[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]


                     TERRORISM GONE VIRAL: THE ATTACK IN 
                      GARLAND, TEXAS, AND BEYOND

=======================================================================

                                HEARING

                               BEFORE THE

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             FIRST SESSION

                               __________

                              JUNE 3, 2015

                               __________

                           Serial No. 114-19

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________


                  U.S. GOVERNMENT PUBLISHING OFFICE
95-683 PDF            WASHINGTON : 2015                  
                     
________________________________________________________________________________________ 
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, 
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free). 
E-mail, gpo@custhelp.com.  

                    
                     
                     
                     
                     
                     
                     
                     
                     
                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Candice S. Miller, Michigan, Vice    James R. Langevin, Rhode Island
    Chair                            Brian Higgins, New York
Jeff Duncan, South Carolina          Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             William R. Keating, Massachusetts
Lou Barletta, Pennsylvania           Donald M. Payne, Jr., New Jersey
Scott Perry, Pennsylvania            Filemon Vela, Texas
Curt Clawson, Florida                Bonnie Watson Coleman, New Jersey
John Katko, New York                 Kathleen M. Rice, New York
Will Hurd, Texas                     Norma J. Torres, California
Earl L. ``Buddy'' Carter, Georgia
Mark Walker, North Carolina
Barry Loudermilk, Georgia
Martha McSally, Arizona
John Ratcliffe, Texas
Daniel M. Donovan, Jr., New York
                   Brendan P. Shields, Staff Director
                    Joan V. O'Hara,  General Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                            
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Michael T. McCaul, a Representative in Congress 
  From the State of Texas, and Chairman, Committee on Homeland 
  Security:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Oral Statement.................................................     4
  Prepared Statement.............................................     6
The Honorable Pete Sessions, a Representative in Congress From 
  the State of Texas:
  Oral Statement.................................................     7

                               Witnesses

Mr. John J. Mulligan, Deputy Director, National Counterterrorism 
  Center:
  Oral Statement.................................................     8
  Prepared Statement.............................................    10
Honorable Francis X. Taylor, Under Secretary, Intelligence and 
  Analysis, U.S. Department of Homeland Security:
  Oral Statement.................................................    12
  Prepared Statement.............................................    14
Mr. Michael B. Steinbach, Assistant Director, Counterterrorism 
  Division, Federal Bureau of Investigation, U.S. Department of 
  Justice:
  Oral Statement.................................................    19
  Prepared Statement.............................................    20

 
     TERRORISM GONE VIRAL: THE ATTACK IN GARLAND, TEXAS, AND BEYOND

                              ----------                              


                        Wednesday, June 3, 2015

             U.S. House of Representatives,
                    Committee on Homeland Security,
                                                    Washington, DC.
    The committee met, pursuant to call, at 10:13 a.m., in Room 
311, Cannon House Office Building, Hon. Michael T. McCaul 
[Chairman of the committee] presiding.
    Present: Representatives McCaul, Smith, King, Duncan, 
Perry, Clawson, Katko, Hurd, Carter, Walker, Loudermilk, 
McSally, Ratcliffe, Donovan, Thompson, Langevin, Higgins, 
Richmond, Keating, Vela, Watson Coleman, Rice, and Torres.
    Chairman McCaul. The Committee on Homeland Security will 
come to order.
    The purpose of this hearing is to receive testimony 
regarding the increasing threat from violent Islamist extremist 
groups, such as ISIS, who use the internet and social media to 
recruit fighters, share propaganda, and inspire and potentially 
direct attacks.
    Before I recognize myself for an opening statement, I would 
like to welcome our newest Member of the committee, Congressman 
Daniel Donovan of New York. We have another yet another New 
Yorker on this committee. Quite a contingency we are building. 
But his experience as a district attorney and dedication to 
public service make him a, I believe, valuable asset to this 
committee, and we are happy to have you, sir. I appreciate it.
    I now recognize--I yield to the gentleman from New York.
    Mr. King. I would like to join you in welcoming Mr. 
Donovan. I have known him for many years. He is an outstanding 
district attorney, outstanding public servant, and he is going 
to be able to work across the aisle for the betterment of the 
country.
    So, Dan, it is great to have you on board.
    Chairman McCaul. Miss Rice is recognized.
    Miss Rice. Just to show how bipartisan we are all going to 
be, as a Democrat, I would like to welcome my former colleague, 
D.A.--former D.A. Dan Donovan.
    Great to have you here and look forward to working with 
you.
    Thank you, Mr. Chairman.
    Chairman McCaul. Anybody else like to--Mr. Richmond?
    Now on to a more serious topic, just yesterday in Boston 
reports are emerging that Mr. Rahim was killed by Federal law 
enforcement officers after lunging at them with a knife; he was 
being investigated by the Boston Joint Terrorism Task Force 
after communicating with and spreading ISIS propaganda on-line. 
Known associates of Mr. Rahim are also being arrested as we 
speak.
    These cases are a reminder of the dangers posed by 
individuals radicalized through social media.
    In Garland, 1 month ago, Elton Simpson fired off a series 
of tweets declaring his loyalty to the Islamic State and urged 
others to do the same. Simpson included a hashtag 
``TexasAttack,'' previewing his decision to terrorize the 
Prophet Muhammad cartoon contest that Islamists on social media 
had singled out as a target.
    In his final tweet, just minutes before the attack, Simpson 
told his followers to follow Junaid Hussain or also known as 
al-Britani, a 20-year-old British foreign fighter embedded with 
ISIS in Syria, and one of the group's top recruiters who has 
been linked to the CENTCOM Twitter hack in January of this 
year. Hussain was quick to praise the Garland attack and issued 
a warning that same night stating, ``The knives have been 
sharpened. Soon we will come to your streets with death and 
slaughter.''
    This attack exemplifies a new era in which terrorism has 
gone viral. Extremists issued a call to arms to attack an 
event. A radicalized follower clearly heeded that call, and he 
took steps to make sure his act of violence would spread and 
motivate more.
    Social media networks have become an extension of the 
Islamist terror battlefield overseas, turning home-grown 
extremists into sleeper operatives and attackers. The 
proliferation of jihadist propaganda on-line has established a 
new front in our battle against Islamist extremists. We are no 
longer hunting terrorists living in caves and who only 
communicate through couriers. We are facing an enemy whose 
messages and calls to violence are posted and promoted in real 
time over the internet.
    For example, last month the threat level at military bases 
across the country was elevated after ISIS supporters posted 
the names of individuals serving in the military on-line and 
quickly spread this on social media. Aspiring fanatics can 
receive updates from hard-core extremists on the ground in 
Syria via Twitter, watch ISIS' bloodlust on YouTube, view 
jihadi selfies on Instagram, read religious justifications for 
murder on JustPasteIt, and find travel guides to the 
battlefield on ask.fm/Jihadi. Recruiters are mastering the 
ability to monitor and prey upon Western youth susceptible to 
the twisted message of Islamist terror.
    They seek out curious users who question--have questions 
about Islam or want to know what life is like in the so-called 
Islamic State. They engage, establish bonds of trust, and 
assess the commitment of their potential recruits. From there, 
extremists direct users to continue the conversation on more 
secure apps where secured communications hide their messages 
from our intelligence agencies. Such communications can include 
advice for traveling to terror safe havens, contact information 
for smugglers into Turkey, or the membership process for 
joining ISIS itself.
    I know the officials appearing before us here today are 
disturbed by these trends. Mobile apps, like Kik and WhatsApp, 
as well as data-destroying apps, like Wickr and SureSpot, are 
allowing extremists to communicate outside of the view of law 
enforcement.
    Equally as worrisome are ISIS' attempts to use the dark or 
deep web. These websites hide IP addresses and cannot be 
reached by search engines, giving terrorists another covert 
means by which they can recruit fighters, share intelligence, 
raise funds, and potentially plot and direct attacks 
undetected, as we saw yesterday in Boston.
    ISIS tailors its message for specific audiences around the 
globe and, in doing so, projects power far beyond its growing 
safe havens by amplifying its battlefield successes and winning 
over new converts across the world. Its media sophistication 
case helps legitimize its self-proclaimed caliphate and its 
perverse interpretation of Islam. This stands in stark contrast 
to al-Qaeda's past outreach, which relied on tightly-
controlled, top-down messaging and propaganda more difficult 
for aspiring jihadists to find.
    Today ISIS is instead taking a grassroots approach to 
terror, seeding its repressive world view from the ground up, 
from digital magazines to on-line videos that glorify barbaric 
murder. ISIS is using its multi-platform engagement to create a 
jihadi subculture that supports its violent ideology and 
encourages attacks against the United States and its allies.
    These tactics are a sea change for spreading terror, and 
they require from us a paradigm shift in our counterterrorism 
intelligence and in our operations.
    For example, we can start by doing what FBI Director Comey 
suggested, shaking the trees more aggressively to quickly 
identify and engage potential home-grown jihadis. But this is a 
dynamic new front in the war against Islamist terror. It will 
require a new approach with the heavy focus on the ideological 
battle space.
    I am grateful for the three witnesses that we have here 
today that are dealing first-hand on the front lines with how 
this terror is going viral. I look forward to hearing their 
testimony and recommendations for confronting this new and 
dangerous challenge.
    [The statement of Chairman McCaul follows:]
                Statement of Chairman Michael T. McCaul
                              June 3, 2015
    Just yesterday in Boston, reports are emerging that Usaama Rahim, 
who was killed by Federal law enforcement officers after lunging at 
them with a knife, was being investigated by the Boston Joint Terrorism 
Task Force after communicating with and spreading ISIS propaganda on-
line. Known associates of Rahim are also being arrested. These cases 
are a reminder of the dangers posed by individuals radicalized through 
social media.
    In Garland 1 month ago, Elton Simpson fired off a series of tweets 
declaring his loyalty to the Islamic State and urging others to do the 
same. Simpson included a hashtag ``TexasAttack''--previewing his 
decision to terrorize the Prophet Mohammad cartoon contest that 
Islamists on social media had singled out as a target. In his final 
tweet sent minutes before the attack, Simpson told his followers to 
follow Junaid Hussain, a 20-year old British foreign fighter embedded 
with ISIS in Syria and one of the group's top recruiters who has been 
linked to the CENTCOM Twitter hack in January of this year.
    Hussain was quick to praise the Garland attack and issued a warning 
that same night: ``The knives have been sharpened; soon we will come to 
your streets with death and slaughter!'' This attack exemplifies a new 
era in which terrorism has gone viral.
    Extremists issued a ``call to arms'' to attack an event, a 
radicalized follower clearly heeded that call, and he took steps to 
make sure his act of violence would spread and motivate more. Social 
media networks have become an extension of the Islamist terror 
battlefields overseas, turning home-grown extremists into sleeper 
operatives and attackers.
    The proliferation of jihadist propaganda on-line has established a 
new front in our battle against Islamist extremists. We are no longer 
hunting terrorists living in caves who only communicate through 
couriers. We are facing an enemy whose messages and calls to violence 
are posted and promoted in real time.
    For example, last month, the threat level at military bases across 
the country was elevated after ISIS supporters posted the names of 
individuals serving in the military on-line and quickly spread on 
social media.
    Aspiring fanatics can receive updates from hard-core extremists on 
the ground in Syria via Twitter, watch ISIS bloodlust on YouTube, view 
jihadi selfies on Instagram, read religious justifications for murder 
on JustPasteIt, and find travel guides to the battlefield on Ask.fm. 
Jihadi recruiters are mastering the ability to monitor, and prey upon, 
Western youth susceptible to the twisted message of Islamist terror. 
They seek out curious users who have questions about Islam or want to 
know what life is like in the so-called Islamic State. They engage, 
establish bonds of trust, and assess the commitment of their potential 
recruits.
    From there, extremists direct users to continue the conversation on 
more secure apps, where secure communication hides their messages from 
our intelligence agencies. Such communications can include advice for 
traveling to terror safe havens, contact information for smugglers in 
Turkey, or the membership process for joining ISIS itself.
    I know the officials appearing before us today are disturbed by 
these trends. Mobile apps like Kik and WhatsApp--as well as data-
destroying apps like Wickr and Surespot--are allowing extremists to 
communicate outside of the view of law enforcement. Equally as 
worrisome are ISIS attempts to use the ``dark'' or ``deep web.''
    These websites hide IP addresses and cannot be reached by search 
engines, giving terrorists another covert means by which they can 
recruit fighters, share intelligence, raise funds, and potentially plot 
and direct attacks undetected.
    ISIS tailors its message for specific audiences around the globe 
and, in doing so, projects power far beyond its growing safe havens by 
amplifying its battlefield successes and winning over new converts 
across the world. Its media sophistication helps legitimize its self-
proclaimed Caliphate and its perverse interpretation of Islam.
    This stands in stark contrast to al-Qaeda's past outreach, which 
relied on tightly-controlled, top-down messaging and propaganda more 
difficult for aspiring jihadists to find. Today, ISIS is instead taking 
a ``grass-roots'' approach to terror, seeding its repressive worldview 
from the ground up.
    From digital magazines to on-line videos that glorify barbaric 
murder, ISIS is using its multi-platform engagement to create a jihadi 
subculture that supports its violent ideology and encourages attacks 
against the United States and its allies. Their tactics are a sea 
change for spreading terror, and they require from us a paradigm shift 
in our counterterrorism intelligence and operations.
    For example, we can start by doing what FBI Director Comey 
suggested--``shaking [the] trees more aggressively''--to quickly 
identify and engage potential homegrown jihadis. But this is a dynamic 
new front in the war against Islamist terror, and it will require a new 
approach with a heavy focus on the ideological battle space.
    I am grateful to have three witnesses today that are dealing first-
hand with how terror is going viral. I look forward to hearing their 
testimony and recommendations for confronting this challenge.

    Chairman McCaul. With that, I now recognize the Ranking 
Member.
    Mr. Thompson. Thank you, Mr. Chairman. Thank you for 
holding today's hearing.
    I would like to also thank the witnesses for appearing 
today.
    On May 3, the American Freedom Defense Initiative, which is 
recognized as a hate group by the Southern Poverty Law Canter, 
organized a Muhammad art exhibit and contest event in Garland, 
Texas.
    Two violent extremists armed with assault rifles and body 
armor attacked police that were providing security to the 
event, resulting in the wounding of a dedicated police officer. 
According to the FBI, just hours before the Garland attack, a 
bulletin was issued to State and local police stating that one 
of the assailants may have an interest in traveling to the 
event. Unfortunately, the local police stated that the bulletin 
was not received in time.
    Mr. Chairman, by no means am I saying that this bulletin 
would have changed the outcome of the situation, but I do think 
that this illustrates that we need to continue looking into 
information sharing with State and local police and also 
listening to the boots on the ground on how to recognize and 
prevent acts of home-grown violent extremism.
    In the days following the attack in Garland, supporters of 
the terrorist group ISIL praised the attack. After the attack, 
it was discovered that one of the gunmen detailed his plans to 
leave the country and travel to Syria to join ISIL on Twitter. 
The assailant's plans were disrupted when the FBI arrested some 
people that planned to travel with him. It also came to light 
that he engaged with other ISIL followers from around the world 
through Twitter.
    Mr. Chairman, we know that the threats from foreign and 
domestic terrorist groups are not going away overnight. Using 
the internet and social media to recruit members, plan attacks, 
and spread ideology is not novel. As the director of the 
National Counterterrorism Center pointed out in a hearing in 
this committee in February, ISIL's exploitation of social media 
plays a prominent role in the group's ability to recruit 
fighters from around the world. But as we look at social media 
and how violent extremist propaganda is spread, we must look at 
ways to countermessage. Both sides of the aisle are engaged in 
an examination of the President's Countering Violent Extremism 
strategy. The Department has a vital role to play in carrying 
out that strategy, as evidenced by the fact that there is a 
dedicated CVE coordinator, David Gersten, working.
    Mr. Chairman, at this time, I request that this committee 
have an open oversight hearing where we can take testimony from 
DHS's CVE coordinator about the Department's role in 
implementing the CVE strategy.
    Furthermore, we know that more work remains to ensure that 
our foreign partners are willing to and able to stop and 
identify foreign fighters at their borders. Last Friday, the 
U.N. Council issued an unprecedented statement urging countries 
to enforce border controls that allow suspected terrorists to 
travel across international borders. The director of the NCTC 
also stated at our February hearing that there was work to be 
done in this area. I know that the committee has a task force 
that is examining this issue, and we should be receiving their 
recommendations soon.
    Mr. Chairman, as I stated in our last hearing on this 
issue, we all have a stake to prevent terrorist attacks against 
Americans and on American soil. Accordingly, I encourage this 
committee to continue serious discussions on how to counter 
violent extremist messages while protecting Constitutional 
rights. As we consider this threat, we need to foster greater 
information sharing among diverse partners and seek new ways to 
work together to pursue effective and promising approaches to 
violent extremism.
    With that, Mr. Chairman, I yield back.
    [The statement of Ranking Member Thompson follows:]
             Statement of Ranking Member Bennie G. Thompson
                              June 3, 2015
    On May 3, the American Freedom Defense Initiative, which is 
recognized as a hate group by the Southern Poverty Law Center, 
organized the ``Muhammad Art Exhibit and Contest'' event in Garland, 
Texas. Two violent extremists, armed with assault rifles and body 
armor, attacked police that were providing security to the event, 
resulting in the wounding of a dedicated police officer. According to 
the FBI, just hours before the Garland attack, a bulletin was issued to 
State and local police stating that one of the assailants may have had 
an interest in traveling to the event.
    Unfortunately, the local police stated that the bulletin was not 
received in time. By no means am I saying that this bulletin would have 
changed the outcome of the situation, but I do think that this 
illustrates that we need to continue looking into information sharing 
with the State and local police and also listening to the boots on the 
ground on how to recognize and prevent acts of home-grown violent 
extremism.
    In the days following the attack in Garland, supporters of the 
terrorist group ISIL praised the attack. After the attack, it was 
discovered that one of the gunmen detailed his plans to leave the 
country and travel to Syria to join ISIL on Twitter. The assailant's 
plans were disrupted when the FBI arrested some people that planned to 
travel with him. It also came to light that he engaged with other ISIL 
followers from around the world through Twitter.
    We know that the threats from foreign and domestic terrorist groups 
are not going away overnight. Using the internet and social media to 
recruit members, plan attacks, and spread ideology is not novel. As the 
director of the National Counterterrorism Center pointed out in a 
hearing in this committee in February, ISIL's exploitation of social 
media plays ``a prominent role'' in the group's ability to recruit 
fighters from around the world.
    But as we look at social media and how violent, extremist 
propaganda is spread, we must look at ways to counter-message. Both 
sides of the aisle are engaged in an examination of the President's 
Countering Violent Extremism strategy. The Department has a vital role 
to play in carrying out that strategy, as evidenced by the fact that 
there is a dedicated CVE coordinator, David Gersten.
    At this time, I would request that this committee to have an open 
oversight hearing where we can take testimony from the DHS CVE 
coordinator about the Department's role in implementing the CVE 
strategy. We know that more work remains to ensure that our foreign 
partners are willing and able to stop and identify foreign fighters at 
their borders.
    Last Friday, the U.N. Security Council issued an unprecedented 
statement urging countries to enforce border controls that allow 
suspected terrorists to travel across international borders. The 
director of the NCTC also stated at our February hearing that there was 
work to be done in this area. I know that the committee has a Task 
Force that is examining this issue, and we should be receiving their 
recommendations soon.
    As I stated at our last hearing on this issue, we all have a stake 
prevent terrorist attacks against Americans and on American soil. I 
encourage this committee to continue serious discussions on how to 
counter violent extremist messages, while protecting Constitutional 
rights. As we consider this threat, we need to foster greater 
information sharing among diverse partners and seeks new ways to work 
together to pursue effective and promising approaches to counter 
violent extremism.

