Counterintelligence in Afghanistan: Preliminary Credibility Assessment Screening System

: The present article explores one of the most relevant counterintelligence (CI) programs in Afghanistan. The preliminary credibility assessment screening system (PCASS) assisted to provide initial screening of suspects for further follow up of intelligence and security forces. Thus, the objective of this article is to explore the dynamics of employing this technology in fragile states in support of the intelligence activities. To that purpose, we have used an exploratory case study research, which included several sources of data collection. We found that PCASS is used to empower the Afghan police forces to identify and neutralize insider threats, but also to keep NATO-coalition forces safer. Further research should focus, for instance, on the impact of the Afghan culture on PCASS operations.


Introduction
This article focuses on counterintelligence systems that are used to assist the detection of criminal activities, infiltration, insider threats, and espionage in the Afghan National Defence and Security Forces (ANDSF). To achieve that purpose, we will focus in the most promising programs implemented in Afghanistan, which is the Preliminary Credibility Assessment Screening System (PCASS) and Cellular Exploitation (CELLEX) that have been implemented in both Afghan Ministry of Interior (MoI) and Ministry of Defence (MoD).
It is generally accepted that after 9/11, and during the first phase of the war in Afghanistan, the rate of "green-on-blue" incidents, also known as insider attacks, was high and therefore simply unacceptable. After the PCASS program was introduced in late 2012, everyone agreed on the significant effect on reducing the internal threats [1], so we thought the PCASS program deserved to be studied. In order to provide an idea of the severity of the green-on-blue attacks, we believe it is relevant to illustrate that since 2007, insider threats in Afghanistan have killed more than one hundred and forty coalition troops and wounded more than one hundred and eighty of them [2]. As a result, and according to Walters and Traugutt [1], between December 2012 and June 2016, the Afghan Intelligence Units have conducted over thirty thousand PCASS exams, resulting in over four hundred Afghans being removed from positions of proximity to coalition forces and in several insurgent infiltration cells being disrupted.
The war in Afghanistan practically required the participation of all members of the North Atlantic Treaty Organization (NATO) [3]. So it seems quite clear that with so many troops on the ground, insurgent activities would also have more targets of opportunity to shoot down. To mitigate the non-screening contact between Afghan National Defence and Security Forces (ANDSF) and Coalition forces, the PCASS program made a great contribution to both the selection of Afghan forces that were in contact with the NATO forces, and removing the latter if there was any indication of threat. On the other hand, the recent withdrawal of NATO troops from Afghanistan will naturally reduce the contact with ANDSF and therefore the likelihood of coalition casualties may also be lower.
For NATO leadership, the integrity of the force is of paramount importance, and in this regard the insider threat detection and the reduction of green-one-blue attacks is equally relevant in decreasing the likelihood of troops retraction. Anyone who knows NATO well is aware that there are always tighter force protection measures at times of political decision-making about the future presence of NATO's mission in Afghanistan. It should be noted that France redeployed their main forces from Afghanistan followed by an insider attack on a French training mission in KAPISA province, which killed four soldiers and wounded fifteen, eight of them seriously [4]. Additionally, to reinforce the previous concerns, as we are writing this article, two US military were killed in action, in what appears to be another insider attack [5]; this proves that there is still a long way to go when it comes to the improvement of the force protection measures.
We have also noted that the number of articles dealing with this issue is relatively low and the existing ones are more technical and quantitative in nature. Notable research is related to the articles of data and text mining methods for real world deception detection from Fuller et al. [6] or the innovative research that intended to fabricate portable devices by using wearable sensors and soft computing algorithms from Golgouneh and Tarvirdizadeh [7]. In order to complement the existing literature, the purpose of this article is to shed light on the use of PCASS in fragile states, in particular as regards the support of intelligence activities and their implications for the security of NATO-coalition and Afghan forces.
This article is structured into five sections; after the introduction we have provided a brief review of the literature; secondly, we explained the methodological process and the main sources of data collection; then, we discussed the main findings of the research; in the last place, we provided the conclusions, limitations and suggestions for further research.

