Hezbollah

by Levitt, Matthew

  Lights Blinking Red

  On November 13, 1995, Sunni extremists detonated a car bomb filled with 250 pounds of explosives in the parking lot outside the headquarters of the Saudi Arabian National Guard training support mission (OPM-SANG) in Riyadh. Five Americans and two Saudis were killed in the attack, which left two craters about thirty-nine feet from the front of the building.66 The perpetrators of that attack would claim inspiration from a little-known Saudi extremist named Osama bin Laden, and bin Laden himself would later sing their praises.67 Just weeks after the OPM-SANG bombing, the State Department issued a travel advisory urging Americans in Saudi Arabia to be cautious. “Unconfirmed information,” it read, suggested that “additional bombings may be planned against western interests in Saudi Arabia, including facilities and commercial centers occupied and/or frequented by Americans.” Attacks, the advisory continued, “could occur anywhere in the kingdom.”68 Another warning would be issued two months later, this one “noting that targets in Riyadh are especially at risk.”69

  The OPM-SANG bombing was not the first attack targeting US interests in the kingdom, but it was a watershed event. The terrorist threat in Saudi Arabia preceding the attack, as reflected in a later evaluation led by Gen. Wayne Downing, was benign until fall 1994. The only exceptions were three “isolated incidents” during Operation Desert Storm and the hijacking of a Saudi Airlines airbus in 1994.70 As it happened, these isolated incidents began just a month after one Saudi Shia group called for the uprooting of US forces from Saudi Arabia.71 On February 3, 1991, a US transport bus was doused in kerosene, and at about the same time, shots were fired at another US military bus. The following month, several shots were fired at a US Marine vehicle. Then, in 1994, the Downing Report found, “the volume and tone of reporting on potential terrorist threats became more ominous.”72

  Following the OPM-SANG bombing, the threat condition for US forces in Saudi Arabia was raised one notch from THREATCON ALPHA—the second lowest—to THREATCON BRAVO, and security was enhanced at all installations with an American presence throughout Saudi Arabia. At Khobar Towers, the security fence was repaired and upgraded for the first time since US forces occupied the complex in 1990.73 Requests to extend the perimeter of the complex 100 to 150 feet away from the buildings located right along the fence were denied by Saudi authorities. The Saudis also denied requests to trim vegetation along the perimeter to allow for better observation of the perimeter, citing the need for vegetation to prevent local Saudis from observing Americans’ activities within the compound. A US civil engineering team trimmed the vegetation anyway, though military commanders would later be taken to task for being too cautious in their requests for support from the Saudis due to cultural sensitivities.74 General Schwalier issued several Battle Staff Directives focused on improving security for the 4404th Wing at Khobar, including physical barriers, serpentine driving control patterns at checkpoints, and more.75

  Sometime in spring 1996, US military and intelligence officials began to notice suspicious activities around Khobar Towers. From April to June 1996, officials noted ten events, including incidents of Arab men watching, photographing, or hiding near the compound’s perimeter fence. In one case an Arab male accosted a British airman driving to Khobar Towers, and in three other cases vehicles spun their tires in the north parking lot. There was also an unconfirmed report of a sniper attack aimed at a Frenchman within the compound. These cases were investigated and in most cases determined to be unrelated to terrorist activity. For example, officials concluded the photographs may have been taken by visitors to Dhahran during the Hajj pilgrimage who were curious about Americans. “The most serious incident,” one government report concluded, involved a car moving one of the Jersey barriers on the compound’s eastern perimeter in May 1996. In what may have been an effort to test the compound’s perimeter and base security, the car slowly approached a row of barriers and hit one barrier at four to six miles per hour, moving the barrier two to three feet. The car then backed up and drove away.76

  The following month, the June 17 issue of the Defense Intelligence Agency’s (DIA) Military Intelligence Digest summarized these incidents based on information provided by investigators from the Air Force Office of Special Investigations (AFOSI). AFOSI, Saudi military, and local police all investigated these incidents and determined no attack on Khobar Towers was imminent. Still, the DIA report indicated “an increased threat of a terrorist attack at Khobar Towers.”77 By this point the Hezbollah cell members were nearly ready to strike. Eight days later, they did.

