Thanks to technological advances since the end of the Cold War, the control unit in the back end of the camera was the size of a credit card, and the tech specialists had easily been able to conceal it in the ceiling plaster. The unit was connected to a device intended to convert the camera’s analogue feed into a digital signal, which could be transmitted over the NRO’s network to the monitoring room at headquarters. Investigators had also installed surveillance software on the computer at the workstation, so that any activity on it could be seen in real time by agents on watch.
At the moment, however, all that the FBI agent in the monitoring room could see on the video was a vacant desk and chair. As Carr had learned time and again, no matter how well thought out an investigative plan might be, the real world has a way of throwing up last-minute surprises. It seemed impractical to install a new camera over the desk that Regan had claimed. The NRO would have to ensure that Regan sat where he was supposed to.
Making that happen was a delicate matter. As is true of any ongoing espionage investigation, the Regan case had been kept strictly confidential. Even within the FBI, the NRO, and the Air Force, only those with an absolute need to know were aware of the fact that Regan was a suspected spy. If Regan was to be placed in the monitored office space without making him suspicious, his supervisor at TRW would have to be taken into confidence.
That person was Paul McNulty, a tall, broad-shouldered former Navy captain who had hired Regan. Bob Rice, an NRO counterintelligence official, called McNulty into his office. After having McNulty sign a confidentiality agreement, Rice told him that Regan was under investigation. He didn’t give McNulty any details but explained why Regan had to sit where he was supposed to.
After the briefing, McNulty went over to Regan, who was settling in.
“Brian, you have to sit over there,” he said, explaining that the single-person suite had to be reserved for another employee who was expected to start in two weeks.
Reluctantly, Regan gathered up his things and moved to the other office. An aerial view of him appeared on the video monitor in the NRO conference room. The next morning, he signed on to his computer after receiving his log-in information from the IT department. Within minutes, he was on Intelink, looking at images of Libyan weapons-testing facilities in the Sahara Desert. It was as if he had never left.
• • •
In his first two weeks, Regan went through a round of training to brush up on his knowledge of satellites and other national systems used in reconnaissance. He could do it all at his desk by taking a series of core competency courses accessible on the NRO network. From sources of electronic intelligence to ways of resolving data problems, the subjects of most of the courses were familiar to him, and he was able to breeze through them. He had no difficulty either with the tests he had to take on a variety of topics—orbital mechanics, imagery intelligence, collection management, and so on—and ended up with scores of 90 to 100 percent on most.
The quick work Regan made of the courses left him with plenty of time on hand to resume his explorations on Intelink. As they monitored his browsing from their perch at the NRO—in real time rather than several months after the fact—the investigators saw that his searches were no longer confined to the Middle East and North Africa. He had added a new country to his list: the People’s Republic of China.
The documents he was looking up contained secrets about the Chinese military that the United States had gathered over decades. On his third day at work, shortly before leaving the office, he spent time studying a defense intelligence assessment of sites in China holding weapons of mass destruction. He looked up an image of one of these storage facilities. Days later, he accessed a report on China’s deployed ballistic missile force, and not long after, another one titled “China, Nuclear Weapons and Special Nuclear Material Security Handbook.”
Even though he had no justifiable work reason to surf Intelink, Regan didn’t seem to feel any trepidation in doing it, despite being new on the job. He made no effort to guard his computer screen from the eyes of coworkers. But he was still concerned about surveillance. At one point, when his coworker was absent from the room, he closed the door and got up on his desk to quickly inspect the ceiling. Fortunately for the investigators, the camera had been hidden well enough that he detected no sign of it. He went back to surfing, assured that he was in the clear.
On the morning of August 15, Regan called up two Intelink documents on his desktop. The first was an aerial image of a Chinese surface-to-surface missile launch facility. The second was an aerial image of a surface-to-air missile launcher in the northern no-fly zone of Iraq. For the next twenty minutes, agents observed him scribbling on a five-by-seven yellow legal pad while glancing repeatedly at the screen. He appeared to be making notes.
It was the first time that agents had seen him engage in this behavior. Their eyes glued to the video monitor, they awaited his next move. Regan closed the documents that were open on the screen, took out a three-by-five index card, and began writing on it, this time consulting the notes he’d made on the pad. Then he took a pair of scissors and cut out the bottom of the index card before slipping it into his front pocket. Next, he ripped the top few sheets from the pad, tore them up into little pieces, and threw them into a burn bag—a trash receptacle for discarding classified information.
Around five p.m. that day, agents watched Regan take out the scissors again. This time, he used them to cut out parts of documents that contained text printed on a dark background. It was impossible for the monitoring agents to discern from the video monitor what these documents were. Regan took the pieces he’d cut out and taped them together on a plain sheet, which he then put into a folder. He balled up what remained of the documents and threw that into the burn bag.
