The Secret Sentry (35 page)

The War Ends

By late October 2001, it was clear to U.S. officials that U.S. combat troops were urgently needed on the ground in order to
defeat the Taliban and destroy the remnants of al Qaeda in Afghanistan. It was not until October 30, however, that a U.S.
Marine Corps MEU operating from ships in the Indian Ocean was ordered by CENTCOM to prepare for deployment to Afghanistan.
It would require more than three weeks to assemble and prepare the necessary combat units to execute this order.
⁴⁸

Much of the early SIGINT effort was focused on helping the Northern Alliance forces capture the key city of Mazar-i-Sharif
in northern Afghanistan. Finally, after two weeks of intense fighting, Mazar-i-Sharif fell to the Northern Alliance on November
10. With the fall of this city, the badly battered Taliban and al Qaeda military forces in northern Afghanistan quickly began
to crumble as the Northern Alliance forces drove rapidly southward. Four days later, the Afghan capital of Kabul fell to the
Northern Alliance without a fight. Soon after, the remnants of the Taliban military collapsed.

The day that Kabul fell, a radio intercept caught the Taliban’s leader, Mullah Omar, broadcasting a message from Kandahar
exhorting what was left of his troops to stand and fight, telling them, “I order you to obey your commanders completely and
not to go hither and thither. Any person who goes hither and thither is like a slaughtered chicken which falls and dies. Regroup
yourselves. Resist and fight . . . This fight is for Islam.”
⁴⁹

Such exhortations were in vain. Mullah Omar’s plea fell on deaf ears as American fighter-bombers decimated what was left of
the Taliban and al Qaeda forces fleeing Kabul. But mistakes occurred. On November 13, U.S. warplanes bombed a building in
Kabul thought to be a Taliban or al Qaeda headquarters. After the bombs completely leveled the building, a senior military
official recalled, “Some cell phone intercepts [contained] some excited or angry exchanges between Taliban and al Qaeda members”
indicating that one or more al Qaeda leaders had been killed in the building. U.S. officials later learned that the building
housed the Kabul offices of the al-Jazeera television network.
⁵⁰

By early December, SIGINT showed that there were few remaining organized Taliban and al Qaeda combat units still operating
inside Afghanistan. On the night of December 6–7, Mullah Omar disappeared from Kandahar and was not heard from again for some
time. U.S. intelligence later learned that he and his men managed to flee southward across the border into Pakistan, where
he remains to this day. The failure of the U.S. military to capture or kill Mullah Omar was to prove to be a major mistake,
one that we are still paying for with the lives of our soldiers in Afghanistan.
⁵¹

For the SIGINT personnel in Afghanistan, the fall of Kandahar, the birthplace of the Taliban, meant that the Taliban’s ill-conceived
attempt at waging a conventional war was over. Despite the failure to capture or kill Mullah Omar, the Bush administration
loudly and publicly declared victory. This proved to be a very premature statement. The Taliban not only survived, but has
actually thrived in the six years since the invasion of Afghanistan.

The Battle of Tora Bora

This didn’t mean that the war was over for the American SIGINTers in Afghanistan. Far from it.

After the fall of Kandahar, teams of Green Beret, Delta Force and Navy SEAL commandos, together with allied Afghan militiamen
on the U.S. payroll, began systematically combing the mountainous and sparsely populated southeastern part of the Afghan countryside
looking for Osama bin Laden and his fighters. Accompanying them were a half-dozen SIGINT collection teams, who systematically
searched the airwaves looking for any sign of bin Laden and his al Qaeda forces.
⁵²

These SIGINT teams belonged to some of the most secretive units in the U.S. military. There were teams of U.S. Navy Tactical
Cryptologic Support operators belonging to Naval Security Group Activity Bahrain, who were assigned to provide SIGINT support
to the elite commandos of SEAL Team Six. Working with the operators from the U.S. Army’s Delta Force was a squadron of highly
skilled SIGINT specialists from the five-hundred-man U.S. Army Security Coordination Detachment (formerly known as the Intelligence
Support Activity), based at Fort Belvoir, Virginia, outside Washington, D.C., whose unclassified nickname was Grey Fox.
⁵³

