CIIs, which guarantee the full operation of the IC in normal conditions especially, in conditions of crisis [22]. Another key point of this Decree is certainly the indication of the obligation, within the scope of the CIs detected, to adopt an OSP within a year and a review of the same every five years, drawn up by the officials responsible for security of the infrastructure, the owner of the infrastructure and the security liaison officer, that is a pre-requisite for the creation of OSP [3, 16].

Annex B of this Decree describes the minimum requirements for drafting and implementing an OSP, providing details on the implementation of risk analysis techniques, on the hierarchy of the security measures to be taken, distinguishing between permanent measures (physical protection systems, communication systems, training and awareness raising of the staff) and measures to apply graduated activations in relation to the level of threats and risks.

2. Terrorism threats in cyberspace

As described above, the cyberspace is the new frontier for all those criminal and terrorist organizations who want to pursue their malicious and evil interests [1, 5, 6, 9, 11, 12, 19, 25, 34, 35, 37, 38, 41, 43].

The cyber domain, and in particular Internet, from a sociological point of view, has no centralized governance but rather, is based on the service users themselves who are spread all over the world and then with totally different cultures [1]; precisely this decentralized governance based on various cultures and certainly influence the technological tool, both in the positive and negative senses [1].

Considering the wide use of cyber technologies to improve the performance of CIs, one might think of a willingness on the part of terrorist organizations, to exploit these cyber vulnerabilities to launch attacks on CIs or even aggravate the effects, without their direct involvement in these attacks [1].

All the intelligence agencies are moving in this direction, which represents the future and requires further study, but until now there has been no clear evidence or suspicion regarding cyber attacks stricto sensu against critical infrastructure by terrorist organizations [24, 38]; considering that cyberterrorism, according to Barry Collin, is “the convergence of physical and virtual worlds where cyber weapons produce physical consequences”.

The Federal Bureau of Investigation (FBI) defines such activity as:

a criminal act perpetrated with the use of computer and telecommunications capabilities, resulting in violence, destruction and / or interruption of services to create fear causing confusion and uncertainty within a given population, with the aim of influencing a government or of a population to conform to a particular political agenda, social or ideological.

Paradoxically, attacks and threats regarding this domain come from so-called “rogue states” such as North Korea and Iran. Iran is of considerable interest in a recent US report that points out an increase in attacks coming from Iran and indicates its technological evolution in the cyber world [26].

We could say that, at present, the cyber world does not seem to be used by any terrorist organizations to conduct any real attacks [38]. However, the cyberworld, according to Lombardi [1], offers different “operational” levels:

• we use cyber tools to attack the real world;

• we fight in the cyberworld with consequences that occur in the real world;

• the cyberworld is used to educate and inform.

The last point is of particular interest for the continuation of our analysis on the actual use of cyberspace by terrorist organizations; the possibility of training, through real training courses or manuals for creating IED (Improvised Explosive Device) and “informing” about the success of its suicide attacks or to spread the jihadi creed, it makes this dimension very attractive for the new terrorism 2.0, now accustomed to using the network and social networks to spread their beliefs.

2.1 Social media and cyber terrorism

Social media are therefore a useful tool for the terrorists of the new millennium.

Summarizing the many definitions of social networks, we can define them as instruments of mass communication that can be used only in cyberspace and that base their operations on the internet network, using various software [1]. Through them, users communicate, develop their own “virtual identity” and share various forms of content. The possibility of sharing ideas and content in real time anywhere in the world is the so-called “viral effect”of social media. This is the social media characteristic especially exploited by terrorists [1].

What makes these tools higly attractive is the ease of use and the absence of costs related to a wide range of features that allow users to “customize” their virtual space and their network [1].

Obviously, social media tools themselves are not threats but perhaps that is only because you do not know the real intentions of the end users. In fact, cyberterrorism are all those activities on social networks that aim to destabilize the civil society of different countries [1].

By definition, cyberterrorism is an offensive activity in cyberspace through the use of the network for propaganda purposes, affiliation, denigration, etc... [1,15].

Terrorist organizations that make significant use of social media are jihadist-Islamic organizations such as Al Qaeda and ISIS, engaged in massive operations of “cyberterrorism” aimed at destabilizing the civil society, through propaganda with video of executions, attacks and threats against Western countries [1]; in this regard, it was only a very short time ago that photos were published on social media, immortalizing the landmarks of our country with the small paper containing claims by ISIS. Why? Spread terror through information (or misinformation, depending on your point of view) but without any concrete action, as mentioned by our Intelligence Services and reported by Lombardi10 and other scholars [31].

According to Denning [17] and Lachow [28], cyber-terrorism would be more a myth than a real threat, as it seems to have not caused so far real dangers (equated to terrorism in the physical world). Even Tordjman, of the Institute for Counter-Terrorism in Israel of Herziliya, shared this opinion. The point is to define how the cyber-space is used by the terrorist organizations.

All experts agree that the main uses are: spread of propaganda, attracting new members and funds [1, 44].

Not everyone is for taking down IS propaganda, however. Some experts argue that the bloody videos cause the group more harm than good. Terrorism expert and noted it has actually led many countries to rise up against IS.

Experts wagered that if you showed your friend one of the IS execution videos, they’d probably be disgusted; so, the very typical response to this propaganda is not to be attracted to the Islamic State, but to be repulsed.

There’s no doubt that IS is attracting new recruits through social media, yet they’re mainly recruiting people who were already radicalized. The other side of the picture is that ISIS propaganda is causing nations to rise against it.

United States got involved in fighting IS, after the group released a video where they killed journalist James Foley. Jordanians started fighting IS after a video where they burned alive one of their pilots, Lt. Muath al-Kaseasbeh. Egypt started fighting IS, after it released a video of them beheading 21 Egyptian Coptic Christian migrant workers.

We need to consider that ISIS is the most active terror group on Facebook, Twitter, YouTube and Instagram account and their intention to create a cyber caliphate11.

Another operation implemented by ISIS has been the creation of a smartphone application, called “The Dawn of Glad Tidings,” which offer all the news about the activities of the Islamic State and allow the use of twitter account users who downloaded this application, to spread their messages [44]; the other principal purpose is therefore to increase as much as possible the diffusion of their messages, and, above all, in the opinion of the author, spread the image of an organization stronger than it is in reality.

Recently, IS has also announced the formation of a hacking division, led by British Junaid Hussein, also known as Abu Hussain Al Britani (killed in late August 2015 in Syria by US drone), which will handle their cyberwar; however, there were no significant attacks to critical infrastructures of NATO countries, but there have been numerous attacks against the Twitter profile of the US military command centers and their databases.

The last attack hit the Air Force; 156 soldiers of the US Air Force have seen their personal and sensitive information in the hands of IS.

In order to face this new threat related to IS, countries like the UK, have set up highly specialized departments, such as the 77th Cyber Brigades, created in April in England; this new department will be tasked to conduct psychological operations and to monitor the social networks, as well as to direct the behavior of some populations.

The 77th Brigade officially consists of:

• Headquarters Element

• The Media Operations Group [MOG] (MOG sends out teams to HQ or battlegroup teams to report the new or teach personnel how to deal with the media);

• The Security Capacity Building Team [SCBT];

• 15 Psychological Operations Group [15 POG] (focused on Psychological Warfare);

• Military Stabilisation Support Group [MSSG] (“unique defence organisation that provides the UK with an array of skills and knowledge, that can be used to provide military support to the civilian efforts to stabilise countries around the world that are either emerging from conflict or are at risk of sliding into chaos”)12.

The British Government has also launched other programs, such as the Research, Information and Communications Unit (RICU), a trilateral unit owned jointly by the Foreign & Commonwealth Office (FCO), Home Office and the Department for Communities and Local Government (DCLG) based at the Office for Security and Counter-terrorism (OSCT) at the Home Office, “with the aims to coordinate government-wide strategic and crisis communications activities – both domestic and foreign – to counter the appeal of violent extremism and to strengthen inter-community relations at the grass-roots level”13. It is composed by three units:

• Monitoring and Coordination Team: responsible for providing analysis and insights of media and audience reactions;

• Domestic and International Campaigns Team: charged with the implementation of strategic

• communications activities targeted at vulnerable communities;

• Insights and Analysis Team: conducts research and analysis of target audiences both on and offline.

The United States, in September 2014, have created a cyber brigade, recalling all the soldiers who have knowledge in the field of information security and information technology and, as the British Government, has launched several different program strategic communications against terrorist extremism, such as the Center for Strategic Counterterrorism Communications (CSCC)
and the Digital Outreach Team (DOT), that performs direct engagement through the Internet and social media to counter extremist propaganda and misinformation.

On this front, there is also the presence of “private” hacking company, as the GhostSec, born after the attacks on the headquarters of Charlie Hebdo.

The GhostSec seems to have managed to thwart possible attacks in Tunisia and the United States, getting information by hacking some jihadist forums and subsequently passing these reports to their respective governments.

GhostSec is divided into four divisions. Their operations team oversees the entire unit and gives directions, their technology team maintains tools to fight ISIS, their intelligence team infiltrates ISIS networks and gathers information (including on the Deep Web) while their research team collects data on ISIS news and propaganda.

The main feature of this type of organization is the complete freedom of action, regardless of constraints violations of privacy or similar legal restrictions, and these methods have certainly helped their work, which currently counts:

• 57,000 social media accounts related to IS closed;

• 100 websites reconnected to IS closed;

• 791 Twitter account linked to the IS discovered;

• 11 Facebook pages closed;

• 52 e-mail address directly connected to parties related to IS, in addition to the discovery that many sites are using IS servers on US territory.

All these activities are performed in a web little known, the so-called “deep web”, known by many hackers and activists, used to create encrypted forum. It is then in this “deep web” that we must move to prevent further attacks and to monitor activities on social networks.

Other activity detected by the intelligence services is growing contact between cyber terrorists and organizations of cybercrime with the purpose of creating alliances or perhaps to sell the services offered by cybercriminals (phishing, etc.) to increase the financial resources of cyberterrorists [1].

This scenario has not gone unnoticed to intelligence analysts and all our security services and current Prefect Giovanni De Gennaro, when he was the General Director of the DIS (Dipartimento Informazioni e Sicurezza), stated:

quanto più alto è il grado di informatizzazione di una collettività nazionale, quanto più diffuso è l’uso di apparecchiature telematiche da parte dei suoi cittadini, delle sue aziende e delle sue pubbliche amministrazioni, quanto più frequente è il ricorso al web per acquisire, trasferire o scambiare informazioni, tanto maggiore è la vulnerabilità di quel sistema-paese14.

Analyzing the situation and becoming aware of the new scenario that is presented to us, with all its branches, it now seems essential and urgent to study and apply a Social Media Strategy at the national level, with proactive investigations, already active on the web and on social networks, aimed at preventing attacks and at identifying possible terrorist cells, thus allowing the implementation of a strategy that is both defensive and offensive. At the same time, an information campaign for the whole public administration should be implemented, in order to sensitize all to a careful use of social media, and so reduce the vulnerability of the system.

The use of Cultural Intelligence techniques conducted on the web, has a considerable importance to analyse the phenomenon and to follow the “propagator” of IS. An emblematic case was registered in December 2014, when an IS propagator (Shami Witness, Indian) was arrested and considered a key piece of the Islamic State propaganda by the intelligence agency. Subsequently, however, it was discovered that its activity was limited to disseminate materials and information on IS, along with the passion for American films of superheroes, nothing more.

Another case of non-use of cultural intelligence techniques is the use of the signal “stop” (raised arm and open hand with palm facing forward) used by all military checkpoints in Iraq; in fact, in the local culture this sign is not associated with “stop” or an “alt” but rather is a sign of welcome and hospitality.

