The Secret Sentry

by Matthew M. Aid

  The War on Terrorism

  During General Minihan’s term, the radical Islamic terrorist group al Qaeda (Arabic for “the base”) began appearing on the U.S. intelligence community’s radar screen. It was headed by a Saudi multimillionaire and veteran of the 1980s war against the Soviets in Afghanistan named Osama bin Laden, who was then living in exile in the Sudan. The earliest known NSA reporting on bin Laden’s activities dates back to 1995 and was based in large part on monitoring the telephone calls coming in and out of his ranch near the Sudanese capital of Khartoum. For example, the agency intercepted a series of telephone calls congratulating bin Laden on the June 25, 1996, bombing of the Khobar Towers in Dhahran, Saudi Arabia, which killed nineteen American military personnel. (In fact, it was Hezbollah and the Iranian government, not al Qaeda, that had carried out the Khobar Towers attack.)64

  Despite these successes, NSA was experiencing considerable difficulty monitoring bin Laden. But when he was forced out of the Sudan in mid-1996 by the Sudanese government and moved to Afghanistan, it made SIGINT coverage of his activities significantly easier.65

  In November 1996, one of bin Laden’s operatives in the United States, named Ziyad Khalil, purchased a Inmarsat Compact M satellite telephone and more than three thousand hours of prepaid satellite time from a company in Deer Park, New York, for seventy-five hundred dollars. In a matter of weeks, the sat phone was in the hands of bin Laden in Afghanistan. It was assigned the international telephone number 00873-682-505-331.66 When NSA was unable to intercept all of the satellite phone traffic, the CIA mounted its own in-de pendent SIGINT collection operation. The CIA managed to intercept half of the traffic, and NSA succeeded in getting the rest, but refused to share its take with the CIA.67

  Over the next two years, NSA’s relationship with the CIA deteriorated as officials from the two agencies clashed repeatedly and refused to cooperate with one another on joint SIGINT operations against al Qaeda. During this period, NSA and the CIA in dependently monitored the telephone conversations of bin Laden and his military operations chief, Mohammed Atef, as they kept in touch with their operatives and sympathizers around the world. Some of these intercepts helped foil a number of bin Laden terrorist plots, including two terrorist attacks on American embassies overseas in 1997 and seven attacks on American diplomatic or military establishments overseas in 1998, among them a planned bombing aimed at American forces stationed at Prince Sultan Air Base, in Saudi Arabia, and the hijacking of an American airliner.68

  Up until this point, NSA’s efforts to monitor bin Laden’s activities had been underresourced and desultory. But on August 7, 1998, this changed when al Qaeda operatives bombed the American embassies in Nairobi, Kenya, and Dar es Salaam, Tanzania, killing 224 people (12 of whom were Americans) and injuring thousands more. Overnight, bin Laden became the agency’s number-one target. Unfortunately, news reports after the East Africa bombings revealed that NSA was listening to bin Laden’s phone conversations. Two months later, in October 1998, bin Laden ceased using the satellite telephone, depriving NSA and the CIA of their best source of information about what bin Laden and his cohorts were up to.69

  The Hayden Era at NSA

  On February 23, 1999, the Pentagon announced that NSA director Minihan’s replacement was to be Major General Michael Hayden of the U.S. Air Force, who was then serving in Seoul as the deputy chief of staff of the United Nations Command and U.S. Forces in Korea. Hayden, age fifty-two, was a veteran intelligence officer who had held a wide variety of high-level intelligence and policy positions over a thirty-two-year career prior to being named NSA director. These included involvement managing intelligence collection operations in the former Yugo slavia during the mid-1990s war in Bosnia, and commanding the Air Intelligence Agency from January 1996 to September 1997. Hayden pinned on his third star and then arrived for his first day of work at Fort Meade on March 26, 1999.70

  Genial but unprepossessing, Hayden was described by journalist Bob Woodward as “short and balding, with a big head and large-framed eyeglasses— definitely not out of central casting for a TV talk show or a general.” But Hayden’s qualities had nothing to do with his looks. His subordinates had to learn to pace themselves for the long, grueling days that he put in at the office. He had a reputation for being thoughtful, honest, and forthright and was well known within the U.S. military establishment for his low-key management style and, perhaps more important, his ability to get along with people with temperaments and personalities different from his own. Hayden had just taken over when the United States plunged into another war in the former Yugoslavia, a territory that he knew all too well from his involvement in the mid-1990s conflict. This time, the war was over yet another rebellious Yugoslav province that was seeking its independence—Kosovo.