    Chairman McCaul. I thank the Ranking Member.
    Let me first, I ask unanimous consent that the gentleman 
from Texas, Mr. Sessions, the Chairman of the Rules Committee, 
also represents Garland, Texas, be allowed to sit on the dais 
and participate in today's hearing.
    Without objection, that is so ordered.
    The gentleman from Texas is recognized, Mr. Smith.
    Mr. Smith. Mr. Chairman, I would like to ask unanimous 
consent to be recognized out of order for 2 minutes.
    Chairman McCaul. Without objection.
    Mr. Smith. Mr. Chairman, I appreciate your and the Ranking 
Member's indulgence.
    I will yield my 2 minutes to the gentleman from Texas, the 
Chairman of the Rules Committee, Pete Sessions.
    Chairman McCaul. Mr. Sessions is recognized.
    Mr. Sessions. Mr. Chairman, thank you very much.
    My thanks to Chairman Lamar Smith, my colleague from San 
Antonio, for kindly yielding time to me.
    I also want to thank the young Chairman of the Homeland 
Security Committee, the gentleman from Austin, Michael McCaul, 
as well as the Ranking Member, my good friend, Bennie Thompson, 
and Members of the committee.
    Thank you for inviting me to participate in today's hearing 
to discuss the ISIS-inspired terrorist attack in Garland, 
Texas.
    As the proud Representative of the 32nd Congressional 
District of Texas, I am pleased to notify each and every one of 
you that all of north Texas is committed to fighting terrorism. 
Specifically, the city of Garland, Texas, is a diverse all-
American city that continues to attract families and businesses 
with its thriving economy and growing opportunities. Since 
1891, this city has grown from a small cotton-farming community 
to a thriving metropolitan area outside of Dallas with almost a 
quarter-million people that call Garland, Texas, home.
    The mayor of Garland, Texas, Doug Athas is a friend of 
mine, and he works closely with his city managers, William 
Dollar and Bryan Bradford, as well as the police chief, Mitch 
Bates, and local officials, including the school board and 
other community leaders to ensure that Garland is a great, safe 
city to live in.
    On Sunday, March 3--May 3, 2015, a courageous Garland 
police officer swiftly acted to protect the people of Garland 
from what could have been a devastating situation. I would like 
to commend the police officer and all members of local law 
enforcement who stood in the face of terrorism and protected 
countless innocent lives.
    I remain committed to working with each of my colleagues in 
the House, local leaders, and local law enforcement to uphold 
our duty as elected officials to protect the people who we 
serve. It is my sincere hope at today's hearing, that we can 
learn positive lessons so that other cities and communities can 
be as prepared as Garland, Texas, if an event were to happen in 
their local community.
    Mr. Chairman, thank you very much. I yield back my time.
    Chairman McCaul. I thank the gentleman from Texas.
    Other Members of the committee are reminded that opening 
statements may be submitted for the record.
    Pleased to have a distinguished panel of witnesses before 
us today on this important topic. The first, John Mulligan, 
joined the National Counterterrorism Center in March 2015 as 
deputy director. Previously, he served as associate deputy 
director for counterterrorism at the National Security Agency.
    Next we have Mr. Francis Taylor. Assumed his post as under 
secretary for intelligence and analysis at the Department of 
Homeland Security in April 2014. Previously, he served as 
assistant secretary of state for diplomatic security and 
director of the Office of Foreign Missions.
    Finally, we have Mr. Michael Steinbach, who was appointed 
FBI director by James Comey as the assistant director of the 
Counterterrorism Division in July 2014. Prior to assuming his 
current position, he served as assistant director of the 
counterterrorism division and the acting section chief for the 
FBI's International Terrorism Operations Center.
    I want to thank all of you for being here today.
    The Chairman now recognizes Deputy Director Mulligan to 
testify.

   STATEMENT OF JOHN J. MULLIGAN, DEPUTY DIRECTOR, NATIONAL 
                    COUNTERTERRORISM CENTER

    Mr. Mulligan. Thank you, Chairman McCaul, Ranking Member 
Thompson, and Members of the committee. I greatly appreciate 
the opportunity to discuss some of the recent events of 
interest to the committee and the growing threat of extremists' 
use of social media to National security.
    I am pleased to join my colleagues from Homeland Security 
and the Federal Bureau of Investigation. As you already know, 
we work closely every day as part of the counterterrorism 
community, and that interagency partnership is one of the 
keystones of our homeland defense.
    This morning I will speak briefly to you about the recent 
attempted attack in Garland, Texas, and the role of violent 
extremist social media in that event. Then I will transition to 
broader remarks on ISIL's use of social media before concluding 
by sharing some of the efforts NCTC and our partners across the 
Federal Government are pursuing to counter that avenue of 
threat.
    As has already been described, last month two U.S. citizens 
attacked an art exhibit and cartoon contest in Garland, Texas. 
The attackers arrived on the date of the event, exited their 
car, and opened fire with semiautomatic rifles, injuring a 
guard on the scene. Thankfully, local law enforcement partners 
in the area were aware of the potential for violence and were 
able to respond quickly to prevent the attack from injuring or 
killing others. This event highlights the growing threat our 
Nation faces from a new generation of terrorists, often 
operating from afar, who use social media to find like-minded 
associates within our borders who can be motivated to violence, 
attacking with little or no warning.
    As was indicated, in this case, an on-line ISIL supporter 
on Twitter posted a link to an article with information about 
the cartoon contest a few weeks before-hand. This supporter's 
posting also included a message suggesting extremists should 
follow in the footsteps of the Charlie Hebdo attack in Paris.
    Days later, one of the Garland attackers reached out to 
ISIL supporters and asked to move their communications to 
private Twitter messaging. The same individual also urged 
Twitter users to follow the account of a known ISIL member who 
had been trying to incite ISIL supporters to conduct attacks in 
the West. Just hours before the attack, the same attacker 
posted a message on his Twitter feed indicating he had pledged 
allegiance to ISIL with the accompanying hashtag 
``TexasAttack''.
    ISIL did not claim responsibility for directing or managing 
the attack, but ISIL operators praised the attackers and 
encouraged others to follow suit. The group also highlighted 
the attack in the most recent edition of its on-line magazine, 
which it publishes in several languages.
    As we examine ISIL's broader efforts in social media, like 
any brand that seeks to target young people, ISIL continually 
innovates its on-line marketing to ensure it is developing 
effectively crafted messages. Using well-known U.S.-based 
platforms such as a YouTube, Facebook, or Twitter, ISIL works 
to ensure its media releases reach audiences far and wide 
through reposting, regeneration of follow-on links, and 
translations into multiple languages. ISIL also employs 
marketing tradecraft, attaching its messages to trending topics 
in order to gain additional readership. Consequently, its 
social media presence is more wide-spread than any other 
terrorist group.
    Since the beginning of this year, ISIL has published more 
than 1,700 pieces of terrorist messaging. These include videos, 
pictorial reports, and on-line magazines. These products are 
often very professional in their presentation and timely in 
their delivery, underscoring ISIL's commitment to master 
multiple social media tools in order to advance their extremist 
objectives.
    As the committee already knows, ISIL has often shaped its 
media contents to amplify the effect of its violent operations 
and activities. They do so in an attempt to project an image of 
power and intimidation. They also employ a complementary 
approach to enhance recruitment, a projection of the self-
described caliphate as an idealized family-friendly environment 
in which ideological, religious, or personal fulfillment can be 
realized. This narrative has successfully induced large numbers 
of young people to make their way to the combat zones of Syria 
and Iraq.
    During the past few months, ISIL's social media operators 
have more aggressively pursued a new line of effort. Following 
statements from senior ISIL leaders encouraging lone-actor 
attacks against the West, these operators are now practicing 
on-line recruitment and provisioning of terrorist instruction 
intended to precipitate civilian attacks within the United 
States and other nations. Sadly, as we have seen, some 
individuals have embraced the messaging and have sought to 
commit acts of violence on this basis.
    When it comes to countering the spread of ISIL's violent 
messaging, several social media platforms have taken the 
initiative to close down accounts advocating terrorism and 
violent acts. They do this upon detection. However, energetic 
efforts to prohibit the propagation of violent messaging has 
not been universal, and there is still much work to be done to 
encourage greater vigilance and a broader sense of corporate 
responsibility to address this threat to public safety.
    For our part, we are employing the knowledge that we have 
developed--that has been developed by the U.S. counterterrorism 
community to refine and expand our prevention efforts. We have 
seen a steady proliferation of more proactive and more engaged 
community awareness initiatives across the United States, all 
working with the goal of giving communities information and 
tools they need to identify the threats posed by violent 
extremist on-line recruitment and to effectively engage it 
before it manifests in violence.
    With our DHS colleagues, we have created and regularly 
deliver a community resilience exercise program, a table-top 
exercise that brings together law enforcement and community 
leaders to run through a hypothetical scenario and potential 
responses.
    In summary, we need multi-level partnership efforts to 
enable local U.S. communities to build the dual capabilities of 
addressing radicalization and ensuring resilient responses when 
an individual moves from radical ideology to radical violence. 
We must continue to develop our knowledge of evolving terrorist 
on-line tactics, and we need to communicate that knowledge so 
that it can be used to minimize the application of terrorist 
on-line tactics against our citizens.
    I will stop there, Mr. Chairman. Thank you again for the 
opportunity to address the committee.
    [The prepared statement of Mr. Mulligan follows:]
                 Prepared Statement of John J. Mulligan
                              June 3, 2015
    Thank you Chairman McCaul, Ranking Member Thompson, and Members of 
the committee. I appreciate this opportunity to discuss the potentially 
tragic event in Garland, Texas, last month, which we thankfully 
averted. And I want to more broadly address the growing threat of 
violent extremists' use of social media to our National security. I'm 
pleased to join my colleagues and close partners from the Department of 
Homeland Security and the Federal Bureau of Investigation.
                              garland plot
    As you already know, last month, two U.S. citizens attacked an art 
exhibit and cartoon contest in Garland, Texas. The attackers arrived on 
the last day of the event, exited their car, and opened fire with semi-
automatic rifles, injuring a guard on the scene.
    Thankfully, our law enforcement partners in the area were aware of 
the potential for violence and were able to respond quickly to prevent 
the attack from becoming a greater tragedy.
    This event, however, exemplifies the challenge posed by home-grown 
violent extremists who can be motivated to violence quickly and have 
the means to attack without warning. It also highlights the growing 
threat our Nation faces from a new generation of terrorists who find 
like-minded associates on the internet and social media to share their 
violent extremist ideology.
                 garland attackers' use of social media
    Let me explain more about how the Garland attack plans evolved. 
Less than 2 weeks before the attack, an on-line ISIL supporter posted a 
link on Twitter to a news article with information about the cartoon 
contest. This supporter's posting also included a message that 
suggested people should follow in the footsteps of the Charlie Hebdo 
attackers in Paris.
    In addition, one of the Garland attackers reached out to the ISIL 
supporters and asked to move their communications to private Twitter 
messages.
    Approximately 15 minutes before the attack, the same attacker 
posted a message on his Twitter feed indicating he had pledged 
allegiance to ISIL with the accompanying hashtag TexasAttack, which we 
now know was an indicator of his intent to target Garland.
    While ISIL did not claim responsibility for the attack, many of its 
supporters, including a known ISIL member, praised the Garland 
attackers and encouraged others to follow suit. The group also 
highlighted the attack in its most recent edition of its English-
language magazine Dabiq, in which it praised the attackers for seeking 
vengeance for the honor of the Prophet Muhammad.
            broader commentary on isil's use of social media
    Like every other brand that targets young people, ISIL continually 
innovates to ensure it is using each new on-line marketing tool. 
Consequently, its social media presence--and that of its followers--is 
more wide-spread than that of any other terrorist group. In addition to 
maximizing its spread of terrorist messaging, the group shares guidance 
on how anyone can support ISIL and connects with like-minded 
individuals who become potential recruits.
    In terms of the group's media efforts, ISIL has published more than 
1,700 pieces of official terrorist messaging since the beginning of 
this year, including videos, pictorial reports, and magazines. These 
products are often very professional in appearance and continue to 
improve in quality with each new release, suggesting the group places a 
high priority on trying to win over the hearts and minds of new 
followers--including Westerners.
    ISIL relies on the internet to send this material outside of Iraq 
and Syria and has shown a particular affinity for Twitter to 
disseminate official messaging, probably because the platform allows 
the group to reach a very broad audience. ISIL supporters also 
regularly use other platforms, such as Ask.FM and Facebook, to share 
information related to the self-declared Islamic State, including 
specific guidance on how to travel to Syria and how to avoid Western 
authorities.
    ISIL supporters use the privacy of Twitter's direct messaging 
capability and encrypted messaging applications to discuss topics they 
deem too sensitive to display on their public accounts, such as travel 
facilitation into Syria or Iraq. We increasingly have seen ISIL 
supporters publicize their use of encrypted messaging applications on 
social media to let aspiring violent extremists and terrorists know 
that there are secure avenues by which they can communicate--after they 
make public contact on-line.
    The group takes advantage of all the features and functions of 
social media to ensure wide-spread distribution of its messages. ISIL 
supporters on Twitter, for example, have used various tactics to expose 
its messaging to a more mainstream audience such as hijacking popular 
hashtags associated with pop culture figures or current events and 
using commercial applications to automate its tweets to make the group 
a trending topic.
    It's important to be clear, however, that a video or series of 
pictures probably are not going to radicalize or mobilize to violence 
individuals who are just beginning to show interest in the group or 
violent extremist ideologies. Rather, these videos can serve as 
discussion points, which enable other ISIL supporters to find one 
another and discuss their support for the group with like-minded 
individuals.
    During the past few months, numerous statements from senior ISIL 
leaders have called for lone-offender attacks against the West. We 
remain highly concerned by numerous people in the homeland who are 
buying into ISIL's distorted messaging. While we recognize companies 
have some initiatives underway to curb terrorist use of their 
platforms, there is still much work to be done.
                   countering violent extremism (cve)
    The volume of individuals going abroad as foreign terrorist 
fighters to Iraq and Syria only emphasizes the importance of 
prevention. Enduring security against terrorism--and defeat of 
terrorist organizations like ISIL--rests in significant part on our 
ability to diminish the appeal of terrorism and to dissuade individuals 
from joining them in the first place. To this end, we continue to 
refine and expand the preventive side of counterterrorism. Working in 
close coordination with the Department of Justice (DOJ), the Department 
of Homeland Security (DHS), and the Federal Bureau of Investigation 
(FBI), the National Counterterrorism Center (NCTC) is engaged in this 
work all across the country.
    We collaborated with DHS to create tools that help build community 
resilience across the country. Additionally, we have seen a steady 
spread of proactive community awareness efforts across the United 
States. These efforts aim to give communities both the information and 
the tools they need to recognize violent extremist ideologies and to 
intervene before radicalization to violence.
    In concert with DOJ, DHS, and FBI, NCTC met with communities in 
Denver, Sacramento, Buffalo, and Minneapolis to raise community and law 
enforcement awareness of the terrorist recruitment threat. Our joint 
presentation, developed in partnership with DHS, addresses the specific 
issue of foreign fighter recruitment in Syria and Iraq; and we have 
received a strong demand for more of this outreach.
    This is an effort to share information about how members of our 
communities are being targeted and recruited to join terrorists 
overseas. This is not a law enforcement-oriented effort designed to 
collect information. Seen in that light, we have had a remarkably 
positive reaction from the communities with which we have engaged.
    With our DHS colleagues, we have also created--and regularly 
orchestrate--the Community Resilience Exercise. This is a table-top 
exercise that assembles local law enforcement and community leadership 
in tackling a hypothetical violent extremist or foreign fighter-related 
scenario, including a hypothetical attack. The goal of the exercise is 
to build capacity within municipalities to mitigate the terrorist 
threat.
    We are also encouraging our local partners to implement models for 
countering violent extremism similar to existing crime prevention 
efforts. This approach mirrors the way, for example, that local 
partners, including law enforcement, schools, social service providers, 
and communities, have come together to provide alternative pathways and 
outlets for people who might be vulnerable to joining a gang. We have 
found that the more resilient the community, the less likely its 
members are to join a terrorist group.
                           counter-messaging
    As many community leaders have admirably pushed terrorist 
narratives out of their public spaces, these narratives have found 
refuge in virtual spaces. We understand that to truly counter violent 
extremist narratives, credible voices in communities should be 
encouraged to create alternative narratives that are attractive to 
target audiences. The role of these credible voices in communities as 
front-line responders cannot be overstated. Put plainly, we believe 
encouraging these community voices is an important and essential 
strategy.
    However, communities best suited for repelling these terrorist 
narratives have not generally followed terrorist migration into on-line 
spaces. Communities whose young people are vulnerable to terrorist 
messaging have inconsistent capacities when it comes to countering that 
messaging. We believe this is the result of communities' fear of being 
associated with violent extremist elements, unfamiliarity with 
terrorists' on-line presence and tactics, and a lack of resources to 
create and disseminate alternative on-line content. Without confidence-
building measures and proper training and resources, these communities 
will be hard pressed to counter ISIL's dominant messaging.
    We are working with our partners and local communities to lessen 
these obstacles and to identify capacity-building measures. For 
example, we are connecting community leaders with entertainment 
industry executives. And we are actively trying to form public-private 
partnerships. For instance, the Peer2Peer program--a public-private 
partnership between EdVenture Partners and the Department of State--has 
empowered university students to create counter narratives to ISIL on 
social media. With programs like these, we have seen that private 
sector and community contributors can be much more nimble, creative, 
and credible on-line.
    It is in everyone's interest to help mitigate this fear and 
encourage the use of law-abiding measures that communities can employ 
to confront terrorist narratives in virtual environments. To achieve 
this objective, we can provide training and information that will 
enable communities to use social and technical tools in the fight 
against on-line violent extremism. We can cultivate relationships 
between communities, the private sector, and the Federal Government 
based on trust and mutual benefit.
                               conclusion
    In summary, confronting these threats and working with resolve to 
prevent another terrorist attack remains the counterterrorism 
community's most important mission. This year, NCTC enters its second 
decade of service. While the Center has matured tremendously during 
that period, we are focused on positioning ourselves to be better 
prepared to address the terrorist threat in the decade to come. We 
expect this threat will increasingly involve terrorists' use of on-line 
platforms.
    Chairman McCaul, Ranking Member Thompson, and Members of the 
committee, thank you for the opportunity to testify before you this 
morning. I want to assure you that our attention is concentrated on the 
security crises in Iraq and Syria--and rightly so. But we continue to 
detect, disrupt, and defeat threats from across the terrorist spectrum.
    Thank you all very much, and I look forward to answering your 
questions.

    Chairman McCaul. Thank you, Mr. Mulligan.
    The Chairman now recognizes Under Secretary Taylor to 
testify.