  But in the days and weeks following the 1995 OPM-SANG bombing, threat assessments focused on the likelihood of further attacks in the Saudi capital employing an explosive device of about the same size. “Everyone assumed … there would be another bombing,” the US Consul General in Dhahran noted, but “the focus was Riyadh. No one really thought anything was going to happen in Dhahran.” Nor did anyone suspect terrorists would construct a bomb anywhere near as large as the one used in Khobar Towers. According to the chief of the National Intelligence Support Team in Riyadh, the threat, he and others assumed, would be an explosive of “maybe 500 pounds but … we never went above 1,000 pounds” when assessing the potential threat. The assumption, therefore, was that the base must be defended against “an OPM/SANG type bomb,” as one AFOSI officer put it.78

  And while tactical intelligence on the date, time, place, and type of attack were lacking, the air force investigation into the Khobar Towers bombing ultimately determined that “a considerable body of information was available that indicated terrorists had the capability and intention to target US interests in Saudi Arabia, and the Khobar Towers was a potential target.”79 In fact, in March 1996, a senior intelligence official briefed General Schwalier on the “increasing amount of circumstantial information indicating that some terrorist activity could occur during and immediately after the Hajj….” The following month, an air force assessment concluded that “security measures here [at Khobar] are outstanding, which in my view would lead a would-be terrorist to attempt an attack from a position outside the perimeter…. If a truck parks close to the fence line, and the driver makes a quick getaway, I think the building should be cleared immediately.”80

  Hezbollah Surveillance Operations, under the Radar

  The fact that red lights started blinking only in 1994 and that an attack on US personnel in Saudi Arabia was deemed unlikely until 1995 is startling, given that Hezbollah operatives had been engaging in surveillance operations for the Khobar Towers plot around 1993. It was that year, the FBI concluded, that Ahmed al-Mughassil instructed Mustafa al-Qassab, Ibrahim al-Yacoub, and Ali al-Houri to start surveillance of Americans in Saudi Arabia. Al-Qassab and al-Yacoub then spent three months in Riyadh, where Hani al-Sayegh joined them, and conducted surveillance of American targets. Their surveillance reports were passed on first to Saudi Hezbollah military chief al-Mughassil, and then to the leader of Saudi Hezbollah, Abdel Karim al-Nasser, and then to officials in Iran. When their surveillance mission was done, al-Mughassil met with them in person to review their work. As 1993 wore on, the assignments began to trickle down the Hezbollah chain. Al-Yacoub instructed Abdallah al-Jarash to conduct surveillance of the US embassy in Riyadh and to “determine where Americans went and where they lived.” Also at al-Yacoub’s direction, al-Jarash and Ali al-Marhoun conducted surveillance of a fish market frequented by Americans, also located near the US embassy in Riyadh, and reported back to al-Yacoub with the results.81

  It was not long before Hezbollah expanded its surveillance operations beyond Riyadh. In early 1994, al-Qassab initiated surveillance of American and other foreign sites in the Eastern Province of Saudi Arabia and provided his written reports to al-Nasser and Iranian officials. Al-Mughassil called for further surveillance of American sites in the Eastern Province, which was carried out around fall 1994 by al-Marhoun, Saleh Ramadan, and Mustafa al-Mu’alem. Their reports were passed on to al-Mughassil in Beirut. Around the same time, an Ira
nian military officer directed Saed al-Bahar to conduct parallel surveillance activities in Saudi Arabia, which al-Bahar did. Finally, in late 1994 after extensive surveillance in the Eastern Province of Saudi Arabia, several Saudi Hezbollah operatives specifically identified Khobar Towers as an important American military location. Informed of this conclusion, al-Mughassil quickly provided funds to Ramadan for the express purpose of finding a place where Hezbollah could store explosives in the Eastern Province.82

  Meanwhile, Iranian officers tasked Saudi Hezbollah cell members with carrying out additional, parallel surveillance in support of future attacks targeting Americans in Saudi Arabia. In 1995, for example, al-Bahar and al-Sayegh conducted surveillance at the direction of an Iranian military officer in the area of Jizan, along the Saudi Red Sea coast near Yemen, and at American sites in the Eastern Province. Hani al-Sayegh, who had spent time in Damascus, where he was issued an international driver’s license in 1994, provided the group’s surveillance reports to the Iranian officer.83