Bin Laden’s whereabouts were not a secret to the Pashtun tribesmen of southeastern Afghanistan. On November 13, he and his
forces left the city of Jalalabad in a convoy of Toyota pickup trucks just ahead of advancing American and Northern Alliance
forces and moved into prepared defensive positions in the Tora Bora mountains, thirty miles southeast of Jalalabad.
⁵⁴

The day after Jalalabad fell, a small CIA Jawbreaker intelligence team called Team Juliet, which was commanded by a Green
Beret officer seconded to the CIA, was sent to the city to enlist the help of the Northern Alliance militia commander who
had taken control of it, Hazrat Ali. A member of the Pashay tribe from northern Afghanistan, Ali willingly signed on and was
instantly put on the CIA payroll to the tune of several hundred thousand dollars in return for his promise to help find and
capture or kill bin Laden and his al Qaeda fighters.
⁵⁵

It did not take the CIA long to find bin Laden in his new stronghold along the border with Pakistan.
⁵⁶
The new intelligence prompted the United States to begin a series of major air strikes on Tora Bora on November 30. It also
prompted the U.S. Army to immediately begin planning a search-and-destroy operation to root out bin Laden and his fighters.
But rather than assigning the mission of destroying the al Qaeda force at Tora Bora to American combat units, General Tommy
Franks and Major General Franklin “Buster” Hagenbeck, commander of the Tenth Mountain Division and the senior army field commander
in Afghanistan, decided to give the job to the motley collection of Northern Alliance militiamen in Jalalabad commanded by
Ali. This would prove to be a grave military mistake. Ali, as one of his former Green Beret advisers put it, was “a disaster
waiting to happen.” His troops possessed very little in the way of demonstrable fighting ability. One thing that the CIA and
the Green Beret advisers clearly agreed upon was that Ali’s ragtag militiamen were going to need substantial American military
help if they were to be successful in clearing the Tora Bora mountains of bin Laden’s al Qaeda forces. On December 2, a twelve-man
Green Beret A-team, designated ODA 572, arrived in Jalalabad to support Ali’s attack on Tora Bora. The unit was ordered not
to engage in combat operations. Rather, its principal mission was to call in air strikes on al Qaeda positions in the mountains.
On board the MH-53 Pace Low helicopters that ferried ODA 571 to Jalal-abad was a four-man Green Beret SIGINT team, whose mission
was to collect intelligence and locate the source of the al Qaeda radio transmissions, then call in air strikes on the coordinates.
⁵⁷

It should come as no surprise that when it came time for Ali’s troops to attack the al Qaeda positions, the militia commanders
suddenly discovered a large number of different reasons why they could not advance despite repeated entreaties from their
Green Beret advisers. Ali’s locally recruited Pashtun militiamen were more willing to fight the Northern Alliance troops ferried
in by the United States than they were to clear the Tora Bora caves of al Qaeda fighters.
⁵⁸

On December 3, a CIA Jawbreaker intelligence team operating near the town of Gardez, in eastern Afghanistan, picked up the
first “hard” intelligence that bin Laden was in fact at Tora Bora. A U.S. Army Grey Fox SIGINT team near Gardez intercepted
some al Qaeda walkie-talkie radio traffic that confirmed he was personally leading the al Qaeda forces.
⁵⁹

Despite the accumulation of evidence from SIGINT, which was confirmed by interrogations of captured al Qaeda personnel after
the battle was over, senior Bush administration officials and CENTCOM officers adamantly refused to accept, probably as a
matter of political expediency, that bin Laden was ever at Tora Bora. The official view of CENTCOM, as voiced by the command’s
spokesman, was this: “We have never seen anything that was convincing to us at all that Osama bin Laden was present at any
stage of Tora Bora—before, during or after.”
⁶⁰