 STATEMENT OF FRANCIS X. TAYLOR, UNDER SECRETARY, INTELLIGENCE 
       AND ANALYSIS, U.S. DEPARTMENT OF HOMELAND SECURITY

    Mr. Taylor. Mr. Chairman McCaul, Ranking Member Thompson, 
Members of the committee, thank you for the opportunity to 
appear with my colleagues to discuss the home-grown violent 
extremist threat to our country.
    The terrorist threat today is more decentralized and 
complex. It is not constrained to one group, race, ethnicity, 
National origin, religion, or geographic location. ISIL, al-
Qaeda, and other like-minded terrorist organizations have 
expanded their efforts to recruit individuals for violent 
action at home and to continue to be effective in recruiting 
foreign fighters from Western countries to travel to Syria and 
Iraq.
    Core al-Qaeda and its affiliates remain a major concern for 
DHS. The group and its affiliates maintain the intent and in 
some cases the capability to facilitate and conduct attacks 
against U.S. citizens and facilities. Their attack planning 
continues, despite our persistent efforts to disrupt them.
    Through their sophisticated messaging capability as Mr. 
Mulligan has mentioned, ISIL has been able to quickly reach a 
global audience and encourage acts of violence, inspiring U.S. 
citizens to travel to Syria to recruit and radicalize the 
violence--Western home-grown violent extremists here at home. 
This is concerning because mobilized lone offenders present law 
enforcement with limited opportunities for detection and to 
disrupt their plots. The recent attack in Garland, Texas, 
reinforced the importance of close collaboration and 
information sharing between DHS, the FBI, other Federal, State, 
local, and private-sector partners.
    Prior to the attack, the FBI and DHS shared with the Texas 
fusion center and local law enforcement warnings that the event 
was at risk of being targeted for violent extremism. These 
warnings led to the preparations taken by the Garland PD that 
helped thwart the attack.
    Our top priority to counter this evolving threat is 
information and intelligence sharing with our partners. DHS, 
I&A, and the National Protection and Programs Directorate's 
field personnel are instrumental in this effort and 
anticipate--to anticipate potential terrorist actions and to 
propose protective security measures that help build resilience 
in our communities across the country.
    As an example of close coordination intelligence sharing 
between DHS, I&A, and our State and local partners was the 
protest last week in Phoenix, Arizona, this past weekend. We 
proactively contacted our partners on the ground and shared 
intelligence from the FBI and DHS sources in real time to help 
ensure local leadership and law enforcement had the necessary 
information to protect their communities and their citizens.
    Additionally, we reached out to the faith community in 
Phoenix to provide information regarding the potential violent 
activities so that they could take preventative actions in 
their communities. It is important that we continue to build 
these partnerships with State and local law enforcement in a 
way that enhances community relationships and builds resilience 
to violent extremist recruitment.
    DHS now has a senior executive, the DHS coordinator for 
countering violent extremism, whose sole role is to coordinate 
and improve the Department's CVE efforts. The new DHS CVE 
strategy emphasizes the strength of local communities and the 
premise that well-informed and well-equipped families, 
communities, and front-line personnel represent the best 
defense against violent extremism.
    DHS will continue to work with our international 
counterparts and our colleagues within the FBI, NCTC, the State 
Department, and across the IC to identify potential threats to 
our security both at home and abroad.
    Chairman McCaul, Ranking Member Thompson, and distinguished 
Members of the committee, thank you for the opportunity to 
appear before you today, and I look forward to your questions.
    [The prepared statement of Mr. Taylor follows:]
                Prepared Statement of Francis X. Taylor
                              June 3, 2015
    Chairman McCaul, Ranking Member Thompson, and distinguished Members 
of the committee, thank you for the opportunity to appear before you 
today--along with my colleagues from the Federal Bureau of 
Investigation (FBI) and the National Counterterrorism Center (NCTC)--to 
discuss the foreign fighter threat and current efforts to disrupt 
terrorist travel.
    For some time, the U.S. Government, including the Department of 
Homeland Security (DHS), has been concerned that terrorist groups 
operating in permissive environments present a significant security 
threat to the United States and our allies. Events in Australia, 
Canada, and Europe underscore that the foreign fighter threat is no 
longer a problem restricted to foreign conflict zones such as those in 
Syria or Western Iraq. The Islamic State of Iraq and the Levant (ISIL) 
and other like-minded terrorist organizations have been effective in 
recruiting fighters from Western countries, as well as recruiting 
individuals for violent action at home.
    The threat is real, continues to evolve, and is a present danger 
across the globe. The recent attack in Garland, Texas demonstrates the 
importance of close collaboration among I&A, FBI, NCTC, and our 
Federal, State, local, and private-sector partners. Prior to the art 
exhibit event at the Curtis Culwell Center, the intelligence community 
(IC) shared information with Texas fusion centers indicating the event 
had a risk of being targeted by violent extremists. When the 
perpetrators opened fire outside the exhibit on May 3, 2015, the attack 
was thwarted by the Garland Police Department. The information shared 
with Texas officials contributed to the overall threat picture and 
helped inform their security procedures for the event.
    We recognize that the threat environment is ever-evolving and 
becoming increasingly complex and decentralized. For that reason, DHS 
is continuing to encourage an informed and aware public capable of 
self-advocacy, as promoted by the ``If You See Something, Say 
SomethingTM'' campaign, as well as our more specific 
bulletins. We recognize protecting the homeland is a shared 
responsibility.
    In my testimony today, I will discuss the foreign fighter threat 
and highlight specific efforts DHS is undertaking to identify, address, 
and minimize the foreign fighter threat to the United States and to our 
allies.
                         foreign fighter threat
    While much of today's hearing will focus on terrorist threats from 
Syria and Iraq, it is important to emphasize that the terrorist threat 
is fluid and cannot be associated with one group, race, ethnicity, 
national origin, religion, or geographic location. Many terrorist 
groups continue to pose a risk to our security and safety.
    Core al-Qaeda (AQ) and its affiliates, such as al-Qaeda in the 
Arabian Peninsula (AQAP), remain a major concern for DHS. Despite the 
deaths of many of AQ's senior leaders, the group and its affiliates 
maintain the intent, and, in some cases, the capability to facilitate 
and conduct attacks against U.S. citizens and facilities. The group and 
its affiliates have also demonstrated that capability to adjust 
tactics, techniques, and procedures for targeting the West.
    Events in recent weeks have also made it clear why DHS and others 
in the counterterrorism and law enforcement communities are concerned 
about the threats posed by terrorists operating out of Syria and Iraq. 
In addition to al-Qaeda loyalists, a number of those involved in 
terrorist operations within Syria and Iraq are affiliated with ISIL. 
ISIL aspires to gain territory and attempt to overthrow governments in 
the region and eventually beyond. The group's experience and successes 
on the battlefields in Syria and Iraq have armed it with advanced 
capabilities that most terrorist groups do not have.
    ISIL has also publicly threatened ``direct confrontation'' with the 
United States, which is consistent with the group's media releases 
since last summer that have alluded to attacking the United States. 
Through their sophisticated messaging capability, which includes the 
dissemination of high-quality media content on multiple on-line 
platforms, ISIL has been able to quickly reach a global audience and 
encourage acts of violence, as well as inspire U.S. citizens to travel 
to Syria to join in the conflict. Also on a daily basis, Syria-based 
ISIL members are attempting to recruit and radicalize to violence 
Western HVEs on social media, especially Twitter. The reach and 
popularity of social media has lowered the bar for Homegrown Violent 
Extremists (HVEs) to connect with terrorist organizations, such as 
ISIL.
    ISIL's calls for lone offender attacks are likely resonating with 
HVEs because the group's self-proclaimed Caliphate resonates with 
individuals looking to be part of a larger cause, it regularly releases 
high-quality English-language videos and on-line magazines on-line, and 
their Western fighters are accessible on social media to HVEs 
interested in mobilizing. The IC assesses there is currently an 
elevated threat of HVE lone offender attacks by ISIL sympathizers, such 
as the Garland attackers, which is especially concerning because 
mobilized lone offenders present law enforcement with limited 
opportunities to detect and disrupt their plots.
    The on-going conflict in Syria has emerged as a draw for more than 
22,000 foreign fighters. More than 180 U.S. Persons and at least 3,700 
Westerners have traveled or attempted to travel to Syria to participate 
in the conflict. We have also noted that veteran al-Qaeda fighters have 
traveled from Pakistan to Syria to take advantage of the permissive 
operating environment and easy access to foreign fighters. We remain 
concerned that foreign fighters from the United States or elsewhere who 
may go to Syria and Iraq, become more radicalized to violence, and 
return to the United States or their home country and conduct attacks 
on their own or in concert with others. Furthermore, we also are 
concerned that U.S. Persons who join violent extremist groups in Syria 
could gain combat skills and connections with violent extremists, and 
possibly become persuaded to conduct organized or lone-actor style 
attacks that target U.S. and Western interests abroad. We also are 
aware of the possibility that Syria could emerge as a base of 
operations for al-Qaeda's international agenda, which could include 
attacks against the homeland.
               dhs response to the foreign fighter threat
Aviation Security
    Terrorist organizations like AQAP continue to pose a serious threat 
to international civil aviation. As we have seen in AQAP's three 
attempted aviation attacks against the homeland--the airliner plot of 
December 2009, an attempted attack against U.S.-bound cargo planes in 
October 2010, and an airliner plot in May 2012--terrorist groups have 
shown a significant and growing sophistication in terms of bomb design 
and construction, operational skill, and innovation. In the past 3 
years terrorists have become increasingly interested in circumventing 
airport security screening through the use of improvised explosive 
devices (IEDs) concealed in cargo, commercial electronics, physical 
areas of one's body, in shoes or clothing, and in cosmetics and 
liquids.
    To address the terrorist threat to aviation, DHS continues to 
evaluate, modify, and enhance aviation security measures. For example, 
beginning in July 2014, DHS required enhanced screening at select 
overseas airports with direct flights to the United States. Weeks 
later, DHS added additional airports to the list, with the United 
Kingdom and other countries following with similar enhancements to 
their required aviation security operations. Following recent world 
events, in January 2015, the Transportation Security Administration 
(TSA) took steps to enhance the number of random searches of passengers 
and carry-on luggage boarding aircraft at U.S. airports. TSA, as 
directed by Secretary Johnson, conducted an immediate, short-term 
review to determine if additional security measures are necessary at 
both domestic and overseas last-point-of-departure airports. DHS 
continues to evaluate the implementation of aviation security measures 
with air carriers and foreign airports to determine if more is 
necessary, and will make the appropriate aviation security adjustments 
without unduly burdening the traveling public.
    In the long term, DHS is exploring the possibility of expanding 
pre-clearance operations at foreign airports with flights to the United 
States. This initiative provides for customs, immigration, and 
agriculture inspections of international air passengers and their goods 
by U.S. Customs and Border Protection (CBP) officials before the 
individual boards the plane for travel to the United States. Currently, 
CBP has pre-clearance operations at 15 airports and in 6 countries and, 
if appropriate, intends to enter into negotiations in order to expand 
air pre-clearance operations to new locations.
Information Sharing
    Information sharing with our domestic and foreign partners is vital 
in identifying developing threats both here and abroad. DHS is 
committed to continuing our efforts, along with our colleagues in the 
IC, to partner with European governments and other key counterterrorism 
allies to share information about terrorist threats.
    Since its inception, DHS has sought to broaden and deepen 
international liaison efforts to improve its ability to share 
information with key foreign allies. DHS has worked closely with the 
European Union through the U.S.-E.U. Passenger Name Records Agreement 
to facilitate the transfer of Passenger Name Records information to DHS 
by airlines that are subject to E.U. data protection laws. This 
agreement provides the highest standard of security and privacy 
protection. In addition, DHS has used its close partnerships with the 
countries in the Visa Waiver Program and the Five Country Conference to 
improve our respective abilities to identify illicit travel. The 
Preventing and Combating Serious Crime Agreement that DHS and 40 
foreign partners have signed provides each signatory with reciprocal 
access to fingerprint repositories for the purposes of combating 
serious crime and terrorism. Along with the immigration authorities of 
Australia, Canada, New Zealand, and the United Kingdom, we participate 
in the Five Country Conference. We have been negotiating a series of 
bilateral immigration information-sharing agreements with those 
countries that would reduce the likelihood that a person applying for 
asylum or a visa in any of the five countries who has an illicit past 
could hide that history. DHS also engages with foreign partners to 
share analytic and targeting methodology, chiefly by conducting 
analytic exchanges, to enhance the ability of DHS and foreign allies to 
identify individuals and travel routes, and prevent foreign fighter 
travel to foreign conflict zones.
    DHS is working with our interagency partners to inform our State, 
local, Tribal, territorial, and private-sector (SLTTP) partners of 
recent events and threats. Following the Paris Charlie Hebdo attacks, 
the Office of Intelligence and Analysis (I&A) prepared two Intelligence 
Notes and worked with the FBI to prepare and issue Joint Information 
Bulletins (JIBs); DHS shared both items Nation-wide with fusion 
centers. I&A field personnel, in partnership with DHS Office of 
Infrastructure Protection's Protective Security Advisors, are 
instrumental in threat information/intelligence dissemination to our 
SLTTP partners, characterizing threat information to jurisdictions, and 
proposing protective security considerations to prevent or mitigate 
terrorist activities. More recently, events in Garland, Texas highlight 
the critical importance of close collaboration between I&A and other 
Federal and SLTTP partners. The sharing of threat information 
concerning the art exhibit at the Curtis Culwell Center contributed to 
State and local law enforcement's overall threat picture for the event, 
which helped local authorities establish appropriate security 
procedures given the nature of the threat. Ultimately, the enhanced 
security posture helped prevent a potentially devastating mass casualty 
event.
    I&A continues to provide our State and local law enforcement 
partners with information about observable behavioral indicators of 
U.S. Persons planning or attempting travel to Syria. I&A has produced 
tailored assessments on the motivations of U.S. travelers, their travel 
patterns, the role social media is playing in radicalization to 
violence, and the ways in which U.S. Persons are providing material 
support to Syria-based violent extremist groups. Additionally, I&A has 
partnered with the FBI to produce JIBs and other products for State and 
local law enforcement on the trends and observable behaviors in 
individuals seeking to travel to Syria.
Tracking Foreign Fighters
    DHS is increasing efforts to track those who enter and leave Syria 
and may later seek to travel to the United States without a Department 
of State (DOS)-issued visa under the Visa Waiver Program (VWP). Working 
with the IC, DHS is working to ensure that individuals traveling from 
VWP countries are subject to enhanced vetting advance of travel to 
ensure National security and public safety.
    In response, this fall, DHS strengthened the security of the VWP 
through enhancements to the Electronic System for Travel Authorization 
(ESTA). Through ESTA, CBP conducts enhanced vetting of VWP applicants 
in advance of travel to the United States in order to assess whether 
they are eligible to travel under the VWP or could pose a National 
security risk or public safety threat. Through interagency information-
sharing agreements, CBP provides other U.S. Government agencies ESTA 
application data for law enforcement and administrative purposes to 
help assess risk and make a determination about an alien's eligibility 
to travel under the VWP without a visa. Additionally, CBP requires air 
carriers to verify that VWP travelers have a valid authorization before 
boarding an aircraft bound for the United States. ESTA has been a 
highly-effective security and vetting tool that has enabled DHS to deny 
travel under the VWP to thousands of prospective travelers who may pose 
a risk to the United States, prior to those individuals boarding a 
U.S.-bound aircraft. In response to increasing concerns regarding 
foreign fighters attempting to enter the United States through the VWP, 
DHS strengthened the security of the program through enhancements to 
ESTA. These improvements are designed to address the current foreign 
fighter threat, and provide an additional layer of security for the 
VWP. DHS determined that these ESTA enhancements would improve the 
Department's ability to screen prospective VWP travelers and more 
accurately and effectively identify those who pose a security risk to 
the United States. In addition, these enhancements to ESTA help the 
Department facilitate adjudication of ESTA applications. By requiring 
ESTA applicants to provide additional information, DHS can more 
precisely identify ESTA applicants who may be known or suspected 
terrorists. These enhancements also reduce the number of inconclusive 
matches that would previously have resulted in an ESTA denial.
    Because we view advance passenger screening as a critical element 
to an effective National counterterrorism capability, we have explained 
to many partner nations how they can compare airline manifests and 
reservation data against terrorist watch lists and other intelligence 
about terrorist travel. This is an area where the United States has 
developed a capability significantly more advanced than most other 
nations, both in identifying illicit travel and in protecting the 
privacy and civil liberties of all travelers, and we have worked to 
share this know-how in order to prevent terrorists from traveling the 
globe in anonymity. Developing this capability is also consistent with 
the new obligations introduced through U.N. Security Council Resolution 
2178, introduced last year by President Obama.
    DHS is also working with partner nations in Europe, the Middle 
East, and North Africa to increase our information sharing to track 
Syrian foreign fighters. These efforts allow the United States greater 
visibility on potential threats to the homeland, while similarly 
enhancing our partners' ability to track and prevent terrorist travel. 
The importance of this issue was highlighted by the United Nations 
Security Council's adoption of Resolution 2178 in September 2014, which 
provided new momentum for European and other governments to use air 
passenger screening technology and enhance information sharing through 
multilateral and bilateral channels.
Countering Violent Extremism
    HVEs from a range of ideological and religious backgrounds 
represent a persistent and often unpredictable threat based on their 
close familiarity with the United States and their ability to act with 
little or no warning as lone offenders or in small cells. Over the past 
few years we have seen HVEs plot to bomb high-profile targets, such as 
the Federal Reserve Bank in New York, the U.S. Capitol, and commercial 
establishments in downtown Chicago, Tampa, and Oakland. All these plots 
were disrupted.
    To address the need to counter violent extremism (CVE) in the 
homeland and to guard against the domestic ``lone offender''--someone 
who did not train at a terrorist camp or join the ranks of a terrorist 
organization overseas, but is inspired here at home by a group's social 
media, literature, or violent extremist ideology--Secretary Johnson has 
directed DHS to build on our partnerships with State and local law 
enforcement in a way that enhances community relationships and builds 
resilience to violent extremist recruitment. DHS now has a senior 
executive, the DHS coordinator for countering violent extremism, whose 
sole responsibility is coordinating and improving the Department's CVE 
efforts.
    To ensure a unified effort that fulfills opportunities and meets 
objectives, the Secretary recently tasked the DHS coordinator for 
countering violent extremism to update the current CVE Approach and 
develop a Department-wide CVE strategy. The new DHS CVE Strategy aims 
to improve the Department's ability to: Engage with local community 
partners; partner with the interagency and international community; 
provide best-in-class on-line innovation and analysis; and support CVE 
practitioners with research, training, and threat information. Under 
this strategy, DHS offices and components will prioritize CVE 
activities within their mission areas.
    As part of the strategy, the Department plans to help cities and 
regions build and utilize local CVE frameworks for all forms of violent 
extremism threatening the homeland, and to encourage communities to 
develop their own intervention efforts to counter violent extremism. 
Within the limitations of appropriate Government action, we will 
address the evolving nature of on-line recruitment and radicalization 
to violence--particularly violent extremist use of social media--by 
encouraging credible voices to challenge and counter violent extremism.
    Ultimately, this strategy aims to increase awareness among 
community members who may be in a better position to counter violent 
extremism. With increased training, analysis, and information sharing 
between the Department and State and local law enforcement, fusion 
centers, and first responders, we will increase the law enforcement 
understanding of violent extremism and how we can best mitigate 
threats.
    DHS's approach emphasizes the strength of local communities and the 
premise that well-informed and well-equipped families, communities, and 
front-line personnel represent the best defense against violent 
extremism. Over the past 8 months, DHS has participated in a National 
Security Council (NSC)-coordinated interagency effort to work with 
Boston, Los Angeles, and Minneapolis/St. Paul to facilitate and support 
the development of locally-based, and -driven, violent extremism 
prevention and intervention pilot frameworks.
    On February 18, 2015, the White House hosted a CVE Summit that 
focused on both domestic and international CVE efforts. Prior to the 
Summit, DHS hosted a roundtable discussion with Vice President Biden 
and domestic stakeholders on February 17, 2015, at the White House. The 
Summit included the rolling-out of piloted prevention and intervention 
programs in Boston, Los Angeles, and Minneapolis-St. Paul; DHS plans to 
evaluate these efforts and facilitate expansion to other 
municipalities. Under this initiative, DHS and the interagency 
encouraged local partners to develop mechanisms for engaging the 
resources and expertise available from a range of new partners, 
including the private sector as well as social service providers 
including education administrators, mental health professionals, and 
community leaders. As next steps, DHS is working with the interagency 
to further support prevention and intervention efforts in Boston, Los 
Angeles, Minneapolis-St. Paul and efforts elsewhere around the country 
while seeking to expand support efforts to other cities.
    Additionally, since September 2014, Secretary Johnson has 
personally participated in direct engagement efforts with critical 
stakeholders in Chicago, Columbus, Minneapolis, Los Angeles, Boston, 
Boston and most recently, New York, to hear how DHS can best support 
local efforts to counter violent extremism and address foreign 
terrorist fighters. DHS CVE efforts, in partnership with NCTC, also 
include the development of the Community Awareness Briefing (CAB), 
which is designed to share Unclassified information with stakeholders 
regarding the threat of violent extremism, as well as help communities 
and law enforcement develop the necessary understanding of al-Qaeda, 
al-Shabaab, ISIL, and other entities' recruitment tactics as well as 
explore ways to address these threats at the local level. The CAB draws 
a parallel between the similar recruitment targets of all types of 
violent extremism. For example, the CAB uses the case study on the 
attack at a Sikh temple in Oak Creek, Wisconsin to illustrate potential 
for violence from all types of violent extremists, including but not 
limited to violent white supremacists, violent eco-terrorists, violent 
Neo-Nazis, criminal gangs (such as MS-13), and international terrorist 
groups. Due to the increased number of Western-based fighters traveling 
to foreign conflicts, such as Syria and Somalia, the CAB now includes 
information relating to the foreign terrorist fighter recruitment 
narrative by al-Shabaab and ISIL. CABs have been successfully conducted 
in 15 U.S. cities thus far.
    Beyond our borders, DHS collaborates with partner countries, 
including the United Kingdom, Australia, Belgium, the Netherlands, 
Germany, Spain, and France, to develop best practices in community 
engagement endeavors that effectively counter violent extremism. 
Following the Paris attacks, DHS worked with some of these countries 
and DOS to link members of civil society and community stakeholders in 
respective countries so that they could coordinate and build grass-
roots responses to the attacks in Paris.
    DHS is also working closely with the NSC staff, DOS, the Department 
of Justice including the FBI, and NCTC to prepare for the CVE Regional 
Ministerial Summit planned for June 11-12, 2015 in Australia. I will be 
leading the U.S. delegation to this summit, which will bring together 
key stakeholders from national and local governments around the world, 
as well as the private sector, civil society, and community leaders to 
develop an action agenda to address violent extremism in all its forms.
                               conclusion
    The terrorist threat is dynamic, as those who operate individually 
or as part of a terrorist organization will continue to challenge our 
security measures and our safety. DHS will continue to work with our 
international counterparts and our colleagues within the FBI and NCTC 
and across the IC to identify potential threats to our security, both 
at home and abroad.
    Chairman McCaul, Ranking Member Thompson, and distinguished Members 
of the committee, thank you for the opportunity to appear before you 
today. I look forward to answering your questions.

