SOLVING CRIME—AND PREVENTING TERRORIST ATTACKS
It was a bad Monday. I’d just come back to New York from a trip to Fort Lauderdale with one of the detectives on my task force. We ran an operation there that triggered turf issues for the field office, and the local FBI supervisor screamed at me like I’d never been screamed at before: You are banned from the state of Florida! So on this Monday, I expected my boss to chew up what was left of me. I stayed at the office late, coming up on midnight, to offer my hide. The boss just made me wait, and then he left.
So I got home late—I was living in Westchester County—and I canceled plans to meet my workout buddy at the gym by the World Trade Center, where we usually met on Tuesdays. I slept in. When I was getting out of the shower, I heard Katie Couric on the TV in the bedroom say a report had just come in: A small plane had flown into the side of one of the towers at the World Trade Center. The phone rang. It was Jill, saying, Did you see what happened to the World Trade Center? You’d better get into work. I was confused. I said, I’m not a fireman. What do you want me to do about a fire at the World Trade Center? Then the newscast cut in with an update.
I floored it in the black Chevy Tahoe, tinted windows up, speeding into Manhattan. Bureau radio on, I listened to the chatter, tracking calls to rally—first at an intersection right next to the towers, then in Chinatown. The bridges were closed. When I got near the Triborough Bridge, the on-ramp was a parking lot. I drove on the shoulder, lights and sirens on, trying to maneuver around the cars, and there were orange construction barrels in the way. When the other drivers saw the lights and sirens, a bunch of them jumped out of their cars and started lifting the barrels out of the way so I could get through. When I made it up onto the bridge and drove across, my car was the only car on the bridge. It was like that scene in Vanilla Sky. Southbound on the FDR, again I was practically the only car on the road. By then the first tower had fallen. I took the right-hand exit at the Brooklyn Bridge, and I saw a crowd of people walking the other way on the FDR, away from downtown. They were all white, covered in dust. Not excited, not talking. Calm, dazed, a crowd of ghosts walking along.
I made it to 26 Federal Plaza, dropped the car, and immediately the SWAT team rallied, right there: Get your gear on, get in the vehicles, get together. We’re going to stage the vehicles, we’re going to be ready, because no doubt we’re going to get called. The SWAT team would be the ones who would arrest the people who were involved in this. Any second now—I was sure of it—we would get the order to go out to some location in Brooklyn or the Bronx or wherever, and get this guy or that guy. They moved our team over to the West Side Highway, by the heliport. The weather was absolutely gorgeous, blue sky, not a cloud, and we stood there and we waited.
And we waited, and we waited. Nothing happened. And eventually we started to realize that probably nothing was going to happen that day. There was no one to go get, because no one knew yet who had done this.
By that night, it was decided that the field office could not work from the old Federal Building. The air quality was too bad. The building had sucked in all the fumes and dust from Ground Zero. So the field office moved uptown, to the FBI garage, a huge brick building on the corner of the West Side Highway and Twenty-sixth Street. Oil-stained cement floor, debris everywhere, cars everywhere. This was the graveyard for old Bureau cars—name your style of anonymous dark sedan, they were all there, along with cars that had been seized. Ferraris and Bentleys, rusting and rotting away, going nowhere.
All that stuff got hauled out, and we put in tables, phone lines, computers. This was the command center. This was where the terrorism case squads worked their investigations. All the intelligence on the attacks was pouring in here. All decisions about deployments and investigations were made here. The SWAT team provided a perimeter of security around the building, twenty-four hours a day. Every street agent who wasn’t on a terrorism squad or with the SWAT team was shagging leads for the case. The lead pool ran out of the USS Intrepid, the old aircraft carrier docked a few blocks up the river, and it ran around the clock. This was the rhythm: show up at the Intrepid at 7 A.M., grab a stack of leads, go work them, come back at 7 P.M., give your paperwork back, go home and sleep, repeat.
On and on it went, one week working days, the next week working nights. It rained, the air was freezing, and we stood there. Somebody had to stand guard, so we did it. But we wanted to do more. We wanted to find the people responsible for this—even though, very quickly after the attack, we in fact knew who they were: terrorists affiliated with al-Qaeda and directed by Osama bin Laden. We also knew that the nineteen hijackers, the ones most responsible, had all died in the attack when the airplanes they had hijacked crashed into the Twin Towers, the Pentagon, and a field in Pennsylvania.
Most of us on the SWAT team were criminal guys. Agents who do criminal work have traditionally seen themselves as the only true agents, the ones who do the real work. Everybody else could mess around sending cables back and forth, swapping “intelligence.” Criminal agents did the big stuff. We arrested people. Of course, the agents who worked on terrorism thought they were the real thing. Each side had its own myths to deploy against the other. Being of the criminal camp, I was champing at the bit to get moving. Instead, I found myself saying, Can I see your ID, ma’am? to every twenty-five-year-old on the way into work at Martha Stewart’s headquarters, upstairs in our building.
September 11 was the day that made everything look different from how it had looked before. This is true even in a literal way. After standing watch the night of 9/11, three of us drove downtown. By that point, everything south of Twenty-sixth Street was like a world under martial law. No private vehicles. Restaurants serving food only to first responders. I remember coming down Broadway with city hall on the left, the park in front tapering to a point. It looked like a winter morning after an eight-inch snowfall. Every surface was white. It looked peaceful. And it was quiet—the dust, like snow, muffled every sound. There were no people walking around, and there was no traffic.
We dropped the car at 26 Federal Plaza and then walked over to see Ground Zero up close. I remember reminding myself, That’s not snow. That’s just the buildings, and everything and everyone that was in them, a physical manifestation of violence and hatred. But also of all the people and lives and families and businesses and enterprises and hopes and plans and everything that intersected at those two tall towers, turned into dust.
The dust and debris would be hauled to Fresh Kills Landfill on Staten Island, and agents and police officers would go out there every day to sort through it. They would put on their Tyvek suits and take garden rakes in their hands and rake the dust and debris, looking for human remains, day after day. Living persisted, in all the forms living takes. My friend Michael Breslin worked at the morgue, documenting the bodies and body parts being brought in.
