The Secret Sentry (33 page)

The Taylor memo was the last straw for Hayden. Clearly his agency was in deeper trouble than he had believed when he took
the job, but he needed to know the full extent of the problem. In April 1999, he commissioned two management reviews on the
state of NSA; one he assigned to a number of the agency’s reform-minded Young Turks, who had chafed at the lack of action
under Minihan, while the second report was to be prepared by five outside experts. Both reports, handed to Hayden in October,
were scathing, with one concluding that NSA had become “an agency mired in bureaucratic conflict, suffering from poor leadership
and losing touch with the government clients it serves.” Hayden later told reporters, “The agency has got to make some changes
because by standing still, we are going to fall behind very quickly.”
⁷⁴

Hayden’s reformation and modernization plan, “100 Days of Change,” hit NSA like a tidal wave on November 10 with an announcement
to the entire NSA that “our Agency must undergo change if we are to remain viable in the future.” Hayden began by streamlining
the agency’s labyrinthine management structure, bringing in from the outside a new chief financial officer to try to reform
NSA’s financial and accounting practices and a veteran air force intelligence officer, Major General Tiiu Kera, to try to
improve NSA’s tense relations with the Pentagon. Overnight, the agency’s top priority became modernization, while its SIGINT
mission became the secondary priority. Money was taken from ongoing SIGINT operations and shifted to modernization projects,
with particular emphasis on redirecting NSA’s SIGINT effort against what Hayden described as the “digital global network.”
The bud get cuts hurt, forcing Hayden to tell his worried employees in January 2000, “I realize the business areas that we
decide to disengage from to pay for this transformation will be very important to many of you. I ask you to trust yourselves
and your management on the tough calls we must make this winter to survive and prosper as an Agency.”
⁷⁵

Hayden and his senior managers had hoped that they could keep the massive reengineering of NSA out of the public realm. But
these hopes were dashed when, on December 6, reporter Seymour Hersh published an article in the
New
Yorker
magazine that blew the lid off NSA’s secret, revealing that America’s largest intelligence agency was having trouble performing
its mission.
⁷⁶
Hersh’s article set off a furious debate within NSA about the difficulties the agency was facing. The considered judgment
of many NSA insiders was in many respects harsher and more critical than anything Hersh had written. Diane Mezzanotte, then
a staff officer in NSA’s Office of Corporate Relations, wrote, “NSA is facing a serious survival problem, brought about by
the widespread use of emerging communications technologies and public encryption keys, draconian budget cuts, and an increasingly
negative public perception of NSA and its SIGINT operations.”
⁷⁷

Less than sixty days later, another disaster hit the agency. During the week of January 23, 2000, the main SIGINT processing
computer at NSA collapsed and for four days could not be restarted because of a critical software anomaly. The result was
an intelligence blackout, with no intelligence reporting coming out of Fort Meade for more than seventy-two hours. A declassified
NSA report notes, “As one result, the President’s Daily Briefing—60% of which is normally based on SIGINT— was reduced to
a small portion of its typical size.”
⁷⁸

The Switchboard

Located on the strategically important southwestern tip of the Arabian Peninsula, Yemen is one of the poorest and least developed
nations in the world. Although the Yemeni government is dedicated to modernizing the nation, the deeply religious Yemeni people
remain firmly rooted in the past. For centuries, Dhamar Province, a mountainous region south of Yemen’s capital, Sana’a, has
been the home of the warlike and rebellious al-Hada tribe. One of its most prominent members was a man named Ahmed Mohammed
Ali al-Hada.
⁷⁹

Fiercely devoted to the ultraconservative Salafi interpretation of the Koran, al-Hada was steadfastly and vocally opposed
to any form of Western influence or presence in the Arab world. Yemeni security officials confirm that al-Hada fought with
the mujahideen against the Soviet military in Afghanistan during the 1980s, returning to Yemen in the early 1990s a fully
committed jihadi and a member of Osama bin Laden’s newly created al Qaeda organization. Both of al-Hada’s daughters married
al Qaeda operatives. One daughter was married to a senior operative named Mustafa Abdulqader al-Ansari. The other, Hoda, was
married to a Saudi named Khalid al-Mihdhar, who on 9/11 would lead the al Qaeda team that crashed a Boeing 757 airliner into
the Pentagon.
⁸⁰