    Chairman McCaul. Thank you Secretary Taylor.
    The Chairman now recognizes Assistant Director Steinbach.

    STATEMENT OF MICHAEL B. STEINBACH, ASSISTANT DIRECTOR, 
  COUNTERTERRORISM DIVISION, FEDERAL BUREAU OF INVESTIGATION, 
                   U.S. DEPARTMENT OF JUSTICE

    Mr. Steinbach. Good morning, Chairman McCaul, Ranking 
Member Thompson, and Members of the committee. Thank you for 
the opportunity to appear before you today to discuss the reach 
of terrorist influence which transcends the geographic 
boundaries like never before.
    Terrorists' use of technology has aided in the 
dissemination of rhetoric, encouraging attacks on U.S. 
interests in the homeland and abroad. As the threat to harm 
Western interests evolves, we must adapt and confront the 
challenges. This includes working closely with our Federal, 
State, local, and international partners since the threat 
persists in all of our communities. We continue to identify 
individuals who seek to join the ranks of foreign fighters 
traveling in support of ISIL and also those home-grown violent 
extremists who may aspire to attack the United States from 
within.
    Conflicts in Syria and Iraq continue to entice Western-
based extremists who wish to engage in violence. We estimate 
upwards of 200 Americans have traveled or attempted to travel 
to Syria to join extremist groups. We closely analyze and 
assess the influence groups like ISIL have on individuals 
located in the United States who are inspired to commit acts of 
violence. These threats remain among the highest priorities for 
the FBI and the intelligence community as a whole.
    ISIL has proven relentless. Through their skillfully-
crafted messaging, the group continues to attract like-minded 
extremists, including Westerners. Unlike other groups, ISIL has 
constructed a narrative that is appealing to individuals from 
many different walks of life. It is seen by many who click 
through the internet everyday, receive social media push 
notifications, and participate in social networks. In recent 
months, ISIL, via social media, has advocated for attacks 
against military personnel, law enforcement, and intelligence 
community members.
    ISIL has gone so far as to post the names, addresses, and 
photos of U.S. military personnel to the internet, which 
quickly went viral.
    We should also understand community and world events may 
entice an individual to act. As we have seen recently with 
highly-publicized events, including the attack in Garland, the 
events will attract media attention, and may inspire copycat 
attacks. The targeting of the Muhammad art exhibit and contest 
exemplifies the call-to-arms approach encouraged by ISIL, along 
with the power of viral messaging.
    As I stated in previous opportunities I have had to testify 
before this committee, there is no set profile for the consumer 
of this propaganda. However, one trend continues to rise: The 
inspired youth. We have seen children and young adults drawing 
deeper into the ISIL narrative. These generations are often 
comfortable with virtual communication platforms, especially 
social media networks. Some of these conversations occur in 
publicly-accessed social media networking sites, but others 
take place via private messaging platforms. As a result, it is 
imperative the FBI and all law enforcement organizations 
understand the latest communication tools and are equipped to 
identify and prevent terror attacks in the homeland. We live in 
a technologically-driven society, and just as private industry 
has adapted to modern forms of communication, so too have the 
terrorists. Social media is yet the latest tool exploited by 
terrorists. With its wide-spread distribution model and 
encrypted communications, it has afforded a free zone by which 
to recruit, radicalize, plot, and plan. We need to urgently 
assess the laws applicable in these matters and work with 
private industry toward technology solutions.
    To correct the narrative, this is not a conversation about 
National security at the expense of privacy or about weakening 
legitimate security of communication products through creation 
of technological back doors. We are looking to be fully 
transparent with the legal process showing evidence of a crime 
to gain access through the front door with full knowledge of 
those companies. The FBI seeks to ensure no one is above the 
law so the bad guys cannot walk away leaving victims in search 
of justice. There is certainly a balance between security and 
privacy. We seek that proper balance and one in which security 
enhances liberty.
    The FBI, in partnership with DHS and NCTC, is utilizing all 
investigative techniques and methods to combat the threats 
these individuals pose to the United States.
    In conjunction with our domestic and foreign partners, we 
are rigorously collecting and analyzing intelligence 
information as it pertains to the on-going threat posed by 
foreign terrorist organizations and home-grown violent 
extremists. In partnership with our many Federal, State, and 
local agencies assigned to Joint Terrorism Task Forces around 
the country, we remain vigilant to ensure the safety of the 
American public.
    Chairman McCaul, Ranking Member Thompson, and committee 
Members, I thank you for the opportunity to testify concerning 
ISIL's persistent threat to the United States. I am happy to 
answer any questions you may have.
    [The prepared statement of Mr. Steinbach follows:]
               Prepared Statement of Michael B. Steinbach
                              June 3, 2015
    Good morning Chairman McCaul, Ranking Member Thompson, and Members 
of the committee. Thank you for the opportunity to appear before you 
today to discuss the wide-spread reach of terrorists' influence, which 
transcends geographic boundaries like never before. As technology 
advances so, too, does terrorists' use of technology to communicate--
both to inspire and recruit. The wide-spread use of technology 
propagates the persistent terrorist message to attack U.S. interests 
whether in the homeland or abroad. As the threat to harm Western 
interests evolves, we must adapt and confront the challenges, relying 
heavily on the strength of our Federal, State, local, and international 
partnerships.
    We continue to identify individuals who seek to join the ranks of 
foreign fighters traveling in support of the Islamic State of Iraq and 
the Levant, commonly known as ISIL, and also home-grown violent 
extremists who may aspire to attack the United States from within. 
These threats remain among the highest priorities for the FBI and the 
intelligence community as a whole.
    Conflicts in Syria and Iraq continue to serve as the most 
attractive overseas theaters for Western-based extremists who want to 
engage in violence. We estimate upwards of 200 Americans have traveled 
or attempted to travel to Syria to participate in the conflict. While 
this number is lower in comparison to many of our international 
partners, we closely analyze and assess the influence groups like ISIL 
have on individuals located in the United States who are inspired to 
commit acts of violence. Whether or not the individuals are affiliated 
with a foreign terrorist organization and are willing to travel abroad 
to fight or are inspired by the call to arms to act in their 
communities, they potentially pose a significant threat to the safety 
of the United States and U.S. persons.
    ISIL has proven relentless in its violent campaign to rule and has 
aggressively promoted its hateful message, attracting like-minded 
extremists to include Westerners. To an even greater degree than al-
Qaeda or other foreign terrorist organizations, ISIL has persistently 
used the internet to communicate. From a homeland perspective, it is 
ISIL's wide-spread reach through the internet and social media which is 
most concerning as ISIL has aggressively employed this technology for 
its nefarious strategy. ISIL blends traditional media platforms, glossy 
photos, in-depth articles, and social media campaigns that can go viral 
in a matter of seconds. No matter the format, the message of 
radicalization spreads faster than we imagined just a few years ago.
    Unlike other groups, ISIL has constructed a narrative that touches 
on all facets of life--from career opportunities, to family life, to a 
sense of community. The message isn't tailored solely to those who are 
overtly expressing symptoms of radicalization. It is seen by many who 
click through the internet every day, receive social media push 
notifications, and participate in social networks. Ultimately, many of 
these individuals are seeking a sense of belonging.
    As a communication medium, social media is a critical tool for 
terror groups to exploit. One recent example occurred last week. An 
individual was arrested for providing material support to ISIL by 
facilitating an associate's travel to Syria to join ISIL. The arrested 
individual had multiple connections, via a social media networking 
site, with other like-minded individuals.
    As I've stated in previous opportunities I've had to testify before 
this committee, there is no set profile for the susceptible consumer of 
this propaganda. However, one trend continues to rise--the inspired 
youth. We've seen certain children and young adults drawing deeper into 
the ISIL narrative. These individuals are often comfortable with 
virtual communication platforms, specifically social media networks.
    ISIL continues to disseminate their terrorist message to all social 
media users--regardless of age. Following other groups, ISIL has 
advocated for lone-wolf attacks. In recent months ISIL released a 
video, via social media, reiterating the group's encouragement of lone-
offender attacks in Western countries, specifically advocating for 
attacks against soldiers and law enforcement, intelligence community 
members, and Government personnel. Several incidents have occurred in 
the United States and Europe over the last few months that indicate 
this ``call to arms'' has resonated among ISIL supporters and 
sympathizers.
    In one case, a Kansas-based male was arrested in April after he 
systematically carried out steps to attack a U.S. military institution 
and a local police station. The individual, who was inspired by ISIL 
propaganda, expressed his support for ISIL on-line and took steps to 
carry out acts encouraged in the ISIL call to arms.
    The targeting of U.S. military personnel is also evident with the 
release of hundreds of names of individuals serving in the U.S. 
military by ISIL supporters. The names were posted to the internet and 
quickly spread through social media, depicting ISIL's capability to 
produce viral messaging. Threats to U.S. military and coalition forces 
continue today.
    Across the world, recent events commemorating ANZAC Day, a 
significant milestone in Australian and New Zealand military history, 
attracted unwanted attention that could have resulted in violence had 
Australian authorities not disrupted the plotting efforts underway. 
These arrests re-emphasize our need to remain vigilant in the homeland 
against these small-scale attacks.
    We should also understand community and world events--as viewed 
through the eyes of a committed individual--may trigger action. As 
we've seen with recent highly-publicized events, including the attack 
in Garland, Texas, these acts of terror will attract international 
media attention and may inspire ``copy-cat'' attacks. The targeting of 
the Muhammad Art Exhibit and Contest exemplifies the call-to-arms 
approach encouraged by ISIL along with the power of viral messaging. In 
this instance, the event gained much publicity prior to it occurring 
and attracted negative attention that reached areas of the country--and 
the world--that it may not have without the wide-spread reach of the 
internet. The extensive network coupled with the magnetic messaging 
provides inspiration and validation that others share their outrage.
    Lastly, social media has allowed groups, such as ISIL, to use the 
internet to spot and assess potential recruits. With the wide-spread 
horizontal distribution of social media, terrorists can identify 
vulnerable individuals of all ages in the United States--spot, assess, 
recruit, and radicalize--either to travel or to conduct a homeland 
attack. The foreign terrorist now has direct access into the United 
States like never before.
    In recent arrests, a group of individuals was contacted by a known 
ISIL supporter who had already successfully traveled to Syria and 
encouraged them to do the same.
    Some of these conversations occur in publicly accessed social 
networking sites, but others take place via private-messaging 
platforms. As a result, it is imperative the FBI and all law 
enforcement organizations understand the latest communication tools and 
are positioned to identify and prevent terror attacks in the homeland. 
We live in a technologically-driven society and just as private 
industry has adapted to modern forms of communication so too have the 
terrorists. Unfortunately, changing forms of internet communication are 
quickly outpacing laws and technology designed to allow for the lawful 
intercept of communication content. This real and growing gap the FBI 
refers to as ``Going Dark'' is the source of continuing focus for the 
FBI, it must be urgently addressed as the risks associated with ``Going 
Dark'' are grave both in traditional criminal matters as well as in 
National security matters. We are striving to ensure appropriate, 
lawful collection remains available. Whereas traditional voice 
telephone companies are required by CALEA to develop and maintain 
capabilities to intercept communications when law enforcement has 
lawful authority, that requirement does not extend to most internet 
communications services. As a result, such services are developed and 
deployed without any ability for law enforcement to collect information 
critical to criminal and National security investigations and 
prosecutions.
    The FBI, in partnership with the Department of Homeland Security, 
is utilizing all lawful investigative techniques and methods to combat 
the threat these individuals may pose to the United States. In 
conjunction with our domestic and foreign partners, we are rigorously 
collecting and analyzing intelligence information as it pertains to the 
on-going threat posed by foreign terrorist organizations and home-grown 
violent extremists. In partnership with our many--Federal, State, and 
local agencies assigned to Joint Terrorism Task Forces around the 
country, we remain vigilant to ensure the safety of the American 
public. Be assured, the FBI continues to pursue increased efficiencies 
and information-sharing processes as well as pursue technological and 
other methods to help stay ahead of threats to the homeland.
    Chairman McCaul, Ranking Member Thompson, and committee Members, I 
thank you for the opportunity to testify concerning terrorists' use of 
the internet and social media as a platform for spreading ISIL 
propaganda and inspiring individuals to target the homeland. I am happy 
to answer any questions you might have.