At another level, the wheels of national government were grinding forward. First, federal immigration services stopped all regular processes of deportation—no illegal aliens would be sent out of the country until the FBI cleared them of any connection to the 9/11 attacks. Second, at the same time, immigration enforcement became much more aggressive, particularly as it concerned Middle Easterners, than it had been on September 10. Attorney General John Ashcroft was blunt: “If you overstay your visa—even by one day—we will arrest you.” And third, hundreds of agents, not only in the New York area but all over the country, were processing leads generated out of the 9/11 case files, which were known as PENTTBOM and TRADEBOM.
To show what happened when those three lines intersected, consider one scenario that might have unfolded if you’d become the subject of a lead after 9/11. Let’s say you were from the Middle East, and your neighbor had called the FBI and said, The person who lives next door comes and goes at odd hours, and he hangs out with other guys with Middle Eastern names, and I think I saw him wearing a turban once. The FBI got thousands of such calls. Every call became a lead. We would get the address, and two agents would go out that same day. Once the agents arrived at your doorstep, even if you weren’t there, if any of your neighbors passed by, the agents would have struck up conversations with them. If one of those neighbors, too, happened to have come from a Middle Eastern country, the agents would have asked if he was a citizen or to see his green card. If that man wasn’t a citizen and didn’t have a green card, he would no longer have been your neighbor. He would have been detained.
All of a sudden, the U.S. was enforcing immigration laws in a way that it had not done for decades. Many, many people were picked up and thrown into deportation proceedings, which would not occur until they were cleared of any connections to terrorism. A massive logjam formed.
In addition to all the people who were getting picked up in the New York area, others were picked up around the country, and some of them caught the interest of the terrorism squads, so they asked for those detainees to be sent to New York. The Immigration and Naturalization Service, as it was then known, quickly blew through all of its detention space. The INS started signing contracts to house detainees in county jails in New Jersey. The Passaic County Jail, the Orange County Jail—facilities with some hard-core inmates—started to fill up with immigration detainees who had not even been accused of a crime. These detainees were virtually all Middle Eastern. They were virtually all dark skinned. They were not treated with courtesy.
As the numbers grew, it finally dawned on someone that we had to start vetting these detainees so that we could figure out whether to let them go or start deporting them. So the special agent in charge asked Ray Kerr to come up with a plan. Ray grabbed a few of us and explained the job. We were eager to do anything. None of us knew anything about terrorism. We didn’t know what a vetting investigation for someone with connections to terrorism should even include. The process we set up was not efficient. Some of those first groups of detainees were in custody for a long time—six months or more—before we were finally able to build the system and then get them through it.
The program generated a lot of lawsuits and prompted my first interaction with the inspector general’s office at the Department of Justice. Sometime after we had concluded the detainee clearances, the inspectors came to New York to investigate how we had handled our assignment. Ray Kerr and I sat for that interview together. They asked a lot of questions about why we had detained so many people, how we created the clearance process, and why it had taken so long. The only candid response was to point to the context: This was New York in the traumatic aftershock of 9/11. The attorney general had asked the FBI to render an opinion on every immigration detainee’s possible connections to terrorism. We created a process to do that. We had never done it before. It was far from perfect.
Our group ended up processing about 550 detainees. The best thing about this job was that it got done. The detentions were incredibly hard on people. Most of the detainees had blue-collar jobs, and most of them were guilty of nothing other than violating immigration laws that typically had not been enforced. One day another agent came back from the Passaic County Jail. A man he had been interviewing had broken down in tears. Said that after 9/11 people called him horrible names and gossiped about bad things he was supposed to have done, things that he did not do. Called him a terrorist. Then he looked at the agent and said, I am Sikh. I’m not even Muslim.
I am continually struck by the strangeness of living in a world where many people cannot connect with 9/11 in a visceral way. It is still so much with me. Five years after the attacks, I started working on counterterrorism full-time. Having spent most of the period since 9/11 looking closely at terrorist groups and religious extremism, these things weigh differently in my perspective than in most people’s. Some people see counterterrorism as essentially a political issue, even a fearmongering technique. It is sometimes both of those things. It is also very real. People who work in counterterrorism are correct in making this point: The fact that 9/11 happened once does mean that something like it could happen again. And the fact that we should have seen it coming the first time—we could have seen it, and we didn’t—instills everyone involved in counterterrorism with a vigilance that manifests as dread and fear. Not a fear of bad things happening, but fear of missing something. A relentless second-guessing. People who take this threat seriously are more on edge than people who don’t.
The FBI after 9/11 is a different entity from what it was before. There were agents who were working drugs on 9/10, and from the next day forward, for the rest of their careers, worked terrorism. I went back to my organized-crime squad, where we all expected that any day someone would walk in and say, Okay, C-24 is now Eurasian Terrorism. That didn’t happen, but terrorism changed the way we thought even about crime. The old tribal structure of the Bureau—criminal versus counterterrorism, knuckle-draggers versus pinheads—was blown away. Now we were all in it together.
In the summer of 2006 I moved out of organized crime and into counterterrorism. My first case was the London airliner plot. A bunch of young terrorists had learned how to make bombs out of easily available household products. The airliner plot is the reason why, today, when you get on an airplane, all your liquids, aerosols, gels, creams, and pastes have to fit inside a quart-sized plastic bag. The key word for understanding this case—its plain facts and its larger significance—is “components.”
The terrorists had devised a way to break down the components of explosive devices so that they could elude detection at airports by airport security and then reassemble the devices once an airliner was aloft. My unit and I gathered intelligence from the British investigation and tried to determine if any Americans were involved. Coordinating the various services—the FBI and CIA; British intelligence; and others—required learning how to share information seamlessly. This case also brought me face-to-face for the first time with the man who succeeded Louis Freeh as FBI director, Robert Mueller.