From this kind of events, we note that the activities of study and investigation of intelligence can not and should not be limited to mere activities registered online or in the field but we need to analyze the environmental and cultural contest to better understand the situation in which we operate. In a word, activity of Cultural Intelligence, understood as intelligence activities conducted on the basis of information of a political and social, economic and demographic that help to understand the history and the behavior of a population15 but, in this case, conducted in the cyberspace, that is by definition an intangible space, where different people with different cultures meet and interact, creating a new culture based on many cultural interaction and to difficult interpretation: the culture of cyberspace.

References

[1] Autori vari, Cur. di Osservatorio per la Sicurezza Nazionale. (2013) Cyberworld, Capire proteggersi e prevenire gli attacchi in rete. Hoepli, Milan.

[2] Bologna S., Lazari A., Mele S. (2014). Improving Critical Infrastructure Protection and Resilience against Terrorism Cyber Threats, NATO Workshop.

[3] Bouchon S., DI Mauro C., Loggtmeijer C., Nordvik J., Pride R., Shupp B., Thornton M. (2008). Non-Binding Guidelines, JRC, Italy.

[4] Brunner E.M., Suter M. (2009). International CIIP HANDBOOK 2008/2009, ETH, Zurich.

[5] Caleta S., Radosevic S. (2014). Comprehensive Approach as “Sine Qua Non” for Critical Infrastructure Protection, IOS Press.

[6] Chiesa R. (2014). Quelle verità mai dette sulla cyber security, available at: http://www.agendadigitale.eu/infrastrutture/757_quelle-verita-mai-dette-sulla-cyber-security.htm

[7] Choucri N. (2012) Cyberpolitcs in International Relations. MIT Press, Chicago.

[8] Choucri N., Goldsmith D. (2012). Lost in cyberspace: Harnessing the Internet, international relations, and global security in Bulletin of the atomic scientists, vol.68, no.2, 70-77.

[9] CIS Sapienza [Cyber Intelligence and Information Security] (2014). 2014 Cyber Security Report, Consapevolezza della minaccia e capacità difensiva della Pubblica Amministrazione Italiana, Italy.

[10] Clark D. (2010) Characterizing Cyberspace: past, present and future, MIT Review, Chicago. Available at: http://web.mit.edu/ecir/pdf/clark-cyberspace.pdf

[11] Clusit (2012). Rapporto Clusit 2012 sulla sicurezza ICT in Italia, Italy.

[12] -- --. (2014). Rapporto Clusit 2014 sulla sicurezza ICT in Italia, Italy.

[13] Colella A. (2014). Armi cibernetiche e strategie di difesa: Importanza della Societal Digital Security Culture, in Cyber Warfare 2014. Armi cibernetiche, sicurezza nazionale e difesa del business, cur. Gori U., Lisi S. Franco Angeli Editore, Milano.

[14] Consiglio dell’Unione Europea 12109/13 (2013). Strategia dell’Unione europea per la cybersicurezza: un ciberspazio aperto e sicuro, UE.

[15] COPASIR [Comitato Parlamentare per la Sicurezza della Repubblica] (2010). Relazione sulle possibili implicazioni e minacce per la sicurezza nazionale derivanti dall’utilizzo dello spazio cibernetico, Italy.

[16] Decreto Legislativo del 11 Aprile 2011, 61. Attuazione della Direttiva 2008/114/CE recante l’individuazione e la designazione delle infrastrutture critiche europee e la valutazione della necessità di migliorarne la protezione.

[17] Denning D.E. (2001). Activism, Hacktivism, and Cyberterrorism: The Internet as a tool for Influencing Foreign Policy, in Networks and netwars: the Future of Terror, Arquilla J. e Ronfeldt D. (2001). Crime and Militancy, RAND Publications, Santa Monica. Available at: http://www.rand.org/content/dam/rand/pubs/monograph_reports/MR1382/MR1382.ch8.pdf

[18] Edwards M. (2014). Critical infrastructure protection, in NATO science for peace and security. E., Human and Societal dynamics, vol. 116. IOS Press, Amsterdam.

[19] Enisa [European Network and Information Security Agency] (2012). National Cyber Security Strategies. Setting the course for national efforts to strengthen security in cyberspace, UE.

[20] -- --. (2010). Cyber Europe 2010 – Evaluation Report, UE.

[21] European Commission COM 702 (2004). La protezione delle infrastrutture critiche nella lotta contro il terrorismo, UE.

[22] Gori U. (2014). L’inarrestabile sviluppo delle armi cibernetiche, in Cyber Warfare 2014. Armi cibernetiche, sicurezza nazionale e difesa del business, cur. Gori U., Lisi S. Franco Angeli Editore, Milano.

[23] Geers K. (2011). Strategic Cyber Security, CCD COE Publications, Tallinn.

[24] Green J. (2002). The Myth of Cyberterrorism. Available at: http://www.washingtonmonthly.com/features/2001/0211.green.html

[25] ISCOM [Istituto Superiore delle Comunicazioni e delle Tecnologie dell’Informazione], (2004). La Sicurezza delle reti nelle Infrastrutture Critiche, Italy.

[26] Kagan F.W., Stiansen T. (2015). The growing Cyberthreat from Iran. The Initial report of project Pistachio Harvest, American Enterprise Institute Critical Threats Project and Norse Corporation, USA.

[27] Kekovic Z., Kesetovic Z. (2013). National Critical Infrastructure Protection. Regional Perspective. ICS, Belgrade.

[28] Lachow I. (2009). Cyber Terrorism: Menace or Mith?, in Cyberpower and National Security, Kramer F.D., et.al (2009). Potomac Books, Inc, Washington D.C.

[29] Lazari A. (2014). European Critical Infrastructure Protection, Springer.

[30] Libicki M.C. (2013). Brandishing Cyberattack Capabilities. Rand for National Defense Research Institute.

[31] Maggioni M., Magri P. (2015). Twitter and Jihad: the communication strategy of ISIS, ISPI. Italy.

[32] Manzoni Zapparoli A. (2010). Sicurezza 2.0: è tempo di convergenza tra sicurezza fisica e logica, available at: http://www.secsolution.com/articolo.asp?id=24

[33] Mele S. (2014). La cooperazione tra pubblico e privato nella cyber-security. Punti di forza e criticità per la sicurezza nazionale. Available at: http://www.sicurezzanazionale.gov.it/sisr.nsf/approfondimenti/la-cooperazione-pubblico-privato-nella-cyber-security.html

[34] Panzieri S., Setola R. (2004). Vulnerabilità indotte dal Cyberspace sui sistemi di monitoraggio e controllo, Convegno Scientifico Nazionale ENERSIS, Italy.

[35] Presidenza del Consiglio dei Ministri (2004). Protezione delle infrastrutture critiche informatizzate, la realtà italiana. Gruppo di lavoro sulla protezione delle infrastrutture critiche informatizzate, Italy.

[36] Public Law 107-56, 26 October 2001 available at: https://www.sec.gov/about/offices/ocie/aml/patriotact2001.pdf

[37] Report Tenace (2014). Critical Infrastructure Protection: Threats, Attacks and Countermeasures. Italy.

[38] Setola R. (2011). La strategia globale di protezione delle infrastrutture e risorse critiche contro gli attacchi terroristici. CeMISS, Italy.

[39] Tabansky L. (2013). Critical Infrastructure Protection Policy: the Israeli Experience in The Journal of Information Warfare, vol. 13, Issue no. 3.

[40] -- --. (2012). International Cooperation in Critical Infrastructure Protection Against Cyber Threats, Atlantic Voices vol. 2, no. 9, 6-9.

[41] -- --. (2011). Critical Infrastructure Protection against Cyber threats, in Military and Strategic Affairs, vol 3, no.2, 61-78.

[42] -- --. (2011). Basic Concepts in Cyber Warfare in Military and Strategic Affairs, vol 3, no.1, 75-92.

[43] Cur. di Théron P. (2013). Critical Information Infrastructure Protection and Resilience in the ICT Sector, IGI Global.

[44] Zanasi A. (2014). Cultural e Cyber Intelligence: la Nuova alleanza?, in Cyber Warfare 2014. Armi cibernetiche, sicurezza nazionale e difesa del business, cur. Gori U., Lisi S. Franco Angeli Editore, Milano.

1 Università Cattolica del Sacro Cuore – Milano

Largo Gemelli 1, 20123, Milano, (IT)

ITSTIME – Department of Sociology

2 This layer is usually included in the logical layer, following the definition of the International Telecommunication Union (ITU).

3 High mobility is intended to be the ability to launch an attack from anywhere useful, without geographical limits and therefore without the need for military bases or military vehicles.

4 It should be noted that cyber weapons have not necessarily destructive purposes such as “conventional” weapons but can be used to steal or alter information defensive systems.

5 For further informations on this topic see Rid T., McBurney M (2011). Cyber-Weapons, The RUSI Journal, 157:1, 6-13.

6 Siemens is the largest engineering company in Europe and the most profitable unit is the industrial automation division and some of its products are automation equipment and systems and controls for production machinery and machine tools and power automation products.

7 Italian Ministry for the Interior Decree G.U. 30 Aprile 2008 Individuazione delle infrastrutture critiche informatiche di interesse nazionale, n. 101, 2008.

8 Norton 2012 cybercrime report – italy. Available at: http://now-static.norton. com/now/en/pu/images/Promotions/2012/cybercrimeReport/NCR-Country_Fact_Sheet-Italy.pdf 2012.

9 Presidenza del Consiglio dei Ministri – Dip. Innovazione e Tecnologie “Protezione delle Infrastrutture Critiche Informatizzate: la realtà italiana”, 2004 (estratto).

10 Available at: http://www.itstime.it/w/comicita-resiliente-is-minaccia-roma-e-milano-by-marco-lombardi/; For further informations on this topic: http://www.itstime.it/w/nuovo-video-is-contro-i-cristiani-until-there-came-to-them-clear-evidence-by-marco-lombardi/; see also http://www.itstime.it/w/is-lo-stato-islamico-pubblica-il-suo-magazine-dabiq-8-by-marco-lombardi/; http://www.itstime.it/w/da-foley-a-muad-al-kasaesbeh-cosa-cambia-nella-comunicazione-di-is-by-marco-lombardi/; http://www.itstime.it/w/lo-stato-islamico-una-realta-che-ti-vorrebbe-comunicare-il-documento-di-is-in-italiano-by-marco-lombardi/;

11 http://thehackernews.com/2015/02/anonymous-isis-cyber-attack.html

12 https://www.gov.uk/government/groups/military-stabilisation-support-group.

13 Briggs R., Feve S. (2013). Review of Programs to Counter Narratives of Violent Extremism. WHAT WORKS AND WHAT ARE THE IMPLICATIONS FOR GOVERNMENT? Institute for Strategic Dialogue, UK.

14 “The higher the degree of computerization of a national community, the more widespread is the use of telecommunication equipment by its citizens, its businesses and its public administration, the most common is the use of the web to acquire, transfer or exchange information, the greater is the vulnerability of that system – country”.

15 Coles (2005). Cited in Zanasi (2014) [44].

Focus:
grandi eventi

A Case Study Analysis
of the Implementation of GIS Technology
for Safety and Security Planning
during Major Sport Events

Giovanni Pisapia1

ITSTIME – Italian Team for Security, Terroristic Issues & Managing Emergencies

Keywords

Geographic Information System (GIS) technology, major sport events, safety and security planning, traffic management and transport system, common operating picture

Parole chiave

Sistema informativo geografico, grandi eventi sportivi, pianificazione di sicurezza, gestione del traffico e dei trasporti, quadro operativo comune

1. An Overview of Geographic Information System (GIS)
Technology for the Safety and Security Sector
of Major Sport Events

Planning safety and security measures for major sport events requires a reliance on spatial data and geographical reference maps to define resources and physical security system requirements. This holds true for major road sport events in particular, but also becomes a requirement for the overall management of the transport systems, logistic operations, and traffic generated by the major event itself.

