Chapter VI: Strengthening The FBI To Prevent Domestic Terrorist Attacks
The FBI has made significant strides since 9/11 in transforming itself into America's lead counterterrorism agency and an intelligence-driven organization to prevent terrorist attacks domestically, but it is clear from the Hasan case that the necessary transformation is incomplete. The Hasan case raises our concerns that the FBI headquarters exercised insufficient supervision and coordination of the FBI field offices and JTTFs and that the FBI has not utilized intelligence analysis as well as it could. The FBI's vision of JTTFs as being interagency information-sharing and operational coordination mechanisms is sound, but the Hasan case suggests that the JTTF model has not fulfilled the vision completely in practice. During our investigation of the Hasan case, we learned of a disagreement between the FBI and DoD regarding the JTTFs' functioning and that JTTF detailees lack access to key databases. As a result, we have concerns that the culture of JTTFs may be that they are FBI investigative entities, with detailees to JTTFs essentially serving as additional personnel to augment the FBI. The FBI should ensure that the JTTFs become full interagency information-sharing and operational coordination mechanisms. Otherwise, the JTTFs certainly will not achieve their full potential.
A critical fact discovered during our investigation which underlies these concerns is that neither the San Diego JTTF nor the Washington JTTF linked Hasan's first [REDACTED] communications — the communications that triggered the San Diego JTTF's January 7th memorandum to the Washington JTTF — with the subsequent [REDACTED] communications between Hasan and the Suspected Terrorist [REDACTED]. None of Hasan's communications indicated any overt plotting of terrorist attacks. A thorough investigation should have resulted even based on Hasan's initial communications, but even more so an analysis of the entirety of the communications, based on their content, certainly should have triggered a thorough investigation of Hasan including interviews of his superiors and colleagues. That intensive investigation would have significantly increased the likelihood that his communications would have been linked to his public displays of radicalization and would have caused him to lose his security clearance, been disciplined, and hopefully been discharged from the military. Instead, these communications were never linked, and the Washington JTTF investigation was concluded prematurely.
We note that this report is produced as the FBI begins to consider its next major leadership transition. Director Robert Mueller, who has led the FBI since shortly prior to the 9/11 attacks, is preparing to leave in September 2011 at the end of his statutorily fixed term of ten years. Director Mueller provided a bold vision for the FBI after 9/11 and instituted significant changes to achieve that vision. There is no question that the FBI has made substantial progress since 9/11 and has achieved many successes in countering terrorism as a result of his leadership. And change in any bureaucracy, and particularly a government bureaucracy steeped in a tradition that has produced numerous successes for a century, can unfortunately take significant time. But given the threat of homegrown terrorism that we face, we must be impatient for progress. We hope that our findings and recommendations will be particularly useful as Director Mueller seeks to reinforce the changes that he has instituted since 9111 and when a new director sets priorities for the FBI for the next decade to achieve Director Mueller's complete vision.
In sum, our conclusion is not that the FBI has made no significant progress in transformation. Rather, the Fort Hood attack was a warning that the FBI's transformation remains a work in progress and that the FBI must accelerate its transformation — particularly given the growing complexity and diversity of the homegrown terrorist threat. The challenges involve not just reforming or creating new institutions within the FBI but also ensuring that the FBI has the appropriate written policies and procedures, culture, and career incentives so that the new institutions operate as intended over the long term. In addition, to match Director Mueller's leadership, the FBI should ensure that a culture exists at all levels of the organization of continually assessing and improving current practices. We offer the following analysis in the spirit of working with the FBI to remedy its internal problems quickly and decisively so that its personnel can be as effective as they are dedicated.
A. FBI Transformation Begins After 9/11.
The FBI is the lead federal investigative agency for counterterrorism criminal investigations and intelligence collection within the United States.120 The FBI's efforts against terrorism began decades before the 9/11 attacks, including against Puerto Rican separatist groups, white supremacist groups, and animal rights activists as well as violent Islamist extremists. The FBI's counterterrorism efforts included the prosecutions concerning the first World Trade Center bombing in 1993 and — as described by the 9/11 Commission — the "brilliant" investigation into the bombing of Pan American Flight 103 over Lockerbie, Scotland, in 1988.121 The 9/11 attacks led the then-new FBI Director, Robert Mueller, to seek to transform the FBI's entire institutional and operational architecture.122 Immediately following 9/11, Director Mueller declared that the FBI's top priority was preventing domestic terrorist attacks123 and that the FBI needed to become an intelligence-centric rather than purely law-enforcement centric organization. As Director Mueller stated, "Today, we are focused on prevention, not simply prosecution. We have shifted from detecting, deterring, and disrupting terrorist enterprises to detecting, penetrating, and dismantling such enterprises — part of the FBI's larger culture shift to a threat-driven intelligence and law enforcement agency."124 And as stated by then-Attorney General Michael Mukasey in the Attorney General's Guidelines for Domestic FBI Operations, "The FBI is an intelligence agency, as well as a law enforcement agency. Its basic functions accordingly extend beyond limited investigations of discrete matters, and include broader analytic and planning functions."125 As evidence of his prioritization of counterterrorism, Director Mueller declared that no counterterrorism lead or threat would go unaddressed.126
The 9/11 attacks and the Iraq War led to two major independent examinations of the FBI's counterterrorism capabilities, the 9/1 1 Commission and an Executive Branch commission appointed by President George W. Bush concerning intelligence and weapons of mass destruction. Both commissions were critical of the FBI's intelligence and counterterrorism capabilities, including that the FBI relegated intelligence analysts to second-tier status behind its agents and was dominated by agents who prioritized winning convictions and devalued intelligence collection.127 Rather than recommending creation of a separate domestic intelligence service modeled loosely on Britain's MI5 agency, both commissions essentially recommended that the FBI create a so-called "agency within an agency" that would specialize in counterterrorism and related national security matters.128
As a result of Director Mueller's leadership and these outside commissions' recommendations, the FBI instituted a series of significant organizational changes designed to change the FBI into an intelligence-driven organization focused on preventing terrorism. To implement these changes, the FBI adopted a Strategy Management System based on the "Balanced Scorecard" commonly used in the corporate world and, with support from the prominent consulting company McKinsey & Co., created a Strategic Execution Team to execute organizational changes and to build support and momentum across the FBI.129 As discussed in Chapter IV, the FBI significantly expanded its JTTFs to be the major FBI operational units in countering terrorism domestically. In addition, the FBI created a Directorate of Intelligence in its headquarters to produce intelligence analysis and to provide an institutional home for its analysts. In an effort to create this so-called "agency within an agency," the FBI created a National Security Branch at its headquarters composed of its Counterterrorism and Counterintelligence Divisions and the new Directorate of Intelligence.130 The FBI also created a Field Intelligence Group at each of its field offices in order to provide intelligence analysis and support to agents.131 Finally, in furtherance of its efforts against the homegrown terrorist threat, the FBI recently launched a program at its headquarters to coordinate the assessment of the nature and extent of this threat. This program integrates analysts and other experts from the Intelligence Community, including DoD, and uses information lawfully obtained from websites and other online communication platforms in order to initiate and direct investigations.
The FBI also reoriented its investigative processes to reflect its desire to generate intelligence and to prevent domestic terrorist attacks. To be sure, intelligence and law enforcement are not complete opposites: Just as intelligence is desirable in order to prevent an attack, law enforcement is also oriented toward preventing a criminal act by intercepting the conspirators before they perpetrate their intended crime and even by engaging in community policing to make an area inhospitable to criminals. However, the challenge of melding intelligence and law enforcement involves two disciplines that have fundamental incompatibilities: Intelligence requires extrapolating from data to make conclusions and predictions, while law enforcement seeks to obtain evidence that will withstand scrutiny at trial. Also, intelligence may involve obtaining very specific information but may also involve amalgamating diverse data to spot trends, while law enforcement is generally case-specific.
