The Threat

by Andrew G. McCabe

  The FBI after 9/11 is a different entity from what it was before. There were agents who were working drugs on 9/10, and from the next day forward, for the rest of their careers, worked terrorism. I went back to my organized-crime squad, where we all expected that any day someone would walk in and say, Okay, C-24 is now Eurasian Terrorism. That didn’t happen, but terrorism changed the way we thought even about crime. The old tribal structure of the Bureau—criminal versus counterterrorism, knuckle-draggers versus pinheads—was blown away. Now we were all in it together.

  In the summer of 2006 I moved out of organized crime and into counterterrorism. My first case was the London airliner plot. A bunch of young terrorists had learned how to make bombs out of easily available household products. The airliner plot is the reason why, today, when you get on an airplane, all your liquids, aerosols, gels, creams, and pastes have to fit inside a quart-sized plastic bag. The key word for understanding this case—its plain facts and its larger significance—is “components.”

  The terrorists had devised a way to break down the components of explosive devices so that they could elude detection at airports by airport security and then reassemble the devices once an airliner was aloft. My unit and I gathered intelligence from the British investigation and tried to determine if any Americans were involved. Coordinating the various services—the FBI and CIA; British intelligence; and others—required learning how to share information seamlessly. This case also brought me face-to-face for the first time with the man who succeeded Louis Freeh as FBI director, Robert Mueller.

  Over the next twelve years I would be fortunate to have a great deal of interaction with Mueller. He is not—and I think he would admit this, probably while feigning slight resistance for comic effect—Mr. Casual. He is not a charming communicator, the way Jim Comey can be. Mueller was a Marine lieutenant commanding a platoon in Vietnam. He achieves change through force of will. It was not a relaxing experience for me to be told, You’re going to brief the director twice a day on this case, every day at 7 A.M. and 5 P.M. Mueller was also a prosecutor. He cross-examines you every time you’re in front of him. Ball-busting is his way of expressing affection. If he said, Where does a person even find a tie like that? I knew things were fine: He never went out of his way to insult anyone he didn’t actually like. He had strict habits and boundaries. Dress: blue suit, white shirt, red tie. His idea of relaxed attire was losing the jacket and wearing a V-neck sweater over the shirt and tie. Later, when I traveled with him, Mueller’s most senior assistant said, The first rule is, Don’t be late—if you’re late, you will be left behind. Another rule was, Don’t talk to him during the flight. He’s reading and studying. If he has questions, he will get up from his seat and come back to speak with you. No matter where we were, no matter what was happening, when the day was done, he always went straight to his hotel room. Never stayed up late in the bar with the rest of us or invited people up to his room, the way Louis Freeh had when I traveled with him.

  When I moved over to counterterrorism, it marked a permanent change in how I lived my life. Working in counterterrorism means approaching every holiday with an overwhelming sense of dread. Christmas is the Christmas Threat. New Year’s Eve is Times Square. There is not a single joyous holiday occasion that doesn’t have an undercurrent of Are we positioned correctly? Did we give the field the correct guidance? What do we know about the one hundred suspects we think are the closest to doing something violent? Work in counterterrorism means you’re always at an elevated state of alert, and all personal plans, no matter how important, are subject to change. On the way to my dad’s sixty-fifth birthday party, I got a call about a break in the airliner plot. I flew back to D.C. and went straight to the office. I regret having missed family celebrations like that and other parts of normal everyday life—but the choice was clear.

  Operation Overt

  Thursday, August 10, 2006. At Heathrow, lights are off. Doors are locked. At every other airport where flights to Heathrow were scheduled to leave from—JFK, Reagan, de Gaulle, Dublin, Schiphol, Frankfurt, and more—departure terminals are mobbed. Security lines are thousands of people long. The lines don’t move. Today, nobody gets through. Traffic outside is backed up. People are bailing out of cars a mile away, trudging toward the terminal, and dragging suitcases behind them, streaming like crowds of refugees along the shoulders of highways.