Over the next twelve years I would be fortunate to have a great deal of interaction with Mueller. He is not—and I think he would admit this, probably while feigning slight resistance for comic effect—Mr. Casual. He is not a charming communicator, the way Jim Comey can be. Mueller was a Marine lieutenant commanding a platoon in Vietnam. He achieves change through force of will. It was not a relaxing experience for me to be told, You’re going to brief the director twice a day on this case, every day at 7 A.M. and 5 P.M. Mueller was also a prosecutor. He cross-examines you every time you’re in front of him. Ball-busting is his way of expressing affection. If he said, Where does a person even find a tie like that? I knew things were fine: He never went out of his way to insult anyone he didn’t actually like. He had strict habits and boundaries. Dress: blue suit, white shirt, red tie. His idea of relaxed attire was losing the jacket and wearing a V-neck sweater over the shirt and tie. Later, when I traveled with him, Mueller’s most senior assistant said, The first rule is, Don’t be late—if you’re late, you will be left behind. Another rule was, Don’t talk to him during the flight. He’s reading and studying. If he has questions, he will get up from his seat and come back to speak with you. No matter where we were, no matter what was happening, when the day was done, he always went straight to his hotel room. Never stayed up late in the bar with the rest of us or invited people up to his room, the way Louis Freeh had when I traveled with him.
When I moved over to counterterrorism, it marked a permanent change in how I lived my life. Working in counterterrorism means approaching every holiday with an overwhelming sense of dread. Christmas is the Christmas Threat. New Year’s Eve is Times Square. There is not a single joyous holiday occasion that doesn’t have an undercurrent of Are we positioned correctly? Did we give the field the correct guidance? What do we know about the one hundred suspects we think are the closest to doing something violent? Work in counterterrorism means you’re always at an elevated state of alert, and all personal plans, no matter how important, are subject to change. On the way to my dad’s sixty-fifth birthday party, I got a call about a break in the airliner plot. I flew back to D.C. and went straight to the office. I regret having missed family celebrations like that and other parts of normal everyday life—but the choice was clear.
Thursday, August 10, 2006. At Heathrow, lights are off. Doors are locked. At every other airport where flights to Heathrow were scheduled to leave from—JFK, Reagan, de Gaulle, Dublin, Schiphol, Frankfurt, and more—departure terminals are mobbed. Security lines are thousands of people long. The lines don’t move. Today, nobody gets through. Traffic outside is backed up. People are bailing out of cars a mile away, trudging toward the terminal, and dragging suitcases behind them, streaming like crowds of refugees along the shoulders of highways.
On this day I woke at 4 A.M. and drove to work alone, on the toll road, listening to the radio. News reports described the bedlam at the airports. Three words drifted through my mind—We did this. I was connected to this chaos. My office was the place where, when we gave the word—because of something we had learned—the global transportation system went haywire. I could see the sprawling interconnectedness of what I would be doing at my desk today. I would be dealing with the consequences of an ongoing investigation into a plot to take down commercial airliners with ingeniously devised homemade bombs. Unexpectedly, an arrest had just been made, meaning that the terrorists would soon know we were onto them and maybe would launch their attack. So an alert had gone out to airline-security personnel worldwide—with results I was listening to on the radio.
The job of working counterterrorism is to prevent acts of terror. To protect people from an ambush out of nowhere. Stop them from getting hurt or killed. Foil plans of attack meant to pitch the world into a black hole of anxiety and fear. All of which can prompt, at times, a feeling of propulsion and even exhilaration, something that people in counterterrorism rarely discuss but would have to acknowledge. The intense, even addictive, feeling of priority. The sense of necessity built into the job. Necessity not just to your government but to other governments and to everyone you are responsible for protecting. Those feelings are validating—validating of the call that, in the first place, draws practically every agent to the Bureau, every officer to law enforcement.
I parked my car at Liberty Crossing 1. LX-1 is an intelligence facility on a little piece of land in McLean, Virginia. Onion layers of normality and strangeness make up the culture of this place, and it shows in the design. On the outside, LX-1 looks like a typical four-story office complex, modern and nondescript, its footprint in the shape of an X. On the inside, it contains elements of the FBI and the NCTC, the National Counterterrorism Center—since 2004, the country’s main nerve center for counterterrorism intelligence collection and analysis. The NCTC includes representatives of all the U.S. intelligence agencies that work terrorism. Hallways are lined with massive, solid-oak doors. The work spaces behind those doors, known as vaults, don’t look much different from the cubicles you’d find in any office. Because of all the classified material handled here, the whole building is a sensitive compartmented information facility, or SCIF, pronounced “skiff.”
Face pale, eyes frozen in a thousand-yard stare: That was my ID picture, taken on my first day on the job there, in May 2006. What had I gotten myself into? I had left a tight community in New York, where I was a leader. I had jumped into a field I barely knew, with a unit of agents who were strangers, in a section known as the meat grinder: International Terrorism Operations Section I—ITOS-1. Another job, another acronym. (“ITOS” is pronounced “AYE-toss.”)
Setting up ITOS-1 was one of the Bureau’s first steps toward becoming an intelligence-gathering and terrorism-prevention organization. Before the Twin Towers fell, there had been just two counterterrorism units at FBI headquarters—the Osama bin Laden Unit and the Radical Fundamentalist Unit. Those units would grow and the number of units multiply. By the time I got to headquarters, the FBI had two counterterrorism sections, encompassing more than ten units. My section, ITOS-1, covering all cases involving Sunni extremists, had six units corresponding to geographic territories. Four units—called the CONUS units (“CONUS” rhymes with “bonus”)—covered the continental United States. A fifth, the Arabian Peninsula Unit, also covered Iraq, Afghanistan, Pakistan, and Asia. The sixth, the Extraterritorial Investigations Unit—the ETIU—covered the rest of the world: Europe, Canada, Africa, South America, Eastern Europe, and Russia. I was the ETIU unit chief.
Counterterrorism is a tough job. The work is grueling, devouring nights and weekends. You operate with zero margin for error. Worse, merely by identifying someone as a threat, you and the FBI take responsibility for that threat. If a terror subject comes on my radar, and I investigate and find nothing, but five years later the suspect launches a deadly attack, it’s on me. Why wasn’t that guy stopped five years ago?
