The Threat

by Andrew G. McCabe

  I was not the only one with limited energy for celebration. It was not long before the FBI was pilloried for waiting to issue its statement about having the Guardian on Tamerlan. We would be pilloried much more for having closed the Guardian to begin with—even though closing the Guardian was the only thing that made sense to do, under the legal system as it is—and probably under any legal system we would want to have. This was the backstory: In March 2011, the FSB, the Russian Federal Security Service, had told the FBI that Tamerlan and his mother, Zubeidat Tsarnaeva, ethnic Chechen immigrants to the U.S., held radical Islamic beliefs.

  We asked the FSB for more specifics, since we don’t investigate beliefs. We never got any more specifics. Russian disseminations were like that. You never knew exactly what you were getting. Could be a legitimate warning, or could just be the Russians trying to get us to track down someone for political reasons. The agents here did the best they could with what they had. They interviewed both mother and son, interviewed people who knew them, and conducted thorough background checks. None of that work raised questions of terrorism, much less the “articulable factual basis” necessary to open a full investigation. What else should the FBI have done? Every time a person of interest comes to our attention, should we be obligated to keep investigating that person forever? To do so would overstep the bounds of our legitimate authority. It would violate subjects’ privacy. It would waste FBI resources. The Boston Joint Terrorism Task Force opened more than a thousand Guardians in 2011 alone. It is not humanly possible to investigate everyone forever.

  Investigating everyone forever, though, seemed to be the only thing the FBI might have done that would have satisfied the congressional leadership, judging from the conversations that took place after the crisis had passed. Reviews of the investigation were initiated soon after the event and continued for at least three years. Many people to this day will say the Boston bombing was a failure on the FBI’s part. Whether you believe that reveals where you stand on the spectrum of a defining issue in counterterrorism: acceptance of risk. Counterterrorism involves risk. It involves trade-offs. Go too far in one direction—toward the all-seeing eye of a national-security state on a permanent war footing—and you undermine the rights and liberties we cherish as a nation. I wish the trade-off did not exist, but it does.

  After Boston, much misinformation circulated about our investigation. Congress devoted a great deal of energy to questioning how and when the FBI shared information with state and local partners—in the process displaying unrealistic expectations of how seamlessly information can ever be shared, and how equally all information can ever be weighed. To help manage these expectations, Mueller, Joyce, and I decided on a new communications strategy with Congress. We would make more effort to inform congressional leadership of the details on the front end of a crisis, in hopes that we could spend less energy correcting mistaken impressions on the back end. We began making personal telephone calls to the congressional leadership during the earliest hours after major incidents and following up with regular updates.

  We also decided that whenever we found ourselves in an analogous situation to the one we had with this Guardian, we would announce it right away. And we have been in similar situations a number of times. The best-known one occurred in 2016, when Omar Mateen, the shooter who killed forty-nine people at the Pulse nightclub in Orlando, turned out to have been the subject of a prior FBI investigation. Until or unless terrorism disappears from the world, or the U.S. becomes a surveillance state, the FBI will continue to open and close cases on a very small number of people who go on to do terrible things. But now, when the FBI finds out that this has happened, it takes us an hour to acknowledge the situation. There is no debate anymore.

  6

  Examination

  COLLECTIVE INSANITY AND THE CLINTON INVESTIGATION

  Always Sunny in the Caliphate

  About two weeks after the FBI’s first-ever crowdsourced manhunt, in Boston, the FBI launched a second crowdsourced manhunt. We released photos of three men from the Benghazi attack site, and we asked for the public’s help in identifying them. Also that spring, in Syria, a new name began emerging into prominence from the shuffle of schisms among extremist groups: ISIS, which is an acronym for “the Islamic State of Iraq and Syria.” Keeping track of ISIS would be part of my new job, as executive assistant director of the National Security Branch, overseeing all FBI work on counterterrorism, counterintelligence, weapons of mass destruction, and the HIG. The month I accepted that position, Edward Snowden, a onetime contractor for the National Security Agency—the agency primarily responsible for collecting and monitoring electronic communications—began to leak the vast trove of information he had stolen. For the better part of a year, as Snowden fled the country and sought safe haven elsewhere, the biggest part of my work would be managing the fallout from those leaks.

  The FBI’s Snowden problem had two dimensions: exposure and spoilage. His leaked documents brought counterintelligence under intense public scrutiny—not a situation in which counterintelligence thrives. Before Snowden, counterintelligence had always existed in a netherworld, right where it belongs. As a field of endeavor, it favors sheltered, quiet conditions and was rarely much discussed even internally. In presentations of the President’s Daily Brief and the director’s briefings, where the counterterrorism division was always under the gun, the counterintelligence division was almost never under the gun. Now, all of a sudden, because of Snowden, Mueller could not get enough counterintelligence. He brought out a twelve-gauge full of questions: Where is Snowden now? What is he telling the Chinese? What is he telling the Russians? What are we doing to get him charged? Have we figured out the full extent of what he took? How deep are we into the damage assessment? The assistant director of counterintelligence had never before looked down the barrel of Mueller’s questioning. He is the only person I ever saw come near to telling Mueller where to go.

