The Spy Who Couldn't Spell

by Yudhijit Bhattacharjee

  The sheets with trinomes that he’d had on him at the airport—marked Letter S-I134, Letter M-I134, and Letter A-341I—contained encrypted geocoordinates of the hiding locations in Pocahontas. Regan explained that each “letter” was meant for a different country. S-I134 contained the coordinates for the sites where he’d hidden packages for Iraq (S representing Saddam Hussein); M-I134 contained the coordinates for the secrets he’d assembled for Libya (M for Muammar Gaddhafi); and A-341I (A being a reference to Ali Khamenei) had the sites with packages for Iran. Regan also explained how he’d tailored the three sets of packages keeping in mind the geopolitical context and intelligence needs of each country. The documents he’d compiled for Iraq, for instance, included satellite images of military facilities in Iran and other countries in the region. Similarly, for Iran, he’d assembled images and reports relating to the Iraqi military and the militaries of other neighboring countries.

  He’d decided at the last minute not to include in these sets satellite intelligence about Israel’s military, even though he had printed such documents out from Intelink along with everything else. His reasoning was that giving away classified information about Israel—the United States’ closest ally in the region—to countries that were sworn enemies of Israel would be directly harmful to the national security of the United States. That’s why he’d mulched those documents in the bathtub of the motel in Chester and thrown them into a dumpster.

  The people in the room listened with rapt attention as Regan spoke, his dull delivery notwithstanding. He paused every now and then to take a sip of Mountain Dew. The scheme he had used to encrypt the Pocahontas coordinates, he said, was based on an employee phone list from the NRO. He’d had the list with him when he was arrested at the airport, but it hadn’t struck investigators as unusual. Regan said he’d buried copies of the list at several locations in Chantilly as well as in Farmingdale; since it was the key to his code, he had been paranoid about misplacing it. That’s what he’d been doing when surveillance specialists saw him disappear into the woods behind the handball court at Farmingdale High the weekend before he was arrested.

  Some of the notes with cryptic writings that agents had found in Regan’s van contained references to these locations. Carr had brought those notes along this morning, and when he laid them out on the table, Regan told him what they meant. “Turkey-block” was a reference to the Talkin Turkey deli near the NRO, where Regan had often gone for lunch—he’d buried a copy of the phone list there. He’d buried another one off the highway by Galyan’s sporting goods store in Chantilly; his code for that location included “35steps-dirt-log-Mexico”—a reference to the number of steps he had to walk south of a fallen log to get to the spot.

  Carr took notes on how the trinome code worked, but there was no need to decrypt the trinomes to find the Virginia packages, Regan said. He had written down the plaintext coordinates of the Pocahontas sites on a sheet of paper and rolled it up in a toothbrush container that could be found buried next to I-95 sixty miles south of Washington, D.C., at a spot next to Exit 130A. In the container, Regan said, agents would also find, in encrypted form, the coordinates for the seven packages in Maryland. The code he’d used for these was based on his junior high school yearbook.

  Carr had sent an agent to buy some food for Regan. The agent returned with a ham and cheese sandwich and placed it before Regan. The U.S. marshals weren’t happy, but Carr didn’t care. He knew he was going to need Regan’s help again soon. For now, his mind was racing to make plans for the recovery operations in Virginia. Shortly after one p.m., after wrapping up the day’s interview, he called Lydia Jechorek.

  “Lydia,” he said. “We’re going on a road trip.”

  • • •

  The convoy of vehicles sped south along I-95, having set out from the FBI’s Washington Field Office bright and early on March 22, a Saturday. Carr was at the wheel of his personal Ford Excursion, a roomy SUV that he typically used on the weekends for transporting band instruments for his kids and taking Boy Scouts on camping trips. This morning, all of the seats in it were occupied by agents from Carr’s squad. The back of the vehicle was loaded with shovels and metal detectors and other gear for executing what the agents hoped would be a successful treasure hunt.

  Riding in the other cars were officials from the NRO, the CIA, and the NSA—the rightful custodians of much of that treasure. Following the directions that Regan had given the day before, Carr led the convoy down the highway past Fredericksburg before turning around and driving back in the opposite direction, on I-95 North, until he got to the sign for Exit 130A. He pulled his truck over to the shoulder and parked right in front of the exit sign. The other cars pulled up behind him. Everybody got out.

  The agents walked uphill from the sign as Regan had directed, inspecting the ground with ground-penetrating radar and a metal rod to probe the soil. Spring was still a few weeks away, and the trees and bushes along the highway looked bare. The area the agents were exploring was next to private property fenced by barbed wire; two little boys playing there peeked out from behind a large tree, curious to see what was going on. The sight of so many people walking along the shoulder of the highway drew the attention of a Virginia state trooper driving by, and he came over to inquire about the activity.

  The agents flashed him their badges. “We’re looking for some evidence,” Carr said. The trooper left them alone.