    Chairman McCaul. Thank you, Director Steinbach.
    I now recognize myself for 5 minutes.
    I want to first pull up on the screen what I consider to be 
an internet conspiracy to conduct a terrorist attack. I was a 
Federal prosecutor, worked on drug cases, organized crime. 
There are a lot of similarities, but this one is conducted 
completely on the internet.
    [The information follows:]
    
    
    Chairman McCaul. Let me first commend--I want to commend 
the FBI, Homeland Security, and the Joint Terrorism Task Forces 
for their textbook model case efforts in both the Garland 
attack, and most recently in Boston. That is the way it is 
supposed to work. Unfortunately, you have to get it right every 
time, and they just have to get it right once.
    But this kind-of shows what we are dealing with the threat 
gone viral. You have this guy Miski, the ISIS follower in 
Somalia, directing attacks against the cartoonist art 
competition to Mr. Simpson, who responds, and as the attack is 
being conducted, we have the infamous Mr. al-Britani, who has 
become one of the chief ISIS recruiters, hackers, directors for 
terrorist attacks, congratulating them, basically saying: The 
knives have been sharpened; soon we will come to your streets 
with death and slaughter.
    I guess my first question is to Director Steinbach. This is 
just a microcosm of the conspiracy on the internet that we are 
looking at and the threat that we are looking at on the 
internet.
    How many potential recruiters do you think we have sitting 
in Syria and Somalia and northern Africa actively recruiting 
acts of terrorism globally?
    Mr. Steinbach. That is a good question, sir. So I think you 
can refer to the Brookings Institute study on terrorists' use 
of social media, in particular Twitter, and it gives you an 
idea of what we are dealing with. So when you look at the 
volume of social media and its social--and its ability to 
spread horizontally, you probably look at a--in the 
neighborhood of a couple thousand core users, propagandists, 
that are pushing that message out, and then probably in the 
neighborhood of 50,000 based on the study that is in open 
source of individuals re-tweeting that message and then again 
upwards of 200,000, say, for instance, receiving that message. 
So that is our pool with which to start. Those are just, you 
know, ballpark numbers.
    So, unfortunately, social media is a great tool for the 
public, but it also allows for this horizontal distribution, 
which is very difficult to follow. So those are baseline the 
numbers that we start with.
    Chairman McCaul. Baseline you start with. You said--and it 
has been reported over as many as 200,000 pro-ISIS tweets per 
day occur on the internet. Is that correct?
    Mr. Steinbach. So I couldn't give you the exact numbers. It 
is a large volume, and that is the trick. Right? What is 
somebody's individual right to tweet and say what they want to 
say versus somebody who is going down a different road, a more 
nefarious road. So that is our starting point, is those 
thousands that you talk about in trying to cull through that 
and find out who amongst those individuals are up to no good, 
who amongst those individuals are potentially plotting an 
attack on Western interests.
    Chairman McCaul. That is the great challenge that the FBI 
and Homeland has, is to try to, you know, monitor, to the 
extent you can, these communications.
    Mr. Steinbach. It is hugely problematic. So the social 
media is great. It is out there. It is open-source, but the 
volume is immense. That, of course, I am talking about the open 
side of social media. I am not talking about encrypted direct 
messaging, which is also a very problematic issue for us.
    Chairman McCaul. How many of those followers are actually 
in the United States in your estimate?
    Mr. Steinbach. So I think Director Comey stated at last 
there is hundreds, maybe thousands. It is a challenge to get a 
full understanding of just how many of those passive followers 
are taking action.
    Chairman McCaul. I have read some of these Twitter accounts 
and tweets. They have thousands of followers and thousands 
following, which means they are actively communicating and 
pinging each other, and then they go into--let's go into 
messaging. Then they go into a more secure space that if we 
have coverage we can pick up that communication, but as you 
suggested in your testimony, then they have the ability to go 
on to what is called dark space, to another platform that is 
secure comm that we don't have the ability to monitor these 
communications. Is that correct?
    Mr. Steinbach. That is correct, sir.
    Chairman McCaul. To me, that is one of the greatest 
concerns I have. Do we have any idea how many communications 
are taking place in the dark space?
    Mr. Steinbach. No. We don't. That is the problem. We are 
past going dark in certain instances. We are dark. The ability 
to know what they are saying in these encrypted communication 
situations is troubling.
    Chairman McCaul. I think it is a tremendous threat to the 
homeland. Do you have any recommendations for the Congress?
    Mr. Steinbach. I think we need to have an honest 
conversation. Get past the rhetoric of what we are talking 
about. We are not talking about large-scale surveillance 
techniques. We are talking about going before the court, 
whether the criminal court or the National security court with 
evidence, a burden of proof, probable cause, suggesting a crime 
has been committed, or in our case, that there is a terrorist, 
and showing that burden of proof, having the court sign off on 
it, and then going to those providers and requesting access to 
either that stored information or that communications that is 
on-going. So we are not looking at going through a back door or 
being nefarious. We are talking about going to the company and 
asking for their assistance. So we suggest and we are imploring 
Congress to help us seek legal remedies towards that, as well 
as asking companies to provide technological solutions to help 
that.
    We understand privacy. Privacy, above all other things, 
including safety and freedom from terrorism is not where we 
want to go.
    Chairman McCaul. Well, and I think this committee should be 
looking at this very important issue.
    Finally, if you can't comment on the most recent Boston 
case, it has been reported that this was a ISIS-inspired event 
over the internet and an attempt to behead police officers. We 
know that a lot of their commands and call to arms are to 
attack military installations and attack police officers. I 
know you--it is an active investigation, but to the extent you 
can comment on this, would you please do so?
    Mr. Steinbach. Investigation is early on post-event. So 
there is not a lot I could say on the intelligence side. You 
are right, sir. We know that ISIL has put out a message to 
attack the West, specifically law enforcement, military. We 
know that they have been looking at those target sets. So we 
are very careful in where we are at. The targets that are out 
there, the counterterrorism subjects, we are monitoring them 
very closely for any type of action, any type of overt steps, 
any mobilization factors, and when we see those, we are not 
taking the chance.
    Chairman McCaul. I appreciate that, and we again commend 
your efforts in this most recent threat.
    With that, the Chairman now recognizes the Ranking Member.
    Mr. Thompson. Thank you, Mr. Chairman.
    Mr. Steinbach, you went into great detail the challenge of 
social media and other things. Do you at this point see the 
challenge also resources or the authority to do your job?
    Mr. Steinbach. I don't feel we have a challenge resource-
wise. We have done an effective job identifying, prioritizing, 
and working through the JTTFs, the State, locals, to focus the 
target set. So I would say that of course we always have to 
prioritize resources, but it is more so the challenge for me is 
the technological challenge to get over that hurdle.
    Mr. Thompson. When you said ``technological,'' is it just--
explain that a little bit for me, please.
    Mr. Steinbach. So when a company, a communications company 
or an ISP or a social media company, elects to build in its 
software encryption, end-to-end encryption, and leaves no 
ability for even the company to access that, we don't have the 
means by which to see the content. When we intercept it, we 
intercept encrypted communications. So that is the challenge, 
working with those companies to build technological solutions 
to prevent encryption above all else.
    Mr. Thompson. So there is nothing from a Congressional 
standpoint authority you need from us to make that happen?
    Mr. Steinbach. Well, I think a number of years ago Congress 
passed CALEA, which was a law that was put in place that 
required telecommunication providers to provide assistance to 
law enforcement. I would suggest that that is a starting point 
that we need to expand who is bound by that law. 
Telecommunication providers are just a small subset of the 
companies that are out there that provide communication 
services these days. So I think it is a starting point that 
would be helpful.
    Mr. Thompson. So can you provide the committee with beyond 
the starting point in terms of where the Department thinks we 
should be going in this direction?
    Mr. Steinbach. Sir, I could. I think more appropriately the 
FBI's OTD, the Operational Technology Division, has the lead on 
that, and they can--and I am sure they would be happy to come 
here and kind of lay out for you step-by-step where they need 
to go.
    Mr. Thompson. I think, Mr. Chairman, we ought to try to 
make that part of what we do.
    Chairman McCaul. I agree.
    Mr. Thompson. Okay.
    Mr. Mulligan, according to your testimony, videos, tweets, 
and messages are probably not enough to radicalize individuals 
who are beginning to show these tendencies. They serve as 
discussion points. Showing interest and having on-line 
discussions are not criminal in nature. So what do we do about 
all these on-line portals that kind of start this--people down 
this slope, so to speak?
    Mr. Mulligan. Sir, as my colleague mentioned, so it is part 
of a dialogue. They start out by trying to gain your interest. 
It is marketing and advertising. As Michael indicated, a lot of 
it is there is followers. You know, you frequently start out as 
following someone and following the trail, or you are 
subscribing to one of their channels. Then it progresses beyond 
that into a dialogue. So what we really need to be doing is 
helping educate a lot of the members of the public about this 
process. We have been trying to do that with DHS so that like, 
as Michael also said, family members are aware that if their 
children are spending a lot of time on this, they need to be 
able to counter that. They need to be able to execute some 
degree of measures.
    These individuals are very savvy in their understanding of 
the gradual nature of recruitment and operationalization. So 
what they try to do is create a series of images that are 
attractive, and then they try and broaden that into a further 
discussion. So it does require, again, a much more active 
interventionist approach.
    Mr. Thompson. General Taylor, can you kind of tell us where 
the DHS fits in this space in terms of trying to do the 
community engagement and some other kinds of things that can 
help what Mr. Mulligan is talking about?
    Mr. Taylor. Yes, sir, certainly. As my colleagues on both 
sides have mentioned, it starts with the intelligence to 
understand the tactics, techniques, and procedures that our 
adversaries are using to reach into our communities, and we go 
out with NCTC, with the FBI, with the Department of Justice, to 
conduct community resilience exercises to teach communities 
about the tactics, techniques, and procedures, what to look 
for, how to spot it, who they may report to about that activity 
so that they can intervene at the earliest possible stage. We 
have done that across the country.
    Secretary Johnson has done six of them so far this year. He 
is actually out doing one this afternoon. It is a clear part of 
our strategy to ensure the communities understand this threat 
and how it is being manifested. In my mind, it is almost like 
what we do with predatory behavior with child molesters in that 
we have got to inform parents of what is happening on the 
internet so that they can go and monitor what their children 
are doing and seeing on a continuous basis.
    Mr. Thompson. Last question. Do parents who are monitoring, 
do they have enough options out there? You know, I think if a 
parent suspects that my child might be engaged in this 
behavior, you know, who do I call? Do I call the local law 
enforcement? Do I call the FBI? Or have I really put my child 
in a situation where I am labeling that child for life? Do we 
have anything in between law enforcement and the parent that 
can help mitigate some of these circumstances?
    Mr. Taylor. Well, certainly I think the opportunity is for 
the community to engage, for the schools to engage before it 
gets to a radical action that requires law enforcement 
involvement. So what we try to get communities to understand is 
that they are a part of the solution and it is not just the law 
enforcement solution that we are looking for. We are looking 
for communities to be engaged, to understand, and to intervene 
when these events occur.
    There is a recent case we had where a father in New 
England, his daughter went missing. He went to the airport in 
his State and said: I think my daughter is leaving. We were 
able to find his daughter--she wasn't at that airport; she was 
at another airport--before she got on a plane to go to 
overseas. That happens almost every day with somebody having 
that sort of challenge, and it is not a law enforcement 
response. It is helping parents be good parents and helping 
their children not make bad mistakes.
    Mr. Thompson. Thank you, Mr. Chairman.
    I yield back.
    Chairman McCaul. Mr. King is recognized.
    Mr. King. Thank you, Mr. Chairman.
    Let me thank all the witnesses for their testimony today 
and for the tremendous service they have given our country. So 
thank you very much.
    I would just like to expand on something or maybe slightly 
disagree with something the Ranking Member said, and maybe it 
is more for the point of clarification, about whether or not 
ISIS' use of the social media can by itself cause someone to 
carry out violent action.
    I know, in many cases, it may be part of a long process, 
but we had two recent cases in New York where there was a man 
in Jamaica, Queens, who attacked two police officers with a 
hatchet. It doesn't appear as if there was a long process of 
radicalization there. He was responding to, in effect, a 
directive from ISIS.
    Then we had two women. Now, this may--somewhat a longer 
process, also in Queens, who had IEDs in their apartments. They 
both seemed to--primarily their means of radicalization was the 
ISIS' use of social media. Am I correct in that or--I think I 
am not trying to disagree with the Ranking Member. I just 
wanted to add on to that.
    Mr. Mulligan. I would suggest, Congressman, that you are 
absolutely correct in their--they believe they are able to 
operationalize people solely through social media. They believe 
that they can enter into the dialogue I referred to earlier and 
provide the tools, and they are not getting into very complex 
tools.
    What they are telling them is: Here are some tactics and 
procedures you should use. Here is some easily available--
readily-available information on-line that you can exploit. In 
other words, they believe that they can provide them everything 
that they will need to undertake some kind of lone-actor 
attack.
    Mr. Steinbach. Let me add to that, sir. You also hit on an 
important point, and that is the diversity of the threat. You 
have got a slow burn, but you also have individuals who are 
flash to bang, which is very quick. We have seen more of this 
flash to bang with ISIL and their on-line efforts. Again, it is 
not just going someplace on the internet and looking it up. The 
social media push is coming right to your pocket via your smart 
phone. So it is a diversity of threats. So you are right in 
that it all depends on the individual. But we have to be 
prepared for both types of situations.
    Mr. King. I think you were very--all of you were eloquent 
as far as some of the dark areas, where you just can't go right 
now. It would seem to me that in those instances, it is even 
more important to have human sources on the ground that can 
fill in those gaps. I would just say, and maybe this is 
rhetorical on my part, but with the constant criticism of law 
enforcement and the constant talk of snooping and spying, for 
instance, to me it makes it much harder to recruit people on 
the ground. Like in Boston, if this had been 2 days ago, and 
the Associated Press and the New York Times uncovered the fact 
that the Boston Police were following those alleged terrorists, 
that would have been snooping and spying. Well, now it turns 
out, after the fact, it was effective surveillance. I just 
think that the use of those terms really are doing a tremendous 
disservice as far as enabling law enforcement to recruit people 
on the ground. You said you want to work with the community, 
and you do, but at the same time this onslaught coming from the 
media and from certain people in politics, constantly talking 
about snooping, spying, harassment, to me, it undoes a lot of 
the good that you are trying to do. So I don't know if you want 
to comment or not. Again, maybe I was just making a rhetorical 
point. But if anyone wishes to comment, fine. If not I will 
just----
    Mr. Steinbach. I agree with you, sir. You have to have a 
multitude of tripwires, both on-line and in person. We try to 
insert sources in situations where there is a predicated 
investigation, but it is a challenge.
    Mr. Taylor. Sir, I would add to what Mr. Steinbach has said 
and indicate that this is a total team fight. It takes HUMINT. 
It takes SIGINT. It takes what I call transaction INT, looking 
at travel patterns and those sorts of things to come to this. 
Certainly in communities, communities sometimes feel: Well, you 
are looking at us too much as opposed to another community. Our 
response is generally: The bad guys are trying to recruit your 
kids. That is why we are talking to you. It is not because of 
your religion, but it is what the bad guys are trying do. That 
is why we are here talking to you about strategies to defend 
yourself.
    Mr. King. My time is running out. Just if you could comment 
on this. ISIS, one thing they have been doing it appears is 
encouraging use of hoax threats. Are you in a position it say 
yet whether or not what happened on Memorial Day, with 10 
different hoax threats were called into the airlines and again 
this weekend when they were called in, if that is in response 
to ISIS? Are these lone wolves? Or is it just a person carrying 
out a hoax?
    Mr. Steinbach. I would say we don't have any credible 
information that there are threats to aviation right now. So, 
yes, the ones so far appear to be hoaxes. Tracking those back 
to an individual or a group is still an on-going process.
    Mr. King. But ISIS has said that the use of the hoax itself 
is an effective means of attack.
    Mr. Steinbach. Correct. Correct.
    Mr. King. I yield back. Thank you, Mr. Chairman.
    Thank you for your testimony.
    Chairman McCaul. Mr. Richmond is recognized.
    Mr. Richmond. I guess I will start with you, Mr. Taylor, or 
maybe even Mr. Mulligan. You mentioned that there were about 
1,700 messages sent out by ISIL. How many, if you had to 
estimate, about how many people did that reach?
    Mr. Mulligan. Certainly tens of thousands; 1,700 separate 
publications, be it a video release or an on-line magazine 
release, but certainly in the thousands to tens of thousands 
probably.
    Mr. Richmond. The people who start to follow and engage in 
the social media, even if it is on the front, we are not seeing 
any similarities or any consistent traits across the board in 
the people that start to engage, or are we?
    Mr. Mulligan. Well, sir, it is partly about what the actual 
publication is or the video is about or what they are trying to 
incite. In some instances, as you know, we are particularly 
concerned when we see someone who is let's say a Twitter feed 
that is being followed and they are really strongly advocating 
violence. Then I think the FBI is paying particular attention 
to those. It is important to also note that in some instances a 
lot of the followers are just--I mean, they are paying 
attention. The media is paying attention to some of these 
entities. On a lot of the video releases, obviously, they are 
tracking and reporting on it.
    I would also like to posit that, in many instances, they 
are also trying to generate buzz themselves. So we have seen 
multiple instances in which they have, if you will, 
collaborators who will retweet messages to try and increase the 
numbers so that it makes it look like they have got a very 
large number of followers. The bottom line is they are 
effective at using social media, and they are effective at, if 
you will, manipulating social media.
    Mr. Richmond. Knowing that they are experts at manipulating 
social media and using social media, are there things that we 
can do or things that we should encourage others to do or not 
to do to protect themselves? I guess now I am going to get into 
the sensitive area of, you know, I am not commenting whether it 
is their First Amendment right to have a contest to depict or 
make fun of Islam. But in my mind, I encourage my mother not to 
walk down dark streets at night because it is dangerous. I 
would get upset if someone drew cartoons of Jesus or called 
Mary a slut. I mean, that is just my faith.
    So if you know they are social media experts and they are 
good at using social media to get their message out, are we 
inciting some of this with our or some people's hatred towards 
their religion and other things? I mean, are we fueling some of 
this fight?
    Mr. Taylor. Sir, I think I would answer that question 
simply by saying the Constitution of the United States of 
America and our rights and freedoms are something that stands 
in the way of our enemies' effort to create a global caliphate. 
So I don't think any one event fuels this. I think it is coming 
at our system of government; our freedoms is what they are 
trying to undermine. They are in the news cycle.
    Mr. Richmond. So you don't see any spike in people 
following after events like this or any rise in social media 
conversations when you have a contest like that going on?
    Mr. Taylor. Of course, you do.
    Mr. Richmond. I guess that is my question then.
    Mr. Taylor. But, again, in America, those kinds of 
conversations happen every day as a part of our Constitutional 
rights in this country. So saying that we should stop doing 
something here would cause them to stop doing it there, they 
will find somewhere else to look for a reason to, you know, to 
attack America.
    Mr. Richmond. I agree with that.
    But I guess my question is, and I think that a guy that is 
going to rob a lady walking down a dark alley is going to rob 
somebody. But I am going to encourage my mother not to walk 
down that alley so it won't be her so that it is not easy prey.
    I guess, you know, it is our Constitutional right to say 
whatever you want. But I promise you if you call my mother a 
bad name, there are going to be some consequences and 
repercussions. I just don't think that we are having that 
honest conversation. When we are talking about young people, we 
are talking about angry people, we are talking about people who 
feel picked on.
    I mean, you know, there are some words that will trigger a 
response, but you have the absolute First Amendment right to 
say it. Then it is up to me whether I want to exercise my 
discipline or hit you in the mouth. So the question becomes: 
How often are we going to get hit in the mouth before we 
realize that we may be playing into it unnecessarily by just 
being callous and cruel I think in some instances?