Despite those burdens, and also because of them, morale in counterterrorism units is high. I loved working there. After all their years of service, most agents look back on one division or squad or field office as having been their home in the FBI. For me, ITOS-1 was home. The section had tremendous camaraderie because everyone was toughing it out together. A huge sense of mutual respect and self-respect emerged from the job’s relentless pace.
Regularity and accountability were the principles that drove our work. Meetings happened every day, rain or shine. And every day our section chief, Michael Heimbach, who ran ITOS-1, held us accountable. Mike Heimbach was the FBI’s answer to George Hamilton, the actor: chestnut tan, slicing smile, extremely expressive eyebrows. Heimbach’s management style involved a lot of laying down of dares. A standard Heimbach line was, It’s time to step up. In the daily morning briefing, we all got our heads screwed on straight so we could march forward in the right direction. In the wrap that afternoon, we shared progress reports, answered questions from Heimbach, and spoke freely about longer-range issues. Working under such orderly management was new for me. As a supervisor in New York, I had struggled to schedule formal meetings with my squad even once a month. But I took the ITOS-1 model of orderly management into every job I had later.
Living with a daily expectation of progress reports ingrained the importance of follow-through. Heimbach would never dance around a central question. He always came right at it, always carried himself with confidence that answers would be given. Dissembling, obviously, was not acceptable in these conversations. Neither was self-delusion or trimming. Dishonesty and obfuscation are strategies that people engage in when they think the questions they’ve been asked will eventually just go away. ITOS-1 was a culture where everyone knew that legitimate questions always had to be answered. Where everyone knew that legitimate questions never go away.
That summer we had started getting information from British intelligence about a group of young men in London. The men had come to the attention of British security services through the investigation of the London transport system attack the prior year. On July 7, 2005, four suicide bombers in London had killed fifty-two people and injured nearly eight hundred more on the Underground and a double-decker bus. A few weeks later, a man named Abdulla Ahmed Ali came to the attention of MI5, the British security service whose focus is on domestic matters. (MI6 is the service that operates overseas. The division is roughly that between the FBI and the CIA.) A tip suggested that Ali might be connected to those bombings. The Brits put him under surveillance and kept collecting intelligence on Ali for a year. Then Ali went to Pakistan.
Surveillance there found that Ali was spending time with an extremist named Rashid Rauf. Rauf had fled Britain in 2002, under suspicion for his uncle’s death by stabbing in Birmingham. Now he was an operational planner for al-Qaeda in Pakistan. In cooperation with an al-Qaeda senior commander, Rauf taught Ali how to build liquid explosive devices using common chemicals—peroxide, hexamine, citric acid—that could be detonated with AA batteries.
Ali went back to England, paid cash to buy a little apartment, and started experimenting. He and his friends bought plastic bottles of a sports drink called Lucozade—a British version of Gatorade—and they worked on turning each one into a handheld bomb. They would drill a small hole through the plastic nub in the bottom of the bottle. They would let the liquid drain out from that hole. They would use a hypodermic needle to inject the empty bottle with explosive ingredients. Then they would seal the hole with epoxy. Properly assembled, each device was powerful enough to blow through the cabin wall of a commercial passenger jet.
This whole operation was being watched. By now, British investigators had cameras and microphones in the apartment where the experiments took place. Around the country, some twenty other subjects were being tracked. The conversations were sobering. After one young father took a child to play in a park on a weekend, he was overheard struggling openly with the knowledge that when he became a suicide bomber, he would never see his child again. He and his associates were forming a plan to take bombs on flights from London, we believed, to the United States, and then to kill themselves and everyone else on those flights.
The members of this terrorist cell also had connections to people in the U.S. Those connections were the FBI’s big concern. Monitoring the American side of threats was traditionally the Bureau’s role. To do that, we needed the best and freshest intelligence about the situation. Did we know exactly what the CIA knew? Were they giving us what we needed so that we could do the work we needed to do? It’s not enough for the Brits to say, Our bad guy here in London talked to three people in New York last week. The FBI has no way of knowing what that means until we get the names. We need to open cases in order to figure out if they’re just family members of some bad guy and know nothing, or if they are passive collaborators, or if they are actively doing bad stuff on their own.
The name of this case was Operation Overt. The Brits named it. I have no idea why they called it that. Counterterrorism case names were frequently obscure or awful. Kinetic Panda, Bubble Puppy, Milk Can. Mueller would always ask, Where did that name come from? The person briefing him would usually answer, We have a machine that gives us the names. It’s random. It comes from the machine.
I hate it, he would say. Or—since the FBI does not in fact have a naming machine—he would say, I don’t believe you.
Operation Overt fell under my aegis. As a result, I became the FBI’s conduit for information flowing from several directions, formal and informal. The British provided daily written reports to the FBI legat in London, who passed them on to me. Colleagues in Pakistan did the same for our legats in Islamabad. If the legats had drinks or dinner with their local partners, they’d give me the skinny afterward. I had extensive conversations with the legat in London. At some point in the process, I started riding over to Langley every day with Art Cummings, the deputy assistant director for counterterrorism, to sit in on the secure video teleconferences with foreign counterparts at the Agency’s Counterterrorism Center. My unit and I had to suck back all this information, figure out if there was a U.S. angle, and open cases—which involved surveillance on those targets from field offices and more information ricocheting back to headquarters. We had about 150 agents checking bank accounts, credit cards, communications, travel. We opened 150 or so cases. We had court-authorized electronic surveillance on the communications of a small number of subjects, which generated more information on the individuals we deemed of greatest concern.
We pulled at threads to see if something might unravel. Send me the honey, read one line of one transcript of an intercept. I’m going to the wedding in Massachusetts, read another line of another transcript. We were inclined to interpret such things in the widest possible ways. In counterterrorism, “wedding,” for instance, has historically been used as a substitute word for an attack. But sometimes a wedding is only a wedding. And it’s as common to ship honey back and forth in Yemen as it is to FedEx a contract in the U.S. But how can you be certain whether honey is more than honey?
