The Watchers

by Shane Harris

  McCarthy was incredulous. “No, John! You’re going to do this? No.”

  “Yes, I am,” Poindexter replied resolutely.

  She couldn’t shake the feeling that her friend was heading for rough water.

  McCarthy and Poindexter were cut from distinct partisan cloths, but she had come to admire him, even emulate him, and she wanted to protect him. Power had changed hands in Washington, back in Poindexter’s favor. But old memories persisted. She feared that his past would catch up with him and overshadow all the good she thought he could do with TIA.

  Still, she could hardly fault him for fighting. McCarthy had not, and would not, forgive herself for what she thought she’d failed to do before the attacks. Her brightness and her smile were thin gauze on a deep wound. Now Poindexter intended, in some way, to make amends for all that. How could she tell him not to try?

  McCarthy considered herself an ardent civil libertarian, and she held out the possibility that her friend’s work on behalf of the free world might constitute a threat to freedom. But there had to be a way to balance security and liberty, she thought. There was a rational answer to this equation. If anyone could find it, she believed it was Poindexter. He had the will. Once he set his mind to a problem, he wouldn’t be dissuaded. McCarthy hoped that those who didn’t know him as well as she would view him as charitably. At the very least, she thought, he needed a major public relations campaign.

  Poindexter didn’t want to hang around DARPA for long. He planned to serve as director of the Information Awareness Office for about a year, enough time to get TIA and its related programs on their feet. Then he’d hand it all over to a permanent manager. Maybe Popp would be that man; Poindexter had to meet him first.

  Poindexter thought Popp had crafted an exceptional proposal. A bit more geared toward crisis management than preemption, but he found the writing so superb that he wanted to meet the man behind it. Two weeks after their first e-mail contact, Popp came to a job interview at DARPA headquarters. Their scheduled one-hour meeting stretched on for two more.

  Poindexter didn’t fit Popp’s expectations at all. He was warm, courteous, easy to talk to. After he’d boned up on Poindexter’s past, Popp imagined an imposing giant, quick to cut him down. But instead he felt that he’d found a reflection of his own father. As a child, few things made Popp happier than to build something with his dad. “Let’s go build a porch,” his father would say. The elder Popp drew up the plans and his son did the hammering. One designer, one implementer. Popp sensed that Poindexter needed someone who was good with a hammer.

  Poindexter liked what he saw. Popp was a young hard charger, with a palpable energy. He was bright and came equipped with a military background and a PhD in computer science. This wasn’t so far afield from Poindexter’s own experience, even if Popp was an Air Force man, a sin for which the admiral agreed to forgive him. Poindexter had always trusted his sense about people, and now it told him he’d found a winner.

  Poindexter wasted no time bringing Popp into the fold. He pulled out his TIA presentation materials and described how he wanted the overarching Information Awareness Office to function. Popp thought that it all looked strong, but certain words Poindexter used to describe his efforts seemed politically supercharged.

  In one chart Poindexter used “profiling” to describe a method of screening particular individuals for terrorist characteristics. “That seems to be a little delicate,” Popp said. “That word ‘profiling’ is a hot button, loaded term. We may want to consider not using it.”

  Popp was unsure how Poindexter would react to such a presumptuous remark. He hadn’t even landed the job yet.

  But Poindexter seemed to take the point. He didn’t agree that the term was loaded, though he granted that another could find it so.

  This made Popp wonder: Did Poindexter have a political blind spot? He didn’t dismiss concerns about semantics, about how others might perceive his intentions. But he did seem to think he was above their judgments, Popp thought. As if the world was full of petty people, and he just wasn’t one of them.

  But Poindexter got the message. It was a delicate word. Much as he might like to change people’s minds, he knew that some never would.

  In all their time together Popp never heard Poindexter use the word “profiling” again.

  Poindexter called Popp two days after the interview and offered him the job. Tony Tether, the DARPA director, still had to bless the arrangement, but that was a perfunctory gesture. Popp was now the number two.

  On January 14, 2002, Poindexter reported for duty. He and Popp spent the unseasonably warm day “in-processing,” an administrative routine that reduced human beings to the sum of their paperwork. A day spent filling out personnel forms overshadowed its exquisite uniqueness. Today was John Poindexter’s return to government after fifteen years in the wilderness. His curious pariah existence ended now. Poindexter was back.

  The welcome was unceremonious. DARPA’s building managers, lacking enough offices for Poindexter’s new venture, stuck him and Popp in closets. The pair set up camp in a sliver of tiny niches on the tenth floor of the headquarters building. Poindexter took the biggest of the group; Popp ensconced himself in a slightly smaller space, barely big enough to turn around in. A team of four support contractors eventually would cram themselves into the middle alcove.

  Time, not space, was of the essence. Poindexter had spent the holidays laying out his strategy to quickly award a raft of TIA contracts, so that experiments could be under way and have achieved some measure of progress by the end of the year. He articulated his plan in a formal solicitation to potential researchers, known in government parlance as a “broad agency announcement.”