    Thank you for your questions.
    Thank you, Mr. Chairman.
    Chairman McCaul. I thank the gentleman.
    Mr. Perry is recognized.
    Mr. Perry. Thank you, Mr. Chairman.
    Thank you gentlemen for being here.
    I think this is a difficult subject, trying to find the 
line between privacy and security, as I think everybody has 
alluded to. Let me ask you this.
    There are folks that might wear their heart on their sleeve 
regarding this circumstance, radical Islam, attacks, and so on 
and so forth. They might be having a conversation openly on 
social media where they espouse their opinions, which might 
lead them to be a target for some of these individuals, if you 
know what I mean, and maybe even some of the folks in this 
building, somebody that is having this hearing today or 
somebody that is asking questions like this.
    Do you folks have any way or do the platforms have any way 
of monitoring traffic about those individuals that might have 
had a conversation with a friend openly on open source, on-
line, about their disdain for radical Islam, for attacks, and 
might have been disparaging about it? Do they become a target? 
Does that individual become a target? Is there any way that the 
social platforms have a way of monitoring it? Do any of you 
folks have a way of monitoring it? Do you collaborate on that?
    Is that a chill? Is there a chilling effect for free speech 
if people feel like they might be targeted because of their 
thoughts posted openly on social media?
    Mr. Steinbach. So I am not sure that I fully understand the 
question. So I think that social media platforms usually abide 
by the terms of service agreement. They have got small 
compliance departments. For the most part, the answer to the 
first part, no, I don't think social media companies are doing 
anything along the lines that you speak.
    As far as the intelligence community or law enforcement 
monitoring those individuals who are exercising expressions of 
freedom and then become targets, we don't have a mechanism in 
place to track them. We would track it from the other side if 
we see threats coming toward them. But not necessarily--is that 
the question you are asking, sir?
    Mr. Perry. Essentially, yeah.
    Mr. Steinbach. So we are not tracking it from the other 
end.
    Now if somebody comes to us and says, ``Hey, I feel 
threatened,'' of course we will look into that. But as far as a 
data pull of some type of large scale to look at that, no.
    Mr. Perry. Go ahead.
    Mr. Mulligan. If I could also offer another bit of context 
to what Mike said. When you are operating on social media, 
particularly some of the broadly-available public platforms, 
you are in open space. So you can be monitored by any entity 
out there, by commercial entities, by educational institutions, 
by the media. Anyone can be looking at that. That is one of the 
challenges that I think people are often concerned about, going 
back to this point that you make.
    Frequently within this country we are trying to--I mean, 
trying to encourage credible voices to contest the ideological 
extremism that is being advocated. Those folks are often 
reluctant to do so because of the fact that they are concerned 
that they will either, as you said, become a potential target 
of violence, become an intelligence target, become a law 
enforcement target.
    I think what we have been trying to do collectively as a 
community is trying to change that environment, at least from 
the perception of the U.S. Government's monitoring of their 
activities. But I do believe that, again, it is open space. So 
any person that enters into that space needs to understand 
that.
    Mr. Perry. So when you talk about--some of you talked about 
encrypted direct messages and dark space. Can you give me some 
examples? Is it essentially just texting? Would that be 
considered off limits to monitoring by the United States 
Government even in cases where there might be an imminent 
planning and plotting? Is there any way--and if this is 
Classified, that is fine, too. But I am just wondering from 
that perspective, you know, if it is not on Facebook, if it is 
not on Twitter, do we have the capability--the Federal 
Government, do they have the capability and/or do the providers 
have the capability? Are there algorithms that pick this type 
of stuff up or processes that pick this stuff up?
    Mr. Steinbach. The answer is no. There are 200-plus social 
media companies. Some of these companies build their business 
model around end-to-end encryption. There is no ability 
currently for us to see that. So if we intercept the 
communication, all we see is encrypted communication.
    Mr. Perry. Anybody else? Some examples. Are we talking just 
straight texting? Like I know a program called Cyber Dust, 
right? So once you send it and it is received, it disappears. 
That would be--is that an example of the dark space, or is that 
just encrypted direct communications? What is that?
    Mr. Steinbach. So dark space is a general term. So, yes, 
there is lots of models out there. There is models in social 
media that go point-to-point and then once you read it, it 
disappears; it is not saved. Some companies can set, you can 
set how long a text is saved. Some of them are encrypted from 
the start. Most of them are text-type direct forms. Some of 
them are photographs that send. There is all kinds of different 
models. Some of them are more like bulletin board formats. 
There is lot and lots of formats out there.
    Mr. Perry. All that is off-limits right now to the Federal 
Government as far as you are----
    Mr. Steinbach. It is not that it is off-limits. It is that 
there are more and more of these companies are building their 
platforms that don't allow us. We will still seek to--they will 
go to those companies and serve them legal process, but if the 
company has built a model that even they can't decrypt, then it 
doesn't do us any good.
    Mr. Perry. Thank you, Mr. Chairman.
    I yield back.
    Chairman McCaul. Mrs. Watson Coleman is recognized.
    Mrs. Watson Coleman. Thank you very much, Mr. Chairman.
    Thank you very much, gentlemen, for your information 
sharing here. I think I want to tag on a little bit to 
Congressman Richmond's questions because I want to get at 
something that I have not heard a lot about.
    I am reading that there really is no sort-of common 
denominator here, not any religious zealot. Individuals who are 
being radicalized don't even necessarily know what the Islam 
religion is all about. It is not socioeconomic. It is not 
racial or ethnic.
    So I am trying to figure out what exactly is it? What is 
enticing about beheadings and violence and this just very angry 
assault that our young people are being exposed to? What is 
tripping them and their attention to that kind of 
radicalization? What is it about ISIL?
    Mr. Mulligan. So, ma'am, if I can just give you a little 
bit of context on that. You are right to describe--and I think 
one of my colleagues described earlier--the range of how can I 
say it, experiences and, if you will, ideological knowledge, 
religious knowledge varies incredibly widely. What there seems 
to be is, they are appealing in some instances to, if there is 
a sense of victimization, that they are the individuals who are 
those who, you know, will conquer those who have been the 
victimizers. So it appeals to that, to that underdog nature. 
They really do an effective job in communicating that sense.
    As I said in my remarks, they couple that with an ability 
to present: Here is the idealized vision of what our religion 
presents. If you really want to leave the trappings of all the 
challenges and troubles you are having in your current life and 
join us, we will offer you more direction and more means. So 
that is how they seem to be succeeding.
    Mrs. Watson Coleman. So they seem to be attracting young 
people. Are we talking about middle school age? Are we 
talking--what ages are we talking about? When we say ``youth,'' 
just how young are these young people?
    Mr. Mulligan. I would say we are seeing ages in the teens, 
probably upper teens into 20s. It is also important, you know, 
we deem this a new generation of terrorists because as General 
Taylor was saying, a lot of them are extremely conversant in a 
lot of social media. I mean they have grown up with it. So this 
is the means by which they use to reach that generation.
    Mrs. Watson Coleman. I can understand that. What I don't 
understand is what is enticing them. What appeals to you when 
you see someone beheaded or you see these nasty threats or you 
see this violence? The victimization is something I would like 
to just carry on a little bit. One of my favorite programs was 
about the FBI profiler. So I am wondering, is that a real 
thing? I know there is police profiling I am concerned about. 
But is there such a thing as psychological profiling? Are we 
looking at those kinds of things? Are we identifying some 
traits that have nothing to do with ethnicity or socioeconomic 
or whatever, but other traits? Are we able to like identify any 
sort of red flags in the children and the young people in 
school and in college? Because I just wonder whether or not we 
are expending enough energy and resources in trying to identify 
early on and intervene.
    Mr. Steinbach. So, yes, the FBI does have a Behavioral 
Analysis Unit. There is within the National Center for the 
Analysis of Violent Crime, there is a unit dedicated to 
terrorists. It spends a lot of time looking at the parts of 
radicalization and mobilization, what attracts folks. But like 
Mr. Mulligan said, it is a very complicated piece.
    Quite frankly, what we have seen as far as a profile is the 
lack of a profile. There is just so many reasons. You know, we 
don't see disaffected. We see some disaffected. We don't see 
well-to-do. We see some well-to-do. Victimization is certainly 
a common theme. Younger and younger individuals are drawn into 
this messaging. I would say that ISIL has done an effective 
message versus al-Qaeda in that they have said publicly: Hey, 
the caliphate is here today. You can come now to a country 
where sharia law rules. Bring your family.
    They have really messaged it across the spectrum to a wide 
walk of individuals.
    Mrs. Watson Coleman. Let me just ask this last question, if 
I might: Should we be engaging the Department of Education, 
higher education, in identifying programs and approaches and 
sort-of learning devices that would be able to anticipate and 
deal with our younger people who are affected by whatever it is 
that is turning them on here?
    Mr. Taylor. Yes, ma'am, we should, and we are beginning to 
work with the Department of Education on these kinds of issues 
because it is a whole-of-community effort. It is not just the 
police, not just the churches. But it is education. It is civic 
organizations as well.
    Mrs. Watson Coleman. Thank you, Mr. Chairman.
    At some point, I really would like for us to explore what 
more can be done proactively in identifying and sort-of 
intervening at an earlier stage.
    Thank you for your indulgence.
    Chairman McCaul. Thank you.
    Mr. Hurd is recognized.
    Mr. Hurd. Thank you, Mr. Chairman and Ranking Member, for 
holding this hearing. I think a number of these issues we can 
talk all day long about that, and so we are packing a lot in in 
a very short period of time.
    My first question is to Mr. Mulligan and Ambassador Taylor. 
Talk about the community engagement exercises and engaging 
credible voices throughout these communities. How do we blow 
that up? How do we make it bigger? How do we accelerate those 
projects?
    Mr. Mulligan. So we have been developing a partnership 
community awareness briefing, and we have just been moving it 
out fairly slowly initially to ensure that we are having a 
degree of success. But we have had some success in that. Now we 
are trying to train the trainer so that we can get into a 
situation where we are propagating it more broadly across the 
communities. Because going back to some of the other 
observations that have been made, it really is at the community 
level that we need to have this success. Also we need to have, 
I think as the Ranking Member said, levels between Government 
and local. In a lot of instances, particularly with family 
members, as you know, people are reluctant to engage any sort 
of authorities. We need to try and find that middle ground, 
sir.
    Mr. Hurd. I appreciate that. Because we need to be thinking 
about this in terms of weeks, not years. Because that is the 
speed at which we need to counter this threat. Ambassador 
Taylor, do you have any remarks on that?
    Mr. Taylor. It is a global phenomenon. So our outreach 
internationally has been important as well. I am leading a 
delegation to Australia next week to further our communication 
with our Five Eyes partners about this phenomenon and how we 
can engage communities really across the world so they better 
understand what this risk threat is.
    Mr. Hurd. Because in order to make the FBI's job a lot 
easier, this lone-wolf idea, the way we are going to stop that 
is by countering that violent ideology and extremist ideology. 
That is going to take a whole-of-Government effort. Who in the 
Government is responsible for this? The CVE activity.
    Mr. Taylor. It is actually a shared responsibility between 
Justice, the intelligence community, DHS, and the FBI. Our 
deputies meet regularly to formulate those strategies and to 
implement those strategies within the United States.
    Mr. Hurd. My suggestion there would be looking at unity of 
commands because when you have three people in charge of 
something, nobody is in charge of it. I think that is something 
that we are plagued with in the Federal Government on a number 
of occasions. My next set of questions is to Mr. Steinbach.
    The canon out there on counterterrorism is clear, 
terrorists are trying do two things: They are trying to kill a 
lot of people, and they are trying to elicit counterterrorism 
responses in a government to upset a population to foment 
discord. All right. So with that as the background, that is why 
I am a little bit nervous when we start talking about CALEA 
expansion, all these kinds of things, I get nervous because of 
the privacy aspect.
    So my question, and not to get too technical, does end-to-
end encryption that is provided by many U.S. companies prevent 
your ability to do attribution?
    Mr. Steinbach. In some cases, yes.
    Mr. Hurd. But not in all cases?
    Mr. Steinbach. Not in all cases.
    Mr. Hurd. All right. So are you suggesting that when you 
have a court order on someone connected to terrorism that there 
are companies that aren't cooperating with helping to get as 
much information as they can about that individual?
    Mr. Steinbach. No. What I am suggesting is that companies 
have built a product that doesn't allow them to help.
    Mr. Hurd. But if you are saying it doesn't prevent 
attribution--because the key here is to try to find as much 
information so that we can--you know, to exhibit the success 
that you all have had in Boston. You know, you were able to 
identify someone and use other tools to track him and stop and 
prevent this from happening. That is, you know, it is a 
difficult task. Don't get me wrong. I know how hard you guys 
are working. Maintaining the operational pace that you all have 
maintained since September 11 is unprecedented. Your men and 
women in the FBI should be patted on the back and heralded. But 
we also got to make sure that we are protecting our civil 
liberties and our borders at the same time. When you talk about 
reviewing applicable laws around the technology challenges that 
you are facing in CALEA expansion, I just want to be clear you 
are not talking about putting a back door in software, are you?
    Mr. Steinbach. No. Like I said in my prepared statement, 
sir, I am talking about full transparency. I am talking about 
going to the companies who then could help us get the 
unencrypted information. The attribution piece is important to 
understand that, depending on the technology involved--and this 
requires, quite frankly, a technology discussion--there are 
tokens that are used that do not allow for attribution. So it 
is not quite as simple as just using other techniques or 
attributions, sometimes that attribution is not there. I would 
be happy to discuss in a Classified setting in more detail just 
exactly what we are talking about.
    Mr. Hurd. I would love that. Thank you.
    One thing, we have been talking a lot about the use of 
social media and digital tools and how it has made it easier 
for ISIS to recruit people. But it also gives us an opportunity 
to do double-agent operations against them, to penetrate, you 
know, their ability. When chasing al-Qaeda, you know, 10 years 
ago, if you were anything close to an American, you would get 
your throat slit. Now we have these new tools in order to 
penetrate them. Again, I know I have run out of time.
    I yield back that to the Chairman. Thank you.
    Chairman McCaul. If I could just briefly comment, we led a 
delegation on investigating foreign fighters to the Middle East 
and Europe. We found that there is a counternarrative out 
there. This is more not on-line, but foreign fighters who have 
left the region, some returned inspired and more radicalized, 
and some returned very disillusioned from the experience. I 
think that narrative, and this may be more a State Department 
issue, the more we get that narrative out there, the better off 
we are going to be.
    The Chairman recognizes Miss Rice.
    Miss Rice. Thank you, Mr. Chairman.
    Mr. Steinbach, I just want to ask you a couple of 
questions. How does the intelligence community qualify an 
elevated threat from on-line-inspired terrorists? So we all 
know how when they raise the threat level, but specifically 
with this on-line communication, how do you rate what the--what 
level the communication, how it rises to something that you 
really are worried about?
    Mr. Steinbach. So it is I think a simple question with a 
complicated answer. There is lots of pieces. The volume, the 
specificity, whether or not they have identified willing 
sympathizers who will do something. It is a lot of pieces that 
go into it. Many of those factors are present now.
    Miss Rice. So are there any difficulties? What is the 
biggest difficulty in terms of being accurate when you are 
trying to rate the level of a threat?
    Mr. Steinbach. So as Mr. Hurd stated previously, the social 
media is great because it is out-there social media--it is 
voluminous, but it is volume. So there is trying to weed 
through the thousands and thousands of individuals on social 
media and find the--all the noise out there, identifying the 
signals. So it is a volume piece. You know, looking at social 
media requires a different business process that we do things 
with, and going from there to finding a credible threat, it is 
a very difficult process.
    Miss Rice. I mean, it seems like it would be. We have been 
talking this whole time about on-line communications, on-line 
radicalization. Is there any physical presence of either ISIL 
or al-Qaeda doing face-to-face recruiting here in this country?
    Mr. Steinbach. So I would say we don't--we have, of course, 
a number, a small number of returned foreign fighters. We have 
individuals who have been overseas and returned to the United 
States. Where they are and who they are is probably an 
intelligence gap for us. I would say our best estimates are we 
don't have ISIL sitting in the United States. We have got 
individuals who have taken up the call to arms based on ISIL's 
messaging.
    Miss Rice. Right. But not everyone who has gone and come 
back becomes a recruiter. So I am just curious as to whether 
there are people who don't go anywhere, aren't on the internet 
and are actually in a physical place actually doing, you know, 
whether in tandem with the on-line recruitment actual face-to-
face recruiting.
    Mr. Steinbach. So you are talking about a classical home-
grown violent extremist, the lone wolf. There are a number of 
factors that would cause somebody to radicalize. It doesn't 
have to be on-line. It could be a friend, an associate. Other 
factors may cause that person to become radicalized. On-line 
just happens to be, when you look at the spectrum, by volume, 
the highest percentage.
    If you are asking, do we have core al-Qaeda coming to the 
United States and sitting here--or core ISIL, I think we look 
at that intelligence gap all the time. But I would say, for the 
most part, no.
    Miss Rice. Okay. Thank you.
    I yield back my time. Thank you, Mr. Chairman.
    Chairman McCaul. Mr. Duncan is recognized.
    Mr. Duncan. Thank you, Mr. Chairman.
    Al-Qaeda led the way with Inspire magazine, I think, which 
was an on-line publication. Are we still seeing Inspire as 
prevalent as it was? Has ISIL adopted that media? Is there a 
way to track? You have got a website platform like Inspire, is 
there a way for you guys to track who visits that page, who 
takes it and forwards that information? If you can answer that 
for me.
    Mr. Mulligan. Sir, to answer your question, Inspire still 
comes out periodically. That model has been successfully copied 
by several of the other affiliates and other terrorist-related 
entities. They see that whole process of like an on-line 
magazine as being an effective model. It has been adapted by 
ISIL. They have a publication called Dabiq. It is a variation 
on that. They put out their information. They put it out in 
multiple languages.
    To answer your question about our ability to track its 
propagation, we are not really able to do that. They put 
multiple links to it. I mean, as you can imagine, once 
something starts to propagate on the internet, it is there. It 
can reside in a number of places. So that model does exist. It 
continues. They are continuing to employ it. Again, it is 
extremely difficult, impossible to track really.
    Mr. Duncan. For the freshman Members and the people that 
just started following this issue, I would recommend that you 
get the Inspire magazine, take a look at some of the 
information that is being provided. I have never seen the 
information you are talking about that ISIL or others. If there 
is a way to share that with the committee, even if it is a 
Classified setting, we would be glad to take a look at that. I 
personally would like to do that.
    I am very interested in the foreign fighter flow. I went 
last year to Europe to really delve into these foreign fighters 
coming off the battlefield from Syria, whether they transited 
through Turkey. When I was there, or right before I got to 
Brussels, a foreign fighter actually came back, shot up the 
museum there, the Jewish museum, killed three or four people, 
and tried to flee to north Africa through France. So the 
timeliness of my travels. But this was the very beginning; you 
didn't hear about ISIS as much in May and June of last year, 
not like you hear about them now and at least over the last 12 
months.
    At the time, that foreign fighter that shot up the museum 
in Brussels, Germany knew, apparently knew, about him and 
failed to let the Belgians know or the French know because they 
were suspicious of U.S. intelligence gathering through 
monitoring phone calls and all that has come out after Snowden. 
So what are some of the challenges of tracking these foreign 
fighters? You talk about core al-Qaeda and core ISIL. I am 
talking about the fringe guys that go over and maybe get 
radicalized on the battlefield and decide: You know what? I can 
do this back home. How do we track those guys and how 
successful have we been?
    Mr. Mulligan. So that has been, ironically, that has been 
an incredibly unifying factor among the counterterrorism 
community across the globe. A lot of our Western partners, so, 
I mean, they have got substantial foreign fighter flow issues. 
You know, as Mike indicated----
    Mr. Duncan. Schengen region in Europe, you get there----
    Mr. Mulligan. Yes, sir. Again, that is something they are 
trying to confront in Europe with regard to how do this they 
manage this with the Schengen flows right now? We have been 
