JULY WARNING AND FORECAST REPORT

• Document Type: CREST
• Collection: General CIA Records
• Document Number (FOIA) /ESDN (CREST): CIA-RDP91B00776R000400040015-8
• Release Decision: RIPPUB
• Original Classification: S
• Document Page Count: 8
• Document Creation Date: December 23, 2016
• Document Release Date: July 5, 2013
• Sequence Number: 15
• Publication Date: July 27, 1988
• Content Type: MEMO

Declassified in Part- Sanitized Copy Approved forRelease2013/07/18 : CIA-RDP91B00776R000400040015-8
The Director of Central Intelligence
Washington, D.C. 20505
National Intelligence Council
NIC# 02638/88
27 July 1988
MEMORANDUM FOR: See Distribution
FROM: Andre LeGallo
National Intelligence Officer for Counterterrorism
SUBJECT: AptylWarning and Forecast Report
1. The monthly warning meeting on terrorism was held on 22 July.
Following is my report on the topics covered:
2. Iran. CIA briefed on the current status of the Iranian threat to US
interests, the actions Iran is likely to take, where the US is at greatest
risk, and the outlook for the future.
CIA believes Iran will eventually decide to retaliate for the accidental
downing of IranAir Flight 655, but that Iranian leaders will first exhaust
diplomatic efforts and then act in a way not to endanger initiatives to
improve foreign relations. A decision to retaliate would probably be made
by consensus of Iran's leaders--including Assembly Speaker Rafsanjani, the
Prime Minister, the Intelligence and Interior Ministers, and the Iranian
Revolutionary Guard Corps (IRGC).
Iran is aware that military retaliation against the US in the Persian
Gulf is not a realistic option. It wants to continue to exploit its role as
"victim"--from the IranAir incident--and retain the moral high ground. Nhen
Tehran retaliates, it will likely employ surrogates. Recent reporting of
indicate that Iranian-backed
groups continue to prepare for attacks against US interests. Yet threats
against the hostages in Lebanon have stopped, apparently following warnings
by Iran and Hizballah spiritual guide, Shayk Fadlallah not_iu link the
hostages to the downing of IranAir Flight 655.
25X1
25X1
25X1
25X1
25X1
25X1
25X1
25X1
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18: CIA-RDP91B00776R000400040015-8
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18 CIA-RDP91B00776R000400040015-8
SECRET 25X1
The areas of greatest risk for the US have not changed, but some aspects
25X1
of the threat are different. Iran's apparent interest in using surrogates
not previously linked to it may produce uncontrollable assets who may act
without authority. Some groups, such as the Abu Nidal Organization (ANO) or
other Palestinian groups, may seek involvement with Iran in order to garner
a new sponsor. . These groups offer Iran an attractive outlet--not being
linked historically--and Tehran may opt to employ them, believing that its
involvement would be hard to trace. Yet, while these groups may make
demands on Iran for their assistance, we doubt that Tehran would accede in
any arrangement that could jeopardize its security interests, e.g.,
providing ANO a base of operations. The danger is that these groups may act
without Iranian authority. Indeed, some of these
groups may claim attacks
in the name of Iran, hoping to divert the blame.
25X1
Another concern is that Hizballah or Palestinian
extremists may act on
their own out of a growing sense
the Gulf military situation, and
of "freelancing" is increasing.
of frustration
the acsa in.
over the IranAir incident,
ion of Abu Jihad. The danger
25X1
The downing of IranAir Flight
655 is not seen
as an isolated incident by
Iran or many others in the Middle East, but as part of a larger US
conspiracy to undermine and embarrass Iran and the Palestinians, and to help
Israel. The emotional baggage from Iran, Lebanon, and the assassination of
Abu Jihad sustains a high threat environment. As noted, uncontrolled
individuals or groups could lash out in frustration
--thus we believe the
25X1
danger is increasing.
Threats to US interests will continue at a high rate. The more likely
incidents are hijackings or attacks against large numbers of US personnel.
