Home News Testimony Changes the FBI is Making to the Counterintelligence Program
This is archived material from the Federal Bureau of Investigation (FBI) website. It may contain outdated information and links may no longer function.
  • David Szady
  • Assistant Director, Counterintelligence Division, FBI
  • Federal Bureau of Investigation
  • Before the United States Senate, Committee on the Judiciary
  • Washington, DC
  • April 09, 2002

Good morning, Chairman Horn, Members of the Subcommittee, and distinguished Members of the California Delegation. I value the opportunity to appear before you and discuss terrorism preparedness, including threats posed by attacks involving biological, chemical or nuclear agents, as well as measures being taken by the FBI and our law enforcement partners to address these threats.


The mission of the FBI's Counterterrorism Program is to detect, deter, prevent, and swiftly respond to terrorist actions that threaten the U.S. national interests at home or abroad, and to coordinate those efforts with local, state, federal, and foreign entities as appropriate. The counterterrorism responsibilities of the FBI include the investigation of domestic and international terrorism. As events during the past several years demonstrate, both domestic and international terrorist organizations represent threats within the borders of the US

The FBI defines domestic terrorism as the unlawful use, or threatened use, of violence by a group or individual based and operating entirely within the US or its territories, without foreign direction, committed against persons or property, to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.

International terrorism involves violent acts dangerous to human life that are a violation of the criminal laws of the US or any state, or that would be a criminal violation if committed within the jurisdiction of the US or any state. Acts of international terrorism are intended to intimidate or coerce a civilian population, influence the policy of a government, or affect the conduct of a government. These acts transcend national boundaries in terms of the means by which they are accomplished, the persons they are intended to intimidate, or the locale in which perpetrators operate.

The FBI has developed a strong response to the threats posed by domestic and international terrorism. Between fiscal years 1993 and 2003, the number of Special Agents dedicated to the FBI's Counterterrorism Program grew by approximately 224 percent (to 1,669 Agents-nearly 16 percent of all FBI Special Agents). The FBI has strengthened its Counterterrorism Program to enhance its abilities to carry out its objectives.

The San Francisco Division of the FBI

The San Francisco Division of the FBI encompasses the entire jurisdiction of the United States District Court, Northern District of California, consisting of 15 counties located along the North and Central Coast of California. Approximately 7.5 million people live in this region, the majority residing in the six counties located in the San Francisco Bay Area. The Bay Area has a large impact on the economy of the United States and the Pacific Rim. Multiple industries, oil refineries, biotechnology companies, financial services, and Internet providers are located throughout the region. The Port of Oakland ranks the fourth largest in the United States and twentieth in the world in terms of annual container traffic. Three international airports located in San Francisco, Oakland, and San Jose support the booming tourism industry in Northern California. The Lawrence Livermore National Laboratory, located in the East Bay, is a premier scientific center and a key element of our national security infrastructure.

The headquarters office for the Division is located in San Francisco with satellite offices, or Resident Agencies (RAs), located in the cities of Eureka, Santa Rosa, San Rafael, Oakland, Hayward, San Jose, Palo Alto, and Watsonville. The Division personnel resource staffing level for Special Agents is 307 with 37 management staff positions. The authorized support complement for the division consists of 256 employees.

Since September 11, 2001, the San Francisco Division has made personnel changes to address the emerging international terrorism threat. Approximately 30 Agents have been reassigned to the Counterterrorism Program. This doubles the number of Agents conducting terrorism related investigations. The reassigned agents are predominately from organized crime and drug squads that have extensive experience in identifying, disrupting, and dismantling criminal networks. The reorganization resulted in terrorism squads being located in the major metropolitan areas of San Francisco, Oakland, and San Jose. The geographical placement of these squads enhances the Counterterrorism Program's abilities to address the terrorism threat throughout the region.