sharing a lot of information back and forth with some of the 
means and processes that we are trying to employ to track 
foreign fighters. What is also very clear to us is it needs to 
be, particularly with our foreign partners, a whole-of-
Government approach. We are trying to share with them the 
benefits that we have experienced by ensuring that the free 
flow of information among the interagency. In many instances, 
we will develop an effective relationship with a foreign 
partner, only to discover that the partner flow within their 
own nation is not optimized to try and ensure that appropriate 
law enforcement authorities have been alerted to that foreign 
fighter flow.
    Mr. Duncan. Right.
    Mr. Mulligan. But the bottom line is things are trending 
positively in the information sharing.
    Mr. Duncan. Bilateral trade.
    Mr. Mulligan. Multilateral, multilateral, sir. But the 
other challenge is, again, so we estimate there have been about 
4,000 in total foreign fighters flowing from the West. But what 
we have seen is, again, there are foreign fighters from over a 
hundred countries. Some of our other partners, folks who are in 
that region, have developed very effective mechanisms for both 
tracking the foreign fighters and developing rehabilitation 
programs. So going back to some points that the general made 
earlier, we really need to do a lot of information sharing 
about their experiences at rehabilitation, their experiences at 
tracking, and incorporating them into some of our own 
processes.
    Mr. Duncan. In the essence of time, north Africans are 
trying to get across the Med into Italy and Spain. Once they 
do, they have got pretty much free travel throughout Europe. So 
how do you target those? I mean, these are migrants that are 
getting on boats and coming across. We don't know about.
    Mr. Mulligan. Interestingly, some of the direction that has 
been given lately, over the last several months by ISIL 
leadership, is they are urging a lot of these fighters to 
remain in place, to, as you know, they have been trying to 
establish branches of the caliphate in other countries. So they 
are trying to say: Hey, don't move. You don't need to move 
across north Africa. Stay in Libya and work with our branch 
there. So that is one other part of their strategy. That is how 
they are trying to offset that limitation.
    Mr. Taylor. Sir, if I might add, we are working very 
closely with our European partners on that flow from Italy and 
into the northern parts of Europe. It is a very big concern for 
us, not only from a counterterrorism perspective, because 
eventually some of these people might end up applying for visas 
in our country. So it is a high priority for our intelligence 
exchanges with our partners in Europe in terms of getting our 
arms around that particular flow.
    Mr. Duncan. All right. Thank you. I am out of time. Mr. 
Chairman, I would ask that we delve into the effectiveness of 
JTTFs with regard to some of this.
    That might have to be in a Classified setting. But I yield 
back.
    Chairman McCaul. Let me just say for the Members, we do 
have a do have Classified briefs with the FBI and Homeland, 
social media monitoring and on encryption challenges. JTTFs 
would be ripe. The other flaw I noticed in my travels is that 
European partners don't screen E.U. citizens past any watch 
list as they fly from, say, Istanbul back into Europe. I think 
that is a big security gap. We urged them to change that. I 
know the E.U. Parliament is addressing a change in their law.
    Mr. Taylor. It is in work. It is not moving as fast as we 
would like it to move. But there are some glimmers of hope that 
based upon the recent activity, threats, and actions in Europe, 
that the Europeans understand the importance of PNR and other 
sorts of data tracking of citizens internal to the European 
Union. So we have some hope that there will be a light at the 
end of the tunnel going forward on that.
    Chairman McCaul. I did as well.
    Mr. Langevin.
    Mr. Langevin. Thank you, Mr. Chairman.
    I want to thank our panel for their testimony here today. I 
apologize if any of the questions I am going to touch on have 
already been asked. I had to leave briefly to take a call from 
our commanding general in Afghanistan to get an update, a 
briefing on current status of things over there in my Armed 
Services Committee role. If I could begin with this. As some of 
you may know, I spent a lot of time and am very concerned about 
cybersecurity issues, particularly as they relate to critical 
infrastructure. Can you tell me in your role with respect to 
seeing this stepped-up effort using social media in recruitment 
and using cyber as a tool what you are seeing in terms of 
recruitment or efforts to use cyber weapons to attack critical 
infrastructure? Can you also describe what measures, if any, 
that are also different when combating the threat of a home-
grown terrorist interested in cyberterrorism rather than more 
traditional physical attacks?
    Mr. Steinbach. Sir, I think it is a great question. I 
think, first of all, we are seeing more and more a blended 
threat, the cyber intrusion peace with the counterterrorism 
piece. Where we are at now, we do see those same terrorist 
actors using cyber intrusion as a tool. They are experimenting 
with it, seeing how effective they are. We have seen most 
recently in the last less than a year them becoming more and 
more adept at cyber intrusion-type activities.
    Mr. Taylor. Sir, I would add to Mr. Steinbach's comments by 
saying that this is a very high-priority concern for the 
Department of Homeland Security, our National Protection and 
Programs Directorate work with the critical infrastructure 
community every day across this country about the cyber threat 
in general, and specifically about the threat from terrorist 
actors so that they are prepared for and understand the 
potential for that threat and have means of mitigating those 
sorts of attempts within our critical infrastructure.
    Mr. Langevin. Mr. Mulligan, do you have anything to add?
    Mr. Mulligan. Yes, sir. I mean, I would agree with those 
points. I would also posit, again, it seems that it is an 
inevitable kind of trend that they would move into that realm. 
They would move into that realm because, again, it is a means 
by which they could effect damage in a very cost-efficient way. 
They are operating largely, they have a high degree of 
maneuverability in cyber space. So it seems quite logical that 
they would attempt to pursue that. We need to be developing 
mechanisms for detection of those activities, sir.
    Mr. Langevin. Have you seen those stepped-up efforts to 
specifically focus on that as a tool right now to be used to go 
operational?
    Mr. Steinbach. Yes. We have seen stepped-up efforts.
    Mr. Langevin. Okay. Thank you.
    Mr. Mulligan, if I could turn to you, I am very supportive 
of efforts to incorporate counter-messaging into CVE strategies 
and the use of public-private partnerships, such as the 
Peer2Peer program that you mentioned in your testimony, to 
ensure these messages are heard.
    At the same time, central to any effective counter-
messaging strategy, though, is the credibility of the 
messenger, which can be greatly undermined if Government is 
involved. So how can we ensure that there are independent 
voices that can counter extremist messages without compromising 
the independence that gives their statements weight?
    Mr. Mulligan. Sir, that is exactly some of the outreach 
efforts that we are trying to make with regard to the community 
advising piece. It is also--I mean, it is a question of 
establishing processes by which people will be able to feel 
free that they are able to have the tools to do that kind of 
counter-messaging. The challenges that we have, again, is there 
are still trust deficits that need to be overcome. We all, as 
you said, we need to find those intermediaries who are willing 
to take up that effort.
    Mr. Langevin. Thank you. For the panel and before my time 
runs out, social media platforms play a prominent role in all 
of your testimony, obviously. Can you describe the 
relationships that each of your agencies has with the private 
operators of these networks? Are these relationships 
institutional or more based on personal relationships? What 
kinds of requests do you make of these companies?
    Mr. Steinbach. So I won't get into specifics, sir. I would 
say that we have relationships with every company that is in 
that environment because we have to. We have to serve them 
process. It is based on personal relationships as a starting 
point, but we develop more than that. But I think each company 
is different. I don't think it is appropriate in this setting 
to talk about those particulars with that company.
    Mr. Taylor. Sir, I would add that Homeland Security in our 
cybersecurity role has relationships with all of these 
companies. As Mr. Steinbach mentioned, we probably would want 
to have the conversation in a Classified environment.
    Mr. Langevin. Well, hopefully, we can perhaps follow up on 
that, Mr. Chairman, at a later date then.
    Chairman McCaul. Yeah. If I could just quickly follow up, a 
lot of people ask me why don't we conduct a cyber offensive 
attack to shut down these in the social media program. I guess 
the two problems with that is they will--you know, once that is 
done, they will open up another account rather quickly. No. 2, 
I guess our intelligence-gathering capability goes down quite a 
bit. You don't have to comment at all on that.
    But the Chairman now recognizes Mr. Ratcliffe.
    Mr. Ratcliffe. Thank you, Mr. Chairman.
    I want to thank you and the Ranking Member for holding this 
critically important hearing. Of course, I thank all the 
witnesses for being here today and for all the important work 
that you do every day to serve our country.
    This attack in Garland really seems to underscore and 
demonstrate the unique challenges that ISIS is posing today. In 
Garland, we saw two dead terrorists and no civilian casualties. 
We saw law enforcement do exactly what they should have done, 
which is protect the public. Yet we are living in unprecedented 
times where a failed attack by ISIS in that regard is still 
spun as a win, where a failed attempt still plays into the 
narrative that they want to sell.
    As a former terrorism prosecutor who handled a number of 
matters involving al-Qaeda, I have noticed something that 
appears to me to be an important difference. I want to ask you 
about that. You know, al-Qaeda and ISIS have both been 
encouraging lone-wolf attacks, but al-Qaeda has been doing it 
for years with very little success. It seems to me that ISIS 
has been very effective in this regard in just a matter of 
months. We are at a situation, it appears to me, that ISIS' 
sophisticated use of social media is essentially having a 
cascading effect, if you will, where it has become a terrorism 
multiplier of sorts, one where lone-wolf attackers like Mr. 
Simpson or Mr. Soofi or Mr. Rahim can essentially use the ISIS 
brand without having to join ISIS.
    In that regard, it concerns me that it would appear that 
ISIS has essentially created a terror franchise. So I want to 
very quickly ask you each whether you think I am accurate in 
that assessment.
    Mr. Mulligan. Congressman, I think that is an excellent 
characterization. I would agree with you. That is precisely. 
They have very effectively leveraged that capability. They have 
exceptional capabilities. They claim they are making maximum 
use of every opportunity to amplify effect. You have seen them 
using it in terms of representing their victories on the 
battlefield and the way that they have obviously treated our 
hostages. They attempt to squeeze every bit of, if you will, 
perceptual power out of social media.
    Mr. Taylor. I would agree with Mr. Mulligan in that regard.
    I have been doing this for a long time, about 45 years. I 
have never seen a terrorist organization with the kind of 
public relations savvy that I have seen with ISIL globally. 
They have been very effective in using it.
    Mr. Steinbach. Yeah, I think my colleagues hit the main 
points. I would just add to that in addition that it is a focus 
on a Western audience. When you look at the social media tweets 
in English versus al-Qaeda or others, they are at a much higher 
rate. So it is a great propaganda message. It is a propaganda 
message that is focused on a Western English-speaking audience.
    Mr. Ratcliffe. So we are talking a lot about the effect of 
their message. I want to focus a little bit more on the cause.
    Director Steinbach, you and the deputy director both talked 
about this, this sort-of unique narrative that ISIS has 
created, a false narrative, one that involves a sense of 
community, a sense of adventure, maybe the ability to find a 
spouse. We all know how ridiculous these claims are. But for 
those that are susceptible to radicalization, it seems to be an 
increasingly successful narrative from their standpoint. I am 
curious, since ISIS grew out of al-Qaeda in Iraq, why did ISIS 
suddenly become effective at crafting this message when al-
Qaeda and other terrorist organizations really hadn't been 
previously? Do we have any insight into that?
    Mr. Mulligan. I don't want to oversimplify it, but I would 
point out the demographic. They have attracted a younger 
generation of fighters who are much more conversant. They are 
in a situation where they have initially occupied territory in 
which there was fairly advanced infrastructure that could then 
be leveraged. So, I mean, if you think over time, as you know, 
al-Qaeda has, in some instances, they were not occupying 
optimal areas to try and leverage that infrastructure whereas 
ISIS did position itself very, very well. I also think they 
have a fundamental orientation to action that kind of dominates 
a lot of their psyche and how they move.
    Mr. Taylor. I think the other difference, sir, is that 
social media wasn't as robust when al-Qaeda started as it has 
been since, actually since 2010, the Arab Spring, and how 
social media was used in those events and how it has propagated 
its use by other groups since that time.
    Mr. Steinbach. Just to further clarify what Frank said, he 
is absolutely right. So when you look at the internet, 4, 5, 6 
years ago, it was anonymous, but you still, the bad guy, the 
individual living in the United States still had to reach to a 
forum, identify that forum, go into that forum.
    With social media, it is pushed to you. It is so far 
advanced in comparison to the anonymous internet.
    Mr. Ratcliffe. My time has expired. I hope the Chairman 
will indulge me to ask one additional question. Because I think 
what is important here is I want to find out what the--we have 
talked about their effective messaging and the fact that they 
have created essentially a winning brand that is that is 
drawing the disaffected and disenfranchised to them. What are 
we doing to counter that message? What can we do besides--in 
other words, to create a losing brand for them? I realize that 
part of that is kinetic military operations on the ground. But 
from a social media standpoint, is there a counterstrategy?
    Mr. Mulligan. So I would posit to you that there is 
basically a three-prong strategy. We are trying to counter them 
on the battlefield because of the fact that we are trying to 
negate this image of the caliphate which they are successfully 
representing. I mean, that is kind-of their center of gravity.
    The second piece, as you described, is the whole cyber on-
line media piece. Going back just very quickly to what Frank 
said, the range of options of over-the-top applications that 
they are able to employ. I mean, going back, I mean, what were 
the options that were available to al-Qaeda? Not so great. Now 
we are in another universe of operational activity. But, 
nevertheless, because they are operating in public space they 
have vulnerabilities there. We should move very aggressively to 
counter that.
    Finally, the third area is this ideological space that we 
talked about in terms of finding those voices, those credible 
voices that can contest the ideological message. We need to 
work defense all three of those.
    Mr. Ratcliffe. Thank you, gentlemen.
    I yield back. I appreciate it, Mr. Chairman.
    Chairman McCaul. Thank you.
    Mrs. Torres is recognized.
    Mrs. Torres. Thank you, Mr. Chairman.
    Mr. Steinbach, I am looking forward to reading that 
Brooklyn Institute study on terrorism and social media. I took 
a sneak peak at it while we were in the session. I understand 
that, as of October of last year, there were 42,000 identified 
Twitter accounts if the report is correct, and thousands have 
been disabled. In some ways, I kind-of think that, you know, it 
is good to be able to view what is being said and what is being 
planned is one way we can try to prepare and prevent.
    Mr. Taylor, there has been a lot of talk about community 
outreach programs. There has been a lot of talk about community 
awareness, community policing. This is nothing new. We have 
known that there have been a lot of issues in the past that 
need to be addressed from a neighborhood level. But somehow we 
have not been able to translate that want to do neighborhood 
community awareness to actually doing it.
    We have seen a lot of tensions arise between our local law 
enforcement groups and our community groups. This is nothing 
recent. This has been on-going. So what have we changed? What 
does community policing look like in my neighborhood versus, 
you know, the northern part of California?
    Mr. Taylor. Ma'am, your question is a good question. I 
think community policing is community policing. I don't think--
it is about relationships with the communities that we serve. 
It hasn't changed in 20 years that I have been involved in 
community policing. It is the outreach that happens with people 
who are from the community so that you build partnerships. That 
is what community policing is all about.
    I daresay it happens in diverse communities. It happens in 
majority communities. But it has to happen the same way. You 
have to build a relationship.
    Mrs. Torres. You need to have trust.
    Mr. Taylor. And the trust.
    Part of--Secretary Johnson has spoken eloquently about 
this--when he goes out to do these community engagements, he is 
met with skepticism. He receives complaints about profiling and 
other sorts of concerns the community has. But you have to have 
that discussion, too, to build the trust, that we are talking 
about things that the community needs to know that the 
community can do to protect themselves.
    Mrs. Torres. Thank you.
    Mr. Steinbach, I know that--well, I want you to know that I 
represent the Ontario airport, which is, to our demise, it is 
controlled and managed by LAX. I would like to hear more about 
the FBI's Joint Terrorism Task Force in Los Angeles and how 
they are working with my local police department in Ontario to 
ensure that training is happening not only for those officers 
at LAX or LAPD, but it is also happening for those officers who 
would be the first responders should an incident happen.
    Mr. Steinbach. The LA FBI's Joint Terrorism Task Force is a 
very large task force. It does not just include LAX, it 
includes all the major airports, Orange County, Ontario. I 
would suggest that you make an appointment to go out and tour 
that. I am sure the office out there--Dave Bowdich runs that 
office--he would be happy to provide a tour and give you first-
hand an understanding of just how robust that task force is. I 
was just out there a couple weeks ago discussing with him and 
meeting some of the folks on his task force. But I would 
encourage you to go out there and see first-hand.
    Mrs. Torres. Right. I would like to continue this 
discussion with you off the record here.
    Mr. Steinbach. Sure.
    Mrs. Torres. To bring to your attention, my staff recently 
went on a tour, and I was saddened to have discovered that 
while training is happening among other agencies, Ontario 
Police Department has not been invited to participate in many 
of that--or much of that.
    Mr. Steinbach. So I would be happy to have that 
conversation with you, and I also would be happy to bring those 
concerns to Mr. Bowdich's attention.
    Mrs. Torres. Thank you.
    Mr. Taylor. Ma'am, if I might as well, in our community 
outreach role in DHS, we certainly are working very hard with 
police agencies throughout California. So if there is a deficit 
of training and there is something that DHS might be able to 
help in Ontario, we are more than happy to have that discussion 
and ensure that the training that is available in 
counterterrorism is available to Ontario.
    Mrs. Torres. Thank you.
    Chairman McCaul. Mr. Katko is recognized.
    Mr. Katko. Thank you, Mr. Chairman.
    I want to thank each one of you for being here today, and I 
have heard from some of you in the past, and I am constantly 
amazed at your depth of knowledge but also your dedication to 
your mission. I echo the sentiments of my colleagues, and I 
very much appreciate what you are doing to keep our country 
safe.
    Mr. Steinbach, I want to talk to you just for a minute 
about the CALEA-type comments that were being made, and I just 
want to make sure that we are clear. I was a Federal prosecutor 
for 20 years and routinely engaged in all types of 
sophisticated wiretap surveillances and other electronic 
surveillances. Our investigations benefited greatly as the 
cellular telephone industry developed. There were many 
technologies that were introduced to the market that we could 
not at first monitor.
    I think just so I am--I want to make sure we are clear what 
you are talking about. For those internet sites and those 
places on the--out there that are dark, if you will, you are 
simply talking about being able to have access to them. So not 
to monitor them without a court order, but to, obviously, to 
use court orders if there is probable cause to then monitor 
those sites. Is that what you are talking about?
    Mr. Steinbach. Absolutely correct, sir.
    Mr. Katko. Okay. So this isn't talking about just, you 
know, forcing them to go public so that we can monitor 
everything that is going on. You are talking about if you get 
probable cause we go forward.
    Mr. Steinbach. Going to the court with a court order, 
criminal courts or the FISC.
    Mr. Katko. Okay. Very good.
    Mr. Taylor, you mentioned about CVE probably being our best 
defense against the violent extremism and the reaching out to 
the people that--and programs to be our best defense. I 
couldn't agree with you more because I was with the Chairman 
and others when we went overseas to talk to our foreign 
partners and to see first-hand the issues with the Foreign 
Fighter Task Force, and there are security gaps overseas that 
we can't control. It leads me to conclude that our best chance 
of stopping these instances from happening in the United 
States--unfortunately, it is going to be on our soil. It is not 
going to be overseas, at least not yet.
    So, with that being said, if you could just expound for a 
minute, what would you envision, briefly, as to what would be 
the best way to build this program? I know we have got some 
pilot programs Nation-wide, but what would be the best way to 
build this program?
    Mr. Taylor. You mean here in terms of community engagement 
here----
    Mr. Katko. Yes.
    Mr. Taylor [continuing]. In our own country?
    I think this is all a part of a broad set of strategies. 
Community engagement in this country is one part of that. I 
think we learned a lot of lessons from the pilot studies we 
have had in Los Angeles, Denver, Boston, and Minneapolis.
    Mr. Katko. Minneapolis, yes. Yep.
    Mr. Taylor. Now the challenge is to propagate those lessons 
learned to communities across this country, which we are 
continuing to do. We believe that the first line of defense 
from radicalization is the family and the community and build 
from there. The propagation of these--this training, this 
engagement, we believe will help us achieve a better outcome in 
terms of what we are trying to get.
    Mr. Katko. Now we have the JTTF model for the law 
enforcement side, but from the community outreach side, I know 