The challenge begins when the geographical information available originates from different entities with varying scopes of end use. The information might be collectively complete for all intended planning purposes, however visualizing the interrelationship between the datasets of all maps simultaneously cannot be physically done. The answer to this challenge is to introduce Geographical Information System (GIS) technology computer software to avoid the following potential risks:

• Existence of multiple versions of the truth

• Data entry mistakes between internal role players and external stakeholders

• Data latency, which is a barrier to making timely and critical decisions resulting, in some occasions, in a delayed decision making processes

• Data not organized optimally for user access and analysis needs

• Users not having adequate tools to analyse the data

• Difficulty to share spatial data and make it available for analytical purposes especially with external stakeholders

• No central capability to store and analyse data in a comprehensive and holistic way

Geographic information system (GIS) technology allows visualising, questioning, analysing, interpreting and understanding geographic data in many ways that reveal relationships, patterns, and trends in the form of maps, reports, and charts. It provides for the manipulation of spatial and other data for presentational and analysis purposes. The technology consists in shape files (point, line, polyline and polygon) with associated attribute tables containing ancillary numerical or textual data, which can be related to other files (e.g. databases, sheets). In addition, there are tile-based raster data-sets which are used for presentational purposes (e.g. Ordnance Survey map tiles).

In many cases local law enforcement and government departments already utilize GIS for their internal planning purposes and have extensive databases of spatial datasets. By introducing a software platform intended for the major sport event, the process of integrating and coordinating the information also facilitates the involvement of those internal and external partners involved. GIS becomes the tool by which stakeholders can visually communicate their immediate and long-term needs and requirements for the event. This enables overlaying safety and security measures with increased accuracy and allows for managing and monitoring them during the event in real time.

Even though geographic information technology is advancing in a relentless way (e.g. developments in cloud-based infrastructure, availability of large data and open-source software), the principles and benefits of applying GIS for safety and security planning during major events remain, and are current, as detailed in this and other related articles (Chatterton, 2012). However, to operate and implement the software successfully on complex projects, individuals are required to have a comprehensive understanding of spatial information science, analysis and data management.

The implementation of GIS does bring its own challenges. In general, the control of chances to spatial data is highly difficult to manage due to the numerous contributing role-players coupled with frequent changes, especially as the event comes closer. It is therefore fundamental that quality control regards to data management (e.g. layers ownership) is sufficiently standardized to ensure the spatial information is current and shared effectively.

2. Case Studies

The following is a detailed description of the practical use of GIS technology for the safety and security planning of three major sport events from three different perspectives:

• For the 2010 FIFA World Cup, the capability was built within the Johannesburg Metropolitan Police Department (JMPD)

• For Glasgow 2014, the capability was built within the Organizing Committee (OC)

• For Baku 2015, the capability was provided by a private company external to the Organizing Committee (OC)

For these events, the spatial element, for which GIS provides an integrated and workable solution, was at the centre of integrated planning, particularly beyond the venue boundary in the wider games’ theatre.

2.1 Case Study 1:
2010 FIFA World Cup – Johannesburg, South Africa

The use of the GIS technology was one of the key activities carried out by the Johannesburg Metropolitan Police Department (JMPD) to successfully plan and implement the 2010 FIFA World Cup (FWC) safety and security arrangements for Johannesburg, which resulted in a peaceful and incident free event (Asmal, 2012).

Initially, the tool was implemented for the 2009 FIFA Confederations Cup and other event’s rehearsals at three venues between 2008 and 2010: Ellis Park Stadium (EPS), Orlando Stadium and Soccer City Stadium. As the implementation of the technology for the execution of the traffic management plans and the crime prevention operations was deemed positive during the rehearsals, the technology was then implemented for the 2010 FIFA World Cup event.

During the bid process, the City of Johannesburg (CoJ) was identified as the main Host City of the 2010 FWC South Africa. It hosted two match venues (Soccer City Stadium and Ellis Park Stadium), two official Fan Fests areas (Elkah Stadium in Soweto and Innes Free Park in Sandton), both the Opening and Closing Ceremonies, and the International Broadcaster Centre (IBC). Furthermore, the event was the biggest that the City ever hosted (City of Johannesburg, 2011):

• The opening ceremony held at Soccer City Stadium (Soweto) was attended by 84,490 spectators

• The total attendance at both Johannesburg match venues, Ellis Park Stadium and Soccer City Stadium, over the fifteen games played in the two stadiums was 1,040,000, with an average attendance at Soccer City Stadium of 99% and at Ellis Park Stadium 94% of their respective capacities

• The total number of supporters that streamed into the Johannesburg Fan Fests – Elkah Stadium in Soweto and Innes Free Park in Sandton – was 202,209. The combined attendance at both venues on the most attended days reached 51,000 spectators

• In total 225,836 people attended the Johannesburg Public Viewing Site situated in New Town in the Johannesburg Central Business District

• Over 220,000 football fans visited one or more of the nine Ekasi TV sites in the City of Johannesburg

• Football For Hope held in Alexandra, Johannesburg, had 2,500 visitors a day

• The International Broadcasting Centre situated in the Soccer City Stadium precinct was visited by a total of 13,642 accredited media and 2,542 Host Broadcast Services staff from 65 different countries

The safety and security measures for the FIFA event in Johannesburg were planned and implemented in conjunction with three law enforcement agencies: the South African Police Service (SAPS), the Gauteng Traffic Police and the Johannesburg Metropolitan Police Department (JMPD).

JMPD, a Department2 of the City of Johannesburg (CoJ), was legislatively responsible for traffic policing, policing of municipal by-laws and regulations and the prevention of crime (Government of South Africa, 1998). In line with these functions for the 2010 event, the Department was tasked to “...provide assistance to the South African Police Service (SAPS) as well as traffic management (The Organising Committee’s Safety and Security Division and NATJOINTS, 2008)”.

GIS technology was already implemented successfully for crime-prevention projects including crime mapping and physical/social disorder audits by the Project Manager of the Joburg City Safety Programme3 (JCSP) within JMPD to develop crime mapping/crime analysis4 (CM/CA) reports, physical/social disorder audits5, and CCTV system6 incidents plotting in the Johannesburg inner city (Pisapia, 2012b). It became apparent that its benefits should be applied for the safety and security planning of the FIFA event. In particular, the technology’s benefits included:

• Increasing efficiency: as GIS was already widely used among external stakeholders to optimize decision-making processes, it assisted in reducing staff time and improving efficient planning

• Better decision making: GIS assisted in making better decisions about the spatial planning for the event (e.g. route/corridor selection, evacuation planning) – making correct decisions about location is critical to the success of the event

• Improving communication: GIS-based maps and visualizations greatly assisted in understanding road events, traffic and transportation plans and to share them among internal role-players and external agencies. GIS-generated maps were a type of visual language that improved communication between different teams, departments, disciplines, professional fields, organizations, and the public at large

• Better record keeping: GIS assisted to better manage and maintain authoritative records about the status and change of the spatial plans related to event. GIS provided a strong framework for managing these types of records with full transaction support and reporting tools

• Managing the event geographically: GIS assisted in a better planning and operational understanding throughout event’s theatre

GIS technology7 was thus used to capture all relevant event-related information into a spatial geodatabase which included: transportation hubs and routes; temporary facilities (e.g. park and rides, park and walks, rail stations, bus stations); security layers (e.g. traffic warning zone, traffic free zone, inner perimeter, stadium perimeter); road closures (e.g. traffic control points, vehicles permit checkpoints); permanent structures (e.g. stadiums), temporary overlays (e.g. fences, mag and bags screening areas) and police officers’ deployment for traffic management purposes.

JMPD was able to share this geographical information in the form of shape files, geodatabases and maps with the South African Police Service (SAPS), the South African National Defence Force (SANDF), as well as local/provincial/national departments. This allowed all operational plans to be aligned through the available updated and detailed spatial information.

The importance of having developed spatially focused operational plans for the event cannot be overemphasized. By physically defining, delineating and identifying, through GIS technology, all of the components of the Department’s operational plans (e.g. road closures, transportation routes, spectators’ flows, police deployment, temporary and permanent signs for vehicles and pedestrians), it was possible for JMPD to share the plan’s spatial information with both internal role players (e.g. officers, management) and external partners. This ensured common alignment and understanding in the implementation of safety and security measures for the event in various locations by different role-players.

Furthermore, spatial-related information assisted in the development of accurate documentation related to the event safety and security measures (e.g. road closures plans) and traffic management plan (e.g. clients’ routes) for the benefit of residents and business. GIS was thus utilized to communicate efficiently and effectively 2010-related information to the public.

In particular, in-depth analysis, utilizing GIS technology, was conducted on the Ellis Park Stadium (EPS) precinct, one of the FIFA event’s venues, to identify crime hot-spots and assess crime trends and patterns (Pisapia and Fonio, 2015a). This many-fold spatial dataset, built in the run up to the tournament, was aimed at defining crime-prevention projects for the reduction of both the actual incidence of crime and the negative perceptions of crime. These projects consisted principally in:

• Implementing tactical policing techniques (e.g. visible policing, patrol enhancements) focused on identified crime hot-spots through the use of problem-oriented/community policing practices

• Addressing environmental underlying causes of crimes such as the absence of street lights, non-compliant liquor outlets, bad buildings, illegal taxi ranks, and waste management

• Mainstreaming safety and security principles, such as Crime Prevention through Environment Design (CPTED) notions, into urban regeneration projects by the Johannesburg Development Agency (JDA) with the aim of informing the City’s urban planning projects at creating environments that diminished opportunities for criminal activities8

As reported by local, national and international media, the 2010 FIFA World Cup was a great success, in particular from a safety and security perspective: no serious incidents involving any client groups, including spectators or visitors, took place during the event. Some reporters even stated that this was the best world cup ever (Beth, Neil, 2010). This is in line with the outcome of an in-depth analysis by the JCSP, which utilized GIS technology for monitoring and evaluating crime levels before, during and after the event in the Ellis Park Stadium (EPS) precinct. The report indicated a drastic reduction of police recorded crime incidents in the area during the event (Pisapia, 2012a).

The evaluation of the implementation of the JMPD safety and security plan for the event detailed that the use of the GIS technology was one of the most tangible key aspects for the successful implementation of the operations for the event (Pisapia and Fonio, 2015b). Additional benefits include:

• The optimization of decision making within JMPD and the integration with external partners

• The recognition, among partners, of the importance of sharing spatial data for the benefit of conducting coordinated operations with multiple partners

• The collation of all spatial data into a single geospatial database, which realised significant cost savings in terms of information sharing/data accuracy

• The externalisation of a geospatial database, which allowed the benefits of a single source of truth to extend beyond JMPD

• The easy-to-use data visualisation, in particular mapping documents, enabled creative use of data throughout the project (e.g. leaflet for spectators and police officers)

To conclude, for the safety and security planning of the 2010 FWC in Johannesburg, GIS technology was used in a holistic manner to secure the event. It was implemented to draw the event’s security measures (e.g. road restrictions, police deployment), to compile crime mapping/crime analysis and disorder audits, and to plot recorded CCTV system incidents. These activities aimed at reducing both the actual incidences of crime and the negative perceptions of crime in the run up to and during the event in Johannesburg Inner City and the Ellis Park Stadium (EPS) precinct.

2.2 Case Study 2:
XX Commonwealth Games 2014 – Glasgow, Scotland

Initially, Glasgow 2014 Limited did not scope the establishment of a GIS solution. However, as work started to progress, it became apparent that the spatial element, for which GIS technology provides an integrated and workable solution, was at the centre of integrated planning for the Games, particularly beyond the venue boundary and into the wider theatre.

