Al Qaeda was an army and should be attacked like an army, not a criminal group.

What does that actually mean? Whether you call it an army or a criminal group it operates in small groups, acting it would appear with a great deal of independence. If "arrmy" mesans something you can hoe to meet and defeat in battle, that is not the tight word to use for Al Qaeda.

It relies on the timeworn guerrilla principle of taking advantage of natural cover - more especially natural human cover, of not being readily distinguishable from the rest of the population. It also depends on having potentially some degreee of support from people who are open, in some degree, to being sympathetic to its aims.

A major factor in developing and holding on to that kind of sympathy, and translating it, where necessary, into active support, is the impact of overkill by its opponents on the population in which the potential sympathisers live.

I imagine that the operatives in organisations like the CIA know this kind of stuff. However, if so, they don't seem to have had much success in getting the message across to the people in charge.