In a call with Boston, we were talking about video coverage from a bank along a route we assumed the attackers had likely taken as they left the scene. I asked the assistant special agent in charge if we had gotten the video from the bank. She said, No, we haven’t. And then silence. Until I asked, Well, why? She said, We’ve got a lot to do, it’s 6 P.M., the bank is closed, we’ll talk to them tomorrow. That was the breaking point for me. This kind of stuff had to stop—I lit into her. I said, You do not get it. You are not handling this thing the way it needs to be handled. This is a terrorist incident. This is the counterterrorism division. You are working the biggest terrorism case we’ve seen in the last decade, and that means you are on it twenty-four hours a day, seven days a week. There is no break. Nothing gets done tomorrow. Everything gets done today. When you develop a lead it gets handled immediately. If you need more people to get that done, I will send you five hundred more people by tomorrow morning. If you need video coverage from that bank, I expect you to be at that bank five minutes after the thought occurred to you. If the thought occurs to you in the middle of the night, you should be at the manager’s front door, banging on the door, waking him up. That is how we respond to a terrorism incident. And if you don’t know who the manager of the bank is, and you don’t know where his house is, just tell me you don’t know and I will find that out for you and push that information to you. She said, Okay, okay, I get it. I understand. There was no pushback. Every minute clicking away was making it harder and harder to find the attackers.
I ended the call and immediately felt bad about it—regretted administering that kind of public discipline, which I don’t believe in. Praise in public, discipline in private—that’s the best course most of the time. But in the moment, I could not hold this back. As I stewed about my outburst, I received a message: The director and deputy director wanted to see me. The deputy had been on the call. It felt like getting called to the principal’s office.
I went upstairs. Hello, Wanda. She made go-on-in gestures—slight tilt of the head, sideways-pointed thumb. Mueller sat in the conference room, wearing his Mueller face. Hand on chin, chin tilted down, peering up at me through thickets of eyebrows. I tried to head him off—I’m sorry you had to hear that, I didn’t know what else to say. He put his hand up, the stop-talking gesture. In a low, calm voice, he said, You had to do that. It was the right thing to do. The voice of authority.
Authority was an important part of my experience as a special agent of the FBI. An orientation to authority is unfashionable. Many people see authority as inherently suspect, even alien to their experience. I take a different view. I value authority, and I believe we all need it. It is a necessary element of meaningful civic life. I am not talking about egocentric authority, authority for its own sake—the punitive force of compulsion, exerted to gratify the individual who exercises it. I am talking about legitimate, contemplative authority, which serves as a pillar of any institution or community—authority exercised within a system built on respect and accountability. This kind of authority can deliver a warning. It can discriminate between right and wrong. It can discern. It can punish. It can praise. Authority is activated by a crisis. And it must be earned, as Mueller had earned his. It keeps us solid when things are falling apart.
White Hat, Black Hat
By day three of the investigation, April 17, we had two suspects. Beginning on the first day, as after any attack, we had gone back to look at every current subject of investigation in the area. We scrubbed every counterterrorism case, not just in the Boston field office but also in the whole surrounding area, including the New Haven and New York City field offices. We looked for any bit of information that perhaps we hadn’t seen or correctly interpreted—any clue that someone knew about or was involved in plotting this attack. We also looked to see if any subject of those cases seemed like the kind of person who might have been involved in this attack or was located in a place that made involvement plausible. In addition to evaluating these known potential subjects, we worked with informants and witnesses, and analyzed images and videos, to identify persons of interest. We began surveillance operations on some of those people, and we received reports on their activities. By day three, the surveillance reports were not much more promising than this: He went to the mini-mart, he bought a slushy, he went back to his apartment.