Background
For more than half a century, the polygraph profession has asserted that seemingly unresolved cases can be unraveled by resorting to the physiological basis of a suspect's truthfulness [8]. Although polygraphs and PCASS have been used in the field of criminology, they are increasingly being applied in the field of defense as well.

NATO Counterintelligence and the Afghan Police Intelligence Force
The legal framework for NATO Resolute Support is provided by a Status of Forces Agreement [9] that defines the terms and conditions under which NATO forces carry out their activities in Afghanistan.
The Resolute Support is a new NATO-led, non-combat mission [10], whose main purpose is to train, advice and assist (TAA) the Afghan National Defence and Security Forces and Afghan Security Institutions (ASI) [3]. The Resolute Support uphold the North Atlantic Council Initiating Directive to be a non-combat mission, as we have already mentioned -which implies 1) non-direct participation in counter-terrorism tasks; and also 2) not directly engaged in counter-narcotics tasks; thus, the TAA efforts include, but are not limited to: professional development, logistics, communications, intelligence, medical support, maintenance, aviation, tactical air control, and maintaining a Quick Reaction Force [11].
TAA is defined in the NATO Advisor Assistance Guide [11] as: "Train -developing ASI programs and institutions to educate, instruct and prepare the ANSF, enabling them to generate and maintain the force, thereby providing and maintaining effective and enduring security capabilities; Advise -facilitating and influencing by means of counsel and the improvement of ASI and ANSF through the creation of a professional relationship based on trust; Assist -aiding in the accomplishment of tasks and will focus primarily on developing ASI and ANSF systems, processes and procedures" (p. [4][5][6][7][8][9]. NATO Advisors of the Afghan Intelligence Units have performed Level 1 TAA, which means they have assisted their counterparts in a daily basis close proximity, at a time when the coalition was reducing its footprint within the operational framework. Resolute Support advisors work at the national and regional levels to mature Afghan intelligence capabilities. These advisors are teaching their Afghan counterparts on how to work as analysts and how to prepare intelligence estimations in support of military and policing plans and strategies, and they help the Afghan National Army (ANA) and the Afghan National Police (ANP) to expand intelligence, surveillance, reconnaissance [12], and in particular to improve their (counter)intelligence capacities.
Although NATO Resolute Support distinguishes "intelligence" from "counterintelligence" activities, and where both are carried out by different units, sometimes the ANDSF distinction is not as clear. For example, the MoI Directorate of Police Intelligence are often compiled to perform intelligence and counterintelligence missions due to the organizational constraints (e.g. lack of human or material resources). That is the reason why we sometimes use the terms intelligence and counterintelligence interchangeably, when referring to ANDSF; and that is also why NATO's INT and CI units work in such a close cooperation.
While intelligence (INT) is generally classified as the collection of critical information that aid decision makers determine further police or military activities, counterintelligence (CI) may be defined as the information gathered and activities conducted to protect against espionage, sabotage, or assassinations conducted by or on behalf of foreign governments or elements of foreign organizations, persons, or international terrorist activities [13]. A more general definition may identify counterintelligence as any measure taken to negate intelligence collection efforts against an organization or its people [14]. Doctrinally, general counterintelligence operations include advice and assistance programs, which in Afghanistan´s particular situation aim to improve ANDSF´s security posture. In that regard, and according to Wettering [15], the Polygraph examinations serve three separate counterintelligence purposes: 1) they intimidate would-be 46 DOI 10.3849/aimt.01343 disclosers of secrets from doing so for fear of being caught; 2) when used on a routine basis they can reveal deceptions which can lead to confessions, or at least more intensive scrutiny; 3) they can be used as a follow-up investigative tool should a person come under suspicion from other means. Although there is some consensus in the literature that the polygraph is a vital tool of counterintelligence, yet it is opposed by some government agencies [15].
In accordance with the assumptions described above, we believe it is important to identify the duties of a NATO Police Intelligence Investigations Advisor, which is: to organize, train, and equip the intelligence system of the Afghan Ministry of Interior's Directorate of Police Intelligence 1 in order to develop and sustain a professional police force responsive to the needs of the civilian population and the security requirements of the Government of the Islamic Republic of Afghanistan (GIRoA) [16]. According to the aforementioned recruitment position, which is still available on the Internet, it is intended to integrate a Police Intelligence Investigations Advisor into NATO's INT Unit(s) [16], we disclose the intelligence main duties, which include: • to advise and mentor the Afghan Directorate of Police Intelligence (DPI) Director of Police Intelligence Investigations, • to assist in implementing Afghan Police Intelligence Model, • to synchronize Police Intelligence Investigation activities, • to support the development of plans, policies, and doctrine for DPI investigations, • to oversee technical innovations and development within the investigations unit, • to assist in coordination with other Afghan Police investigative organizations, • to ensure the implementation of the Ministerial Development Plan is progressing to professionalize the Afghan police force, • to ensure that DPI Intel Investigations is implementing and following proper investigative procedures that meet rule of law and human rights policies, • to institute a police intelligence records management system, • it may be required other related duties as may be directed.
The identified duties may be performed by those especially hired for this purpose, but may also be performed either by police officers or military forces from NATO US or Coalition. Overall, the NATO INT Advisors are working with several Afghan organizations, which include the Assistant Minister of Defence for Intelligence, the ANA General Staff (GS) Intelligence Directorate, the MoI Directorate of Police Intelligence, and the NASRAT, also known as the National Threat Intelligence Center (NTIC), which is a national-level intelligence fusion center [12].

