Forensics and Attribution

Description: Conduct forensic analysis and attribute terrorist acts (including the means and methods of terrorism) to their source(s), to include forensic analysis as well as attribution for an attack and for the preparation for an attack in an effort to prevent initial or follow-on acts and/or swiftly develop counter-options.
Forensics is the collection and examination of evidence associated with an act and is a critical part of the process supporting an attribution determination. Attribution involves the fusion of the science- based technical forensic examination results, all-source intelligence information, and other law enforcement/investigative information. The forensics and attribution capability is central to the identification of terrorist actors, co-conspirators, and sponsorship. They are conducted, in part, to inform government leadership of the responsible actor(s) and/or sponsorship and to assist in the prevention of initial or follow-on acts of terrorism. Attribution assessments always include a confidence determination.
This capability may need to be delivered in a time-constrained, hazardous, or crisis environment. Upon a terrorist act or incident, execution of this capability begins with the swift exploitation of evidence for the collection of intelligence information, and subsequent analysis that contributes to the attribution process. Evidence exploitation may occur at attack sites, identified support locations, networks, or at the site of prior and post activities.

Critical Tasks
 Preserve the crime scene and conduct site exploitation for intelligence collection.
 Conduct crime scene investigation.
 Conduct forensic evidence examination, including biometric and DNA analysis.
 Conduct CBRNE material analysis.
 Conduct digital media, network exploitation, and cyber technical analysis.
 Assess capabilities of perpetrating terrorists and compare with known terrorist capabilities and methods of operation.
 Conduct investigations to identify the perpetrator(s), conspirator(s), and sponsorship.
 Interview witnesses, potential associates, and/or perpetrators.
 Analyze intelligence and forensics results to refine/confirm investigative leads.
 Fuse intelligence, law enforcement information, and technical forensic conclusions to develop attribution assessments.
 Interpret and communicate attribution results, confidence levels, and their significance to national decision makers.