The Secret Sentry

by Matthew M. Aid

  After the battle, the army and marine units were ordered to withdraw from the city and turn their positions over to units of the ill-equipped and poorly trained Iraqi army and Iraqi national guard. Within a matter of days, cell phone intercepts showed that al-Zarqawi’s foreign fighters and the Sunni insurgents had quickly moved back into Fallujah and had retaken control of the city from the Iraqi forces. Angry marine intelligence officers shared with reporters intercepted telephone calls showing that the insurgents had managed to get through the marine and Iraqi cordon around Fallujah by blending in with the refugees returning to the city. So in the end, the Battle of Fallujah, like Operation Anaconda two years earlier, ended up being nothing more than an illusory and costly victory.45

  They’re Back! The Taliban Resurgence

  In Afghanistan, the U.S. military’s SIGINT effort, although with a fraction of the size of the resources available in Iraq, continued to improve slowly as time went by. But far too often, an intercept that would have enabled a U.S. unit to take out a medium-value target “using his cell phone to coordinate and call in attacks on coalition forces” had to be called off. With unfortunate frequency, a unit found and engaged the enemy but was forced to withdraw without completing its mission because of a lack of personnel. Trying to run this “secondary” war with manifestly insufficient U.S. forces proved to be an exercise in futility.46

  Still, U.S. Army SIGINT units in Afghanistan got better at exploiting the Taliban’s low-level walkie-talkie traffic. A Green Beret officer put it bluntly: The Taliban were “using simple communications methods . . . This is not the Cold War. We’re not using super high-tech stuff to pick up SIGINT and things like that. Once we get on the right frequencies and get a trusted interpreter to translate that for us, it turns out to be a very good tool.”47

  By 2004, most of the major U.S. Army firebases along the fifteen-hundred-mile Afghan-Pakistani border had their own small SIGINT unit, distinguished by the cluster of antennae erupting from the rooftop of the base’s barbed-wire-enclosed operations building. The largest were located just outside Kandahar and at Forward Operating Base Salerno, on the outskirts of the border town of Khowst. And all the Green Beret base camps spread throughout southern Af-ghanistan had small teams of Green Beret and Navy SEAL SIGINT operators providing tactical SIGINT support for Special Forces reconnaissance teams patrolling the region along the Afghan-Pakistani border.48

  When the radio scanners at one of the firebases picked up traffic from the Taliban’s Japanese-made ICOM walkie-talkies (which usually had a range of five miles or less in the rugged terrain), it usually meant that there was a Tal-iban rocket or mortar team somewhere in the vicinity, clinging to a nearby ridgeline to call in the coordinates of its target to nearby gunners.49

  At the army firebase at Shkin, in southeastern Afghanistan, the base’s SIGINT operators became quite adept at catching Taliban gunners preparing for such attacks. Within minutes of the operators’ intercepting the transmissions, artillery fire or air strikes were pummeling the location of the Taliban mortar team. The result was, as an army report notes, that the Taliban was “forced to shift from accurate mortar fire to much less accurate longer range rocket fire from less advantageous firing positions across the border” in Pakistan. 50

  Inside Afghanistan itself, SIGINT was proving to be an increasingly important defensive tool, providing warning of impending Taliban attacks on U.S. Army patrols. Marine Gunnery Sergeant Michael Johnson remembered a helicopter assault during which insurgents were baiting a trap for Afghan forces when they went out on an operation. “We’d intercept communications of their radio communications that they were going to ambush that platoon. Within a minute they had contact.”51

  Beginning in late 2004, U.S. commanders in Afghanistan were gratified to see signs appearing in the battlefield SIGINT they were receiving that some of the Taliban guerrillas operating inside Afghanistan were demoralized and on the run. An anonymous U.S. intelligence officer was quoted as saying, “We actually overheard a Taliban fighter break out into a lament, saying ‘Where are you [Mullah] Omar, why have you forsaken us?’ ”52

  U.S. military commanders launched their own PR offensive, releasing selected intelligence assessments intended to convince the American public that the Taliban in Afghanistan were all but beaten. First came the chairman of the Joint Chiefs of Staff, General Richard Myers, who described the security situation in Afghanistan as “exceptionally good” during a visit to Kabul. In a meeting with American reporters in Kabul in April 2005, the commander of U.S. forces in Afghanistan, Lieutenant General David Barno, confidently predicted that “the Taliban militia would collapse as a viable fighting force over the next several months,” adding that he believed that the Taliban rank and file would accept an amnesty offer from Afghan president Hamid Karzai to lay down their arms and join the Afghan government.53

