22

Close Target Reconnaissance in Syria1

The four helicopters scythed through the air, two Black Hawks full of Delta operators covered by a pair of AH-6 Little Birds, all headed for the Syrian border near Al Qaim. The aircraft were flown by Night Stalkers, but it was broad daylight—4:45 P.M. on October 26, 2008. They were on their way to kill a man.

That man was Abu Ghadiya, the nom de guerre of Badran Turki Hishan al-Mazidih,2 an Iraqi of about thirty years of age who ran the largest foreign fighter network in Syria. During the peak of the Iraq War in 2006 and 2007, JSOC estimated Abu Ghadiya was running 120 to 150 foreign fighters3 (including twenty to thirty suicide bombers) a month into Iraq. Thanks to a spy in Abu Ghadiya’s camp and to signals intelligence facilitated by an Orange operative’s repeated undercover missions to the area, JSOC had been carefully tracking him for months. The task force knew that he occasionally visited Iraq to maintain his bona fides with the fighters, but his regular base in the area was a safe house in Sukkariyah, a village near the town of Abu Kamal, six miles across the border from Al Qaim.

It was to that village the helicopters were now flying. Thousands of feet above, a Predator cast its electronic eye on the objective, transmitting what it saw back to Al Asad, where task force staff crowded around the few computer screens that had the live video feed. (The Task Force West operations center lacked its Balad counterpart’s lavishly high-tech accoutrements.) As the helicopters crossed the border, the mission fell under CIA command.4

*   *   *

The raid on Sukkariyah had been nine months in the planning, but it became the only public evidence of a highly successful clandestine campaign waged inside Syria by Orange and other JSOC elements since the earliest days of the Iraq War.

JSOC’s history in the Levant stretched back to the work done by Delta and the Army of Northern Virginia during the 1980s. Since then, Delta had maintained a close relationship with Israeli special operations forces, with operators sometimes wearing Israeli uniforms when working in the Jewish state,5 while the unit later known as Orange had gradually deepened its network in the region. After the September 11 attacks raised U.S. awareness of Islamist terror threats, in 2002 Rumsfeld gave JSOC the green light to conduct missions in both Syria and Lebanon. The United States had deep concerns about the Quds Force’s operations in the region as well as Hezbollah’s huge influence in Lebanon. Special mission unit operators rated Hezbollah, not Al Qaeda, as the “A-team” when it came to Islamist terrorism. “You don’t want to mess around with Hezbollah,” said one. “They make Al Qaeda look like a joke.”

Beirut was no longer the battleground it had been in the 1970s and 1980s, but danger still lurked in the shadows. An Army of Northern Virginia operative almost learned this lesson the hard way in October 2002 out walking near the Lebanese capital’s famous corniche. Returning from a mission in a nearby country, he was passing through Lebanon in order to conduct activities to maintain his nonofficial cover when three men tried to force him into a car as he took a short cut back to his hotel. The operative, whose background was in Special Forces but who was unarmed, fought back. He managed to wrestle a .22 caliber pistol away from one of the attackers and escape, shot in the midriff. Unwilling to break his cover by going to the U.S. embassy, he called instead, and was put through to the regional medical officer (who worked out of the embassy). Following the doctor’s advice, “he literally sewed himself up in the hotel room and then continued with his full counter-surveillance routes,” said a special mission unit source. The operative then went through the laborious process required to cover his tracks before departing Lebanon without breaking cover (other than the call to the embassy), despite suffering from a gunshot wound. He crossed multiple international borders before receiving medical care, a feat of tradecraft and endurance that insiders discussed in whispered tones years later. “Putting people in and getting people out of those environments [requires] very elaborate steps to ensure that they are clean [i.e., with cover intact and not under surveillance] coming out,” said the special mission unit source. “He went through all those elaborate steps and that’s why it’s legendary.”

As to who had attacked the operative and why, a JSOC staffer familiar with the episode said they were most likely street criminals who saw him as a target of opportunity, rather than Hezbollah members who suspected he was more than he seemed. But an Army spokesman told the author that the operative received a Silver Star “for gallantry in action against an enemy of the United States during the period 19–21 October 2002.”6 The citation for the Silver Star, however, was classified.7

After returning to the United States, the operative briefed Rumsfeld on his exploits. His unit, meanwhile, ensured that in the future operatives under nonofficial cover would have better access to emergency health care.