US interests are especially at risk in the Persian Gulf--particularly in
Kuwait, Bahrain, and the UAE. Hijackings by Hizballah are possible, as with
KU 422 and the Air Afrique incident. Indeed, Hijackings are more likely to
be initiated from countries where security is poor and where the hijackers
have a support structure, such as obtains in many African countries. But
the capability exists in Europe, as well. We have some indications that
Iran is renewing contacts with members of the Lebanese North African
terrorist cell arrested in France last year. We doubt that the hostages
will be harmed.
While a rogue operation sponsored by elements in Tehran is always
possible, we do not believe one is likely. Rafsanjani appears to be in
control, and he apparently does not believe that a terrorist incident would
be beneficial at this time. Yet while Rafsanjani would be involved in such
operational decisions, he may be forced to accede to more "radical" demands
25X1
25X1
nprlaccifiAci in Part - Sanitized Copy Approved for Release 2013/07/18 CIA-RDP91B00776R000400040015-8
Declassified in Part - Sanitized Copy Approved for Release
2013/07/18 CIA-RDP91B00776R000400040015-8
SECRET
25X1
to hit the US. Terrorist attacks by Iran
would serve
to remind the US that
Tehran still has the power to act and to
damage the US position in the
25X1
region.
The question is not whether--but when--Iran will strike. No one
believes Iran has foresworn terrorism as a foreign policy tool. The
confrontation will continue. The question is when it will be politicall
opportune for Tehran to employ terrorist tactics a ains
3. 17 lovember. CIA briefed on the recent assassination of CAPT
Nordeen, whether there is an emerging pattern to 17 November operations, and
the prospects for improved Greek counterterrorist performance. At 0800, 28
June, CAPT Nordeen's vehicle passed a car approximately 100 meters from his
home loaded with high explosives which were detonated by remote
control--most likely by radio signal. Nordeen was killed instantly, and
damage was done to buildings up to 100 meters away by blast, shrapnel, and
debris. There were no other casualties. Two men were reported seen leavin
the scene at high speed on a mortocycle shortly after the explosion.
CAPT Nordeen was driving a lightly armored Ford Grenada down a one-way
street, after exiting the grounds of his home. 17 November noted in its
communique that it was aware that he drove an armored vehicle and probably
used that information to calculate the size of the device. A barrier of
sand/cement bags reportedly was placed around the explosives, to channel the
full force of the explosion toward the target. All of the circumstances of
the attack indicate the group conducted a thorough surveillance of Nordeen's
movements. The explosives car was stolen in January, but there is no
evidence indicating how long the terrorists monitored Nordeen prior to the
attack.
The US Embassy in Athens suggested that Nordeen may have been a backup
or secondary target, but there is no hard evidence that this is the case.
Analysis of a copy of the group's communique noted that the section dealing
specifically with CAPT Nordeen appeared to have been a replacement for
another text. In addition, one date on the claim was 14 June. Since no
other portion of the text dealt with Nordeen or his position directly, the
Embassy raised the possibility that, for unknown reasons, the priority
target could not be attacked, and Nordeen was the fall-back. Nevertheless,
the precision of the attack suggests more than two weeks of preparation went
into the operation, and that the group had selected him earlier, at least
as the secondary target. There is no information suggesting the identity of
the putative priority target.
The group added a new dimension to the focus of its anti-American
rhetoric. More graphically than in any previous communique, the group
linked its antipathy towards the US and Turkey, going as far as asserting
npriaccifiari in Part - Sanitized Copy Approved for Release 2013/07/18 CIA-RDP91B00776R000400040015-8
25X1
25X1
25X1
25X1
25X1
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18: CIA-RDP91B00776R000400040015-8
SECRET U 25X1
that the attacks on Americans will continue until the last Turkish soldier
is out of Cyprus and the last American soldier is out of Greece. While 17
November's ideology may genuinely embrace an anti-Turkish theme, the group
may be trying to bolster sagging tolerance of its attacks by linking public
resistance to Athen's rapprochement with Ankara with its anti-American
struggle. By portraying Washington as the force behind Turkish
expansionism, the group may have hoped to transfer anti-Turkish sentiment to
the US.