  But the spin campaign was already backfiring in late March 2005, when Tal-iban guerrilla teams once again began surging across the border from their safe havens in northern Pakistan, but this time in numbers never seen before. In a matter of weeks, the security situation inside Afghanistan deteriorated rapidly. The number of attacks on American military installations and Afghan police posts and government offices in southern Afghanistan rose dramatically, as did the number of civilians killed by the Taliban.54Intelligence analysts confirmed on the basis of SIGINT intercepts that the number of Taliban guerrilla teams operating inside Afghanistan had also risen dramatically in the previous two months. Moreover, intercepts confirmed that two of the Taliban’s best field commanders, Mullah Dadullah and Mullah Brader, had crossed over from Pakistan and were leading large Taliban guerrilla detachments in Kanda-har and Zabul Provinces.55

  By late spring of 2005, large chunks of three important southern Afghan provinces— Kandahar, Uruzgan, and Zabul— were controlled by the Taliban, with the exception of the major cities and a few isolated firebases, which remained in the hands of American forces. When Lieutenant Colonel Don Bolduc’s First Battalion, Third Special Forces Group, arrived in Kandahar in June 2005 to take over the responsibility for garrisoning southern Afghanistan, his men found that the U.S. Army unit that they were replacing had done little to prevent the Taliban from consolidating its hold on these three provinces, preferring instead to focus its operations on clearing the areas around the few remaining army firebases in southern Afghanistan. Between January and July 2005, the Taliban, thanks to this complacency, had been allowed to establish permanent base areas in the provinces. It was also furiously reinforcing its forces in these sanctuaries with new guerrilla units infiltrated in from Pakistan and new levies recruited from among sympathetic local tribesmen.56

  The situation in Zabul Province was particularly grim. A longtime Taliban stronghold, Zabul was so hostile that some American troops referred to it as “Talibanland.” Others called it the “Fallujah of Afghanistan,” a reference to the Iraqi insurgent stronghold in al-Anbar Province. Patrols from the 173rd Airborne Brigade operating in Zabul were repeatedly attacked by groups of as many as 100 to 150 Taliban fighters. Over and over again, army SIGINT personnel accompanying the 173rd Airborne’s patrols picked up heavy volumes of Taliban walkie-talkie traffic closely monitoring their movements and coordinating attacks on their positions. The Taliban suffered heavy casualties, but it was clear that the province had become a far more dangerous place than it had been after the U.S. invasion in 2001.57

  But no matter how good the SIGINT was, U.S. forces could clear but not hold the ground they took. Take, for example, what happened after a three-day running battle in August 2005 in the Mari Ghar region in the heart of Zabul Province, which pitted more than two hundred Taliban guerrillas against a twelve-man Green Beret team from the First Battalion, Third Special Forces Group commanded by Captain Brandon Griffin, and a sixteen-man detachment of Afghan army troops. When the battle was over, Captain Griffin’s team had killed sixty-five guerrillas, losing only one man in return. But no ground had been gained during the
battle. Despite three days of near-continuous running battles with the Taliban, Griffin’s team had been forced to leave the Mari Ghar region in the hands of the Taliban. It was the same old story— the U.S. Army just had too few troops in Afghanistan to hold anything more than the string of firebases that it occupied throughout the country.58

  Even worse, tactical SIGINT also showed that the Taliban had morphed from a motley group of insurgents into a heavily armed and well-led guerrilla force, which proved to be insurgents and foreign fighters who, according to a U.S. commander, “were resolute. They stood and fought.”59

  The Surge

  Following the Battle of Fallujah in November 2004, the security situation in Iraq continued to deteriorate rapidly as the level of sectarian violence between the country’s Sunni and Shi’ite militias steadily mounted and insurgent attacks on U.S. forces shot up. In this savage and unforgiving environment, SIGINT became increasingly vital to U.S. military commanders as the Iraqi insurgents dried up intelligence by closing down (i.e., killing) most of the U.S. military’s HUMINT sources. By 2005, SIGINT had once again supplanted HUMINT as the principal source of intelligence for the United States. A postmortem re-port on the U.S. Army Third Corps’s tour of duty in Iraq had this to say about SIGINT’s effectiveness:

