With the move to Balad under way, McChrystal held a commanders’ conference at Bragg in late July. Attended by JSOC’s senior staff officers and component unit commanders, the conference was McChrystal’s chance to outline the direction in which he intended to take the command. That direction was away from the large set-piece operations that for so long had dominated JSOC’s thinking. Instead, McChrystal wanted to expand the capability to operate on the left side of a spectrum that had large-scale joint readiness exercise-style operations at the right end, and small, completely clandestine missions on the other. “He wanted to go blacker, faster, smaller,” said a source familiar with the meeting. McChrystal expressed preferences for smaller tailored packages for such missions and for a Joint Readiness Training paradigm, in which JSOC elements trained together on specific tasks, but without the massive joint readiness exercise umbrella. In this context, he announced his intention to review the “internal role” of all JSOC’s tiered units. The JSOC commander also left subordinates in no doubt about where they stood in the long war now under way. JSOC, he told them, was now the nation’s “main effort” in the “war on terror.”1
The JOC McChrystal built in a corner of Balad air base was the physical embodiment of his insistence on a networked, flattened command structure in which organizations shared information with each other instead of hoarding it in their own “stovepipes.” Housed in a massive concrete clamshell-shaped hangar dating from Saddam’s time, the operations center had an entry control point at one end and offices for McChrystal and other senior figures at the other. Between these, separated by a plywood wall, were two big rooms that functioned as the nerve centers for the Iraq task force and for JSOC globally. Each had a right-angled horseshoe of desks at the center facing a wall of flat video screens, with rows of workstations behind and to the sides of the leaders and senior staff officers who occupied the horseshoe.
In the Iraq task force operations center, the task force commander—usually the Delta commander—and his staff sat at the horseshoe. In the rows behind them sat about sixty more operations officers, intelligence analysts, and liaison officers from other commands. The JOC’s space-age, high-tech appearance invited comparisons to science fiction. “We used to call it the Battlestar Galactica,” said an officer who spent several tours in the Iraq task force JOC. Others called it the Death Star. The officer estimated there were thirty to fifty individual workstations in the JOC, all facing nine “monster TV screens … probably sixty-inch TVs arranged in a grid square.” A separate feed ran on each screen. One might have a list of the day’s missions, another the feed from Echo’s Birdseye aircraft above an ongoing assault, a third the video from another intel asset, and so on. “All of a sudden something would start happening on a target, people would focus on that one screen,” the officer said. The staff called it “Kill TV.” Next door in McChrystal’s global ops center, called the Situation Awareness Room, the JSOC commander—or, in his absence, one of his two one-star deputies—sat at the head table with his command sergeant major and intelligence and operations directors on one side and representatives from other agencies and the Iraq task force on the other.2
John Abizaid, who had been McChrystal’s brigade commander a decade before when McChrystal commanded an 82nd Airborne battalion, was a strong supporter of the JSOC boss’s desire to turn his command into a “network.” But, as McChrystal acknowledged, others he needed to buy into the concept—particularly in the intelligence community—took longer to come around. He pressed ahead regardless, hoping that as the task force produced results, leaders in other agencies would want to leverage its success. To help accelerate the process, he made the entire JOC facility a sensitive compartmented information facility, or SCIF (pronounced “skiff”), so folks from different agencies and task forces could share top secret data quickly and openly—a complete reversal from the mind-set that traditionally dominated special ops and intelligence organizations.3
McChrystal or one of his two one-star deputies were always in Iraq, but from fall 2003 Delta had day-to-day responsibility for running the Iraq task force. (When he focused Delta on Iraq, McChrystal also put JSOC’s Afghanistan task force under the alternating command of Team 6 and the Rangers.)4 By late summer 2004, the Iraq task force was divided between the headquarters at Balad, usually led by the Delta commander or his deputy, a Delta squadron task force headquartered at Mission Support Site Fernandez in Baghdad, and smaller Ranger, Delta, and Team 6 elements in Mosul, Tikrit, and other towns, with Task Force Brown’s helicopters in support. The British SAS’s Task Force Black, based in the Green Zone next door to the Delta squadron, wanted to work closely with JSOC, but the British government’s concerns over JSOC’s treatment of detainees meant the SAS continued to concentrate on hunting former Saddam regime elements long after McChrystal had refocused on Zarqawi.5