The close call did little to inhibit JSOC or its newest subordinate unit, Orange, from undertaking equally dangerous missions next door to Lebanon in Syria. JSOC had plenty of reasons for wanting to get inside Syria after the September 11 attacks. One was the knowledge that Syria had chemical weapons and was trying to achieve nuclear capability, perhaps with help from Iran, whose Quds Force was gaining influence in Syria. The 2003 invasion and occupation of Iraq soon heralded a new concern: Sunni insurgent groups’ use of Syria as a way station en route to Iraq for volunteer militants from the broader Muslim world.

As in Lebanon, there was a significant role for Orange, which in 2003 was just beginning the shift in mind-set and, ultimately, culture that its move to JSOC entailed. The unit’s change of command that summer helped accelerate things. The outgoing commander, Colonel Tom Tutt, was an old-school military intelligence officer more comfortable with treating Orange as a national intelligence asset to be used against strategic targets. His replacement, Colonel “KT” Trautman, who had been Tutt’s deputy and Orange’s sigint squadron commander, thought differently. “He was very tactically focused,” said one officer. “He very much wanted to get into the fight.” In particular, Trautman wanted to modernize the unit’s signals intelligence platforms to enable Orange to provide direct, real-time support to JSOC task forces conducting direct action missions. Another officer said Trautman’s approach had the support of the unit’s rank and file. “Everybody in that organization wanted to get into the fight” and knew remaining a “strategic” asset would have meant “you stay on the sidelines,” he said.

Up to that point, the unit’s case officers—personnel certified to recruit sources—were typically human intelligence specialists who had not graduated from its assessment and selection course. Not being traditional operatives, they were viewed rather skeptically in the unit. “The leadership always wanted to get rid of case officers,” said one special mission unit veteran. But once the Army of Northern Virginia came under JSOC, the need for case officers grew. In an effort to meet the demand, Orange expanded the number of selection course graduates it sent to the CIA’s field training course at the Farm. The unit also increased the number of personnel it accepted from the other (i.e., non-Army) services (a process that had begun in the late 1990s).

Something that didn’t change was Orange’s frequent role as the tactical arm of the NSA, which funded most of the unit’s signals intelligence budget via the Consolidated Cryptologic Program. Another constant was the unit’s obsession with secrecy. “Everybody in the unit was on the Department of the Army Special Roster, which means they didn’t exist,” said a retired special ops officer. Orange was still headquartered at Belvoir, but its three squadrons—“Operations” (sometimes referred to as “Humint” or “Ground”), “Sigint,” and “Mission Support,” as well as its supporting aviation elements—were spread around the Washington area, in some cases operating from clandestine locations including an office building near Fort Meade.

In 2003, Orange had teams in Saudi Arabia, the Horn of African and South America, among other locations. “Outside of Afghanistan and Iraq, Orange had everything else in the world,” said a special mission unit officer. “Everything. That unit was maxed out.” Partly because the other units were so tied up in Iraq and partly because Orange itself was adopting a more tactical pose, the unit’s ground squadron, made up largely of Special Forces soldiers, tried to muscle its way into a direct action role, or at least that was how it appeared to other units. This led to friction with Delta and Team 6 operators, who had long regarded such missions as their sole preserve. “Everyone thinks they’re a trained shooter,” complained a Delta operator. “Orange doesn’t want to do AFO anymore. They want to be the finishing force.… When they go somewhere to do the find and the fix, they’re trying to fuck the Unit out of the finish. It’ll never work.”

That, however, was not the case in Syria. There, the personnel Orange sent in were unarmed and were largely commercial cover operatives, meaning they posed as businessmen and had what a special mission unit veteran called “established presence” in the region. (Until 2003, all the Army of Northern Virginia’s commercial cover operatives were in Operations Squadron’s B Troop. The squadron’s other three troops, A, C, and D, used only official cover. Then D Troop, which had only been reestablished in the late 1990s after a long hiatus, saw its mission change from one that used official cover to one that availed of nonofficial cover. Its operatives went abroad using commercial cover in places like Jakarta, Sulu Province in the Philippines, and Morocco. But D Troop had a hard time getting official backing for missions into denied areas like Syria, which remained the preserve of B Troop.) During the middle of the decade, Orange had fewer than a dozen personnel operating under commercial cover, about half a dozen of whom were conducting the Syrian operations.