  External exposure of those leaks caused more damage. For a year afterward, our division fought to defend capabilities we had relied on. The NSA made a desperate effort to save its bulk-data collection program under section 215 of the Patriot Act. Its ability to create a pool of metadata—not communications content—that could be queried with an individual search term upon a finding of reasonable suspicion was an important tool; we had just used it to analyze Tamerlan Tsarnaev’s phone records. The post-Snowden environment killed that capability and cast suspicion on all of the government’s lawful surveillance efforts. The White House ordered a full review of the intelligence community’s surveillance and national-security activities, and because the FBI is the most public and most outward-facing of those agencies—the broadest target in the intelligence community—we took more than our share of the criticism. It seemed as if our ability to pursue the mission of protecting national security, which requires us to be able to investigate terrorists and spies, was under assault not just by our most vocal critics but also by our most dependable supporters.

  The FBI’s biggest Snowden problem, though, had less to do with the information he took than with the way his actions reframed the relationships we had with technology companies and the work those relationships made possible. Overnight, the business model changed. Suddenly, everybody using the internet was newly focused on the security of their communications. Tech companies competed to position themselves as market leaders in terms of privacy. Marketing campaigns projected new images of these companies as defenders of liberty who would no longer freely support government intelligence or law-enforcement work. Tech companies framed their choice as moral or ethical. I saw the choice, frankly, as a bottom-line business decision. The cooperative relationships we had with these companies in the pre-Snowden world were suddenly a thing of the past.

  This was in the background during the year when ISIS entered the vanguard of violent extremism. ISIS produced the most seductively packaged, ostentatiously violent, technologically savvy terrorist propaganda I had ever seen. Their work ma
de the al-Qaeda magazine Inspire look as if it had been run off a ditto machine. They created videos with Hollywood production values, appealing to the range of audience demographics about as well as any mainstream media company. For believing strivers, there were jihadi-lifestyle-oriented infomercials, as enticing as the Home Shopping Network—It’s Always Sunny in the Caliphate. For isolated, unstable loners, there were splatter and snuff films—as gory as the most explicit scenes of violence in a big-studio action movie, but real. ISIS even had its own version of a breakout star: “Jihadi John,” an actual executioner, who gained a following in some quarters for his beheading videos. On the distribution side, ISIS was even more adept. The first group to make full use of social media, ISIS pushed propaganda to countless phones on the platforms of mainstream apps. Eventually the group learned how to monitor users’ interaction with content, assess an individual’s vulnerability to their message, and then contact them directly with IMs that dinged like any others: Hey, brother, reach out to me at this WhatsApp handle … From there, conversations would continue under end-to-end encryption that law enforcement has no power to surveil.

  In this period, the percentage of communications that law enforcement could not see began to grow. It has kept on growing. Widespread use of encrypted connections has been unambiguously good for online banking and consumer purchases on the web, but it has also created a danger, by staking out large swaths of the digital world that exist beyond the reach of any lawful court order. In the United States, that situation is unprecedented. In the U.S., there is no physical space that is beyond the reach of law enforcement. Americans have always acknowledged that if a judge determines there is probable cause, law enforcement can access any person or place in this country with the proper legal authorities: warrants issued under court oversight and executed with Fourth Amendment rights observed and respected.

  Now we cannot always do that with cyberspace. The makers of the encryption technology have brought about a state of affairs that they themselves cannot control. Or will not control. In 2016, after the San Bernardino shooting—when an American couple, inspired by ISIS, killed fourteen people and injured twenty-two at a public-health training event and Christmas party in California—I hoped that the FBI and Silicon Valley would negotiate a truce. I hoped that we would all be able to agree that, yes, it was important that law enforcement be able to have access to a phone that was carried by the man who helped to kill all these people. This was someone who had sufficient connections overseas that we couldn’t be sure he was not directed by a terrorist organization, and we wouldn’t be sure until we took a look at his communications devices. Apple, the maker of his phone, did not agree. Tim Cook, the CEO of Apple, made provocative statements: “The government is asking Apple to hack our own users and undermine decades of security advancements that protect our customers.” As if Apple were the only reliable guarantor of public safety. Really? But that’s the position the company took, and still takes.

  Law enforcement should never be allowed to unilaterally decide what sort of access we should have. But democratically elected representatives need to engage in a thorough and meaningful debate over questions like these: How are we going to balance privacy and security? Under what conditions should the government have access to private communications? What kinds of laws should we apply to data in motion (as it traverses our networks and lands on our devices) and what kinds should we apply to data at rest (in the server farms and data centers of the world)? We need to start having this conversation in some organized fashion. After San Bernardino, nobody on the Hill wanted to take the lead, though, because any choice might alienate some constituency.