The size of the force would grow over the next several years, commanders would shift locations, and the organizational chart would change repeatedly. But this was all in keeping with McChrystal’s precept that it was important for his force not to become wedded to a particular organizational construct or geographic setup. Rather, he wanted his command to be able to adapt on the fly, moving troops and command and control nodes from base to base as the enemy situation morphed.6
McChrystal was running a global enterprise, but after first favoring Afghanistan with time and resources for Winter Strike, he had decided to prioritize the campaign against Al Qaeda in Iraq. “Things were really heating up in Iraq,” said a senior JSOC staff officer. “We shifted the main effort.” Having established his state-of-the-art command center at Balad, taken stock of the challenges confronting him, and taken the measure of the men and women under him, by fall 2004 McChrystal had the pieces in place to realize his ambitious agenda for JSOC and to pit his nascent network against Al Qaeda in Iraq. As the staff officer put it, “That’s when JSOC became the JSOC on steroids.”
* * *
Perhaps no individual other than McChrystal himself was more responsible for turning JSOC into an information age war-fighting machine over the next couple of years than Colonel Mike Flynn, who replaced another Army colonel, Brian Keller, as JSOC’s intelligence director in July 2004. A wiry, black-haired Rhode Islander equipped with a razor-sharp mind and a willingness to challenge conventional wisdom, Flynn had already enjoyed an impressive career, serving as intelligence director for the 82nd Airborne Division and XVIII Airborne Corps, including a tour in Afghanistan in the latter position when McChrystal was the Corps’ chief of staff. But this would be his first special operations assignment.7 McChrystal understood the central importance of intelligence in counterinsurgency and had put in what the military calls a “by name request” for Mike Flynn to become his intelligence chief.8
When Flynn took charge of JSOC’s intelligence shop, the command’s intelligence capabilities were on the cusp of a quantum leap forward. This revolution was a necessary step in achieving McChrystal’s vision. For the task force to get inside Al Qaeda in Iraq’s decision cycle, it needed to drastically increase both its intake of all sources of data and the speed with which it molded that information into actionable intelligence. This in turn required improvements in how JSOC obtained and processed all the different types of intelligence, such as imagery intelligence and signals intelligence. But lacking access to significant volumes of either in early 2004, when McChrystal refocused the task force on Zarqawi, Delta made human intelligence a priority.
“We said, ‘Okay, we’re on it,’” said a Delta source. “We got AFO going, our [reconnaissance] going, every guy that had been trained as a case officer. We knew we’ve got to find sources, start hunting.” Delta had advantages over the CIA in building source networks in war-torn Iraq: not only were its operators more used to working in a combat zone, but they could more easily plant themselves on small bases from which the conventional military was operating all over Iraq.9 By early 2004, the CIA was also positioning small numbers of officers on military bases,10 but tension had continued to grow between the Agency and JSOC over the latter’s exploding intelligence requirements and capabilities. Later that year, in an effort to build bridges with the Agency, McChrystal made Flynn his liaison at the CIA’s Baghdad station,11 which was now the largest in the world.12
Delta’s ability to conduct low-vis operations using its fleet of locally acquired cars was impressive, but the unit was determined to go one better. In the absence of an effective Iraqi intelligence service, Delta created its own. The unit recruited and trained carefully selected Iraqis to conduct intelligence operations on the task force’s behalf. Perhaps borrowing the CIA’s name for the Afghans the Agency hired for one of its counterterrorism pursuit teams in Afghanistan, Delta called its Iraqi agents the Mohawks. Delta used these brave Iraqis, who numbered in the dozens and for the most part lived on Coalition bases, to conduct close-target reconnaissance—in essence, getting as close to a person or building of interest to JSOC as possible—where sending in non-Iraqis would entail too high a risk. For such missions, the Mohawks sometimes used Delta’s “camera cars”—local vehicles in which the unit’s “techs” had installed hidden cameras in much the same way that major auto manufacturers disguised backup cameras in their vehicles. “It’s the same color as the car but it’s still a camera,” an operator said. In addition to close-target reconnaissance, the Mohawks’ other primary mission was source recruitment. They also elicited information simply by talking with family members and other acquaintances on the telephone. Sometimes they would accompany conventional forces on patrol, which allowed the Mohawks to enter houses, talk with locals, and even recruit sources without attracting attention.
