The Threat: How the FBI Protects America in the Age of Terror and Trump

by Andrew G. McCabe

sophisticated investigative authorities. You do not get to search warrants, you don’t get to subpoenas, you don’t get to listen in on a subject’s communications through a FISA or Title III court order, without people telling you what they know. And if you can’t credibly tell them that you will protect and conceal their identity if they are willing to go out on a limb, if they are willing to risk their own and their families’ lives and welfare—if they can’t trust that you will protect them—then they will not cooperate with you.

Discretion allows the FBI to generate human sources. Human sources build the credibility of this institution. No other U.S. agency has a pool of human sources bigger than that of the FBI. That is the true strength of this organization: the ability of its agents to go out into any part of this country, sit down with people, and get information from them in a lawful, constitutionally protected way. A person who is willing to have an ongoing relationship of this kind with an agent is...

And the Bureau’s goal would be not only to find out who is responsible for working with the enemy, but also to protect the campaign from the foreign influence that might be seeping into what they are trying to do.

the Federal Election Campaign

Act strictly regulates the participation by foreign nationals in U.S. elections and specifically prohibits the provision of money or anything of value. The FBI would open an investigation to protect the people who are involved in that political activity from malicious foreign influence. We assume the campaign is operating under good faith. We assume innoce...

It could be a good idea to start out by talking with people who have a history with other people in the campaign. So agents might go to those people and say, What do you know about this person? And have you heard anything about that? And if, in talking to those people, agents came across someone who had exposure to and knowledge about this person or that issue, or was in a position to find out, agents might say to the person, See if they know anything about this or that, and let us know what they say.

First, federal immigration services stopped all regular processes of deportation—no illegal aliens would be sent out of the country until the FBI cleared them of any connection to the 9/11 attacks. Second, at the same time, immigration enforcement became much more aggressive, particularly as it concerned Middle Easterners, than it had been on September 10. Attorney General John Ashcroft was blunt: “If you overstay your visa—even by one day—we will arrest you.” And third, hundreds of agents, not only in the New York area but all over the country, were processing leads generated out of the 9/11 case files, which were known as PENTTBOM and TRADEBOM.

All of a sudden, the U.S. was enforcing immigration laws in a way that it had not done for decades. Many, many people were picked up and thrown into deportation proceedings, which would not occur until they were cleared of any connections to terrorism. A massive logjam formed.

One day another agent came back from the Passaic County Jail. A man he had been interviewing had broken down in tears. Said that after 9/11 people called him horrible names and gossiped about bad things he was supposed to have done, things that he did not do. Called him a terrorist. Then he looked at the agent and said, I am Sikh. I’m not even Muslim.

People who work in counterterrorism are correct in making this point: The fact that 9/11 happened once does mean that something like it could happen again. And the fact that we should have seen it coming the first time—we could have seen it, and we didn’t—instills everyone involved in counterterrorism with a vigilance that manifests as dread and fear. Not a fear of bad things happening, but fear of missing something. A relentless second-guessing. People who take this threat seriously are more on edge than people who don’t.

The old tribal structure of the Bureau—criminal versus counterterrorism, knuckle-draggers versus pinheads—was blown away. Now we were all in it together.

Mueller was a Marine lieutenant commanding a platoon in Vietnam. He achieves change through force of will. It was not a relaxing experience for me to be told, You’re going to brief the director twice a day on this case, every day at 7 A.M. and 5 P.M. Mueller was also a prosecutor. He cross-examines you every time you’re in front of him. Ball-busting is his way of expressing affection.

He never went out of his way to insult anyone he didn’t actually like. He had strict habits and boundaries. Dress: blue suit, white shirt, red tie.