  A mere pamphlet by procurement standards—it totaled only twenty-five pages—the document was chock-full of insights into Poindexter’s mind. He described the motivation behind TIA and made clear his ultimate goal: “to predict and hence preempt future terrorist actions against us.”

  Anyone who hadn’t known of Poindexter’s relentless technological pursuit over the past decade would be brought up to speed quickly after reading the first few paragraphs of the announcement.

  Currently, terrorists are able to move freely throughout the world, to hide when necessary, to find unpunished sponsorship and support, to operate in small, independent cells, and to strike infrequently, exploiting weapons of mass effects and media response to influence governments. This low-intensity/low-density form of warfare has an information signature, albeit not one that our intelligence infrastructure and other government agencies are optimized to detect. In all cases, terrorists have left detectable clues that are generally found after an attack.

  He continued.

  To fight terrorism, we need to create a new infrastructure and new information technology aimed at exposing foreign terrorists and their activities and support systems. This is a tremendously difficult problem, because terrorists understand how vulnerable they are and seek to hide their specific plans and capabilities. Terrorists’ use of camouflage and deception reduces their signature and introduces great uncertainty in the interpretation of any data collected. Once an information leak is discovered, terrorists can adapt quickly to stop it, either by changing tactics or re-organizing in some way.

  The key to fighting terrorism is information. Elements of the solution include gathering a much broader array of data than we do currently, discovering information from elements of the data, creating models of hypotheses, and analyzing these models in a collaborative environment to determine the most probable current or future scenario.

  So there was his vision—laid bare for all to see. The unclassified document ended up in the hands of Beltway contractors, university researchers, and, eventually, a small number of trade journalists. Poindexter had meant to assert a grand challenge, proposing a broad, scientific problem and inviting solutions to address it. Cost was not the deciding factor. Broad agency announcements also were governed by separate regulations different
from traditional procurements, so Poindexter was free to evaluate each proposal separately, and with criteria based on his own scientific judgment. He and his crew would award contracts to the companies they felt showed the most promise, even if it meant risking the taxpayers’ money. Indeed, at DARPA the managers believed they hadn’t achieved success unless some of their ventures failed. They often learned the most from their biggest mistakes.

  Poindexter hand selected the managers for his research programs. A team of warrior geeks, each one possessed bona fides in the fields of high-end, high-risk technology. And fortunately for Poindexter, most of them already had been working on the very projects he planned to incorporate into his new office.

  Among this elite, esoteric band were people like Ted Senator, an MIT graduate who’d spent fourteen years building computer programs to detect fraud and illegal activity in financial systems. Senator was managing DARPA’s Evidence Extraction and Link Discovery program. Poindexter assigned him the crucial task of developing automated tools to extract, or harvest, data from large information sets. By design, the tools were not so different from those the Able Danger team had used a few years before, but the state of technology was advancing rapidly, as Senator knew well. Before coming to government he founded an analysis group at the National Association of Securities Dealers, where he built a system that monitored the NASDAQ stock exchange for improper trading activity. He’d also pulled a stint as the chief of artificial intelligence with the Financial Crimes Enforcement Network at the Treasury Department, one of the most advanced and successful data-tracking operations in government. FinCEN was tapped to monitor and shut down terrorist-funding streams immediately after the 9/11 attacks.

  Each manager brought his own narrow focus to Poindexter’s broad task. This was a researcher’s dream—to have his pet project lifted up to national policy status, and by none other than a former presidential adviser. Scientists like Jonathon Phillips, who’d spent the bulk of his career developing automated face recognition technology, were now let loose on a wartime effort. Phillips assumed command of a Poindexter program dubbed Human Identification at a Distance, which aimed to verify people not only by their unique facial characteristics but by their particular gait or the way they held their bodies. Such a tool would be a boon to surveillance and had applications on the battlefield as well as the home front.

  Poindexter eventually chose half a dozen men to join him. Perhaps most important among them was an ex-CIA officer named Tom Armour, who’d worked on the original Genoa program. Poindexter prevailed upon him to launch a new effort, aptly, albeit unimaginatively, named Genoa II. Armour had been chief technologist for the CIA’s nonproliferation center. An expert on nuclear weapons systems and Soviet missiles, he and Poindexter shared a cold war pedigree. Armour was also a warrior. Before his career as a spook he’d flown combat missions in Vietnam aboard AC-119 gunships. To Poindexter, Armour was one of the few bright lights in the dim CIA.

  Poindexter told his managers to think about the counterterrorism mission at hand but also to design with future leaders in mind. Think about the commander in chief ten years from now who will have grown up with the Internet, he liked to say. “That president is going to expect the best technology and will be really pissed if she doesn’t have it.”