Preliminary Credibility Assessment Screening System (PCASS)
Research on stress control has become popular in recent years, with regard to the development of new devices to measure stress, especially with great use in the field of psychological illness. Recent advancements were made by Golgouneh and Tarvirdizadeh [7] that shed some light on the design and manufacture of portable stress monitoring systems based on photoplethysmography (PPG) and galvanic skin response (GSR) physiological signals acquired by wearable sensors to estimate an accurate value for stress index (SI) based on soft computing algorithms.
For law enforcement it is imperative to discover lies, and that is why these forces are trying to use tactics very similar to the aforementioned stress monitoring systems, in an attempt to uncover deception [6]. In addition, the US Department of Defence (DoD) has been improving its ability to determine the reliability of individuals working with its military forces abroad. In that extent, the DoD authorized counterintelligence organizations to use polygraphs or PCASS as tools to enhance force protection of their military serving abroad, such as in Afghanistan and Iraq [17]. In light with the above, PCASS was used to collect physiological data during structured interview processes and to algorithmically evaluate the physiological data for changes inconsistent with truthfulness [18]. The PCASS, as an innovative technology, is not fail-proof. However, it has the potential to verify information due to its sensors, designed to record physiological responses connected with questions presented by a PCASS operator [19]. The PCASS measures perspiration through changes trough GSR's to collect electro-dermal data [19] and cardiovascular changes using a PPG's [20], as shown in Fig. 1.

Fig. 1 Preliminary Credibility Assessment System [17]
The PCASS might be suitable for CI field operations due to its portability and it eliminates the examiner's role in reaching a decision, which overcomes some of the shortcomings of the conventional polygraphs. However, using this device still requires that it be attached to the person of interest during a structured interview and it suffers from many of the same obstacles as the traditional polygraph [6]. The equipment in Fig.  1 better assists the detection of threats and allows the ability to conduct timely, critical, focused intelligence investigations [21]. PCASS is therefore adequate for CI operations in Afghanistan 2 , especially as an initial triage tool that enhances the existing screening methods (e.g. CELLEX) for security counterintelligence. The US Office of the Secretary of Defence also argues that CELLEX is used in conjunction with PCASS during counterintelligence vetting/screening procedures throughout all of Afghanistan -the equipment provides: mobile forensic extraction, decoding, and analysis tools that extracts logical file system, and physical data from mobile phones, tablets, GPS units, SIM cards, memory cards, USB devices, and smartphones [21]. The term CELLEX, also known as cellular exploitation, is intended to capture and retrieve data from electronic devices 3 in support of PCASS operations, as the latter are usually not valid as evidence in court.

