The Threat

by Andrew G. McCabe

  5

  Benghazi to Boston

  RELIVING THE HORROR, AGAIN AND AGAIN

  No Red Lines

  Try to hit the alligator closest to the boat. In 2011, when I returned to headquarters from the HIG, that was the counterterrorism division’s guiding strategy. And the water was teeming with alligators. As in the case of Zazi and the New York City subway plot, sometimes we got lucky. In May 2010, a Pakistani named Faisal Shahzad left a Nissan Pathfinder packed with propane, gasoline, fireworks, and timing triggers parked in Times Square. Vendors called the police when the car began smoking after a failed detonation. Three days later, Shahzad slipped past FBI surveillance teams outside his house and was pulled off a flight by Customs and Border Protection officers minutes before the airplane was to leave for Pakistan. In October of the same year, we were spared the loss of possibly two airliners when security officers found bombs packed in toner cartridges on aircraft at East Midlands Airport, in the United Kingdom, and Dubai International Airport, in the United Arab Emirates. Both packages were the creative and deadly work of AQAP bomb maker Ibrahim al-Asiri. In January 2011, observant workers discovered a backpack containing a radio-controlled pipe bomb on the route of the Martin Luther King Jr. Day parade in Spokane, Washington. Investigators determined that the perpetrator, a white supremacist named Kevin Harpham, had laced the bomb’s shrapnel with rat poison to aggravate the injuries.

  In September 2016, a man named Ahmad Khan Rahimi gave us three near misses in a single day. One Saturday morning, a bomb made by Rahimi detonated in a garbage can just before the start of a fun run in Seaside Park, New Jersey. No one was injured. That night, a pressure-cooker bomb made by Rahimi detonated on a street in Chelsea, in Manhattan, injuring a number of people but producing no fatalities. A second pressure-cooker bomb made by Rahimi, also left on the street in Manhattan, miraculously failed to detonate despite being handled and moved by several passersby. The next day multiple bombs—all the work of Rahimi—were discovered at the train station in Elizabeth, New Jersey. Rahimi was taken into custody after a shootout with police in Linden, New Jersey.

  Unfortunately, near misses were not our only experiences during those years. In Fort Hood, Texas, in Oak Creek, Wisconsin, in Overland Park, Kansas, in Chattanooga, Tennessee, in San Bernardino, California, in Orlando, Florida, terrorists killed or wounded many people. With each tragedy we improved our ability to respond and, we hoped, to prevent the next one. The inevitable next one. I had returned to CT during a milestone month of what I still nostalgically refer to as the “War on Terror.” On May 2, 2011, U.S. forces killed Osama bin Laden. Though still a danger, al-Qaeda was no longer the monolithic, overriding threat it had once been. Counterterrorism now required thinking about a larger variety of extremist groups, including state-sponsored groups. Did Lebanon’s Hezbollah, or the Quds Force of Iran’s Revolutionary Guard Corps, have a presence in the U.S.? How could they act against us here?

  The case of Mansour J. Arbabsiar shifted our perspective on those questions. Before Arbabsiar, we thought there were still some things that state-sponsored terrorists would not do. The Arbabsiar case, which ended with his arrest in October 2011, showed us that nothing was beyond the realm of possibility. With financial support and direction from known members of the Quds Force, Arbabsiar—a used-car salesman in Corpus Christi, Texas—sought to hire Mexicans from the Los Zetas drug cartel to assassinate the Saudi Arabian ambassador to the United States at a restaurant in Washington. That was such a clownfish-crammed saltwater aquarium of a situation that I will gut it for you: The Iranian government ordered a hit on American soil. We had always thought that was a red line they would never cross. They crossed it.

