The Black Banners

by Soufan, Ali H.

  However, because the WFO was the first port of call for overseas attacks, and because al-Qaeda had not officially claimed responsibility for the embassy bombings (thus the case had not automatically been given to NYO), a WFO team was already en route to Nairobi to begin investigating. Before NYO could start investigating, we had to convince headquarters that al-Qaeda was involved.

  Tom and I walked across the street from our office to the Joint Terrorism Task Force command center. It was packed with representatives of every U.S. intelligence and law enforcement outfit with offices in New York City, including the CIA, the U.S. National Security Agency (NSA), and the police department. In the center of the room, at the podium, manning the secure phones and conversing with headquarters in Washington, were John O’Neill, Pat D’Amuro, and other senior FBI agents.

  “Ali believes that al-Qaeda is responsible for the attacks,” Tom told John and Pat, “and he’s got a convincing explanation.”

  I repeated what I had told Tom a few minutes earlier.

  “Good thinking,” John said when I had finished. “I want you to help draft a memo to headquarters in Washington explaining why we think the attack has bin Laden’s signature. Come with me.”

  I followed John from the podium to a side room. Sitting at a round table reviewing files were Kevin Cruise, from the I-49 squad, and an NYPD detective, Tom Corrigan, who was also attached to I-49. Both Kevin and Tom were al-Qaeda experts. John instructed the three of us to prepare a memo for headquarters outlining why we thought al-Qaeda was responsible.

  I wrote down the analysis I had given John and the others, and Kevin and Tom added historical and other classified information that bolstered the claim. They had been privy to intelligence reports on al-Qaeda cells in the region, specifically in Nairobi, and added those details to the memo. When we completed it we showed it to John, who gave it his approval and sent it off to headquarters.

  A reply came back about thirty minutes later that headquarters had accepted the arguments in our memo. An NYO team was to be assembled: half would go to Nairobi and the other half to Dar es Salaam. Senior officials decided that Pat D’Amuro would lead both groups. Arrangements were made for everyone to leave in a few hours.

  While the decision was being made as to who would make up the team, John came up to me. “Good work on the memo,” he said, putting his arm around me.

  “Thanks, boss,” I said.

  “Listen,” John continued, “I don’t want you to go to Nairobi. I need you here with me. We’ll have enough agents on the ground there, but I could use your insights here.”

  In Nairobi the FBI team worked with local law enforcement and intelligence services to begin piecing together the attacks, gathering evidence, performing forensic analysis, questioning witnesses, and following leads. Reward for Justice posters were issued by the State Department and distributed worldwide.

  At the same time, Department of Justice prosecutors from the Southern District of New York flew in and worked with local officials to establish protocol for conducting the investigation. This was essential, as our interest was not just in finding those responsible but also in ensuring that we would be able to convict them in a U.S. court—and use evidence gained for other potential al-Qaeda–related prosecutions.

  We needed to make certain that all parts of the investigation—from the handling of evidence to the conducting of interviews and interrogations—met federal standards, so that evidence, testimony, and confessions would be admissible in U.S. courts. Counterterrorism is a continuous process. The result of any operation might end up in court, so it is prudent to have the legal process in mind in order to keep all options open.

  While my colleagues were doing the hard work on the ground in Nairobi, I worked with John and others in New York both in providing assistance to the Nairobi team and in tracking the broader al-Qaeda network. One city we started focusing on was London. The British capital had been the location from which al-Qaeda had distributed bin Laden’s declaration of jihad and other statements. It was also where media outlets such as CNN and ABC had arranged their meetings with bin Laden.

  John contacted senior British officials to urge them to take the al-Qaeda threat seriously and to help us investigate alleged al-Qaeda members in London and throughout the United Kingdom. They were at first reluctant to do anything about the presence of EIJ and al-Qaeda operatives in London, who didn’t seem to be harming British interests.