Late at night on August 16, long after all employees had left the building, Carr and others went in to do a search of Regan’s office. In the burn bag, they found the crumpled-up remains of the dark-colored documents that Regan had cut out portions of. The pages were from a course catalog containing descriptions of secret and top secret courses available to employees of the NRO and other intelligence agencies. Reading the catalog could provide a foreign intelligence service useful insight into NRO systems.
The investigators also recovered the torn-up bits of paper from the pad that Regan had been writing on. He had not ripped out just the top sheet that contained his notes but several sheets below it as well, apparently to ensure he didn’t leave behind any indentations of his writing.
Carr pieced the puzzle together. At the top of the page, Regan had written “August 7, 2001,” followed by a series of digits and letters: “IRBMCSS2.” The information tallied with the Chinese missile launch facility whose image Regan had looked at: the digits were the latitude and longitude, August 7 was the date the image was taken, and IRBMCSS2 stood for the type of weapon system it was—intermediate-range ballistic missile Chinese surface-to-surface 2. On the next line, Regan had jotted down the image date and coordinates for the Iraqi surface-to-air missile launcher whose surveillance photograph he’d browsed along with the Chinese facility.
What Regan had scribbled farther down was more intriguing. He’d written each of the coordinates across two lines in zigzag fashion, like two sets of sawteeth interlocked with each other. The first digit of the Chinese coordinates was penned on the top line, the second digit on the line below, the third digit again on the top line, and so on. The digits of the Iraqi coordinates were similarly arranged, starting on the lower line and alternating up and down. From the resulting pattern, Regan had derived a single sequence of digits that consisted of the two sets of coordinates intermingled with each other, which he’d written on another part of the sheet and scratched out because he’d made an error. The jottings, as Carr soon learned, were steps to encipher the two sets of coordinates using a simple technique known as a rail-fence cipher. Regan had also written a series of words at the botto
m of the sheet—“could sit should” and “stand and mingle.” It didn’t take long for Carr to recognize that they were an innocuous code for the two weapons systems in the aerial images: CSS and SAM.
• • •
Days before the FBI agents watched him take notes at his desk, Regan e-mailed his supervisor—Paul McNulty—to say he would be taking some time off at the end of August. The request was an unusual one to make for an employee who had just started in a new job—that, too, after waiting in the wings for the better part of a year—but Regan explained that he had to take his wife and kids to Orlando for vacation before the school year started. McNulty didn’t object, and Regan put down the dates he would be gone on an office whiteboard where employees posted their whereabouts. Next to his name on the employee list, he scrawled, with a fat blue marker: “27–30 August, Leave, Orlando, FL.”
In fact, he was getting ready for another trip to Europe to market himself as a spy. Using his frequent-flier miles on United Airlines, he had purchased a return ticket from Washington Dulles to Frankfurt—flying out on August 23 and coming back on August 30—for a mere $31.26. According to the terms of his security clearance, he was supposed to inform the NRO of any foreign travel in advance. Following that rule, he had decided, wouldn’t be a smart thing for him to do. It could lead to some uncomfortable questions about the purpose of his travel.
On the weekend before he was to fly out of the country, Regan drove to Farmingdale with Anette and the kids. He had finally had to cave in and buy another minivan to replace the old Dodge, which hadn’t stopped breaking down even after he spent $5,000 to put in a new engine. He was convinced that the repair shop had taken him for a ride. He had sent angry letters to the shop, threatening to go to court, but to no avail.
But bygones were bygones. The best he could do now was focus on the future. A lot was riding on it. His $65,000 salary from TRW was considerably higher than what he’d been making as a master sergeant, but it wasn’t enough to keep pace with the family’s needs, let alone get out of debt. Both his daughters needed braces, and that wasn’t going to be cheap. The older daughter was about to start high school, which worried Regan. He had heard about incidents of kids bringing weapons to the high school she would be going to beginning the next month, and he wished to move to a better neighborhood. He would be able to afford that and more if he succeeded in making a sale this time when he traveled to Europe.
Before that, he wanted to squeeze in a visit to see his parents. It was the last chance to take his kids to the beach before the summer ended. One of his brothers was hosting a block party that weekend, which he was looking forward to. But that wasn’t all.
He also had some business to take care of.
On the morning of Saturday, August 18, Regan left Anette and the kids with his parents and drove to Farmingdale High School. He parked his car and walked into the woods behind the handball courts and spent about fifteen minutes there before driving back to his parents’ house. The next morning, he drove out by himself once again and went to Staples to make copies of documents he’d brought along. From there, he drove a couple of miles to Highway 110, parking on the grassy shoulder in front of an exit sign for Huntington and Amityville.
He stepped out of the car and once again disappeared into a wooded area nearby. From the other side of the highway, a surveillance specialist shot video of him entering the woods and then coming out ten minutes later. But just like at Farmingdale High the day before, even with a powerful telephoto lens, it was impossible to peer into the middle of the trees and see what he’d been up to. Following him all the way in would have given the surveillance away.