  And also because people on the Hill were consumed by other distractions, such as Benghazi. Yes, still. Benghazi. Over a period of four years there were eight separate full-scale congressional investigations of the attack. The last one was conducted by the House Select Committee on Benghazi, chaired by Representative Trey Gowdy, of South Carolina. That committee’s appointment and hearings made big news for a long time; the next month, when the FBI collaborated with Defense on the capture of Ahmed Abu Khatallah, a ringleader of the Benghazi attack, the news seemed to come and go in a week. (In 2018, Khatallah was sentenced to twenty-two years in prison for his role in the attack.) The first Benghazi investigation, by the House Intelligence Committee, was just ending its second year of work when Jim Comey was sworn in as the new FBI director. That first committee’s report found no evidence of a cover-up, no evidence of wrongdoing by the president or the secretary of state, and no evidence that the Obama administration’s conflicting statements about the cause of the attack had been intentional. The findings of the next seven investigations of Benghazi revealed little more. I continued to be called to testify and brief Congress on Benghazi throughout those four long years. There were weeks when ISIS was posting videos to YouTube of Americans being beheaded, and I was being called to the Hill to testify about Benghazi yet again.

  Americans have freer access to more information than at any other time in the history of our country. What happened when we were let loose on that landscape of possibility? People raised their voices, louder all the time, and the boundaries of the landscape we had known wore down as volumes rose. The country started seeming like a village in a folktale under a spell, where the more the people see, the less they know.

  In Walked Jim

  September 2013: Entering his first morning staff meeting as FBI director, Jim Comey loped to the head of the table, put down his briefing books, and lowered his six-foot-eight-inch, shirtsleeved self into a huge leather chair. He leaned the chair so far back on its hind legs that he lay practically flat, testing gravity. Then he sat up, stretched like a big cat, pushed the briefing books to the side, and said, as if he were talking to a friend, I don’t want to talk about these today. I’d rather talk about some other things first. He talked about how effective leaders immediately make their expectations clear and proceeded to do just that for us. Said he would expect us to love our jobs, expect us to take care of ourselves … I remember less of what he said than the easygoing way he spoke and the absolute clarity of his day-one priority: building relationships with each member of his senior team.

  Comey continually reminded the FBI leadership that strong relationships with one another were critical to the institution’s functioning. One day, after we reviewed the briefing books, he said, Okay, now I want to go around the room, and I want you all to say one thing about yourselves that no one else here knows about you. One hard-ass from the criminal division stunned the room to silence when he said, My wife and I, we really love Disney characters, and all our vacation time we spend in the Magic Kingdom. Another guy, formerly a member of the hostage-rescue team, who carefully tended his persona as a dead-eyed meathead—I thought his aesthetic tastes ran the gamut from YouTube videos of snipers in Afghanistan to YouTube videos of Bigfoot sightings—turned out to be an art lover. I really like the old masters, he said, but my favorite is abstract expressionism.

  This hokey parlor game had the effect Comey intended. It gave people an opportunity to be interesting and funny with colleagues in a way that most had rarely been before. Years later, I remember it like yesterday.

  That was Jim’s effect on almost everyone he worked with. I observed how he treated people. Tell me your story, he would say, then listen as if there were only the two of you in the whole world. You were, of course, being carefully assessed at the same time that you were being appreciated and accepted. He once told me that people’s responses to that opening helped him gauge their ability to communicate. Over the next few years I would sit in on hundreds of meetings with him. All kinds of individuals and organizations would come to Comey with their issues. No matter how hostile they were when they walked in the door, they would always walk out on a cloud of Comey goodness. Sometimes, after the door had closed, he would look at me and say, That was a mess. Jim has the same judgmental impulse that everyone has. He is complicated, with many different
sides, and he is so good at showing his best side—which is better than most people’s—that his bad side, which is not as bad as most people’s, can seem more shocking on the rare moments when it flashes to the surface.

  That does not mean he is two-faced. No one’s words or actions are perfectly consistent over time. No one moves through life in a state of complete “transparency.” Anyone who believes that unfaltering transparency goes with the job of director of the FBI knows nothing about how power is exercised, much less how institutions of government function. Comey does have charm, and it is sincere. Upon arriving at the FBI, he used that quality to build a deeply affectionate sense of camaraderie, which was especially pronounced in his relationship with the deputy director, Sean Joyce. The relationship between the director and his deputy—the appointed head of the institution and the most senior special agent in the Bureau’s ranks—is complementary, and in the case of Comey and Joyce it was also very close. The director is like a CEO, managing external relationships and internal strategy, laying out the FBI’s ten-year plan, and inspiring the entire workforce to think about what happens to the Bureau over the long term. The deputy director is the action arm of the partnership, the executor, managing the FBI’s day-to-day operations and intelligence collection. From the time Comey arrived, there was no apparent barrier between him and Joyce. The director was always seeking authentic, almost raw, feedback. The deputy responded with what seemed like total candor. Comey thrived on that—with Joyce most of all, but with many others, too. Tell me what you really think, Comey would say in meetings, trying to tease out opinions and insights from everyone in the room, not just the same three people over and over again.