Methodology
This article follows a single, exploratory and qualitative case study strategy. This field study took place in Kabul, Afghanistan, from July 2017 to February 2018, and it included several sources of data collection for triangulation and corroboration purposes, such as participant observations, and the analysis of non-classified documents. Participant observation is a key social science research approach that involves observing and interacting with the subject of interest while actively participating in the setting, as well as getting very close to research participants [22]. Our goal was to gain a deep understanding of a particular phenomenon [23] and, in this context, the participant observation was considered the primary method of data collection, as it enabled the analysis of the phenomenon in its real life setting [24]. The case research included notetaking at meetings and informal conversations [22] between the Resolute Support Intelligence Advisors and their Afghan counterparts, rather than collecting documents and making audio or video recording as suggested by other authors [25]. The interviews as informal conversations derived from the ongoing context and were conducted in the course of meetings, while there were no predetermined questions, topics or wording [26]. Although these questions resulted from ongoing meetings and can match real life circumstances, it can also be less systematic, making it difficult to establish patterns among data collection sources. The theoretical saturation was difficult to achieve due to the limited number of respondents. To mitigate the aforementioned issue, we have only interviewed highly knowledgeable informants, who had plenty experience in the field of study. Aspects that remained unclear were referred for future research perspectives which can be found in the conclusion section.
Official documents are also known to provide valuable data in case study research [27]. Along with interviews and observations, they comprise one of the main forms of data sources for interpretation and analysis in case study research [22]. For this research, we used non-classified documents that were retrieved from open [online] sources [28], such as the NATO official website, or US Department of Defence. For credibility reasons all the collected documental were published by governments or other official organizations [29].
Due to the confidentiality reasons, we kept the anonymity of all NATO and Afghan respondents, and their respective INT branches. In addition, we have not stored any physical or digital records containing speeches or transcriptions. From the participant observations we collected field notes in a research diary [23] which aided the author to build a set of categories and subcategories to search for associations between several sources of data collection.

Results
This section provides a summary of the empirical findings, which highlighted two relevant evidences: first, we present the opportunities and challenges of technological sophistication in the Afghan counterintelligence police; followed by an analysis of the implications into the NATO Resolute Support Mission.

Capacitating the Afghan Police with sophisticated technologies
The data showed that PCASS, in addition to acting as an extraordinary deterrent tool, effectively identifies potential threats.
In this regard, we have identified opportunities that operationalized the Afghan intelligence activities. Despite the Afghan intelligence police vetting procedure, which, in fact, is allowing to identify threats, it has been difficult to keep up the pace of quality. As we mentioned before, from 2012 to 2016, thirty thousand PCASS exams were conducted, which in the NATO Intelligence (INT) advisors' view is a very high volume of screening exams. The PCASS screening process is complex and time-consuming, i.e. the high amount of interviews does not exactly match with the desired quality. With the intention to keep quality standards, during the year of 2018, the US CI units conducted training activities to train the Afghan Intelligence Unit trainers, in order to achieve one of the coalition objectives -i.e. the Afghan Police Forces should be able to conduct their own operations. This process has proven to be effective in setting national quality standards and vetting capacity. In addition, PCASS activity is very technical, as it requires a very specific training and above average resilience, and the operators spend long hours on screening activities. We have therefore found it difficult to retain PCASS operators and to recruit new and competent ones. In this regard, NATO INT Advisors have played a key role in liaising with Senior Afghan Police Intelligence Officers to raise awareness in order to keep this program operational; on the other hand, the "train-the-trainers" program has also come to fruition, enabling the Afghan INT units to train their own PCASS operators, and thus renew their human resources.
On the other hand, we have also identified several challenges. Although the PCASS system is already operational in several countries, there is still very limited research, both in terms of innovation and development of this technology, as well as in scientific terms. The lack of technological developments may be associated with the high investment in research that PCASS producers/manufacturers are only willing to embrace if they know in advance that governments are eager to invest in these types of systems. As regards to scientific research, we have conducted a SCOPUS search on August 1 st , 2019, using the keyword "Preliminary Credibility Assessment Screening System" and we have just identified Fuller's et al. [6] article, which generally represents the scarcity of research in this field of study. The scarcity of scientific articles may eventually be explained due to the difficulty that researchers have in accessing confidential data. Another possible challenge is the lack of interagency cooperation, especially in regard to intelligence agencies. According to our data, it is not possible to ascertain a robust cooperation between intelligence agencies -take the case of the Directorate of Police Intelligence (DPI), which is the primary police force responsible to prevent insider treats and the infiltration of criminal networks in the Afghan Police, and the National Directorate of Security (NSD), which is a secret service organization and the primary intelligence agency in Afghanistan. We believe this situation is not exclusive to Afghan agencies, since we are convinced the same competition occurs among intelligence agencies in western countries. Therefore, we identified interagency cooperation as fundamental to build strong CI operations; in other words, PCASS is used to gather preliminary evidence so that it can serve as a basis for conducting further in-depth police investigations, which, based on field data collection, will serve as evidence for the prosecution of the suspect.

