The Threat

by Andrew G. McCabe

  The chart was always changing—names appearing and disappearing—and in each meeting I had to talk through every single element that had changed since last time. Mueller would kick back in his chair, sitting up very straight. Put his hand to his mouth. Circle his chin—really, polish it—with his knuckles. You could see him thinking, making connections, preparing questions. He might interrupt with a curveball—What happened with that guy who was going to the wedding in Massachusetts next week?—recollecting some little piece of information that I’d given him in the days before. I had to be ready for anything.

  If he leaned forward, it was a very bad sign. Mueller leans forward only when frustrated. He gestures, taps his finger on the table. He points—he is a pointer. Also a hand tosser. He tosses his hands and sighs. If he leaned forward, looking at the chart, and then smacked the side of his hand against his head—then it was all over. Time to grab that stick and aim the plane back to the sky, because you are about to crash. When the hand hits the head, Mueller is not with you. Does not put faith in what you’re saying. Or is just not following. You have not communicated a good position effectively.

  The most memorable thing about briefing Robert Mueller, though, was the questions. Always the questions, welling up from his prosecutorial soul. Cross-examination is one of Mueller’s most basic forms of human interaction, and it’s the vehicle for one of his most basic traits: curiosity. He loved to get down into the details and fire off questions one after another in a firm, clear, resonant, courtroom voice.

  Sometimes in briefings he would eviscerate people who did not know what they were talking about, hadn’t followed up on things that he’d asked them to follow up on, or were bringing him the same problem they had brought months earlier but made no progress on. Evisceration was an occupational hazard for analysts, especially, because analysts like to chew on both sides of a question. Could be this, could be that. They are inclined to provide indirect answers to direct questions in exchanges along these lines:

  Mueller: Is this guy a danger?

  Analyst: He seems to have extremist beliefs, but I haven’t seen him do anything illegal. I don’t have access to everything the Agency has.

  Mueller: Why not? We talked about this three weeks ago when we spoke about that other case. Have we made progress? Last time we talked, I told you to get with the CIA and fix this. Make sure that we’re getting what they’re getting. Why are we stumbling across the same problem again? When are we going to fix this? Really. Tell me when this problem will be fixed.

  I learned early on that if I didn’t know something, it was infinitely better to say, I don’t know the answer to that, sir, but I will get it for you—because that would end the matter. He wouldn’t rub your nose in it. But if you promised to get the answer, you had to follow through and get the answer. You would never just make the promise as a way of making him back off. You would figure it out, put it in an email, send it to his chief of staff. And that could be as good as knowing the answer initially, because you were showing that you were thorough, you followed through, you were resolving his question—which was the most important thing. Because everyone knew, in Mueller’s FBI, that legitimate questions do not go away.

  By the time I got through the morning cycle of briefings and got back to my office, it seemed like I had five minutes before I had to meet Art and go to the CIA. By the time we got back from there, it was noon: time to start deciding what to say in the afternoon meeting with the director. Sometimes it seemed the briefing cycle was more important than the information—were we working the briefing or working the threat? The truth is, they’re inextricably related, and you have to work both. Tension was high. I would constantly analyze every gesture Mueller made, every word he said. I watched him as closely as I watched the intelligence.

  Rocks in Our Pockets

  Then a man got arrested in southern Punjab, bringing a giant swath of the global air-traffic system to a halt. While the Brits had been monitoring the network of collaborators in Britain, other intelligence services had been pursuing a vigorous ground operation to locate Rauf in Pakistan. When the Pakistanis nabbed him in the city of Bahawalpur, on or around August 9, it took the Brits by surprise. It took the FBI by surprise, too. Also airport security, everywhere.

  For no one was this a completely happy surprise. Arresting Rauf was like taking a card out of the bottom of a house of cards. At that point, the whole investigation came down. When Rauf was taken into custody, all the suspects in the UK had to be taken into custody, because once they got word of his arrest, they could have rushed their plot forward or taken it underground.

  The timing of a takedown like this needs to be carefully choreographed. You don’t want to do it suddenly. You have to be up on your surveillance to see how all the contacts respond. You have to coordinate arrests and searches—more than twenty arrests, in this case, and more than fifty searches. You have to agree on what Brits call “forms of words”—the precise wording of legal documents and of media releases, so those statements are all positioned and ready to go. Airport security has to be briefed, so they can revise their standards rationally, not in a panic.

  All these processes of preparation had begun, but we were nowhere near ready. Absurd warnings got dropped on TSA and its many variants around the world: Look out for Gatorade or Lucozade bottles that might have had their bottoms drilled out. Immediately, nobody could take a carry-on bag onto an airplane. Nobody could take a liquid on any flight anywhere.

  The follow-on consequences of Rauf’s arrest were at the top of the news as I drove into work that morning. In the coming hours, there would be a lot of shouting inside the FBI and inside British intelligence: How the hell did this happen? I understood all too well what had happened. There’s always a tension between the desire to keep collecting intelligence and the need to disrupt a plot before anyone gets hurt. Case by case, experts will often disagree over where the sweet spot is. Sometimes people will jump the gun. The jumpers see themselves as prudent. There should be no sudden jumps. I was as unnerved by the sudden move as anybody. On the highway to LX-1 in the early-morning dark, though, my momentary reaction to this turn of events was something more like wonder.

