The Largest Security-Cleared Career Network for Defense and Intelligence Jobs - JOIN NOW

Military

Chapter IV: "That's Our Boy:" The FBI's Superficial Inquiry into Major Hasan Prior To The Attack

Hasan's public displays of radicalization toward violent Islamist extremism while on active duty reached a crescendo during the first year of his fellowship, the 2007-2008 academic year, after which his public displays ended. Yet his radicalization continued [REDACTED] during the second year of his fellowship, the 2008-2009 academic year, as he began communicating with the subject of an unrelated terrorism investigation, the Suspected Terrorist, [REDACTED]

The Suspected Terrorist was well known to the FBI as the subject of several investigations, including investigations by FBI JTTFs. [REDACTED] The current, third investigation is led by the JTTF in the FBI's San Diego Field Office, [REDACTED]. JTTFs are units in FBI field offices that conduct counterterrorism investigations, with one in each of the FBI's 56 field offices.97 JTTFs are staffed not only by FBI agents but also by government employees on detail ("detailees") from other federal agencies — such as agencies within DoD — and state and local goveniments.98 After 9/11, preventing terrorism domestically became the FBI's top priority, and a major FBI initiative involved increasing the number of JTTFs from thirty-five on 9111 to 106 in 2010.99 The FBI also created a National JTTF in 2002 to "manage" the JTTF program, to coordinate between the JTTFs and FBI headquarters,100 and to be a "point of fusion" for terrorism intelligence among JTTFs such as by coordinating terrorism projects involving JTTF intelligence collection.101

The San Diego JTTF was responsible for reviewing the [REDACTED]. Hasan's initial communication with the Suspected Terrorist sparked concern within the San Diego JTTF because it suggested that Hasan was affiliated with the U.S. military and sought the Suspected Terrorist's opinion [REDACTED]. DoD detailees at the San Diego JTTF checked a military personnel database and mistakenly concluded that Hasan was a military communications officer, not a military physician, by misreading "comm. officer" in Hasan's military file as referring to a communications officer rather than a commissioned officer. For operational reasons, the San Diego JTTF decided not to disseminate Ham's communications through normal intelligence channels [REDACTED]; instead, the San Diego JTTF decided to keep the information about Hasan solely within the JTTF structure. In the interim, the San Diego JTTF learned of another communication from Hasan to the Suspected Terrorist which should have raised counterintelligence concerns because it [REDACTED].

In lieu of sending a normal intelligence communication, the FBI agent at the San Diego JTTF [REDACTED] sent a detailed memorandum to the Washington, DC, JTTF on January 7, 2009. (Hasan was stationed at Walter Reed in Washington, DC, and therefore was in the investigative jurisdiction of the JTTF at the FBI's Washington, DC, Field Office.) The Washington JTTF had led the post-9/11 investigation into the Suspected Terrorist (the second of the three FBI investigations into that individual). Copies of that memorandum were also sent by that FBI agent to relevant agents in the FBI's headquarters-based Counterterrorism Division. The memorandum surveyed Suspected Terrorist's significance [REDACTED]. The memorandum included the content of Hasan's initial [REDACTED] communications and requested an inquiry into Hasan. The request was not a mandatory order for the Washington JTTF to investigate but rather a "discretionary lead," which was a type of lead that did not specify what if any actions the receiving JTTF should take. The FBI agent wrote in the memorandum that the communications would be problematic if Hasan indeed was a military communications officer.

On February 25, 2009 — more than six weeks after the January 7th memorandum from the San Diego JTTF — the FBI leadership at the Washington JTTF assigned the lead to a detailee from the Defense Criminal Investigative Service (DCIS). DCIS is the law enforcement arm of the DoD Office of the Inspector General, which is a semi-autonomous entity within DoD and responsible for investigating waste, fraud, and abuse such as in military procurements. DCIS is not a counterintelligence or counterterrorism agency. In contrast, each Military Service has its own counterintelligence agency or agencies, which also play a counterterrorism role. The Army, for example, has the Criminal Investigative Division for criminal matters and Army Intelligence and Security Command (including the 902nd Military Intelligence Group) for intelligence matters.102

The DCIS agent's FBI supervisor at the Washington JTTF did not specify any actions that the DCIS agent should take. The DCIS agent did not begin the inquiry until the last day of the standard ninety-day deadline for completing inquires based on discretionary leads. The inquiry was conducted, concluded, and summarized in a reply memorandum to the San Diego JTTF in four hours on a single day: May 27, 2009.