  SIGINT and the War in Kosovo

  The three-month war in the Yugoslav province of Kosovo, which lasted from March 24, 1999, to June 10, 1999, pitted the overwhelming might of the combined military forces of the United States and NATO against Slobodan Milos?e-vic ´’s overmatched Yugoslavian military. After talks held in Rambouillet, France, to try to negotiate a peaceful settlement of the Kosovo crisis resulted in stalemate, the decision was made to wage a unique kind of war, one conducted from the air only. On March 24, U.S. and NATO warplanes began bombing Yu-go slav military positions in Kosovo and throughout Yugoslavia to force the Belgrade government to accept the terms of the Rambouillet Accord. The name given to the U.S. and NATO bombing campaign was Operation Allied Force. Most of NSA’s SIGINT effort was focused on collecting as much intelligence as possible about the Yugoslav strategic command-and-control network and air defense system to help the U.S. and allied warplanes win air superiority.

  All in all, postwar reporting indicated that NSA performed well during the war, with more than 300,000 Yugoslav telephone calls, 150,000 e-mail messages, and over 2,000 fax messages being intercepted, covering Yugoslav troop movements, force status reports, logistics updates, hospital duty logs, and more. It was a very impressive performance for a three-month conflict, made all the more remarkable by the fact that literally no American soldiers were killed in action. 71

  The 100 Days of Change

  Hayden entered the Fort Meade complex in March 1999 determined to make his mark quickly on the agency he had inherited. He flew down to Austin to meet with former NSA director Bobby Ray Inman, who was now teaching at the University of Texas. Inman advised Hayden that the biggest challenge he would face running NSA was obstruction from NSA’s senior civilian officials, which Inman had encountered when he ran the agency during the 1970s.72

  Hayden flew back to Fort Meade and found on his desk a thick report prepared for his predecessor, Minihan, by the NSA Scientific Advisory Board, chaired by retired lieutenant general James Clapper Jr. The Clapper report confirmed many of the findings of the House and Senate intelligence committees, including the conclusions that because the agency did not have a business plan, it was mismanaging its SIGINT collection assets, and that the agency research and development efforts “lacked focus and innovation.” A second report from Clapper arrived a few months later, which urged Hayden to retool NSA “organization ally, programically, and technologically.” This was followed by an April 9 memo from his director of operations, James Taylor, who told Hayden in no uncertain terms, “The first and most important issue for NSA/CSS is to reform our management and leadership system . . . We have good people in a flawed system.”73

  The Taylor memo was the last straw for Hayden. Clearly his agency was in deeper trouble than he had believed when he took the job, but he needed to know the full extent of the problem. In April 1999, he commissioned two management reviews on the state of NSA; one he assigned to a number of the agency’s reform-minded Young Turks, who had chafed at the lack of action under Minihan, while the second report was to be prepared by five outside experts. Both reports, handed to Hayden in October, were scathing, with one concluding that NSA had become “an agency mired in bureaucratic confli
ct, suffering from poor leadership and losing touch with the government clients it serves.” Hayden later told reporters, “The agency has got to make some changes because by standing still, we are going to fall behind very quickly.”74

  Hayden’s reformation and modernization plan, “100 Days of Change,” hit NSA like a tidal wave on November 10 with an announcement to the entire NSA that “our Agency must undergo change if we are to remain viable in the future.” Hayden began by streamlining the agency’s labyrinthine management structure, bringing in from the outside a new chief financial officer to try to reform NSA’s financial and accounting practices and a veteran air force intelligence officer, Major General Tiiu Kera, to try to improve NSA’s tense relations with the Pentagon. Overnight, the agency’s top priority became modernization, while its SIGINT mission became the secondary priority. Money was taken from ongoing SIGINT operations and shifted to modernization projects, with particular emphasis on redirecting NSA’s SIGINT effort against what Hayden described as the “digital global network.” The bud get cuts hurt, forcing Hayden to tell his worried employees in January 2000, “I realize the business areas that we decide to disengage from to pay for this transformation will be very important to many of you. I ask you to trust yourselves and your management on the tough calls we must make this winter to survive and prosper as an Agency.”75