Thus, when the FBI uses the term "intelligence-driven," the FBI cannot be referring simply to using intelligence as a trigger for law enforcement, investigative activity; the use of intelligence as a trigger for law enforcement should be a given. Instead, the point of being an "intelligence-driven" organization is that the production of intelligence is a preeminent objective, separate from whether a prosecution occurs, and that the collection and analysis of information are not tied to specific cases that are being investigated for prosecutorial purposes. As described in a Harvard Business School case study on the FBI:
A critical aspect of [Director Mueller's] envisioned FBI was that it would be intelligence-led: Analysis would identify leading threats and vulnerabilities pertinent to each field office as well as gaps in the FBI's knowledge about those threats and vulnerabilities. FBI agents would then have to develop informants, collect data, conduct surveillance, and so on to fill the gaps. In many instances, analysts might direct the activities of special agents. An intelligence-led, threat- based FBI would try to reconcile tensions between intelligence and law enforcement by applying intelligence techniques to law enforcement activities. Some FBI officials saw this as a radical departure in practices. Others argued that the FBI had long operated in this way — for instance, in battling the ... mafia in New York by identifying, infiltrating, and prosecuting five central crime families.132
One example of the FBI's reorientation to become intelligence-driven was enabling counterterrorism investigations to serve both intelligence and law enforcement purposes simultaneously. Prior to 9/11, the FBI classified its terrorism investigations as either criminal ([REDACTED]) or intelligence ([REDACTED]).133 After 9/11, the FBI consolidated these two codes into a single code for counterterrorism investigation ([REDACTED]), which has as its primary purpose "developing intelligence regarding the subject or the threat."134
The most significant example of such reorientation was the creation by Attorney General Mukasey's 2008 Attorney General's Guidelines for Domestic FBI Operations of a three-tiered system for FBI investigations. That three-tiered system was then reflected in the FBI's issuance of a revised Domestic Investigations Operations Guide in December 2008. Previously, the FBI would not conduct investigative activity absent sufficient factual predication that a crime was being or had been committed. However, intelligence collection required that the FBI be able to assess the potential threat associated with an individual or situation even if it lacked sufficient factual predication to initiate an investigation of a specific crime.135 As a result, the three-tiered system for FBI investigations begins with the least-intrusive "assessment," then progresses to a "preliminary investigation" in which more intrusive tools could be used, and finally permits a "full investigation" in which the full panoply of FBI investigative techniques (such as wiretapping) could be used. As discussed in the revised Guide, an "assessment" is permitted even when there is "no particular factual predication" that a crime is being committed and instead based on an "authorized purpose" such as "to detect, obtain information about, or prevent or protect against federal crimes or threats to the national security or to collect foreign intelligence."136 Also as discussed in the Guide, investigations or assessments are precluded —appropriately — "based solely on the exercise of First Amendment protected activities or on the race, ethnicity, national origin or religion of the subject."137
As discussed in Chapter II, the FBI has experienced successes in disrupting several serious plots even as the threat of homegrown violent Islamist extremism has risen sharply in recent years. The 2009 disruption of a terrorist plot by Najibullah Zazi is one of the most prominent examples of the FBI's successes against terrorist plots and according to the FBI is illustrative of its progress in becoming intelligence-driven. Based on a series of frantic communications from Zazi to his al Qaeda handler regarding bomb instructions, the FBI, working with other agencies, unraveled and prevented a massive attack on the New York City subway system. The coordination across federal, state, and local departments, led by two JTTFs, was excellent and unprecedented.
B. The FBI's Inquiry Into Hasan Was Impeded By Division Among Its Field Offices, Insufficient Use Of Intelligence Analysis, And Outdated Tradecraft.
The FBI has made substantial strides since 9/11 in reorganizing itself and reorienting its investigative processes to generate intelligence and ultimately to prevent domestic terrorist attacks. The FBI has been successful in disrupting many terrorist plots. However, the Fort Hood case suggests that the FBI's transformation to become an efficient and effective intelligence- driven organization focused on preventing domestic terrorist attacks is unfinished. The creation of new institutions within the FBI sometimes has not been accompanied by clear business processes that articulate these new institutions' responsibilities and authorities within the FBI.
As a result, these new institutions may not have achieved the transformation of the FBI that was desired.
1. The Hasan inquiry was plagued by disjunction between two field offices and the lack of coordination by FBI headquarters.
Counterterrorism-related activities at FBI field offices are today more effectively managed and coordinated than they were on 9/11, but the Hasan case suggests that the FBI remains too divided among its 56 field offices and thus among the JTTFs (with each field office housing a JTTF). In the Hasan case, the San Diego and Washington JTTFs (located at the San Diego and Washington Field Offices, respectively) operated with a counterproductive degree of individual autonomy — that is, with inadequate coordination and communication. This situation was coupled with the FBI headquarters' and National JTTF's lack of involvement in resolving the dispute between these JTTFs. As a result, we are concerned that seams among multiple field offices, among JTTFs, and between operational and intelligence-related components may not be methodically identified and fixed by a central management structure.
Although headquartered in Washington, DC, the FBI's organizational center of gravity has predominantly been its field office structure, with fifty-six field offices spread throughout the United States and generally located in major cities. Each field office is headed by a Special Agent in Charge or, for some of the larger field offices, an Assistant Director in Charge. The FBI's decentralization among field offices dates back as far as Director J. Edgar Hoover, who led the FBI from 1924 to 1972.138 Former Attorney General Richard Thornburgh described the FBI organization as "decentralized management of localized cases,"139 and one noted expert in the U.S. national security system's organization commented, "It is fair to say that when the Cold War ended, the FBI was less a single agency than a system of fifty-six affiliated agencies, each of which set its own priorities, assigned its own personnel, ran its own cases, followed its own orders, and guarded its own infonnation."140 Field office autonomy was reinforced by Director Louis Freeh during his tenure from 1993 to just prior to 9/11, during which he decentralized operations, pushed headquarters staff to the field (a move praised at the time, as it included forcing individuals whose skills were eclipsed by the end of the Cold War to learn new operational skills), and caused the heads of the field offices to gain in power and independence.141
Field office autonomy made particular sense for law enforcement activities in which a field office would coordinate closely with prosecutors in the local U.S. Attorney's Office. Still, field office autonomy did impact even law enforcement activities; as the 9/11 Commission noted, "Field offices other than the specified office of origin [i.e., the office responsible for a particular case] were often reluctant to spend much energy on matters over which they had no control and for which they received no credit."142 Even more so, the high state of decentralization within the FBI was a major factor in the FBI's portion of the U.S. Government's failure to prevent the 9/11 attacks. This issue was highlighted by Congress's post-9/11 inquiry into the associated intelligence failures. As the Congressional Joint Inquiry concluded:
Numerous individuals told [the Joint Inquiry] that the FBI's 56 field offices enjoy a great deal of latitude in managing their work, consistent with the dynamic and reactive nature of its traditional law enforcement mission. In counterterrorism efforts, however, that flexibility apparently served to dilute the FBI's national focus on Bin Ladin and at Qaeda. Although the FBI made counterterrorism a "Tier One" priority, not all of its field offices responded consistently to this FBI Headquarters decision. The New York Field Office did make terrorism a high priority and was given substantial responsibility for the at Qaeda target following the first attack on the World Trade Center in 1993. However, many other FBI field offices were not focused on a] Qaeda and had little understanding of the extent of the threat it posed within this country prior to September 11.143
* * *
In 1999, the FBI received reports that another terrorist organization was planning to send students to the United States for aviation training. The purpose of this training was unknown, but [terrorist] leaders viewed the plan as "particularly important" and reportedly approved open-ended funding for it. An operational unit in the Counterterrorism Section at [FBI] Headquarters instructed 24 field offices to pay close attention to Islamic students from the targeted country engaged in aviation training. ... There is no indication that field offices conducted any investigation after receiving the communication. ... The former chief of the operational unit involved in this project told the Joint Inquiry that he was not surprised by the apparent lack of vigorous investigative action by the field offices. The FBI's structure often prevented Headquarters from forcing field offices to take investigative action that they are unwilling to take. The FBI was so decentralized, he said, and Special Agents in Charge of field offices wielded such power that when field agents complained to a supervisor about a request from Headquarters, the latter would generally back down.144
Since 9/11, the FBI has made progress in seeking to improve coordination among its field offices within an overall strategic framework. For example, the FBI has forced priorities onto its field offices, ensuring the preeminence of counterterrorism, and rates them in terms of their knowledge of the threats in their respective domains. Organizationally, the FBI established four Executive Assistant Director positions to strengthen central management of the FBI. As previously mentioned, the FBI also mandated that field offices create Field Intelligence Groups to serve as the "lens through which field offices identify and evaluate threats"145 and "the hub of the FBI's intelligence program."146 FBI headquarters did not originally provide a template for these groups, leading each field office to create a different version, but the FBI eventually standardized these groups across the field offices.147
Although progress in achieving greater integration across field offices has been made, the lack of effective communication between the San Diego and Washington JTTFs is evidence that the two field offices operate in a climate in which field office autonomy is still prized. The San Diego JTTF characterized the lead on Hasan as "discretionary" to the Washington JTTF but did not provide clear guidance for how the Washington JTTF should proceed. No one from the San Diego JTTF followed up with the Washington JTTF to discuss the original memorandum or the progress of the Washington JTTF's inquiry into Hasan. Simultaneously, no one from the Washington JTTF reached back to the San Diego JTTF to discuss the lead and to seek any further information or clarification. Such a clarification of the San Diego JTTF's request for an
inquiry was particularly appropriate given that, as the San Diego JTTF noted in its memorandum, Hasan's communications did not indicate any overt terrorist activity. Since the Fort Hood attack, the FBI has abolished the term "discretionary lead" due to its ambiguity; instead, a communication from one field office to another states whether it is for either "information only" or "action required."148 Still, even if the San Diego JTTF's communication to the Washington JTTF had called for mandatory action and not used the vague "discretionary lead," the San Diego JTTF could not have compelled the Washington Field Office to take any specific action.
Critically, there was a complete disjunction between the San Diego JTTF's and the Washington JTTF's understanding of the DCIS agent's access to the [REDACTED] database. The San Diego JTTF believed that the DCIS agent had access to that database and would conduct due diligence by querying it for additional information. In contrast, the DCIS agent lacked knowledge of and access to it and thought that the San Diego JTTF would send him any additional communications. As a result, Hasan's subsequent communications were never linked by either JTTF to his first [REDACTED] communications.