  Our SIGINT collection was the most spectacular intelligence discipline on the battlefield, as we were able to collect on many targets cued by other intelligence disciplines. Trusted and useful, SIGINT provided an abundance of intelligence on insurgent networks, named persons of interest, and enemy operations. SIGINT is a critical area where continued development of linguists, not only in skill but in numbers, must occur.60

  Army and marine commanders in Iraq found that SIGINT by itself was only moderately effective at the street level. But when combined with reasonably effective tactical HUMINT gathering, its value soared dramatically. Colonel Emmett Schaill, the deputy commander of the army’s First Brigade, Twenty-fifth Infantry Division, which operated in Mosul, in northern Iraq, from September 2004 to June 2005, recalled that SIGINT and unmanned drones played an important supporting role in finding Iraqi insurgents in his sector, but were less important than the HUMINT assets that his brigade developed during its tour in Iraq. Leveraging the intelligence he collected with information from national intelligence agencies like the CIA and NSA, by the end of his tour Schaill was able to lead his brigade to destroy 80 percent of Abu Musab al-Zarqawi’s al Qaeda cells in northern Iraq, a fact confirmed by SIGINT intercepts of al Qaeda cell phone traffic.61

  Even after Schaill’s brigade left Mosul and returned home, SIGINT continued to produce valuable intelligence that, working in conjunction with HUMINT and unmanned drones, resulted in heavy insurgent casualties. On August 12, 2005, SIGINT intercepts led U.S. Army Special Forces to an al Qaeda in Iraq hideout outside Mosul. When the firefight was over, three senior al Qaeda in Iraq leaders were dead, including the commander of al Qaeda in Iraq forces in Mosul, Abu Zubayr (aka Mohammed Sultan Saleh), who was killed while wearing a suicide vest packed with explosives.62

  But SIGINT is an inexact science, especially against an enemy that knows that its communications are almost certainly being monitored. This has meant that American intelligence analysts in Iraq have often not been able to exploit the intercepts they get. Take, for example, a typical “cordon and search” operation launched by a company of U.S. Marines and a battalion of the Iraqi army on June 29, 2005, near the town of Saqlawiyah, an insurgent stronghold in al-Anbar Province. The goal of the operation was to surround the town and conduct a door-to-door search of all houses in certain neighborhoods looking for weapons and insurgents. An army report on the operation recounts, “During the search, a [marine] radio battalion reported picking up insurgent radio traffic that identified individuals by name. The suspected insurgents were instructed to remain in their hideout.”

  The problem was that the cell phone call that the marines had intercepted did not identify who the insurgents were other than by their first names. Those unfortunates who had those first names were detained—and then released for lack of evidence.63

  U.S. intelligence officials now candidly admit that the turning point of the war in Iraq occurred in February 2006, when Sunni insurgents bombed a mosque in the city of Samarra, which was one of the holiest shrines for Iraqi Shi’ites. The Samarra bombing unleashed a wave of sectarian fighting that led to unprecedented slaughter in Iraq. All of the progress in winning the “hearts and minds” of Iraqis was swept away, and the carnage dominated the nightly news in the United States. This outburst of violence came at a time when HUMINT in Iraq was, in the words of a commentator, “fairly scarce and usually unreliable.” The U.S. military had to depend on SIGINT to help it combat this rising tide of violence. 64

  A February 2006 report notes that an army SIGINT platoon located south of Baghdad was “working miracles and helping us put lots of insurgents into Abu Ghurayb [sic] prison.”65In July, intelligence generated by the SIGINT platoon assigned to the 506th Regimental Combat Team led to the capture of four of the top ten Iraqi Shi’ite insurgents known to be operating in the unit’s area of operations. The commander of the small and overworked team reported that his platoon “continues to exploit and unravel insurgent networks in Eastern Baghdad which is saving American and Iraqi lives every day.”66

  But arguably, SIGINT’s greatest single success in Iraq occurred on the eve-ning of June 7, 2006, when al Qaeda in Iraq leader al-Zarqawi and five others were killed by an air strike conducted by two U.S. Air Force F-16 fighter-bombers on al-Zarqawi’s safe house five miles north of the city of Baquba. The U.S. military, in celebrating this success, may have gone too far— it revealed and compromised the means used to track al-Zarqawi down, a combination of SIGINT (cell phone interception), HUMINT, and imagery collected by unmanned reconnaissance drones. SIGINT tracked the movements of al-Zarqawi’s spiritual adviser, Sheikh Abd al-Rahman, by tapping his cell phone and tracing his movements. HUMINT found the safe house where al-Zarqawi was hiding. And imagery intelligence determined with pinpoint accuracy the coordinates of the house, which was struck by laser-guided bombs dropped by the F-16s.67