The San Francisco Division is the sixth largest FBI division with regard to the number of personnel. As such, it has considerable resources available, especially in the matter of responding to a terrorist attack. The San Francisco Evidence Response Team (ERT), consisting of approximately 30 Special Agents, is a highly skilled team that specializes in the recovery of evidence from crime scenes. ERT Agents have training in post-blast scenarios and work closely with the Division's Special Agent Bomb Technicians to deal with a bombing crime scene. Sixteen of San Francisco's ERT Agents have traveled or will travel to New York to work at the World Trade Center scene. The Division also has a Hazardous Materials Response Team (HMRT) consisting of eight Special Agents. These Agents have undergone 160 hours of training to obtain Technician-level certification. The HMRT is tasked with the collection of evidence at a scene where weapons of mass destruction (i.e. chemical, biological, radiological, and nuclear weapons) have been employed. The San Francisco Division HMRT gained invaluable experience when it was deployed to the East Coast in response to the release of anthrax in September and October of 2001. With regard to tactical deployments, the San Francisco Division is one of nine field offices with an enhanced Special Weapons and Tactics (SWAT) Team. The team's 46 operators are trained and equipped to fold into the FBI's elite Hostage Rescue Team, if necessary, for domestic or international deployments. As a result of specialized training, the SWAT Team is able to operate in a variety of environments including those with chemical, biological, and radiological contamination.

Joint Terrorism Task Forces (JTTFs)

Cooperation among law enforcement agencies at all levels represents an important component of a comprehensive response to terrorism. This cooperation assumes its most tangible operational form in the joint terrorism task forces (JTTFs) that are established in 44 cities across the nation. These task forces are particularly well-suited to responding to terrorism because they combine the national and international investigative resources of the FBI with the street-level expertise of local law enforcement agencies. This Agent-to-Officer cooperation has proven highly successful in preventing several potential terrorist attacks.

Given the success of the JTTF concept, the FBI has established 15 new JTTFs since the end of 1999. Contingent upon the FBI's 2003 budget request for funds to expand the JTTF program, the FBI plans to have established JTTFs in each of its 56 field divisions by the end of 2003. By integrating the investigative abilities of the FBI and local law enforcement agencies these task forces represent an effective response to the threats posed to US communities by domestic and international terrorists.

The San Francisco Division formed its JTTF in 1997. Currently, it is comprised of 25 federal, state, and local agencies. The federal agencies participating in the JTTF include: the Bureau of Alcohol, Tobacco, and Firearms, the Drug Enforcement Administration, the Federal Aviation Administration, the Federal Bureau of Investigation, the Federal Protective Service, the Immigration and Naturalization Service, the Internal Revenue Service, the United States Coast Guard, the United States Department of State, the United States Department of Treasury, the United States Marshal's Service, the US Customs Service, the United States Office of Export Enforcement, the United States Postal Service, and the United States Secret Service.

The local agencies include the Alameda County Sheriff's Department, California Department of Justice, the California Highway Patrol, the Contra Costa County Sheriff's Department, the Oakland Police Department, the San Jose Police Department, the San Francisco Police Department, the San Mateo County Sheriff's Department, the Santa Clara County District Attorney's Office, and the Santa Clara County Sheriff's Department.

Enhancing the intelligence capabilities of the JTTF is a priority of the FBI. To aid this task, the California Anti-Terrorism Information Center (CATIC) has been integrated into the JTTF. CATIC, administered by the State of California Department of Justice, is tasked with providing law enforcement agencies in the state with timely and valuable intelligence support for the purpose of combating terrorism. CATIC analysts will work side-by-side with FBI analysts in order to share information on domestic and international terrorist threats. This partnership will form the backbone of the San Francisco FBI Terrorist Intelligence Center. This Center will generate a first-rate terrorist intelligence product that can be disseminated rapidly and effectively to appropriate local, state, and federal agencies.

In order to improve local information sharing, the San Francisco Division has taken the initiative to develop and maintain a JTTF website. This code-word protected website is an effective tool to disseminate law enforcement sensitive material in a rapid fashion to JTTF member agencies and local law enforcement agencies. Immediate threat advisories, case updates, and relevant articles are available for review on the site. With the integration of CATIC into the JTTF, the quantity and quality of material will increase. This website will likely serve as a model for other JTTFs throughout the United States.

