Are We to Believe Samir Khan’s Communications Were Used as a Tripwire, but Awlaki’s Weren’t?

You should read both the AP and OregonLive accounts of yesterday’s Mohamed Osman Mohamud trial for their description of the problems surrounding the FBI’s account of its early investigations of the teenager (not to mention its choice, when Mohamud’s drinking suggested he was abandoning his radicalism, they nudged him back into extreme views).

But for now I’d like to look at the account FBI Agent Issac DeLong gave of how they first started tracking Mohamud. From the AP.

DeLong’s testimony also revealed that FBI agents in the Charlotte, N.C., office tracking now-deceased al-Qaida operative Samir Khan were the first to identify Mohamud as a potential threat because of communication between the two.

The FBI was tracking Khan – who was killed in a drone strike with then-al-Qaida leader Anwar al-Awlaki – when they came across Mohamud’s emails to him in early 2009. They tracked down Mohamud’s IP address to a Portland suburb and identified him. When he cropped up on the bureau’s radar again, DeLong said he was able to rely on that information to identify Mohamud.

DeLong also said that a team of FBI agents followed Mohamud during his freshman year of college, monitoring his phone calls, text messages and emails, along with video and photo surveillance.

And from OregonLive:

Agents in Charlotte, N.C., picked up on Mohamud’s name in early 2009 while intercepting email traffic of then-U.S. based al-Qaida propagandist Samir Khan.

That August, FBI Special Agent Isaac DeLong was assigned to interview Mohamud’s father, Osman Barre, who feared Muslim extremists were radicalizing his son. Barre had read about Somali youths from Minnesota who were heading overseas to fight, and he worried his own son was trying to fly to Yemen to fight against the West, DeLong testified.

Barre agreed to speak to Mohamud and try to make sure he wouldn’t fly overseas. He took his son’s passport and reported back to the FBI that they had a chat.

“His father said that his son was not hiding anything,” DeLong said, “and there was nothing to worry about.”

But Barre followed up by forwarding to the FBI an email link he had received, DeLong said. It concerned a school in Yemen that his son hoped to attend. The correspondence contained the email address [email protected], which Mohamud had created in the United Kingdom, DeLong said.

The agent combed through the FBI’s storehouses of electronic data, finding that the address had been tied to the investigation of Samir Khan. He would learn that Mohamud had traded more than 100 emails with Khan beginning in February 2009 and that Mohamud had written articles for Khan under a pen name while a student at Beaverton’s Westview High School.

There are things that still don’t make sense about this narrative. At least from these accounts, it’s unclear whether the Charlotte discovery led to the Portland investigation, or whether the preliminary investigation out of Charlotte just served to make Mohamud’s father’s concerns more alarming.

And note this account still doesn’t jive with Hesham Abu Zubaydah’s claim that he had been told to track Mohamud at his mosque as early as 2008 (though we’re close enough in timeline that it’s possible they had Hesham track Mohamud after the Khan discovery, but before the formal investigation).

Moreover, note that the FBI delayed the Khan admissions until after the US had killed him, and turned over details of DeLong’s communications just weeks before the trial. The government tried to hide all of this earlier part of the narrative for a long time.

Mostly, though, I’m interested in how the FBI’s treatment of emails to Khan in early 2009 compared with its treatment of emails to Anwar al-Awlaki in that same period and earlier. From the Webster report, we know the FBI wasn’t prioritizing Awlaki emails in this period.

In fact, potentially radicalized people communicating with Awlaki were only incidentally tracked until after the [Nidal Hasan] attack(s) in 2009; the wiretap on Awlaki was not considered primarily a source of leads.

The report explains that when the Nidal Hasan emails were first intercepted the wiretap (which appears to have started on March 16, 2008) occasionally served as a “trip wire” identifying persons of potential interest. (Remember that bracketed comments are substitutions for redactions provided in the report itself.)

The Aulaqi [investigation] [redacted] also served as an occasional “trip wire” for identifying [redacted] persons of potential interest [redacted]. When SD-Agent or SD-Analyst identified such a person, their typical first step was to search DWS-EDMS [their database of intercepts] and other FBI databases for additional information [redacted]. If the [redacted] [person] was a U.S. Person or located in the U.S., SD-Agent might set a lead to the relevant FBI Field Office. If the information was believed valuable to the greater intelligence community and met one of the FBI’s intelligence-collection requirements, SD-Analyst would disseminate it outside the FBI in an IIR.

[snip]

On December 17, 2008, Nidal Hasan tripped the wire. (40-41)

But all of the “trip wire” leads that came from this wiretap up to this point were set as “Routine Discretionary Action” leads. (44) That’s how Hasan’s initial emails were also treated.

Now it’s possible that Mohamud’s emails were treated in the same way: the FBI went through the effort of identifying his IP, but once they had identified him they dropped the investigation. Though it doesn’t make sense that Mohamud’s writings for Khan would merit a big alarm later if they didn’t when they were written.

In other words, to the degree that the FBI’s story about Mohamud’s communication with Khan doesn’t make sense, it suggests the possibility that Khan’s communications were used a Tripwire in a way that Awlakis, during the same period, were not.

Tweet about this on Twitter0Share on Reddit0Share on Facebook0Google+0Email to someone

4 Responses to Are We to Believe Samir Khan’s Communications Were Used as a Tripwire, but Awlaki’s Weren’t?

  • 1
  • 2
  • 3
  • 4
Emptywheel Twitterverse
bmaz @JONF34 @mucha_carlos Well, unless she pays me to defend her, I might be good with that.
1mreplyretweetfavorite
emptywheel So will reading abt donor to KARL ROVE's PAC sniffing at what a "vile" campaign Trump is running. https://t.co/bYqxilzEs0
4mreplyretweetfavorite
emptywheel Story of GOP donors wailing bc $$ "is devalued currency in blustery, post-policy [Trump] campaign" will make you weep http://t.co/s5BMEjKPLl
5mreplyretweetfavorite
emptywheel Solving Yemen's crisis w/passive voice: “We believe more care needs to be taken to avoid civilian casualties.” http://t.co/v67XDt8GbJ
45mreplyretweetfavorite
emptywheel @onekade So I thought that it was possible someone had planted that.
50mreplyretweetfavorite
emptywheel @onekade I had speculated that it would be really easy to PLANT someone's name in Ashley Madison, bc there's no email verification.
50mreplyretweetfavorite
emptywheel @onekade Thought that same thought, but he did admit to it, right?
1hreplyretweetfavorite
bmaz @RMFifthCircuit I think Berman's decision sticks. But will wait to see briefing to make any definitive bet.
1hreplyretweetfavorite
bmaz @IanPGunn @WALLACHLEGAL @McCannSportsLaw @amilst44 @WerlySportsLaw yeah, crap, I had late Tuesday. What a dope I was.
2hreplyretweetfavorite
emptywheel Shorter billionaire owners: Goodell's witch hunt in name of "integrity of the game" makes us look like cheats. https://t.co/whPO04tnFh
2hreplyretweetfavorite
bmaz @RMFifthCircuit Though, there is a lot of new blood on the 2nd. Interesting to see if any are on the panel.
2hreplyretweetfavorite
emptywheel I wonder if NSA would let us know if someone broke into their 0day collection? Hahaha. Just kidding. https://t.co/TAdQe7yxyj
2hreplyretweetfavorite
January 2013
S M T W T F S
« Dec   Feb »
 12345
6789101112
13141516171819
20212223242526
2728293031