  But as of the end of 2006, SIGINT had “won battles,” a now-retired senior Marine Corps officer said, “but it did not get us any closer to winning the war.”68 It was not until spring of 2007, four years after the U.S. invasion of Iraq, that SIGINT finally hit its stride, producing some of the best intelligence then available to U.S. commanders about the identities and locations of Iraqi insurgents. Concurrent with the beginning of the U.S. Army’s “surge” operation in and around Baghdad, SIGINT suddenly became a critically important tool to locate and destroy insurgent cells operating in the Baghdad area and in al-Anbar Province to the west. A large part of the credit for SIGINT’s increasing effectiveness was due to the efforts of navy captain Steve Tucker, who since February had held the position of chief of NSA’s Cryptologic Services Group (CSG) Baghdad, which was situated in the Al-Faw Palace, west of Baghdad. By the time Tucker arrived, CSG Baghdad had ballooned into NSA’s largest overseas liaison organization, consisting of 116 military personnel and NSA civilians in Baghdad and ten locations throughout Iraq. It was responsible for feeding national and tactical-level SIGINT not only to the commander of U.S.

  forces in Iraq, but also to three division headquarters and twelve brigade staffs, as well as to the headquarters of the secretive Combined Joint Special Operations Task Force, which controlled all U.S. military special forces in Iraq.69

  But most of the credit for SIGINT’s increased effectiveness on the battlefield, according to senior U.S. military and intelligence officials, goes to the new commander of U.S. military forces in Iraq, General David Petraeus, who assumed command of U.S. forces in January 2007. According to sources familiar with U.S. intelligence operations in Iraq, Petraeus, who was acutely aware of the vital importance of intelligence, especially SIGINT, in counterinsurgency warfare, went out of his way to understand how the technology worked
, and as a result, made much more effective use of SIGINT against the Iraqi insurgents than his predecessors had.70

  In part, this was due to the introduction of far more effective equipment like a new intercept system called Prophet Triton, which arrived in Iraq in August 2006 and reportedly revolutionized army SIGINT units’ ability to identify and locate the origins of enemy cell phone communications. This system proved to be an extremely valuable intelligence source during the surge counterinsurgency in Baghdad in the summer of 2007.71 Also arriving on the Iraqi battlefield in 2007 were other newly developed SIGINT collection systems—Cellex, DangerMouse, Searchlite, and SIGINT Terminal Guidance, all of which have improved the U.S. Army’s ability to intercept and locate the origins of the cell phone calls of Iraqi insurgents and allied foreign fighters from al Qaeda in Iraq. One of the most advanced of the new systems is an NSA-designed piece of equipment called simply RT-10—but the high-quality intercept intelligence it produces is made available only to selected army and marine commanders and their intelligence staffs.72

  There have also been some significant changes in tactics that have made SIGINT a more effective tool for field commanders in Iraq. For example, small mobile teams of military SIGINT collectors carrying the newly arrived SIGINT gear now routinely accompany army and marine “door kickers” on missions throughout Iraq. The dangerous job of these teams is to locate the nearby hiding places of Iraqi insurgent fighters so that the patrols they are with can find the bad guys as they talk on their phones. Navy SIGINT teams called Joint Expeditionary SIGINT Terminal Response Units (JESTRs) are assigned to the army brigades in Baghdad tasked with working “the streets to find, fix and finish insurgents.” 73

  Another example of a recent positive development has been the successful use of navy SIGINT operators by the elite Navy SEAL team in Iraq, which is permanently based at Camp Dublin, outside Baghdad. The team has its own dedicated Tactical Cryptologic Support team of SIGINT operators, whose job it is to accompany SEAL team members on their combat missions inside Baghdad, protecting them by scanning known enemy frequencies for insurgent threats as well as locating insurgent cell phone emitters so that they can be attacked by the navy special operators.74But the work is highly dangerous. On July 6, 2007, one of these navy SIGINT intercept operators, Petty Officer First Class Steven Daugherty, was killed when an improvised explosion device (IED) exploded under his Humvee during an extraction mission inside Sadr City, the sprawling Shi’ite slum in east Baghdad. Also killed in the blast were two other members of SEAL Team Two.75