The FBI is presently working with the US Department of Justice to ensure that the JTTFs are coordinated with the newly created Anti-Terrorism Task Forces located in the offices of US Attorneys throughout the country. This coordination is crucial to avoid duplication of effort and enhance the exchange of information and overall counterterrrorism objectives.

National Infrastructure Protection Center and InfraGard

Because of its relevance to the topic of this hearing, specifically the threat to nuclear and chemical facilities, I would like to briefly discuss the National Infrastructure Protection Center (NIPC), which was created in 1998. The NIPC is an interagency center housed at FBI headquarters that serves as the focal point for the government's effort to warn of and respond to cyber intrusions, both domestic and international. NIPC programs have been established in each of the FBI's 56 field divisions, including the San Francisco Division. Through a 24-hour watch center and other initiatives, the NIPC has developed processes to ensure that it receives information in real-time or near-real-time from relevant sources, including the US intelligence community, FBI criminal investigations, other federal agencies, the private sector, emerging intrusion detection systems, and open sources. This information is quickly evaluated to determine if a broad-scale cyber attack is imminent or underway.

On January 16, 2002, the FBI disseminated an advisory via the National Law Enforcement Telecommunications System (NLETS) regarding possible attempts by terrorists to use US municipal and state web sites to obtain information on local energy infrastructures, water reservoirs, dams, highly enriched uranium storage sites, and nuclear and gas facilities. Although the FBI possesses no specific threat information regarding these apparent intrusions, these types of activities on the part of terrorists pose serious challenges to our national security.

The NIPC also has a role in preventing terrorist acts. The focus of NIPC's "Key Asset Initiative" includes physical asset identification and protection, in addition to the prevention and detection of computer intrusions. Assets include the major electrical, communications, water facilities, transportation hubs, energy plants and other infrastructure which are instrumental in supporting societal activities and which, if attacked, would represent a major loss or disruption to California and the United States. Computer intrusions not only may be used to gain illegal entry into government or military agencies, but also have a significant impact on the business community and the US economy. Computer terrorists may also conduct clandestine communications via computers located in educational institutions or elsewhere without the knowledge of the computer system's sponsor.

With computer technology in mind, coupled with the desire to prevent computer attacks and intrusions, the San Francisco Division participates in the InfraGard Program. This program incorporates business, governmental, and military communities into a system similar to a Neighborhood Watch. Together with the FBI, the group conducts meetings to discuss awareness of computer issues and operates a self-warning system.

Threat Warning Systems

Because warning is critical to the prevention of terrorist acts, the FBI has also expanded the Terrorist National Threat Warning System (NTWS) first implemented in 1989. The system now reaches all aspects of the law enforcement and intelligence communities. Currently, sixty federal agencies and their subcomponents receive information via secure teletype through this system. The messages are also transmitted to all 56 FBI field offices and 44 legal attaches. If threat information requires nationwide unclassified dissemination to all federal, state, and local law enforcement agencies, the FBI transmits messages via the National Law Enforcement Telecommunications System (NLETS). In addition, the FBI disseminates threat information to security managers of thousands of US commercial interests through the Awareness of National Security Issues and Response (ANSIR) program. If warranted, the expanded NTWS also enables the FBI to communicate threat information directly to the American people. Since the terrorist attack of September 11, 2001, the FBI has disseminated 37 warnings via the NTWS. The FBI also has issued more than 40 "be on the lookout" (BOLO) alerts via the NLETS system. BOLO alerts provide the names of individuals who are of investigative interest to the FBI.

