Philip Ingram: Using HUMINT in Cyberspace Is Best to Fight Extremists Online
An interview with Philip Ingram, veteran of the UK Army Intelligence Corps
Mr. Ingram, could you please tell our readers about yourself and your background?
Philip Ingram: I am a former British Army Officer, a Colonel, who started his career in the Royal Electrical and Mechanical Engineers but transferred to and spent most of his career in the Intelligence Corps as a planning officer and senior intelligence officer. As well as serving in the UK and Germany, I have been deployed to Northern Ireland, Croatia, Bosnia, FYROM (Macedonia), Kosovo, Cyprus, and Iraq. With a first degree in Applied Sciences and a Masters Degree in Military Technology, I was formally trained at the Advanced Command and Staff College in joint and combined operations. My military career saw formal recognition with an operational commendation and an award of an MBE by Her Majesty the Queen in 1996.
On leaving the military in 2010, I went into the steel industry as a sales and marketing director to learn about business before, some 3 years later, leaving to set up my own company and get into journalism and consulting specialising in intelligence, terrorism, defence, security and geopolitics. I now run my own company called Grey Hare Media providing expert content for global media outlets.
At present, you are retired military intelligence officer but you still deal with counter-terrorism issues. In what activities are you engaged now? Does your company - the Grey Hare Media - provide services to private or state clients? In general, what kind of problems are typically addressed?
Philip Ingram: I keep abreast of all terror-related activities so that I can provide expert commentary on them and add value to counter-terrorism discussions and conferences. I have hosted several of these conferences. Coming originally from Northern Ireland, I grew up with terrorism all around me. This has given me a unique understanding which proved invaluable during and after my military career. I am on the board of several counter-terrorism information and intelligence-focused organisations, so I again can provide advice on CT issues as a consultant.
You have an extended experience in tracking and identifying extremists in social networks and Internet in the whole. Could you please elaborate on this issue?
Philip Ingram: One of the organisations I am on the board of specialises in tracking and penetrating criminal and terrorist organisations. It is a new company, but to prove our capability, we penetrated 140 invitation-only groups associated with ISIS on Telegram. We had also infiltrated their previous activities on the Dark Web and on Twitter. This has given me a unique insight into the extremists’ global reach and the way they radicalise individuals online.
In your experience, what social networks, software and methods are used by extremists and jihadists for recruitment and other terrorism-related activity? What kind of technologies should be used by counterterrorism departments to effectively combat the spread of radical propaganda and cyber terrorism? If you don’t mind me asking, what kind of software and methods do you apply in this field?
Philip Ingram: Terrorists use many different social networks and encrypted channels to promote their activities. The main channel used by Islamist extremists and in particular those Islamic State focused ones, is the Telegram platform, as it provides very high-grade end-to-end encryption. They maintain backup communication network on other platforms but seem to prefer Telegram. It is very technically difficult to break into these channels, so the method I have found successful is using human intelligence (HUMINT) techniques in the cyber environment. Essentially, this means running intelligence agents and spies inside the online forums.
What problems do security services face when dealing with terrorists? What are the main difficulties in investigating terrorism-related cases?
Philip Ingram: There are many issues the security services face when trying to deal with terrorists. The biggest one is that the security services have to operate within the law and terrorists don’t. Additionally, the powers the security services are given must be balanced against the rights of normal citizens so that their activities are proportionate to the threat and necessary to deal with it.
Other real challenges are the technological advances in encryption, ease by way terrorist material can be accessed, and in some countries the ease of access to weapons and explosives.
Many experts refer to an issue of proportionality of punishment. What can be improved in this area?
Philip Ingram: I am not sure what you mean by this question. Terrorists have to be caught, prosecuted, and if found guilty, punished within the law of the land they have committed the crime in. As different countries have different punishments, proportionality has to be set by the governments of those countries.
There is also a problem of conversion of former terrorists. Some of them can be still under psychological pressure from radicals, on the other hand, they struggle with the integration into the society and don’t always succeed. What methods are the most effective to help them stay on track for the rehabilitation?
Philip Ingram: There are many rehabilitation programmes; some are good, some are less good. The only way for them to be properly effective is for them to be tailored to each individual. Some individuals are glad to be out of terrorism and take active roles in helping others, whereas some remain loyal to their terrorist cause and will never be rehabilitated. There must be a balance between legal, social, and medical intervention in any rehabilitation programme, as well as constant monitoring and assessment that it continues to work.
Intelligence gathering is crucial in combating terrorism. Which methods are more effective and which ones are less effective? For instance, some extremists recruited by security services may deliberately provide misleading intelligence information in order to cause damage to their extremist rivals or for some other purposes. Sometimes, recruited agents are just useless. How can you understand what will really bear fruit?
Philip Ingram: The most effective intelligence is all source-derived intelligence-utilising information gathered from open sources (OSINT), collected by intercepting communications (SIGINT), analysis of imagery (IMINT), and the running of spies and agents (HUMINT).
Some may try to mislead when running agents, but professional HUMINT operators, agent handlers, are well aware of this and can put checks in place to minimise this risk. All agents are graded for their reliability and the reliability of the information they provide, and useless agents are dropped quickly. HUMINT has the advantage of being able to understand a target’s intent and thinking, and it is possible to ask follow-up questions to an agent. SIGINT allows the understanding of what is being said or written and how it is communicated, but you only get what you intercept. IMINT, again, is good, but you only see what is in the visual field of the sensor.