Al-Hada’s principal function within al Qaeda since 1996 had been to serve as a secret communications cutout between bin Laden
and his military operations chief, Mohammed Atef, and the organization’s operatives around the world. Bin Laden and Atef would
call al-Hada’s house in Sana’a and give him orders that he was to convey telephonically to al Qaeda’s operatives in Europe,
Asia, and Africa, and al-Hada would relay back to bin Laden and Atef in Afghanistan the reports he got from the field. Records
of bin Laden’s satellite phone calls from Afghanistan show that he called al-Hada in Sana’a at least 221 times between May
1996 and the time that the Saudi terrorist leader stopped using his phone in October 1998.
⁸¹

U.S. intelligence first learned about al-Hada and his telephone number from one of the captured al Qaeda planners of the August
1998 East Africa bombings, a Saudi national named Mohamed Rashed Daoud al-’Owhali, who was arrested by Kenyan authorities
on August 12, 1998, five days after the bombing of the U.S. embassy in Nairobi. Interrogated by a team of FBI agents, al-’Owhali
gave up the key relay number (011-967-1-200-578)—the telephone number of Ahmed al-Hada.
⁸²

NSA immediately began intercepting al-Hada’s telephone calls. This fortuitous break could not have come at a better time for
the U.S. intelligence community, since NSA had just lost its access to bin Laden’s satellite phone traffic. For the next three
years, the telephone calls coming in and out of the al-Hada house in Sana’a were the intelligence community’s principal window
into what bin Laden and al Qaeda were up to. The importance of the intercepted al-Hada telephone calls remains today a highly
classified secret within the intelligence community, which continues to insist that al-Hada be referred to only as a “suspected
terrorist facility in the Middle East” in declassified reports regarding the 9/11 intelligence disaster.
⁸³

In January 1999, NSA intercepted a series of phone calls to the al-Hada house. (The agency later identified Pakistan as their
point of origin.) NSA analysts found only one item of intelligence interest in the transcripts of these calls— references
to a number of individuals believed to be al Qaeda operatives, one of whom was a man named Nawaf al-Hazmi. NSA did not issue
any intelligence reports concerning the contents of these intercepts because al-Hazmi and the other individuals mentioned
in the intercept were not known to NSA’s analysts at the time. Almost three years later, al-Hazmi was one of the 9/11 hijackers
who helped crash the Boeing airliner into the Pentagon. That al-Hazmi succeeded in getting into the United States using his
real name after being prominently mentioned in an intercepted telephone call with a known al Qaeda operative is but one of
several huge mistakes made by the U.S. intelligence community that investigators learned about only after 9/11.
⁸⁴

During the summer of 1999, intercepts of Ahmed al-Hada’s telephone calls generated reams of actionable intelligence. In June,
the State Department temporarily closed six American embassies in Africa after intercepted calls coming in and out of al-Hada’s
house revealed that al Qaeda operatives were in the final stages of preparing an attack on an unidentified American embassy
in Africa. By early July, intercepted al Qaeda communications traffic had revealed that bin Laden operatives were preparing
another operation, this time in Western Eu rope. Two weeks later, more intercepted calls coming from al-Hada’s house indicated
that bin Laden was planning to hit a major American “target of op-portunity” in Albania. As a result, planned trips to Albania
by Secretary of State Madeleine Albright and Secretary of Defense William Cohen were hastily canceled.
⁸⁵

