The Watchers

by Shane Harris

  They were going to need help.

  CHAPTER 17

  SHIPS PASSING IN THE NIGHT

  Since September 11, John Poindexter and Mike Hayden had been sailing the same noisy ocean, searching for the same signals. But they hardly recognized the other’s presence. They were ships passing in the night. Sooner or later, they were bound to collide.

  Poindexter had never met Hayden. On paper the pair seemed natural competitors. Poindexter was the elder, by nearly ten years. He was Navy, Hayden was Air Force. Poindexter came up through the academy, Hayden was an ROTC graduate from Duquesne University. But in one important respect—and for their present purposes, maybe it was the most important—they were identical. Each man was a brilliant technocrat.

  They knew the system. They knew its limits. They had built their careers pushing them, and they regretted the times they hadn’t. They were survivors. And now each man had come to a crest. Not by virtue of his status or position but because of the job each one believed he’d been called to do.

  Poindexter made his first approach to the NSA in February 2002, when he was making the rounds of the other intelligence agency heads. Poindexter wanted the NSA to join his network, based at the Information Dominance Center. The agency was the biggest signals collector out there—he thought it was only natural they should participate.

  Poindexter secured a meeting with Bill Black, Hayden’s number two and a career NSA employee. When Hayden took over as director, he brought Black out of retirement to help him run the agency. Black had taken a post at SAIC, the California contractor so intrinsically linked with the agency that employees called it NSA-West. He knew the agency in ways that his new boss didn’t. The NSA was run by middle management, the career establishment that caustically referred to any chief as “the current director.” They were the permanent class. And within their ranks, the lawyers held particular sway. Without Black, Hayden might have found the agency too inhospitable to carry out his broad agenda.

  Poindexter showed up at Fort Meade on the morning of February 2. Officials had a whole day of events planned for him. He started out at a ten o’clock meeting with lower-level officials and then sat down with Black after lunch. Poindexter gave him the same TIA briefing he’d presented to others. But he didn’t find Black as talkative and agreeable. He was in listening mode, Poindexter thought. He took more than he gave.

  Poindexter wasn’t completely in the dark about what the NSA was up to. Based on those prelunch meetings, he understood that the agency was in the midst of a much broader intelligence-gathering effort. He could also tell that to preempt terrorism the NSA was expanding the scope of its activities. Poindexter was never read into the warrantless surveillance program, now known internally as Stellar Wind. Nor was he ever told that the agency was operating under new presidential authorities. But he could see that the tempo had changed. And why wouldn’t it? he figured.

  Black and his underlings didn’t tell Poindexter about the agency’s work with telecommunications companies. But again, he knew from his own career what a long history the NSA had with the intelligence agencies. The phone companies were indispensable partners, something Poindexter had been reminded of on a recent visit to an AT&T laboratory in New Jersey. There he learned that a large percentage of phone calls, no matter which carrier generated them, passed through AT&T circuits. Clearly, he thought, of all the telecom companies, AT&T was the most important. Had someone at the NSA said they were working with the company to divert their network traffic to the agency, Poindexter wouldn’t have blinked.

  Poindexter told Black that he wanted the NSA on his network. Black seemed supportive, Poindexter thought. But he made no promises. Poindexter had a hard time deciding how impressed Black was with the TIA concept. But he thought that they surely needed it.

  Indeed, as the agency amassed more stores of telecom metadata, its approach started to look like Poindexter’s. Instead of just monitoring individual targets, the terrorist hunters began to look for patterns. They timed series of phone calls, measured the waves of e-mail traffic emanating from particular corners of the world, and examined the conspicuous but still vague overlaps of phone calls and credit card purchases. These patterns told the agency whom to zoom in on, whose phone to tap and e-mails to read. It was the best method they had, but all too often, it led nowhere.

  The FBI was discovering that firsthand. The torrent of leads that Mike Hayden let loose after 9/11 more often than not led agents on wild-goose chases. Rather than leading them to sleeper agents, the NSA’s intelligence usually led them to the doorstep of an innocent American, or a Pizza Hut.

  FBI agents weren’t the only ones frustrated by the NSA’s lack of specificity. At the CIA, the senior officials in charge of tracking Al Qaeda members overseas were less impressed by social network models, and the insights they could provide into terrorist behaviors and organizational structures. They wanted to know whom to kill. In one meeting at Langley, a senior CIA official looked across a table at an NSA analyst, who’d shown up with a nebulous link diagram. “I don’t need this,” the official said. “I just need you to tell me whose ass to put a Hellfire missile on.”

  The NSA wanted that too. “Geo-location” was the trade term for locating a target based on his signals. And the analysts could do that. But still, they were overwhelmed by the amount of information they had to process. The data was piling up.

  Poindexter knew that had long been the agency’s problem. And he knew about the BAG. He thought it was a blunt instrument compared to the precision tools he was testing. Poindexter distrusted graphs in general. He abhorred how they watered complex information down into a bland stew.

  Poindexter left Fort Meade feeling moderately successful. Black hadn’t made any promises, but having spent nearly the entire day there, Poindexter felt confident that he was on the right track.