After all the potential bomb packages on Boylston Street had been cleared as safe, evidence-collection teams brought the bags to Black Falcon Pier, on the Boston waterfront. By now we knew something about the bombs themselves—they were homemade devices that consisted of pressure cookers packed with ball bearings, nails, and explosives rendered from firecrackers. They had been detonated by means of a remote-control unit designed to be used for a motorized toy car. A marking on the lid of one of the pressure cookers gave us the name of the foreign manufacturer. We identified the importers who sold that brand and model in the U.S., identified every store in the Northeast region that stocked it, and then tried to figure out everyone who had purchased one in the recent past. We went to Amazon and other online retailers. We did the same kind of source analysis on every element of the bombs and on the backpacks that carried them. The backpacks came from Target. We purchased similar ones. We built models of the bombs to get a better understanding of how they worked.
The FBI also asked the public for help: We asked that people send us their video and still photographs of Boylston Street. When you ask the public for help, you get it—and much of the help you get is not much help at all. We had such a flood of information, including video footage from businesses in the blast area, that it became a challenge to review and analyze it all. We needed every set of eyeballs we could muster. At headquarters we pulled together a video- and photograph-exploitation team to assist the work being done in Boston, sorting through evidence in twenty-four-hour shifts.
On day three, an analyst in Boston identified the video that became the investigation’s turning point. From forensic evidence, we knew that the second bomb had detonated on the ground, next to a mailbox in front of the Forum restaurant. The analyst reviewed commercial video from across the street, looking at the Forum. The footage showed a man, wearing a white baseball cap, walk up to the spot with what appeared to be a backpack on his shoulder. We then looked at the Forum’s footage, which pointed in the opposite direction, showing the back of the crowd on the sidewalk, in front of the restaurant, watching the finish.
The Forum was a restaurant with a small bar that abutted an outdoor seating area. The restaurant was located on Boylston Street, on the final stretch of the race, a few blocks from the finish line. The camera on the restaurant showed a festive crowd of people drinking, eating, and watching the runners, and a line of spectators standing on the sidewalk. The man in the white baseball cap—he wears it backward—walks into the frame. He has a backpack slung on one shoulder. He looks around. He pushes up into the crowd on the sidewalk, not far from a woman with a stroller. There is a child in the stroller. The man in the white hat takes the backpack off his shoulder. The bomb is in that backpack. He places the backpack on the ground. He waits a moment, looks around, and then meanders off.
Suddenly, there is a loud noise to the left of the Forum crowd. It is the sound of the first bomb detonating, at the finish line. In the video you see the faces of the spectators as they shudder and gasp. They all turn their heads to look in the direction of the sound—everyone turns except for one man, the man in the white hat. He is the only person who is not taken by surprise. He just steps away from his backpack and walks out of the frame to the right. Seconds later, this second device detonates.
With that video, we were confident we had a solid picture of one of the bombers. Analysts then went back through all the commercial surveillance video previously obtained from the stores that lined Boylston Street to see if we had additional footage of the man with the white hat. We did—and it revealed a second man. The footage, spliced together in sequence, showed the two men walking tog
ether along Gloucester Street, turning left onto Boylston, and proceeding toward the Forum and the finish line. Both men wore backpacks, and both wore baseball hats. One hat was black, one hat was white. We knew we had our bombers: White Hat and Black Hat. Their backpacks contained the bombs.
I remember being in my office later that day when someone from the team walked in with a CD. He handed it to me, and I pushed it into my computer. On the monitor I saw the entire Forum video. I was struck by the carefree nature of the crowd, the lightness of the scene. The horror of the video was compounded because I knew what was about to happen. But I wasn’t prepared for what I saw. The video continued after the explosion. A man, a young boy, and a younger girl had been standing outside the restaurant. After the detonation, people were running everywhere. The boy was lying in the street. The girl was screaming. The man scooped her up. He talked to the boy. Bent down to pick him up. The boy was his son. The boy’s name, we would later learn, was Martin Richard. He was eight years old. That is where the video cuts off. Martin Richard was one of the three people killed by these bombs.
I watched this at my desk. Later that night I went back to the office and watched it again and again. I must have been trying to push through it in some way, to get past the emotional reaction. I never have.