But General Franks’s version of events does not square with the facts. SIGINT coming out of NSA and intercepts collected by
frontline U.S. military intelligence units proved that bin Laden was indeed at Tora Bora. The official history of the U.S.
Special Operations Command indicates that U.S. Special Forces continued to collect hard “all-source” intelligence, most of
which was coming from SIGINT, that “corroborated” bin Laden’s presence at Tora Bora from December 9 through December 14, 2001.
Only after December 14 did the trail go dead, the official history indicates.
⁶¹

The most significant intercept of al Qaeda message traffic occurred on December 7, when one of Hazrat Ali’s commanders at
Tora Bora said, “We have intercepted radio messages from Kandahar to the Al Qaeda forces here, and they ask, ‘How is the sheik?’
The reply is, ‘The sheik [i.e., bin Laden] is fine.’ ”
⁶²

But despite repeated and increasingly urgent pleas from Ali’s Green Beret advisers, his Afghan militiamen refused to press
home their attacks.
⁶³
In retrospect, we should not be surprised that the militiamen, whose motivations were purely mercenary, did not aggressively
move in on the Tora Bora cave complex, or that bin Laden and his fighters somehow managed to escape through Ali’s lines without
being detected. In any case, the evidence is now clear that at some point prior to December 11, 2001, Osama bin Laden and
as many as eigh teen hundred of his fighters slipped away in the dead of night from the Tora Bora mountains and made their
way across the border to the safety of northern Pakistan.
⁶⁴
Regardless of who is responsible, bin Laden and over a thousand of his fighters managed to escape and are still on the loose
today.
⁶⁵

Amazingly, despite all the evidence to the contrary, the Pentagon refused to accept the assessments from commanders on the
ground that bin Laden was gone. Secretary of Defense Rumsfeld told reporters that he believed that bin Laden had not escaped
and was still trapped inside Afghanistan. On what factual basis (if any) Rumsfeld made this claim is not known, but it ran
completely contrary to the classified reporting that he and his staff were getting from Afghanistan at the time. This was
not the first time that the acerbic secretary of defense was to be proved wrong.
⁶⁶

By December 19, even the most optimistic “true believers” at the Pentagon and at CENTCOM headquarters in Tampa, Florida, knew
that the Tora Bora operation had been an abysmal failure. Captain Robert Harward, a veteran Navy SEAL and the commander of
the elite twenty-three-hundred-man U.S.-coalition Special Forces unit Task Force K-Bar, was quoted as saying after Tora Bora,
“All of this had got us nothing. No weapons, no ammunition, nothing.”
⁶⁷

But we now know that the failure to kill Osama bin Laden and destroy his al Qaeda forces at Tora Bora was a massive strategic
blunder by the White House, the Pentagon, and CENTCOM. Today, al Qaeda has reconstituted itself and is back in the business
of killing Americans whenever and wherever it can. Author and terrorism expert Peter Bergen neatly sums up the Tora Bora fiasco
this way: “Allowing Al Qaeda’s leadership to escape from Tora Bora and fight another day has proven to be a costly mistake.
And it was only the first of many.”
⁶⁸

CHAPTER 13

A Mountain out of a Molehill

NSA and the Iraqi Weapons of Mass Destruction Scandal

The greatest derangement of the mind is to
believe in something because one wishes it to
be so.

—LOUIS PASTEUR

The Hiatus

After the Battle of Tora Bora, there followed a six-month hiatus where the attention of the White House, the U.S. military,
and the entire U.S. intelligence community, including NSA, were largely focused on the hunt for Osama bin Laden and the remainder
of his al Qaeda forces in Afghanistan and Pakistan.