When the Washington JTTF provided its assessment back to the San Diego JTTF several months later and the San Diego JTTF disagreed as to the adequacy of the underlying inquiry, there was no attempt by these JTTFs to negotiate a resolution beyond an apparent telephone call between the DCIS agent in San Diego and the DCIS agent in Washington.
- The DCIS agent at the Washington JTTF did send an email to the DCIS agent in San Diego stating that the Washington JTTF would reassess its position if the San Diego JTTF sent any additional information concerning Hasan's links to terrorism or requested any specific action. However, as indicated in that email, the DCIS agent in Washington missed that the purpose of the inquiry if it had been intelligence-driven — should have been not just to find any current terrorist links but also to assess whether Hasan was radicalizing to violent Islamist extremism and might become a counterintelligence threat by virtue of him holding a security clearance and potentially being deployed to a combat zone. In addition, the Washington DCIS agent's email ignored the fact that the San Diego JTTF had essentially recommended interviews of Hasan's superiors and col leagues.
- In turn, the San Diego JTTF never reconsidered its decision not to send a normal FBI intelligence communication to DoD with Hasan's first [REDACTED] communications, an idea that the San Diego JTTF had discarded after erroneously concluding that Hasan was a military communications officer. Equally, there was no attempt by the San Diego JTTF to resolve the issue by confrontation or escalation. The FBI agent at the San Diego, JTTF did not provide a formal request to the Washington JTTF for specific action, contact the FBI supervisor in the Washington JTTF directly, or elevate the issue further to senior officials in each field office and, as needed, to the headquarters-based Counterterrorism Division or the National JTTF. The San Diego JTTF's failure to issue a formal request for action or to elevate the matter was particularly problematic given that the San Diego JTTF — the office responsible for investigating the Suspected Terrorist with whom Hasan had communicated — essentially recommended interviewing Hasan's superiors and colleagues despite the Washington JTTF's belief that such interviews would compromise the investigation, [REDACTED].
Although the FBI's headquarters plays a substantial role in what it considers to be the highest priority terrorism cases, it played no role in the inquiry concerning Hasan. Several officials within the headquarters-based Counterterrorism Division were copied on the inter-field office correspondence related to Hasan, but at no point did anyone at that Division take action to encourage additional or more urgent efforts to examine Hasan — for example, given that at the time the FBI believed that Hasan was a military communications officer. Nor was the Counterterrorism Division informed by the San Diego or Washington JTTFs of the dispute concerning the adequacy of the Washington JTTF's inquiry. The National JTTF also was not informed of this inquiry into Hasan or the dispute between the field offices — even though, by the FBI's own characterization, the National JTTF is intended to coordinate JTTFs as their "hub" and particularly when other agencies' equities (such as DoD's in this case) are involved.149 Had either or both of the Counterterrorism Division and the National JTTF been informed of the dispute, they could have made their own assessment of whether the Washington JTTF's inquiry was sufficient, forced elevated discussion between the two JTTFs to resolve the matter, shared information directly with DoD, or even have sought to impose their own solution on the JTTFs. The San Diego JTTF's failure to elevate the Hasan matter was poor judgment but also speaks to the cultural pressures within the FBI to defer to and respect other offices' autonomy.
Accordingly, our investigation of the Hasan case suggests that the field offices retain too much autonomy and that the FBI's headquarters-based coordinating mechanisms lack sufficient strength or support from the field. It is noteworthy that the FBI did not produce any documents to the Committee that articulated the division of labor and hierarchy of command-and-control authorities among the Counterterrorism Division, the National JTTF, the FBI's headquarters-based intelligence analysis unit called the Directorate of Intelligence, the field offices, and the JTTFs. We conclude that there are none, and the FBI has not disputed this conclusion.150 We are also concerned that the Counterterrorism Division has had eight leaders since 9/11 and that such turnover contributes to the centrifugal forces within the FBI.151
Despite progress by FBI leadership in surmounting it, the Hasan case indicates that the FBI's division among field-offices may still compromise the FBI's stated desire of becoming an intelligence-driven organization that primarily prevents terrorist attacks over the long term. As we noted above, the FBI has had successes to date in interdicting terrorist plots. However, the growing complexity and diversity of the threat, combined with the speed at which individuals are radicalizing to violent Islamist extremism and seeking to commit attacks, mean that the FBI's components will increasingly need to operate as a single, seamless entity and to do so quickly, in real time. Information across cases will need to be fused quickly and matched with other available information from public and private sources. Decisions about prioritization and resource allocation will need to be made across the FBI, as how one field office operates can have significant implications for how the FBI overall is able to counter the national and transnational terrorist enemy. As Arthur Cummings, who was Special Agent in Charge for Counterterrorism at the Washington Field Office, explained in 2007:
There is no such thing as a local terrorism problem. Something might happen locally, but within two seconds, you discover national and international connections. [The Special Agents in Charge of field offices] were always kings in the past. They got to decide who to arrest and when to do it. Now, headquarters needs to oversee those decisions.152
The Hasan case suggests that the FBI's internal balance is still skewed too far toward field office autonomy, with insufficient strategic coordination from headquarters of the full range of FBI activities including investigative decisionmaking. The FBI must find the appropriate balance between (1) centralization to ensure that the FBI operates as an intelligence-driven organization able to prevent domestic terrorist attacks planned across multiple field offices' jurisdictions, and (2) decentralization to generate innovation, to identify and seize opportunities quickly, and to work with state and local law enforcement.153
There was a fundamental disjunction between the San Diego JTTF and the Washington JTTF concerning who was responsible for investigating [REDACTED] communications between Hasan and the Suspected Terrorist. That disjunction contributed to the Washington JTTF's failure to conduct an intensive investigation of Hasan, including interviews of his superiors and colleagues, based on all available information regarding Hasan's communications with the Suspected Terrorist. Neither the FBI's headquarters-based Counterterrorism Division nor the National JTTF was notified of or resolved the conflict between the field offices and thus were unable to take steps to resolve it. As a result, the FBI's inquiry into Hasan was terminated prematurely, The FBI lacks documents that articulate the division of labor and hierarchy of command-and-control authorities among the Counterterrorism Division, the National JTTF, the FBI's headquarters- based intelligence analysis unit called the Directorate of Intelligence, the field offices, and the JTTFs. The leadership of the Counterterrorism Division has also experienced significant turnover since 9/11. Thus, despite the FBI's progress in strengthening its headquarters and bringing field offices under a strategic framework, the Hasan case leads us to be concerned that the FBI remains divided among strong field offices and between the field offices and its headquarters.
The FBI should ensure the appropriate balance between field office autonomy and headquarters central control in order to become the intelligence-driven organization it wants to be. Headquarters elements such as the Counterterrorism Division and the National JTTF should actively identify and resolve investigative disagreements and ensure that they conduct sufficient oversight of how field offices are aligning their activities with strategic priorities for intelligence collection and analysis. The FBI should articulate in writing the command-and-control hierarchy among its headquarters and field entities in order to ensure clear responsibility, authority, and accountability for national security activities.
2, The FBI's inquiry into Hasan failed to utilize intelligence analysts fully in order to drive the purpose of the investigation and assess Hasan's communications.
A critical aspect of becoming an intelligence-driven organization to prevent terrorism and other national security threats requires (1) integrating strategic intelligence analysis into the FBI's operational activities, (2) using intelligence analysis to identify knowledge gaps and threat trends, and (3) using this analysis to prioritize intelligence collection and law enforcement operational activities against national security targets. The FBI has historically been dominated institutionally by its agents, who played the lead role in the law enforcement successes that established the FBI's great reputation. As recounted by the 9/11 Commission, the FBI's attempt to foster intelligence analysis prior to 9/11 ran into cultural resistance, with analysts often being either secretarial staff or relegated to performing secretarial or other support functions.154 The FBI sought to remedy this problem after 9/11 by creating a Directorate of Intelligence at headquarters and a Field Intelligence Group in each field office composed of intelligence analysts to serve as the intelligence "hub.155 The FBI also tripled the number of analysts to 2,800 authorized positions (as compared to 13,000 agents' 56), hired agents of increased quality, created a formal mechanism to disseminate intelligence reports, and disseminated thousands of such reports.157
Despite these structural improvements in the FBI's analytic capability, FBI intelligence analysts from the resident Field Intelligence Group were not consulted by the DCIS agent or his FBI supervisor in the Washington JTTF concerning Hasan's case. An analyst familiar with the Suspected Terrorist could have advised the DCIS agent on the role that this individual has played in [REDACTED], oriented the DCIS agent toward the question of whether Hasan was radicalizing, and explained what evidence would suggest radicalization. At the very least, an analyst could have helped interpret Hasan's first [REDACTED] communications with a more critical eye regarding whether they represented innocuous research or instead could signify that Hasan was radicalizing to violent Islamist extremism. An analyst may also have noted other possible threats posed by Hasan, including traditional counterintelligence concerns, and recommended additional collaboration with DoD. In contrast, the relevant personnel at the San Diego JTTF included two intelligence analysts, and the San Diego JTTF did flag Hasan's first [REDACTED] communications for further inquiry even though they lacked any evidence of overt terrorist activity. Still, the San Diego JTTF could have marshaled other intelligence analysts — including at the headquarters-based Directorate of Intelligence — when disputing the Washington JTTF's determination that Hasan's first [REDACTED] communications were benign; it should be noted that the San Diego JTTF's decision not to issue a report via normal intelligence channels [REDACTED] based on Hasan's first [REDACTED] communications, due to the mistaken belief that Hasan was a communications officer, foreclosed one avenue for circulating the communications to analysts inside (and outside) the FBI. In sum, the lack of a role for intelligence analysts in the Washington JTTF's inquiry into Hasan raises alarm that the FBI's effort to strengthen its intelligence analytic corps and to integrate it into the FBI's investigative functions is incomplete.