  Minutes later, the agents found the toothbrush holder, buried less than three inches under the ground. The discovery seemed surreal to Carr. On the drive down from Washington, he’d felt both an adrenaline rush as well as a niggling doubt, wondering if Regan might be leading the FBI on a wild-goose chase. Now he had no doubt that the search was on the right track.

  “Steve, it’s wrapped in packing tape,” Kathy Springstead yelled out to Carr above the roar of the highway traffic rushing past. “Do you want me to take the tape off?”

  If this had been ordinary evidence found in the course of an investigation, it would have had to be handled with the utmost care. The agents would have had to take it into a lab, where forensic examiners would have fingerprinted it and conducted other analysis to link the package to the subject of the investigation. But this wasn’t ordinary evidence. Regan’s legal fate had already been sealed. There was no need to waste time.

  Carr asked Springstead to unwrap the container. “We have to see what’s in it,” he said.

  After cutting through the tape, she peeled off the layers. What lay inside was only the bottom half of the holder—a translucent purple tube with sheets rolled up in it. Since the roll was a couple of inches longer than a toothbrush and wouldn’t have fit under the lid of the holder, Regan had left it off. He’d buried the lid—with an identical set of papers—off an exit on the other side of the highway.

  The agents unrolled the pages, holding them down against brown paper bags while somebody took digital photographs. Among them was a copy of Regan’s encrypted offer letter, his codebook, and the instructions for decryption—the same set of materials he’d mailed to the Libyan embassy. One of the sheets contained some twelve lines of numbers mixed in with letters, which Carr identified as the code for the Maryland coordinates that Regan had talked about. And then there was the information that the agents wanted to act upon immediately: the page on which Regan had put down the plaintext coordinates for the packages buried in Pocahontas.

  Besides the other half of the toothbrush holder hidden on the southbound side of I-95, the investigators also dug up a saltshaker that Regan had told them about. It contained the keys to the storage unit Regan had rented near Pocahontas. During the investigation, Carr would have given anything to be able to track down those keys—they would have been a priceless aid in the effort to reconstruct Regan’s crime.

  At this juncture, however, all he wanted to do was get to Pocahontas State Park as quickly as possible. By two p.m., the convoy was back on the highway, hea
ded eighty miles farther south.

  • • •

  The morning dew was still fresh at Pocahontas on Sunday, March 23, when Carr and his fellow agents began walking through the woods to locate the first of the twelve sites. Bill Lace and Marc Reeser had GPS units with them to guide the way. Geocoordinates can be written in different ways; Regan had followed the “degrees decimal minutes” format. What he had written on the sheet in the toothbrush holder were the three digits after the decimal point for each latitude and longitude. Since the digits that came before the decimal point—the degrees and the minutes—were the same for practically the entire park, he hadn’t bothered to write them down. It was simple enough for Lace and Reeser to complete each set of coordinates and plug them into their GPS devices.

  They navigated through the tall pines, stepping over fallen logs and broken tree limbs—the apparent wreckage left behind by a storm just days earlier. Some of the agents carried shovels. Others held metal detectors to look for the roofing nails that Regan had said he’d hammered into a tree near every site. Even though the coordinates were sufficient to pinpoint the sites, the nails, Regan had explained, were a backup to help confirm each location, along the lines of what he’d read in J. J. Luna’s book. The choice of a state park to bury the materials was itself based on Luna’s advice: Regan wanted to pick a place that would be protected from any construction activity in the foreseeable future.

  After about fifteen minutes of walking, the agents got to the first site—a flat clearing in the middle of the trees. On a tree about eight feet away, just as Regan had said, they found three nails, hammered into the trunk at approximately chest height. One of the agents began digging at the spot the GPS had pointed to.

  After just a few strikes, his shovel hit something soft. He removed the loose dirt to uncover the top of a package, wrapped in a garbage bag. It lay barely a foot under the ground.

  “We found one!” more than one person yelled out to the others. Somebody gave Carr a high five. His face was flushed with excitement.

  The dozen or so people in the group gathered around the site for a photo, with the package still in the ground. Afterward, the agents hauled it out. Somebody laid a tarp on the ground nearby. Springstead slit open the package with a knife and laid out some of the documents on the tarp. As the agents had expected, the pages were printouts of satellite images and intelligence reports, most of them stamped “Top Secret.” Information that—according to Regan—“could start a war.”

  Over the next hour and a half, excited shouts of “Found another one!” rang out in the forest time and again as the agents went from one site to the next. In scanning the trees with the metal detectors while searching for the nails, the agents ran into a problem: it was hard to remember which trees they had already scanned. The solution they came up with was to nick the trunks of the scanned trees with their shovels—a violation that would no doubt have earned them hundreds of dollars in fines, had a park ranger been on the scene. But the excitement in the air was too high for anybody to care. By lunchtime, Carr’s team had dug up another five packages from the general area, which along with the first package made up the entire cluster of six that Regan had buried on this side of the park.