But while the U.S. military and intelligence community were focused on finding and killing bin Laden, they ignored a new threat
that was once again rearing its ugly head—the Taliban. Within a matter of weeks of the end of the Battle of Tora Bora, the
Taliban had managed to resurrect themselves across the border in northern Pakistan. After the fall of Kandahar in December
2001, between one thousand and fifteen hundred hard-core Taliban guerrillas, including their one-eyed leader Mullah Mohammed
Omar and virtually all of his senior commanders, slipped across the border to the safety of northern Pakistan. No attempt
was made by the U.S. Army or the Pakistani military to prevent their exodus from Afghanistan. Thousands more Taliban fighters
disappeared into remote mountain hiding places in southern Afghanistan, or returned to their villages to wait to fight another
day.
¹

A few weeks later, in mid-January 2002, SIGINT reporting coming out of NSA revealed that a relatively small number of Taliban
military commanders had returned to Afghanistan and were operating along the Afghan-Pakistani border. The intercepts showed
that the Taliban had reestablished a crude but effective communications system using satellite telephones, which allowed its
field commanders inside Afghanistan to communicate with their superiors in northern Pakistan. Within days of this discovery,
small teams of Taliban fighters began launching sporadic mortar and rocket attacks against U.S. military outposts in southern
and southeastern Afghanistan, as well as ambushing U.S. Army patrols operating along the Afghan-Pakistani border. By the end
of January 2002, U.S. intelligence reporting, including SIGINT, had confirmed that Taliban guerrillas were operating in seven
Afghan provinces.
²

Unfortunately, the reappearance of the Taliban was ignored by the Bush White House, which had already set its sights on Iraq.
So beginning in February 2002, and continuing without letup through the summer of 2002, just as Taliban guerrilla attacks
were on the rise inside Afghanistan, virtually all CIA and U.S. military intelligence assets (including SIGINT) were withdrawn
and sent back to the United States to prepare for the invasion of Iraq. Only a few tactical SIGINT collectors assigned to
the small army and marine contingents in Afghanistan remained to keep track of the Taliban and al Qaeda.
³

Operation Anaconda

The precipitous withdrawal of the CIA and U.S. military intelligence assets could not have come at a worse time. In February
2002, just as the withdrawal of intelligence commenced, a force of three hundred Afghan militiamen plus CIA and Green Beret
personnel left the sleepy town of Gardez in southeastern Afghanistan to reconnoiter reported al Qaeda positions in the nearby
Shah-i-Kot Valley. They were accompanied by a three-man Green Beret SIGINT team, whose job was to scan the airwaves searching
for any sign that the patrol’s movements had been detected by al Qaeda forces in the area. Near the village of Zer-mat, only
a few miles from the entrance to the valley, the SIGINT personnel picked up several walkie-talkie radio transmissions by individuals
speaking Arabic who were carefully noting the movements of the Green Beret convoy. The gist of one of the intercepted transmissions
was: “Where was the convoy headed?” Clearly al Qaeda fighters in the hills were closely monitoring the patrol’s movements
with the intention of ambushing it if and when the opportunity presented itself. The Green Beret patrol commander prudently
ordered the convoy back to the safety of Gardez. It was clear that the enemy was guarding the entrance to the valley.
⁴

A few weeks later, in early February, unmanned Predator reconnaissance drones discovered what appeared to be a small concentration
of al Qaeda forces in the Shah-i-Kot Valley. But SIGINT indicated that the size of the enemy force might be larger than the
drone’s imagery indicated, and the intercepts revealed that there were a number of senior al Qaeda commanders operating in
the valley, based on the number of satellite telephones detected sending and receiving messages from the valley floor. By
mid-February, the rising volume of SIGINT “hits” emanating from the valley indicated that the al Qaeda force there was being
reinforced with fresh troops coming across the border. The quantity and quality of the SIGINT, however, left much to be desired,
with the desultory number of intercepts indicating that the al Qaeda commanders knew their communications were being monitored.
⁵

