The Threat

by Andrew G. McCabe

  The operative word there is “probably.” The FBI does not have the luxury of assessing whether people are fully capable of doing what they suggest they might do. If you are inclined to film yourself firing an AK-47 while hollering about jihad, and if you are taking affirmative actions in line with those sentiments, then you have cast the die and have set yourself up for investigation. It would not be a reasonable response to those situations if the FBI were to say, Well, this guy, he’s kind of dumb, so we’ll just leave him be—we only build cases on people who got good grades in high school. That would not be a wise or just process. But it’s the strange way some people suggest we should operate.

  From Muscling to Targeting

  Some of the disruptions I’ve described were partly enabled by more targeted investigative techniques. Many targeting techniques are based on access to and organization of data. In truth, targeting isn’t that much easier than muscling, but its ambitions usually fall a little bit shy of muscling’s ideal of omniscience.

  A targeted approach to finding the California Brothers might have looked like this: First, we go to all the terrorists we know in California, around California, in states not even close to California, and then maybe in foreign countries that have flights to California. Then we look at all those people and see if, in their networks, we can make a connection to California. That will give us a pretty good lead. Targeting is the Bureau’s preferred mode of counterterrorism investigation today.

  To get from muscling to targeting, the Bureau had to develop a certain level of confidence in its own ability and experience, and a certain tolerance of risk. Our overblown response to the California Brothers is a perfect illustration of how little risk we were capable of handling during the Bush years. By “we,” I mean not just the FBI but Americans as a whole. What do Americans do as soon as any tragedy strikes? We immediately go back with a microscope and try to figure out which individual to hold responsible. To some degree it’s an understandable reaction. But taken to an extreme, it expresses and perpetuates damaging and unrealistic expectations about how intelligence and law-enforcement services are able to function in society.

  A turning point in the Bureau’s shift from muscling to targeting was Bryant Neal Vinas. He was a Latino kid from Long Island who shattered some of our preconceived notions about al-Qaeda. Prior to Vinas, we thought it wasn’t possible to get sources in al-Qaeda, wasn’t possible to send cooperators into the Federally Administered Tribal Areas of Pakistan (FATA) to start really developing relationships. There was a notion that al-Qaeda was so expert in sniffing out spies in their ranks that all roads to the FATA were lined with the severed heads of failed infiltrators. It was too dangerous a proposition to operate the kinds of sources—cooperators or undercover—that we would do with organized-crime or terror groups in the U.S.

  Vinas had converted to Islam, hopped on a plane, flown to Pakistan, and joined up with al-Qaeda. He took part in an attack on an American base, then went to Peshawar to find himself a wife. The Pakistanis arrested him and turned him over to us. He was charged with material support of terrorism—our meat-and-potatoes charge for people who become affiliated with terrorist groups—and he decided to cooperate. He let loose with all kinds of eye-opening intelligence about the process of affiliating with al-Qaeda, meetings with high-level al-Qaeda leadership, how he got there, and other Westerners he met along the way. From that we were able to take a closer look at people whom Vinas met and the people they knew. It was a giant leap in the evolution of the targeting process, much more efficient and less legally dubious than some of the earlier ideas that hypothetically might have made it onto the counterterrorism-division whiteboard—looking at every twenty-year-old who traveled to Pakistan last year, for instance.

  After learning the story given to us by Vinas, a lot of people in the Bureau thought, Oh, my God, is it that easy? If a kid from Long Island could do it, why couldn’t we? We proceeded cautiously. It’s not like all of a sudden the floodgates opened and we sent every Joey Bagadonuts from Staten Island over to Waziristan. But Vinas did change how we thought about our options. His experience told us that al-Qaeda would talk to foreigners, as long as those foreigners were not on the radar of intelligence services as people who might be associated with terrorism. They wanted people who had “clean” passports—passports that would allow travel back to Western Europe or the U.S. without visas. For al-Qaeda or ISIS, that’s the prime asset for a Western operative. To recruit a person with a clean passport, indoctrinate them, turn them around, and send them back—that’s their goal, and that’s our nightmare.