We did not yet know who these two men were, but we knew they were responsible. We had to figure out their identities. So the next day, Thursday, day four, the question became, What do we do with the footage we have? We would not of course release the more graphic video, the one that I had watched the night before. That was never in question. But what would we do with the video that showed White Hat and Black Hat? Should we continue to work our leads quietly, in the usual way, or should we ask for the internet’s help—in effect, crowdsource the manhunt? We had never done that before.
I felt strongly that we should make the videos public. I went upstairs to discuss this with Mueller, Deputy Director Sean Joyce, Stephanie Douglas, who was the executive assistant director of national security, and Michael Kortan, the head of public affairs. We all knew that asking the public for help in this way would bring an avalanche of bad leads. We would have to run through every one of them. We risked wasting resources when we had none to spare. But the press, thanks to a leak, already knew we had footage of a suspect and were ready to tell the world. The general public had been crowdsourcing the manhunt all week without our supervision or encouragement. Online and in newspapers, innocent people were being falsely identified as suspects. We all made our arguments. I came down strong in saying that such insanity would continue and could turn violent. We had no reason to wait. Joyce, Douglas, and Kortan agreed. Mueller said, Let’s do it.
Kortan had mocked up a poster of what it would look like if we decided to make the images public. The Boston special agent in charge, Richard DesLauriers, used a version of this poster during a scheduled press conference at 5 P.M. that day, and we pushed the video to TV stations at the same time. The FBI.gov website crashed from all the incoming connections. But with expanded capacity, we were back up and running later that night. At Quantico, a hundred analysts worked on incoming tips and pored over video. I reviewed some of the video myself, then went home. I had been asleep only a couple of hours when the phone rang.
Guardian
Jane Rhodes, a section chief in counterterrorism who was night watch command, called me to say that a police officer had been shot in Cambridge, and there had been a carjacking in Boston. She did not know of any connection between these events and the bombing. Since the events were anomalous, and since they occurred within the general region of our investigation, she felt I should know about them. I showered, dressed, and then Jane called again. There had been a shootout in Watertown. One suspect escaped, the other was shot and run over, and was being taken to a hospital. I headed for headquarters with lights and sirens on, ran every red on Constitution, and then the briefings started.
We soon had more details. The carjacking victim revealed that the two carjackers had told him they were the bombers. More important, for the work of identification, was that we had someone rush to the hospital with a Quick Capture Platform, a piece of electronic gear that can take fingerprints under almost any conditions, sync with the FBI database, run the print, and confirm identification in the field. The suspect, who was pronounced dead from his injuries at 1:35 A.M., was identified as Tamerlan Tsarnaev. In the video, Tamerlan was Black Hat. We still had no idea who White Hat was.
Off the Watch Command Center in SIOC are breakout rooms with SVTC capacity. By about 3 A.M., Mueller, Joyce, and I had gathered in one of these rooms. Analysts here and at LX-1 were gathering information about Tamerlan Tsarnaev, running his name and his identifiers through every database and database aggregator. The first thing they did was to answer the most basic, top-level questions the Bureau asks about any person of interest: What do we know, from our own information, about this individual? Does he exist in our files anywhere? Do we have a case on him already? Did we ever investigate him in the past? From the answers to those questions, all further questions will proceed. Where does he live, whom does he know, what does he drive, whom is he related to, has his name ever surfaced in any FBI documents? Every name that has been mentioned in any 302 in the system is indexed, so we can type “Tamerlan Tsarnaev” into a computer and see a list of any other subjects who have ever mentioned him in an interview.
Mueller’s chief of staff, Aaron Zebley, who had been gathering information about Tamerlan Tsarnaev, walked in with a piece of paper in his hand. His mouth started moving. He was saying words that no one in counterterrorism at the FBI wants to hear. He was saying, We had a Guardian on him.