Our concern regarding the role of analysts is echoed by a 2010 report issued by the FBI Intelligence Analysts Association, which found that a "clear hierarchy exists in which agents occupy the ranks of senior executives, and analysts are still relegated to a category called `Support Employees.'"158 The report noted that FBI analysts hold only 14 out of 276 (or 5 percent) of the FBI's Senior Management Positions (called in other departments the "Senior Executive Service"),159 The report also found that (1) the FBI's reforms to enhance the role of intelligence analysts were "perceived as a threat" by agents, (2) agents received no training on the role of analysts, (3) a 2005 FBI reorganization demoted the FBI's top analyst, (4) a December 2009 FBI policy permits analysts to be assigned menial duties, and (5) many analysts cannot access the Internet or classified databases from their desks.160 The report observed that the leaders of the FBI's Directorate of Intelligence have almost all been agents rather than analysts and that high turnover has "led to lapses in the competence, continuity of policy and accountability of FBI management."161
Accordingly, based on the Hasan case and these other indications, the FBI should ensure that its intelligence cadre has the leadership and support it needs and that barriers are broken down for analysts to assume their rightful place in FBI organizational culture — such as by permitting analysts to become mid-level and senior managers even over agents.162 FBI agents should be rewarded for integrating analysis into their operational activities and held accountable if they do not.
In an effort to integrate analysts more fully with agents, the FBI created threat fusion cells to bring together analysts and agents — integrating intelligence and investigations to identify and mitigate counterterrorism threats and vulnerabilities. Each threat cell focuses on a specific threat and is intended to collect intelligence to provide strategic and tactical analysis to drive operations. The FBI is in the process of applying this model to address a wide range of counterterrorism threats and should accelerate its efforts in this area.
Despite the FBI's improvements in its analytic capability, intelligence analysts were not integrated sufficiently into the inquiry into Hasan. Such integration might have enabled the JTTF to: (I) gain a broader perspective on the significance of Hasan's communications with the Suspected Terrorist, [REDACTED], (2) orient the inquiry into Hasan to whether he was radicalizing rather than just whether he was engaged in overt terrorist activity, (3) analyze Hasan's communications more critically as to whether they were truly research, and (4) suggest what information to seek in order to determine whether Hasan was radicalizing to violent Islamist extremism or otherwise constituted a national security threat.
We are concerned that analysts may not be sufficiently integrated into operations and may lack sufficient stature within the FBI vis-a-vis agents as necessary for an intelligence-driven organization. As the Hasan case shows, the FBI should ensure that analysts are integrated into operations and play a major role in driving operational decisionmaking. At a basic level, the FBI should ensure that — unlike in the Hasan case — agents consult with analysts routinely, and the FBI should ensure that agents who integrate analysts into their operational activities are rewarded and agents who do not are held accountable. For example, the FBI should accelerate its use of combined agent/analyst threat fusion centers. More generally, the FBI should ensure the dismantling of barriers to intelligence analysts assuming a prominent role in the organization and that analysts have sufficient leadership opportunities at all levels, including to supervise agents as appropriate. Finally, the FBI should ensure that analysts receive the technological and other support necessary to produce sophisticated analysis.
3. The FBI did not update its tradecraft used in the investigation of the Suspected Terrorist, which contributed to the FBI's failure to understand the significance of Hasan's communications with that individual.
The FBI's conduct vis-a-vis Hasan demonstrates that the FBI did not identify and update deficient tradecraft (i.e., the methods and processes for conducting investigative or intelligence activities) concerning significant suspected terrorists such as the Suspected Terrorist [REDACTED] prior to an attack occurring.
An analysis of the full extent of Hasan's communications would have shown that Hasan's interest in the Suspected Terrorist belied any conceivable research purposes. Yet the San Diego JTTF only flagged Hasan's initial [REDACTED] communications with a suspected terrorist for further inquiry. The criteria used by the San Diego JTTF to determine whether a communication with that particular suspected terrorist merited scrutiny or follow-up were neither memorialized nor institutionalized in the event of a personnel turnover and not reviewable by FBI headquarters. We are concerned that this ad hoc approach did not accord with the significance of the Suspected Terrorist [REDACTED].
To its credit, since the Fort Hood attack, the FBI now requires that FBI headquarters- based analysts simultaneously review case information of [REDACTED] subjects of investigations [REDACTED] to ensure that the relevant field office has not missed any important communications. Such oversight accords with the Suspected Terrorist's [REDACTED] and enables headquarters-based analysts — who may have a broader perspective on terrorist activity than agents in a field office — to weigh particular communications differently.
However, this new process does not replace the need for FBI headquarters to review and oversee a field office's protocols [REDACTED].
Our investigation also found that, in the Hasan case, the San Diego JTTF the San Diego JTTF was prevented from easily linking Hasan's subsequent communications with his first [REDACTED] communications. In addition, the San Diego JTTF never linked Hasan's subsequent communications to his initial [REDACTED] communications either from memory or by actively running a database search under Hasan's name. [REDACTED] Thus, an analyst or agent looking at a communication would not automatically receive information concerning previous communications [REDACTED]. Instead, a communication could only be linked with previous communications [REDACTED] by agents' or analysts' memory or by the agents or analysts actively searching the database [REDACTED].
To its credit, the FBI reacted swiftly after the Fort Hood attack and remedied this problem within a few months by utilizing the necessary information technology. Yet we have concerns that this particular gap suggests a larger challenge facing the FBI's tradecraft.
- The FBI believed that the Suspected Terrorist was, in essence, [REDACTED].
- Accordingly, it is unacceptable that the FBI personnel who had access to communications were content using a system that did not link automatically to [REDACTED] previous communications and that apparently no one in the FBI recognized the attendant inefficiency and risk of mission failure. The ability to link communications would have identified patterns in Hasan's contact with the Suspected Terrorist [REDACTED]. Doing so would place the contents of any single communication in the context of the new individual's overall relationship with a suspected terrorist and help indicate whether that subject was radicalizing to violent Islamist extremism.
The FBI has presented us with no evidence that FBI headquarters or the National JTTF had identified this tradecraft problem, realized its potential implications, and tried to remedy it prior to the Fort Hood attack. Based on the Hasan case, we are concerned that there may be other FBI tradecraft areas that need to be updated against the evolving terrorist threat.
The FBI did not update its tradecraft for purposes of its investigation of the Suspected Terrorist. The FBI could not easily link Hasan's initial communications with the Suspected Terrorist to his later communications, and the failure to do so was a factor in the government not intervening against Hasan before the attack, and the FBI should have identified and remedied its inability to link his communications together prior to the attack.
The FBI should ensure that its internal processes are effective in identifying tradecraft that is outmoded as compared to evolving threats.
C. The Inquiry Into Hasan Focused On The Narrow Question Of Whether He Was Engaged In Terrorist Activities And Not Whether He Was Radicalizing To Violent Islamist Extremism And Thus Could Become A Threat.
The 9/11 attacks led the FBI to seek to transform its entire institutional and operational architecture in order to become intelligence-driven and to prevent terrorism domestically.163 A prime example of the FBI's reorientation to being "intelligence-driven" is the FBI's issuance of a revised Domestic Investigations Operations Guide in December 2008. The revised Guide permits an "assessment" for intelligence purposes — that is, even when there is "no particular factual predication" that a crime is being committed and instead based on an "authorized purpose" such as "to detect, obtain information about, or prevent or protect against federal crimes or threats to the national security or to collect foreign intelligence."164 The FBI's view of being intelligence-driven is certainly different from the traditional law enforcement approach of investigating crimes (e.g., terrorist attacks) after they occur. In that sense, the FBI has been generally successful in altering its law enforcement culture.
The San Diego JTTF's flagging of Hasan for additional scrutiny [REDACTED] despite Hasan's communication showing no evidence of criminal activity is a positive example of the FBI being intelligence-driven. Thus, the problem with the FBI's performance in the Hasan case is not that the FBI failed to pick Hasan out of the myriad leads that the FBI faces every day; in actuality, the San Diego JTTF did flag him based on his first [REDACTED] communications to the Suspected Terrorist. Rather, the problem is that, as the DCIS agent in Washington described his investigation, the inquiry into Hasan was focused on whether Hasan was engaged in overt terrorist activities.