  For the Bureau, Vinas was also a turning point in terms of confidence building. Not only did he provide more information, he helped us see the situation of recruitment from a different angle. That let us become much more aggressive in identifying people in the U.S. with potential capability to work for us on the ground. After Vinas, we developed sources that became extremely valuable to the U.S. intelligence community. He also turned us on to a number of specific people whom we began to look at with more of a targeting mentality. We saw how those people connected to one another, where they came from, where they were going.

  There was never a watershed moment in the shift from muscling to targeting. The FBI never decided, Tomorrow we’re going to do everything differently. The Bureau evolved over time. We learned by doing. Where we succeeded, we pursued.

  We are still shadowed by expectations that we should be muscling machines. Today, when we open an investigation on U.S.-based extremists, we are thinking from day one about disruption. From the first minute of collection, we are looking for things that could be used as evidence in some kind of criminal prosecution. Constantly thinking, What do we have on this guy? Is he a felon who happens to be in possession of a firearm? Did he lie to Customs and Border Protection last time he entered on his flight from Pakistan? When he’s not in the mosque, is he selling coke on the corner?

  We’re constantly building into the case a disruption strategy. We do that for two reasons. In case he’s a serious threat, or in case he’s no threat. In the first scenario, we consider disruption because flash to bang, the time between inspiration and action, tends to be quicker now. A suspect can be receiving instructions from Syria on his smartphone while he’s shopping at the grocery store—so we may need to take him into custody immediately at any time. In the event that he’s not a serious threat, if no plot and no immediate risk develops, there will come a time when we realize that we have collected enough. There will come a time when we see that the guy doesn’t seem to have any true connections—sure, he’s following propaganda, he’s following Twitter feeds, but in reality he’s not talking to anybody overseas. He has a small number of friends here, but none of them seem to be interested in his supposed desire to blow up a bank or a restaurant. So we will just take the case down—make an arrest if appropriate, or simply close the investigation. Because we don’t want to carry it around for another five years.

  Which is what we did with the 150-odd cases connected to Operation Overt. The FBI was just like the boy on the beach. We carried the load of Overt cases around for what seemed like forever. Most of those cases went nowhere: The people had no nexus to terrorism and were not engaged in any activity that was terrorist related. But some were indeed engaged in suspicious activities, and some were arrested for terrorism-related offenses.

  When the stakes are high—when people feel desperate, and when they want to act with an abundance of caution—there’s a real temptation to muscle it. But in the years to come, as I continued working counterterrorism and played my part in the shift to targeting, I would often consider our collaborations on Overt. The CIA, to its credit, will muscle nothing. We learned a lot about targeting from our interactions with the Agency, just developing our relationship with them and reaping the benefits of their targeting activity. Working with the Brits, who have a more realistic risk tolerance, also helped a lot. They know their population includes extremists. They accept that fact
. They calmly try to focus on the people who appear to be most likely to act on those beliefs. Start with known bad guys, known bad organizations, and work out from there. Don’t just look for every brother in California.

  As for Rashid Rauf, whose capture took so many by surprise, he was not in confinement for long. The next year, Rauf managed to escape after an extradition hearing when he asked to stop at a mosque for afternoon prayers. Some while later he found himself in the wrong place at the wrong time and ended up dead. Which can happen when you’re a high-profile terrorist in a dangerous part of the world.

  4

  Interrogation

  ASKING THE RIGHT QUESTIONS, AND ASKING THE RIGHT WAY

  A Cooler Full of Flour

  In the late summer of 2009, Mike Heimbach gave me a call. He said, I need you to go to Denver to help them work on a CT case. The case was called High Rise. It involved a potential plot to attack mass transportation in a major city. I asked, When do you need me to go? He answered, Tomorrow.