The claim letter also touched on the group's traditional themes.
Papandreou was criticized for not following through on promises to close the
US bases, break Athens ties to NATO, and reform the country's economic
structure. In addition, the author of the communique laid out an
interesting military strategy for resolving the situation with Turkey, short
of all-out war.
17 November probably began laying the ground work for revitalizing its
campaign earlier in 1988. The anti-Turkish theme was given prominence in
the letter claiming responsibility for the murder of a Greek businessman on
I March. This theme was reemphasized with the attack on four Turkish
Embassy cars on 23 May, in which two devices exploded and two did not.
Although the group raised the US-Turkish link in the 1 March murder, it
stated that the assassination of Nordeen was the second phase of an action
begun with the latter attack on the Turkish cars, indicating that the group
is plannin a series of ? erations against US and Turkish interests in
Greece.
17 November probably hopes to sustain the increased pace of its attacks
against the US, particularly with another round of base talks going on this
month. The group has carried out seven operations against US targets since
1975, but the last four have taken place since April 1987. In 1988, the
group has conducted an attack at approximately two-month intervals.
Furthermore, it has demonstrated it can prepare for several operations
concurrently. The group apparently had been preparing the 28 June attack
since at least January--when the car containing the bomb was stolen and
shortly after the attempted assassination of a DEA official--but also
planned and carried out the attack on the Greek businessman in March and the
Turkish car bombing in May. The group may have exhausted itself with the
rapid pace of the attacks. Ne suspect 17 November is a relatively small
organization, and it may need a -espite to organize the next round of
attacks.
Clearly we expect US interests to continue as a prime target for 17
November. Nevertheless, the group is unlikely to ignore Greek interests.
The series of attacks since April 1987 offers a number of possibilities for
future targeting:
-In addition to demonstrating it can attack more secure targets,
the group also may turn to greater use of smaller, non-lethal
bombings--such as those against the Turkish cars and Greek tax
25X1
25X1
25X1
25X1
425X1
nna-Inecifiarl in Part - Sanitized Coov Approved for Release 2013/07/18: CIA-RDP91B00776R000400040015-8 I
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18: CIA-RDP91B00776R000400040015-8
SECRET 25X1
offices--to protest Athen's policies and possibly draw less public
criticism.
-The vehemence of the anti-Turkish rhetoric and the attacks on the
cars indicates Turkish interests are at substantial risk. The group,
however, may not yet be sure enough of public support to assassinate
Turkish officials, particularly since it would draw attention away from
the US.
-Much of the Nordeen communiaue was directed aaainct the Greek
military.
them. the variety of methods for carrying out attacks demonstrated by
the group presents greater security problems, as it has expanded the
range of targets it can tta:k. 17 November moved from point-blank
assassinations to large explosive devices using remote control, in an
orderly progression--although not without some problems. Only the most
hardened facilities appear beyond the capability of the group to
attack.
The murder of Nordeen followed by the City of Poros attack appears to
have shaken Athens out of its lethargy, if only because of the prospect of
losing tourist revenue. Controversy within the intelligence community
surrounds the issue of why Athens has made no progress in controlling
domestic terrorism. Part of the problem is the poor state of the police
investigative capability, once again demonstrated in its handling of the
Nordeen attack. The lack of action also suggests an unwillingness--for a
variety of reasons--by some in the government and police to move against 17
25X1
25X1
25X1
November, which had its genesis during the junta years when current
government officials were active in the resistance. Even so, there is no
hard evidence that
links any government official directly to any of the
Greek groups or
that officials have
intervened in investigations to protect
the terrorists.