On a now-ominous note, during that summer intercepted telephone calls coming into al-Hada’s home mentioned for the first time
a man referred to only as “Khaled.” No doubt this was a reference to 9/11 hijacker Khalid al-Mihdhar, who at the time was
living in al-Hada’s home along with his wife, Hoda. Because this was the first mention of “Khaled” in an al Qaeda intercept,
NSA did not report the information, as it could not be determined from the intercept who he was, much less whether he was
an al Qaeda operative. After 9/11, investigators learned that a few months after this call, al-Mihdhar caught a flight from
Sana’a to Islamabad, Pakistan, then crossed the border into Af-ghanistan to undergo a special terrorist training course at
al Qaeda’s Mes Ay-nak training camp, which was located in an abandoned Russian copper mine outside Kabul. Al-Mihdhar completed
the training course and returned to Yemen via Pakistan in early December 1999.
⁸⁶

In December 1999, NSA intercepted another series of telephone calls to al-Hada’s home in Sana’a, which revealed that an “operational
cadre” of al Qaeda operatives intended to travel to Kuala Lumpur, Malaysia, in early January 2000. The transcript of the intercepted
call identified only the first names of the team—“Nawaf,” “Salem,” and “Khalid.” Based on the context and wording of the conversation,
NSA analysts concluded that “Salem” was most likely the younger brother of “Nawaf,” which, as it turned out, was correct.
“Salem” was a Saudi national named Salem al-Hazmi, who was the younger brother of Nawaf al-Hazmi. A CIA analyst who reviewed
the transcript and accompanying NSA intelligence report surmised that “something more nefarious [was] afoot but did nothing
further with the report.”
⁸⁷

On January 15, 2000, two of the 9/11 hijackers mentioned in the NSA intercept, Khalid al-Mihdhar and Nawaf al-Hazmi, flew
into Los Angeles International Airport from Bangkok. Both men used their Saudi passports and visas, issued in their names
by the U.S. consulate in Jidda. They spent the next two weeks holed up in an apartment in Culver City, outside Los Angeles,
before renting an apartment at 6401 Mount Ada Road in San Diego.
⁸⁸

Two months later, on March 20, NSA intercepted a telephone call to al-Hada’s house from a man who identified himself only
as “Khaled.” Unfortunately, because of the technology in use at the time, the agency did not know that the call it was monitoring
had originated in the United States. NSA reported some of the contents of the intercepted call, but not all of the details,
because the agency’s analysts did not think that it was terrorist related. It was not until after the 9/11 attacks that the
FBI pulled al-Mihdhar’s telephone toll records and confirmed that the anonymous “Khaled” was none other than al-Mihdhar, who
was calling his father-in-law from his apartment in San Diego. A 2002 congressional report found that NSA’s inability to identify
the location of the caller was to prove disastrous because it would have confirmed “the fact that the communications were
between individuals in the United States and suspected terrorist facilities overseas.”
⁸⁹

In May and June 2000, NSA intercepted a number of additional telephone calls to al-Hada’s house from the anonymous “Khaled.”
As before, NSA could not identify the caller or his location. And because the calls dealt mostly with personal matters, the
agency did not report the content or even the substance of these conversations. Thanks to the spadework done by the 9/11 Commission,
we now know that the purpose of the call was for al-Hada to tell his son-in-law that his wife was expecting their first child.
Upon being told by al-Hada of the birth of his son in late May 2000, al-Mihdhar closed his San Diego bank account, transferred
the registration of his car to his colleague Nawaf al-Hazmi, and made reservations to fly home to Yemen. He apparently did
not bother to tell his boss in Afghanistan, al Qaeda operations chief Khalid Sheikh Mohammed, that he was abandoning his post
for purely personal reasons. Al-Mihdhar drove to Los Angeles on June 9 and took Lufthansa Flight 457 from Los Angeles International
Airport to Frankfurt the next day. He was not to return to the United States for more than a year.
⁹⁰

Despite NSA’s successes, it was only a matter of time before al Qaeda finally succeeded. On October 12, 2000, al Qaeda suicide
bombers drove a speedboat laden with high explosives into the U.S. Navy destroyer USS
Cole
as it lay at anchor in the port of Aden, Yemen, waiting to be refueled. Seventeen sailors were killed in the blast and another
thirty-nine wounded. On the same day that the attack on the
Cole
occurred, NSA issued an intelligence report based on intercepts (most likely calls coming in and out of Ahmed al-Hada’s home
in Sana’a) warning that terrorists were planning an attack in the region. However, the NSA warning message was not received
by consumers until well after the attack had taken place.
⁹¹

CHAPTER 12

Snatching Defeat from the Jaws of Victory 9/11 and the Invasion of Afghanistan

What you are prepared for never happens.