  High Rise was heating up. Because the Denver field office had not had much experience with counterterrorism, the case was causing some struggle. A situation like the one unfolding in Colorado creates a lot of special needs, just in terms of information flow. The director requires regular updates, and a thick stream of intelligence has to be nimbly routed among various departments at headquarters and throughout the intel community. Asking a field office to manage all that in the middle of a crisis is onerous. If they don’t execute flawlessly, they’re liable to get buried. Today, with the benefit of lots of counterterror crisis experience, headquarters collaborates well with the field. A decade ago, when the FBI began experimenting with sending HQ agents to the field as liaisons, agents in field offices sometimes felt they were being bigfooted by a babysitter. That was the reception I faced in Denver.

  The subject of High Rise was Najibullah Zazi, a twenty-four-year-old Afghani raised in Pakistan and then in Flushing, Queens. After high school, Zazi ran a coffee cart in lower Manhattan, near Ground Zero. Along with two of his high school friends, Adis Medunjanin and Zarein Ahmedzay, Zazi became radicalized. Following his father’s lead, Zazi sided with Taliban sympathizers at his local mosque. He and his friends watched hundreds of lectures by jihadist imams. They watched internet videos of American soldiers being ambushed. Zazi also fell into debt and went bankrupt.

  In 2008, he and his friends traveled to Pakistan. They connected with highly placed al-Qaeda terrorists, who provided weapons training and taught them to build bombs. They went through what amounted to Terrorism 101—complete with graduation—and came back to the U.S. Together, they hatched a plan to detonate homemade explosives on the New York City subway. They planned to do this on September 11, 2009—the eighth anniversary of 9/11. Intelligence indicated they were directed by influential al-Qaeda operatives, possibly including Rashid Rauf, a key figure in the London airliner plot.

  Back in the U.S., Zazi and his parents moved to Colorado, where Zazi conducted experiments in bomb building. He was following directions he’d been given in Pakistan. He would go to beauty-supply stores and buy chemicals like hydrogen peroxide in bulk. (When an employee at one of the beauty-supply stores made a comment about the volume of his purchases, Zazi said, “I have a lot of girlfriends.”) He rented hotel rooms where he practiced cooking the peroxide down to potent concentrations. On Memorial Day weekend 2009, the FBI got a tip that Zazi’s communications to his trainer back in Pakistan had been intercepted. That’s what set us to looking at him.

  By the time I got involved, Zazi had completed his experiments. He had taken the bomb-making materials he’d constructed, put them in his rental car, and started driving to New York. Along the way, he got pulled over for speeding—upward of a hundred miles per hour—but the materials were not found. On the weekend of the 9/11 anniversary, he was in New York. He and his associates were tipped off to FBI and New York Police Department surveillance by Ahmad Wais Afzali, a Queens imam who knew them and who was also serving as a source on this case for the NYPD’s Intelligence Division. (The imam’s double-agent work later caught up with him—he was charged with making a false statement in a terrorism investigation and, as part of a plea deal, he left the U.S. for Saudi Arabia.)

  Spooked by the surveillance, Zazi hopped a flight back to Colorado. Unbeknownst to him, more than a few of his fellow passengers were undercover FBI agents. By the time I arrived, Zazi was still in Colorado, and he knew that we knew something and were investigating him vigorously.

  Any major case like this is chaotic. The whole field office works on it. Everybody operates around the clock. In the FBI, the agent who opens a case or is the first assigned to a case owns that case, period. The case agent is king. Every case agent has a partner, a co–case agent, who lends a hand. But essentially the case agent is responsible for every aspect of the investigation for that case, from surveillance to warrants to evidence analysis to interviews. In a typical case, such as a onetime bank robbery, handling the details is straightforward. A massive national-security case that involves multiple field offices, multiple search warrants, mountains of evidence, and thousands of pages of handwritten notes needing to be transcribed can turn anyone into a one-armed paper hanger. It’s more than any one human being can handle.