Those missions actually began in the months prior to the March 2003 invasion of Iraq. The intent was to ensure the United States had “eyes and ears all around Iraq” by the time the conventional forces drove north across the Kuwait-Iraq border, said a JSOC staffer. By late summer 2003, Orange operatives and other JSOC personnel were infiltrating Syria to focus on two target sets: any evidence that Saddam Hussein’s regime had moved weapons of mass destruction to Syria ahead of the allies’ invasion of Iraq; and the foreign fighter networks already establishing roots in Syria to support the Iraq insurgency. Rumsfeld had to personally approve the missions, which were carried out under the auspices of the CIA’s chief of station in Damascus. Tasked to locate the foreign fighter safe houses and get proof that the networks were operating in Syria, the operatives were not starting from a blank slate. They were often led to a particular safe house by a suspect’s IP router address that U.S. intelligence had already obtained. Because the United States wanted to keep this ability secret, while still proving to the Syrian regime that it knew what was going on at a particular location, the operatives’ mission was to gather more tangible evidence, often by photographing safe houses, hotels, mosques, and bus stops used by foreign fighters. These missions combined high technology with classic espionage tradecraft: cover identities and counter-surveillance practices that included ducking into public bathrooms to change disguises—including wigs—to throw off any tail. “I go in a public restroom, do a quick [disguise swap] and I come out as a seventy-year-old man because I’ve got the bald head,” said a special mission unit veteran. In theory, anyone tailing the hirsute man who entered the bathroom would ignore the bald guy coming out. Meanwhile, “you’re off and onto public transportation, going to do an operational act.” Sometimes that act was even more dangerous than secretly photographing jihadists in public. On occasion, operatives would pick the locks of Al Qaeda safe houses, filming and photographing what was inside, and presumably copying the contents of any digital devices they found. “They had guys on the ground basically breaking into the people’s apartment and getting information,” said a special ops source familiar with the missions. “Talk about close target recce.… That’s pretty frickin’ ballsy.… Two people with a lockpick kit and a camera. If they would have been caught, they were done.”

The operatives also placed automatic cameras and other recording devices disguised as everyday items to monitor safe houses and other locations. One new piece of gear they used was the Cardinal device, developed by the Defense Intelligence Agency’s science and technology department and operated in conjunction with the National Security Agency, which programmed the devices to work in groups that configured and reconfigured their own networks.8 Designed to take photos only when triggered by movement sensors, the device stored the pictures before transmitting them via satellite uplink at preset times. “The original plan was to use them for establishing patterns of life,” a senior JSOC official said. However, the device was neither popular with operatives nor productive in terms of actionable intelligence.

Another new piece of kit the operatives employed was a camera designed to evade detection by the security cameras the jihadists used at their safe houses. “Those [security] cameras can see infrared cameras,” said a source familiar with the operations. (Many cameras use infrared for some functions.) “So if you plant a camera to spy on them, they can see the infrared source, the camera. So we developed a camera that did not use [infrared].” Although JSOC tested the new cameras in 2004 in very low light conditions in Afghanistan, they were designed for clandestine operations in an urban environment. On at least one occasion, the new cameras worked spectacularly. “We caught guys going into a Syrian office building, I believe it was in Damascus, and they were like head dudes of this fighter network,” said the source. “The State Department walked into [Syrian president Bashar] Assad and friggin’ put the photographs down … and said, ‘You’re supporting this. This is the evidence right here. Here are the friggin’ pictures.’”

Indeed, the United States used intelligence that JSOC obtained in Syria as leverage with the Assad regime, presenting it to Damascus in demarches in an effort to pressure Assad to crack down on the foreign fighter networks. Sometimes this was done indirectly via Jordanian government intermediaries and at other times by the U.S. government itself, including on at least one occasion, by Secretary of State Condoleezza Rice (who had moved to the position in January 2005). But not wanting to reveal to the Syrians that American troops had been spying in their country, the U.S. government told Damascus that the material had been seized in raids on foreign fighter safe houses in Iraq. Disguising and altering the material to conform to that cover story represented a “delicate art,” a special mission unit veteran said. JSOC and the CIA went to great lengths to figure out whether to actually change the documents and photos, or to keep them as they were and tell the Syrians, “This was pulled off this guy’s Nokia 3200 cell phone in Baghdad—this is the guy’s name, here’s his bus ticket; he laid this all out on who was assisting him. Here’s all the evidence. Do something about it. We know they’re coming through here.” Sometimes this required technological wizardry. For instance, if the cover story for a photograph taken by an operative in Aleppo was that it was pulled off a foreign fighter’s iPhone in Baghdad, it might need to be digitized so that it looked like an iPhone photograph. The Assad regime remained completely ignorant that the intelligence being presented to them was obtained by undercover U.S. troops in Syria. The demarches met with mixed success. The Syrians would only take action if the United States could tie the presence of particular jihadists passing through Syria to a threat to the Assad regime.