  Hayden and his senior managers had hoped that they could keep the massive reengineering of NSA out of the public realm. But these hopes were dashed when, on December 6, reporter Seymour Hersh published an article in the New Yorker magazine that blew the lid off NSA’s secret, revealing that America’s largest intelligence agency was having trouble performing its mission.76Hersh’s article set off a furious debate within NSA about the difficulties the agency was facing. The considered judgment of many NSA insiders was in many respects harsher and more critical than anything Hersh had written. Diane Mezzanotte, then a staff officer in NSA’s Office of Corporate Relations, wrote, “NSA is facing a serious survival problem, brought about by the widespread use of emerging communications technologies and public encryption keys, draconian budget cuts, and an increasingly negative public perception of NSA and its SIGINT operations.” 77

  Less than sixty days later, another disaster hit the agency. During the week of January 23, 2000, the main SIGINT processing computer at NSA collapsed and for four days could not be restarted because of a critical software anomaly. The result was an intelligence blackout, with no intelligence reporting coming out of Fort Meade for more than seventy-two hours. A declassified NSA report notes, “As one result, the President’s Daily Briefing—60% of which is normally based on SIGINT— was reduced to a small portion of its typical size.”78

  The Switchboard

  Located on the strategically important southwestern tip of the Arabian Peninsula, Yemen is one of the poorest and least developed nations in the world. Although the Yemeni government is dedicated to modernizing the nation, the deeply religious Yemeni people remain firmly rooted in the past. For centuries, Dhamar Province, a mountainous region south of Yemen’s capital, Sana’a, has been the home of the warlike and rebellious al-Hada tribe. One of its most prominent members was a man named Ahmed Mohammed Ali al-Hada.79

  Fiercely devoted to the ultraconservative Salafi interpretation of the Koran, al-Hada was steadfastly and vocally opposed to any form of Western influence or presence in the Arab world. Yemeni security officials confirm that al-Hada fought with the mujahideen against the Soviet military in Afghanistan during the 1980s, returning to Yemen in the early 1990s a fully committed jihadi and a member of Osama bin Laden’s newly created al Qaeda organization. Both of al-Hada’s daughters married al Qaeda operatives. One daughter was married to a senior operative named Mustafa Abdulqader al-Ansari. The other, Hoda, was married to a Saudi named Khalid al-Mihdhar, who on 9/11 would lead the al Qaeda team that crashed a Boeing 757 airliner into the Pentagon.80

  Al-Hada’s principal function within al Qaeda since 1996 had been to serve as a secret communications cutout between bin Laden and his military operations chief, Mohammed Atef, and the organization’s operatives around the world. Bin Laden and Atef would call al-Hada’s house in Sana’a and give him orders that he was to convey telephonically to al Qaeda’s operatives in Europe, Asia, and Africa, and al-Hada would relay back to bin Laden and Atef in Afghanistan the reports he got from the field. Records of bin Laden’s satellite phone calls from Afghanistan show that he called al-Hada in Sana’a at least 221 times between May 1996 and the time that the Saudi terrorist leader stopped using his phone in October 1998.81

  U.S. intelligence first learned about al-Hada and his telephone number from one of the captured al Qaeda planners of the August 1998 East Africa bombings, a Saudi national named Mohamed Rashed Daoud al-’Owhali, who was arrested by Kenyan authorities on August 12, 1998, five days after the bombing of the U.S. embassy in Nairobi. Interrogated by a team of FBI agents, al-’Owhali gave up the key relay number (011-967-1-200-578)—the telephone number of Ahmed al-Hada.82

  NSA immediately began intercepting al-Hada’s telephone calls. This fortuitous break could not have come at a better time for the U.S. intelligence community, since NSA had just lost its access to bin Laden’s satellite phone traffic. For the next three years, the telephone calls coming in and out of the al-Hada house in Sana’a were the intelligence community’s principal window into what bin Laden and al Qaeda were up to. The importance of the intercepted al-Hada telephone calls remains today a highly classified secret within the intelligence community, which continues to insist that al-Hada be referred to only as a “suspected terrorist facility in the Middle East” in declassified reports regarding the 9/11 intelligence disaster.83