  On this day I woke at 4 A.M. and drove to work alone, on the toll road, listening to the radio. News reports described the bedlam at the airports. Three words drifted through my mind—We did this. I was connected to this chaos. My office was the place where, when we gave the word—because of something we had learned—the global transportation system went haywire. I could see the sprawling interconnectedness of what I would be doing at my desk today. I would be dealing with the consequences of an ongoing investigation into a plot to take down commercial airliners with ingeniously devised homemade bombs. Unexpectedly, an arrest had just been made, meaning that the terrorists would soon know we were onto them and maybe would launch their attack. So an alert had gone out to airline-security personnel worldwide—with results I was listening to on the radio.

  The job of working counterterrorism is to prevent acts of terror. To protect people from an ambush out of nowhere. Stop them from getting hurt or killed. Foil plans of attack meant to pitch the world into a black hole of anxiety and fear. All of which can prompt, at times, a feeling of propulsion and even exhilaration, something that people in counterterrorism rarely discuss but would have to acknowledge. The intense, even addictive, feeling of priority. The sense of necessity built into the job. Necessity not just to your government but to other governments and to everyone you are responsible for protecting. Those feelings are validating—validating of the call that, in the first place, draws practically every agent to the Bureau, every officer to law enforcement.

  I parked my car at Liberty Crossing 1. LX-1 is an intelligence facility on a little piece of land in McLean, Virginia. Onion layers of normality and strangeness make up the culture of this place, and it shows in the design. On the outside, LX-1 looks like a typical four-story office complex, modern and nondescript, its footprint in the shape of an X. On the inside, it contains elements of the FBI and the NCTC, the National Counterterrorism Center—since 2004, the country’s main nerve center for counterterrorism intelligence collection and analysis. The NCTC includes representatives of all the U.S. intelligence agencies that work terrorism. Hallways are lined with massive, solid-oak doors. The work spaces behind those doors, known as vaults, don’t look much different from the cubicles you’d find in any office. Because of all the classified material handled here, the whole building is a sensitive compartmented information facility, or SCIF, pronounced “skiff.”

  Face pale, eyes frozen in a thousand-yard stare: That was my ID picture, taken on my first day on the job there, in May 2006. What had I gotten myself into? I had left a tight community in New York, where I was a leader. I had jumped into a field I barely knew, with a unit of agents who were strangers, in a section known as the meat grinder: International Terrorism Operations Section I—ITOS-1. Another job, another acronym. (“ITOS” is pronounced “AYE-toss.”)

  Setting up ITOS-1 was one of the Bureau’s first steps toward becoming an intelligence-gathering and terrorism-prevention organization. Before the Twin Towers fell, there had been just two counterterrorism units at FBI headquarters—the Osama bin Laden Unit and the Radical Fundamentalist Unit. Those units would grow and the number of units multiply. By the time I got to headquarters, the FBI had two counterterrorism sections, encompassing more than ten units. My section, ITOS-1, covering all cases involving Sunni extremists, had six units corresponding to geographic territories. Four units—called the CONUS units (“CONUS” rhymes with “bonus”)—covered the continental United States. A fifth, the Arabian Peninsula Unit, also covered Iraq, Afghanistan, Pakistan, and Asia. The sixth, the Extraterritorial Investigations Unit—the ETIU—covered the rest of the
world: Europe, Canada, Africa, South America, Eastern Europe, and Russia. I was the ETIU unit chief.

  Counterterrorism is a tough job. The work is grueling, devouring nights and weekends. You operate with zero margin for error. Worse, merely by identifying someone as a threat, you and the FBI take responsibility for that threat. If a terror subject comes on my radar, and I investigate and find nothing, but five years later the suspect launches a deadly attack, it’s on me. Why wasn’t that guy stopped five years ago?