  Proliferating terrorist groups and techniques made coordination of U.S. intelligence work even more important. Cooperation among the relevant agencies—staffed by individuals whose defining characteristics include reticence and skepticism and, on our worst days, paranoia—did not come naturally. Adapting to meet new threats, agencies had to cross red lines of their own. People stopped concentrating so much on protecting their lanes and started thinking about how to share resources and information. The Arbabsiar case was a milestone in the relationship between the FBI and the intelligence community. Soon after we started developing the case, we brought our colleagues over and said, This is what we’ve got. We have a great source, great access. We’ll tell you everything. We want your help. They said, Yes, we want in.

  The information architecture of threats, and of investigations, was changing fast. The Arab Spring had just passed, and new threat actors emerged. Some were purely local, such as the Libyan militias, and some were regional, such as the Nusra Front, a Syrian rebel group that splintered off al-Qaeda in Iraq. Terrorists were improving their public relations skills, packaging their messages for increasingly mainstream consumption. For al-Qaeda in the Arabian Peninsula, Anwar al-Awlaki produced a glossy propaganda magazine called Inspire, with article headlines such as HOW TO MAKE A BOMB IN THE KITCHEN OF YOUR MOM.

  The U.S. government’s Middle East foreign policy discussions focused on what role this country should play in the civil war in Libya. Many of us in counterterrorism were much more concerned about Syria. That country was going south, hard. The population had become so fractured, the country was a completely lawless place. After a war broke out between the old-timers in al-Qaeda in Iraq and the new, better-packaged generation in the Nusra Front, the younger generation relocated to Syria. Then that group split and gave birth to what eventually became ISIS. It was a volatile, violent situation, and few people in the U.S. government were paying attention.

  In the counterterrorism division we were all very concerned. Maybe we should have done more to raise the alarm with Congress, but I don’t think we ever seriously considered that option. In those days, the FBI interacted with the Hill as little as possible. When Congress wanted a briefing, we went up, fulfilled our responsibility, and got back to work. Bob Mueller’s approach to the Hill was: only go when it is unavoidable. He, like all directors after Hoover, fiercely guarded the FBI’s non-partisan integrity. Mueller protected the FBI from congressional partisanship by following the standard rules for dealing with radiation: minimize your exposure time, don’t get too close to the fissile material, keep something in between you and the danger. Time, distance, and shielding.

  On the night of September 11, 2012, in Benghazi, Libya, a mob attacked a U.S. diplomatic compound and a nearby CIA base. Four Americans were killed: J. Christopher Stevens, the U.S. ambassador to Libya; Sean Smith, an employee of the State Department; and CIA security contractors Tyrone S. Woods and Glen Doherty. The FBI immediately opened an investigation, as it does whenever any U.S. facility is attacked. The FBI counterterrorism division—which by this time I led, as assistant director—oversees those investigations, because initial suspicion for such attacks always falls on terrorist actors. But the FBI was denied diplomatic access to the Benghazi crime scene by the Libyan government, such as it was, and the risk of violence was in any case too great for us to go in immediately.

  The FBI pursued this investigation according to procedural guidelines, within diplomatic limits. Still, the problems of access drew criticism right away. When I went to brief Congress, one member said, I saw a CNN reporter in Benghazi walking through the crime scene—if CNN can be over there already, why can’t the FBI? I answered, If you don’t own the environment, you can’t access the environment. Benghazi was not like a bank robbery in Kansas, where FBI agents could go charging in to dust for fingerprints and interview the tellers. This was a foreign country. To send in U.S. law enforcement after the host country had denied access could be considered an act of war. It would take a lot of time and effort before we could get the right conditions on the ground to be able to send people in to do anything.

  Outside the FBI, the Bureau’s work was viewed through a partisan lens. During the week following the attack, Obama administration officials offered two different explanations for the violence.
Susan Rice, most prominently, said it was part of a spontaneous demonstration against an anti-Muslim video that had been produced by an American. Others said that it appeared to be a planned terrorist attack. Some Republicans considered these ambiguous or inconsistent statements as indications of a cover-up. With a presidential election less than two months away, Republicans seized on the idea that Benghazi was an al-Qaeda attack as a way to discredit President Obama on the issue of national security. On the other side, Democrats were eager to suggest that, no, the attack had nothing to do with terrorism.