Piecing all this information and insinuation into a coherent picture would have been challenging in an atmosphere of mutual confidence, honesty, and trust. International interagency relations during that time could not have been described in those terms. British and American intelligence did not have high confidence in each other. No one was sure what was happening in Pakistan. Everyone connected with this investigation spent a lot of time wondering what they weren’t being told.
There was also a lot of distrust between the CIA and the Bureau in those days. The FBI was always wondering, Are they telling us everything? The CIA was always wary: Don’t tell them everything because they’ll screw it up. The two agencies got along better than they had prior to 9/11, but things were far from perfect. You can’t repair relations with the flip of a switch. We cherished our mutual suspicions. With Overt, the FBI quickly saw that we should be working our end of this thing, and quickly moved to make the CIA cut us in and be more transparent.
One part of my job was to distill all this into a briefing for the director, twice a day, every day. Whether I briefed Mueller face-to-face or by secure videoconference, I always brought a fresh link chart. Pictures, name tags, colored string, pushpins: On TV and in movies, obsessive investigators build elaborate link charts to show connections among persons of interest. These portrayals are not far from the truth. We build charts because charts help us solve problems. Put somebody’s picture on the chart, and you find yourself thinking about that person. Leave the person off, and you might not. Mueller had a lot of quirks about the link charts. He detested diagonal lines. Some colors he liked. Some he didn’t. The most important rule was not to use too many colors and not to use bright colors. This wasn’t an eccentricity—it was wisdom gained from experience. Sharply contrasting colors could become distracting and could also make you think that colors that were different had nothing to do with one another. Mueller did not want to be distracted, and he also wanted to be able to see the problem whole. He wanted to know everything that we knew but did not want clutter. Sometimes he would take out the chart and suddenly you would see his face fall, as if to say the kind of thing that he would rarely say: Who made this piece of crap?
The chart was always changing—names appearing and disappearing—and in each meeting I had to talk through every single element that had changed since last time. Mueller would kick back in his chair, sitting up very straight. Put his hand to his mouth. Circle his chin—really, polish it—with his knuckles. You could see him thinking, making connections, preparing questions. He might interrupt with a curveball—What happened with that guy who was going to the wedding in Massachusetts next week?—recollecting some little piece of information that I’d given him in the days before. I had to be ready for anything.
If he leaned forward, it was a very bad sign. Mueller leans forward only when frustrated. He gestures, taps his finger on the table. He points—he is a pointer. Also a hand tosser. He tosses his hands and sighs. If he leaned forward, looking at the chart, and then smacked the side of his hand against his head—then it was all over. Time to grab that stick and aim the plane back to the sky, because you are about to crash. When the hand hits the head, Mueller is not with you. Does not put faith in what you’re saying. Or is just not following. You have not communicated a good position effectively.
The most memorable thing about briefing Robert Mueller, though, was the questions. Always the questions, welling up from his prosecutorial soul. Cross-examination is one of Mueller’s most basic forms of human interaction, and it’s the vehicle for one of his most basic traits: curiosity. He loved to get down into the details and fire off questions one after another in a firm, clear, resonant, courtroom voice.
Sometimes in briefings he would eviscerate people who did not know what they were talking about, hadn’t followed up on things that he’d asked them to follow up on, or were bringing him the same problem they had brought months earlier but made no progress on. Evisceration was an occupational hazard for analysts, especially, because analysts like to chew on both sides of a question. Could be this, could be that. They are inclined to provide indirect answers to direct questions in exchanges along these lines:
Mueller: Is this guy a danger?
Analyst: He seems to have extremist beliefs, but I haven’t seen him do anything illegal. I don’t have access to everything the Agency has.
Mueller: Why not? We talked about this three weeks ago when we spoke about that other case. Have we made progress? Last time we talked, I told you to get with the CIA and fix this. Make sure that we’re getting what they’re getting. Why are we stumbling across the same problem again? When are we going to fix this? Really. Tell me when this problem will be fixed.
I learned early on that if I didn’t know something, it was infinitely better to say, I don’t know the answer to that, sir, but I will get it for you—because that would end the matter. He wouldn’t rub your nose in it. But if you promised to get the answer, you had to follow through and get the answer. You would never just make the promise as a way of making him back off. You would figure it out, put it in an email, send it to his chief of staff. And that could be as good as knowing the answer initially, because you were showing that you were thorough, you followed through, you were resolving his question—which was the most important thing. Because everyone knew, in Mueller’s FBI, that legitimate questions do not go away.
By the time I got through the morning cycle of briefings and got back to my office, it seemed like I had five minutes before I had to meet Art and go to the CIA. By the time we got back from there, it was noon: time to start deciding what to say in the afternoon meeting with the director. Sometimes it seemed the briefing cycle was more important than the information—were we working the briefing or working the threat? The truth is, they’re inextricably related, and you have to work both. Tension was high. I would constantly analyze every gesture Mueller made, every word he said. I watched him as closely as I watched the intelligence.
Then a man got arrested in southern Punjab, bringing a giant swath of the global air-traffic system to a halt. While the Brits had been monitoring the network of collaborators in Britain, other intelligence services had been pursuing a vigorous ground operation to locate Rauf in Pakistan. When the Pakistanis nabbed him in the city of Bahawalpur, on or around August 9, it took the Brits by surprise. It took the FBI by surprise, too. Also airport security, everywhere.
For no one was this a completely happy surprise. Arresting Rauf was like taking a card out of the bottom of a house of cards. At that point, the whole investigation came down. When Rauf was taken into custody, all the suspects in the UK had to be taken into custody, because once they got word of his arrest, they could have rushed their plot forward or taken it underground.
The timing of a takedown like this needs to be carefully choreographed. You don’t want to do it suddenly. You have to be up on your surveillance to see how all the contacts respond. You have to coordinate arrests and searches—more than twenty arrests, in this case, and more than fifty searches. You have to agree on what Brits call “forms of words”—the precise wording of legal documents and of media releases, so those statements are all positioned and ready to go. Airport security has to be briefed, so they can revise their standards rationally, not in a panic.