The absence of a proper GIS solution triggered different risks for the Organizing Committee: from planning inaccuracies due to inadequacies of spatial data resources and the lack of spatial data management at the planning stage (e.g. failure to assess the interaction of Games activities with the city) to Games-Time inaccuracies (e.g. errors in map products such as spectator guides). Some of the unwanted consequences from not having a GIS solution consisted in:

• Exposure to additional costs from reliance on partners/stakeholders delivering GIS products

• Exposure to unnecessary time delays for decision-making and planning purposes from reliance on partners/stakeholders delivering GIS products (e.g. partners not providing timeously maps related to the road events courses)

• Future requirements and future costs related to the drawing of maps for internal role-players and external stakeholders both for planning and operational purposes (e.g. security staff deployment plans)

• Risk of delay and cost due to planning errors (lack of configuration control of ad-hoc planning using open sources (e.g. Google Maps, MS PowerPoint)

• Risk of additional cost of developing a short-notice capability at a more advanced stage of event’s planning, rather than incremental development

Such risks were more acute for the safety and security planning of the road events, traffic management and transport system, which required strong integration between the security and transport operations both internally to the Organizing Committee and with external partners.

The first step in establishing GIS technology capability within the Glasgow 2014 Organizing Committee (OC) was the conveying of a transfer of knowledge (ToK) workshop held on the 28-29 November 2012, with staff from the Olympic Delivery Authority9 (ODA). For London 2012, GIS technology was employed for a range of mapping purposes, including printed and online guides, maps for client groups (e.g. spectators, athletes), and planning work including public consultation, roads orders, the Olympic Route Network (ORN) and multi-agency planning and data exchange (Chatterton, 2012).

It was thus decided to implement GIS technology for the planning of safety and security measures for the event’s road events, traffic management and transport systems with the aim of minimizing data latency risks and associated impacts with appropriate configuration control and management.

From a data architecture perspective, a common geodatabase and file repository10 with configuration control to allow data access exclusively to approved users was established within the OC. Internally, data was shared through GIS Arc Reader11, an ESRI free software viewing only licence, loaded onto staff’s personal computers based in the OC Headquarters. As a direct link for third parties of the common file repository could not be activated, a Glasgow 2014 Share File internet-based secure webpage was established to allow file sharing with third parties12, as GIS shapefiles tend not to be large. Thus, even though the interoperability with external stakeholders was limited, the sharing of basic spatial data in shape files/geodatabases was made possible.

One of the innovative tools utilized to share event spatial information with both internal and external partners consisted in the application of the ArcGIS Online (AGOL) system, which provided a convenient web-based application to visualize and share spatial data and conducting simple analyses13.

The staff consisted of a project leader for the Security Department and a GIS Manager for the Transport Functional Areas (FAs), both with a professional working knowledge of GIS. In addition, the Security Department recruited one GIS technician and one Frontrunner (volunteer), while the Transport FA recruited two GIS technicians. GIS users increased as Games-Time approached. In general, OC staff working in the Security/Transport area had to have basic mapping capability to carry out their roles (e.g. consult/analyse data through AGOL).

From a data perspective, the GIS system set up for the event drew together various types of data in a spatial framework: shapefiles14 (points, lines, polylines and polygons), tables (excel, database) and raster datasets (cell-based background maps and imagery).

From a data management perspective, a system to classify, store and share spatial data was created to ensure data integrity and alignment among all internal GIS users (Pisapia, 2013b).

From a governance perspective, the sharing of the event’s spatial information among internal role-players and external stakeholders15 was facilitated through the GIS 2010 User Group, chaired by the OC, which met regularly to oversee the advancement of the project and to enhance the cooperation between partners. A second group was instituted by Glasgow City Council (GCC) Land & Environmental Services (LES): the GCC Commonwealth Games GIS Project Group. Its mandate was to facilitate and manage the significant demands for spatially-referenced information for the Games by the Host City to ensure the availability of a streamlined, single version of data for the provision of spatial information for strategic, corporate and day-to-day planning for the event.

To conclude, a project management approach was utilized to ensure objectives, resources and available time were aligned and integrated within the broader organization’s commitments and project reviews were conducted accordingly.

The above set-up allowed the maintenance of a single spatial database as a shared resource and the creation of a “single source of truth”. The data register for the safety and security planning of the road events, traffic management and transport system, consisted in the following data sets:

• For the safety and security measures for each of the road events:

• Routes (in conjunction with GCC) and sectors

• Temporary overlay such as barriers, pedestrian, vehicles crossing points

• Security/safety/spectators service workforce locations on/adjacent to the field of play (FoP)

• Police Scotland officers locations on/adjacent to the FoP

• Broadcast and media positions

• Sport specific signage locations & workforce location

• Intermediate time points locations

• Location of Vehicle Permit Checkpoints (VPC)

• High spectators areas (HAS)

• Police Scotland route risk assessment segments and OC Security risk mitigation measures

• For the safety and security measures for the traffic management and transport system, spatial data was divided into:

• Spatial datasets from Games partners (e.g. GCC, contractors):

• Base maps and imagery for contextual mapping, from regional mapping to the kerb-line

• Transport infrastructure: roads, railways and rail stations

• Traffic management infrastructure: street furniture traffic signals, CCTV and speed enforcement cameras

• The Games Route Network (GRN) and associated temporary traffic regulation orders (TTROs)

• Key transport routes: bus routes and bus stops which could be potentially affected

• OC-generated spatial data16:

• List of addresses (residents and businesses) impacted by the event’s security measures (e.g. road closures)

• Anti-Terrorism Traffic Regulation Orders (ATTROs)

• Hostile Vehicles Mitigations (HVMs)

• Transport-led road restrictions (TTROs)

• Vehicle Permit Checkpoints (VPCs)

• Local Area Traffic Management Plans (LATMPs) for each venue and village

• Venues Last Mile routes and interaction with TTROs/LATMPs

• Ad-hoc planning tasks (e.g. context maps, distances to venues, walking distances from City centre)

• Event Day Controlled Parking Zone (EDCPZ) Areas

• Secure Residents Access Parking and Permit (RAPP) Scheme Areas

• Venues Grid Reference Systems (island sites and precincts)

Furthermore, the OC Security Department used GIS technology to support its security venue deployment plan, in conjunction with Police Scotland and Scottish Fire and Rescue, by digitizing positions of security, spectators’ service and safety personnel’s locations within and around the venue perimeters. The OC Security Department also created GIS data of the venues’ physical security system17 (e.g. CCTV system, secure perimeter, pedestrian screening areas, vehicle screening areas, exit gates). Such data, compiled with that related to road events, traffic management and transport system, provided a common operating picture related to safety and security measures for the protection of the event’s venues.

An important element in managing the safety and security spatial data was the adherence to the internal OC policies on information technology security and UK Government Protective Marking Scheme (GPMS) (Cabinet Office, 2014). Similarly to the London 2012 approach (Chatterton, 2012), security of information was kept proportionate to the data sensitivity as opposed to enforcing the high security level and associated technology constraints across all data. To ensure the spatial data was easily accessible to end-users, information was categorized per its level of confidentiality and required protection. OC-managed data consisted of information for public consumption or internal use only, which made up the majority of knowledge content. Instead, Police Scotland managed and organized confidential data, using secure systems to access it.

Parallel to the digitizing and continuous update of the spatial data, the successful implementation of the technology was achieved through a strong data management, administration and organization. Different tools were used for this purpose, such as: drafting policies, detailing a comprehensive data register, keeping metadata updated, tracking the project’s open issue and detailing the project’s outcomes against achievable timelines (e.g. Gantt charts, MS Project planning worksheets). This was essential in setting up the safety and security spatial-data integrated database, maintain its accuracy and avoid the risk of error or inaccuracy. The database provided the backbone for the developing of the Security Department operational plans for the road events, traffic and transport system for the event.

The benefits inherently connected with the use of the technology, which consisted principally in an enhanced sharing of geographical information in a timely and accurate manner based upon a “single source of truth” to allow collaborative work both within the Organization and with third parties, became apparent to both internal role-players and external stakeholders within the safety and security fraternity.

Thus, following a request to expand the GIS scope (Pisapia, 2013), the initial focus, which consisted exclusively in the safety and security planning of the road events, traffic management and transport system, evolved closer to Games-Time to encompass other functional area activities18.

The technology was thus used to support operational planning and the exchange of spatial information for a number of different purposes, such as: city operations, last mile, venue development and overlay drawings, venues and villages transport operation plans, Games Route Network (GRN) design, traffic management plan, traffic regulation orders (road closures), Queens Baton Relay journey and integration of 2014 Glasgow Festivals with Games operations. This provided the opportunity for maximising the use of GIS to add value and reduce data latency risks in the prelude to the Games.

2.3 Case Study 3:
1st European Games 2015 – Baku, Azerbaijan

The practical experience in implementing GIS technology for safety and security planning for the 1st European Games in Baku, Azerbaijan, benefitted from previously applying it to Johannesburg 2010, London 20112 and Glasogw 2014. Thus, some elements inherited from previous events and implemented for Baku 2015 will not be detailed again. Instead, this case study focuses mainly on the differences in its application.

The experience in Baku was different from the one in Glasgow and Johannesburg. In Baku, an external company provided the GIS services, whereas for Glasgow and Johannesburg the capability was built up in-house. Regardless, GIS was used for supporting the safety and security planning of road events, traffic management and transport system with similar outcomes, in terms of maps, shape files and geodatabases, as the previous events.

During the planning process, the Baku European Games Operation Committee (BEGOC) recognized the need of GIS technology to support the planning and operations of the largest sporting event ever held in Azerbaijan. It was also acknowledged that a GIS solution would have to satisfy multiple internal and external purposes (e.g. publications).

Due to time constraints, BEGOC decided to appoint an external company to provide GIS services through a public request for proposal (RFP). The ultimate aim was to ensure BEGOC had a managed central data repository for the Games’ spatial data, and the capability to use this data to produce analysis and map outputs for both internal and external purposes.

The Baku-based GIS company awarded the contract provided various services and resources to ensure the project was successfully implemented, such as project management, GIS analysts, data collectors, data provision, traffic and road network information, cartography design services, training and support services. Similar to Glasgow 2014, the company supplied both ESRI ArcGIS Desktop licences to GIS technicians working within the OC to digitize and create spatial data and ArcGIS Online (AGOL) to share information with both internal and external partners.

A peculiarity of the European Games, in terms of GIS implementation, was that the contracted company was tasked to identify, source and assist in the procurement of spatial data (base data) primarily related to the city of Baku and country of Azerbaijan, as it was not easily available through local/national government agencies19.

The safety and security requirements for the road events, traffic management and transport system were relatively straightforward, with some necessary adjustments to the idiosyncrasies of the Games’ operations compared to Glasgow and Johannesburg. Some of the spatial information that was created with GIS technology to support the safety and security planning consisted in the following:

• For venue centered-data: secure perimeter, pedestrian screening areas (PSA), vehicle screening areas (VSA), vehicle permit checkpoints (VPC), temporary overlay, permanent construction, transport load zones

• For transport system data: roads, Games Route Network (GRN), railway/metro stations and lines, accredited shuttle, bus stops, parking areas, competition/non-competition venues

• For road events data: routes, sectors, crowd barriers, pedestrian and vehicle crossing points, broadcast & media positions, athletes feeding points, street furniture road closures and advisory closures, traffic management (e.g. diversion routes, points of interest), high spectators areas (HSAs), police deployment (FoP and road closures), sport deployment (marshals). In addition, all points of interest in the proximity of the routes were digitized, for planning purposes, such as: embassies, post offices, hospitals, police/fire and rescue stations, hotels and government buildings

GIS-derived maps for the road events were created for both operational and stakeholders’ engagement purposes, highlighting road closures timeframes, diversion routes and vehicle permit checkpoints. An example is provided in the map below.

Figure 1: Baku 2015 Road Race GIS Map

The digitization of similar maps, which depicted the event’s spatial information, constituted the backbone of the operational plans and enabled the alignment of internal role-players and external stakeholders’ operations (e.g. Baku Major Office). In particular, these maps assisted in bridging language gaps during Games-Time, which existed between the OC, which had English as its official language, and the Government Security Authorities (GSA), which operated in Azerbaijani. As the saying goes, ‘a picture is worth a thousand words,’ the GIS generated maps provided a common working language.