As later recounted in the reply memorandum to the San Diego JTTF, the Washington JTTF's focus was on whether Hasan was engaged in terrorist activities — not whether he was radicalizing to violent Islamist extremism. The DCIS agent in Washington queried the DoD personnel database and determined that Hasan was a military physician, not a communications officer. He also queried the FBI's investigative databases to determine whether Hasan had surfaced in any prior FBI counterterrorism or other investigations and found nothing. Finally, the DCIS agent obtained a series of routine personnel files from a DoD manpower center. These files included Hasan's annual Officer Evaluation Reports from 2004 to 2008. The Officer Evaluation Reports for 2007 and 2008 — the years in which Hasan's public displays of radicalization to violent Islamist extremism were most pronounced — praised his research concerning violent Islamist extremism as having potentially significant applicability to counterterrorism and recommended promotion to major. The records also indicated that Hasan was recently promoted to major. The only explicitly negative information in the files was Hasan's failure to pass fitness requirements. The DCIS agent believed it was relevant that Hasan had not tried to hide his identity [REDACTED] in his communications with the Suspected Terrorist, which the agent believed implied that the communications were legitimate research efforts.

The Washington JTTF's DCIS agent considered interviewing Hasan or his superiors and colleagues but decided not to do so for two reasons: First, the DCIS agent believed that, as the Hasan communications were an outgrowth of the San Diego JTTF's investigation of the Suspected Terrorist, the Washington JTTF needed to tread carefully to avoid disrupting that investigation [REDACTED]. The DCIS agent was concerned that interviews of Hasan's superiors and colleagues would cause that investigation to be revealed given that the DCIS agent believed that such officers would brief their superiors about the interviews. Second, the DCIS agent felt that interviews might jeopardize Hasan's career and thus potentially violate the requirement that FBI investigations use the "least intrusive means" possible.

The Washington JTTF's DCIS agent concluded that Hasan's communications were explained by the research described in the Officer Evaluation Reports into Islamic culture and beliefs regarding terrorism. He discussed his methodology, rationale for not conducting interviews, and conclusions with his FBI supervisor, who approved. Neither the DCIS agent nor the FBI supervisor contacted the San Diego .ITTF to discuss and validate these concerns, and there is no indication that they considered [REDACTED]. There is no indication that the DCIS agent and the FBI supervisor consulted any other officials within the FBI on whether disseminating the information on Hasan or taking additional investigative steps such as interviews would be precluded by law [REDACTED] or the FBI's Domestic Investigations Operations Guide. The DCIS agent then sent a memorandum — approved by his FBI supervisor — back to the San Diego JTTF, with copies to relevant FBI headquarters-based Counterterrorism Division personnel, describing his investigative process and results.

The FBI agent in San Diego who had asked the Washington JTTF to conduct the inquiry found the Washington JTTF's work to be "slim." The FBI agent was critical that the DCIS agent had not probed more deeply into Hasan's background and had not interviewed Hasan's superiors and colleagues or Hasan himself. In fact, the FBI agent even thought that Hasan might be a confidential human source of the Washington .ITTF given how superficial he believed the Washington JTTF's inquiry was. To avoid making the FBI "look like the heavy" vis-à-vis the DCIS agent, the FBI agent asked one of his DCIS detailee colleagues at the San Diego .ITTF to contact the DCIS agent at the Washington JTTF in order to register concern. That DCIS agent in San Diego tried to contact the DCIS agent in Washington by telephone but eventually sent an email instead to register concerns about the depth of the inquiry and the lack of interviews. The DCIS agent in Washington relayed the San Diego JTTF's concerns to his FBI supervisor, who reiterated his approval of how the inquiry had been conducted — including the decision not to interview Hasan's superiors and colleagues in order to avoid disclosing the San Diego JTTF's investigation of the Suspected Terrorist, [REDACTED]. Following this consultation, the DCIS agent in Washington responded by email and defended the decision not to interview Hasan or his superiors and colleagues in order to avoid revealing the investigation, [REDACTED]. The DCIS agent in Washington then asked the San Diego JTTF whether it could provide any evidence of terrorist links by Hasan or had requests for specific action.

A few days later, the FBI agent in San Diego talked again with the DCIS agent in San Diego and registered that he was upset with the Washington JTTF's response. The FBI agent asked him to place another call to the DCIS agent in Washington. The DCIS agent in San Diego claims that he did, although the DCIS agent in Washington denies that he received this call. (The FBI does not have records of telephone calls made from the San Diego JTTF.) The DCIS agent in San Diego recounts that he told the DCIS agent in Washington, "If the San Diego Division had received a lead like this on a similar Subject [e.g., an Army officer communicating to a subject of a terrorism investigation], the San Diego Division would have at least opened an assessment and interviewed the Subject." Nor did the FBI agent at the San Diego JTTF — who was responsible for [REDACTED] analyzing the communications — express any concern to the Washington JTTF about interviews of Hasan's superiors and colleagues [REDACTED].

Neither the San Diego nor the Washington JTTFs linked Hasan's first [REDACTED] communications — the communications that triggered the San Diego JTTF's January 7th memorandum to the Washington JTTF — with the [REDACTED] subsequent communications between Hasan and the Suspected Terrorist [REDACTED]. Indeed, the San Diego JTTF did not realize that the additional communications [REDACTED], and the Washington JTTF never learned of any of them.

