The Watchers

by Shane Harris

  Kleinsmith recognized that he was an outsider. And he wasn’t so impolitic as to apprise the group of his candid assessment. At least, not without an i nvitation.

  During a lunch break Kleinsmith buttonholed Philpot and gave him his assessment of the group’s dynamic, as he’d been asked. These analysts were basing their conclusions on hardened assumptions, he said. Maybe those assumptions were good ones, but the analysts had closed themselves off to alternatives. They weren’t fusing their ideas; they were bickering. And by his read, the course of action for Able Danger was being dictated by whoever could yell the loudest. About the only thing they could agree on was that the United States should hit Al Qaeda in Afghanistan. But here too they seemed to have excluded other options. How could they be so sure that would do the job? Hadn’t the network demonstrated a reach far beyond its remote headquarters?

  Kleinsmith didn’t think he was being especially insightful—just observant. He made Philpot an offer. “Let me do a quick, preliminary run on the data sets we have at the IDC and see what the picture is. I’ll call my guys right now.” Philpot agreed; he seemed equally unimpressed with the results so far.

  Kleinsmith told two of his analysts to start with a broad, keyword search involving Al Qaeda. They ran the usual sources—public information on the Internet, as well as the Joint Worldwide Intelligence Communications System, a private network that the Defense Department used to transmit classified messages.

  Ninety minutes later, the analysts passed the results back to Kleinsmith. They startled him. The IDC had found Al Qaeda “footprints” around the world, in the form of news reports, cable traffic, and other sources that when viewed collectively showed the network hardly was confined to its base in Afghanistan. Hits popped up around the world, and a lot of it came from open sources. The information the intelligence community lacked could be right at its fingertips.

  Philpot asked Kleinsmith to present his findings to the group. To make it more intelligible, he ran the data through ThemeScape, one of the mapmaking tools that displayed information as a series of peaks and valleys. Al Qaeda seemed to have four major centers of gravity, he explained, indicated by the high volume of reporting pointing to Europe, North Africa, the Middle East, and the Far East. Everywhere he looked, there were mountains waiting to be excavated. Nuggets to be discovered. Leads to be followed. Here, he seemed to be saying. Don’t you see?

  Kleinsmith read the faces in the room. Now who was kidding? they appeared to be asking

  “Centers of gravity”? In practically every major hot spot around the globe? This was absurdly broad. useless. Who is this kid? he imagined them thinking. Some punk major from an intelligence outfit no one’s ever heard of? You’ve spent an hour on this. We’ve spent years. And where did you find this stuff again? The Internet? You’re wasting our time.

  In moments like this, the dutiful Boy Scout gave way to the petulant upstart. The analysts’ hostility emboldened Kleinsmith. These were the guys who didn’t “get it,” he told himself. And not because they couldn’t comprehend the technology, but because it threatened them. He threatened them. This nobody was pointing out, on a map, where the nation’s most exalted spies had failed to look.

  If Able Danger wanted to understand Al Qaeda, he declared, if they wanted to attack it on all fronts, then they had to plunge deeper. They should start here, in this ocean he had collected. Why did the big letter agencies presume the government had the best information? Clearly, a lot of journalists, academics, and others grazing on open sources had come up with some powerful insights about the network. He had just demonstrated that. With more work his analysts could suss out meaningful signals in this noise, separate the real leads from the garbage, and come back with what the military wanted: a list of Al Qaeda’s weak spots, the keys to its demise.

  Philpot had seen enough. As the meeting concluded he announced that Kleinsmith and the IDC would take the lead on the Al Qaeda mapping plan. Able Danger would shift its attention and support to a wider campaign. The new guys were in charge. And Kleinsmith was a marked man.

  A few weeks later, in February 2000, Able Danger gave Kleinsmith his first marching orders: “Start with the words ‘Al Qaeda,’ and go.”

  The IDC team worked as it had during the China experiment. A small group of analysts, never more than four, started broadly. They reaped a harvest of Web pages and classified reports, then got their hands dirty sifting the pieces. They worked quickly, and under pressure, since demands from the IDC’s other clients—the various military commands—hadn’t abated.

  Kleinsmith drew up an ambitious wish list of more than one hundred military and intelligence databases that he wanted to access in addition to the sources already available. He thought that the richness of the harvest, and therefore the analysis, would increase as he fed more data into the system. The new sources ranged from the merely “classified” to those designated so sensitive that access was given only as needed.

  About half of the data owners rebuffed Kleinsmith’s requests. Many feared that sharing secrets would reveal how they acquired them. A breach like that could put an agency out of the intelligence business. They jealously guarded their sources and methods, and Kleinsmith knew that even if he was allowed to brief them in detail on Able Danger, the gravity of the mission alone could not persuade others to cooperate with him. He’d have to rely on sheer persuasion.

  It wouldn’t be easy. Law enforcement agencies, in particular, resisted his requests. They were in the business of keeping records for criminal prosecutions, not freewheeling intelligence missions. By design, their databases were full of U.S. persons information. “There’s no way in hell you’re getting this,” more than one official told Kleinsmith.