  In about April or May 1995, al-Marhoun underwent four days of live-fire drills sponsored by Hezbollah in Lebanon. While in Lebanon, he visited al-Mughassil’s Beirut apartment. Al-Mughassil provided al-Marhoun $2,000 in hundred-dollar bills to support the Saudi Hezbollah cell’s surveillance activity in Saudi Arabia—money al-Marhoun subsequently used to finance a trip to Riyadh with Saleh Ramadan to scout out additional sites frequented by Americans. Al-Mughassil insisted that they remain focused on Khobar Towers, however, and in June al-Marhoun, Ramadan, and al-Mu’alem began regular surveillance of Khobar. Briefed in Beirut by Ramadan on their successful regular surveillance, al-Mughassil directed them to continue.84

  As it happened, another cell member, Fadel al-Alawe, came to Beirut at al-Mughassil’s request around the same time Ramadan was there. While the two Saudi Hezbollah operatives did not see each other in Beirut, al-Alawe—who thought he was there to brief al-Mughassil on the cell’s surveillance activities—must have been surprised to see surveillance reports from Ramadan on al-Mughassil’s desk. In fact, al-Mughassil had another reason to summon al-Alawe to Beirut. As surveillance of Khobar Towers continued, al-Mughassil now needed to ensure he could smuggle the explosives for the operation from Lebanon, through Jordan, and into Saudi Arabia. It was time for a test run, though al-Alawe would be told it was the real thing. Al-Mughassil instructed al-Alawe to drive a vehicle he claimed contained hidden explosives from Lebanon to Saudi Arabia, which al-Alawe did. Only on his arrival back home did al-Alawe discover al-Mughassil had been testing him.85

  Then, in late fall 1995 and again in late 1995 or early 1996, Ramadan returned to Beirut to confer with al-Mughassil about the planned operation targeting Khobar Towers. During the first of these meetings, Ramadan brought more surveillance reports to al-Mughassil and learned for the first time that Hezbollah would be attacking Khobar Towers with a tanker truck loaded with explosives and gasoline. At the second meeting, al-Mughassil began to lay out the operational roles of different cell members. Al-Mughassil discussed the need to accumulate enough explosives to destroy a row of buildings and noted that “the attack was to serve Iran by driving the Americans out of the Gulf region.”86

  In hindsight, we know that none of the cell’s local surveillance, travel back and forth to Beirut, test drives from Lebanon to Saudi Arabia, or telephone or other communications was noticed by US or Saudi authorities. US intelligence was generally aware of increased Iranian surveillance of US personnel based on classified source reporting, but it lacked the details. In the days after the bombing, US intelligence would significantly underestimate the time it took to hatch the plot, speculating that this “well-executed attack may have been planned for several months.”87

  In all likelihood, what enabled the Saudi Hezbollah cell members to successfully execute these surveillance efforts undetected was their prior training in Lebanon and Iran. But they also enjoyed close oversight and support during the operation from senior Iranian and Lebanese Hezbollah officials. During the cells’ surveillance activities, for example, al-Mughassil told al-Marhoun that he had received a phone call from a high-level Iranian government official inquiring about the progress of their surveillance activity. Later, al-Mughassil would further confide to al-Marhoun that “he had close ties to Iranian officials, who supplied him with money and gave him directions” for Saudi Hezbollah.88 Former FBI director Louis Freeh would later testify about one particular conspirator who ultimately described to investigators the money and passports he received from IRGC officials, as well as their directions on target selection and the training he received and surveillance he conducted at their behest.89

  Meanwhile, al-Mughassil’s presence in Beirut facilitated his close coordination with Imad Mughniyeh’s senior operational planners within Hezbollah’s Islamic Jihad Organization (IJO). According to the CIA, Saudi authorities believed al-Mughassil held a Lebanese and possibly also an Iranian passport at the time of the Khobar attack. Saudi information also suggested he “has strong family ties to Lebanese Hezbollah and has been in contact with the office of the Supreme Leader Khamenei.” According to Jordanian intelligence, as reported by the CIA, an alleged Hizballah leader named Amad Ali Zayb Zahir (whom, the CIA conceded, it could not identify) “stated on 26 June [the day after the bombing] that the bombing was carried out by Saudi Shias with links to Hizballah and Iran.” Leading up to the bombing, the CIA knew of little more than the previous year’s training by the IRGC in Lebanon of Saudi and Bahraini “Shia oppositionists,” as the CIA reports described them.90