  Everyone on both sides of the aisle wanted explanations as to why this attack had happened—Was it the movie? Was it a terrorist plot?—before the FBI had a clear sense of who had been involved. That picture would begin to emerge only through a grinding, tedious investigation that began in late September, when a small team of FBI investigators arrived in Tripoli. Our embassy there was spartan. Only the security was elaborate. The investigators were not allowed to leave the building except in caravans of fully armored vehicles manned by U.S. soldiers. Even a trip to a local police department to develop liaison contacts who could corral witnesses involved a massive military movement. We had immense numbers of questions and requests, and in any given week, if the Libyan police did even one of the twenty things we asked them for, that was a pretty good rate of return.

  On the Hill, there was no understanding of realities on the ground. Congress found a hundred ways of asking the one question that hijacked their minds: Was this al-Qaeda or just the movie? My colleagues and I always provided the only clear and honest answer we could credibly provide, on the basis of the information we had: We do not know yet. It may have been both. We have unsubstantiated indicators that people with connections to al-Qaeda may have been involved, and we also know that the video provoked violent protests in Cairo and other places around the world.

  The honest answer was not acceptable. It was dismissed as equivocating. The exchanges we had on the Hill when we went to give briefings did not concern the process of investigation. The only thing I saw members of Congress learning, during these early Benghazi briefings, was that the way to gain the upper hand in a confusing situation was to keep on repeating yourself, louder and louder, and never to listen, never to rest.

  Patriots’ Day

  Skepticism was general and trust was low where national security was concerned. As 2013 arrived, politicians, journalists, academics, and, it seemed, almost everyone with an internet connection had harsh words for the intelligence community’s work—especially interrogation, drone strikes, and electronic surveillance. The government’s use of technology was a frequent target. But that spring, when a new crisis exploded, technology proved itself an asset.

  On the afternoon of Monday, April 15, 2013—Patriots’ Day, as it’s celebrated in Massachusetts—I went to a meeting at the office of the National Security Council, next door to the White House in the Old Executive Office Building. The building is a time capsule. Chandeliers, black-and-white tile floors, grand staircases: You could round a corner and not be surprised to bump into Dwight D. Eisenhower. I had arrived a few minutes early. I was unpacking my lock bag when someone said, Have you heard what just happened at the Boston Marathon? By the time this person said the word “explosion,” and then the word “bomb,” I was making for the door, back to the Hoover building, and into crisis mode—where I stayed until we found the people responsible for detonating two bombs near the finish line of the world’s oldest marathon, killing three people and maiming and wounding more than 250.

  In the aftermath of the bombing, my first job was to manage the competing demands for information and resources that had been instantaneously activated by the attack. I spoke immediately with all four of my deputy assistant directors—in charge of administration, domestic terrorism, international terrorism, and intelligence—and we gathered every shred of available information about what had happened. I organized it in my mind to brief the deputy director, who would convey the information to the homeland-security adviser at the White House, who would convey it to the chief of staff, who would convey it to the president. Other agencies are our partners in counterterrorist operations, but the FBI has foremost responsibility for responding to acts of terrorism in the United States.

  Then I went down to SIOC—the Strategic Information and Operations Center—for a conference call involving agents in the Boston field office along with representatives from every FBI division and office that could possibly have anything to offer. SIOC is the one part of the Hoover building that looks and functions like something you’d see on the TV show 24. SIOC operates in a constant state of readiness. This is where the FBI coordinates federal responses to major incidents like the 9/11 attacks. Connected to the top secret computer network linking the White House with Defense and other agencies, SIOC also allows FBI officials to watch faraway events in real time, events such as the initial search of the Benghazi compound—via aerial surveillance assets over Libya. The facility covers forty thousand square feet: almost an acre, almost as big as a football field. One big room, the Watch Command Center, is divided into an A side and a B side by a removable video wall, like a massive TV screen that can be divided up into many individual screens. Lining the room are some six hundred computer stations on long rows of tables and more than a thousand phone lines. The tables are dotted with little signs like place cards, saying ITOS-1 or U.S. ATTORNEY, giving everyone a clearly defined place. The cards do not bear people’s proper names. In SIOC, individual identity matters less than job description: You are your office before you are yourself.