The appropriate question about Hasan was not only (as the Washington JTTF focused its investigation) whether he was engaged in terrorist activity. A more intelligence-oriented inquiry would also have sought to know:
- could Hasan be in the process of radicalizing to violent Islamist extremism such that he might engage in terrorist activity in the future;
- what did the nature of Hasan's communications with the Suspected Terrorist teach about that suspected terrorist's modus operandi in furtherance of terrorist objectives [REDACTED] without actually breaking the law; and
- could Hasan be a future counterintelligence threat putting U.S. military operations at risk.
Put more concretely, the Washington JTTF only looked for overt steps to support terrorist activity and did not assess the broader threat posed by a military officer and his communications with a known type of terrorist called a [REDACTED].
We are concerned based on the Hasan case that the FBI has more work to do in training its personnel as to how being intelligence-driven should affect their operational activities.
The FBI's inquiry into Hasan was focused on whether Hasan was engaged
in overt terrorist activities. The inquiry did not pursue whether Hasan might be radicalizing to violent Islamist extremism, what information his radicalization and relationship with the Suspected Terrorist could contribute to the larger understanding of radicalization, and whether Hasan
might become a counterterrorism or counterintelligence threat in the future.
The FBI should ensure that agents understand practically how being intelligence-driven should affect their investigative objectives and operational activities.
D. Our Investigation Of The Hasan Case Raises Questions About Whether The Joint Terrorism Task Forces Have Become Fully Effective Interagency Coordination and Information-Sharing Mechanisms.
The FBI has set forth a vision — of which we approve — of JTTFs as the premier mechanism for counterterrorism information-sharing and operational coordination among federal entities and with state and local law enforcement. However, the JTTFs did not fulfill this aspiration in the Hasan case, and during our investigation of the Hasan case we learned of larger unresolved policy disputes concerning JTTFs' functioning.
Neither the Washington JTTF nor the San Diego JTTF cited any law [REDACTED] as a barrier to sharing Hasan's communications or information derived from those communications with DoD counterintelligence officials. We have found no legal barrier that prevented the JTTFs from notifying DoD counterintelligence officials concerning Hasan's communications and enlisting those officials' expertise in investigating Hasan, a servicemember. The Hasan case highlights interagency disagreements and internal JTTF weaknesses that raise our concern that the JTTFs are at risk of becoming essentially an investigative entity serving the FBI's interests.
1. DoD and the FBI disagree concerning_which agency has the lead for counterterrorism investigations of servicemembers.
The standard operating procedure of the Army's operational counterintelligence unit, the 902nd Military Intelligence Group (located within the Army's Intelligence and Security Command), is that even its lowest level of investigation of a servicemember includes interviews of employers and associates. Accordingly, had Hasan's initial [REDACTED] communications (let alone all of them) been shared with the 902nd Military Intelligence Group, then Army counterintelligence officials most likely would have interviewed his superiors and colleagues. Even the most minimal interviews would most likely have shown that his communications were not mere research and instead accorded with his overall displays of radicalization to violent Islamist extremism. Neither the Washington JTTF nor the San Diego JTTF pointed to any law or regulation as the reason that information about Hasan was not shared with DoD counterintelligence officials.165 At most, the San Diego JTTF initially decided not to circulate the communications as a standard FBI intelligence communication to DoD because of the erroneous belief that Hasan was a military communications officer and thus could have read the report. The San Diego JTTF did not revisit its decision once the Washington JTTF reported that Hasan was a military physician and not a communications officer and that was a very consequential mistake. Moreover, the Washington JTTF's concern that sharing might expose the investigation [REDACTED] on the Suspected Terrorist was belied by the fact that the San Diego JTTF — which was responsible for the investigation of that individual — advocated interviews of Hasan and his superiors and colleagues.
Our investigation revealed a significant disagreement between the FBI and DoD concerning whether the FBI or DoD should have the lead for investigating servicemembers for counterterrorism purposes. As noted above, the FBI is the lead federal investigative agency for counterterrorism criminal investigations and intelligence collection within the United States pursuant to statute enacted in 1996 and a Presidential directive issued in 2003).166 DoD and the FBI had signed an accord called the "Delimitations Agreement"167 in 1979 and supplemented it in 1996. The Delimitations Agreement states that DoD has the lead for "counterintelligence" investigations of servicemembers.168 Mirroring various statutes and regulations, the Delimitations Agreement defines "counterintelligence" to include both classic espionage and "international terrorism."
- DoD argued that the Delimitations Agreement is directly applicable to the investigation of servicemembers for counterintelligence purposes — to include counterterrorism, by definition. A senior DoD counterintelligence official referred to the agreement as its "bible" governing its relationship with FBI on counterintelligence investigations. Thus, under DoD's view, the agreement required that the Army and not the JTTF lead the inquiry into Hasan and that the FBI notify DoD of the information in its possession regarding Hasan.
- In contrast, the FBI argued that the Delimitations Agreement is not operative with respect to counterterrorism and instead applies only to investigations of servicemembers for classic counterintelligence (i.e., espionage). In the FBI's view, statutory and regulatory sources giving the FBI the lead for domestic counterterrorism investigations govern despite the Delimitations Agreement, and that agreement was signed prior to counterterrorism assuming such a preeminent investigative interest and giving rise to counterterrorism-specific organizations such as JTTFs. In addition, according to the FBI, the Delimitations Agreement has been negated by the "course of dealing." Thus, in the FBI's view, the FBI — through the .ITTEs — rather than DoD has the lead for counterterrorism investigations of servicemembers. Under the FBI's view, the JTTFs were the appropriate lead for the inquiry into Hasan.
We are concerned that the question of lead responsibility for counterterrorism investigations of servicemembers is unresolved between the FBI and DoD. In addition, we believe that the legal question of which agency technically has the lead in general is secondary to the operational question of which agency is best situated from an expertise and resource perspective to conduct a particular investigation. In other words, just because the FBI is the lead agency for domestic counterterrorism investigations does not mean that the FBI is the sole agency conducting such investigations and that no other agency should have the lead in practice depending upon the circumstances. Having other agencies play a lead role in investigations makes sense in order to maximize inherently limited government resources. In the case of Hasan, DoD arguably was best situated to evaluate the counterterrorism threat posed by him given the existence of an entire Army unit with the mission of guarding against threats from within the Army. Thus, we are concerned that the JTTFs' failure to share information about Hasan with DoD may indicate a tendency within part of the FBI to believe that either a lead merits the FBI conducting a counterterrorism investigation or the lead is not worth investigating even by another agency. This tendency would detract from the optimal use of federal, state, and local capabilities beyond the FBI in order to investigate the most leads in the most efficient and effective manner.
Leaving aside the questions of which agency should lead counterterrorism investigations of servicemembers in principle or in practice, we note that the inquiry into Hasan was not only a counterterrorism investigation but also a classic counterintelligence (i.e., espionage) investigation: Hasan's regard for the Suspected Terrorist, as evident in his first [REDACTED] communications [REDACTED], could eventually have led Hasan to seek to aid the enemy if he was deployed to Iraq or Afghanistan; at the very least, Hasan's regard for the Suspected Terrorist could have led Hasan to disclose Secret-level information — which Hasan was cleared to access — in an unauthorized manner. Thus, even if the FBI is correct that it should lead investigations of servicemembers regarding counterterrorism (a position not supported by the Delimitations Agreement), the Hasan case was also a classic counterintelligence case and should have been reported to DoD for that purpose. As a result, the Delimitations Agreement would require that DoD have had the lead on the investigation from a counterintelligence perspective.
To the credit of both the FBI and DoD, immediately after the Fort Hood attack they took steps to ensure that DoD was aware of all then-existing FBI counterterrorism investigations involving DoD or DOD-affiliated personnel, devised and implemented a new procedure for providing DoD with notification of such investigations going forward, and initiated negotiations to consolidate and update the architecture of FBI/DoD agreements concerning information- sharing and operational coordination.169 Under this notification policy, a JTTF is required to inform the National JTTF of a counterterrorism inquiry into a servicemember. The individual in the National JTTF to be informed is the Deputy Unit Chief for DoD matters, who will then notify the military counterintelligence entity in DaD most relevant to that servicemember. Also, within days of the attack, the FBI provided DoD with a list of FBI investigations concerning DoDaffiliated personnel or those with access to DoD facilities. The review found [REDACTED] investigations that had a nexus with DoD and that JTTFs had coordinated with the appropriate military investigative organization in [REDACTED] cases. (We do not know whether such coordination involved the lead for investigations of any servicemembers being transferred to DoD pursuant to the Delimitations Agreement.)
Although the FBI/DoD review found that the FBI coordinated over 90 percent of these cases with DoD, we are concerned about the gap given the clear-cut nature of the obligation. Not only did the failure to share information with DoD concerning Hasan play a major role in the government's failure to prevent the attack, but the reasons for the failure to share the Hasan information with DoD were not confined to the misjudgments of a select few but rather are related to policy disputes regarding the functioning of JTTFs. As indicated by the adoption of the new policy, the FBI agrees with the importance of informing DoD of investigations of servicemembers, but the key question of which agency should lead these investigations remains outstanding between the FBI and DoD. The FBI and DoD should be sure to resolve all of these questions related to the Delimitations Agreement in principle and in practice as they negotiate the new master DoD/FBI agreement.