This deception was one reason why the United States sometimes chose to use military personnel under a combination of official and nonofficial cover for these missions rather than the more traditional method of paying local sources to conduct them. A second was to protect the technical intelligence upon which the missions were based. “Do you want to let a recruited source or agent know how much data you’ve got, particularly when some of that stuff’s come from NSA collection et cetera?” said the special mission unit veteran. “Because of the sensitivity of the information … it really needs to be an American doing this.” A third reason was that the United States needed to have absolute trust in the intelligence coming out of Syria. So, although Orange had an increasing number of Farm-trained case officers who were certified to recruit and pay sources, the Syria missions did not involve that. They were “almost all CTR [close target reconnaissance], close-in signals intelligence or close-in collection of data,” said the special mission unit veteran.

In the early days operators from the small unit that became Computer Network Operations Squadron sometimes augmented the Orange operatives.9 In at least one case in Syria, a CNOS operator entered Syria as an employee of an international organization. At other times, capitalizing on the popularity of Internet cafés in the Middle East, CNOS operators often posed as businessmen who dealt with communications technologies like cell phones or computers. CNOS also targeted the Iraqi refugee camps in Jordan, most likely using local sources to access the camps.

The Orange operatives’ ethnicities would not have immediately marked them as Westerners. The operatives included one or two women, who never went in solo, but accompanied male operatives as part of a pair. Having a man and woman work in tandem proved even more useful in parts of the Arab world than it had in the Balkans. The special mission unit veteran noted that jihadists used women in certain roles in the Middle East because male security personnel were less likely to search under their all-covering garb. “Two can play at that game,” he said. But two-person missions were the exception, rather than the rule. Orange’s Syria deployments were “mostly singleton and most without any backup,” he added.

As the program matured, Orange deepened its operatives’ cover, in some cases moving them and their families from the United States to countries closer to Syria, which required the Army secretary’s approval and the agreement of multiple geographic combatant commanders and station chiefs. The governments of at least some of those countries had no idea that U.S. spies were living under commercial cover there. (The U.S. ambassador and CIA station chief in each nation had to sign off on such arrangements.) The commercial cover operatives never resided in Syria itself, however.

As with their East European counterpart in Delta, the Orange operatives under commercial cover were unknown to many even in their own chain of command and their missions were tightly compartmented even within JSOC. When intelligence generated by the missions was discussed in JSOC’s video-teleconferences, “they’d never say where the intel came from,” said an officer. Even in higher-level discussions, the most detailed description would be “Orange assets in Syria,” he said.

The missions into Syria were also kept from almost everyone in the U.S. embassy in Damascus. “The chief of station, the ambassador will know they’re in there and maybe the chief of ops in the station, and that’s about it,” the special mission unit veteran said. The operatives had an emergency action plan if they were compromised. “Your best course of action is not to break cover,” he said. “Always stick to whatever and whomever you’re portraying and the legend.” Even if the Syrians caught the operatives and threw them in jail, they were forbidden from acknowledging that they were American spies. It would be up to the U.S. government whether or not to claim them.

The Orange operatives in the Levant were working in areas where spies for Israel were “constantly getting rolled up,” the special mission unit veteran said, which partly explained why the missions into Syria and Lebanon were “episodic.” If, for instance, the Syrian security services pulled in a network of Israeli sources for questioning, JSOC would want to know what tipped the Syrians off before sending its own operatives back in. Perhaps in part because of this caution, no Orange operative or mission in Syria was compromised, a remarkable record, “since Syrian intelligence is really good,” the special mission unit veteran said. “They’re looking for spies all the time.” But there were some close calls. In one case an operative “had a recording device battery kind of melt and explode and just burn the shit out of [his] pocket” while he was on Syrian public transport, the SMU veteran said. “He just held his pants out and it was just like burning the tar out of them as he’s riding this bus out of there.”

The missions enabled JSOC to build a detailed picture of the network that moved jihadists from Aleppo and Damascus airports through the Syrian section of the Euphrates River Valley until they crossed into Iraq near Al Qaim. After several years, one name stood out as Zarqawi’s master facilitator in Syria: Abu Ghadiya.