  Exactly seven weeks later, on March 25, Poindexter went back to the fort and sat down with Mike Hayden. TIA was the topic of discussion once again.

  He didn’t give Hayden the full briefing. Poindexter presumed that Black, who was also there, had given his boss the highlights. Poindexter heard a lot of the same talk about the NSA’s new challenges. He explained to Hayden how he thought TIA could help.

  It was hard to get a read on the NSA director. Did he grasp the concept? Was he willing to experiment? Poindexter had a long-standing bias against Air Force officers, so he was perhaps skeptical about Hayden going into the meeting. He also knew the NSA’s reputation as a reluctant partner with other intelligence agencies. The fort took in a lot more than it gave out.

  Poindexter and Hayden had a polite if cool exchange. It was the first and last time that they ever sat down face-to-face.

  Over the next several months, the two ships passed each other more frequently, closer each time. They watched each other. And in time, they stalked each other. Neither man could have predicted how it would all settle out. But in the end, the NSA would own TIA.

  CHAPTER 18

  FULL STEAM AHEAD

  Once the first node was installed on the TIA network, in early 2002, Poindexter set out an ambitious schedule to enlarge his laboratory and build a working TIA prototype. Every three months he would conduct an analysis experiment on a particularly challenging problem facing the network’s members. The idea was to test a set of tools in a real-world environment. The members brought the problems, Poindexter provided the tools.

  Each experiment received a code name that, to a landlubber, might seem obscure. “Mistral,” “Sirocco,” “Rafale,” “Noreaster.” The names paid homage to Poindexter’s other passion—sailing. Each one referred to a type of wind.

  The first experiment began in May. And with each new test Poindexter made more tools available to the members of the network. Some performed well. Others the members junked.

  It wasn’t hard to find real-world intelligence problems. With the government’s fear of more attacks spreading at a relentless pace, there was always more work to be done. Th
e list of experiments reflected some of the worst fears and toughest challenges that military and intelligence agencies were f acing.

  Domestic military planners creating a new homeland defense command were worried about nuclear, biological, or chemical weapons attacks against a U.S. city. Collaborating on the TIA network with analysts in different agencies, they devised a rank-ordered list of targets, starting with the most likely and working down to those at less risk. Over the course of the experiment, the analysts swapped classified documents, posed competing hypotheses, and employed an audio search tool that let them find keywords in spoken recordings. This was the kind of information sharing that the 9/11 Commission called for years later in its final report. In the end the TIA team produced the analysis in one-tenth the amount of time it had taken another set of analysts to do the same work by hand.

  Word of the experiments spread. Like Kleinsmith’s analysts on steroids, Poindexter’s researchers were offering faster and potentially better ways of doing business.

  Analysts poring over interrogation reports from detainees held at Guantánamo Bay, Cuba, wondered if Poindexter’s new system might help them. Hundreds of men captured on the battlefields of Afghanistan and Pakistan had been flown to the island jail, often with little attempt to discern whether they were actually members of Al Qaeda. The Pentagon’s Criminal Investigation Task Force, which was trying to sort the prisoners, asked the TIA team to use their data extraction and linking tools on a set of interrogation reports. These were the end result of lengthy, often coercive sessions with the detainees, and they contained hundreds of references to other people, places, and groups. As the stacks of reports piled up, the interrogators struggled to make sense of what was in them.

  Some detainees frequently mentioned the same names or places. Some claimed to know one another. Others said they didn’t. The Pentagon task force wanted to know which men were real terrorists and which were just “dirt farmers,” innocents caught in the fog of war who had no useful intelligence to offer.

  The TIA team ran their tools, looking for interesting and nonobvious relationships among the prisoners. What they considered to be valuable leads they passed along for use in follow-up interrogations. But the tools also revealed that some of the detainees were certainly not terrorists. Far from speeding their release, this new information became a kind of baseline for what a “nonterrorist” looked like. The data tools were then recalibrated to disregard certain attributes and search for others that were germane to the interrogators’ work.

  Throughout 2002, anywhere Poindexter turned he could find agency chiefs and cabinet secretaries trying to carve their own counterterrorism niche. Intelligence was the best game in town, and Poindexter was in demand. Paul Polski, an old Naval Academy classmate, called Poindexter for help on an ambitious project to screen millions of airline passengers against terrorist watch lists and intelligence databases. Polski was working with the new Transportation Security Agency, set up swiftly after the 9/11 attacks, on a system that could assign risk levels to each flier. Like Poindexter, Polski was an old counterterrorism hand. In the late eighties he had directed a team of engineers at a Federal Aviation Administration research lab set up in the wake of the Pan Am Flight 103 bombing. Polski called his technicians, who invented bomb-sensing equipment and other countermeasures, the “Green Berets of science.” Poindexter’s team helped Polski vet ideas and proposals for the passenger-screening system.

  Attorney General John Ashcroft also came calling. Shortly after 9/11 he set up a new terrorist-tracking task force to find suspects using public records. The FBI hired ChoicePoint, a data-aggregation firm based outside Atlanta, to give agents access to billions of records on nearly every person inside the United States—everything from their driver’s licenses to marriage records to the forms they filled out to open post office boxes. The company made millions of dollars off its federal government sales, which became an indispensable part of the business, and designed systems specifically for use by the FBI and the intelligence agencies. Poindexter’s team helped the FBI trackers devise new ways of sifting through hoards of information without hitting dead ends.