  I did further analysis on the claims of responsibility. The two were almost identical, the only difference being the location and the names of the shadowy “platoons,” or cells, that had carried out the bombings. The Nairobi claim announced that the bombing had been planned by the platoon of Martyr Khalid al-Saeed and carried out by operatives from the Arabian Peninsula (referring to Saudi Arabia); the Dar es Salaam claim said that the bombing had been planned by the platoon of Abdullah Azzam and carried out by an Egyptian. The names of the platoons honored Islamist terrorist heroes: Khalid al-Saeed was one of the terrorists behind the November 1995 attack on U.S. servicemen in Riyadh, Saudi Arabia (an act for which he had been praised by bin Laden), and Abdullah Azzam was an original mentor to many of al-Qaeda’s members, widely considered to be the father of the Arab mujahideen in Afghanistan. Azzam’s base had been in Afghanistan, so this pointed to a connection between Afghanistan and the attack. Moreover, the parties in both claims, employing language similar to that used by bin Laden in previous fatwas, referred to themselves as being part of the Islamic Army for the Liberation of the Holy Places.

  On August 10, three days after the bombing, Debbie Doran, an I-49 agent manning the phones in the FBI’s command post in Nairobi, took a call from someone who reported seeing a “suspicious Arab man with bandages on his hands and stitches on his forehead.” The caller then appeared to have second thoughts and signaled that he was going to hang up.

  The FBI runs in Debbie’s blood: her father was a special agent in charge in New York. When she signed up for the bureau, she knew exactly the long hours it would entail, and she is willing to be consumed by important work. Debbie coaxed the caller to stay on the line by assuring him that anything he told her was confidential. It was clear to her from his voice—almost a whisper, with a distinct element of fear—that he worried that saying too much might put him in danger. Debbie spoke of the bombing and reminded him of his moral duty to find the killers of so many innocent people.

  The caller told her where he had spotted the man and provided a description. An undercover team was dispatched. Among the agents were Stephen Gaudin and an NYPD detective named Wayne Parola. Stephen, newly assigned to the SWAT team in the New York office, had been with the U.S. Army Special Operations Forces. Though at the time he lacked in-depth knowledge of al-Qaeda, he had a remarkable talent for communicating with suspects, a function of his natural empathy and people skills. He would later put this gift to use in key interrogations. The assignment to Nairobi changed Stephen’s career path: he was to become a central member of the FBI’s al-Qaeda team. Wayne Parola was a member of the JTTF and brought a lot of experience. Italian, stocky, with a black beard, he walked the walk, talked the talk, and fit the role of an NYPD detective.

  Wayne, Stephen, and the rest of the team staked out the location, and a man who matched the description given to Debbie soon appeared. The agents monitored him, waiting for an opportune moment to grab him. When the moment presented itself, they apprehended and subdued him. A search produced eight hundred-dollar bills. The man had no identification or documents.Unsure how serious his injuries were, the team took him to a hospital to be evaluated by a doctor.

  John Anticev led the questioning at the hospital, conducted at the detainee’s bedside. John had been the case agent for Terrorstop, the 1993 New York City landmarks operation, and he was both an experienced interrogator and schooled in radical terrorism, a fact he soon impressed upon the patient-detainee.

  “What’s your name?” John asked.

  “My name is Khaled Saleem
bin Rasheed,” the man replied. Asked where he was from and what he was doing in Nairobi, the man replied that he was from Yemen and that he was looking for business opportunities.

  John didn’t challenge his story. Instead he asked him how he had been injured. Rasheed replied that he had been in the Cooperative Bank at the time of the bombing, and that he had been knocked down by the explosion. He had checked himself into the hospital, where he had gotten stitches and where his injuries had been bandaged.

  John nodded and jotted down everything he said, in the meantime analyzing his words and studying his moves. He asked Rasheed if he was comfortable and whether he had had a chance to pray. Rasheed said that he had, and John went on to ask him a series of seemingly routine questions about his religious beliefs and his views on the United States, the Taliban, and related matters.

  Rasheed settled into his bed and engaged John. He seemed to enjoy the discussion, welcoming the chance to “educate” John on these subjects. John steered the conversation to Abdullah Azzam and noticed that Rasheed gave a slight, seemingly involuntary smile upon hearing the name. It was clear that he was knowledgeable about the theology used as a basis for Islamist radicalism, and he, in turn, was impressed with John’s knowledge.