And so it was that by Sunday night, as Regan drove back to Bowie with his family, investigators realized that despite having learned a great deal about how he had spent his weekend—from where he and the family had gone out to eat (Mario’s Pizza) to what movie he’d watched at the movie theater with Anette and his boys (Jurassic Park III)—they were in the dark about what really mattered. What had Regan made copies of at Staples and why had he gone into the woods two mornings in a row?
• • •
At around eight twenty-five a.m. on August 23, Paul McNulty stopped by Regan’s desk to have Regan accompany him to a meeting at NRO headquarters. It was Regan’s last working day before his leave—although he’d written August 27 to 30 on the office whiteboard, he planned to take Friday, August 24, off as well. As the two chitchatted on the short drive to the NRO in McNulty’s car, Regan told McNulty that he would be getting on the road after work to head to Orlando with his family.
The meeting was in the Signals Applications Office, where Regan had worked until 2000. Some of his former coworkers were present. Regan, dressed in a polo shirt with broad stripes, sat down with McNulty to participate in the discussion, which was focused on a proposal to make changes to the system for disseminating the NRO’s satellite intelligence to other branches of the military.
Regan listened to the presentation with his typically aloof expression. When the speaker had laid out the proposal, McNulty turned to him to ask what he thought.
“Do you know anything about this?” McNulty asked.
“Yeah,” Regan said, getting up from his chair to walk up to the whiteboard.
He sketched out a flowchart showing how the NRO’s intelligence was pushed out to different military customers. There was no need to change the system, he explained, because the intelligence was already accessible to all the users it was meant for. By the end of the meeting, most people in the room appeared convinced by his argument.
“It’s a good thing I took you to that meeting,” McNulty remarked as he and Regan drove back to their building. “I didn’t know anything about that system.”
In McNulty’s estimate, the proposed changes could have cost a few million dollars. “You just saved the government a bunch of money,” he said admiringly.
• • •
Although McNulty’s compliment was perfectly sincere, bringing Regan to the meeting had been nothing but a ruse. McNulty was acting at the direction of NRO counterintelligence, which had asked him to keep Regan away from his office for a block of time that morning.
Investigators had found out about Regan’s plans to travel to Europe less than twenty-four hours earlier. Although they had previously guessed that Regan might be lying about going to Orlando—they hadn’t heard him mention it even once in phone conversations with his wife—his itinerary had come to light only at the last minute after an agent made inquiries with various airlines and discovered reservations under Regan’s name on Lufthansa. His flight was to take off from Dulles at four-oh-five p.m.
When Carr and his colleagues came into work that morning, the atmosphere at the FBI’s Washington Field Office was crackling with tension. Everybody could sense that a big day lay ahead. But whether Regan was to be arrested or not was still an open question that had to be resolved by senior officials in the Department of Justice. The FBI could put Regan in handcuffs only after getting the DOJ’s authorization.
It wasn’t clear if the evidence Carr and his fellow investigators had collected up to this point was enough to convict Regan. What they had been hoping all along was to catch him in the act of providing classified information to a foreign intelligence service. At the very least, they wanted direct evidence showing that he had contacted another government with the intention of transmitting U.S. defense secrets.
Using the intercepted packages to prove that wasn’t an option, for that would involve revealing how the FBI got the packages in the first place. To establish the provenance of the packages, the government would be compelled to call the confidential informant who had provided the packages to testify in court. Not only would that put the informant at risk; it would deter other sources from tipping off the bureau in the future. The cost to the FBI’s broader counterintelligence efforts would be much too high.
The investigato
rs were anxious to find some new evidence that would provide unambiguous grounds for an arrest. But the clock was ticking toward his scheduled departure. With Regan away at the meeting with McNulty, Carr and his fellow agents made another sweep of his office. In the video surveillance from the prior weeks, they had seen Regan occasionally bringing a personal laptop to work, and Carr was optimistic about finding something incriminating on it. The investigators searched every corner of his work space, even crawling under his desk, but there was no laptop to be examined.
Outside, in the building’s parking lot, another group of agents searched Regan’s van. In a blue duffel bag that looked like a carry-on he was planning to take on the flight, they found a blue folder containing Regan’s airline tickets, a Eurail pass for train travel within Europe, European railway maps, four blank envelopes, and several blank mailing labels. Also tucked in the folder were papers that looked decidedly more curious.
The pages were filled with line after line of three-digit numbers written by hand. They consisted of three copies of a set of three documents, each titled “Letter.” Two of them—Letter S-I134 and Letter M-I134—consisted of a single page each, while the third, marked Letter A-341I, ran to two pages. The multiple lines of trinomials in the documents looked like possible code. It was impossible to say whether these “letters” were the evidence investigators were looking for.
The agents photographed the sheets and the other items in the folder, hoping that nobody was watching. Then they carefully put everything back in the duffel bag as before, locked the van, and cleared out of the lot as quickly as possible.
The Spy Who Couldn't Spell Page 12