All these processes of preparation had begun, but we were nowhere near ready. Absurd warnings got dropped on TSA and its many variants around the world: Look out for Gatorade or Lucozade bottles that might have had their bottoms drilled out. Immediately, nobody could take a carry-on bag onto an airplane. Nobody could take a liquid on any flight anywhere.
The follow-on consequences of Rauf’s arrest were at the top of the news as I drove into work that morning. In the coming hours, there would be a lot of shouting inside the FBI and inside British intelligence: How the hell did this happen? I understood all too well what had happened. There’s always a tension between the desire to keep collecting intelligence and the need to disrupt a plot before anyone gets hurt. Case by case, experts will often disagree over where the sweet spot is. Sometimes people will jump the gun. The jumpers see themselves as prudent. There should be no sudden jumps. I was as unnerved by the sudden move as anybody. On the highway to LX-1 in the early-morning dark, though, my momentary reaction to this turn of events was something more like wonder.
Overt was a lesson in that basic tension within counterterrorism. Is it time to take this down, or do we need to let it go a little further? We never had those conversations about Operation Overt in the way we should have, because Rauf’s arrest brought the whole thing to an end so suddenly. That disruption was a radical departure from how we worked counterterrorism in the Bush administration.
One of my first bosses in counterterrorism used to tell a story. A boy walks down the beach. Sees a pretty rock lying on the sand. Squats down, picks it up. This rock is perfect for his rock collection, the boy thinks—and he puts it in his pocket—and then off to the side another rock, glinting in the sunlight, catches the boy’s eye. He goes and picks up that one, too. Then another rock, and another, and the boy goes on like that until he is so weighted down with perfect rocks to take home that he can’t carry them all. He plops down in the sand, paralyzed by treasure.
The FBI counterterrorism division, my boss said, was like that boy. Any shiny thing we saw, we picked it up. In those years—the years of collection—we wanted to know everything that we could possibly know about what our subjects were doing and about the networks that they might be functioning within, so that we could find out more about the threat in general.
We collected to the verge of overload because, as an organization, the FBI didn’t know what we didn’t know about terrorism. We did not know much about whether there were al-Qaeda operatives in this country, or what they might look like if they were here. We were trying to establish a net of collection that would show us the dangerous people and show us how those people were connected to dangerous people overseas. We opened cases, opened more cases, and then kept opening cases. We had pockets full of rocks.
That approach came with high costs. It cost human resources. We had to keep renewing FISA warrants, had to maintain and monitor electronic surveillance, had to keep translating what came off the surveillance, had to keep analyzing all the data. We weren’t even sure how to identify the point of diminishing returns. In the dance of collection and disruption, the art is sensing a delicate balance: the time when you’ve collected enough to understand the immediate threat—the subject you’re following or investigating—and also to understand the broader potential impact of that person and the person’s involvements. When you feel you’ve hit that point, you’ve got to be able to disrupt.
But in the Bush years, we erred heavily on the side of collection. The pressure, in every case, was to collect. Do you have FISA up, do you have enough FISA up, are you collecting enough, who are you going to go up on next? The pressure was never to make an arrest next week. To make an arrest, you had to prove something almost impossible to prove: that you’ve squeezed the lemon dry, that there is no more juice in this investigation.
Collection and disruption roughly correlate with two parallel investigative approaches: muscling and targeting. Muscling drove the FBI’s post-9/11 drill of running every lead. If we got thirty thousand leads in a month, so what? In those days, when agents got a counterterrorism lead, we would muscle it, hammer it, throw people and eyes and effort at every line of every spreadsheet, never sleep or stop or take days off, because we were t-crossing, i-dotting, shoe-leather-destroying beasts.
Consider, for example, the threat of the so-called California Brothers. This was a potential threat that bedeviled us the whole time I was in ITOS. It grew out of a report that suggested an al-Qaeda member had referred once to “the brothers in California.”
The California Brothers became a source of unending worry, hysteria, and frustration. I can’t even remember where the idea of this threat began. But I can guarantee that if you walked up behind any ITOS agent from that era, even today, and whispered the words “California Brothers,” that agent would jump back, punch you, maybe shoot you, while dropping dead from a heart attack.
Once or twice a year, another agency might send a cable, continuing a series of what we came to call the Scary Cables, in which some analyst would observe that a shift in the wind had been recorded in Tajikistan at the precise moment when sixteen chickens in Alabama had simultaneously laid green speckled eggs, and then go on to suggest that the intersection of these events, in all likelihood, pointed to California—raising the ongoing concern that the California Brothers had yet to be identified.
The implication of the Scary Cables was always, What have you done about the Brothers, FBI? This would provoke such massive hysterical reactions among the ITOS leadership, me included, that we would do things like re-review every single case in every field office in California. Or go out and check for every male between the ages of X and Y who traveled to California from country Z. These were massive data-gathering exercises that consumed huge amounts of investigative and analytical resources and turned up nothing.
We were, yes, looking for a needle in a haystack. But our general attitude was: The FBI’s not afraid of haystacks. We’re that good, we’re that strong, that is who we are—we do hard stuff better than anybody. If FBI agents have to take each stalk of hay off that stack, inspect it individually, and replace it precisely where it was before, we will goddamn do that, and for your convenience also provide you with a spreadsheet by four o’clock this afternoon that tallies all stalks of hay that were inspected in the last twelve hours. And this will be no sweat. And it will be preferable by far to taking the risk of failing to sweep up that one crucial bit of hay that we should have gotten.
That, in a nutshell, was the FBI’s muscling approach to counterterrorism in 2006: If you tell me there’s a terrorist in California, I will go to California and look at every human being in the state.