Bioterrorism and Weapons of Mass Destruction

The FBI Counterterrorism Division's Weapons of Mass Destruction Countermeasures Unit (WMDCU) plans and conducts Weapons of Mass Destruction (WMD) training exercises which address the specific needs and objectives of state and local emergency responders. State and local emergency management officials may request this assistance through their respective FBI WMD Coordinators who forward the request to WMDCU. Every FBI Field Division, including the San Francisco Division, has a WMD Coordinator. WMDCU fully integrates state and local planning officials into the exercise planning process to ensure their requirements are specifically met. WMDCU also co-chairs the Interagency Board (IAB) for Equipment Standardization and Interoperability. Comprised of over 48 separate local, state and federal organizations, the IAB is responsible for the creation of the Standardized Equipment List and is recognized as the leading authority in the area of WMD response equipment.

The bioterrorism threat has risen to a new level. The federal government, in partnership with state and local law enforcement agencies, has always taken threats concerning the intentional release of biological agents seriously. However, until recently, neither the federal government nor state and local responders have been required to utilize their assets to coordinate a response to an actual release of anthrax. The intentional introduction of anthrax into our infrastructure has resulted in significant alarm concerning our health and safety. I would like to comment on the manner in which the law enforcement community responds to a suspected act of terrorism involving biological agents, and reinforce the cooperative effort that is in place between the federal government and the myriad of first responders who provide guidance, assistance and expertise.

The response to a potential bioterrorist threat can be broken down into two different scenarios: overt and covert releases. The distinction between the two involves the manner in which the biological threat agent is introduced into the community and the nature of the response. Regardless of whether a biological release is overt or covert, the primary mission of law enforcement and the public health community is saving lives.

An overt scenario involves the announced release of an agent, often with some type of articulated threat. An example of this would be the receipt of a letter containing a powder and a note indicating that the recipient has been exposed to anthrax. This type of situation would prompt an immediate law enforcement response, to include local police, fire and emergency medical service (EMS) personnel. As noted earlier, each FBI field office is staffed with a WMD Coordinator whose responsibilities include liaison with first responders in the community. Due to this established relationship with first responders, the local FBI WMD Coordinator would be notified and dispatched to the scene.

Depending on the magnitude of the threat, the response protocol would involve securing the crime scene and initiating the FBI's interagency threat assessment process. The FBI's WMD Operations Unit of the Counterterrorism Division at FBI Headquarters, coordinates this threat assessment, which is designed to determine the credibility of the threat received, the immediate concerns involving health and safety of the responding personnel, and the requisite level of response warranted by the federal government. The FBI obtains detailed information from the on-scene personnel and input from the necessary federal agencies with responsibility in the particular incident. In a biological event, the Department of Health and Human Services (DHHS), including Centers for Disease Control and Prevention (CDC), and the Food and Drug Administration (FDA), as well as the United States Department of Agriculture (USDA), are the key agencies called upon to assist FBI personnel in assessing the particular threat. Based upon the assessment, a determination is made as to the level of response necessary to adequately address the particular threat, which could range from a full federal response if the threat is deemed credible, to collection of the material in an effort to rule out the presence of any biological material if the threat is deemed not credible. In the event of a chemical, nuclear or radiological threat, a similar threat assessment would occur. All procedures are designed to support and enhance local first responders' capabilities and safety.

The FBI Headquarters Counterterrorism Division interaction with the field and the WMD Coordinators, along with other internal and external agencies, has improved the threat assessment process and allowed federal, state, and local agencies to provide a measured response, greatly enhancing efficiency. In many cases, the situation is handled with minimal publicity, therefore limiting the impact of the terrorist objective. The process has been effective in saving the federal government, and the state and local communities, time and money, and has allayed the fears of victims in rapid fashion on numerous occasions.

The method of collecting suspect material is established by protocols set forth by the FBI's Hazardous Material Response Unit (HMRU), assigned to the FBI Laboratory. These protocols, recognized and followed by state and local Hazmat teams, are necessary to ensure that sufficient evidentiary samples are collected, screened and packaged according to scientific safety guidelines for transportation to the appropriate testing facility. Over 85 State Health Laboratories perform this analysis on behalf of HHS/CDC and belong to a coordinated collection of facilities known as the Laboratory Response Network (LRN). (Four of these Laboratories are within the San Francisco Division of the FBI. They are: the California Department of Health Services, located in Berkeley; the Santa Clara County Public Health Laboratory; the Humboldt County Public Health Laboratory; and Lawrence Livermore National Laboratory.) Once the testing has been completed, results are provided to the FBI for dissemination in the appropriate manner. The results of the analysis are then disseminated to the exposed person or persons, local first responders and to the local public health department. Additionally, results will be forwarded to the CDC in Atlanta, GA.