3. Conclusion

As these three case studies have illustrated, GIS technology allows the integration of spatial information into a single, holistic picture, whereby a dynamic, common operating picture is created to enable everyone to see the same information and deploy resources accordingly (Kataoka, 2007).

From a data sharing and command, control and communications (C3) perspective, various software options are available, for example ArcGIS Online, which depends on internet access and file upload, and ArcGIS Server, which is more accessible for individuals within an organization. However, technology is rapidly evolving and new solutions will be made available in the future for more effective, user-friendly applications, which will take into consideration end-users requirements. Even though software packages have different benefits associated with them, the basic principles surrounding the implementation of the tool are similar.

The examples from Johannesburg, Glasgow, and Baku highlight how critical maps are for major sport events as they provide an invaluable context to decision-making. Major risks from not utilizing GIS technology for such large scale projects include, but are not limited to:

• Silo approach: disjointed plans with inaccurate spatial data between internal role-players and external stakeholders, in particular outside the venue boundaries. This could affect both planning stage (e.g. failure to assess the interaction of event activities with the city day to day movements) and event time (e.g. difficulty in coordinating emergency operations)

• Not-envisaged mapping costs: additional non/envisaged mapping-related tasks rise as the planning progresses. The costs to effectively carry them out by outsourcing them could be costly for the OC

• Copyrights breach: possible civil penalties and reputational damage arising from inadvertent license breach by OC staff using online maps for business purposes without authorization

• Un-scoped mapping tasks: as the event approaches, external stakeholders request OC to provide updated and detailed event maps outside the venue boundaries (e.g. event client groups’ movements), which are not available

• Internal and external unfulfilled expectations: general expectation, from both internal functional areas and partner agencies, that some of the maps will be produced by the OC through GIS technology closer to the event

While this article focused on the use of the GIS technology for safety and security purposes, an all-encompassed use of the technology for the entire event’s planning activities could lead to identifiable downstream cost and time savings, as well as reducing exposure to risks arising from errors in the planning process from data latency. In addition, expanding the usage of the software can strengthen the level of cooperation and collaboration between internal role-players and external partners.

Beyond the safety and security applications, possible uses of GIS include, but are not limited to: spectator journey planner, games-time information web-site, signage and way finding, maps for inside the venues/village, clients groups’ guides, public consultation maps, maps for media (e.g. newspapers), mapping for the OC staff, tablet maps and apps for mobile devices, advertising/trading/brand protection/temporary concession areas (e.g. street vendor zones), spectator routes to Games’ venues (e.g. last mile), cultural venues (e.g. nation houses), maps for training venues and test events, map production for OC operational plans and OC deployment plans.

An area which requires further attention and consideration is the post-games legacy use of GIS. There are tangible benefits, including newly developed or enhanced spatial databases, as well as intangible benefits, such as enhanced cooperation and networking between local and national government departments. It is therefore recommended that future use of GIS should parallel the holistic vision of the host city, and most opportunely, if possible, for crime-prevention (i.e. crime mapping, crime analysis) and disaster management. GIS for major sport events can establishment significant lasting legacies for the resident population if coordinated with the host city effectively from its inception.

Annex: List of Acronyms

Full Name

Acronym

Anti-Terrorism Traffic Regulation Orders

ATTROs

ArcGIS Online

AGOL

Baku European Games Operation Committee

BEGOC

City of Johannesburg

CoJ

Command, Control and Communications

C3

Crime Prevention through Environment Design

CPTED

Ellis Park Stadium

EPS

Environmental Systems Research Institute

ESRI

Event Day Controlled Parking Zone Areas

EDCPZ

Fédération Internationale de Football Association

FIFA

Field of Play

FoP

FIFA World Cup

FWC

Games Route Network

GRN

Glasgow City Council

GCC

Geographic Information System

GIS

Government Protective Marking Scheme

GPMS

High spectators areas

HAS

Hostile Vehicles Mitigations

HVMs

International Broadcaster Centre

IBC

Italian Team for Security, Terroristic Issues & Managing Emergencies

ITSTIME

Joburg City Safety Programme

JCSP

Johannesburg Development Agency

JDA

Johannesburg Metropolitan Police Department

JMPD

Land & Environmental Services

LES

Local Area Traffic Management Plans

LATMPs

Olympic Delivery Authority

ODA

Olympic Route Network

ORN

Ordnance Survey

OS

Organizing Committee

OC

Pedestrian Screening Areas

PSA

Secure Residents Access Parking and Permit

RAPP

South African National Defence Force

SANDF

South African Police Service

SAPS

Temporary Traffic Regulation Orders

TTROs

Transfer of Knowledge

ToK

United Kingdom

UK

Vehicle Permit Checkpoint

VPC

Vehicle Screening Areas

VSA

References Cited

Asmal, Z., ed (2012) Reflections & Opportunities: Design, Cities and the World Cup, Designing South Africa.

Bennett, C.J. and Haggerty, K.D. (2011) Security Games, Surveillance and Control at Mega-Events, Routledge, New York.

Beth, N. (2010) South Africa 2010: Why This Has Been the Best World Cup Ever, Daily Mirror, 12 July 2010, http://www.mirror.co.uk/news/top-stories/2010/07/12/why-this-hasbeen-the-best-world-cup-ever-115875-22406810/ [accessed 14 October 2015].

Boyle, P. and Haggerty, K.D. (2009) Spectacular Security: Mega Events and the Security Complex, International Political Sociology, Volume 3, Issue 3, p 257-274, September 2009.

Cabinet Office (2013) Government Security Classifications April 2014, https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/251480/Government-Security-Classifications-April-2014.pdf [accessed 19 October 2015].

Chatterton, M. et al. (2012) Transport Knowledge Management Legacy and Lessons, London 2012 Organizing Committee.

City of Johannesburg, Department of Finance and Economic Development, Joburg City Safety Strategy: Executive Summary, http://www.joburg-archive.co.za/2007/pdfs/citysafety/exec_sum.pdf [accessed 19 October 2015].

City of Johannesburg (2011) Delivering a Promise, Creating a Legacy City of Johannesburg: 2010 FIFA World Cup, Cut to Black.

City of Johannesburg Official Website (2015) http://www.joburg.org.za/index.php?option=com_content&Itemid=311&catid=94&id=702&lang=en&view=article&limitstart=1#departments#ixzz3oW8DJ6b9 [accessed 14 October 2015].

Field, K., (2012) Mapping the London 2012 Olympics, The Cartographic Journal, The British Cartographic Society, Vol. 49 No. 3, August 2013, p 281-296.

Fussey, P. et al. (2011) Securing and Sustaining the Olympic City: Reconfiguring London for 2012 and Beyond, Ashgate, Aldershot.

Fussey, P. et al. (2012) The Regeneration Games: Purity and Security in the Olympic City, British Journal of Sociology, 63, p 260-84.

Government of South Africa (1998) South African Police Service, Amendment Act 83 of 1998, http://www.gov.za/sites/www.gov.za/files/a83-98.pdf [accessed 14 October 2015].

Greene, R.W. (2004) Confronting Catastrophe: A GIS Handbook, Esri Press, 1 July 2004.

Kataoka, M. (2007) GIS for Homeland Security (Case Studies in GIS), Esri Press, 1 December 2007.

Klauser, F. (2008) Spatial Articulations of Surveillance at the FIFA World Cup 2006 TM in Germany, in Franko, Aas K., Oppen, Gundhus H. and Lomell, Mork H. eds, Technologies of Insecurity Routledge, London, p 61-80.

The Organising Committee’s Safety and Security Division and NATJOINTS (2008) in consultation with all host cities and provinces, 2010 FIFA World Cup General Security Concept, The Organising Association Agreement – OAA, 23.4.1: 2010 FIFA World Cup™, 30 June 2008.

Pisapia, G. (2012a) An Evaluation on the Impact of the 2010 FIFA World Cup on Crime Levels in the Johannesburg Inner City, Joburg City Safety Programme (JCSP), Johannesburg Metropolitan Police Department (JMPD), internal use only, unpublished document.

Pisapia, G. (2012b) Evaluation of the CoJ Surveillance Technology’s Impact on Safety and Security in the Johannesburg Inner City, Joburg City Safety Programme (JCSP), Johannesburg Metropolitan Police Department (JMPD), internal use only, unpublished document.

Pisapia, G. (2013a) Geographic Information Systems (GIS) Technology Briefing Note, 26 March 2013, internal use only, unpublished document.

Pisapia, G. (2013b) Arc GIS Data Management, Classification and Handling, Glasgow 2014 Limited Policy, 17 December 2013.

Pisapia, G. and Fonio, C. (2011) Gran Torino: Social and Security Implications of the XX Winter Olympic Games, in Bennett, C.J. and Haggerty, K.D. eds Security Games: Surveillance and Control at Mega-Events, Routledge, London, p 137-49.

Pisapia, G. and Fonio, C. (2015a) Security, Surveillance and Geographical Patterns at the 2010 FIFA World Cup in Johannesburg, The Geographical Journal, Royal Geographical Society, Vol. 181 No. 3, September 2015, p 242-248.

Pisapia, G. and Fonio, C. (2015b) Analisi delle principali attività realizzate dalla Polizia Metropolitana di Johannesburg (JMPD) durante i Mondiali di Calcio FIFA 2010, Sicurezza, Terrorismo e Società (Security, Terrorism and Society), Fascicolo 1, 2015, http://www.sicurezzaterrorismosocieta.it [accessed 13 October 2015].

Radke, S.L. and Hanebuth, E. (2008) GIS Tutorial for Homeland Security, Esri Press, 1 August 2008.

1 Università Cattolica del Sacro Cuore – Milano

Largo Gemelli 1, 20123, Milan, Italy.

ITSTIME – Department of Sociology

E-mail address: giovannipisapia@gmail.com

2 The JMPD’s mandate is derived from the South African Police Service Amendment Act 83 of 1998. The Department’s functions include traffic policing, policing of municipal by-laws and regulations and the prevention of crime. The department is responsible for co-ordination and development of a crime prevention strategy for the city, development of delivery mechanisms and systems for crime prevention and by-law enforcement, and guidance, operation and maintenance of an efficient and effective metropolitan police service. It has seven regional offices, precincts in each region, and sectors in those precincts. It has about 2,300 operational staff members, both uniformed and civilian, drawn from the traffic departments, crime prevention and by-law enforcement agencies of the former local councils within the Johannesburg area, who carry out patrol duties. The department plans to expand this number to 4,000 over the next three years (City of Johannesburg Official Website, 2014).

3 The Joburg City Safety Programme (JCSP) is an integrated, multi-disciplinary programme that aims to improve public safety and contribute to the reduction of crime by focusing on the management of the urban environment together with improved law enforcement and policing (City of Johannesburg).

4 GIS technology was used to draft crime mapping and crime analysis to understand crime trends and patterns in the Johannesburg Inner City.

5 The audit consisted in the geo-coding (providing X Y coordinates) of a range of physical, social, and land-use related disorder issues through GIS technology. The results of the audits were then linked with the crime mapping and crime analysis of the same precinct to determine possible correlations.

6 The Johannesburg CCTV System, following an upgrade before the FIFA event, consisted in 237 dome cameras, which allowed coverage of the Johannesburg Inner City, including the Ellis Park Stadium precinct.

7 The technology for safety and security purposes was implemented by the Joburg City Safety Programme (JCSP).

8 Improvements included, among others, the creation of a pedestrian friendly and walkable urban environment through the establishment of a network of public spaces, and improved circulation around and access to formal taxi, bus and rail facilities.

9 The Olympic Delivery Authority (ODA) was a public body responsible for developing and building new venues and infrastructure, including transport-related, for the Games. This included designing safety and security measures in accordance with statutory requirements.

