INFORMATION GATHERING RISK ASSESSMENT AND RISK ANALYSIS METHODOLOGIES

INFORMATION GATHERING, RISK ASSESSMENT AND RISK ANALYSIS METHODOLOGIES (IN BORDER MANAGEMENT) INGE LINDSAAR THEME 2 MARCH 6, 2015 BG Lt. Col. Inge Lindsaar Estonian Police and Border Guard Board

I. GENERAL INTRODUCTION TO RISK ANALYSIS AND THREAT ASSESSMENT IN BORDER MANAGEMENT

EU IBM 1: BORDER CONTROL 5: DEVELOPMENT OF BORDER RELATED POLICY AND LEGISLATION BORDER CHECKS BORDER SURVEILLANCE 4: INTER-AGENCY COOPERATION RISK ANALYSIS INLAND ACTIVITIES AT BORDER COOPERATION ACROSS BORDER ACTIVITIES IN 3 rd COUNTRIES 3: “FOUR-TIER ACCESS CONTROL MODEL” 2: DETECTION AND INVESTIGATION OF SERIOUS INTERNATIONAL (cross-border) CRIME

RISK ANALYSIS • …IS DEFINED AS THE SYSTEMATIC EXAMINATION OF THREATS, VULNERABILITYIES AND IMPACTS, THE OUTCOME OF WHICH IS RECORDED IN THE FORM OF A RISK ASSESSMENT. • CIRAM- EU BEST PACTICES IN BORDER MANAGEMENT 4

RISK ANALYSIS IN BORDER MANAGEMENT RISK ANALYSIS SHOULD ENSURE INTERNAL SECURITY AND THE SECURITY OF BORDERS …IS THE KEY TOOL TO: • ENSURE OPTIMAL ALLOCATION OF RESOURCES FOR BORDER CHECKS AND SURVEILLANCE; • ENSURE EFFICIENT, UNIFORM LEVEL OF CONTROL ALONG THE BORDERS; • ENSURE AGREED STANDARDS FOR INFORMATION GATHERING IN BORDER MANAGEMENT.

RISK ANALYSIS FOR PREVENTION AND DETECTION OF -ILLEGAL MIGRATION -CROSS-BORDER ORGANISED CRIME, INCL SMUGGLING OF WEAPONS, EXPLOSIVES -TRAFFICKING IN HUMAN BEINGS -TERRORISTS MOVEMENTS -OTHER CROSS-BORDER CRIMINALITY

DEFINITIONS: INTELLIGENCE IN BORDER MANAGEMENT SYSTEM, INTELLIGENCE IS : ANY INFORMATION, RECEIVED OR GENERATED THAT IS RELATED TO ONE OF THE COMPONENT OF THE RISK, i. e. RELATED TO THREAT, VULNERABILITY OR IMPACT.

8

INTELLIGENCE PROCESS • COLLECTION- MUST BE PLANNED AND FOCUSED, NEEDS TO BE DIRECTED AT A TARGET (PERSON, GROUP) OR TOPIC. PLANNING TAKES INTO ACCOUNT THE INFORMATION THAT IS ALREADY AVAILABLE AND EXAMINES THE NEED FOR ADDITIONAL COLLECTION TO FILL GAPS IN THE INFORMATION.

EVALUATION-ASSESSING THE TRUTHFULNESS AND RELIABILITY OF SOURCE AND INFORMATION

INTELLIGENCE PROCESS • COLLATION- SIFTING OUT OF SPURIOUS, NONRELEVANT, AND INCORRECT INFORMATION. ORDERLY ARRANGEMENT OF THE REMAINING INFORMATION; • USE OF COMPUTERISED SYSTEMS

INTELLIGENCE PROCESS • ANALYSIS AND INTERPRETATION-WITHOUT ANALYSIS, A PIECE OF INFORMATION REMAINS A PIECE OF INFORMATION! • INTERPRETATION- KOWLEDGE+NEW INFORMATION. NB! DETERMINE THE BALANCE BETWEEN FACT AND SPECULATION! CRITICAL THINKING AND RE-APPRAISAL

INTELLIGENCE PROCESS • REPORTING- INTELLIGENCE REPORTS ARE THE CULMINATION OF ALL FUNCTIONS IN THE PROCESS. THEY STATE THE FINDINGS OF THE INTELLIGENCE PROCESS. • CLEAR CONNECTION BETWEEN THE FACTS AND JUDGEMENTS, AND CONCLUSIONS AND FORECASTS

