According to a study by the Heritage Foundation, there were 60 publically known terrorist plots against the United States during the timeframe between the attacks of September 11, 2001, and June 24, 2013. It is a tribute to the dedicated hard work of law enforcement and intelligence agencies that 53 of these plots were thwarted before the public was ever endangered.¹ The task of predicting who (or what), when, and where terrorists will attack is the ultimate aim of counterterrorist investigation and intelligence analysis because such information may lead to successful interdiction before the plans can be carried out. Such a result is the classic manifestation of the prevention mission area articulated in the U.S. Department of Homeland Security’s (DHS’s) National Preparedness Goal, which states:

Prevention includes those capabilities necessary to avoid, prevent, or stop a threatened or actual act of terrorism. Unlike other mission areas, which are all-hazards by design, Prevention core capabilities are focused specifically on imminent terrorist threats, including on-going attacks or stopping imminent follow-on attacks.²

Unfortunately, actionable intelligence regarding planned attacks is rare, and its absence necessitates an uneasy reliance on indications and warnings intelligence (sometimes referred to as “chatter”).³ Investigative efforts and enhanced security based on indications and warnings may succeed in disrupting attack preparations, but unless those involved in the plan are in custody, terrorist timelines and target venues may be simply transferred to another time and another place, thus restarting the prevention mission cycle. Adding to the difficulty is the reality that would-be terrorists are learning to take advantage of the situations, potential targets, and capabilities that are easily within their reach at any given moment. It is no longer just a matter of attacking iconic targets anymore, which makes it more difficult for responders to anticipate what the next target will be, how the target will be attacked, and how to prepare for it. Law enforcement is thus perpetually challenged to maintain a capability to interdict terrorist attacks after they have been initiated to rapidly save and protect lives that haven’t already been lost and to eliminate the threat of further losses. Clearly, when the prevention mission is unachievable, law enforcement’s role resides in the protection and response missions of the National Preparedness Goal.⁴