The United States tried to bring diplomatic pressure to bear on Syria, sending Dell Dailey (the State Department’s coordinator for counterterrorism from June 2007 to April 2009) on a tour of Arab capitals asking governments to use their leverage with the Assad regime. The U.S. government also gave its Iraqi counterpart intelligence about Abu Ghadiya’s activities, leading the Iraqis to lobby the Syrians to do something about him. The Syrian government initially refused to take action, perhaps because keeping Abu Ghadiya in position allowed the regime to closely track the foreign fighter network in its country. “He ran the network,” said a senior JSOC official. “It was easier for Syrian intelligence to keep their eyes on him.” Frustrated with the Syrians’ inaction, Petraeus himself volunteered to fly to Damascus and confront Assad about Abu Ghadiya. President Bush rebuffed the offer in a video-teleconference with the general. In the end, the Assad regime tired of Abu Ghadiya’s presence within their borders and let the U.S. government know it would essentially look the other way if U.S. forces targeted him. The Bush administration handed the mission to JSOC.

But to some, it appeared that JSOC needed a little prodding to strike Abu Ghadiya. By 2008 both Central Command and U.S. Special Operations Command had established interagency task forces at their respective Tampa headquarters to track foreign fighters. (Scott Miller headed SOCOM’s.) They prioritized Abu Ghadiya on the grounds that multiple intelligence sources had identified him as the principal facilitator of foreign fighters headed to Iraq, and removing him would help create the pause in the foreign fighter flow that Petraeus wanted. Working together, the two task forces drew up a concept of operations for a mission against Abu Ghadiya. But the Tampa task forces had only “asking authority,” not “tasking authority.” They couldn’t issue orders to other organizations. When they asked JSOC to act, JSOC demurred, arguing it didn’t have enough assets to conduct a raid while maintaining its operational tempo in Iraq. But JSOC attempted to present CENTCOM and SOCOM with a catch-22, claiming that because Abu Ghadiya was already on its target list, nobody else could launch a mission against him. This didn’t sit well with acting CENTCOM commander Lieutenant General Marty Dempsey. He told JSOC, essentially, “if you don’t do something, we will,” said a CENTCOM source. That threat caused JSOC to prioritize Abu Ghadiya.

For at least nine months, JSOC focused its intelligence collection on the foreign fighter kingpin. The planners knew that although he made his home in Zabadani,10 about thirty kilometers northwest of Damascus, he repeatedly visited the safe house near Abu Kamal, sometimes traveling on into Iraq. They hoped he’d enter Iraq while under surveillance, but he never did. The alternative was to strike while he was at the safe house. An Orange operative made multiple solo trips to Sukkariyah undercover to keep tabs on Abu Ghadiya. Among his tasks was to position and move equipment that allowed the NSA to precisely locate Abu Ghadiya’s cell phone in a particular building. JSOC also had access to a spy in Abu Ghadiya’s inner circle who was originally recruited by Syrian intelligence.

In planning a strike into Syria, albeit one just a few miles over the border, the task force intelligence analysts had to determine the likely reaction times of the Syrian air force, border guards, and air defense networks. While the United States had given senior Syrian officials in Damascus a heads-up that a raid might be in the offing, the Syrian troops along the border were none the wiser. But Syrian air defenses were oriented on Israel and Turkey, not longtime ally Iraq, while U.S. intelligence reported that Syrian air force pilots were flying no more than a handful of times a month. “They weren’t sitting on strip alert,” said a military intelligence source. Task force planners estimated that the operators could spend at least ninety minutes on the objective before trouble arrived—“an enormous amount of time for the task force,” he said.

But for JSOC to launch, the spy in Abu Ghadiya’s camp had to report that the wanted man was at the safe house. Abu Ghadiya’s cell phone also had to be on and emitting from that location. There were several false starts. “A lot of us spent a lot of sweat equity planning it and actually going out to Al Asad multiple times to get this guy,” said the military intelligence source. It finally all came together on October 26, 2008.

The Task Force Brown crews had about thirty-six hours to prepare for the mission. After crossing the border, the flight to the objective lasted no longer than fifteen minutes. Located in a tiny hamlet, the target building was a single-story flat-roofed structure. The helicopters took no fire as they approached. The Black Hawks landed, disgorging operators who sprinted to the building, where they suppressed resistance from Ghadiya and a handful of his fighters within ninety seconds, killing between six and twelve militants11 without suffering any wounded or killed themselves. The operators spent about an hour doing “sensitive site exploitation,” which amounts to collecting as much material of intelligence value as possible, before calling for the Black Hawks to return, loading Abu Ghadiya’s body aboard a helicopter,12 and flying back to Al Asad. As the intelligence analysts had predicted, no Syrian security forces showed up while the operators were on the ground.

While Orange continued to operate in the Levant, its presence there declined within two years as Iran became a higher priority. Delta, however, increased its commitment to the region.