  Mughniyeh was also reportedly in contact with Saudi Hezbollah throughout the 1990s through his deputy Talal Hamiyeh.91 Stemming from a powerful Bekaa Valley clan, Hamiyeh is said to have partnered with Mughniyeh in the 1980s during the early days of Hezbollah kidnappings, and even served as point man for negotiating the release of some hostages held in Lebanon.92 Implicated in the 1992 and 1994 Hezbollah bombings in Buenos Aires, he succeeded Mughniyeh as head of Hezbollah’s IJO after the latter’s February 2008 assassination.93

  The Khobar Operation

  Briefed in Beirut on the intelligence his cell collected on Khobar Towers through months of surveillance, al-Mughassil traveled in January or February 1996 to Qatif, not far from Dhahran and Khobar Towers, where he instructed one of his operatives to find places to stockpile and hide their explosives. Sites were apparently identified rather quickly, because sometime around February Ramadan returned to Beirut at al-Mughassil’s direction and drove back to Saudi Arabia in a car stuffed with hidden explosives.94 Though authorities were unaware of this successful smuggling run, they did have indications that terrorists were smuggling explosives. In March, US authorities came by unconfirmed intelligence indicating that “a large quantity of explosives was to be smuggled into Saudi Arabia during the Hajj,” which ran from mid-April to mid-May that year.95 In a briefing they received on April 12, General Schwalier and key members of his staff were told the current threat included reports of “a large quantity of explosives destined for coalition military targets with the potential for use in a bombing attack.” This information, however, was deemed too sensitive to be released down the chain of command, making it largely useless. No changes were made to the existing security posture at the base as a result of this briefing.96

  When he arrived in Qatif, Ramadan delivered the car to an unknown man whose face was veiled.97 Most of the cell members knew one another. This, plus the fact that a Lebanese Hezbollah operative and bomb maker referred to in the US Khobar Towers indictment as John Doe played a key role in constructing the truck bomb, suggests the mysteriously veiled recipient of the explosives delivered from Lebanon may have been the Lebanese Hezbollah bomb maker himself.

  But the following month Hezbollah suffered a serious operational setback. Having passed al-Mughassil’s test run the previous June, al-Alawe was summoned back to Beirut in March 1996 and given the keys to a car stuffed with hidden explosives. Al-Alawe drove the car through Syria and Jordan, arriving at
the al-Haditha crossing point on the Jordanian-Saudi border on March 28. But whereas Ramadan was able to smuggle explosives across the border in his earlier run, al-Alawe was arrested on the spot when Saudi border guards inspecting his car discovered thirty-eight kilograms of plastic explosives expertly hidden within its engine compartment. This in turn led to the arrests over three days in early April of al-Marhoun, al-Mu’alem, and Ramadan.98

  Suddenly, al-Mughassil found himself without his key operatives and facing the prospect that some elements of the operation may be compromised. Undeterred, al-Mughassil quickly found replacements for his four detained operatives and assumed a hands-on role himself to see the operation through.

  Sometime in late April or early May, al-Mughassil returned to Saudi Arabia to personally assemble a new hit squad. Traveling on a false passport and under the cover of a pilgrim on Hajj, he appeared unannounced at Abdallah al-Jarash’s home in Qatif on May 1. Al-Mughassil briefed al-Jarash on the Khobar Towers bomb plot and on the arrests of the four cell members, and asked for his help executing the attack. Al-Mughassil must have assumed al-Jarash would answer in the affirmative, because before leaving he provided al-Jarash with a forged Iranian passport that must have been prepared in advance and told him to “be ready for a call to action at any time.”99

  Assuming the authorities were broadening their investigation after the arrests of his operatives, al-Mughassil again showed up unannounced at another cell member’s home. Three days after visiting al-Jarash, he knocked on Hussein al-Mughis’s door and, after recruiting him to the operation and briefing him on the plan, left him a timing device to hide at his home. At least twice in the months leading up to the Khobar bombing, another Saudi Hezbollah cell member, Ali al-Houri, turned up at al-Mughis’s home seeking help to hide several fifty-kilogram bags and paint cans filled with explosives at sites around Qatif. Then, with just about three weeks to go until the planned attack, al-Mughassil and the unnamed Lebanese Hezbollah operative (John Doe) who arrived to help assemble the bomb moved into al-Mughis’s home in Qatif.100