10 System memory requirements were limited (approximately, the total number of files supporting a single shape file totals 100KB), as most of the base data mapping (e.g. Ordnance Survey data sets) was retrieved remotely through Arc GIS On Line (AGOL). This was to avoid base datasets being stored internally.

11 Arc Reader is a free, easy-to-use desktop mapping application that allows users to view, explore, and print maps and globes. Anyone with Arc Reader can view high-quality interactive maps authored by a high-level ArcGIS for Desktop product and published with the ArcGIS Publisher extension.

12 Access to the share file website was regulated through a non-disclosure agreement (NDA) signed by the OC and the external stakeholders to ensure internal use only data were not leaked to the public.

13 The initial cost for ArcGIS Online (AGOL) was approximately £ 1,900 for 5 licenses, rising incrementally to £7,500 for 50 licenses. As the planning advanced, the Organizing Committee made available licenses for internal and a limited number of external personnel. However, AGOL was not used as a standalone system without access to desktop ArcGIS.

14 Shapefile format have the following constituent files: .dbf, .prj, .sbn, .xml and .shx.

15 The internal role-players were: the Security Department and Transport FAs – which initiated the primary task of jointly planning for the safety and security measures of road events, traffic management and transportation system, OC Accreditation, OC Accommodation, OC City Operations – particularly the last mile, OC Sport – road events planning, in particular focused on safety, security and traffic management, Venue Design and Overlay – exchange of CAD layer files in dwg/dxf format, Venue Management and Venue Operations.

The external stakeholders consisted in: Glasgow City Council with which the OC exchanged a wide range of spatial data, including addresses to determine the residents/business impacted by the Games’ security measures (e.g. road closures), base mapping and imagery at a variety of scales, shapefiles for civic and public buildings (e.g. schools), Scottish Fire and Rescue, Police Scotland, Strathclyde Partnership for Transport (SPT), Ordnance Survey (OS), Angus Council, City of Edinburgh Council, Dundee City Council, North Lanarkshire Council, South Lanarkshire Council, Scottish Government, Ministry of Defence (MoD), AECOM (contractor for the Games Family Demand Model) and Halcrow/CH2M HILL (contractor for the Games Route Network).

16 The OC Transport FA used GIS technology to support all the Games’ transport/traffic management planning deliveries, from Games’ venue to fleet/busses operations. Closer to Games-Time, the OC Transport FA employed a full-time GIS Manager and two GIS technicians.

17 Such data was compiled through the use of FME software, which translated information from CAD drawings.

18 The most ardent supporter for the increase in scope for the GIS project was the Scottish Government, which, through representatives taking part in the GIS 2014 User Group meetings, proposed to assist the OC to broaden the implementation of GIS technology.

19 For the XX Commonwealth Games, the OC benefitted, through the Glasgow City Council (GCC), of the One Scotland Mapping Agreement (OSMA) on a sub contractual basis, thus obtaining base data (e.g. road centerline, aerial pictures) free of charge. However, license agreements may have changed.

Executive Summary

The evolution of the ISIS’ language: a quantitative analysis of the language of the first year of Dabiq magazine – Matteo Vergani, Ana-Maria Bliuc

In questo articolo indaghiamo l’evoluzione dell’ISIS attraverso l’analisi del testo contenuto nella rivista ufficiale del gruppo in lingua inglese, Dabiq. Più specificamente utilizziamo il software di analisi del testo LIWC (nella sua più recente versione del 2015) per indagare l’evoluzione del linguaggio dell’ISIS nel corso dei primi 11 numeri della rivista Dabiq. La nostra analisi mostra interessanti risultati: in primo luogo, il senso di affiliazione sembra essere l’aspetto psicologico più importante per l’ISIS nel corso del tempo. Questo mostra come l’ISIS sia in difficoltà in particolare nel distinguersi da altri gruppi jihadisti con una ideologia molto simile e operanti nello stesso territorio, come al-Qaeda e il fronte al-Nusra. In secondo luogo, l’ISIS negli ultimi numeri ha utilizzato un linguaggio sempre più emotivo, e come sappiamo le emozioni svolgono un ruolo importante nello spiegare perché le persone si mobilitano per una causa. Questo suggerisce che l’ISIS sta cercando di attrarre nuove reclute utilizzando un linguaggio volto a mobilitare emotivamente i lettori, a differenza del periodo precedente in cui il gruppo ha cercato di utilizzare un linguaggio più istituzionalizzato probabilmente volto più a legittimarsi come fonte di autorità religiosa e politica. In terzo luogo, il linguaggio dell’ISIS mostra una crescente attenzione al genere femminile: questo non stupisce poiché l’ISIS è il gruppo jihadista che nella storia ha attratto il maggior numero di reclute di genere femminile. Questo dimostra come il progetto dell’ISIS sia non solo creare un esercito ma anche e soprattutto creare e consolidare uno stato in cui i cittadini possano vivere una vita “normale”, avere una famiglia e creare una nuova società. Questo carattere utopistico è un’altra importante caratteristica che rende l’ISIS diverso da altri gruppi jihadisti. Infine, Infine le nostre analisi rivelano che l’ISIS è molto abile nell’adattarsi a nuove forme di linguaggio: ciò è dimostrato dal crescente uso di gergo proprio dell’ambiente online (“Net Speak”). Questa capacità mostra come l’ISIS sia particolarmente abile nell’aprire un dialogo con individui di giovane età, come dimostrato dai complotti terroristici in cui erano coinvolti adolescenti occidentali di addirittura 14 anni. Riteniamo che le analisi del linguaggio di ISIS che presentiamo in questo articolo sia particolarmente interessante poiché svela aspetti psicologici del gruppo che sono spesso trascurati da analisi condotte con altri metodi.

Suicide Attacks: Strategy, from the Afghan War to Syraq
and Mediterranean region. A triple way to read
the asymmetric threats – Claudio Bertolotti, Andrea Beccaro

Suicide-attacks are one of the most important aspects of modern conflicts. They have played and continue to play a key role in wars like those in Afghanistan and in Iraq where suicide attack had a big impact during the Iraq war, and they represent a key tactics of Islamic State warfare. The aim of this article is the analysis of the problem of suicide-attacks viewed from two different angle. On the one hand the study of the phenomenon inside the debate of the transformation of war and hence highlighting how the new strategic environment (transformation of war debate; RMA; urbanization of conflicts) helps the evolution and effectiveness of the suicide-attacks. On the other hand the focus on the Afghan theatre of war and, thanks to a new database, the analysis of the data with a triple way reading (strategic level; operational level; tactical level) of the suicide-attacks will help to understand the suicide-attack phenomenon in the battlefield.

Gli attacchi suicidi sono uno degli aspetti più importanti dei conflitti moderni. Essi hanno svolto e continuano a svolgere un ruolo chiave in guerre come quelle in Afghanistan e in Iraq, dove gli attacchi suicidi hanno avuto un grande impatto durante il conflitto con gli Stati Uniti e rappresentano una tattica chiave della guerra dello Stato islamico. Lo scopo di questo articolo è analizzare il problema degli attacchi suicidi visto da due diverse angolazioni. Da un lato lo studio del fenomeno all’interno della discussione della trasformazione della guerra e, quindi, evidenziando come il nuovo contesto strategico (trasformazione della guerra; RMA; urbanizzazione di conflitti) aiuti l’evoluzione e l’efficacia degli stessi attacchi suicidi. D’altra parte l’attenzione al teatro di guerra afgano e, grazie a un nuovo database, l’analisi dei dati con una nuova e originale tripla lettura (livello strategico, piano operativo, livello tattico) degli attacchi suicidi che aiuterà a capire il fenomeno sul campo di battaglia.

Intelligence economica: una proposta per l’Italia –
Laris Gaiser

In the wake of political upheavals at the end of the 20th century, national communities began living in an international setting that was considerably different from the traditional world order following the Second World War. The period marked by global bipolar competition was one of geopolitical stability and clear military alliances with countries having rather limited margins activity and economic freedom. Today, we are facing a situation of a new type of anarchy and the stability of the old political alliances has been undermined. The fluidity of international relations has forced countries to tackle global competition in such a way as to achieve the best possible outcome in terms of profits, development and wealth.

The role of the state, which had been for years under criticism, was to be minimized. Due to the pressure of liberal thinking, this objective had gained considerable importance. States, once again, had become active economic players, whose role it was to act as catalysts and push through reform strategies that would enable countries to maintain their competitiveness. Because of the geo-economic war, governments are required to become guarantors of social stability. This role needs to be based on a strategic vision which fosters economic growth and development through economic intelligence. This category in the field of economic geopolitics is new only in the nominal sense. Economic intelligence dictates that there be cooperation between the public and private sectors. The need for which may have been felt in the past, but implementation was only on a comparably minor scale.

Economic intelligence structures are a mere means of effective cooperation between the public and private sectors at a specific time in history, in which the two sectors would be seriously endangered if they failed to act together. Thus, the world of business maintains its vigour and vitality and the state is bestowed a mission that legitimises it. In order to survive inside a very challenging environment the State has to rethink itself. It becomes a “strategic state” with the final goal of fostering its competitiveness creating a stable economic intelligence system.

Economic intelligence could be defined as a discipline studying information needed by companies and states to make the right development decisions with the aim of fine-tuning their cognitive and decision-making capacities in the complex context of global competition

Economic intelligence consists of gathering and processing information relevant to the economic sector with the aim of making operational choices. It consists of activities aimed at obtaining information, surveillance of competitors, protection of strategic information and capitalising on this knowledge in order to influence, determine and control the global economic environment. It is a power tool to be used by countries, in which the private and the public sphere are intertwined and communicating.

The Republic of Venice is taken as clear example of above mentioned capabilities. It serves as a mirror to better understand the ongoing transformations and to propose a solution for Italy where the Parliament in 2007 reformed the old Secret Service Act of 1977 paving the way for future development of economic intelligence. According to the current Constitution economic intelligence in Italy should enjoy full legitimation. The proposal consist of a reform that could take in account the already existing state system upgrading the constitutional and governmental bodies’ with new functions in order to shape an efficient private-public intelligence cooperation.

Sulla scia degli sconvolgimenti geopolitici della fine del XX secolo, le comunità nazionali hanno incominciato a vivere in un contesto internazionale notevolmente diverso da quello scaturito in seguito alla Seconda Guerra Mondiale. Il periodo segnato dal bipolarismo era caratterizzato dalla stabilità geopolitica e da chiare alleanze militari all’interno delle quali i vari paesi avevano margini piuttosto limitati di autonomia e di libertà economica. Oggi siamo costretti a confrontarci con un nuovo tipo di anarchia globale in cui la stabilità delle vecchie alleanze politiche è minata e la fluidità delle relazioni internazionali costringe i paesi ad affrontare la concorrenza globale in modo da ottenere il miglior risultato possibile in termini di profitti, di sviluppo e di ricchezza.

Il ruolo dello stato ridotto quasi al minimo negli ultimi decenni sotto le pesanti critiche di gran parte del pensiero liberale si ripropone al centro della scena internazionale in seguito ai grandi cambiamenti geopolitici dei quali siamo testimoni. Esso ridiviene un soggetto economico attivo con il compito di catalizzare le esigenze del settore produttivo nazionale. Lo stato è costretto a riformare se stesso in modo da mantenere la propria competitività e a causa della guerra geoeconomica, i governi sono tenuti a diventare garanti della stabilità sociale. Questo ruolo deve essere basato su una visione strategica che favorisce la crescita e lo sviluppo attraverso l’intelligence economica. Essa è una branchia della geopolitica economica, nuova solamente dal punto di vista nominale, che impone la cooperazione tra il settore pubblico e quello privato. L’intelligence economica, seppur in forme diverse, già esisteva in passato ma trova oggi le condizioni necessarie per il suo sviluppo completo.