A covert release of a biological agent invokes a different type of response, driven by the public health community. By its nature, a covert introduction is not accompanied by any articulated or known threat. The presence of the disease is discovered through the presentation of unusual signs and/or symptoms in individuals reporting to local hospitals or physician clinics. In this situation, there is initially no crime scene for law enforcement personnel to investigate. The criminal act may not be revealed until days have elapsed, following the agent identification and preliminary results obtained from the epidemiological inquiry conducted by the public health sector. Contrary to an overt act where law enforcement makes the necessary notification to public health, in a covert release, notification to law enforcement is made by the public health sector. The early notification of law enforcement in this process encourages the sharing of information between criminal and epidemiological investigators. Once an indication of a criminal act utilizing a biological agent is suspected, the FBI assumes primary authority in conducting the criminal investigation, while public health agencies maintain responsibility for the health and welfare of the citizens. At the local level, involving the FBI WMD Coordinator and the state or local public health department, and at the national level between FBI Headquarters and the CDC, an effective coordination has been established to address the requisite roles and responsibilities system of each agency.

The response to an actual threat or one that is later determined not to be credible, or a hoax, is indistinguishable. This includes deployment of a Hazmat team, thorough examination of the potentially contaminated area (including situations where a telephonic reporting is received) and the disruption of the normal operations of the affected entity. Additionally, the individuals potentially exposed to the WMD may experience extreme anxiety/fear due to the reported release. Potential victims may have to be decontaminated or transported to a medical facility. The first responders must treat each incident as a real event until scientific analysis proves that the material is not a biological agent. To both the responding entities and the potentially exposed victims, the presence of powder threatening the presence of a biological agent is not a hoax, or something to be taken lightly. The individuals perpetrating such an activity must be held accountable for their actions.

WMD Coordinators are in constant communication with members of the law enforcement, fire, emergency management, and medical communities. That partnership was clearly evident in the cooperation during the time period after September 11, 2001, when persons bent on further disrupting our society initiated numerous anthrax hoaxes in California. In addition to those hoaxes, well-meaning citizens reported hundreds of suspicious packages and other items. Since October 2001 the FBI nationwide has responded to over 16,000 reports of use or threatened use of anthrax or other hazardous materials. The anthrax cases in Florida, New York and New Jersey also required significant supporting investigative attention by San Francisco Division resources.

The WMD program for the San Francisco Division is extremely successful. Since 1997, a collaborative effort between the FBI and the California Office of Emergency Services resulted in the formation of the Bay Area Terrorism Working Group (BATWG). BATWG is a forum of local, state, and federal crisis and consequence management agencies that address WMD contingency planning and training. Quarterly meetings are held at various locales around the Bay Area in order to encourage participation in BATWG. The FBI maintains the BATWG website which immediately and effectively disseminates WMD information to law enforcement, fire services, and public health personnel. WMD Coordinators in the San Francisco Division regularly attend meetings and participate in exercises hosted by local, state, and other federal agencies.

The FBI Laboratory Division is also a key component in dealing with incidents involving the release of biological, chemical or nuclear agents. The FBI Laboratory has developed a response capability to support counterterrorism investigations worldwide. The FBI's mobile crime laboratory provides the capability to collect and analyze a range of physical evidence on-scene, and has been deployed at major crime scenes, including the World Trade Center bombing, Khobar towers, and the East African embassy bombings. The mobile crime laboratory contains analytical instrumentation for rapid screening and triage of explosives and other trace evidence recovered at crime scenes.