  You have to run those cases in a different way: Assign discrete elements of the investigation to discrete teams and create a structure of oversight for each slice of the pie. One agent, for instance, will be in charge of phones. Whatever phones we come across, whatever phones we seize, whatever phones we’re interested in, we lob them over to you, the phone person in charge of the phone bucket. The phone person should be able to say at any given moment how many phones we have, whose phones we have, what kinds of phones those are, which ones we’re able to get into, which ones are encrypted and we can’t get into, what we’re doing to pursue access to those phones, and where the process stands on each of those phones. If we seized the main suspect’s T-Mobile phone, has the warrant been served on T-Mobile? If so, did we get the results back? If so, have the results been uploaded into the system and analyzed? Even that list of questions, for multiple phones from multiple suspects, pretty quickly becomes overwhelming for any individual. So the person in charge of the phone bucket generally oversees a team of people working various aspects of the enterprise. It’s a grueling job.

  Physical searches aren’t a whole lot simpler. And you never know when a demanding, complicated operation is going to suddenly get much more complicated. I got to Denver just before the field office executed search warrants at Zazi’s apartment and at the home of his aunt and uncle. Executing such warrants involves seizing such a massive amount of potential evidence that no one person can fully keep track of what the organization has. In this case, one of the main things we were looking for was bomb-making material. During the search of one of Zazi’s residences, agents opened the door to a bedroom closet and found a five-gallon Igloo cooler filled with white powder. Who keeps five gallons of white powder in a cooler on the floor of a bedroom closet? The team immediately thought it might have found enough of the peroxide-based explosive TATP to take down the entire building. So on an already full day, Denver had to cordon off the area, lock down the apartment complex, evacuate the building, and bring in bomb-recovery personnel. It turned out that the bucket the agents had left in place contained … five gallons of flour.

  Every crisis has moments like this. A big pack of investigators can be like a bunch of very young kids playing soccer: Everybody chases the ball. In any game where everybody chases the ball, you can be sure that almost everybody is ignoring important stuff that needs doing. So in every crisis, you have to keep a kind of balance about the situation, and an inward distance, despite the fact that your mind is blowing up at all the crazy things that are happening. Effective response to chaos involves keeping meticulous order.

  In the midst of all this, Zazi called the FBI field office, out of the blue, and said, I want to talk. We did not ask Zazi to
be interviewed. He just volunteered and was coming in. The case agent got a heads-up about the development. He came to me and said, Zazi’s coming in. What do you think I should ask him?

  Inside, my response was like smothering a silent scream as I considered how, in this situation and cases like it, the Bureau should have had a whole team of people involved: those who knew everything about Zazi’s life, family, and associates; those who were plugged into all of the information we’d collected from the investigation in New York; and those who could distill from this mass of information the requirements—that is, the questions and topics—that we wanted Zazi to discuss. I also wondered, for this important interview, whether the case agent was the right person to do it. If the case agent is new to the job, maybe not. If the case agent’s career has been mostly focused on national security, maybe not. It has been my impression that agents who mainly work counterterrorism have conducted fewer interviews than agents who do criminal work. Zazi’s was one of the more mature and better-organized domestic terrorist plots we’d encountered since 9/11. Improvising did not feel like the right way to do this. That said, I had faith in this case agent.

  All right, I said. Forget about everything else. We sat down. We gamed out a little strategy for this interview. Because Zazi had called and offered to come in, the first approach would be to let him talk. About anything he wanted to talk about. From there, questions about his life, his family, and his beliefs would be productive, nonconfrontational ways to build rapport and fill in any blanks we had in terms of background information. Each question he felt comfortable answering would subtly establish a pattern: The case agent would ask a question and Zazi would answer it. Slowly the case agent would weave in facts that we knew to be true. Zazi would either admit them, incriminating himself, or he would lie about them.