—PENNSYLVANIA DUTCH PROVERB

Zero Hour Is Near

President George W. Bush, who had been inaugurated on January 20, 2001, quickly became a devotee of NSA’s intelligence reporting
based on the briefings he had received before becoming president.
¹
What the president did not know was that the agency was struggling mightily to both modernize its decrepit infrastructure
and to meet the varied intelligence needs of its ever-growing clientele in Washington, with NSA analysts admitting, “they
had far too many broad requirements (some 1,500 formal ones) that covered virtually every situation and target.” Under these
adverse conditions, NSA just did not have enough manpower and equipment resources to devote to international terrorism. And
although terrorism had been NSA’s top priority since the August 1998 East Africa embassy bombings, the agency’s director,
General Michael Hayden, later admitted that he had at least five other “number one priorities,” and was unable to dedicate
sufficient personnel and equipment resources to terrorism. The lack of resources available to cover al Qaeda and other terrorist
targets was to come back to bite the agency in the months that followed.
²

Prior to the September 11, 2001, bombings, NSA intercepted a steadily increasing volume of al Qaeda messages indicating that
Osama bin Laden was about to launch a major terrorist operation against an American target. In late 2000, NSA intercepted
a message in which an al Qaeda operative reportedly boasted over the phone that bin Laden was planning a “Hiroshima” against
the United States. Most U.S. intelligence analysts concluded that the threat from al Qaeda was primarily to U.S. military
or diplomatic installations overseas, particularly in the Middle East and Persian Gulf.
³

Beginning in May and continuing through early July 2001, NSA intercepted thirty-three separate messages indicating that bin
Laden intended to mount one or more terrorist attacks against U.S. targets in the near future. But the intercepts provided
no specifics about the impending operation other than that “Zero Hour was near.”
⁴

In June, intercepts led to the arrest of two bin Laden operatives who were planning to attack U.S. military installations
in Saudi Arabia as well as another one planning an attack on the U.S. embassy in Paris. On June 22, U.S. military forces in
the Persian Gulf and the Middle East were once again placed on alert after NSA intercepted a conversation between two al Qaeda
operatives in the region, which indicated that “a major attack was imminent.” All U.S. Navy ships docked in Bahrain, homeport
of the U.S. Fifth Fleet, were ordered to put to sea immediately.
⁵

These NSA intercepts scared the daylights out of both the White House’s “terrorism czar,” Richard Clarke, and CIA director
George Tenet. Tenet told Clarke, “It’s my sixth sense, but I feel it coming. This is going to be the big one.” On Thursday,
June 28, Clarke warned National Security Advisor Condoleezza Rice that al Qaeda activity had “reached a crescendo,” strongly
suggesting that an attack was imminent. That same day, the CIA issued what was called an Alert Memorandum, which stated that
the latest intelligence indicated the probability of imminent al Qaeda attacks that would “have dramatic consequences on governments
or cause major casualties.”
⁶

But many senior officials in the Bush administration did not share Clarke and Tenet’s concerns, notably Secretary of Defense
Donald Rumsfeld, who distrusted the material coming out of the U.S. intelligence community. Rumsfeld thought this traffic
might well be a “hoax” and asked Tenet and NSA to check the veracity of the al Qaeda intercepts. At NSA director Hayden’s
request, Bill Gaches, the head of NSA’s counterterrorism office, reviewed all the intercepts and reported that they were genuine
al Qaeda communications.
⁷

But unbeknownst to Gaches’s analysts at NSA, most of the 9/11 hijackers were already in the United States busy completing
their final preparations. Calls from operatives in the United States were routed through the Ahmed al-Hada “switchboard” in
Yemen, but apparently none of these calls were intercepted by NSA. Only after 9/11 did the FBI obtain the telephone billing
records of the hijackers during their stay in the United States. These records indicated that the hijackers had made a number
of phone calls to numbers known by NSA to have been associated with al Qaeda activities, including that of al-Hada.
⁸