The FBI Laboratory also provides the capacity to rapidly respond to criminal acts involving the use of chemical or biological agents with the mobile, self-contained fly-away laboratory (FAL). The FAL consists of twelve suites of analytical instrumentation supported by an array of equipment which allows for safe collection of hazardous materials, sample preparation, storage, and analysis in a field setting. The major objectives of the mobile crime laboratory and the FAL are to enhance the safety of deployed personnel, generate investigative leads through rapid analysis and screening, and to preserve evidence for further examination at the FBI laboratory. In addition, the laboratory has developed agreements with several other federal agencies for rapid and effective analysis of chemical, biological, and radiological materials. One partnership, the Laboratory Response Network (LRN), is supported by the CDC and the Association of Public Health Laboratories for the Analysis of Biological Agents.


Terrorism represents a continuing threat to the US and a formidable challenge to the FBI. In response to this threat, the San Francisco Division of the FBI has developed a broad-based Counterterrorism Program that is integrated into the local and state law enforcement and first responder network. The goal of the San Francisco Division is to disrupt terrorist activities using the capabilities of its JTTF prior to an incident. While this approach has yielded many successes, the dynamic nature of the terrorist threat demands that our capabilities continually be refined and adapted to continue to provide the most effective response.

Within the San Francisco Division, all of the FBI's aforementioned investigative responsibilities are conducted jointly with other law enforcement agencies and often with the appropriate fire, emergency response, and medical agencies. It is impossible for the FBI to conduct investigations and obtain intelligence without the assistance of all the region's federal, state, and local agencies. Communication and coordination is exceptional in all areas and the San Francisco Division consistently strives to maintain and improve that cooperation.

Chairman Horn, this concludes my prepared remarks. I would like to express appreciation for this subcommittee's concentration on the issue of terrorism preparedness and I look forward to responding to any questions.

Recent Testimonies
Deciphering the Debate Over Encryption Amy Hess, Executive Assistant Director, Science and Technology Branch, Federal Bureau of Investigation, Statement Before the House Committee on Energy and Commerce, Subcommittee on Oversight and Investigation, Washington, D.C.
The Need for a Consolidated FBI Headquarters Building Richard L. Haley, II, Assistant Director, Facilities and Finance Division, Federal Bureau of Investigation, Statement Before the House Committee on Transportation and Infrastructure, Subcommittee on Economic Development, Public Buildings, and Emergency Management, Washington, D.C.
Encryption Tightrope: Balancing Americans’ Security and Privacy James B. Comey, Director, Federal Bureau of Investigation, Statement Before the House Judiciary Committee, Washington, D.C.
FBI Budget Request for Fiscal Year 2017 James B. Comey, Director, Federal Bureau of Investigation, Statement Before the House Appropriations Committee, Subcommittee on Commerce, Justice, Science, and Related Agencies, Washington, D.C.
Law Enforcement Implications of Illegal Online Gambling Joseph S. Campbell, Assistant Director, Criminal Investigative Division, Federal Bureau of Investigation, Statement Before the House Committee on Oversight and Government Reform, Washington, D.C.
Oversight of the Federal Bureau of Investigation James B. Comey, Director, Federal Bureau of Investigation, Statement Before the Senate Judiciary Committee, Washington, D.C.
Oversight of the Federal Bureau of Investigation James B. Comey, Director, Federal Bureau of Investigation, Statement Before the House Judiciary Committee, Washington, D.C.
Worldwide Threats and Homeland Security Challenges James B. Comey, Director, Federal Bureau of Investigation, Statement Before the House Committee on Homeland Security, Washington, D.C.
Threats to the Homeland James B. Comey, Director, Federal Bureau of Investigation, Statement Before the Senate Committee on Homeland Security and Governmental Affairs, Washington, D.C.
Inspector General Access Kevin L. Perkins, Associate Deputy Director, Federal Bureau of Investigation, Joint Statement with Department of Justice Associate Deputy Attorney General Carlos Uriarte Before the Senate Judiciary Committee, Washington, D.C.