Resolute Support Mission
Finally, we analyzed the implications that the introduction of PCASS technologies add to the course of NATO -Resolute Support Mission. Right after the implementation of PCASS we identified a decrease in green-on-blue incidents [2] that were probably not only due to the contribution of PCASS, but due the combination of complementary technologies such as CELLEX, which aided CI activities detect and deter suspects with insurgency connections before they committed insider attacks. On the other hand, PCASS screening is far from perfection, as there are challenges that have yet to be overcome. According to our findings, PCASS has fulfilled the purpose of keeping the coalition troopers safer, but the vetting process still needs improvement. For example, there are some cultural barriers that must be overcome, i.e. the technology needs to be improved according to individual values and local culture.
Certain terms, such as "corruption" etc., may not be interpreted in the same way by US, European or Afghan citizens and may influence the PCASS results. For instance, during a PCASS test, an Afghan suspect did not identify an episode from the past as a corrupt attitude, while US and EU advisors assessed the situation as a clear case of corruption. In this particular case, the PCASS test turned green (telling the truth i.e. was not corrupt) because, from the suspect's cultural point of view, his attitude was not considered as corruption, while on the advisors side the test should have turned red (lying). Therefore, it is possible that a suspect when submitted to a PCASS interview may differently interpret a certain battery of questions and thus influence the results. It is possible this aspect may be overtaken by the PCASS operator in the preliminary test by explaining the meaning of each term in detail.
Among others, PCASS has the following general advantages for NATO INT advisors: the technology is highly portable, so it can be removed from the Afghan IC Units if these devices require maintenance; although the screening process is complex and requires training, the device is somewhat user friendly and facilitates the assessment to some extent. The technology also presents some limitations, for instance: it can only be used for initial screening; it requires well trained operators and routine requalification; lastly, it needs adequate support infrastructures such as proper detention facilities, rooms to conduct interviews, etc.

Conclusion
This article presents novel practical contributions, as it exploits the contributions of PCASS technology from the Afghan side, in particular as regards to the activities developed to enable, requalify and retain the existing PCASS operators. In addition, we have also explored the limitations, regarding the innovation and development needs, as well as the challenge of improving the collaboration among and between Afghan intelligence agencies. On the NATO Resolute Support side, we have assessed the implications of PCASS, notably the contribution in reducing the insider threats and green-onblue attacks, as well as some advantages and limitations concerning the PCASS technology.
Although this article is exploratory by nature, it also provides several contributions to theory. Given that we were only able to capture a handful of articles in the literature, and the existing ones are more technical and quantitative, this article partially explores the dynamics of using PCASS technology in fragile states, notably in supporting intelligence activities and their implications for NATO-coalition and Afghan forces security. In light with the above, this article is the first of its kind, and we hope to encourage other researchers to follow the same path.
A limitation of this research is due to the reliability and validity of case research data, which is often reinforced by a well-designed research protocol [24] made public, and which contains all general consultation procedures and rules. With the intent of protecting the participants, this research does not disclose any data to public, being in line with the author's professional and ethical code. In addition, it is often observed that sensitive topics pose a threat to the research, participants or the community to which participants belong, in which case the data remain anonymous [23].
The influence of cultural individual traits has yet to be clarified and may influence the PCASS results. To better explore the aforementioned issue, it is our understanding that further research should address this area.