most U.S. attorneys' offices, from example, have LECC-type 
coordinators. Do you envision them playing any role in this?
    Mr. Taylor. Absolutely. It is a shared responsibility 
between DHS and the FBI, NCTC, and the Justice Department, and 
I think it is a whole-of-Government and local Government 
effort, not just the Federal Government. It has to be a whole 
community effort.
    Mr. Katko. I want to talk to--all three of you gentlemen 
can answer this question. The JTTFs have been the backbone of 
our antiterrorism efforts, and, you know, they have been--they 
have done a terrific job. It seems to me lately that they are 
under more and more stress with all the additional things that 
they have to look into on a regular basis. It seems that there 
may be more of a reliance on getting State and local law 
enforcement involved with the JTTFs. Is it a concern going 
forward, are there staffing concerns with the JTTFs going 
forward, and is there a concern that there are not enough 
Federal agents involved going forward?
    Mr. Steinbach. I would be happy to answer that question.
    Mr. Katko. It is FBI. You are going to say yes because you 
want more money. Right?
    Mr. Steinbach. Oh, I will say, as the head of the 
Counterterrorism Division of the FBI, the media reports last 
week were completely wrong. So the JTTF is fully staffed. The 
JTTF as its backbone, as you said, relies on a robust 
partnership with State, local, Federal, Tribal agencies. Those 
resources are there. They have not waned, and we certainly are 
not struggling to keep pace. It is a challenge. We have to 
prioritize our targets, but we have a very robust structure in 
place that relies heavily on the 17,000 State and local 
agencies around the country.
    Mr. Taylor. I agree completely. I happen to have been the 
commander of the Air Force Office of Special Investigation when 
the JTTF concept was created. I supported it back in the 1990s, 
and I still support it today as the best law enforcement 
process for getting at the terrorist issues.
    I think the other thing we have done--and it is not just 
with the JTTF--JTTF relies on fusion centers, relies on the 
18,000 police organizations, first responders, and we have done 
a significant amount of training of those individuals, ``See 
Something, Say Something,'' so that they become force 
multipliers for the JTTF investigators as they focus on, you 
know, the investigation of specific cases. So I can't speak for 
the resource part, but I can speak for the part that says 
Homeland Security, NCTC, the FBI, has invested a significant 
amount of training and effort to--so that people understand the 
threat, understand the risks, understand what to look for and 
report that information on a continuous basis for follow-up 
investigation or for intelligence to go into the IC.
    Mr. Katko. Mr. Chairman, if you indulge one brief question.
    So the takeaway from this, then, is that if there is a 
resource issue, it is on the CVE side and--or the community 
outreach side, and that if something that if we can help you 
with, that would definitely help with the messaging.
    Mr. Taylor. Certainly would help with the messaging and 
with our on-going efforts.
    Mr. Katko. Thank you all, gentlemen, very much.
    Chairman McCaul. Thank you.
    Mr. Keating is recognized.
    Mr. Keating. Thank you, Mr. Chairman.
    Two incidents just this week really demonstrated to me the 
prevalence of what this committee hearing is about today in 
terms of the internet and that as a recruitment device. It hit 
really close to home.
    One of them was the killing of Ahmad Abousamra. He--you 
know, he was educated. He went to school just a few miles from 
where I went to school and where my children went to school, 
and became radicalized. As you are aware, he was among--he was 
on the FBI's Ten Most Wanted List, and he also was the 
architect, one of the major architects, of what we are 
discussing here today, where he was fashioning the internet 
message in a very sophisticated way. He was killed in northern 
Iraq during the last week.
    Then, second, in the area I used to represent in the 
legislature, the neighborhood in Boston, where the terrorist 
incident occurred. I want to congratulate you on your work, 
your fine work, in dealing with that where there were reports 
where that was linked, at least the reports out there on there 
in an on-going investigation, public reports, that was linked 
to this kind of on-going recruitment through the internet.
    So I look at those things, and I understand the importance 
of information sharing on one end. What we concluded with the 
Boston Marathon bombing, the importance of both the local, 
State, and Federal Government working together to share that 
information. I want to congratulate you all on moving that 
forward and improving that situation.
    I think it is very clear, although it is not happening this 
moment in terms of maybe even actionable threats, but at least 
incidents that have occurred, we are going to have to expand 
that to local government, State government, Federal Government, 
and international because it is just a matter of time before 
many of these linkages materialize in a concrete fashion.
    I want to ask two questions: No. 1, given the fact that it 
is going to be four areas, not just three, of information 
sharing, we came back, several Members of the this committee, 
from a CODEL, and we understand the difficulties in--
particularly in the Europe area with our allies where they are 
not moving forward with passenger name records, which we take 
for granted here, when anyone makes a reservation. Having 
border security even on the exterior of the European Union 
borders and how that is not moving the way it should as quickly 
as it should, and even the technical support that we offer as a 
country to some of these countries as to how to deal with it 
not being utilized.
    So I want to ask on a couple of fronts. No. 1, I still 
think we can work together with countries, even if the European 
Union isn't moving. I want you to comment on how we are dealing 
with that information sharing, local, State, Federal, and with 
those individual countries because we also found that some 
countries are more receptive and moving faster than others in 
terms of information sharing that will make us all safer, not 
just here and not just when Americans travel abroad in Europe, 
but here at home too.
    The other thing is the idea that, you know, we are doing a 
good job swatting mosquitoes here at home when it comes to the 
internet, but we are not drying up the swamp as much as we can. 
Can you comment on what we are doing for counter-messaging, not 
just enforcement or trying to find out what is going on, but in 
counter-messaging through the internet to try and have 
competing messages and what you think more could be done? So 
those are the two questions, and anyone that wants to address 
those.
    Mr. Mulligan. So I will jump in on the first piece with 
regard to--and, again, my colleagues are more conversant on 
pushing the information to the locals. But from a National 
perspective, we are very consciously trying to push the 
intelligence and the knowledge that has been gleaned from our 
assessments down to the locals so that they are more fully 
informed. That is definitely--and we need to do more and we 
have to keep pushing that.
    On the international piece that you described, it does 
become at times very unwieldy when you make it a multi-lateral 
issue. So we have established a number of very close bi-lateral 
relationships in terms of information sharing that has been 
very, very positive.
    But the challenge is, if you really are going to try and 
address these challenges in a time-efficient way, you need to 
ensure that a broader range is--that you have the equipment 
that you can be passing information effectively. So that is a 
longer-term objective in that regard.
    In terms of the overall counter-messaging, the Government--
our Government, our Federal Government, has an interagency 
process involved in which we are all moving to do counter-
messaging, that counter-messaging works at the speed of 
Government. It is--well, as you understand, it has constraints 
in that I think the real secret is going to be to broaden that 
overall counter-messaging and include those folks outside of 
the Government so that they can participate in that process.
    Mr. Taylor. I would make two comments, sir.
    First, this committee has been very clear to me in my role 
as the under secretary for intelligence and analysis that the 
core customer for the intelligence that we do is State and 
locals. We have worked very hard for the last year to try to 
transform how we approach the dissemination of data and 
information to our State and local partners with our IC 
colleagues, with the FBI, and with others, and NCTC, but 
specifically focusing on getting relevant information out 
quickly to our State and local partners. I don't know how many 
Joint Intelligence Bulletins we have done this year, but I 
think it is a record over last year. So that is our commitment, 
to move this information and get it into the hands of our first 
responders at the State, local, Federal, Tribal, and private 
sector.
    When we talk about our foreign partners, you mentioned the 
European Union. The European Union is, in some cases, reluctant 
to use PNR across to all the European Union. We do have 
individual dialogues with members of the European Union where 
certain countries are moving forward to do that within their 
own country. I think I was just on the--in New York at the 
United Nations with Secretary Johnson. We talked about U.N. 
Security Council Resolution 1267. I think there is more 
pressure on those communities to do that, and we will continue 
to press to get those kinds of laws passed in those countries 
for that kind of information.
    I would also emphasize that all of the Visa Waiver 
countries--and that is most of the European Union--have 
independent bilateral agreements with us on information 
sharing. Now, it may be through the intelligence service, it 
may be through the FBI or law enforcement. Those are very 
robust agreements that we are continuing to press for the 
exchange of that kind of information. So it is not a perfect 
scene yet, but the information exchange both within our 
country, to our State and local partners, and also with our 
foreign partners continues to improve on a daily basis.
    Chairman McCaul. Mr. Loudermilk is recognized.
    Mr. Loudermilk. Thank you, Mr. Chairman.
    Thank you all for being here. Of all the hearings that we 
have had, in my opinion, this has been one of the most 
productive and informative that I have sat in on.
    One of the things that we are going to be doing in my 
office in the coming weeks is visiting with local law 
enforcement, our fusion centers within the district because 
what I am seeing with this lone-wolf attacks, the calls for 
attackers that are already in the United States, there is going 
to be a reliance on local law enforcement. With the recent 
attacks, it is a reminder to me, and I think to all of us, that 
these attacks are not against us as individuals, they are not 
against us as citizens. They are attacks by those who are 
threatened or diametrically opposed to what we are as a people 
and what we have, which is freedom. You know, our freedom of 
thought, freedom of ideas, freedom of religion and, in the case 
of Garland, Texas, was the freedom of speech. That was really 
what was being attacked.
    With that in mind, the American Freedom Defense Initiative 
and their contest seems to be--as some have said--incited these 
attacks. Understanding and knowing what happened with Charlie 
Hebdo in Paris, which I was there just a few weeks ago in Paris 
with this codel, it would lead us to believe that this is a 
potential target. The first question, how far in advance of the 
event did our IC or counterterrorism know that this event was 
happening? How did we find that out? Was there a coordination 
with them, or did this come from local law enforcement?
    Mr. Steinbach. We knew about it several weeks in advance. 
More specifically, I will say, in this event, in the event in 
Phoenix last Friday, and in every event like this, we do go to 
those organizers and individuals and lay out the threats and 
the potential. We, of course, don't try to talk them out of it, 
but we explain to them: Hey. If you do X, this may happen. So 
we knew several weeks in advance.
    Mr. Loudermilk. Okay. So you know that these are coming. 
How much interface do you have with the local law enforcement 
going into these?
    Mr. Steinbach. It is multi-faceted. So, you know, we put 
out a joint intelligence bulletin which lays out, in this case 
in Garland, a week in advance, kind-of laid out the events and 
the threat to the events. In this particular case and in many 
events like it, we push out a communication tool called a 
collection emphasis message. That collection emphasis message 
asks agencies, Federal, State, and local, to collect 
intelligence on the event and the threats. We put out tactical 
reports. We have, in many cases, depending on the size of the 
event, we have preparatory meetings with State and local, 
identifying who is going to have lead for crowd control, 
emergency response, tactical resources. It is a multi-layered 
approach we take with every special event.
    Mr. Loudermilk. Now Miss Rice asked one of the questions I 
was getting at which was we have 15 years of tracking 
terrorism, terrorists, and their activities, their threats 
through all the chatter. So we have kind-of got to where we can 
filter through what is just chatter and what is a valid threat.
    How responsive are local law enforcement to the threats 
that we are laying out? You know, do they tend to take them 
seriously?
    Mr. Steinbach. Yes. We spend a lot of time, DHS, NCTC, and 
the FBI, pushing that message at the local level through the 
field offices as well as at the executive level.
    Just 2 weeks ago, we had a video teleconference that was 
led by the director of the FBI and the director of Homeland 
Security, where we lay out, again, the threat, the current 
threat. We do that periodically. So there are multiple levels 
of engagement. Today I am going to be taking to major city 
chiefs on this same topic.
    Mr. Taylor. I would add, sir, that we have created a 
network in our fusion centers with our JTTFs across this 
country. Whenever an event occurs, there is someone up on the 
net saying: What is the impact on my community? That is done 
over the Homeland Security intelligence network, or it is done 
over the law enforcement network of the FBI. Our local law 
enforcement partners understand their primary responsibility to 
protect their communities. They understand these risks threaten 
their communities. They are hungry for information to help them 
prepare. That is what we try to design is a system that gets 
that information out to them. Once they get it, as they did in 
Garland, they take the appropriate action.
    Mr. Loudermilk. Now, and if some of this--these questions 
are more of a Classified nature, we can respond to those later 
because I understand and appreciate being in the intelligence 
community in the past.
    But of the communications that we know that happen between 
the attackers and other bad players, how much of that did we 
know before the attack versus as forensic information, and how 
much of that played into the warning that we sent to the local?
    Mr. Steinbach. I would be happy to answer that, but not in 
this setting.
    Mr. Loudermilk. Okay. I appreciate that.
    The last one is the reverse flow. Do we have good channels 
of communications for intelligence gathering from local law 
enforcement, who are the boots on the ground in the community, 
that--because, you know, this was a National event per se 
because it was an organization out of New York, but you may 
have a local event that could be a high-threat target. Do we 
have a flow of information up from the locals?
    Mr. Taylor. Sir, it is a great question. Again, under the 
direction from this committee, we have worked to expand the 
amount of local intelligence that is gathered and reported into 
the IC that is relevant to the IC, not only working with the 
FBI but working independently with our fusion centers in the 
field. We have created a new process, what we call field 
activity reporting, where fusion centers working with DHS and 
the FBI will do reports from a field--State-level perspective 
on threats and risks in the community.
    So I think we have created that opportunity for the local, 
State and local partners to report up, for us to report down, 
and for all of us to share information on a continuous basis.
    Mr. Loudermilk. Are they actively reporting up?
    Mr. Taylor. Absolutely, sir.
    Mr. Steinbach. Let me highlight that a little bit more, 
sir.
    So, I mean, the reason we are pushing information out is to 
make use of the 400,000 State, local, and Tribal law 
enforcement officers around the country. They are our first 
response. They are the ones doing the car stop. They are the 
ones going to the house as the first responders. They are 
seeing it well before any of us here see it. It is incumbent we 
have the guardian process that allows for reporting, the e-
guardian process that allows for reporting of information 
quickly into the fusion center and the JTTF model to act on 
that. So that is the crux, and that is really at the foundation 
of this process.
    Mr. Loudermilk. All right. Thank you very much.
    Mr. Chairman.
    Chairman McCaul. Ms. McSally is recognized.
    Ms. McSally. Thank you, Mr. Chairman.
    Thank you, gentlemen for your testimony today. I 
appreciate, as part of our Task Force on Combating Terrorism 
and Foreign Fighter Flow, we have had some other conversations 
in Classified settings. So I appreciate all the work that you 
are doing.
    Question I have today is about--first one is about the 
recruitment of women and girls from our country. It seems that 
jihadi women in Syria are actively recruiting--or not just 
women, recruiting Western girls. I, you know, can't imagine 
what the draw would be, except of course they are being lied to 
like most of the recruits. But here we have American girls that 
are being recruited to potentially flow over there for a life 
of rape and slavery. So specifically of about--I think you said 
there is 200 that we know of Americans that have flowed over to 
the region, how many of them are women and girls, and are there 
specific targeting efforts that we are doing community-wide or 
others in order to address specifically what is going on with 
targeting of women and girls?
    Mr. Steinbach. So I won't get into specific numbers, but, 
you know, when you look 5, 6 years ago, the number of female 
recruits was almost nil. So right now it is 10 percent I think 
is probably a good ballpark. So it is a minority, but the fact 
that it went from zero to where it is at now is a significant 
uptick for us. So, yes, we look at the reasons why individuals 
are recruited, the specifics. Young adult males, young adult 
females, what is drawing them?
    That is part of our process to understand it, what the 
motivation is for radicalization. We find a wide variety. It is 
not just the classic--you see on TV--jihadi bride. There are 
other reasons that are motivating these young women to take a 
chance and go overseas.
    Ms. McSally. So and as part of the countering of it and 
engaging with communities actually--do we have messages of, 
``No, you are going to be in slavery and repeatedly raped when 
you get over there,'' and actually countering that in, you 
know, the graphic reality of what they are going to get 
recruited into to include potentially testimonies of 
individuals that have experienced this. I mean, the way you 
counter a message is with a stronger message.
    Mr. Steinbach. Absolutely.
    Ms. McSally. So we are doing some of that----
    Mr. Steinbach. Absolutely.
    Ms. McSally [continuing]. At the local level as well?
    Mr. Steinbach. Yes. Through the JTTFs or the fusion 
centers. As part of the CVE narrative, we are reaching out, you 
know, pushing the message out to the communities, to the 
schools, having conversations about the dangers of being on-
line, not just on-line because of pedophiles and because of 
cyber criminals but on-line for fear of recruitment and 
enticement.
    Ms. McSally. Right. Okay. Great. Thanks.
    My next question is about the use of social media for 
fundraising and wonder if you could comment on how ISIS is 
using social media in order to raise funds through crowd-
sourcing and other, you know, attempts to raise funds using 
social media, and are you working with the Department of 
Treasury, specific offices of asset forfeiture, FinCEN and 
OFAC? Specifically, how successful have they been and how are 
we countering that fundraising?
    Mr. Mulligan. I would characterize it for you as it is a 
very arduous process to rebuild--or build our understanding of 
the financial processes that ISIS and ISIL is employing 
currently. I would also point out, as you probably are very 
well aware, that they are--in their expansion of the caliphate, 
they are literally taking possession of a number of resources 
and then exploiting that. So, to a large extent, they have been 
able to draw on a lot of those resources for a lot of their 
financing and funding. But, nevertheless, it is a long--and 
because of the fact that they are an extended organization, 
they have to manage that financial infrastructure. That is an 
intelligence effort that is underway. We are working very 
aggressively with the Treasury Department and other 
stakeholders.
    Ms. McSally. So their on-line fundraising is miniscule 
compared to how their--I mean, I know black market and all the 
stuff they are doing in the regions that they have and the 
ransoms and all the things that they have done that we are 
focusing on, but specifically the on-line fundraising.
    Mr. Mulligan. I would qualify it by saying I don't think 
that we are seeing the same degree of on-line fundraising that 
we probably have seen in the past by other entities.
    Mr. Steinbach. I would concur with that.
    Ms. McSally. Yeah. Okay. Great.
    My last question really quickly is, we know ISIS has been 
trying to motivate people to attack military bases or attack 
military members. Obviously, you know, I was in the military, 
those are some of our most secure areas. There is, you know, 
certainly softer targets that they could go after, but if they 
were to recruit somebody who has access to a base, Major Hasan 
as an example, you know, we could have a major impact from an 
insider threat.
    Have you seen ISIS attempting to recruit military members 
or those who have access to bases? Are you working with the 
Department of Defense in order to counter that threat?
    Mr. Taylor. Well, as the Chairman mentioned in his opening 
remarks, the Department of Defense takes this threat very 
seriously. They work very closely with the FBI, the IC, and DHS 
around how those risks are--might manifest themselves within 
the country.
    Your point earlier, it is a pretty secure place, but they 
have even identified people by addresses, and we work with the 
military on strategies for those individuals to protect 
themselves at this point.
    Ms. McSally. Okay.
    Any other comments?
    Mr. Mulligan. Wanted to just offer the fact that it is very 
reasonable to expect a very aggressive effort by ISIS to be 
trying to derive military targets because part of their overall 
narrative is the fact they want to draw linkages. They want to 
make those correlations. So we have to be particularly vigilant 
with regard to military members.
    Ms. McSally. Great. Thank you.
    My time is expired. Thank you, Mr. Chairman.
    Chairman McCaul. Let me thank the witnesses for your 
testimony and your service to our country.
    The Members may have additional questions in writing, and 
pursuant to committee rule 7(C), the hearing will be open--
record open for 10 days. Without objection, the committee 
stands adjourned.
    [Whereupon, at 12:29 p.m., the committee was adjourned.]

                                 [all]