  Overt was a lesson in that basic tension within counterterrorism. Is it time to take this down, or do we need to let it go a little further? We never had those conversations about Operation Overt in the way we should have, because Rauf’s arrest brought the whole thing to an end so suddenly. That disruption was a radical departure from how we worked counterterrorism in the Bush administration.

  One of my first bosses in counterterrorism used to tell a story. A boy walks down the beach. Sees a pretty rock lying on the sand. Squats down, picks it up. This rock is perfect for his rock collection, the boy thinks—and he puts it in his pocket—and then off to the side another rock, glinting in the sunlight, catches the boy’s eye. He goes and picks up that one, too. Then another rock, and another, and the boy goes on like that until he is so weighted down with perfect rocks to take home that he can’t carry them all. He plops down in the sand, paralyzed by treasure.

  The FBI counterterrorism division, my boss said, was like that boy. Any shiny thing we saw, we picked it up. In those years—the years of collection—we wanted to know everything that we could possibly know about what our subjects were doing and about the networks that they might be functioning within, so that we could find out more about the threat in general.

  We collected to the verge of overload because, as an organization, the FBI didn’t know what we didn’t know about terrorism. We did not know much about whether there were al-Qaeda operatives in this country, or what they might look like if they were here. We were trying to establish a net of collection that would show us the dangerous people and show us how those people were connected to dangerous people overseas. We opened cases, opened more cases, and then kept opening cases. We had pockets full of rocks.

  That approach came with high costs. It cost human resources. We had to keep ren
ewing FISA warrants, had to maintain and monitor electronic surveillance, had to keep translating what came off the surveillance, had to keep analyzing all the data. We weren’t even sure how to identify the point of diminishing returns. In the dance of collection and disruption, the art is sensing a delicate balance: the time when you’ve collected enough to understand the immediate threat—the subject you’re following or investigating—and also to understand the broader potential impact of that person and the person’s involvements. When you feel you’ve hit that point, you’ve got to be able to disrupt.

  But in the Bush years, we erred heavily on the side of collection. The pressure, in every case, was to collect. Do you have FISA up, do you have enough FISA up, are you collecting enough, who are you going to go up on next? The pressure was never to make an arrest next week. To make an arrest, you had to prove something almost impossible to prove: that you’ve squeezed the lemon dry, that there is no more juice in this investigation.

  Collection and disruption roughly correlate with two parallel investigative approaches: muscling and targeting. Muscling drove the FBI’s post-9/11 drill of running every lead. If we got thirty thousand leads in a month, so what? In those days, when agents got a counterterrorism lead, we would muscle it, hammer it, throw people and eyes and effort at every line of every spreadsheet, never sleep or stop or take days off, because we were t-crossing, i-dotting, shoe-leather-destroying beasts.

  Consider, for example, the threat of the so-called California Brothers. This was a potential threat that bedeviled us the whole time I was in ITOS. It grew out of a report that suggested an al-Qaeda member had referred once to “the brothers in California.”

  The California Brothers became a source of unending worry, hysteria, and frustration. I can’t even remember where the idea of this threat began. But I can guarantee that if you walked up behind any ITOS agent from that era, even today, and whispered the words “California Brothers,” that agent would jump back, punch you, maybe shoot you, while dropping dead from a heart attack.

  Once or twice a year, another agency might send a cable, continuing a series of what we came to call the Scary Cables, in which some analyst would observe that a shift in the wind had been recorded in Tajikistan at the precise moment when sixteen chickens in Alabama had simultaneously laid green speckled eggs, and then go on to suggest that the intersection of these events, in all likelihood, pointed to California—raising the ongoing concern that the California Brothers had yet to be identified.

  The implication of the Scary Cables was always, What have you done about the Brothers, FBI? This would provoke such massive hysterical reactions among the ITOS leadership, me included, that we would do things like re-review every single case in every field office in California. Or go out and check for every male between the ages of X and Y who traveled to California from country Z. These were massive data-gathering exercises that consumed huge amounts of investigative and analytical resources and turned up nothing.

  We were, yes, looking for a needle in a haystack. But our general attitude was: The FBI’s not afraid of haystacks. We’re that good, we’re that strong, that is who we are—we do hard stuff better than anybody. If FBI agents have to take each stalk of hay off that stack, inspect it individually, and replace it precisely where it was before, we will goddamn do that, and for your convenience also provide you with a spreadsheet by four o’clock this afternoon that tallies all stalks of hay that were inspected in the last twelve hours. And this will be no sweat. And it will be preferable by far to taking the risk of failing to sweep up that one crucial bit of hay that we should have gotten.

  That, in a nutshell, was the FBI’s muscling approach to counterterrorism in 2006: If you tell me there’s a terrorist in California, I will go to California and look at every human being in the state.