  As the TIA experiments continued apace, Poindexter’s team made more data available to the network members. They already had access to the database of simulated intelligence reports about terrorists, including fake accounts of their daily activities. The TIA researchers nicknamed the database Ali Baba, after the Arabian folk character who opens a cave full of hidden treasure with the magic words “open sesame.” (The name Ali Baba was also becoming a sobriquet in military circles for all suspected terrorists.)

  Simulated intelligence was also used to create ever more complicated synthetic worlds for testing the red teams’ attack templates. The first world consisted of two million individuals. Their names were randomly assigned by mashing together real first and last names, and each person was assigned to an actual address somewhere in the United States. But their attributes were manufactured—age, gender, nationality, whether they paid with cash or credit for purchases. The synthesized people took trips on airlines, which created travel records. Poindexter’s database builders called this alternate reality Vanilla World, because it was so plain. As more sophisticated attributes were added, and new transactions, the flavor names changed.

  Cherry Vanilla World emerged when a separate red team covertly added terrorist sleeper agents into the mix. Their travel records were the signals that the templates were supposed to spot. Poindexter thought that the TIA analysis tools did a respectable job, and he hoped that Strawberry World and Chocolate World were not far off. But there was no denying that the system was primitive. It took a week to successfully identify some suspicious individuals in the fake world, and a lot of manual labor on the part of the researchers. Still, it was a start.

  The TIA network also added real databases of known or suspected terrorists as well as the people, places, and activities that had been linked to them. These “entity databases” were highly classified and were restricted to agencies with nodes on the network. Critics of the intelligence failures that had preceded the 9/11 attacks lambasted the intelligence agencies for not sharing enough information about terrorism. But on the TIA network partners were swapping leads and finding ways to give one another access to their secrets. The network was quickly becoming the most active experiment of its kind. By the end of 2002 the number of individual users at agencies increased more than 35 times, from 7 to 250. By August 2003 the network had 23 nodes and 320 users.

  By far, the NSA was the biggest presence on the network. The agency eventually installed 15 nodes, eclipsing all other organizations. The NSA seemed intensely interested in collaborating. But that struck Poindexter as rather odd, since the agency still had never participated in a single experiment.

  The rules of membership on the TIA network were simple. Each agency brought its own problem set and could bring its own data. But participation in the experiments wasn’t required. And there was also no rule against an agency taking any of the tools off the network to use within the walls of their own organization. Poindexter and Bob Popp both expected that the NSA was moonlighting, but neither could be sure.

  Their suspicions were well founded. In fact, the NSA analysts did remove the experimental data crunching, linking, and extracting tools from the TIA network and quietly put them into service as part of the agency’s warrantless surveillance regime. While Guantánamo interrogators and homeland defenders nibbled at the edges of the signal-in-the-noise dilemma, the NSA set off on a new course. And the agency’s terror hunters put Poindexter’s creation through an ordeal of size and strain that not even he could have devised.

  Behind the blackout curtain that enveloped Fort Meade, the TIA tools were used on the massive flow of data that the NSA was now receiving from U.S. telecommunications companies—that stream of metadata that included phone numbers called, length of calls, the “To” and “From” lines of e-mails. There had never been a noisier ocean that demanded such
immediate, careful attention.

  The BAG was failing. The constant hair balls aggravated analysts, and technicians started to doubt whether or not graphs were really up to the challenge. Though its proponents within the agency—and there were many—saw graphing analysis as the new wave, others knew the awful truth. The NSA was churning out charts and diagrams, but it still hadn’t created the early-warning system that Hayden had envisioned. It had still not achieved total information awareness.

  When the time came to put Poindexter’s tools to the test, the NSA was disappointed again. The TIA tools crashed. They were simply incapable of processing so much information in real time. Like balloons affixed to a fire hydrant, they burst.

  Technologists liked to say that the TIA tools were “brittle,” that they weren’t ready for prime time. And certainly that was true. But for present puposes, that didn’t solve the NSA’s problem. They’d have to tack a new course.

  Yet, all was not lost from the TIA experiment. Poindexter had hit the nerve. What the NSA techies knew, what anyone who watched what he was up to in his workshop knew, was that Poindexter had just broken through a wall. He had dared to suggest, and then envision, that the government could tap into information at its source, that it could find signals in noise the moment they were created. Poindexter had articulated a data philosophy. He was H. G. Wells and Albert Einstein in one package. The imaginer and the creator. Fiction become reality.

  In the months and years to come this glimpse of the future, of what was possible in spite of overwhelming odds, would become Poindexter’s legacy. More than any tool, clever experiment, or acronym, his ambition became a beacon. It called to others, and it drove them.

  It was time for a break. Summer was descending upon Washington, and Poindexter was looking forward to getting out of town. He wanted to talk up TIA to a wider audience. The Highlands Forum in Carmel Valley, California, seemed the perfect place.