  Despite those burdens, and also because of them, morale in counterterrorism units is high. I loved working there. After all their years of service, most agents look back on one division or squad or field office as having been their home in the FBI. For me, ITOS-1 was home. The section had tremendous camaraderie because everyone was toughing it out together. A huge sense of mutual respect and self-respect emerged from the job’s relentless pace.

  Regularity and accountability were the principles that drove our work. Meetings happened every day, rain or shine. And every day our section chief, Michael Heimbach, who ran ITOS-1, held us accountable. Mike Heimbach was the FBI’s answer to George Hamilton, the actor: chestnut tan, slicing smile, extremely expressive eyebrows. Heimbach’s management style involved a lot of laying down of dares. A standard Heimbach line was, It’s time to step up. In the daily morning briefing, we all got our heads screwed on straight so we could march forward in the right direction. In the wrap that afternoon, we shared progress reports, answered questions from Heimbach, and spoke freely about longer-range issues. Working under such orderly management was new for me. As a supervisor in New York, I had struggled to schedule formal meetings with my squad even once a month. But I took the ITOS-1 model of orderly management into every job I had later.

  Living with a daily expectation of progress reports ingrained the importance of follow-through. Heimbach would never dance around a central question. He always came right at it, always carried himself with confidence that answers would be given. Dissembling, obviously, was not acceptable in these conversations. Neither was self-delusion or trimming. Dishonesty and obfuscation are strategies that people engage in when they think the questions they’ve been asked will eventually just go away. ITOS-1 was a culture where everyone knew that legitimate questions always had to be answered. Where everyone knew that legitimate questions never go away.

  ‘When Are We Going to Fix This?’

  That summer we had started getting information from British intelligence about a group of young men in London. The men had come to the attention of British security services through the investigation of the London transport system attack the prior year. On July 7, 2005, four suicide bombers in London had killed fifty-two people and injured nearly eight hundred more on the Underground and a double-decker bus. A few weeks later, a man named Abdulla Ahmed Ali came to the attention of MI5, the British security service whose focus is on domestic matters. (MI6 is the service that operates overseas. The division is roughly that between the FBI and the CIA.) A tip suggested that Ali might be connected to those bombings. The Brits put him under surveillance and kept collecting intelligence on Ali for a year. Then Ali went to Pakistan.

  Surveillance there found that Ali was spending time with an extremist named Rashid Rauf. Rauf had fled Britain in 2002, under suspicion for his uncle’s death by stabbing in Birmingham. Now he was an operational planner for al-Qaeda in Pakistan. In cooperation with an al-Qaeda senior commander, Rauf taught Ali how to build liquid explosive devices using common chemicals—peroxide, hexamine, citric acid—that could be detonated with AA batteries.

  Ali went back to England, paid cash to buy a little apartment, and started experimenting. He and his friends bought plastic bottles of a sports drink called Lucozade—a British version of Gatorade—and they worked on turning each one into a handheld bomb. They would drill a small hole through the plastic nub in the bottom of the bottle. They would let the liquid drain out from that hole. They would use a hypodermic needle to inject the empty bottle with explosive ingredients. Then they would seal the hole with epoxy. Properly assembled, each device was powerful enough to blow through the cabin wall of a commercial passenger jet.

  This whole operation was being watched. By now, British investigators had cameras and microphones in the apartment where the experiments took place. Around the country, some twenty other subjects were being tracked. The conversations were sobering. After one young father took a child to play in a park on a weekend, he was overheard struggling openly with the knowledge that when he became a suicide bomber, he would never see his child again. He and his associates were forming a plan to take bombs on flights from London, we believed, to the United States, and then to kill themselves and everyone else on those flights.

  The members of this terrorist cell also had connections to people in the U.S. Those connections were the FBI’s big concern. Monitoring the American side of threats was traditionally the Bureau’s role. To do that, we needed the best and freshest intelligence about the situation. Did we know exactly what the CIA knew? Were they giving us what we needed so that we could do the work we needed to do? It’s not enough for the Brits to say, Our bad guy here in London talked to three people in New York last week. The FBI has no way of knowing what that means until we get the names. We need to open cases in order to figure out if they’re just family members of some bad guy and know nothing, or if they are passive collaborators, or if they are actively doing bad stuff on their own.