That month, the commander of U.S. forces in Afghanistan, Major General Franklin Hagenbeck, despite the bitter lessons of Vietnam,
began planning a search-and-destroy mission to wipe out the enemy force. Operation Anaconda was supposed to have been a two-day
operation using a reinforced brigade of 1,500 troops drawn from the Tenth Mountain Division and the 101st Airborne Division.
At the time the operation was being planned, Hagenbeck’s staff thought there were only 150 to 200 al Qaeda fighters in the
valley. But once the operation began on March 2, 2002, the U.S. forces found themselves locked in a bitter battle with 2,000
entrenched and very determined al Qaeda fighters who would not retreat despite facing a superior force backed by airpower
and heavy artillery.
⁶

SIGINT could not save the day. Intercepts quickly tailed off because the al Qaeda forces in the Shah-i-Kot Valley “were practicing
systematic communications security,” which effectively denied American SIGINT operators access to enemy radio traffic. Another
major part of the problem was that the SIGINT intercept equipment, designed for use against Soviet forces in Western Europe,
was poorly suited for Afghanistan. The mountainous terrain also made SIGINT collection very difficult. Compounding the problem,
army SIGINT personnel had to somehow hump their heavy SIGINT intercept equipment up to the tops of the surrounding mountains
or hillsides in order to monitor what radio traffic could be picked up.
⁷

When Operation Anaconda finally sputtered to its unhappy conclusion on March 18, eight American and three Afghan soldiers
were dead and another eighty wounded. Equipment losses were much higher than expected. American commanders claimed that the
al Qaeda forces had suffered anywhere from eight hundred to one thousand dead, but no bodies could be found to support these
dubious claims. Hagenbeck later asserted that “few bodies had been found because they had been vaporized by the intense bombing
by U.S. B-52s.”
⁸

General Tommy Franks characterized Operation Anaconda as “an absolute and unqualified success.”
⁹
But it was a Pyrrhic victory at best because almost no prisoners were captured, as the al Qaeda fighters preferred to fight
to the death. The few documents that were captured offered little in the way of hard information about Osama bin Laden’s whereabouts
or details of al Qaeda’s strength and capabilities. The United States pulled out and the enemy moved back in. Ultimately,
nothing had been gained for all the effort.
¹⁰

Hunting al Qaeda

With the end of Operation Anaconda, the focus of the secret intelligence war against al Qaeda shifted to Pakistan, where the
NSA’s assets were few. Al Qaeda’s communications traffic had almost completely disappeared from the airwaves, and decrypted
Pakistani military and diplomatic communications did not prove to be a fruitful source of intelligence because the Pakistanis
themselves did not seem to know where bin Laden was or what he was up to. The CIA’s station in Islamabad, headed by Robert
Grenier, had some high-level phone taps and audio surveillance sources targeted against key Pakistani government officials,
but it does not appear that these sources were much help either.
¹¹

Ahmed al-Hada’s al Qaeda “switchboard” in Yemen, however, was still up and running. Many of the intercepted telephone calls
made through that hub were originating in Pakistan, where the remnants of bin Laden’s organization had gone to ground. So,
shortly after New Year’s Day 2002, NSA, the CIA, and the U.S. military put many of their best SIGINT collection assets into
Pakistan to try to locate the source of these al Qaeda phone calls.

But then disaster struck when NSA suddenly lost its access to al-Hada’s telephone traffic. The government in Yemen discovered
that al-Hada was a member of al Qaeda, and his house was immediately placed under surveillance, which was apparently detected.
On the evening of February 13, al-Hada, his wife, their son, and two unidentified men made an attempt to flee. Finally cornered
in an alley after a frantic car chase involving Yemeni security personnel, al-Hada’s son pulled a grenade from his jacket;
the grenade went off in his hand, killing him instantly. The rest got away. With his death, NSA lost its ability to exploit
his telephone calls, which was to prove to be an incalculable intelligence loss.
¹²