25X1
25X1
25X1
4. Afghan Inspired Terrorism. CIA briefed on the terrorist
implications of the Soviet withdrawal/Mujahedin ascension, the likely future
Afghan Security Force (WAD) activities in Pakistan and their implications
25X1
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18: CIA-RDP91B00776R000400040015-8
Declassified in Part - Sanitized Copy Approved for Release
SECRET
2013/07/18: CIA-RDP91B00776R000400040015-8
u
25X1
for the threat to US interests, the threat
to US interests
in Kabul, and the
prospects for and threat posed by an Iranian-Mujahedin alliance.
25X1
In effect, the implications of the Soviet withdrawal
for terrorism are
unknown. Domestic and international terrorism will continue for the short
term, especially during the withdrawal period. Over the longer term, CIA
expects the WAD to be more concerned for its survival, as opposed to
external targeting. Thus we may see a decrease in attacks on Pakistani
civilian targets. The WAD will
continue to try to assassinate Mujahedin
leaders.
25X1
The Afghans are furious
about the continuous rocket attacks. Also, a
number of car bombings have occurred in Kabul and Jalalabad. While these
actions don't fit the Mujahedin M.O.?targeting civilians--and are probably
the product of regime factionalism, the regime
may opt to conduct some
spectacular operations in Pakistan as a warning.
25X1
Once the Soviet withdrawal is complete. a portion
of the weaponry in the
hands of the Mujajedin could drift to terrorist groups, especially those
with ties to more radical fundamentalist
elements.
Some resistance forces
already have ties with Iran.
25X1
The most serious threat is
in Kabul, which
is perforce a ar zone.
Americans, who look like Russians, could be attacked inadvertently. Also,
there are some reports that Iran might sponsor attacks on the US Embassy.
There are at least eight Iranian-sponsored groups in Afghanistan whose main
concern is to expunge all foreign influence in the country, although few
apparently have operational capabilities inside
Kabul. To date, none have
carried out attacks on western interests.
25X1
The regime appears committed to assuring
security for the US Embassy; so
CIA does not expect any significant attacks on that facility in the near
future. But the threat should not be underestimated. The US remains a
"common foe" for many radical elements. And the regime appears to be
targeting western
journalists, in an effort to delimit their movements.
25X1
25X1
b.eoa(100(6e
A 25X1
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18 : CIA-RDP91B00776R000400040015-8
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18: CIA-RDP91B00776R000400040015-8
SECRET 25X1
SUBJECT: July Warning Report
DCl/NIO/CT/ALeGallo (27 July 1988)
C/NIC
VC/NIC
NIO/CT
cl)- NIO/CT Chrono
- NIO/AF
- NIO/NP/CBW
- A/NIO/AL-CBW,
- NIO/EA
- NIO/ECON
- NIO/EUR
- NIO/FDIA
- NIO/GPF
- NIO/LA
- NIO/N
- NIO/NESA
- NIO/S&I
- NIO/SP
- NIO/USSR
- NIO/W
- D/AG/NIC
25X1
25X1
_ 25X1
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18: CIA-RDP91B00776R000400040015-8
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18: CIA-RDP91B00776R000400040015-8
'
SECRET 25X1
SUBJECT: July Warning Report
DCl/14I0/CT/ALeGallo/ep/46032 (27 July 1988)
Distribution:
OIR/DSD/DB
DI/OIR/DSD
DIA
ICS/NC
- D/ALA
D/OEA
- D/EURA
D/OGI
D/NESA
D/SOVA
C/CRES
C/EA
- C/EUR
C/LA
- C/NE
C/SE
C/AF
- C/EA/RR
C/EUR/RR
- C/LA/RR
C/NE/RR
- C/SE/RR
C/AF/
- NPIC
CTC,
IICT ExecSecy,
- Room 1H-04)
, EPS/Intel Group
NESA/IA
FBIS
FBIS/NEAD/AA
EPS/Ops Group
25X1
25X1
25X1
25X1
25X1
25X1
_ 25X1
Declassified in Part - Sanitized Copy Approved for Release 2013/07/18: CIA-RDP91B00776R000400040015-8