Le strutture d’intelligence economica sono un metodo efficacie di collaborazione tra settore pubblico e privato in un momento storico nel quale sarebbero entrambi seriamente minacciati qualora non agissero all’unisono. In tal modo il settore economico si garantisce lo sviluppo e lo stato ritrova una missione che lo legittima nuovamente. Lo stato ripensa se stesso all’interno di un mondo in continua evoluzione. Esso diventa uno “stato strategico” avente come obiettivo finale quello di favorire la competitività del proprio sistema economico attraverso la creazione di una stabile intelligence economica che può definirsi come la disciplina che, studiando il ciclo dell’informazione necessario alle imprese e agli stati per effettuare scelte corrette di sviluppo, si prefigge di affinare le abilità cognitive e decisionali applicate alle complessità del contesto competitivo globale.

L’intelligence economica consiste nella raccolta e nell’elaborazione di tutte quelle informazioni che possono essere rilevanti per il settore economico e sulla base delle quali si possono effettuare delle scelte operative ponderate. Si compone di attività dirette a ottenere informazioni, sorvegliare i concorrenti, proteggere le informazioni strategiche e capitalizzare le conoscenze al fine di influenzare, determinare e controllare l’ambiente economico globale. Si tratta di uno strumento di potere a disposizione dei paesi in cui la sfera pubblica e quella privata comunicano e si coordinano. La Repubblica di Venezia, dove l’interesse di stato era strettamente legato all’interesse commerciale, è presa come chiaro esempio di tali capacità e serve come cartina di tornasole per meglio comprendere le trasformazioni in atto in Italia dove il Parlamento ha nel 2007 finalmente cambiato la vecchia legge sui servizi segreti aprendo la strada al possibile, futuro, sviluppo della disciplina dell’intelligence economica nazionale. Secondo l’interpretazione proposta essa è conforme alla Costituzione della Repubblica e pertanto pienamente legittima. Se l’Italia desidera rimanere competitiva sul mercato globale, dove continuare la trasformazione intrapresa prendendo in considerazione il sistema costituzionale e di governo già esistente e affidandogli nuove funzioni che possano plasmare un’efficiente cooperazione tra i vari attori del settore economico garantendo un costante flusso informativo.

Islamic extremism from the Balkans emerges in Italy – Giovanni Giacalone

Between 2014 and 2015 several counter-terror operations were conducted between Italy, Albania and Bosnia-Herzegovina; operations which led to the expulsion or arrest of jihadist recruiters, indoctrinators and potential volunteers.

Operations such as “Damascus”, “Balkan Connection” and “Martese” exposed the presence of jihadist cells in Tuscany, Lombardy and the North-East of Italy, all areas of interest for Islamists from the Balkans, with several Islamic centers involved in organizing visits of radical preachers.

Over all, operation “Martese” attracted the attention of the Italian media as it became the first case of a whole Italian family which became radicalized and was ready to depart and seek a new life in the so-called “Islamic State”. A radicalization that was facilitated by an Albanian network linked to Genci Balla and Bujar Hysa, two Albanian preachers currently in jail in Tirana while on trial for jihadist propaganda and recruitment.

In this short article I will explore some of the Italian-Balkanic contacts and links that were activated by the jihadists in order to provide Isis with volunteers, focusing in particular on the Albanian networks.

Tra il 2014 e il 2015 diverse operazioni anti-terrorismo sono scattate tra Italia, Albania e Bosnia-Erzegovina; operazioni che hanno portato all’espulsione o all’arresto di reclutatori, propagandisti e potenziali volontari per la jihad.

Operazioni come “Damasco”, “Balkan Connection” e “Martese” hanno messo in evidenza la presenza di cellule jihadiste in Toscana, Lombardia e nel nord-est d’Italia, tutte zone di interesse per gli islamisti dei Balcani e con diversi centri islamici coinvolti nell’organizzazione di visite da parte di imam radicali.

L’operazione “Martese” ha particolarmente attirato l’attenzione dei media italiani in quanto ha visto coinvolto il primo nucleo familiare radicalizzatosi e pronto a partire per cercare una nuova vita nel cosiddetto “Stato Islamico”. Una radicalizzazione facilitata da una rete albanese legata a Genci Balla e Bujar Hysa, due predicatori estremisti attualmente in carcere a Tirana e sotto processo con l’accusa di propaganda e reclutamento per la jihad.

In questo breve articolo esplorerò alcuni contatti e collegamenti italo-balcanici attivati dai jihadisti per trovare volontari per l’Isis, focalizzandomi in particolare sulle reti albanesi.

SOCial Media INTelligence: un nuovo spazio per la raccolta di informazioni rilevanti – Alessandro Burato

L’utilizzo dei social media come strumento per monitorare gli aspetti più disparati è stato impiegato sin dalla loro comparsa sul panorama mondiale. Quando questa indagine migra dalla molteplicità di temi dei quali si può occupare per dirigersi verso un utilizzo puntuale in materia di sicurezza prende il nome di SOCMINT ossia SOCial Media INTelligence. Ambito di indagine sicuramente non nuovissimo ma di recente teorizzazione, la SOCMINT cerca ancora uno spazio all’interno del dibattito accademico per la sua collocazione nel più ampio spettro delle declinazioni dei processi di intelligence. Tuttavia, dal punto di vista operativo, l’utilizzo del monitoraggio a fini preventivi e investigativi del materiale o delle comunicazioni scambiate sui social network ha già portato a notevoli risultati nella lotta al terrorismo.

L’attenzione dell’opinione pubblica alla funzione di divulgazione della cultura del terrore tramite questi mezzi di comunicazione è scoppiata con la diffusione della propaganda del sedicente Stato Islamico. Un uso massivo delle piattaforme social contraddistingue sempre più la modalità pervasiva della pubblicazione virale di materiale propagandistico e didattico pubblicato da IS, attraverso il quale si cercano di reclutare nuovi mujaheddin che possano ingrossare le fila del combattenti per il Jihad. Come per l’utilizzo dei social in casi di emergenze naturali, i fruitori di questi mezzi diventano allo stesso tempo produttori di informazioni, in questo caso inneggiando alla “guerra santa” o contribuendo a far diventare virale la propaganda prodotta da IS.

“Un avido utilizzatore di Social Media”, “Davvero attivo sui Social Media”. Potrebbe sembrare la descrizione davvero di chiunque, non solo di un teenager ma anche di uomini e donne non nativi digitali che affollano costantemente i social. E invece è quanto è stato riportato da tutte le testate come tratto distintivo di Seifeddine Rezgui, nome de guerre Abu Yahya al-Qayrawani, 24 anni e un diploma di una scuola tecnica e futuro ingegnere, che durante il Black Friday (26 giugno 2015) ha ucciso a sangue freddo 38 persone sulla spiaggia di un resort a Susa, Tunisia. A qualche giorno dall’evento si è subito fatto riferimento ad un profilo Facebook riconducibile all’attentatore dove, mischiati tra post inneggianti il Real Madrid o i rapper più in voga, ce ne sarebbero stati diversi che inneggiano le bandiere nere del sedicente Stato Islamico: “Mio Dio sollevami da questo mondo ingiusto, fai che queste genti soffrano e muoiano, perché solo quando moriranno si ricorderanno di te”, “Se l’amore per il jihad è un crimine, tutti possono testimoniare che io sono un criminale”, e ancora “gli eroi sono nelle loro tombe, le persone reali in prigione e i traditori nel palazzo”.

Sebbene, come per le stragi di Charlie Hebdo e del supermercato kosher, il responsabile della strage fosse in qualche modo noto alle forze dell’ordine, nessuna azione preventiva è stata messa in campo per evitare che un ragazzo, segnalato alle autorità anche se forse non per fatti strettamente legati al terrorismo, venisse fermato prima di colpire.

In questo articolo verrà invece analizzato, alla luce della letteratura disponibile sull’utilizzo della SOCMINT, il caso dell’arresto dei due individui, il tunisino Lassaad Briki e il pakistano Muhammad Waqas, responsabili della diffusione delle immagini di minaccia a luoghi sensibili di Milano/Roma, noto all’opinione pubblica come il caso dei “pizzini” dell’ISIS, che intendevano compiere un attentato in territorio italiano dopo essersi addestrati nei campi siriani.

The use of Social Media as an instrument useful to monitor the variety of the aspects of people’s lives is acknowledged since their first appearance. But when this activity moves from the multiplicity of the issues it can take into account to focus on a more punctual use in terms of security it is known with the term SOCMINT, that is Social Media Intelligence. As it is not a new domain but it has just been theorized, SOCMINT is still looking for a space within the academic debate on its position and role in the wide spectrum of intelligence processes. However, from an operative point of view, the preventive and investigative monitoring of the material and all the communications exchanged on the social network has already brought to relevant successes to fight terrorism.

The interest of the public opinion for the role of social media as a medium of terror has began with the spread of the so-called Islamic State propaganda. The pervasive publication of propagandistic and didactic materials is always more marked by the massive use of social platforms, through which terrorists are looking for new mujahidin to hire so that they can enlarge the number of people fighting for the Jihad. As for the use of social media in case of natural disasters, users are at the same time information producers by exalting the “holy war” or contributing to share IS propaganda. “An avid social media user”, “really active on social media”. This could really be the description of anyone, not only of a teenager but also of men and women not digital-born that use social media. Rather, it is the what have been reported by all journals as a distinctive trait of Seifeddine Rezgui, nome de guerre Abu Yahya al-Qayarawani, 24 years old, a degree from a technical school and a future engineer, that during the Black Friday (26th of June, 2015) killed 38 people on the beach of a resort in Susa, Tunisia. In the aftermath the press immediately referred of a Facebook profile, ascribable to the killer, on which, among comments supporting Real Madrid team or the most popular rappers, there were others supporting IS black flag: “May God take me out of this unjust world and perish its people and make them suffer. They just remember you when you die”, “If the love of jihad is a crime, everyone can testify that I am a criminal”, and more “The heroes are in their graves, real men in prisons, and traitors in the palace.”

Although the killer was somehow known to the police, as happened for the Charlie Hebdo and the kosher supermarket massacres, no preventive actions were taken.

This article focuses on the arrest of two suspects, the Tunisian Lassaad Briki and the Pakistani Muhammad Waqas, responsible for the diffusion of picture of threating messages to sensitive places in Milan and Rome, known to the public opinion of the “pizzini” case, who intended to plan for an attack in Italy after being trained in Syria.

How cyberspace is used by terrorist organization:
possible threats to critical infrastructures?
The most recent activities of cyber counterterrorism
– Mauro Pastorello

Il dominio del cyberspace è sempre stato considerato come il futuro per le azioni di attacco e spionaggio militari, ma per molti anni un suo potenziale utilizzo in modo significativo, sia per scopi offensivi che difensivi, era visto come un miraggio tecnologico, la cui reale utilizzazione non si sarebbe mai avuta. Possiamo dire con certezza che mai come negli ultimi anni, questo miraggio si è trasformato in realtà, con tutti i suoi lati positivi e negativi.

L’ analisi proposta nel mio articolo si focalizzerà sullo studio del cyberspace e del suo utilizzo come strumento e veicolo per lanciare degli attacchi con le nuove cyber weapons, ovvero tutte quelle “armi” che possono non causare vittime, in termini di perdita di vite umane, ma che possono distruggere e mettere in ginocchio l’economia di un intero Paese o di una società, prese mi mira da hacker o cracker che possono agire da soli, per conto di associazioni o gruppi, o addirittura per altri Paesi e lanciare quindi dei veri e propri attacchi cibernetici con il loro avallo, nel silenzio della società civile.