INTELLIGENCE PROCESS • DISSEMINATION-DISTRIBUTION • PRIMARY ROLE-PROVIDE INFORMATION, INSIGHT, AND LEAD TO INTERVENTION! • DISSEMINATION IS A TECHNICAL TERM USED INTELLIGENCE TO DESCRIBE THE ACT OF DISTRIBUTING CREDIBLE AND TIMELY INTELLIGENCE INFORMATION TO OFFICIALS AND „CONSUMERS“ INSIDE AND OUTSIDE ORGANIZATION

INTELLIGENCE PROCESS REVIEWS 1. EFFICIENCY MEASUREMENT- HOW THE INTELLIGENCE ANALYSTS’ WORK WAS DONE; 2. EFFECTIVENESS- HOW THE INTELLIGENCE PRODUCTS ASSISTED THE READER AND DECISION-MAKER. IT RELIES ON HONEST EXCHENGE AND DISCUSSION BETWEEN THE INTELLIGENCE STAFF AND READERS. MAIN QUESTION-WAS IT READABLE AND TIMELY.

3. MONITORING SYSTEMS • FRAN • MONTHLY DATA ON INDICATORS RELATED TO IRREGULAR MIGRATION • DATA AIMED AT MANAGEMENT OBJECTIVES • NOT PRIMARILY ADDRESSED AT STATISTICAL TREATMENT: EASY TO GATHER AND ALLOW FOR COMPARISON AND TREND ANALYSIS.

2. DIFFERENT MODELS THAT ARE BEING USED (CIRAM)

18

THREAT …LOAD OF FORCE ACTING ON THE BORDERS. • IS CHARACTERISED BY ITS MAGNITUDE AND LIKELYHOOD. • THE ANALYST SHOULD DESCRIBE WHICH PROCESSES OR FACTORS BOTH INSIDE AND OUTSIDE THE STATE AFFECT THE MAGNITUDE AND THE LIKELYHOOD OF THE THREAT. 19

IDENTIFYING OF THREATS • THREAT SHOULD BE DESCRIBED IN NEUTRAL, SIMPLE AND SHORT WORDING STYLE; • THE DESCRIPTION OF THE THREAT TYPICALLY INCLUDES: - THE DESCRIPTION OF MODUS OPERANDI; - THE PERPETRATOR GOALS, MOTIVES AND CAPABILITIES (WHO, WHEN, WHERE, HOW MANY); - THE TRENDS AND PREDICTIONS; - THE PUSH FACTORS

TERMS IMPACT/HARM PROBABILITY THREAT RISK INCIDENT HARM PRIMARY HARM SECONDARY HARM COLLATERAL HARM 6. 11. 2020 21

THREAT ASSESSMENT • IN CIRAM, MOST THREATS WILL BE ASSOCIATED WITH BORDER AREAS OR BORDER TYPES • SOME THREATS CAN BE ASSOCIATED WITH PROCESSES FOR CHECKS AND SURVEILLANCE • THREAT ASSESSMENT AS SPECIFIC AS POSSIBLE –BY TYPES OF BORDERS.

THREAT ASSESSMENT: MAGNITUDE AND LIKELIHOOD Among the first factors that will affect the magnitude and the likelyhood at the borders, are: • GEOGRAPHICAL ATTRIBUTES OF THE BORDER AREAS; • THE EQUIPMENT IN PLACE (can be referred as border permeability)

MEASURING THE THREAT: EXAMPLES • IMMIGRATION: THE NUMBER OF MIGRANTS ILLEGALLY CROSSING THE BORDER; THE NUMBER OF REFUSED ENTRY. • DRUG CONTROL: KILOGRAMS OF DRUGS SEIZED. • COUNTERTERRORISM: PATHS THAT TERRORISTS COULD USE TO ENTER THE COUNTRY; THE NUMBER OF SUSPECTED TERRORISTS.

IMPACT - PROBABILITY HIGH IMPACT/HARM VERY LIKELY LESS LIKELY LOW IMPACT/HARM 6. 11. 2020 25

IMPACT • BORDER AND INTERNAL SECURITY • ABILITY TO MANAGE LEGITIMATE PASSENGER FLOW AT BORDER • HUMANIATRIAN IMPACT

Identifications of threats (Optional algorithm) 1. Analytical unit collects all incidents, data and information about main threats. First of all In this process we have to take in to consideration reliability and validity of the information to the threat. Secondly we have to consider probability and magnitude of threats and notice it in the report to decision makers. Another important way of thinking is to identify real and hypothetical ; approval and potential threat. Example: Approval threat (risk) for outside border is illegal migration. Potential threat (risk) is terrorism. Hypothetical is cross border conveying of very large scale of mass infection.