Non-Delta personnel familiar with the Mohawk program gave it high marks. A task force intelligence source called the program “very important” and “probably the best relationship [we had] as far as enabling Iraqis.” It was actually safer to have a Mohawk live on military bases in Iraq, where he could hide in plain sight among the large number of local hires working there, than it was to meet him in a safe house or other location outside the wire. “He knows the area, he’s vetted,” the intelligence source said. “He can work his own cover story … better than if he’s seen coming out of a house in the neighborhood that’s directly tied to the U.S.” Mohawks lived at Mission Support Site Fernandez in the Green Zone, at the task force’s base in Mosul, and at other installations across Iraq. But living on the bases only slightly mitigated the obvious and substantial risk involved in being a Mohawk during a time of open warfare between the Coalition and the Zarqawi-led Sunni insurgency. Despite the care Delta took to teach the Mohawks proper tradecraft, the Iraqi agents sometimes paid a heavy price for siding with the task force.13 “Occasionally we’d get the reports of one of the Mohawks being kidnapped and I know a couple of them got killed,” said a task force officer.
The Mohawks also targeted insurgents using Internet cafés in operations run by Delta and two even more shadowy units. All followed roughly the same template: Mohawks would enter the Internet café without arousing suspicion and upload software onto the computers. Sometimes the software was of the keystroke recognition type, at other times it would covertly activate a webcam if the computer had one, allowing the task force to positively identify a target.
The insurgents often thought they were exercising good communications security by sharing one account with a single password and writing messages to each other that they saved as drafts rather than sending them as email. But the keystroke tracking software meant JSOC personnel in the United States were reading every word. The task force would wait until the target established a pattern, then act. “When you’re ready to deal with him, when that password is [typed] it would trigger a ‘Shitbag 1 is at café 6 at computer 4, go get him’ [order],” said a source familiar with the missions.
Locally recruited Iraqi agents—or sometimes low-vis U.S. operators—would track the insurgent far enough away from the Internet café to minimize the chances of other enemies figuring out how the Americans had located their target. (Often, operators would identify the target’s most likely route away from the café and lay in wait to ambush him.) As with most task force missions, the operators usually snatched the wanted individual without a fight. “Generally when the shootout happened it was either, A, foreign fighters that wanted to fight, or, B, you fucked something up,” said a Delta operator. “We snatched tons of dudes that had guns on them. Why didn’t they shoot? Because we didn’t give them time.” Delta ran “hundreds” of missions like this, he said. But Delta wasn’t the only unit using these tactics. They were pioneered by a Delta offshoot called the Computer Network Operations Squadron, which was the brainchild of two technologically gifted Delta soldiers in the unit’s Technical Surveillance Element called Scott and Keith who by the late 1990s were experimenting with what would later be called cyber operations. “They started as just two dudes in the [Delta headquarters] building that were computer savvy, and then it grew from there,” said a Delta operator. “Before I even had email, they were hacking email. And they were incredibly effective.”