  The team drove to another part of the park to search for the other six packages. Here, too, they struck gold right away. It was evident that Regan hadn’t surveyed this location with much care; he seemed to have been unaware of how high the water table was at some of the spots he had chosen. Digging at one such site in the cluster, agents hauled out a package that was soaking wet.

  “Oh God, look at this,” the digger said. “Look, he punched a hole in this package.”

  As Regan would describe in later interviews to Carr, he’d jabbed his pen into that package while burying it to release the air trapped inside. The air had caused parts of the wrapping to puff up. What Regan hadn’t noticed was how wet the earth around the hole was. In the two years since, water had spilled onto the documents inside. When Carr and the others inspected them, they saw that worms had buried holes through many of the pages.

  Near another site, the agents spotted a piece of plastic stuck on a tree. When they dug up the package at that site, they could see that the plastic had come from the garbage bag that the package was wrapped in. Working in the darkness of night, Regan had evidently failed to notice when the wrapping got caught on the end of a low-hanging tree branch.

  By late afternoon, the group had dug up eleven stacks of documents: some of them stuffed in Rubbermaid containers, some held in cardboard boxes, and a few wrapped directly in trash bags. A lot of the materials recovered from the second cluster were soaking wet, the print smudged off here and there. There was just one package left to be recovered.

  But Carr’s team was having no luck finding it. Lace and Reeser checked and rechecked the coordinates for the site, which resolved to a spot about three hundred yards from the vicinity where the other five packages of this cluster had been found. “Something doesn’t seem right,” Reeser told Carr. Why would Regan have walked so far away from the other sites to bury this package?

  It was past four p.m., and daylight was fast fading in the forest. The group was too exhausted to keep looking. Carr decided it was time to wind up the search for the day. The recovered packages were hauled into the back of the Excursion. They stacked up all the way to the ceiling, blocking the rearview mirror as Carr drove out of Pocahontas before eventually heading back to the Washington Field Office.

  When the agents got back to the office, they loaded the packages on dollies and carted them up on the elevator to the floor of the counterintelligence squad. Carr was worried that the thousands of soaked pages among the documents would get mildewed unless they were dried. So he and the others laid out the stacks inside a conference room. Carr went around the office, grabbing every table fan he could find on the cubicle desks. He placed them around the documents and switched them on, turning the room into a makeshift drying chamber. Before he and the others left, they changed the room’s passcode so that nobody unrelated to the case would be able to get in.

  When Carr pulled into his driveway, it was close to midnight. Despite the day’s rich haul, the failure to locate the twelfth package bothered him. Regan had clearly made an error in writing that site’s coordinates on the sheet hidden in the toothbrush holder. According to what he’d told Carr, however, he hadn’t referred to this sheet when converting the plaintext coordinates into code. He had consulted another piece of paper, which he’d originally recorded the coordinates on and subsequently destroyed. Assuming that this original sheet didn’t contain the same error that had foiled the search for the twelfth package, there was a way to find its correct location, Carr reasoned: by decrypting the trinomes.

  • • •

  Dan Olson had never been able to put the trinomes out of his head. Long after he stopped actively trying to decode them in the late spring of 2002, he had found his mind returning time and again to the knotty problem that those four sheets represented. There was an undeniable sense of frustration associated with the memory. Although his analysis of the trinomes had definitely helped the investigation—his testimony had enabled prosecutors to argue that the trinomes were a code, not a meaningless sequence of numbers—Olson wished he’d succeeded in making a more substantive contribution.

  That’s why he felt a rush of adrenaline when Carr called him with a request to revisit the code. Carr filled him in on the search: how eleven packages had been found using the plaintext coordinates. Olson’s help was needed to find the twelfth package, Carr explained. For Olson, the chance to decrypt the trinomes—even though it wasn’t the same thing as cracking them—was a welcome opportunity for closure.

  The morning after Carr had returned from Pocahontas, Olson went over to the Washington Field Office. During the debriefing with Regan, Carr had taken notes on how Regan had gone about encrypting the coordinates. He gave them to Olson. Re
gan’s step-by-step directions were so confusing that making sense of them was itself a bit like solving a puzzle. When Olson was finally clear about the scheme, he found an unattended cubicle to sit down in and work on the decryption.

  Regan had used two layers of encryption. To convert the coded message into plaintext, he first had to convert each trinome into a two-digit number by following a couple of simple steps. In the first step, the first digit of the trinome had to be “inverted” by using the following table.

  1 2 3 4 5 6 7 8 9 0

  0 9 8 7 6 5 4 3 2 1

  The digit to be converted had to be looked up in the top row. It would convert to the corresponding digit in the bottom row. If the first digit of the trinome was 1, it would change to the digit right below 1 in the bottom row: 0. If the first digit was 6, the corresponding digit would be 5, and so on.

  To convert the second and third digits of the trinome into a single digit, he had to look them up on another table. More on that in a minute, but first the table:

  1

  2

  1

  1

  2

  2

  3

  4

  3

  5

  6

  4

  7

  8