Guardian is the name of the FBI system that organizes complaints and baseline evaluations of every person who comes to our attention in the context of criminal activity, including terrorism and cybercrime. Having a Guardian means that you have been a subject of an investigative inquiry of some kind. A name comes in, it gets entered into Guardian, the person or the lead gets assigned to an investigator, and the process begins. The results of any investigative effort then get loaded back into Guardian, and if there’s not much there to go on—if it’s not enough to predicate the opening of a full investigation—it eventually gets closed. That’s what had happened with Tamerlan Tsarnaev.
In an agent’s life, few things are more excruciating than finding out you had run an investigation on someone who later perpetrated an attack. A nightmare come true: We knew this person posed a potential threat, and then he turned around and blew up the Boston Marathon. The strafing, regretful sense of responsibility: Could we have stopped it? Could I have stopped it?
As Zebley handed each of us a copy, there was half a second before I started reading where I thought, Please, let us have done a good job on the Guardian. I’ve seen outstanding Guardian work, and I’ve seen bad Guardian work. We all three read as hard and as fast as we could. This was good work. After a few minutes, we all started to offer comments. They did their homework … Interviewed him, his parents, his employer … Interviewed a college friend … Says he has a brother, that could be the other guy …
The brother was the other guy, the second suspect—White Hat. By 6 A.M., the hunt for Tamerlan’s brother, Dzhokhar Tsarnaev, had shut down Boston. The manhunt lasted all day. We had a more or less open line with the White House Situation Room and an SVTC with Boston. I went back and forth from one to the other. The head of hostage rescue said he needed a team up there, with helicopters—asked if it was okay to move those air assets and team forward. I told him yes, send the Black Hawks. I worked with Justice Department attorneys on aggressive telephone analysis of Tamerlan’s number, which required a 215 warrant, to figure out whom Tamerlan called, and whom those people called, and whether any of those numbers hit the numbers of known terrorist suspects overseas. Strings of possible analysis pinwheeled out from every phone number or email address. We traced each string, just in case there might be someone else out there, connecte
d to this, planning another attack.
Zebley and a group of other lawyers, after studying the Guardian, discussed what to do with the knowledge that the FBI had, at one point, interviewed Tamerlan. We decided we needed to make an announcement. We needed to put out a statement acknowledging that the FBI had a preexisting inquiry. It is significant and undeniable. And we have learned, through many crises, the truth of yet another old cliché: Bad news does not get better with age. It took us the entire day to arrive at wording we were satisfied with, and in the early evening we released a statement to the media.
By that point, the manhunt in Watertown involved thousands of cops searching house-to-house for Dzhokhar Tsarnaev. Around 6 P.M., Massachusetts governor Deval Patrick lifted the “shelter-in-place” order on Boston-area residents. A man in Watertown walked out into his backyard to smoke a cigarette. He saw that the cover on his boat was disturbed, and the side of the vessel was stained with blood. He called the police. Within minutes, cops converged on the property and trained their guns on the boat. At the first sign of movement, dozens began shooting at the boat. In SIOC, we watched live video of the fusillade and wondered—if Dzhokhar was in fact in there—whether there would be anything left to take into custody. The ground team hit the craft with explosives and even probed it with a robot, and finally Dzhokhar emerged.
Much later, people sometimes asked me how I felt in that moment, when the manhunt was over. I understand why a person would ask that question, but the main thing my honest answer reveals is the distance between the mind-set required to do my job and the mind-set of a person following the news. Psychologically, to manage a crisis like the Boston Marathon bombing response is an extreme exercise in compartmentalization. Whatever bolt of relief I felt at finding Dzhokhar, my life was actually no less complicated the minute he climbed out of that boat. The cloud of questions to be answered just got thicker. Where’s he going to go? Who’s going to talk to him? How are we going to talk to him? Can we ask questions before we give him his Miranda warning? When does he get presented to the judge? Do we do a bedside arraignment? Dzhokhar had been shot multiple times, including in the neck: So could he still even talk? The limit of the relief I allowed myself was, We’re not going to be doing this manhunt again tomorrow. But it was not as if this freed me up to lie on the sofa for a couple of days. I probably did get a good night’s sleep that night, for a change.
The Threat Page 16