  Along with data extraction, human identification, and the Genoa follow-on, Poindexter carved out three other research thrusts. One would create a kind of database dashboard, a tool to manipulate and explore far-flung, massive databases as if they were a single information repository. With so much data at an individual user’s fingertips, the program also conducted parallel research on privacy protection mechanisms that would shield the human identities behind all those faceless data points. Second, Poindexter launched research on software to translate foreign languages into English text automatically. Arabic translators were most in demand, though Chinese would not be far behind on the intelligence community’s priority list. And finally there was a war-gaming component aimed at the core question Poindexter had posed with TIA: Could the government identify a “terrorist signature” that would allow it to predict human behavior? This was perhaps the most crucial research of all. If TIA couldn’t identify the terrorists’ codes, it would never work.

  To catch terrorists, TIA had to think like them. Poindexter was no database expert. But he understood that detecting terrorist signatures was as hard as finding a needle in a stack of needles. In antisubmarine warfare, goblin hunters had certain advantages. They knew what materials they were looking for, what sounds a submarine generally made in the water. They knew where to focus their searches. There weren’t many known characteristics for terrorism, particularly in the information space. Poindexter’s team would have to discover them.

  Several months after he’d set up his new office Poindexter asked Steve Lukasik, a former DARPA director and a self-described political liberal, to form a special “red team” of experts on terrorism. Lukasik assembled a group of academics; authorities on special operations; security and aviation specialists; and experts on terrorist tactics, including the finer points of bomb making. The red team met separately from the other TIA researchers to marshal their collective wisdom. They pretended to be a terrorist cell.

  If they were going to attack America, and kill huge amounts of people and do massive damage, where would they strike? The red team concocted different attack scenarios to help TIA narrow down the kinds of signals it needed to detect. There were a seemingly infinite number of possibilities, so the red team devised a kind of generic attack sequence, broken down into a number of essential movements.

  First, the plotters had to get organized: rent safe houses; construct their communication systems; make contacts. The team determined that this took up about 20 percent of the cell’s time. Next, the attackers would make a list of targets and winnow that down to whichever were the easiest to hit or the most advantageous. And finally, there’d be a reconnaissance phase.

  That was the movement to watch, the red team agreed. Based on their collective study of terrorist operations, they estimated the attackers would spend about 40 percent of their time physically scouting out targets, sending small teams to take photographs, case the security in place, and generally get the lay of the land. The experts also agreed this was the time when the terrorists would be most exposed—they’d be out in the open, traveling, making purchases, and sending messages to one another and their handlers. If TIA were trained to monitor the transactions that occurred in the reconnaissance period, it stood a better chance of spotting the signs of a plot, they theorized.

  The team ran an imaginary attack on a shopping mall, which seemed an obvious target for inspiring mass panic, creating economic shock, and claiming large casualties. Lukasik went online to find the biggest malls in major cities, which presumably would have the most customers. He looked only at indoor malls; outdoor venues seemed less attractive targets, since they offered shoppers more avenues of escape from attackers.

  The red team had started to define a pattern: Reconnaissance requires travel to the site, usually by two people. So look for the simultaneity of travel. Search airline databases for two people arriving in a known target city on two different airlines but who stay in the same hotel. They leave a few days later— presumably after casing the mall—and then move on to another location, home to the next potential target. They stay there a day or two, and then they leave again.

  This sequence of events—which the red team regarded as suspicious—became one terrorist signature. With enough signatures the team could build a template, which would be fed into the TIA system. Using the template as a guide, TIA would scan airline, hotel, and rental car databases looking for the data points that matched up to the preselected picture. If the system returned a huge number of matches, that meant the signatures weren’t specific enough. The template hadn’t filtered out the noise of innocent travelers who happened to have similar schedules. TIA would have to look for more attributes, more signals. So the
red team would have to devise a more detailed template. Were there certain materials the terrorists would have to buy? Modes of transportation they were likely to use? Whom were they calling while they made these multicity hops?

  And on and on the iterative process went, until the red team came up with viable templates that detected more signals than noise. The team examined a gruesome range of scenarios. In addition to attacking a mall, they plotted how to destroy a nuclear reactor. The team’s aviation expert sat down with flight charts and topographical maps to come up with the best approach for flying an airplane into the reactor complex. Reactors that had a minimum of obstructions from surrounding hills, bridges, or power lines were the easiest targets. He rank-ordered 103 reactors in 63 different locations, from the easiest to hit to the hardest. Topping the list was the San Onofre Nuclear Generating System, perched right on the edge of the Southern California coastline, with the Pacific waves lapping at the facility’s outer walls.

  The team also took their attacks underground, when they looked at flooding New York City by blowing holes in the tunnels under the Hudson and East rivers. All of their devious scenarios rested on a simple concept. Red teaming was nothing more than the common sense of experts. It should come as no surprise to anyone that a nuclear reactor on a beach was vulnerable to aerial assault. TIA was not so simple, but Poindexter reasoned that if it could be calibrated based on these known, or knowable plots, it would stand a far greater chance of detecting them.

  Poindexter spent the winter of 2002 gathering his fleet and assembling his officer corps. They were a fine lot in his estimation, as committed to the challenge as they were to the cause. But before Poindexter could set sail, he needed allies, well-placed officials who could provide safe harbor when the seas turned rough. Above all others, one man could give Poindexter that kind of protection. He was at the top of his list of calls.