2. DoD and the FBI disagree concerning the status of detailees to JTTFs as primary information-sharing channels of JTTF information back to DoD.
Our investigation has also revealed a significant disagreement between the FBI and DoD concerning whether the FBI giving Hasan's communications to the DCIS agent detailed to the Washington JTTF constituted sharing that information with DoD as a whole: Detailees from an agency to JTTFs are often governed by an agreement between the FBI and that agency covering administrative matters. All such agreements that we have reviewed prohibit a detailee from sharing JTTF information with that detailee's home agency without first receiving permission from an FBI supervisor at the JTTF. The FBI's agreement with DCIS had this provision.170
- DoD argued that sharing information with a DoD detailee on a JTTF does not constitute sharing that information with DoD as a whole, for three reasons: First, each DoD detailee comes from a specific DoD agency and thus cannot represent all of DoD or know what JTTF information would be of interest to another DoD component. Second, any particular detailee only sees part of a JTTF's activities and thus cannot be the main avenue for sharing JTTF information with DoD. Third, the requirement that a detailee receive approval from an FBI supervisor prior to sharing information with his home agency means that the FBI effectively has veto power over what information is shared — which is contrary to the FBI's information-sharing obligations under the Delimitations Agreement. In sum, DoD regards its detailees as primarily augmenting the JTTFs, not being information-sharing avenues — even if the DoD detailee actually leads the JTTF's investigation in which information of interest to DoD is generated.
- In contrast, the FBI argued that detailees are representatives of their departments and that the requirement for supervisor approval to share information is a low bar. The FBI's view is that the requirement ensures that the FBI knows when its information is being transmitted outside of the JTTF. The FBI's view is also that the requirement enables the FBI to coordinate any operational activity that the agency receiving the information may wish to conduct based on it. Thus, the FBI believes that sharing information with a DoD detailee constitutes sharing that information with DoD — even if the detailee is from DCIS in the DoD Office of Inspector General and the relevant DoD entity that would be interested in the information is the Army's counterintelligence entity, the 902nd Military Intelligence Group.
Thus, under DoD's view, the sharing of Hasan's first communications with the DCIS detailee in the Washington JTTF did not constitute sharing that information with DOD as a whole. In contrast, under the FBI's view, the sharing of the information with the DCIS detailee constituted sharing with DoD as a whole — and it was the DCIS detailee's decision as to whether the information merited being transmitted to any part of DoD; if the DCIS detailee had decided to share the information with DoD, then per DCIS's agreement with the FBI he would have needed his FBI supervisor's approval.
This interagency disagreement is reinforced by an additional factor that our investigation found: the lack of training provided to detailees concerning their purpose for being detailed to a JTTF. DoD's training of detailees has been episodic and does not articulate the purpose of the detailees being sent to the JTTFs. DoD's lack of training of detailees arguably reinforces, in silence, DoD's view that detailees from its components do not represent DoD as a whole. Simultaneously, the FBI's view of detailees' purpose is not reflected in its training of them; in other words, the FBI does not instruct detailees to JTTFs that they should regard themselves as primary information-sharing avenues to their home agencies. The apparent inadequacy of the FBI's training of detailees was flagged by a Department of Justice Office of the Inspector General report in 2005, which identified the lack of training of detailees as a critical weakness in the JTTF program. That report faulted the FBI for "not provid[ing] written guidance that defines the roles and responsibilities of detailees to JTTFs.171 Since then, the FBI has taken steps to train detailees. However, the most recent FM training material for detailees to JTTFs172 lacks a discussion of the detailees' purpose.173 Thus, detailees could master the training but never be informed that the FBI considered them to represent their entire home departments and to be the critical link for ensuring information-sharing.
Do D's argument that sharing information with a DoD detailee to a JTTF does not constitute sharing with DoD as a whole is more convincing. As mentioned, the Committee has no evidence that FBI and DoD training of detai lees ever articulated that detailees represented their departments as a whole. The fact that an FBI supervisor could block the detailee from sharing that information with DoD proper — with no criteria, as seen by the Committee, developed by the FBI to guide that discretion — implies that DoD detailees were not a dedicated information-sharing avenue.
3. FBI corrective action since the Fort Hood attack facilitates information sharing with DoD but does not resolve the larger policy issues.
Demonstrating its desire to ensure that JTTFs are effective information-sharing mechanisms, as described above the FBI reacted to the Fort Hood attack by instituting the new notification procedure for ensuring that DoD is informed of any counterterrorism inquiries into servicemembers. This policy appears to supersede any requirement that an FBI supervisor approve the sharing of information with DoD. This new policy appears to answer the specific question of whether DoD detailees are representatives of DoD as a whole by indicating that they are not — in other words, any issue regarding a servicemember being handled by a JTTF is sent to the National JTTF for transmission to DoD, rather than having DoD detai lees at the relevant .JTTF determine whether to inform DoD directly of the information. However, this new policy does not resolve the policy dispute concerning the issue as to whether the sharing of information within a JTTF with a detailee constitutes sharing that information with the detailee's home agency.
- This policy dispute is still relevant to FBI/DoD relations because the new notification procedure on its face covers only JTTF investigations of servicemembers, not JTTF investigations of matters that might affect DoD but are not concerning servicemembers. The FBI and DoD should be sure to resolve this question in the new master agreement that they are negotiating.
- In addition, the policy question of whether detailees are representatives of their home agencies is still applicable to other entities that send detailees to JTTFs aside from DoD, We recommend that the FBI and its partner agencies decisively resolve the issue of whether detailees are representatives of their agencies and ensure that detailees receive training to that effect.
4. The FBI's failure to link Hasan's first [REDACTED] communications to the Suspected Terrorist to his later ones stemmed in part from JTTF detailees' lack of access to key information, which suggests a major impediment to JTTFs' overall effectiveness.
A review of all of Hasan's communications with the Suspected Terrorist would have shown clearly that Hasan's communications were not research and merited a thorough investigation. As a result, the decision by FBI supervisors at the Washington JTTF to assign the DCIS agent to an inquiry [REDACTED] was flawed because of his lack of access to and knowledge of the [REDACTED] database. Access to that database was essential for the Hasan inquiry due to Hasan's subsequent communications.
Our finding in the Hasan case of the DCIS agent's lack of access to the [REDACTED] database comports with chronic data-access challenges facing detailees to JTTFs identified in prior studies. The Department of Justice's Office of the inspector General reported in 2005 that "a majority of" detailees "with clearances did not have direct or complete access to the" FBI's Automated Case Support system, "even though such access was permitted by policy, which caused delays in their investigations."174 The lack of access to the Automated Case Support system was eventually solved, but a survey of JTTF detailees conducted in 2007 by a twenty- three year FBI veteran who had acted as a JTTF supervisor found that detailees' lack of access to other databases continued even though, in his view, detailees must understand the available databases and be able to extract the necessary information from them in order to be effective JTTF members.175 In fact, the DCIS representative to the National JTTF at the time of the Fort Hood attack not only lacked access to the [REDACTED] database but also was unaware of its existence.176
It is paradoxical that, in the Hasan case, the FBI would rely on a detailee so heavily for the Hasan inquiry but not provide that detailee with the full range of database access and training. The DCIS agent was thus in the unenviable position of being relied upon by the FBI as the lead for the JTTF inquiry into Hasan without having the tools necessary to perform competently.
We are concerned by evidence that this problem goes well beyond the Hasan case. The former JTTF supervisor mentioned above wrote in his report, "The fact that (detailees) are less likely to receive substantive training, database access, and training [on how to operate sources], and yet may be assigned as primary or co-case agent in an investigation, goes against the JTTF concept."177 The FBI's internal review after the Fort Hood attack confirmed that "many" detailees to JTTFs have been unaware of that database, although the FBI could not quantify that number. We find it difficult to align the FBI's view that JTTF detailees are representatives of their home departments for information-sharing purposes with the lack of access of such detailees to the type of information at issue here. Indeed, even if the DCIS agent had considered himself as responsible for representing DoD and serving as a primary bridge for information- sharing to DoD, he would have been unable to share the necessary information due to his lack of access to it.
To its credit, after the Fort Hood attack the FBI increased the training of detailees and FBI agents — 3,700 in all — to widen access to the database, with a prerequisite being an understanding of the rules governing [REDACTED].178 We are troubled that the FBI made significant progress toward solving this apparently well-known problem only after a mission failure resulted. In any event, we hope that the FBI's action will finally solve this problem, and we will monitor progress to ensure that this barrier to effective JTTF operations and information-sharing is resolved completely.
5. We are concerned that JTTFs are not fulfilling the FBI's vision of being interagency information-sharing and operational coordination mechanisms but rather may merely be appendages of the FBI.
Drawing together the issues of the Delimitations Agreement, the status of detailees for information-sharing, and detailees' lack of access to database, we are concerned JTTFs are not fulfilling the FBI's vision of being the premier domestic counterterrorism mechanism for interagency information-sharing and operational coordination.179 The question of detailees' status as information - sharing mechanisms needs to be resolved, and training provided by the FBI and detailees' home departments needs to articulate their role clearly. The FBI also must ensure that detailees have the training and access to the full array of databases so that they can become full-fledged members of the JTTFs.