Muscling was driven by fear—the fear of missing something. Our biggest fear after 9/11 was that more people in the U.S. were connected to al-Qaeda or similar groups. That fear proved legitimate. Operation Overt helped make it clear that al-Qaeda was in fact metastasizing. Its members did want to strike us again. They did want to hit aviation. And they were quickly discovering the internet’s power as a tool for terrorist recruitment and planning.
Just before I moved to headquarters, and just before Overt went into high gear, the FBI arrested two U.S. citizens who had been radicalized by online contact with jihadist recruiters abroad. Ehsanul Islam Sadequee and Syed Haris Ahmed lived in Georgia—in Roswell and Atlanta. Through web forums, they had been in contact with a Brit named Younis Tsouli, an early author of online propaganda for al-Qaeda in Iraq. (Online, Tsouli actually called himself “Irhabi007”—Arabic for “Terrorist 007.”) Sadequee and Ahmed traveled to Washington, D.C., and made some videos, casing targets for terrorist attacks—the Capitol, the World Bank headquarters, a fuel-tank farm along I-95—and sent these videos to Tsouli and to another contact in Britain. They traveled to Canada to meet with the ringleader of the Toronto 18—a group that was planning to attack a range of targets from power grids to the Canadian Parliament building. Ahmed traveled to Pakistan and Sadequee traveled to Bangladesh, where they discussed plans that didn’t get much traction—for instance, plans for the creation of an “Al-Qaeda in Northern Europe,” to be based in Sweden.
These two were idiots, but they had no-kidding connections to al-Qaeda, and they were doing jihadist work. How important or threatening was that work? Unclear. They were not building bombs in their basements, with a view to blowing stuff up tomorrow. But for more than a year, they made consistent efforts to participate in preliminary planning and casing for al-Qaeda attacks here in the U.S. and abroad.
Theirs was one of the first cases with a real operational connection to the internet. The internet pervades human existence so thoroughly now that it can be hard to remember how recently life was mainly analog. When was the point of no return? Maybe around 2006. In July of that year, a microblogging platform called Twitter debuted for the public. In September, Facebook launched a new feature called “News Feed” and opened membership to all comers, where before you had to be part of a college or school network to join. In 2006, YouTube was barely a year old. The first iPhones didn’t go on sale until 2007.
Terrorists were enthusiastic early adopters of every new technology. In 2006, when al-Qaeda launched a digital-media initiative, it pushed out more messages in one year than the group had released in the previous three years combined. The internet made it much, much easier for al-Qaeda, the Taliban, and susceptible Westerners to connect and share information with one another. New social media platforms in particular gave everyone, from hardened terrorists to innocent teenagers, tools to make spectacles of themselves, for good and for ill. In Operation Overt, when we saw that half a dozen of the conspirators had made “martyrdom videos”—a suicide bomber’s version of a suicide note—we knew it was a harbinger of things to come. The melodrama of terrorism, always cranked to 10 on the crazy meter, was about to ratchet up even higher as technological capabilities kept growing.
DVDs were already big. As of Christmas 2006, DVD players outnumbered VHS players in American households for the first time. A lot of stores were doing good business with a run-of-the-mill job: transferring old videotapes onto new DVDs. Around this time, a video-store clerk in New Jersey was doing a transfer and could not believe what he was seeing on the screen. The tape showed ten young men shooting automatic weapons. They were yelling, “Allahu Akbar!” and talking about jihad. The clerk saw something, the clerk said something.
We put the young men under surveillance. They were Muslim. Half of them were in the country illegally. They liked to get together and watch Osama bin Laden videos, or videos of American soldiers being attacked—when they saw a Marine being blown up, they thought it was funny. They were planning to attack a military base and had their eyes on Fort Dix. We shut that down.
In June 2007, we wrapped up a sixteen-month-long sting operation on Russell Defreitas, a U.S. resident from Guyana connected to an extremist Muslim group in the Caribbean. Defreitas planned to blow up fuel lines and fuel tanks at John F. Kennedy International Airport in New York. He made some very incriminating statements, which allowed us to intervene before he could do anything. “Anytime you hit Kennedy, it is the most hurtful thing to the United States,” Defreitas was heard to say in a recorded conversation. “They love John F. Kennedy like he’s the man.… If you hit that, the whole country will be in mourning. It’s like you can kill the man twice.”
Disruption of plots such as these sparked two kinds of conversation. The first happened in courtrooms—the formal legal proceedings to prosecute people for breaking laws. The second happened everywhere else—the informal public conversation about law enforcement and terror.
Disruption always kicks off a three-day news cycle that opens the Bureau up to criticism. On day one, everyone is shocked at the plot that has been uncovered, riveted by the danger, and relieved to hear of the arrest. By day three, the tone has turned 180 degrees. Now the story is, These guys couldn’t have pulled off a serious attack. They failed out of kindergarten and their ex-wives say they have mental disabilities. The theme of the conversation becomes, The FBI is taking advantage of goofballs who probably couldn’t have blown up a balloon.
The operative word there is “probably.” The FBI does not have the luxury of assessing whether people are fully capable of doing what they suggest they might do. If you are inclined to film yourself firing an AK-47 while hollering about jihad, and if you are taking affirmative actions in line with those sentiments, then you have cast the die and have set yourself up for investigation. It would not be a reasonable response to those situations if the FBI were to say, Well, this guy, he’s kind of dumb, so we’ll just leave him be—we only build cases on people who got good grades in high school. That would not be a wise or just process. But it’s the strange way some people suggest we should operate.
Some of the disruptions I’ve described were partly enabled by more targeted investigative techniques. Many targeting techniques are based on access to and organization of data. In truth, targeting isn’t that much easier than muscling, but its ambitions usually fall a little bit shy of muscling’s ideal of omniscience.
A targeted approach to finding the California Brothers might have looked like this: First, we go to all the terrorists we know in California, around California, in states not even close to California, and then maybe in foreign countries that have flights to California. Then we look at all those people and see if, in their networks, we can make a connection to California. That will give us a pretty good lead. Targeting is the Bureau’s preferred mode of counterterrorism investigation today.