  In January 1999, NSA intercepted a series of phone calls to the al-Hada house. (The agency later identified Pakistan as their point of origin.) NSA analysts found only one item of intelligence interest in the transcripts of these calls— references to a number of individuals believed to be al Qaeda operatives, one of whom was a man named Nawaf al-Hazmi. NSA did not issue any intelligence reports concerning the contents of these intercepts because al-Hazmi and the other individuals mentioned in the intercept were not known to NSA’s analysts at the time. Almost three years later, al-Hazmi was one of the 9/11 hijackers who helped crash the Boeing airliner into the Pentagon. That al-Hazmi succeeded in getting into the United States using his real name after being prominently mentioned in an intercepted telephone call with a known al Qaeda operative is but one of several huge mistakes made by the U.S. intelligence community that investigators learned about only after 9/11.84

  During the summer of 1999, intercepts of Ahmed al-Hada’s telephone calls generated reams of actionable intelligence. In June, the State Department temporarily closed six American embassies in Africa after intercepted calls coming in and out of al-Hada’s house revealed that al Qaeda operatives were in the final stages of preparing an attack on an unidentified American embassy in Africa. By early July, intercepted al Qaeda communications traffic had revealed that bin Laden operatives were preparing another operation, this time in Western Eu rope. Two weeks later, more intercepted calls coming from al-Hada’s house indicated that bin Laden was planning to hit a major American “target of op-portunity” in Albania. As a result, planned trips to Albania by Secretary of State Madeleine Albright and Secretary of Defense William Cohen were hastily canceled.85

  On a now-ominous note, during that summer intercepted telephone calls coming into al-Hada’s home mentioned for the first time a man referred to only as “Khaled.” No doubt this was a reference to 9/11 hijacker Khalid al-Mihdhar, who at the time was living in al-Hada’s home along with his wife, Hoda. Because this was the first mention of “Khaled” in an al Qaeda intercept, NSA did not report the information, as it could not be determined from the intercept who he was, much less whether he was an al Qaeda operative. After 9/11, investigators learned that a few months after this call, al-Mihdhar caught a flight from Sana’a to Islamabad, Pa
kistan, then crossed the border into Af-ghanistan to undergo a special terrorist training course at al Qaeda’s Mes Ay-nak training camp, which was located in an abandoned Russian copper mine outside Kabul. Al-Mihdhar completed the training course and returned to Yemen via Pakistan in early December 1999.86

  In December 1999, NSA intercepted another series of telephone calls to al-Hada’s home in Sana’a, which revealed that an “operational cadre” of al Qaeda operatives intended to travel to Kuala Lumpur, Malaysia, in early January 2000. The transcript of the intercepted call identified only the first names of the team—“Nawaf,” “Salem,” and “Khalid.” Based on the context and wording of the conversation, NSA analysts concluded that “Salem” was most likely the younger brother of “Nawaf,” which, as it turned out, was correct. “Salem” was a Saudi national named Salem al-Hazmi, who was the younger brother of Nawaf al-Hazmi. A CIA analyst who reviewed the transcript and accompanying NSA intelligence report surmised that “something more nefarious [was] afoot but did nothing further with the report.”87

  On January 15, 2000, two of the 9/11 hijackers mentioned in the NSA intercept, Khalid al-Mihdhar and Nawaf al-Hazmi, flew into Los Angeles International Airport from Bangkok. Both men used their Saudi passports and visas, issued in their names by the U.S. consulate in Jidda. They spent the next two weeks holed up in an apartment in Culver City, outside Los Angeles, before renting an apartment at 6401 Mount Ada Road in San Diego.88

  Two months later, on March 20, NSA intercepted a telephone call to al-Hada’s house from a man who identified himself only as “Khaled.” Unfortunately, because of the technology in use at the time, the agency did not know that the call it was monitoring had originated in the United States. NSA reported some of the contents of the intercepted call, but not all of the details, because the agency’s analysts did not think that it was terrorist related. It was not until after the 9/11 attacks that the FBI pulled al-Mihdhar’s telephone toll records and confirmed that the anonymous “Khaled” was none other than al-Mihdhar, who was calling his father-in-law from his apartment in San Diego. A 2002 congressional report found that NSA’s inability to identify the location of the caller was to prove disastrous because it would have confirmed “the fact that the communications were between individuals in the United States and suspected terrorist facilities overseas.”89