  Rasheed had reached a point at which he was completely at ease. John was relaxed, calm, smiling, and polite. He gave Rasheed the impression that he respected him, and Rasheed clearly appreciated it—he smiled back and happily chatted.

  As Rasheed was midway through a sentence, John interrupted him and in a swift movement placed a piece of paper and a pen in front of him, telling him sternly, “Write down the number you called after the bombing.”

  Rasheed froze, bewildered by the change in John’s manner and tone. John repeated, “Write down the number!” The certainty with which he gave the command stunned Rasheed, who almost robotically wrote down a phone number. He then put down the pen and stared blankly at John. He was shaking. He had no idea how John knew he had called a number.

  In fact, John didn’t know; but his hunch had paid off, and now the FBI team had in custody someone who not only had effectively admitted a role in the bombing but had supplied an important lead.

  John asked a follow-up question about the number, but Rasheed wouldn’t say anything else.

  As the interrogation was taking place, another team of agents was investigating Rasheed’s cover story. They went to the hospital where he claimed to have been treated following the bombing and to the airport to see if they could find his landing card or any other information. At the hospital, after questioning staff and doctors, they discovered that a janitor had found Rasheed’s belongings stashed on a windowsill above a toilet seat. Among the belongings were truck keys and bullets. They were sent to the FBI forensic team that was analyzing the remains of the truck used for the bombing. The keys were found to match the suicide truck’s locks.

  The agents who had gone to the airport found a landing card under the name Khaled Saleem bin Rasheed. Following up on the landing card information took them to a villa in Nairobi that appeared to have been used by the bombers—residue from explosives was found throughout.

  At the same time, we traced the telephone number Rasheed had written down to a man in Yemen named Ahmed al-Hada. By monitoring the number, we found that it appeared to be used as the main contact number for al-Qaeda in Yemen, and that calls placed from it went regularly to a satellite phone that U.S. authorities had already been monitoring because it belonged to Osama bin Laden. There were several calls from bin Laden’s satellite phone to the Hada switchboard and from Hada to Nairobi. The al-Qaeda link to the bombing was clear.

  On the day of the embassy bombings, a Palestinian al-Qaeda operative named Mohamed Sadeek Odeh was arrested at the airport in Karachi. He had flown in from Kenya, and Pakistani authorities had noticed that the picture on his passport was fraudulent. He was questioned for several days before being rendered, on August 14, to Kenyan authorities and then transported —on the Pakistani prime minister’s plane—to Nairobi. Pat D’Amuro and a team assigned to meet Odeh and his handlers at the Nairobi airport found themselves faced with an unexpected dilemma: the prime minister’s plane didn’t have enough fuel to fly back to Pakistan.

  Eventually the fuel tank was filled. A Kenyan official asked pointedly, “But who will pay?”

  Pat spotted a CIA plane on the runway. “Bill it to them,” he deadpanned.

  The next day, August 15, John Anticev and his team were given access to Odeh. They started off by advising him of his rights, as guided by the bureau and the Department of Justice, and Odeh signed the form, acknowledging that he understood its contents. He went on to admit his involvement in the plot, and he outlined his path to al-Qaeda. He had gone to high school in the Philippines and had become interested in jihad after watching videos and listening to tape recordings of lectures by Abdullah Azzam. In his final year of high school, Odeh needed a thousand dollars, which his father agreed to send him. Upon receiving the money, he asked a cleric whether he should use it to finish his studies or to travel to Afghanistan to join the mujahideen. The cleric told him to head to Afghanistan. There he attended the al-Farouq camp, near Khost, later joining al-Qaeda. He was trained in assassinations and learned how much explosive power was needed to bring down different types of buildings.

  Once his training with al-Qaeda was complete, Odeh was sent to Somalia and then Kenya. His first assignment in Kenya was to set up a fishing business, whose proceeds were used to help finance the Nairobi cell. His second assignment was to work with explosives. Odeh explained to the interrogators that in late July 1998, Khalfan Khamis Mohamed, Mustafa Mohamed Fadhil, and other al-Qaeda members had gathered in Dar es Salaam to grind TNT to be used in the bombing. The two of them had met Fahid Mohammed Ally Msalam and Ahmed the German in House 213 in the Ilala district of the city to make final preparations. With the help of operative Ahmed Khalfan Ghailani, they had loaded boxes of TNT, cylinder tanks, batteries, detonators, fertilizer, and sandbags into the back of the truck to be used.