We also believe that improvements are needed regarding the FBI supervisor approval requirement for sharing information outside of a JTTF, as mandated by the FBI's agreements with the other departments providing detailees. This requirement is arguably necessary (leaving aside specific exceptions such as the Delimitations Agreement) so that FBI supervisors can keep tabs on their investigative information and ensure deconfliction among departments. Still, FBI headquarters should clarify expectations to its personnel in writing regarding whether the FBIsupervisor-approval requirement for sharing information outside of the FBI is an administrative step or a substantive hurdle. If the review is a substantive hurdle, then the FBI should justify why such a hurdle is required and clarify the criteria for sharing information. If the review is not a substantive hurdle, then the FBI should educate the departments sending detailees to the JTTFs so that there is a common understanding among the FBI and those departments. The FBI also should highlight this requirement in its training of detailees and encourage them to utilize this process for sharing information with their home departments. The FBI might create a formal process to contest an FBI supervisor's decision that prevents a detailee from sharing information and to protect detailees who file appeals from repercussions.
We remain concerned that the dispute between the FBI and DoD regarding the interpretation of the Delimitations Agreement remains unresolved. More generally, the FBI should ensure that its JTTFs do not operate under the belief that they (to use government jargon) "own" counterterrorism investigations as well as the information that those investigations produce. Such a belief could unfortunately result in a JTTF believing that, if it determines that a particular individual does not pose a threat, then there is no reason to pass the information to another department. As has been proven time and again in the intelligence context, information that may not appear troubling to one analyst may complete the puzzle for another analyst who has a different perspective or access to other information. In other words, as the Fort Hood case illustrates, information on violent radicalization in the hands of one entity can be misinterpreted, but effective information-sharing can add unique perspectives to help identify threats. Effective operational coordination can help ensure that the entity best situation to act on the threat does so.
JTTF personnel never cited any legal restrictions as the reason that Hasan's communications were not shared with DoD counterintelligence officials. Our investigation surfaced a policy dispute concerning whether detailees to JTTFs were representatives of their departments and thus served a major information-sharing function. As revealed in the Hasan case and reinforced by other evidence, detailees to JTTFs have often lacked adequate access to databases and training but paradoxically are relied upon to lead JTTF investigations. As a result, we are concerned that JTTFs may not be fulfilling their intended role as interagency information-sharing and operational coordination mechanisms.
The FBI should ensure that JTTFs fulfill the broader role of being mechanisms for interagency information-sharing and operational coordination rather than being mere FBI investigative entities and sources of personnel augmentation. Detailees need training and access to databases so that they can be full-fledged members of the JTTFs. The FBI and departments sending detailees should agree upon and train them regarding the purpose of their detail. The FBI also should clarify the requirement that FBI supervisors approve the sharing of information by a detailee with his home agency by setting forth criteria for such approval, creating an appeals process, and evaluating the process periodically. Finally, the FBI should ensure that it facilitates other entities in playing critical investigative roles in countering terrorism and other national security threats, including by sharing appropriate information and having those entities lead investigations in order to use inherently limited government resources and expertise most efficiently and effectively.
E. The FBI's Training Materials Contemporaneous To The Hasan Inquiry Did Not Adequately Cover The Ideology Of Violent Islamist Extremism.
Hasan's first [REDACTED] communications, scrutinized by both JTTFs, were not conclusive of terrorist conspiracy or that Hasan was radicalizing to violent Islamist extremism. Hasan, however, was a military officer who had sworn an oath to support and defend the Constitution, held a Secret-level security clearance, and could be deployed to a combat zone in which violent Islamist extremists were the enemy. In that light, Hasan's initial [REDACTED] communications contained significant anomalies that should have triggered additional and urgent investigative activity - even though the Officer Evaluation Reports praised his research concerning terrorism. These [REDACTED] communications were [REDACTED], meandered in a "stream of consciousness," hinted at the answer Hasan wanted to hear, and had content that contravened officership standards. The communications on their face raised questions of whether Hasan was a potential counterintelligence or counterterrorism threat that relying merely on his Officer Evaluation Reports, as opposed to interviewing his superiors and colleagues, could not answer. Yet neither the DCIS agent nor the FBI supervisor at the Washington J'ITY picked up on the communications' signals.
The inadequacy of the Washington JTTF's inquiry led us to examine the training materials regarding the understanding of radicalization to violent Islamist extremism among the agents on the front-lines of the FBI's counterterrorism efforts. The FBI provided the Committee with a swath of training material and analytical reports concerning radicalization in the United States, including the training material that the San Diego JTTF received.180 (FBI lacks records of what training was provided to the DCIS agent in the Washington JTTF.) These documents focus on the various behavioral indicators of radicalization (e.g., the individual isolates himself from his friends) but have little information on the ideology of violent Islamist extremism and the reasons for its appeal. In other words, the documents ignore the substance of radicalization, including what violent Islamist extremists believe and why. Understanding the ideology of violent Islamist extremism would assist agents in determining, in conjunction with an individual's conduct, what degree of risk an individual might present and whether to pursue further inquiry.
Based on our review of the training documents provided to us by the FBI, we believe that the FBI should produce in-depth analysis of the ideology of violent Islamist extremism, the factors that make that ideology appealing to individuals (including U.S. citizens and legal permanent residents), and what ideological indicators or warning signs show that the individual is weighing or accepting the ideology. Our review also leads us to believe that the FBI also should provide sufficient training to its agents including: (1) ideological indicators or warning signs of violent Islamist extremism to serve as an operational reference guide, and (2) the difference between violent Islamist extremism and the peaceful practice of Islam.
Following the Fort Hood attack, the FBI acted to improve the training of its agents by developing radicalization training material jointly with the National Counterterrorism Center. We learned that this material was completed by NCTC and presented to three field offices during the fall of 2010.
The FBI's internal training materials contemporaneous to the Hasan inquiry did not provide sufficient guidance concerning the ideology of violent Islamist extremism and intellectual indicators that evince that an individual is subscribing to that ideology.
The FBI and other intelligence agencies should ensure that they have sufficient understanding of the ideology of violent Islamist extremism and that ideological indicators or warning signs have been developed for use by agents. Our Committee will review the training materials recently completed by NCTC and the FBI to ensure their adequacy.
120 - See 18 Section 2332b(f); 28 C.F.R. Section 0.85(1); Homeland Security Presidential Directive 5.
121 - 9111 Commission, at 75.
122 - For an overview of FBI reform, see Al Cumming, Intelligence Reform Implementation at the Federal Bureau of Investigation: Issues and Options for Congress, Report No. RL33033 (Congressional Research Service, August 16, 2005).
123 - Robert Mueller, Director, FBI, Statement before the House Judiciary Committee (May 20, 2009).
124 - Robert Mueller, Director, FBI, Statement before the Senate Judiciary Committee (March 5, 2008).
125 - Michael Mukasey, The Attorney General's Guidelines for Domestic FBI Operations (2008), at 9.
126 - Federal Bureau of Investigation, Counterterrorism Division Program Management, Electronic Communication #66F-HQ-A1308701, December 25, 2002.
127 - 9/11 Commission, at 77; Commission on the Intelligence Capabilities of the United States Regarding Weapons of Mass Destruction, Report to the President of the United States (March 31, 2005),at 331, 452 (hereinafter Silberman-Robb Commission).
128 - 9/11 Commission, at 423-426; WMD Commission, at 30.
129 - Jan W. Rivkin, Michael Roberto, and Ranjay Gulati, Federal Bureau of Investigation, 2009, Harvard Business School, unpublished case study (May l8, 2010), at 1-3.
130 - Remarks by Sean Joyce, Executive Assistant Director, National Security Branch, Federal Bureau of Investigation, at a conference sponsored by the Bipartisan Policy Center (October 6, 2010).
131 - Id.
132 - Jan W. Rivkin, Michael Roberto, and Ranjay Gulati, Federal Bureau of Investigation, 2007 (Harvard Business School, unpublished case study, March 9, 2010), at 5-6.
133 - U.S. Department of Justice, Office of the Inspector General, The Department ofJustice's Terrorism Task Forces Report No. 1-2005-007 (2005), at 56.
134 - Id.
135 - Briefing by a senior FBI attorney, July 2, 2010.
136 - Id.
137 - Federal Bureau of Investigation, Domestic Investigations Operations Guide (December 16, 2008), at 39.
138 - Amy Zegart, Spying Blind: The CIA, the FBI, and the Origins of 9/11 (Princeton University Press, 2009), at 122123 (hereinafter Spying Blind).
139 - Id., at 123 (quoting Richard Thornburgh, Statement Before the House Committee on Appropriations, Subcommittee on Commerce, Justice, State, and the Judiciary (June 18, 2003), at 2). See Richard Posner, Remaking Domestic Intelligence (Hoover Institution Press, 2005), at 93 (describing "the autonomy of the field offices [as] a major obstacle to effective national security intelligence in the FBI").
140 - Spying Blind, at 123.
141 - 9/11 Commission, at 76.