Unfortunately, NSA had taken the legal position that intercepting calls from abroad to individuals inside the United States
was the responsibility of the FBI. NSA had been badly burned in the past when Congress had blasted it for illegal domestic
intercepts, which had led to the 1978 Foreign Intelligence Surveillance Act (FISA). NSA could have gone to the Foreign Intelligence
Surveillance Court (FISC) for warrants to monitor communications between terrorist suspects in the United States and abroad
but feared this would violate U.S. laws.
⁹

The ongoing argument about this responsibility between NSA and the FBI created a yawning intelligence gap, which al Qaeda
easily slipped through, since there was no effective coordination between the two agencies. One senior NSA official admitted
after the 9/11 attacks, “Our cooperation with our foreign allies is a helluva lot better than with the FBI.”
¹⁰

While NSA and the FBI continued to squabble, the tempo of al Qaeda intercepts mounted during the first week of July 2001.
A series of SIGINT intercepts produced by NSA in early July allowed American and allied intelligence services to disrupt a
series of planned al Qaeda terrorist attacks in Paris, Rome, and Istanbul. On July 10, Tenet and the head of the CIA’s Coun-terterrorism
Center, J. Cofer Black, met with National Security Advisor Rice to underline how seriously they took the chatter being picked
up by NSA. Both Tenet and Black came away from the meeting believing that Rice did not take their warnings seriously.
¹¹

Clarke and Tenet also encountered continuing skepticism at the Pentagon from Rumsfeld and his deputy, Paul Wolfowitz. Both
contended that the spike in traffic was a hoax and a diversion. Steve Cambone, the undersecretary of defense for intelligence,
asked Tenet if he had “considered the possibility that al-Qa’ida’s threats were just a grand deception, a clever ploy to tie
up our resources and expend our energies on a phantom enemy that lacked both the power and the will to carry the battle to
us.”
¹²

In August 2001, either NSA or Britain’s GCHQ intercepted a telephone call from one of bin Laden’s chief lieutenants, Abu Zubaida,
to an al Qaeda operative believed to have been in Pakistan. The intercept centered on an operation that was to take place
in September. At about the same time, bin Laden telephoned an associate inside Afghanistan and discussed the upcoming operation.
Bin Laden reportedly praised the other party to the conversation for his role in planning the operation. For some reason,
these intercepts were reportedly never forwarded to intelligence consumers, although this contention is strongly denied by
NSA officials.
¹³
Just prior to the September 11, 2001, bombings, several Eu rope an intelligence services reportedly intercepted a telephone
call that bin Laden made to his wife, who was living in Syria, asking her to return to Afghanistan immediately.
¹⁴

In the seventy-two hours before 9/11, four more NSA intercepts suggested that a terrorist attack was imminent. But NSA did
not translate or disseminate any of them until the day after 9/11.
¹⁵
In one of the two most significant, one of the speakers said, “The big match is about to begin.” In the other, another unknown
speaker was overheard saying that tomorrow is “zero hour.”
¹⁶

A Day in Hell

On the morning of September 11, 2001, nearly twenty-two thousand NSA employees headed for the gates at Fort Meade to begin
their workday, which typically started at seven a.m. They faced delays at the gates because the army had recently restricted
public access to the base; security had been drastically tightened because of the recent spate of terrorist threats against
U.S. military installations. Only four gates were open full-time (with four more open part-time), which led to long lines
of cars waiting for clearance during the morning and afternoon rushes.
¹⁷