EXAMPLE OF RISK MATRIX RISK NAME THREAT VULNERABILIT Y IMPACT RISK LEVEL RISK 1 TDA HIGH LOW LOW RISK 2 IM HIGH LOW MEDIUM RISK 3 VA LOW MEDIUM HIGH

THREAT MATRIX FOR BORDER SECURITY IDENTIFIED THREATS FOR UPCOMING PERIOD OF X Change from X-1

CASE STUDY BASING ON CIRAM STANDARDS SMUGGLING OF HUMAN BEINGS: WHAT HAS TO BE IDENTIFIED, HOW TO DISMANTLE THIS RISK?

31 31

1. MODUS OPERANDI OF TRAVEL, CROSSING, AVOIDING DETECTION, DOCUMENTS • Legal entry and stay in first transit country (Russian Federation) • VNM network facilitating arrival, stay and employment in Russian Federation • ARM OGC organising travel to RUS-EST border and finding „scout“ to take “shipment“ across the border • Recruiter for ARM OGC in Estonia – finding „taxi“ drivers nationals and residents of Estonia • Couriers transporting „shipment“ from EST border across the Baltic countries until Poland

2. WHO, WHERE, WHEN;

PROFILE OF VNM NATIONALS • Jumpers” - short stay (‘jump’ within 2 months and/or less) on tourist or business visas and quick transit via RUS (see photo 1 and 2 below). • “Residents” – legal entry, stay and/or work (illegally) in RUS over 3 months • Age : • Gender: 18 -30 y. o (many cases claiming to be minors !) >90% male • Other: Change of statements during the proceedings (names, age etc. )

3. TRENDS AND PREDICTIONS • December 2011: 1 st detected and identified VNM group • December 2011 - November 2013 Active „season“ of cross border movement of VNM groups at EST-RUS border ESTIMATED NUMBER OF GROUPS 30 + GROUPS (200 + persons) (calculation with detection rate 50%)

4. PUSH FACTORS • SOCIAL AND ECONOMICAL SITUATION IN VIETNAM • VERY FEW JOB OPPORTUNITIES WITH DECENT INCOME • TIGHTENING OF IMMIGRATION RULES IN RUSSIA ( INTENCIFIED RAIDS BY LEA’s) • RISE OF RACIAL HATERATE

4. PULL FACTORS • LARGE VNM COMMUNITIES IN EUROPE (POL, DEU, FRA) • ADVERTISEMENT OF JOB OPPORTUNITIES • MIGRATION AMNESTIES • AVAILABILITY OF NUMEROUS SMUGGLING NETWORKS

CASE STUDY 2: THREAT ASSESSMENT : POSSIBLE RIOTS, TERRORISM , EXTREMISM-HOW TO ACT AT BORDERS?

THREAT ASSESSMENT EXAMPLE: VISIT OF A HEAD OF GOVERNMENT X -BRIEFING • BASING ON 2 DOCUMENTS – THREAT ASSESSMENT (14. 08. 20 XX) – RISK ANALYSIS FOR COMING PERIOD (WEEK)- (29. 08. 20 XX) • IDENTIFIED 6 THREATS: 1) 2) 3) 4) 5) 6) TERRORISM EXTREMISM RIOTS PROVOCATIONS ILLEGAL IMMIGRATION CROSS-BORDER CRIMINALITY LEGEND OF THREAT MATRIX: 39

GENERAL ASSESSMENT: TERRORISM / EXTREMISM/RIOTS/PROVOCATIONS INTERNAL BORDERS LEVEL OF THREATS IN BCP-S AND THEIR LEVEL OF THREAT PROBABILITY Terrorism Normal Possible Riots, provocations Medium Almost certain EXTERNAL BORDERS LEVEL OF THREAT PROBABILITY Normal Possible Why such assessment? • • Time of the visit was announced in a very short notice Visa requirement for 3 rd country nationals who probably will plan possible activities Unpredicatble actions by EU nationals or Schengen visa holders Possible threat of crossing the border outside BCP-s 40

GENERAL ASSESSMENT: ILLEGAL IMMIGRATION / CROSS-BORDER THREATS IN BCPS-S AND THE LEVEL CRIMINALITY INTERNAL BORDERS LEVEL OF THREAT ILLEGAL IMMIGRATION ILLEGAL BORDER CROSSING SMUGGLING OF STOLEN VEHICLES SMUGGLING OF GOODS SMUGGLING OF DRUGS SMUGGLING OF WEAPONS OTHER CROSS-BORDER CRIMINALITY MEDIUM LOW NORMAL LEVEL OF PROBABLITY Kindel Võimalik Peaaegu kindel EXTERNAL BORDERS LEVEL OF THREAT PROBABILITY MEDIUM CERTAIN LOW POSSIBLE NORMAL ALMOST CERTAIN NORMAL POSSIBLE LOW POSSIBLE NORMAL ALMOST CERTAIN WHY SUCH ASSESSMENT? • • • EVENTS IN 2014 AT BORDERS AND IN NEARBY COUNTRIES ILLEGAL IMMIGRANTS CROSS THE BORDERS BY CAR AND AT MAIN ROADS INCREASE OF NUMBER OF PERSONS WITHOUT VISAS TRANSITING IN THE REGION TRANSITING ILLEGAL MIGRATION CROSS-BORDER CRIMINALITY IN THE 41 REGION