With the increasing use of highly encrypted communication networks by terrorists, combining HUMINT techniques in a cyber environment works well.
In your assessment, what should be done to enhance international cooperation in the field of terrorist crime prevention? Does Britain have a relative cooperation with Russia? What should be done to improve it?
Philip Ingram: There are two areas where we see international cooperation in the fight against terrorism. The first is through formal networks such as INTERPOL and EUROPOL, and the second is through bilateral relationships set up between different agencies in different countries. These latter relationships are very personality-driven, but are probably the most effective way of passing immediate threat information and intelligence. Often, even if there are political strains between countries, these informal relationships help maintain a level of cooperation.
Relations between Russia and the UK are currently in decline. In your opinion, what should be done to improve the British-Russian relations and increase interaction between the countries?
Philip Ingram: Political relations between the UK and Russia are in decline — and for good reasons. Power in Russia is vested in too few individuals who can ensure the machinery of state is used to increase their personal wealth and keep them in powerful roles. Globally, the annexation of Crimea, interference in Eastern Ukraine, support for Assad in Syria, use of global cyber-attacks, and use of radioactive material on the streets of London and nerve agents in Salisbury don’t help smooth relations. This is not helped by the state media machine’s маскировка (maskirovka) campaign.
However, the Russian people, like the British people, are proud. We have common history in dealing with global dictators, we have suffered terror attacks, and we have operated together on military operations in the Balkans. I have enjoyed working with my Russian counterparts in Kosovo and elsewhere, and underneath the flags and uniforms, we are all the same.
I think recognising those similarities, celebrating what we have done together, and developing international cooperation are the only ways of improving relations. As people, we can put political differences aside and work together and hope our politicians may find a way of doing the same.
You served in the Balkans. What are the main security challenges in the region today?
Philip Ingram: The biggest challenges in the Balkans are twofold. The first is putting the past behind them. History, as it does in so many parts of the world, seems to dictate current politics and is a barrier to real progress in some areas. However, if you look at Slovenia, Croatia, and Montenegro, it shows there is real hope. Politicians need to help people come to terms with their differences and past and look to the future, setting the conditions for better living.
The second challenge is criminality. Some Balkans countries are still conduits for a lot of criminal activity into the rest of Europe, and associated with this is a disproportionate amount of criminal wealth influencing decision makers.
According to US Department of State, the Balkans are a key transit route for foreign terrorist fighters heading to Syria and Iraq. Germany’s foreign intelligence agency (BND) is increasingly concerned about Islamist tendencies in the Balkans, particularly in Bosnia and Herzegovina. How did the region turn into a fertile ground for radical Islam? What Islamist groups are most active there now?
Philip Ingram: The Balkans have always been a transit route from Southern Europe to Northern Europe; we have seen that with migrants from North Africa, Syria, and elsewhere. Migrant routes tend to follow smuggling routes as it is often criminal networks that drive the smuggling of people. Former ISIS fighters are known to have moved into Europe with genuine refugees as they either return home or move to countries with the aim of setting up sleeper cells.
The Balkans are the ancient boundary between the furthest expansion of the Ottoman Empire and the Austro-Hungarian Empire and the interface between the Orthodox religion and the Muslim religion. During the Bosnian conflict, there was a foreign fighter brigade in the Balkans fighting for the Bosnian Muslim army. Many of those who fought there moved off to join Al Qaeda or other global terror organisations. The remaining supporters of that brigade provide the core of the activities that the BND are worried about.
How would you assess the gravity of a migration crisis in Europe? What can be done to overcome the existing difficulties? Some people associate the problem of terrorists’ penetration into the region with heavy migration flows. Is this allegation true?
Philip Ingram: I think the migration crisis throughout Europe is easing, but it highlights some of the flaws that exist with the European model, and the impact of the migration crisis has yet to be fully felt. The Schengen Agreement effectively abandoned a core element of state sovereignty in favour of freedom of movement and allowed migrants free, uncontrolled access to all of the countries in Europe. The nature of migrants is changing too, from those fleeing the war in Syria to a greater number of economic migrants seeking a better life in Europe.
The problem can only be solved by tackling the issues that caused the migrants to leave their home countries in the first place, which requires huge international effort. Then those who have arrived quickly must be processed, identifying those entitled to stay and integrating them into society quickly whilst processing those who have arrived illegally and returning them back to their own countries.
There is evidence that terrorists and criminal gangs have infiltrated migrant groups either to return home with a new identity or to set up terror cells in some European countries. The extent of this infiltration is not known, and that is causing various security agencies a real headache.
In your assessment, what are the implications of Brexit in terms of security? Before the referendum, former head of MI6 Richard Dearlove said that “the truth about Brexit from a national security perspective is that the cost to Britain would be low.” Do you agree?
Philip Ingram: Security across Europe does not rely on the EU or EU membership. Military security is through NATO, in which the EU has no input. The UK’s relationship with Europol will be the only issue that will need careful handling, but the Interpol/Europol relationship will enable that to work. Intelligence sharing is not done through European institutions but on bilateral and multilateral groups and agreements, so it will be largely unaffected by Brexit. Richard Dearlove is completely right in what he said.
Thank you very much for the interview!