A livello metodologico, il cyberspace e i relativi domini, saranno analizzati secondo la teoria di Clark, mettendo in luce come la convergenza fisico-logica delle infrastrutture ha ormai reso obsolete le classificazioni che si limitavano a indicare se un’infrastruttura fosse fisica strictu sensu o logica e come questa convergenza rende ancora più importante e necessario un approfondimento sul tema, dato che molti dei nostri dati personali o altre informazioni si trovano in rete, esposte alle vulnerabilità e minacce di questa nuova dimensione e quindi fortemente a rischio; successivamente verranno forniti alcuni esempi pratici di recenti attacchi cyber e delle loro possibili conseguenze. In ultimo, sarà analizzata la minaccia terroristica nel cyberspace, il cosiddetto cyberterrorism, che Barry Collin definisce come: “the convergence of physical and virtual worlds where cyber weapons produce physical consequences”.

L’attacco Stuxnet, lanciato contro una centrale nucleare in Iran, e quello recentissimo lanciato contro la società italiana Hacking Team, produttrice di software per intercettazione dati, hanno fatto rivalutare il problema e portano ad elaborare nuove considerazioni, come ad esempio l’aumento massiccio dell’automazione e del controllo di apparati industriali completamente gestiti da remoto attraverso il cyberspace. A questa situazione si aggiunge anche il cambiamento di vita sociale che ha segnato gli ultimi anni, con l’esigenza sempre più forte di ciascuno di noi ad essere connesso nel cyberspace 24 ore su 24, per l’utilizzo di social network, la visualizzazione di mail da smartphone, l’attivazione da remoto del teleriscaldamento in casa e tantissimi altri servizi gestibili in “rete”.

Tutto ciò ha fatto sì che diversi Paesi hanno focalizzato la loro attenzione sul cyber world, analizzando nel dettaglio il tipo di utilizzo che ne fanno le strutture Governative, aziendali ed economiche dei rispettivi sistemi Paese, migliorando la legislazione in ambito di cyber security e nella protezione delle infrastrutture critiche, possibili obiettivi delle “cyber weapons”.

Per quanto riguarda il nostro Paese, l’Italia, la sicurezza delle infrastrutture critiche e, più in generale, la sicurezza cibernetica, sono gestite dalle Agenzie di intelligence (AISI, Agenzia Informazioni e Sicurezza Interna, e AISE, Agenzia Informazioni e Sicurezza Esterna) coordinate dal DIS (Dipartimento Informazioni e Sicurezza), insieme al CNAIPIC (Centro Nazionale Anticrimine Informatico per la Protezione delle Infrastrutture Critiche) formato dalla Polizia Postale e delle Comunicazioni e dal UACI (Unità Anti Crimine Informatico).

L’obbiettivo finale di questo articolo è di evidenziare che vi sono delle precise strategie di attacco e difesa nel mondo cyber, basti pensare alla recente formazione della Cyber Brigate nell’Esercito di sua Maestà in Gran Bretagna, che ha il compito di gestire attacchi e difesa cibernetica, o ad un’altra divisione da poco venutasi a creare, la Hacking Division dello Stato Islamico, e che per far fronte a questo nuovo “dominio” militare è assolutamente necessaria una rilettura e rivalutazione delle strategie si difesa dei vari Paesi e condividere quanto più informazioni possibili, cosi da migliorare la risposta ad un eventuale attacco che, per la natura stessa del “terreno” sfruttato (il cyberspace) potrebbe avere delle ripercussioni non solo nel Paese oggetto dell’attacco, ma anche il tutti gli altri Paesi o sistemi, a causa delle interdipendenze del mondo cyber.

A Case Study Analysis of the Implementation of GIS Technology for Safety and Security Planning during Major Sport Events – Giovanni Pisapia

Over the past decade there has been a substantial international body of research focused on various aspects of security planning during major sport events (inter alia Klauser 2008, Boyle and Haggerty 2009, Bennet and Haggerty 2011, Fussey et al. 2011, Pisapia and Fonio 2011, Fussey et al. 2012). More specifically, there has been research focused on utilizing Geographical Information System (GIS) technology for safety, security and emergency management purposes (inter alia Greene 2004, Kataoka 2007, Radke and Hanebuth 2008).

This article describes the overall benefits of implementing Geographic Information System (GIS) technology for drafting, managing, and monitoring successful safety and security operational plans for major sport events. GIS has been utilized for planning various major sport events with encouraging results (Field, 2012). How GIS technology has been applied thus far in this sector is illustrated through this article with detailed, first-hand knowledge of the best practices and key lessons learned from three major sport events: 2010 FIFA World Cup in Johannesburg, South Africa – XX Commonwealth Games 2014 in Glasgow, Scotland – 1st European Games 2015 in Baku, Azerbaijan. The 2012 Olympic Games in London, England, is discussed as well.

As these three case studies illustrate, GIS technology allows the integration of spatial information into a single, holistic picture, whereby a dynamic, common operating picture is created to enable everyone to see the same information and deploy resources accordingly (Kataoka, 2007).

The examples from Johannesburg, Glasgow, and Baku highlight how critical maps are for major sport events as they provide an invaluable context to decision-making. Major risks from not utilizing GIS technology for such large-scale projects include, but are not limited to:

• Silo approach: disjointed plans with inaccurate spatial data between internal role-players and external stakeholders, in particular outside the venue boundaries. This could affect both planning stage (e.g. failure to assess the interaction of event activities with the city day to day movements) and event time (e.g. difficulty in coordinating emergency operations)

• Not-envisaged mapping costs: additional non/envisaged mapping-related tasks rise as the planning progresses. The costs to effectively carry them out by outsourcing them could be costly for the OC

• Copyrights breach: possible civil penalties and reputational damage arising from inadvertent license breach by OC staff using online maps for business purposes without authorization

• Un-scoped mapping tasks: as the event approaches, external stakeholders request OC to provide updated and detailed event maps outside the venue boundaries (e.g. event client groups’ movements), which are not available

• Internal and external unfulfilled expectations: general expectation, from both internal functional areas and partner agencies, that some of the maps will be produced by the OC through GIS technology closer to the event

While this article focuses on the use of the GIS technology for safety and security purposes, an all-encompassed use of the technology for the entire event’s planning activities could lead to identifiable downstream cost and time savings, as well as reducing exposure to risks arising from errors in the planning process from data latency. In addition, expanding the usage of the software can strengthen the level of cooperation and collaboration between internal role-players and external partners.

An area, which requires further attention and consideration, is the post-games legacy use of GIS. There are tangible benefits, including newly developed or enhanced spatial databases, as well as intangible benefits, such as enhanced cooperation and networking between local and national government departments. It is therefore recommended that future use of GIS should parallel the holistic vision of the host city, and most opportunely, if possible, for crime-prevention (i.e. crime mapping, crime analysis) and disaster management. GIS for major sport events can establishment significant lasting legacies for the resident population if coordinated with the host city effectively from its inception.

Negli ultimi dieci anni, è stato pubblicato un numero consistente di articoli sui vari aspetti della pianificazione della sicurezza in occasione di eventi sportivi di rilievo (tra l’altro Klauser 2008, Boyle e Haggerty 2009, Bennet e Haggerty 2011, Fussey et al. 2011, Pisapia e Fonio 2011, Fussey et al. 2012). Inoltre, la ricerca si è anche focalizzata sull’utilizzo del Geographical Information System (GIS) per la pianificazione di operazioni di sicurezza e di gestione delle emergenze (tra l’altro Greene 2004, Kataoka 2007, Radke e Hanebuth 2008).

Questo articolo descrive i benefici dell’utilizzo della tecnologia Geographic Information System (GIS) per la sviluppo, gestione e monitoraggio dei piani operativi di sicurezza per eventi sportivi di rilievo. GIS è già stato utilizzato per la pianificazione di vari grandi eventi con risultati incoraggianti, come ad esempio i Giochi Olimpici di Londra 2012 (Field, 2012). L’utilizzo del GIS in questo settore è illustrato, nell’articolo, attraverso una dettagliata descrizione dei principali insegnamenti e prassi tratti dall’utilizzo della tecnologia durante tre grandi eventi sportivi: Coppa del Mondo FIFA 2010 a Johannesburg, Sud Africa – XX Giochi del Commonwealth 2014 a Glasgow, Scozia – 1 ° Giochi Europei 2015 a Baku, Azerbaijan.

Come questi tre casi dimostrano, la tecnologia GIS consente di integrare informazioni geo-referenziali in un’unica piattaforma, dalla quale si ricava un quadro operativo comune per permettere la condivisione di informazioni e supportare il processo decisionale tra i diversi enti preposti all’organizzazione di grandi eventi (Kataoka, 2007).

Gli esempi provenienti da Johannesburg, Glasgow e Baku evidenziano come la produzione di mappe accurate siano un elemento critico per la pianificazione della sicurezza per eventi sportivi di rilievo, in quanto forniscono il quadro per un effettivo processo decisionale da parte degli enti coinvolti. L’articolo, inoltre, descrive i principali rischi derivanti dal non-utilizzo della tecnologia, tra cui:

• Piani operativi scollegati, con dati geo-referenziali imprecisi, tra i vari operatori, in particolare al di fuori dei confini dei siti

• Costi per la produzione di mappe non previsti durante la pianificazione iniziale, che potrebbe risultare in un aumento delle spese previste del Comitato Organizzatore a ridosso dell’evento

• Possibili violazione di copyright ed eventuali sanzioni civili e danni reputazionali derivanti dall’improprio utilizzo di mappe disponibili online, da parte del personale del Comitato Organizzatore, per scopi commerciali

• Aspettative disattese relative all’utilizzo di mappe per l’evento da parte di operatori locali, nazionali ed internazionali (ad esempio Comitati Olimpici Nazionali)

Questi rischi possono influenzare negativamente durante sia la fase di progettazione (ad esempio la mancata interazione ed influenza reciproca tra le varie attività operative) che di messa in atto dei piani di sicurezza (ad esempio, la difficoltà di coordinare le operazioni di emergenza tra le varie istituzioni) per l’evento.

Mentre questo articolo si concentra sull’uso del GIS per la pianificazione di sicurezza, un uso della tecnologia più ampio per l’intera pianificazione di grandi eventi conduce a rilevanti benefici grazie all’utilizzo di accurati ed esclusivi dati geo-referenziali da parte di diversi enti. L’utilizzo del software rafforza in questo modo la cooperazione e collaborazione tra la varie parti interessate.

Una area che richiederebbe ulteriore attenzione e considerazione è il lascito post-evento della tecnologia. L’esperienza insegna che esistono molteplici benefici relativi all’uso del GIS per la pianificazione della sicurezza di grandi eventi; ad esempio la creazione di banche dati geografiche o la maggiore cooperazione tra vari enti locali e nazionali predisposti all’organizzazione dell’evento. L’uso del GIS potrebbe essere utilizzato anche per altri progetti relativi alla sicurezza e prevenzione del crimine all’interno della città ospitante, quali la mappatura ed analisi della criminalità e la gestione delle emergenze, per conferire una visione d’insieme per una pianficazione effettiva ed efficace della sicurezza prima, durante e dopo l’evento.

Table of contents

Research articles

Matteo Vergani, Ana-Maria Bliuc

The evolution of the ISIS’ language: a quantitative analysis of the language of the first year of Dabiq magazine

Claudio Bertolotti, Andrea Beccaro

Suicide Attacks: Strategy, from the Afghan War to Syraq and Mediterranean region. A triple way to read the asymmetric threats

Analyses and commentaries

Laris Gaiser

Intelligence economica: una proposta per l’Italia

Giovanni Giacalone

Islamic extremism from the Balkans emerges in Italy

Focus: Web Intelligence

Marco Lombardi, Alessandro Burato, Marco Maiolino

Dalla SOCMINT alla Digital HumInt. Ricomprendere l’uso dei Social nel ciclo di intelligence

Alessandro Burato

SOCial Media INTelligence: un nuovo spazio per la raccolta di informazioni rilevanti

Mauro Pastorello

How cyberspace is used by terrorist organization: possible threats to critical infrastructures? The most recent activities of cyber counterterrorism

Focus: Grandi Eventi

Giovanni Pisapia

A Case Study Analysis of the Implementation of GIS Technology for Safety and Security Planning during Major Sport Events

Executive Summary