There was a second security cordon around what NSA calls the Campus, a massive complex of twenty-six separate buildings patrolled
by a 388-man NSA police force, plus an additional forty-nine buildings and warehouses used by NSA in the area surrounding
Fort Meade. This was the equivalent of thirty-four hundred four-bedroom homes jammed together into a single office complex.
Surrounding these buildings was the largest parking lot in the world.
¹⁸
General Hayden arrived in his office on the eighth floor of the Ops 2B building before seven a.m. The director’s office suite
was the envy of all NSA employees, with some staff members calling it “The Penthouse” because it was on the top floor. Not
only was the suite spacious and well appointed, but the view from Hayden’s windows, which faced eastward, was of one of Fort
Meade’s two tree-shaded eighteen-hole golf courses. As was his penchant, he immediately began going through his e-mails, then
turned to the large stack of reports and messages that his executive assistant Cindy Farkus had deposited in his in-box for
his perusal.
¹⁹

Elsewhere on the Campus, more than twenty thousand NSA employees were also plowing through their “Read File” of e-mails, cables,
reports, and raw intercepts that had come in overnight.

Then at eighty forty-six a.m. on that beautiful Tuesday morning, a Boeing 767 jet, American Airlines Flight 11 out of Boston’s
Logan International Airport, struck the north side of the North Tower of the World Trade Center between the ninety-fourth
and ninety-eighth floors.

Within minutes of the crash, all of the major network television and cable morning news shows had broken into their regularly
scheduled broadcasts to show their viewers the first dramatic pictures of the burning North Tower.

Nineteen minutes later, at five past nine a.m., while network news cameras carried the event live, another Boeing 767 commercial
jet, United Airlines Flight 175, lazily flew across the television screen and crashed into the South Tower of the World Trade
Center. It was obvious then that this was no accident, but the worst terrorist attack on U.S. soil in history. Everything
came to a stop as people gathered around TV screens and watched in horror as the Twin Towers collapsed. Those with family
or friends in New York City frantically began trying to reach them, only to discover that virtually all of the phone lines
along the East Coast of the United States were jammed with calls, quickly causing AT&T’s telephone circuits going in and out
of New York City to collapse under the strain.
²⁰

At nine ten a.m., five minutes after the second crash in New York City took place, Colonel Michael Stewart, the army base
commander of Fort Meade, ordered that his post be locked down and declared a Threat Condition Delta, the highest force protection
alert level in the U.S. military, which is used only in war time. No one was allowed to enter or leave the base without proof
that he or she worked or lived there.

Base public works crews quickly placed rows of three-foot-high concrete barriers in front of all of the closed gates to prevent
anyone from ramming their car through one of them. The Maryland State Police closed down a section of Route 32 that ran next
to the NSA headquarters complex, which caused a massive traffic jam.
²¹

At nine thirty a.m. Hayden ordered that all nonessential NSA personnel be sent home immediately and, as a security precaution,
that all remaining, mission-essential personnel be moved out of NSA’s two black-glass office towers into the older (and less
vulnerable) three-story-high Ops 1 office building next door. He then called his wife, Jeanine, at their quarters on base
and asked her to check on their three grown children, all of whom lived or worked in Washington. Before he could explain the
reason for his request, he had to hang up the phone as his staff poured into his office with the latest news bulletins.
²²

The planes crashing into the Pentagon and a deserted field in western Pennsylvania were the final outrages— 2,973 Americans
were dead, surpassing the death toll at Pearl Harbor on December 7, 1941.
²³

Within minutes of the crash, NSA’s internal emergency broadcast system was activated, and announcements began to be read out
over the agency’s public address system ordering all nonessential personnel to leave the base immediately. In a matter of
minutes, the first of thousands of NSA employees began leaving the Campus. Within a few hours, the streets of Fort Meade resembled
those of a ghost town.
²⁴

For the rest of the day, inside the NSA operations buildings a form of controlled chaos reigned. In room 3E099, on the top
floor of Ops 1, the duty officer began calling senior NSA officials who were still at home, on leave, or on the road on business
and ordering them to report back to work immediately. At the direction of Richard Berardino, the chief of the National Security
Operations Center (NSOC), NSA’s watch center, his thirty analysts and reporting officers began rapidly compiling whatever
information they could to brief Hayden and the agency’s senior officials about what had just transpired. Other NSOC staffers
began systematically going back over the past several days’ worth of SIGINT reporting to see if anything had been missed that
might have given any warning of the terrorist attacks. They found nothing.
²⁵