  He had anticipated roadblocks like this. So, as Kleinsmith made the rounds, he set his sights on sources he thought would pose the fewest hassles. He was particularly interested in a database of foreign students maintained by the Immigration and Naturalization Service. These people were in the United States on temporary visas. They were here legally, but they weren’t permanent residents—a key distinction. Kleinsmith was learning to think like a lawyer.

  When he sat down with immigration officials and explained that he wanted temporary access to the visa data, they seemed supportive. His legal rationale was sound. But, the officials explained, they simply couldn’t assist him, because their database was rife with U.S. persons.

  Kleinsmith was perplexed. “What do you mean, U.S. persons?” he asked. Weren’t these foreign students?

  Well, the officials explained, INS employees manually entered visa forms into the system. It was a painstaking process, and the agency was short staffed. Currently, they had a six-month backlog of forms waiting to be processed. So they couldn’t guarantee that, by the time they got around to a particular batch, the students’ legal status hadn’t changed. Statistically speaking, they were certain, some people in the database were now citizens or permanent residents. They just weren’t sure who.

  Able Danger, like the China experiment, revealed just how disconnected and convoluted the government’s intelligence systems really were. The community was anything but a community. Some sources thankfully were not off-limits, Kleinsmith discovered. The IDC could still tap the classified Defense Department network they’d used in previous harvests. Finished reports in that system often yielded productive nuggets, including bank account and phone numbers.

  Of course, the Internet provided the most productive source of all. It gave him the best leads. And, as far as he understood the law, public information was free for the taking. In February, the IDC conducted its first harvest for Able Danger—it was, as Kleinsmith had expected, huge.

  The cache totaled roughly 2.5 terabytes, equal to about one-tenth the number of printed pages held in the Library of Congress. In that single harvest Kleinsmith guessed they’d pulled in about sixteen thousand names. It was all a mile wide and an inch deep. But what he saw unnerved him. Recurring names connected to one another, lin
ked by geography, by intermediaries. A spider’s web of suspicion. What did it all mean? It couldn’t be good, he told himself. He saw associations coming into focus. A global spread. Were these communications channels? Money exchanges? It was all so much vapor, con-trails left in the wake of fast-moving bodies. But the picture was there, taking shape. There were signals in the noise. If only a tenth of them were meaningful, it was enough to lose sleep over. And he did.

  He wasn’t alone.

  Less than a month later, the staff of the House Intelligence Committee learned that Special Operations had tapped the IDC for data analysis, the same kind they’d done for the China experiment. The committee lawyers’ first call went to the Pentagon.

  The committee presumed that the Army had established significant oversight procedures for this. These guys in the IDC weren’t out there on their own again, were they?

  Word came back from the Army lawyers to the committee staff director: “We’ll have to check on that.”

  In the winter of 2000, with the IDC several weeks into its Able Danger work, no one in the senior ranks of the Army or the Pentagon realized that Kleinsmith’s team was once again pulling in thousands of names of U.S. persons. Senior Army intelligence officers had asked the Pentagon for guidance on how to assist Special Operations with Able Danger, but while the lawyers were still deliberating over some new “methodology,” Kleinsmith and his colleagues were off investigating specific leads generated by the harvest.

  Army lawyers were eager to protect the service from a repeat of the China fiasco. They wanted senior-level cover this time. Rear Admiral Michael Lohr, the legal counsel to the chairman of the Joint Chiefs of Staff, got involved. His boss had ordered Able Danger in the first place.

  As Lohr examined what the IDC was up to, he grew increasingly troubled by its novel approach of mining government and public information. He fired off a memo to the Army enumerating his concerns. The IDC could “pull together into a single database a wealth of privacy protected U.S. citizen information, in a more sweeping and exhaustive manner than was previously contemplated.” The message was unmistakable. The Joint Chiefs and the Army must “think carefully how we want to deal with a capability which can gather such information into one cross-referenced super database.” If the Department of Defense planned to maintain such a system, that decision should be made “at a very senior DOD policy level,” Lohr wrote.

  Then, in a note that surely shot fear through the military’s legal corps, Lohr indicated that he had consulted with both a lawyer in the Pentagon general counsel’s office and the United States attorney general. They all agreed that, at least in the short term, the IDC should only be allowed to mine Defense Department databases. That the Internet was off-limits.

  Able Danger was not a law enforcement mission. It was effectively an assassination campaign. The military planned to eliminate these terrorists, not try them in court. The Washington Post smell test would have registered off the charts with this. But as the attorneys closed ranks, and congressional staff hyperventilated, Kleinsmith and his team started passing along information to Able Danger. Weeks before Lohr wrote his memo, Philpot briefed General Peter Schoomaker, the U.S. Special Operations commander, on the progress Kleinsmith had made. He showed the general some of the intriguing discoveries the analysts had produced using their new tools. Schoomaker liked what he saw. The IDC should keep up their good work.

  Kleinsmith and his team worked at a fast clip. Connections became stronger. Signals came in clearer through the noise. Kleinsmith could see that Al Qaeda had evolved from an ideological movement into an operational network—and a formidable one. Names, locations, capabilities, and even financial sources were converging. But the harvest was still too unruly to give Special Operations the precise information they needed. The team had to dig deeper.