  Muscling was driven by fear—the fear of missing something. Our biggest fear after 9/11 was that more people in the U.S. were connected to al-Qaeda or similar groups. That fear proved legitimate. Operation Overt helped make it clear that al-Qaeda was in fact metastasizing. Its members did want to strike us again. They did want to hit aviation. And they were quickly discovering the internet’s power as a tool for terrorist recruitment and planning.

  Just before I moved to headquarters, and just before Overt went into high gear, the FBI arrested two U.S. citizens who had been radicalized by online contact with jihadist recruiters abroad. Ehsanul Islam Sadequee and Syed Haris Ahmed lived in Georgia—in Roswell and Atlanta. Through web forums, they had been in contact with a Brit named Younis Tsouli, an early author of online propaganda for al-Qaeda in Iraq. (Online, Tsouli actually called himself “Irhabi007”—Arabic for “Terrorist 007.”) Sadequee and Ahmed traveled to Washington, D.C., and made some videos, casing targets for terrorist attacks—the Capitol, the World Bank headquarters, a fuel-tank farm along I-95—and sent these videos to Tsouli and to another contact in Britain. They traveled to Canada to meet with the ringleader of the Toronto 18—a group that was planning to attack a range of targets from power grids to the Canadian Parliament building. Ahmed traveled to Pakistan and Sadequee traveled to Bangladesh, where they discussed plans that didn’t get much traction—for instance, plans for the creation of an “Al-Qaeda in Northern Europe,” to be based in Sweden.

  These two were idiots, but they had no-kidding connections to al-Qaeda, and they were doing jihadist work. How important or threatening was that work? Unclear. They were not building bombs in their basements, with a view to blowing stuff up tomorrow. But for more than a year, they made consistent efforts to participate in preliminary planning and casing for al-Qaeda attacks here in the U.S. and abroad.

  Theirs was one of the first cases with a real operational connection to the internet. The internet pervades human existence so thoroughly now that it can be hard to remember how recently life was mainly analog. When was the point of no return? Maybe around 2006. In July of that year, a microblogging platform called Twitter debuted for the public. In September, Facebook launched a new feature called “News Feed” and opened membership to all comers, where before you had to be part of a college or school network to join. In 2006, YouTube was barely a year old. The first iPhones didn’t go on sale until 2007.

  Terrorists were enthusiastic early adopters of every new technology. In 2006, when al-Qaeda launched a digital-media initiative, it pushed out more messages in one year than the group had released in the previous three years combined. The internet made it much, much easier for al-Qaeda, the Taliban, and susceptible Westerners to connect and share information with one another. New social media platforms in particular gave everyone, from hardened terrorists to innocent teenagers, tools to make spectacles of themselves, for good and for ill. In Operation Overt, when we saw that half a dozen of the conspirators had made “martyrdom videos”—a suicide bomber’s version of a suicide note—we knew it was a harbinger of things to come. The melodrama of terrorism, always cranked to 10 on the crazy meter, was about to ratchet up even higher as technological capabilities kept growing.

  DVDs were already big. As of Christmas 2006, DVD players outnumbered VHS players in American households for the first time. A lot of stores were doing good business with a run-of-the-mill job: transferring old videotapes onto new DVDs. Around this time, a video-store clerk in New Jersey was doing a transfer and could not believe what he was seeing on the screen. The tape showed ten young men shooting automatic weapons. They were yelling, “Allahu Akbar!” and talking about jihad. The clerk saw something, the clerk said something.

  We put the young men under surveillance. They were Muslim. Half of them were in the country illegally. They liked to get together and watch Osama bin Laden videos, or videos of American soldiers being attacked—when they saw a Marine being blown up, they thought it was funny. They were planning to attack a military base and had their eyes on Fort Dix. We shut that down.

  In June 2007, we wrapped up a sixteen-month-long sting operation on Russell Defreitas, a U.S. resident from Guyana co
nnected to an extremist Muslim group in the Caribbean. Defreitas planned to blow up fuel lines and fuel tanks at John F. Kennedy International Airport in New York. He made some very incriminating statements, which allowed us to intervene before he could do anything. “Anytime you hit Kennedy, it is the most hurtful thing to the United States,” Defreitas was heard to say in a recorded conversation. “They love John F. Kennedy like he’s the man.… If you hit that, the whole country will be in mourning. It’s like you can kill the man twice.”

  Disruption of plots such as these sparked two kinds of conversation. The first happened in courtrooms—the formal legal proceedings to prosecute people for breaking laws. The second happened everywhere else—the informal public conversation about law enforcement and terror.

  Disruption always kicks off a three-day news cycle that opens the Bureau up to criticism. On day one, everyone is shocked at the plot that has been uncovered, riveted by the danger, and relieved to hear of the arrest. By day three, the tone has turned 180 degrees. Now the story is, These guys couldn’t have pulled off a serious attack. They failed out of kindergarten and their ex-wives say they have mental disabilities. The theme of the conversation becomes, The FBI is taking advantage of goofballs who probably couldn’t have blown up a balloon.