My section, ITOS-1, covering all cases involving Sunni extremists, had six units corresponding to geographic territories. Four units—called the CONUS units (“CONUS”

rhymes with “bonus”)—covered the continental United States. A fifth, the Arabian Peninsula Unit, also covered Iraq, Afghanistan, Pakistan, and Asia. The sixth, the Extraterritorial Investigations Unit—the ETIU—covered the rest of the world: Europe, Canada, Africa, South America, Eastern Europe, and Russia. I was the ETIU unit chief.

Counterterrorism is a tough job. The work is grueling, devouring nights and weekends. You operate with zero margin for error. Worse, merely by identifying someone as a threat, you and the FBI take responsibility for that threat. If a terror subject comes on my radar, and I investigate and find nothing, but five years later the su...

Despite those burdens, and also because of them, morale in counterterrorism units is high. I loved working there. After all their years of service, most agents look back on one division or squad or field office as having been their home in the FBI. For me, ITOS-1 was home. The section had tremendous camaraderie because everyone was toughing it out toge...

Regularity and accountability were the principles that drove our work. Meetings happened every day, rain or shine. And every day our section chief, Michael Heimbach, who ran ITOS-1, held us accountable. Mike Heimbach was the FBI’s answer to George Hamilton, the actor: chestnut tan, slicing smile, extremely expressive eyebrows. Heimbach’s management style involved a lot of laying down of dares. A standard Heimbach line was, It’s time to step up. In the daily morning briefing, we all got our heads screwed on straight so we could march forward in the right direct...

aegis.

legats

If he leaned forward, it was a very bad sign. Mueller leans forward only when frustrated. He gestures, taps his finger on the table. He points—he is a pointer. Also a hand tosser. He tosses his hands and sighs. If he leaned forward, looking at the chart, and then smacked the side of his hand against his head—then it was all over. Time to grab that stick and aim the plane back to the sky, because you are about to crash. When the hand hits the head, Mueller is not with you. Does not put faith in what you’re saying. Or is just not following. You have not communicated a good position effectively.

Cross-examination is one of Mueller’s most basic forms of human interaction, and it’s the vehicle for one of his most basic traits: curiosity. He loved to get down into the details and fire off questions one after another in a firm, clear, resonant, courtroom voice.

happened. There’s always a tension between the desire to keep collecting intelligence and the need to disrupt a plot before anyone

gets hurt.

That approach came with high costs. It cost human resources. We had to keep renewing FISA warrants, had to maintain and monitor electronic surveillance, had to keep translating what came off the surveillance, had to keep analyzing all the data. We weren’t even sure how to identify the point of diminishing returns. In the dance of collection and disruption, the art is sensing a delicate balance: the time when you’ve collected enough to understand the immediate threat—the subject you’re following or investigating—and also to understand the broader potential impact of that person and the person’s involvements. When you feel you’ve hit that point, you’ve got to be able to disrupt.

But in the Bush years, we erred heavily on the side of collection.

Collection and disruption roughly correlate with two parallel investigative approaches: muscling and targeting. Muscling drove the FBI’s post-9/11 drill of running every lead.

That, in a nutshell, was the FBI’s muscling approach to counterterrorism in 2006: If you tell me there’s a terrorist in California, I will go to California and look at every human being in the state. Muscling was driven by fear—the fear of missing something. Our biggest fear after 9/11 was that more people in the U.S. were connected to al-Qaeda or similar groups. That fear proved legitimate.

al-Qaeda was in fact metastasizing. Its members did want to strike us again. They did want to hit aviation. And they were quickly discovering the internet’s power as a tool for terrorist recruitment and planning.

The internet pervades human existence so thoroughly now that it can be hard to remember how recently life was mainly analog.

Terrorists were enthusiastic early adopters of every new technology. In 2006, when al-Qaeda launched a digital-media initiative, it pushed out more messages in one year than the group had released in the previous three years combined. The internet made it much, much easier for al-Qaeda, the Taliban, and susceptible Westerners to connect and share information with one another.