3. KEY PRINCIPLES, TOOLS, ELEMENTS AND STAKEHOLDERS INVOLVED

KEY PRINCIPLES • COOPERATION WITH POLICE, SECURITY POLICE AND CUSTOMS AND OTHER BORDER SECURITY AUTHORITIES IS NEEDED • NEED TO DEVELOP THE UNDERSTANDING OF THE CAPABILITIES OF THE BORDER CONTROL AUTHORITIES: ROLE, RESPONSIBILITIES, RESOURCES, KNOWLEDGE, INFORMATION FLOW AND DECISION-TAKING, STANDARDS, REFERENCE MODELS.

KEY PRINCIPLES : MONITORING THE SITUATION AT BORDERS AIM- TO DETECT EMERGING THREATS OF CROSS -BORDER CRIMINALITY AT EARLY STAGE.

TOOLS: SITUATIONAL AWARENESS Ongoing and planned activities Criminal trends Own resources Terrain & weather Inter agency cooperation Operational history Criminal history Global general situation Legislation 6. 11. 2020 Situation picture National general situation 45

OTHER TOOLS • • ALERTS EARLY WARNINGS RISK PROFILES RISK INDICATORS REGISTERS STAFF/RESOURCES EQUIPMENT

STAKEHOLDERS INVOLVED: EXAMPLE Ministry of Internal Affairs Estonian Board of Border Guard Police Board Rescue Board Ministry of Foreign Affairs Local Authorities Defence Forces Customs Board Correction Board Security Police Board Maritime Board Citizenship and Migration Board Motor Vehicle Registration Centre

ELEMENTS: ACTIONS BASED ON PROPER ANALYSIS 1. Intelligence and Joint intelligence • • targeted intelligence collection joint databases joint teams joint targets and operations 2. Risk analysis • • based on authorities’ specific task-related needs exchange of information on the results of analysis 3. Co-operation in border management • • • Border Guard is the leading authority at the borders Police , security police and customs co-operate in their area of competence and vice versa… Use of each others’ databases and information Use of INTERPOL databases

OPERATIONAL ART Strategic intelligence Strategic risk analysis Strategic planning and guidance Operational intelligence Operational risk analysis Operational planning and guidance Tactical intelligence Tactical risk analysis Tactical guidance and field solutions 6. 11. 2020 49

RISK ANALYSIS MODEL FOR BORDER CONTROL -Based on Schengen Borders Code and the Schengen Catalogue CRIME INTELLIGENCE RISK ANALYSIS BORDER CONTROL STRATEGIC THREATS AS PHENOMENA • statistics, trends • underlying factors LONG TERM SURVEILLANCE • risks and threats • potential change STRATEGIC MANAGEMENT • long term: shape organisation • short term: effect on crime OPERATIONAL THREATS ON THE AREA OF RESPONSIBILITY • statistics • crime patterns • organisations QUANTITATIVE ANALYSIS • geography, demography, traffic • apprehension rate and total crime • clevel of ambition • gaps in controls? OPERATIONAL MANAGEMENT • opplans • budgets TACTICAL LOCAL INTELLIGENCE • filing data + analysis • . serving the products 6. 11. 2020 PROFILING • modi operandi • profiles, indicators, • registers REAL TIME BORDER CONTROL • border surveillance • border checks 50

USING RISK ANALYSIS INTELLIGENCE OPERATIONS National level STRATEGY BACKGROUND regional level SITUATION LEADING IS BASED ON INFORMATION! OPERATIVE LEADERSHIP local level SINGULAR EVENTS 6. 11. 2020 REAL TIME ACTIONS 51

WHO DOES WHAT IN COUNTERTERRORISM ACTIVITIES? NEW TACTICS OF ISIS: CA 1000 PERSONS PRETENDING TO BE ILLEGAL MIGRANTS CROSS ILLEGALLY STATE BORDERS. WHAT TO DO? • WHICH AUTHORITY/ORGANISATION/BODY COLLECTS DATA/ INFORMATION? • WHAT KIND OF DATA/INFORMATION IS COLLECTED? • WHO GIVES THE TASK FOR INFORMATION COLLECTION? • WHO CARRIES OUT ANALYSIS OF INFORMATION? • WHO IS ACTING? • HOW TO ACT? TIME: 15 MIN