You should read both the AP and OregonLive accounts of yesterday’s Mohamed Osman Mohamud trial for their description of the problems surrounding the FBI’s account of its early investigations of the teenager (not to mention its choice, when Mohamud’s drinking suggested he was abandoning his radicalism, they nudged him back into extreme views).
But for now I’d like to look at the account FBI Agent Issac DeLong gave of how they first started tracking Mohamud. From the AP.
DeLong’s testimony also revealed that FBI agents in the Charlotte, N.C., office tracking now-deceased al-Qaida operative Samir Khan were the first to identify Mohamud as a potential threat because of communication between the two.
The FBI was tracking Khan – who was killed in a drone strike with then-al-Qaida leader Anwar al-Awlaki – when they came across Mohamud’s emails to him in early 2009. They tracked down Mohamud’s IP address to a Portland suburb and identified him. When he cropped up on the bureau’s radar again, DeLong said he was able to rely on that information to identify Mohamud.
DeLong also said that a team of FBI agents followed Mohamud during his freshman year of college, monitoring his phone calls, text messages and emails, along with video and photo surveillance.
And from OregonLive:
Agents in Charlotte, N.C., picked up on Mohamud’s name in early 2009 while intercepting email traffic of then-U.S. based al-Qaida propagandist Samir Khan.
That August, FBI Special Agent Isaac DeLong was assigned to interview Mohamud’s father, Osman Barre, who feared Muslim extremists were radicalizing his son. Barre had read about Somali youths from Minnesota who were heading overseas to fight, and he worried his own son was trying to fly to Yemen to fight against the West, DeLong testified.
Barre agreed to speak to Mohamud and try to make sure he wouldn’t fly overseas. He took his son’s passport and reported back to the FBI that they had a chat.
“His father said that his son was not hiding anything,” DeLong said, “and there was nothing to worry about.”
But Barre followed up by forwarding to the FBI an email link he had received, DeLong said. It concerned a school in Yemen that his son hoped to attend. The correspondence contained the email address [email protected], which Mohamud had created in the United Kingdom, DeLong said.
The agent combed through the FBI’s storehouses of electronic data, finding that the address had been tied to the investigation of Samir Khan. He would learn that Mohamud had traded more than 100 emails with Khan beginning in February 2009 and that Mohamud had written articles for Khan under a pen name while a student at Beaverton’s Westview High School.
There are things that still don’t make sense about this narrative. At least from these accounts, it’s unclear whether the Charlotte discovery led to the Portland investigation, or whether the preliminary investigation out of Charlotte just served to make Mohamud’s father’s concerns more alarming.
And note this account still doesn’t jive with Hesham Abu Zubaydah’s claim that he had been told to track Mohamud at his mosque as early as 2008 (though we’re close enough in timeline that it’s possible they had Hesham track Mohamud after the Khan discovery, but before the formal investigation).
Moreover, note that the FBI delayed the Khan admissions until after the US had killed him, and turned over details of DeLong’s communications just weeks before the trial. The government tried to hide all of this earlier part of the narrative for a long time.
Mostly, though, I’m interested in how the FBI’s treatment of emails to Khan in early 2009 compared with its treatment of emails to Anwar al-Awlaki in that same period and earlier. From the Webster report, we know the FBI wasn’t prioritizing Awlaki emails in this period.
In fact, potentially radicalized people communicating with Awlaki were only incidentally tracked until after the [Nidal Hasan] attack(s) in 2009; the wiretap on Awlaki was not considered primarily a source of leads.
The report explains that when the Nidal Hasan emails were first intercepted the wiretap (which appears to have started on March 16, 2008) occasionally served as a “trip wire” identifying persons of potential interest. (Remember that bracketed comments are substitutions for redactions provided in the report itself.)
The Aulaqi [investigation] [redacted] also served as an occasional “trip wire” for identifying [redacted] persons of potential interest [redacted]. When SD-Agent or SD-Analyst identified such a person, their typical first step was to search DWS-EDMS [their database of intercepts] and other FBI databases for additional information [redacted]. If the [redacted] [person] was a U.S. Person or located in the U.S., SD-Agent might set a lead to the relevant FBI Field Office. If the information was believed valuable to the greater intelligence community and met one of the FBI’s intelligence-collection requirements, SD-Analyst would disseminate it outside the FBI in an IIR.
[snip]
On December 17, 2008, Nidal Hasan tripped the wire. (40-41)
But all of the “trip wire” leads that came from this wiretap up to this point were set as “Routine Discretionary Action” leads. (44) That’s how Hasan’s initial emails were also treated.
Now it’s possible that Mohamud’s emails were treated in the same way: the FBI went through the effort of identifying his IP, but once they had identified him they dropped the investigation. Though it doesn’t make sense that Mohamud’s writings for Khan would merit a big alarm later if they didn’t when they were written.
In other words, to the degree that the FBI’s story about Mohamud’s communication with Khan doesn’t make sense, it suggests the possibility that Khan’s communications were used a Tripwire in a way that Awlakis, during the same period, were not.