Scott, a Special Forces weapons sergeant turned Delta communications expert from California, was a technological savant with a particular interest in—and aptitude for—supervisory control and data acquisition (SCADA) computer systems, which run processes in multiple industrial facilities simultaneously. Higher-ups recognized the potential in what a JSOC staff officer described as his “unbelievable talent.” “This was just a dude who said he could hack some email and then the next thing you know he’s running his own program, getting funded,” the Delta operator said. In the first years after the September 11 attacks, the “program” became a stand-alone unit. It started as a small yet effective troop, but by 2007 had grown into the Computer Network Operations Squadron—headquartered in Arlington, Virginia, with a troop at Fort Meade and another at the CIA’s Langley headquarters—and reporting straight to the JSOC commander. The military kept CNOS in JSOC “because we want it to operate in areas that are not necessarily … where we’re currently at war,” said a military intelligence officer. “We want it to operate around the globe [pursuing] national objectives.” By 2006 the unit was “cruising” but heavily committed to the wars in Iraq and Afghanistan, according to two other sources familiar with the unit.
For some of the most dangerous—and kinetic—cyber operations in Iraq, the squadron provided information to the Interagency Support Activity, a short-lived unit created in early 2006 after an Afghanistan proof-of-concept the previous year. It consisted of: Mohawks; CIA Ground Branch paramilitary personnel and contractors; Delta, Team 6, and Orange operators; plus a few Canadian and British operators. Although notionally a combined JSOC-CIA force, the unit reported to the Agency’s Baghdad station chief. “This was how the pesky networks were broken in Iraq,” said a source familiar with the Activity’s missions. “The ones we couldn’t get with sigint and we couldn’t get with humint, basically the really disciplined ones.” One Activity team targeted the leaders of Sunni insurgent rings managing the flow of foreign fighters into Iraq from Syria. The other went after the heads of Shi’ite networks run by Iranian intelligence.
The Activity teams lived in a collection of safe houses separated from each other and from other Coalition forces. When on a mission, the six or so Americans on each team dressed as Iraqis. Fair-toned personnel wore skin-darkening makeup. Their Internet café missions followed the same pattern as Delta’s, with one crucial difference: the Activity teams, which did not have the layers of backup and enablers that habitually supported JSOC’s strike elements, always planned to kill their targets. “I do not know of one who was captured,” said the source familiar with the missions, which were even more secret than Delta’s. “Under forty-five people in the country knew this was going on,” the source said.
The Activity lived a short, violent life. The CIA disbanded the teams in September 2006, partly because the general level of violence in Iraq was increasing and the Activity was taking casualties, partly because JSOC was eviscerating the Sunni networks to such an extent that targeting Internet cafés was no longer yielding results, but also because the United States decided it had better uses for the teams’ talented Iraqi sources.14
Task Force Orange also got into the act, using two Hispanic operatives who spoke excellent Arabic. “They could walk into any Internet café and pass themselves off as a college student or a low-level businessman,” said an officer familiar with Orange missions. “If it was a more cosmopolitan section of Baghdad, we would target those [cafés]. If it was one of the more suburban areas where everybody knew everybody going in and out of that Internet café then we wouldn’t try to do it. But the NSA and the CIA would come to us and say, ‘Okay, here’s a map. We need this place, this place, this place, and this place all covered.’ And we would send guys out and they would do that in a heartbeat.”
Despite the intrepid Internet café operations, however, the breakthroughs that made the biggest difference for JSOC were in the areas of imagery and signals intelligence. In both fields, the task force needed far more aircraft, particularly of the fixed wing variety, than it had in late 2003. McChrystal and his staff worked hard to lay their hands on aircraft that were ready for intelligence, surveillance, and reconnaissance (ISR) missions or could be reconfigured for them. Under McChrystal, the staff became more involved than it had been under Dailey in supporting the strike forces, especially in regard to making ISR aircraft available. “He realized his job as the big boss was to give assets to the smaller bosses,” a Delta source said. The task force’s ISR fleet went from Echo’s single helicopter in mid-2003 to forty aircraft of fifteen different types within the next two years.15 The aircraft belonged mostly to Echo, Task Force Orange, and Task Force Silver (the Air Force covered air unit), and together were known as “the Confederate Air Force” (perhaps in a nod to Orange’s nickname as “The Army of Northern Virginia”).16
McChrystal’s unquenchable thirst for ISR coverage, together with the control JSOC had gained over the unit it now called Task Force Orange, had major ramifications for the Fort Belvoir special mission unit. By 2004 more than half of Orange, and a lot more than half of its aircraft, were committed to Iraq. “Our capability was just that more advanced, we provided that resource that you really couldn’t get with anything else,” said a field grade officer familiar with Orange’s operations. But in order to commit Orange to the war in Iraq, McChrystal had to overcome powerful bureaucratic opposition, particularly from the National Security Agency, which had paid for many of Orange’s capabilities in the expectation that they would be used for the NSA’s national-level missions, rather than in down-and-dirty urban fights in Iraq. “The NSA did not want to have the aircraft in Iraq,” said the officer. “They wanted to do other things [with them].”17 Opposition to the reorientation of Orange also came from high inside the special operations world. “That organization wasn’t designed to do tactical intelligence for JSOC—they pirated it,” said a retired special operations officer. “This was supposed to be a strategic asset that was doing serious stuff.”