To get from muscling to targeting, the Bureau had to develop a certain level of confidence in its own ability and experience, and a certain tolerance of risk. Our overblown response to the California Brothers is a perfect illustration of how little risk we were capable of handling during the Bush years. By “we,” I mean not just the FBI but Americans as a whole. What do Americans do as soon as any tragedy strikes? We immediately go back with a microscope and try to figure out which individual to hold responsible. To some degree it’s an understandable reaction. But taken to an extreme, it expresses and perpetuates damaging and unrealistic expectations about how intelligence and law-enforcement services are able to function in society.
A turning point in the Bureau’s shift from muscling to targeting was Bryant Neal Vinas. He was a Latino kid from Long Island who shattered some of our preconceived notions about al-Qaeda. Prior to Vinas, we thought it wasn’t possible to get sources in al-Qaeda, wasn’t possible to send cooperators into the Federally Administered Tribal Areas of Pakistan (FATA) to start really developing relationships. There was a notion that al-Qaeda was so expert in sniffing out spies in their ranks that all roads to the FATA were lined with the severed heads of failed infiltrators. It was too dangerous a proposition to operate the kinds of sources—cooperators or undercover—that we would do with organized-crime or terror groups in the U.S.
Vinas had converted to Islam, hopped on a plane, flown to Pakistan, and joined up with al-Qaeda. He took part in an attack on an American base, then went to Peshawar to find himself a wife. The Pakistanis arrested him and turned him over to us. He was charged with material support of terrorism—our meat-and-potatoes charge for people who become affiliated with terrorist groups—and he decided to cooperate. He let loose with all kinds of eye-opening intelligence about the process of affiliating with al-Qaeda, meetings with high-level al-Qaeda leadership, how he got there, and other Westerners he met along the way. From that we were able to take a closer look at people whom Vinas met and the people they knew. It was a giant leap in the evolution of the targeting process, much more efficient and less legally dubious than some of the earlier ideas that hypothetically might have made it onto the counterterrorism-division whiteboard—looking at every twenty-year-old who traveled to Pakistan last year, for instance.
After learning the story given to us by Vinas, a lot of people in the Bureau thought, Oh, my God, is it that easy? If a kid from Long Island could do it, why couldn’t we? We proceeded cautiously. It’s not like all of a sudden the floodgates opened and we sent every Joey Bagadonuts from Staten Island over to Waziristan. But Vinas did change how we thought about our options. His experience told us that al-Qaeda would talk to foreigners, as long as those foreigners were not on the radar of intelligence services as people who might be associated with terrorism. They wanted people who had “clean” passports—passports that would allow travel back to Western Europe or the U.S. without visas. For al-Qaeda or ISIS, that’s the prime asset for a Western operative. To recruit a person with a clean passport, indoctrinate them, turn them around, and send them back—that’s their goal, and that’s our nightmare.
For the Bureau, Vinas was also a turning point in terms of confidence building. Not only did he provide more information, he helped us see the situation of recruitment from a different angle. That let us become much more aggressive in identifying people in the U.S. with potential capability to work for us on the ground. After Vinas, we developed sources that became extremely valuable to the U.S. intelligence community. He also turned us on to a number of specific people whom we began to look at with more of a targeting mentality. We saw how those people connected to one another, where they came from, where they were going.
There was never a watershed moment in the shift from muscling to targeting. The FBI never decided, Tomorrow we’re going to do everything differently. The Bureau evolved over time. We learned by doing. Where we succeeded, we pursued.
We are still shadowed by expectations that we should be muscling machines. Today, when we open an investigation on U.S.-based extremists, we are thinking from day one about disruption. From the first minute of collection, we are looking for things that could be used as evidence in some kind of criminal prosecution. Constantly thinking, What do we have on this guy? Is he a felon who happens to be in possession of a firearm? Did he lie to Customs and Border Protection last time he entered on his flight from Pakistan? When he’s not in the mosque, is he selling coke on the corner?
We’re constantly building into the case a disruption strategy. We do that for two reasons. In case he’s a serious threat, or in case he’s no threat. In the first scenario, we consider disruption because flash to bang, the time between inspiration and action, tends to be quicker now. A suspect can be receiving instructions from Syria on his smartphone while he’s shopping at the grocery store—so we may need to take him into custody immediately at any time. In the event that he’s not a serious threat, if no plot and no immediate risk develops, there will come a time when we realize that we have collected enough. There will come a time when we see that the guy doesn’t seem to have any true connections—sure, he’s following propaganda, he’s following Twitter feeds, but in reality he’s not talking to anybody overseas. He has a small number of friends here, but none of them seem to be interested in his supposed desire to blow up a bank or a restaurant. So we will just take the case down—make an arrest if appropriate, or simply close the investigation. Because we don’t want to carry it around for another five years.
Which is what we did with the 150-odd cases connected to Operation Overt. The FBI was just like the boy on the beach. We carried the load of Overt cases around for what seemed like forever. Most of those cases went nowhere: The people had no nexus to terrorism and were not engaged in any activity that was terrorist related. But some were indeed engaged in suspicious activities, and some were arrested for terrorism-related offenses.
When the stakes are high—when people feel desperate, and when they want to act with an abundance of caution—there’s a real temptation to muscle it. But in the years to come, as I continued working counterterrorism and played my part in the shift to targeting, I would often consider our collaborations on Overt. The CIA, to its credit, will muscle nothing. We learned a lot about targeting from our interactions with the Agency, just developing our relationship with them and reaping the benefits of their targeting activity. Working with the Brits, who have a more realistic risk tolerance, also helped a lot. They know their population includes extremists. They accept that fact. They calmly try to focus on the people who appear to be most likely to act on those beliefs. Start with known bad guys, known bad organizations, and work out from there. Don’t just look for every brother in California.
As for Rashid Rauf, whose capture took so many by surprise, he was not in confinement for long. The next year, Rauf managed to escape after an extradition hearing when he asked to stop at a mosque for afternoon prayers. Some while later he found himself in the wrong place at the wrong time and ended up dead. Which can happen when you’re a high-profile terrorist in a dangerous part of the world.