142 - Id., at 74.
143 - Joint Inquiry into Intelligence Community Activities Before and After the Terrorist Attacks of September 11, 2001, Report of the U.S. Senate Select Committee on Intelligence and the U.S. House Permanent Select Committee on Intelligence, Together with Additional Views, S. Rept. No. 107-351, H. Rept. 107-792, 107 111Cong., 2d Sess. (December 2002), at 38-39.
144 - Id. at 334-335.
145 - Robert Mueller, Director, FBI, Statement before the Senate Judiciary Committee (March 5, 2008).
146 - Robert Mueller, Director, FBI, Statement before the Senate Judiciary Committee (January 20, 2010).
147 - Id.; Robert Mueller, Director, FBI, Statement before the Senate Judiciary Committee (September 17, 2008).
148 - Federal Bureau of Investigation, Records Management Matters, Director's Office: Discontinuance of Discretionary Leads, Electronic Memorandum (March 2, 2010), at 2.
149 The Department of Justice's Terrorism Task Forces, at 21 (citing Federal Bureau of Investigation, Joint Terrorism Task Force Report to Congress (October 2003), at 7).
150 - Descriptions of the FBI's internal structure exist but provide no clarity. For example, the FBI's Intranet has the following description of the Counterterrorism Division's International Terrorism Operations Section I: "The mission of [ITOS I] is to support, coordinate and provide oversight of all FBI continental United States (CONUS) based international terrorism (IT) investigations. ITOS I will accomplish its mission utilizing technical collection, human source, coverage, and all essential investigative actions and techniques to optimize collection efforts directed against subjects of [terrorism-related investigations]." Department of Defense, Office of the Inspector, Affidavit of DCIS 2 (November 24, 2009), at 21. The language of "support, coordinate and provide oversight" is so vague as to be meaningless, and the rest of the description indicates that ITOS I is actually itself an investigative body, not a management and oversight body.
151 - Jeff Stein, "FBI Picks Its Seventh Counterterrorism Chief Since Sept. 11, 2001," CQ Homeland Security Intelligence (June 27, 2006). An eighth official was subsequently appointed.
152 - Jan W. Rivkin et al, Federal Bureau of Investigation, 2007, at 2.
153 - All organizations face the tension between centralization and decentralization and must constantly assess whether they are making the correct balance. Alfred Cumming and Todd Masse, FBI Intelligence Reform Since September 11, 2001. Issues and Options for Congress, Report RL32336 (Congressional Research Service, August 4, 2004)), at 15 n.71 (quoting the review of the 1986 Space Shuttle Challenger accident, "The ability to operate in a centralized manner when appropriate, and to operate in a decentralized manner when appropriate, is the hallmark of a high-reliability organization (Columbia Accident Investigation Report, Vol. I (August 2003)). For an assessment of the tension between centralization and decentralization in DoD, see Gordon Lederman, Reorganizing the Joint Chiefs of Staff The Goldwater Nichols Act of 1986 (Greenwood, 1999).
154 - See Zegart, Spying Blind, at 126 n.26 (citing the 911 I Commission, 9111 Commission Staff Statement Number 9 (April 13, 2004), at 9, and the 9/11 Commission, MI Commission Staff Statement Number 2 (April 14, 2004), at 6); The 9/11 Commission Report, at 77. For the FBI's approval of the 9/11 Commission's recommendations concerning intelligence analysis, see FBI, National Press Office, FBI Responds to Report of the National Commission on Terrorist Attacks Upon the United States (July 22, 2004), at 2 (approving, inter alia, of the Commission's recommendation that "The FBI should institute the integration of analysts, agents, linguists, and surveillance personnel in the field so that a dedicated team approach is brought to bear on national security intelligence operations").
155 - Robert Mueller, Director, FBI, Statement before the House Judiciary Committee (May 20, 2009) (describing the vision for Field Intelligence Groups to be the "hub" of the FBI intelligence program).
156 - FBI Intelligence Analysts Association, Intel Shift "Needs to" Happen (February 26, 2010), at 4-5.
157 - Remarks by Sean Joyce.
158 - Intel Shift "Needs to" Happen, at 9.
159 - Id., at 11, 14.
160 - Id., at 16-25 (emphasis in original).
161 - Id., at 22.
162 - We note — as an indicator of FBI culture — that the FBI phone book still divides FBI personnel into two categories — agent and support — with analysts being listed in the support category.
163 - Immediately following 9/11, the then-new FBI Director, Robert Mueller, declared that the FBI's top priority was preventing domestic terrorist attacks and that the FBI needed to become an intelligence-driven rather than law enforcement-centric organization. As Director Mueller testified before Congress, "Today, we are focused on prevention, not simply prosecution. We have shifted from detecting, deterring, and disrupting terrorist enterprises to detecting, penetrating, and dismantling such enterprises — part of the FBI's larger culture shift to a threat-driven intelligence and law enforcement agency." Robert Mueller, Director, FBI, Statement before the Senate Judiciary Committee (March 5, 2008). And as stated by then-Attorney General Michael Mukasey, "The FBI is an intelligence agency, as well as a law enforcement agency. Its basic functions accordingly extend beyond limited investigations of discrete matters, and include broader analytic and planning functions." Attorney General Michael Mukasey, The Attorney General's Guidelines for Domestic FBI Operations (September 29, 2008), at 9.
164 - Id.
165 - The DCIS detailee in the Washington JTTF and his FBI supervisor decided not to conduct interviews of Hasan's superiors and colleagues in part due to the desire to avoid affecting Hasan's career, which they viewed as a legal imperative under Executive Order 12333 (a key executive order that sets forth operating principles for U.S. Intelligence Community) which mandates that investigative activities be conducted using the least intrusive means. We doubt that a military officer who communicates with a suspected terrorist [REDACTED] while holding a Secret- level security clearance and subject to deployment to a combat zone deserves the same level of concern for his career as a civilian who happens to come up during an investigation. We also note that the San Diego JTTF clearly had a different view of whether interviews were appropriate. Leaving aside whether the feast intrusive means test should have prevented interviews (a determination that would not have been supported by the Domestic Investigations Operations Guide itself), the least intrusive means test is relevant only to actual investigative tools such as interviews — not whether the FBI could share Hasan's communications with Army counterintelligence officials so that they could become aware of Hasan's contact with the Suspected Terrorist. And in fact, the least intrusive means test was not the driver for the FBI's failure to share Hasan's communications with DoD counterintelligence officials.
166 - See 18 U.S.C. Section 2332b(f); 28 C.F.R. Section 0.85(I); Homeland Security Presidential Directive 5.
167 - Agreement Governing the Conduct of Defense Department Counterintelligence Activities in Conjunction with the Federal Bureau of Investigation (signed by the Deputy Secretary of Defense and the Attorney General).
168 - Id , Section 6.C.2.
169 - Federal Bureau of Investigation, Electronic Communication, Counterterrorism Program Guidance: Notifications to Outside Agencies: Administrative and Operational Guidance (January 7, 2010).
170 - See, e.g., Joint Terrorism Task Force Standard Memorandum of Understanding Between the Federal Bureau of Investigation and Defense Criminal Investigative Service (hereinafter FBI/DCIS MOU), 2007, Section IX.A.
171 - Department of Justice, Office of the Inspector General, The Department of Justice's Terrorism Task Forces, No. 1-2005-007 (June 2005), at 68-74, 81-2.
172 - Federal Bureau of Investigation, Joint Terrorism Task Force: Task Force O fficer Orientation: A Reference Guide for New JTTF Task Force Officers (December 2009).
173 - Id.
174 - The Department ofJustice's Terrorism Task Forces, at 57.
175 - Anthony D'Angelo, Strategic Change and the Joint Terrorism Task Force: Ideas and Recommendations, Thesis for the Naval Postgraduate School (2007), at 83 (emphasis in original).
176 - Department of Defense, Office of the Inspector General, Results of the Independent Review — Fort Hood Shooting Incident (November 16, 2009), at 6.
178 - Strategic Change and the Joint Terrorism Task Force, at 81.
178 See, e.g., Federal Bureau of Investigation, National Joint Terrorism Task Force, Joint Terrorism Task Force Program: Mandatory Training for JTTF Members (January 15, 2010).
179 - The "319 Group," composed of current and former senior intelligence and law enforcement officials, has written that "the JTTFs operate as a hub-and-spokes system in which intelligence goes up but does not necessarily come back down, and there is little lateral communication. This guarantees FBI control of information, which other agencies resent as contrary to partnership." The 319 Group, America's Domestic Intelligence is Inadequate: The Country Still Lacks a Coherent National Domestic Intelligence-Collection Effort (June 2010), at 13. A former director of intelligence analysis at the New York Police Department has written that "local officials on JTTFs are functionally federalized: they are given access to classified information and are discouraged from reaching back to their home agencies." Samuel Rascoff, "The Law of Homegrown (Counter)Terrorism," in Texas Law Review (June 2010), at 1743.
180 - Federal Bureau of Investigation, Table of Contents for material provided to the Senate Committee on Homeland Security and Governmental Affairs, August 25, 2010.
|Join the GlobalSecurity.org mailing list|