Orange bought six single-engine turboprop aircraft, stripped the insides, and refilled them with signals intelligence gear.18 The unit experimented with putting the packages on Black Hawks, but found that for the sensors to work properly, the helicopters could get no further than 3,000 feet aboveground and a mile or two away from the target—close enough to be spotted by alert insurgents. The planes, however, could perform the mission at up to 15,000 feet above ground level and five miles away.19 “You had no idea I was around,” the field grade officer said.
While much of the Confederate Air Force provided real-time imagery of targets, Orange’s aircraft were there to provide signals intelligence, primarily targeting the insurgents’ use of Iraq’s burgeoning cell phone networks. Before the U.S. invasion, there were almost no privately owned cell phones in Iraq, as they were illegal under Saddam Hussein.20 But the toppling of the dictator resulted in exponential growth of the cell phone market. By May 2005, about 1.75 million Iraqis had cell phones, a number that continued to grow.21 Mid- and lower-level Iraqi insurgents, particularly those fighting for Zarqawi, seemingly could not resist the immediacy of communicating by cell phone. As a result, McChrystal’s network expended much energy on developing and using technological means to exploit a potentially rich source of signals intelligence.
The cell phone networks made such a fat collective target that several different organizations inside and outside the task force attacked it, including Delta (and particularly Echo Squadron), Orange, and the NSA. During the first three years the task force achieved several cell phone-related technological breakthroughs that together represented what a Task Force Brown officer described as “a game-changer.”
The Confederate Air Force planes carried gear that when flown close to a cell phone tower allowed those on board to log in passively and see a real-time record of every phone making a call. Task force personnel could then search for numbers in which they were interested, and the database would tell them if those phones were in use, and if so, where. “We’d pinpoint the location, we’d go hit the target,” said an operator. The cell phone tower info might guide the task force to a particular city block. At that point, the operators would use an “electronic divining rod,” a handheld paddlelike sensor that could be programmed to detect a specific phone and would beep increasingly loudly as it got closer to the device.22 The divining rod could even detect a phone that had been turned off, although not one with the battery and SIM card removed. Indeed, not only could the task force’s electronics specialists find a phone that had been turned off, they also figured out how to turn it on remotely so it became a microphone, broadcasting everything it was picking up back to the task force. They could also “clone” a cell phone without having the original phone in their possession, allowing the task force to send and receive texts, for instance, as if they were the phone’s owner. In addition, Delta made extensive use of handheld SIM card readers that allowed operators who found a cell phone while searching a suspect’s home to quickly remove the card, copy it in the machine, and put it back in the phone, often without the suspect realizing it had been taken out and copied. Sometimes operators would pretend they hadn’t even found the phone, to hide the fact that they now had a record of all its owner’s contacts.23 Operators invented software that allowed it to conduct “nodal analysis” that quickly mapped out insurgent networks based on an analysis of insurgents’ cell phone traffic.24
The NSA placed all the signals intelligence information on the Real Time Regional Gateway (RTRG), an interactive signals intelligence clearinghouse that task force personnel could query using phone numbers they’d just derived from raids, and be rewarded with a set of new leads that the system would spit back. According to authors Dana Priest and William M. Arkin, the RTRG also allowed task force members to monitor signals intercepts as they were happening and led to “a tenfold increase” in the speed with which operators gained access to the intelligence.25
Despite the NSA’s objections to JSOC’s co-opting of Orange, the agency became a critical partner in the effort to break Iraq’s cell phone networks open as a source of intelligence. By late 2003, an NSA cryptologic support group was collecting the metadata—dialing information, but not the content—of all calls made in Iraq. After McChrystal moved his headquarters to Balad, the NSA put a liaison team in the command center.26 Realizing that their cell phones made them vulnerable, the insurgents recruited what a task force officer described as “pretty sophisticated communications engineers” to protect them from surveillance. In 2003, they had already figured out how to reconfigure high-powered cordless phones into a sort of walkie-talkie network. “They thought they had this private little communications hotline … that no one could read because it wasn’t operating at a cell phone level, but we figured that one out pretty fast,” said the officer. “That was a major coup, finding it … and then using that information.” It was a short-lived success. By the next year, the insurgents had all but given up using the technique.