The FBI does not have the luxury of assessing whether people are fully capable of doing what they suggest they might do. If you are inclined to film yourself firing an AK-47 while hollering about jihad, and if you are taking affirmative actions in line with those sentiments, then you have cast the die and have set yourself up for investigation. It would not be a reasonable response to those situations if the FBI were to say, Well, this guy, he’s kind of dumb, so we’ll just leave him be—we only build cases on people who got good grades in high school. That would not be a wise or just process. But it’s the strange way some people suggest we should operate.

Many targeting techniques are based on access to and

organization of data. In truth, targeting isn’t that much easier than muscling, but its ambitions usually fall a little bit shy of muscling’s ideal of omniscience.

Targeting is the Bureau’s preferred mode of counterterrorism investigation today.

A turning point in the Bureau’s shift from muscling to targeting was Bryant Neal Vinas.

He let loose with all kinds of eye-opening intelligence about the process of affiliating with al-Qaeda, meetings with high-level al-Qaeda leadership, how he got there, and other Westerners he met along the way. From that we were able to take a closer look at people whom Vinas met and the people they knew. It was a giant leap in the evolution of the targeting process, much more efficient and less legally dubious than some of the earlier ideas that hypothetically might have made it onto the counterterrorism-division whiteboard—looking at every twenty-year-old who traveled to Pakistan last year, for instance.

His experience told us that al-Qaeda would talk to foreigners, as long as those foreigners were not on the radar of intelligence services as people who might be associated with terrorism. They wanted people who had “clean” passports—passports that would allow travel back to Western Europe or the U.S. without visas.

To recruit a person with a clean passport,

indoctrinate them, turn them around, and send them back—that’s their goal, an...

We are still shadowed by expectations that we should be muscling machines. Today, when we open an investigation on U.S.-based extremists, we are thinking from day one about disruption. From the first minute of collection, we are looking for things that could be used as evidence in some kind of criminal prosecution. Constantly thinking, What do we have on this guy? Is he a felon who happens to be in possession of a firearm? Did he lie to Customs and Border Protection last time he entered on his flight from Pakistan? When he’s not in the mosque, is he selling coke on the corner?

constantly building into the case a disruption strategy. We do that for two reasons. In case he’s a serious threat, or in case he’s no threat. In the first scenario, we consider disruption because flash to bang, the time between inspiration and action, tends to be quicker now. A suspect can be receiving instructions from Syria on his smartphone while he’s shopping at the grocery store—so we may need to

take him into custody immediately at any time. In the event that he’s not a serious threat, if no plot and no immediate risk develops, there will come a time when we realize that we have collected enough. There will come a time when we see that the guy doesn’t seem to have any true connections—sure, he’s following propaganda, he’s following Twitter feeds, but in reality he’s not talking to anybody overseas. He has a small number of friends here, but none of them seem to be interested in his supposed desire to blow up a bank or a restaurant. So we will just tak...

We learned a lot about targeting from our interactions with the Agency, just developing our relationship with them and reaping the benefits of their targeting activity.

In the FBI, the agent who opens a case or is the first assigned to a case owns that case, period. The case agent is king. Every case agent has a partner, a co–case agent, who lends a hand. But essentially the case agent is responsible for every aspect of the investigation for that case, from surveillance to warrants to evidence analysis to interviews.

In a typical case, such as a onetime bank robbery, handling the details is straightforward. A massive national-security case that involves multiple field offices, multiple search warrants, mountains of evidence, and thousands of pages of handwritten notes needing to be transcribed

can turn anyone into a one-armed paper hanger. It’s more than any one h...

Physical searches aren’t a whole lot simpler. And you never know when a demanding, complicated operation is going to suddenly get much more complicated.

Interviews raise all kinds of questions about technique. What should you show someone during an interview, if you want to confront them? You ask the suspect if he’s done something, he denies it, and you have a document, like a transcript of an intercept, in which he admits having done it.

Zazi made categorical denials in his interviews that we were later able to punch through, and he made statements that were absolutely devastating to him.