  For the conference call, in addition to practically everyone in counterterrorism, we pulled in assistant directors of other divisions and SACs from surrounding field offices. They had personnel or assets that could help. People from the Victim and Witness Assistance Program were on the call, too—they would send counselors and people who could provide all kinds of practical help with logistics for the victims and their families: transportation, foreign-language translation, assistance communicating with local government officials, repatriating bodily remains. Human Resources was on the call, because we were moving so many people around and needed help getting them to the right places. The FBI Lab was on the call, to initiate the plan to collect evidence, exploit evidence, handle electronic evidence. Special Flight Ops was on the call, because airplanes would be heading up to Boston full of people, gear, and equipment, and we would have airplanes coming back with evidence, including hazardous evidence—you can’t fly bomb-making material in cargo on Delta or United Airlines. The Hostage Rescue Team—which has an air service of its own—was also on the call, because we could well need high-speed tactical assets supporting the field office in the event of high-risk arrest and search-warrant situations. The Evidence Response Team Unit was on the call, to figure out what kind of help Boston’s own evidence-recovery group might need. The crime scene at the finish line was several blocks long, so we were going to need a boatload of teams to process the whole thing. Which field offices could we draw from, and how quickly could they be on-site? But first we had to find enough bomb teams—FBI agents specially trained to clear an area of explosives—because the entire crime scene, the zone encompassing the scene of the attack on Boylston Street and the area around it, had been filled with spectators, most of whom got away unscathed. Practically all of those people, when the bombs went off, dropped whatever they were carrying—backpacks, purses, briefcases, bags of groceries—and ran. So at a scene where bombs had likely gone off inside some sort of bag, the ground was covered with thousands of bags and backpacks, every one of which had to be cleared by a bomb team before we could even begin the process of evidence recovery. And how would we keep track of everything? Hundreds of agents were about to converge on the Boston field office. How would anyone know who was there, when they arrived, when they left? We had to know where our people were—not just to keep the whole operation moving smoothly, but also because everything would have to be paid f
or—so logistics officers were on the conference call, too, and on their way to Boston. Finance was on the call, to make sure the field office had enough credit cards and to locate hotel space.

  All of this was scaffolding for one monumental question: Who was responsible? Was it one person or more than one? What might happen next? We had no good leads. More than a hundred victims were in the hospital. Some of the victims were in a condition where they could talk to us. A few of them thought they’d seen someone acting suspicious. We had to get sketch artists to them.

  Coordinating a crisis response on this scale, involving all these resources, requires prior experience of similar events. The job is teachable in only one way—by going through it. Crisis learning can’t be taught by a book. No link chart or algorithm could account for all its variables. Crisis learning happens only in relationship: by being part of the group whose job is to manage such urgent, gigantically intricate, high-stakes responses. On the day of this attack—the anniversary of the first battles of the American Revolution, the Battles of Lexington and Concord, commemorated as Patriots’ Day—I found myself in the middle of all these competing demands for attention and resources, in the role of go-between, pulled in many directions. The main reason I was ready was that I had been part of managing the response to such attacks for years.

  This array of actions had been launched, executed, or in process as we rolled into day two of the investigation, April 16. Now we had to focus on converting everything we knew into actionable leads. And we had to move faster. Phone records were not being pulled, video-surveillance footage was not being acquired quickly enough. I provided Boston with extra resources and support. When this did not fix the problems, I did something I have done only a handful of times in my career. I flipped out.