[REDACTED]. The [REDACTED] database is not open to queries by all FBI or JTTF detailee personnel but rather by such personnel whom the FBI deems need the access in order to perform their job duties. FBI personnel and JTTF detailees without database access could only access [REDACTED] information [REDACTED] if it was forwarded to them by someone with access [REDACTED].

  • [REDACTED]. An analyst or agent looking at a communication would not automatically receive information concerning previous communications [REDACTED]. Instead, a communication could only be linked with previous communications [REDACTED] by agents' or analysts' memory or by the agents or analysts actively searching the database [REDACTED]. Thus the San Diego JTTF was prevented from easily linking Hasan's subsequent communications with his first [REDACTED] communications. In addition, the San Diego JTTF never linked Hasan's subsequent communications to his initial [REDACTED] communications either from memory or by actively running a database search under Hasan's name.
  • The San Diego JTTF believed that the relevant investigators at the Washington JTTF had access to the [REDACTED] database and would check it for subsequent communications when conducting the inquiry into Hasan. Yet the DCIS agent at the Washington JTTF leading the inquiry into Hasan lacked access to the [REDACTED] database which contained [REDACTED] communications and in fact did not even know that the database existed. The DCIS agent expected that the San Diego JTTF or FBI headquarters would send him any additional communications, as had happened to him in previous investigations.

The FBI agent at the San Diego JTTF never conducted any searches of the FBI's [REDACTED] database to find whether any additional communications between Hasan and the Suspected Terrorist had been missed by the Washington JTTF (building on the FBI agent's assumption that the Washington JTTF had such access). The FBI agent did not revisit his decision not to send a normal FBI intelligence communication containing Hasan's first [REDACTED] communications to DoD. There is no indication that the FBI case agent in San Diego shared the Washington JTTF's concern that field interviews would compromise the ongoing investigation [REDACTED]. He did not, however, formally request that the Washington JTTF conduct a more thorough investigation of Hasan including interviews of his superiors and colleagues that would not require an explicit description of the FBI's investigation of the Suspected Terrorist, [REDACTED] (e.g., by conducting field interviews under a pretext [REDACTED]; by using Army counterintelligence agents as a proxy [REDACTED]). Finally, the FBI agent did not elevate his concerns about the thoroughness of the Washington JTTF's efforts for resolution by FBI officials at more senior levels in the San Diego and Washington JTTFs or by the headquarters-based Counterterrorism Division or National JTTF.

Instead, the FBI's interest in Hasan ended. Hasan communicated with the Suspected Terrorist during the summer of 2009 [REDACTED], but the San Diego JTTF did not link any of the subsequent communications to Hasan's first [REDACTED] communications. Nor was the Washington JTTF provided with the additional communications. [REDACTED] months later — on November 5, 2009 — the attack at Fort Hood occurred, and Hasan was arrested at the scene, Shortly after the media began reporting on Hasan's attack at Fort Hood, the FBI agent told his DCIS colleague in San Diego, "You know who that is? That's our boy!"



97 - U.S. Department of Justice, Office of the Inspector General, The Department ofJustice's Terrorism Task Forces, at 16.

98 - Id., at 18. The FBI and other federal agencies refer to detailees to JTTFs as "task force officers."

99 - Federal Bureau of Investigation, Protecting America Against Terrorist Attack: A Closer Look at Our Joint Terrorism Task Forces, available at www.fbi.gov/page2/may09/jtffs_052809.html.

100 - Federal Bureau of Investigation, Protecting America: National Joint Terrorism Task Force Wages War on Terror, available at www.fbi.gov/page2/august/08/njttf_081908.html.

101 - The Department of Justice's Terrorism Task Forces, at 21-2. See Federal Bureau of Investigation, FBI Input to Intelligence Community "Calibration Report" Phase II (October 5, 2004), at 7 ("The mission of the NJTTF is to enhance communication, coordination, and cooperation by acting as the hub of support for the JTTFs throughout the United States, providing a point of fusion for intelligence acquired in support of counterterrorism operations.").

102 - For a review of DOD's counterintelligence organizations, legal authorities, and oversight, see Michael J. Woods and William King, "An Assessment of the Evolution and Oversight of Defense Counterintelligence Activities," in Journal of National Security Law and Policy vol. 3 (2009), at 169. An examination of the efficacy of the Army's organizational division between investigating criminal conduct versus counterintelligence is outside the scope of this report. For an analysis of this "anomaly," see Merle V. Bickford, The Organizational Anomaly of US Army Strategic Counterintelligence, Thesis for the U.S. Army Command and General Staff College (2003).



NEWSLETTER
Join the GlobalSecurity.org mailing list


One Billion Americans: The Case for Thinking Bigger - by Matthew Yglesias