  The name of this case was Operation Overt. The Brits named it. I have no idea why they called it that. Counterterrorism case names were frequently obscure or awful. Kinetic Panda, Bubble Puppy, Milk Can. Mueller would always ask, Where did that name come from? The person briefing him would usually answer, We have a machine that gives us the names. It’s random. It comes from the machine.

  I hate it, he would say. Or—since the FBI does not in fact have a naming machine—he would say, I don’t believe you.

  Operation Overt fell under my aegis. As a result, I became the FBI’s conduit for information flowing from several directions, formal and informal. The British provided daily written reports to the FBI legat in London, who passed them on to me. Colleagues in Pakistan did the same for our legats in Islamabad. If the legats had drinks or dinner with their local partners, they’d give me the skinny afterward. I had extensive conversations with the legat in London. At some point in the process, I started riding over to Langley every day with Art Cummings, the deputy assistant director for counterterrorism, to sit in on the secure video teleconferences with foreign counterparts at the Agency’s Counterterrorism Center. My unit and I had to suck back all this information, figure out if there was a U.S. angle, and open cases—which involved surveillance on those targets from field offices and more information ricocheting back to headquarters. We had about 150 agents checking bank accounts, credit cards, communications, travel. We opened 150 or so cases. We had court-authorized electronic surveillance on the communications of a small number of subjects, which generated more information on the individuals we deemed of greatest concern.

  We pulled at threads to see if something might unravel. Send me the honey, read one line of one transcript of an intercept. I’m going to the wedding in Massachusetts, read another line of another transcript. We were inclined to interpret such things in the widest possible ways. In counterterrorism, “wedding,” for instance, has historically been used as a substitute word for an attack. But sometimes a wedding is only a wedding. And it’s as common to ship honey back and forth in Yemen as it is to FedEx a contract in the U.S. But how can you be certain whether honey is more than honey?

  Piecing all this information and insinuation into a coherent picture would have been challenging in an atmosphere of mutual confidence, honesty, and trust. International interagency relations during that time could not have been described in those terms. British and American intelligence did not have high confidence in each other. No one was sure what was happening in Pakistan. Everyone conne
cted with this investigation spent a lot of time wondering what they weren’t being told.

  There was also a lot of distrust between the CIA and the Bureau in those days. The FBI was always wondering, Are they telling us everything? The CIA was always wary: Don’t tell them everything because they’ll screw it up. The two agencies got along better than they had prior to 9/11, but things were far from perfect. You can’t repair relations with the flip of a switch. We cherished our mutual suspicions. With Overt, the FBI quickly saw that we should be working our end of this thing, and quickly moved to make the CIA cut us in and be more transparent.

  One part of my job was to distill all this into a briefing for the director, twice a day, every day. Whether I briefed Mueller face-to-face or by secure videoconference, I always brought a fresh link chart. Pictures, name tags, colored string, pushpins: On TV and in movies, obsessive investigators build elaborate link charts to show connections among persons of interest. These portrayals are not far from the truth. We build charts because charts help us solve problems. Put somebody’s picture on the chart, and you find yourself thinking about that person. Leave the person off, and you might not. Mueller had a lot of quirks about the link charts. He detested diagonal lines. Some colors he liked. Some he didn’t. The most important rule was not to use too many colors and not to use bright colors. This wasn’t an eccentricity—it was wisdom gained from experience. Sharply contrasting colors could become distracting and could also make you think that colors that were different had nothing to do with one another. Mueller did not want to be distracted, and he also wanted to be able to see the problem whole. He wanted to know everything that we knew but did not want clutter. Sometimes he would take out the chart and suddenly you would see his face fall, as if to say the kind of thing that he would rarely say: Who made this piece of crap?