Despite the loss of the “Yemen switchboard,” NSA and the CIA managed to find a number of fugitive al Qaeda leaders hiding
in Pakistan, but not bin Laden. One of bin Laden’s top lieutenants, Abu Zubaida, was arrested in the Pakistani city of Faisalabad
on the night of March 27, 2002, after NSA intercepted a number of satellite phone calls, which CIA operatives inside Pakistan
used to locate his hideout.
¹³
Further SIGINT reporting led to the arrest in June in Morocco of al Qaeda’s Saudi-born chief of operations, Fowzi Saad al-Obeidi,
whose cover name within al Qaeda was Abu Zubair al-Haili.
¹⁴
The following month, intercepted phone calls enabled Pakistani security forces to arrest a thirty-three-year-old Kenyan named
Sheikh Ahmed Salim Swedan, who was wanted by U.S. authorities for his role in planning the 1998 embassy bombings in Kenya
and Tanzania.
¹⁵

On August 27, an NSA listening post intercepted a satellite telephone call placed from somewhere in Karachi, Pakistan, to
a known al Qaeda operative. NSA analysts who studied the translation of the phone conversation were not able to deduce much
of value.
¹⁶
On September 9, on an entirely unrelated matter, Pakistani security forces bagged three Yemenis after an extended exchange
of gunfire. One of them was Ramzi bin al-Shibh, who was well known to U.S. intelligence as one of the key al Qaeda planners
of the September 11 attack. The call that NSA had monitored coming out of Karachi two weeks earlier had come from his phone.
Subsequently, additional al Qaeda phones and laptops were found in Pakistan and eventually turned over to NSA. The telephone
numbers and e-mail addresses in the memories of the phones and laptops were downloaded and fed into NSA’s burgeoning databases
of numbers and addresses of known or suspected al Qaeda members, which were under full-time monitoring. Those telephone numbers
or e-mail addresses that were located in the United States were passed to the FBI for investigation.
¹⁷

Then in early November, NSA intercepted al Qaeda’s Yemen operations chief as he held a lengthy conversation on his satellite
phone while driving through the desert in the so-called Empty Quarter of eastern Yemen. Using the locational data provided
by NSA, a CIA unmanned Predator drone was immediately dispatched from Camp Lemonier in Djibouti to the location. The drone
quickly found the convoy just where NSA said it would be. The Predator fired a Hellfire missile at the lead vehicle, killing
the al Qaeda official instantly. Back at the Pentagon, Secretary of Defense Donald Rumsfeld was furious when he found out
that it was the CIA and not the U.S. military who had killed the official. “How did they get the intel?” Rumsfeld demanded
from the assembled chiefs of the Pentagon’s intelligence agencies. NSA director Michael Hayden admitted that the intelligence
had come from NSA. Rumsfeld’s reported response was “Why aren’t you giving it to us?”
¹⁸

The Focus Shifts to Iraq

In June 2002, NSA and the rest of the U.S. intelligence community turned their attention away from Afghanistan and al Qaeda
and toward a new target—Iraq. After U.N. weapons inspectors were forced out of Iraq by Saddam Hussein in 1988, NSA’s ability
to collect intelligence there deteriorated rapidly; all of the high-grade Iraqi radio traffic that the agency had been exploiting
since Operation Desert Storm in 1991 disappeared from the airwaves. In 1999, there were press reports about how the U.S. and
British intelligence communities had used the U.N. weapons inspectors to conduct sensitive SIGINT collection operations inside
Iraq, and analysts in NSA’s Signals Intelligence Directorate concluded that these had prompted the Iraqis to improve their
already superb communications security procedures.
¹⁹

In 1998 and 1999, the Iraqis began shifting most of the Iraqi Republican Guard and Regular Army’s radio traffic from the airwaves
to a network of one hundred thousand lines of modern fiber-optic cables connecting Baghdad with all of the major command centers
of the Iraqi army and air defense forces. The result was that by early 2001, the newly laid fiber-optic cables were depriving
NSA of most of the sensitive traffic formerly carried by radio.
²⁰
In February 2001, NSA persuaded the U.S. Air Force and the British Royal Air Force to send fighter-bombers to attack the network
as a means of forcing the Iraqis to resume radio communications. But the NSA SIGINT operators subsequently reported that there
was not much of significance to listen to coming from within Iraq.
²¹