  Odeh explained that on August 1, 1998, Saleh had told him that all members of al-Qaeda had to leave Kenya within five days. That same day, Ghailani checked into the Hilltop Hotel in Nairobi, and the following day, Odeh and Harun Fazul met with other al-Qaeda members there. At about the time this meeting was taking place, al-Qaeda members Sheikh Ahmed Salem Swedan and Mustafa Mohamed Fadhil, following instructions, left Nairobi on Pakistan International Airlines Flight 744, bound for Karachi via Dubai; and on August 3, Fahid Mohammed Ally Msalam purchased tickets for himself and Odeh on Pakistan International Airlines Flight 746, scheduled to depart on August 6.

  Odeh joined other al-Qaeda members at the Hilltop Hotel, where they remained in touch with the team in Dar es Salaam. On August 5, in preparation for meeting bin Laden in Afghanistan following the next day’s flight to Karachi, Odeh shaved his beard and got new clothing. While accomplishing his shopping errands, he took a walk along Moi Avenue, near the U.S. Embassy. On August 6, Saleh and Ghailani left Nairobi for Karachi on Kenya Airways Flight 310, and Odeh (using a false name) and Msalam departed on Flight 746.

  Among other details Odeh shared with the interrogators was the role Harun Fazul played in al-Qaeda, specifically his role in writing reports for the leadership. He wrote in code; if anything fell into the wrong hands, al-Qaeda’s plans would still be safeguarded. Odeh gave the questioners examples: “working” meant “jihad,” “potatoes” meant “hand grenades,” “papers” meant “bad documents,” and “goods” meant “fake documents.”

  “Can you give an example of how these words would be used?” Anticev asked.

  “If we say, ‘How were the goods from Yemen,’” Odeh replied, “it would mean ‘we need fake documents from Yemen.’” Odeh said that Harun’s reports were faxed to Pakistan and from there taken by courier to al-Qaeda’s leaders.

  On August 27 John Anticev flew with Odeh from Kenya to Stewart Air Base, where an FBI team was waiting to collect
him and continue questioning him. I was one of the members of that team. I stepped onto the plane and gave John a hug. “Welcome home,” I said. “Great work.” This was an understatement. John and the team in Kenya had done a tremendous job. Odeh, wearing a dark jumpsuit, was taken by a SWAT team onto a helicopter and flown to a jail in New York.

  On August 20, thirteen days after the bombings, I was in the middle of a conversation with John O’Neill about al-Qaeda operations in London when we heard a run of expletives and shouts from people gathered in front of a television screen nearby.

  We ran over and watched a reporter announce that President Clinton had ordered the firing of missiles from navy vessels in the Arabian Sea to bomb sites in Sudan and Afghanistan believed to be run by, or connected to, bin Laden. The sites included a pharmaceutical plant in Khartoum and al-Qaeda training camps near Khost. David Cohen and Charlie S[1 word redacted] from the CIA had called John only minutes before to warn him that the bombing was about to take place.

  This, the reporter said, was the U.S. retaliation for the embassy bombings. Crowds in Sudan and elsewhere in the Arab and Muslim world were protesting the strikes; the United States was seen as having attacked without cause or warning, killing innocent people.

  “What are they doing?” shouted one colleague in disbelief, voicing what we were all feeling at that moment. “Don’t they realize we’ve got agents on the ground in hostile territories?”

  “Why the hell didn’t they at least tell us first that they were going to do this?” I asked John. He shrugged as I followed him to a side office off the command post and called Pat D’Amuro to check on the security of the agents on the ground in Nairobi and Dar es Salaam, all now easy targets for anyone wishing to avenge the U.S. strikes. If the FBI had known about the bombings in advance, our agents would have been pulled out or taken off the streets until the issue died down.