Through 2004, McChrystal’s force of personality gradually melded all these disparate parts—the motley fleet of ISR aircraft; the growing ability to use insurgents’ digital communications against them; the “Death Star” JOC at Balad, increasingly peopled by staffers and liaisons from other parts of McChrystal’s network; the unsurpassed skill and tenacity of special mission unit operators, the Rangers, and the Night Stalkers—into a dynamic process that became known as F3EAD: Find, Fix, Finish, Exploit, Analyze, Disseminate. Finding and fixing involved the ISR assets identifying and then locating a target—usually a person—in time and space. Finishing—capturing or killing—the target was the job of the direct action forces: the special mission unit operators, Rangers, and Task Force Brown aircrews. Exploiting and analyzing the mission’s intelligence haul, which could mean anything from deciphering papers, phones, and computer gear to interrogating prisoners, was the work of operators and, especially, intelligence personnel at all levels. Immediately after that analysis was concluded—which might take weeks in 2003 and a couple of hours by 2006—the results were disseminated around the network to drive more operations. At its core, the process required a much tighter and smoother coordination between intelligence and operations than had been the norm, even in JSOC.
It’s worth noting that veterans of the hunts for Pablo Escobar and Balkan war criminals argued that McChrystal and Flynn were essentially reinventing a wheel that those much smaller task forces had already designed. Published accounts that “attribute to McChrystal and Flynn this great transformation where now we integrate things” ignore history, a Delta source said. “It’s like, dude, that’s Colombia.” Similarly, “the multi-agency sharing of intelligence and technology, [the] breaking down of the walls between the different interagency partners that was done later [by McChrystal in Iraq] was demonstrated under [Jerry] Boykin’s leadership” during JSOC’s hunt for Balkan war criminals in the 1990s, said a senior special operations officer familiar with those missions.
The F3EAD acronym did not roll off the tongue, but it was still easier to say than to do. Lives were lost and much blood spilled as the task force ramped up its operational tempo, fighting to get inside the Zarqawi network’s decision cycle. Getting JSOC to adopt the McChrystal/Flynn mind-set was not without its challenges. As the task force amassed intelligence on a target, there was often tension between those who wanted to keep watching it to see what more they could learn about the enemy network and those who wanted to strike the target immediately, even if it meant exposing assets that had led to the target in the first place.27 These arguments were usually settled on the side of those wanting to act quickly, on the grounds that there was as much or more intelligence to be gained from striking a target than there was from simply watching it. “Strike to develop” became a task force catchphrase.28 “Our fight against Zarqawi was, at its heart, a battle for intelligence,” McChrystal later wrote.29
But once JSOC had perfected the F3EAD “machine,” it became self-sustaining, said a Special Forces officer who observed the process firsthand. Occasionally, the task force would tinker around the margins of the model, “but while they were doing that the machine kept running,” he said. “Unless you could prove you could do something better, you didn’t fuck with the machine.”