  The computers could get Kleinsmith only so far. Now was the time to put them aside and rely on his own mind. Kleinsmith liked to characterize analysts using the Myers-Briggs Type Indicator, which divided people into one of sixteen personality types based largely on how they processed information and made decisions. The best analysts, he thought, excelled at “sensing.” They focused on what they could see, what they could touch. The physical world. They solved problems by working through facts. Kleinsmith was a sensor, as were most of the analysts on his team, who were also mostly women. Most of the women he knew were sensors, and he’d always ended up working with them. Once, in an Army training class, Kleinsmith and his fellow students were divided into two groups based on their Myers-Briggs results. He and the women ended up on one side of the room. From the other side, his male colleagues ribbed him mercilessly.

  In Kleinsmith’s experience, a lot of male analysts were judgers. They added their own values and insights to a problem. They interpreted, and in the process, they made too many leaps in logic. That was a risky approach with Al Qaeda, especially since what the intelligence community did not know far outweighed what they did.

  Kleinsmith and his team sat around the IDC talking their way through the rich data harvest. They started with what they knew: Certain names popped up more than others, and often there were links between them. The obvious question was, How were they actually connected? Not by coincidence in a set of news articles. But by real people? Who were the intermediaries? Was there a human chain? Did it connect person A in Yemen to person K in Germany? The tools indicated that it might. Person K was showing up in other connections too. He seemed . . . prolific.

  As the analysts pondered the possibilities, one of them noted the striking similarity between this puzzle and a favorite party game—Six Degrees of Kevin Bacon. The object was to connect the actor, who seemed to have worked with everyone in Hollywood at some point, to any other actor through six steps or less. Kevin Bacon to Tom Cruise. Bacon starred in Flatliners with Julia Roberts, who was in The Pelican Brief with Denzel Washington, who was in Courage under Fire with Meg Ryan, who was in Top Gun (as Goose’s wife) with Tom Cruise. Three degrees of separation. The best players could nail it in two or less. Kevin Bacon to Arnold Schwarzenegger: Bacon starred in Apollo 13 with Bill Paxton, who played the bumbling con man in True Lies with Schwarzenegger. One degree. Of course, sometimes the obvious connection was staring you in the face. Kevin Bacon to Tom Cruise? Hello. A Few Good Men. Direct connection.

  If the Kevin Bacon game worked for movie actors, why couldn’t it work for terrorists? The team spent hours sitting around the IDC trying to pare down the number of connections between names they’d never heard before and to countries they’d never visited. Their critics thought the analysts had surrendered all logic to machines. They just had to laugh at that.

  Working the problem over, the analysts helped Able Danger planners isolate some twenty individuals they thought merited further scrutiny. The Kevin Bacons, Julia Robertses, and Arnold Schwarzeneggers of Al Qaeda—maybe. Philpot and a handful of his colleagues had camped out at a nearby hotel, so they were on hand to watch the IDC churn out results. They fed the analysis back to Special Operations headquarters, and campaign planners there gave the thumbs-up: Zero in on these people. Find out everything you can about them.

  The target sets narrowed. That made Kleinsmith happy. But he had a much bigger problem.

  Each of those targets required a new harvest. And any names connected to them, any new links, had to be harvested too. The analysis tools were designed to find connections in contained sets of information. But on the Internet, one page linked to ten others, which in turn linked to ten more. The tools couldn’t handle exponential growth.

  Each target created more noise. In a desperate attempt to simplify the analysis, the team constructed rudimentary charts—nothing but boxes containing names connected to each other with straight lines. But the charts ended up twenty feet long and covered with small type. They were so big that the team had to hang them on a wall just to read them.

  The deeper they dove, the more they questioned their own results. Could the data play tricks on them
? A line between two people looked so convincing. But what did that line really mean? What relationship lay underneath it?

  “Do you have any idea how many people on the planet would go to jail just because they knew somebody bad,” one woman asked the group.

  It wasn’t just a good question. It was the question. Guilt by association was a useless standard, at least for Able Danger’s purposes. They had to know, for sure, that the targets actually mattered to Al Qaeda, or were Al Qaeda. They were grabbing at smoke. They needed hard information.

  They knew that intelligence reports from the classified systems often came with an especially useful lead—telephone surveillance logs of suspected foreign targets. Connections through phone numbers offered a more concrete basis of suspicion than much of what the team had pulled in so far. Target X called person Y. On this day. At this time. They wouldn’t call each other if they didn’t know each other.

  One of the analysts meticulously combed through the phone logs. She’d pick a target, then pull out all the numbers that he had called, entering the information as a series of “to” and “from” fields in a spreadsheet.

  Now the analysis tools became useful again. They could crunch all those confusing numbers lightning fast. The team ran the phone number spreadsheet through a visualization program, called Parentage, which created link charts based on phone and Internet logs. At the time, the NSA was using Parentage to trace attacks on computer networks back to a discrete Internet address.

  Parentage created a link chart, and the analysts gathered around to examine it. As Kleinsmith scanned the results, one node caught his eye. He had to check himself to make sure he was reading it correctly. “Plymouth, Michigan.”