Did bulk surveillance programs really stop an American-born terrorist? Probably not

When Edward Snowden revealed the government’s vast surveillance programs in 2013, the Obama administration responded with a defense that sounded compelling: the high-tech spying apparatus had stopped terrorist attacks.

In a rush to provide success stories, senior officials cited the capture of an American terrorist whose case I knew well. I had spent several years reporting about David Coleman Headley, whose reconnaissance for Pakistani spymasters and terrorist chiefs was crucial to the 2008 terrorist attacks in Mumbai that killed 166 people, including six Americans.

Now the intelligence community was claiming the National Security Agency had played a key role in preventing Headley’s follow-up plot against a Danish newspaper in 2009.

That surprised me. In a series of stories and in the 2011 PBS Frontline documentary, “A Perfect Terrorist,” ProPublica had detailed multiple breakdowns in the US counterterror system that allowed Headley to elude detection for years despite tips that could have prevented the attacks.

I consulted with intelligence and law enforcement sources involved in the case, and they were mystified, too.

“When I first heard that statement, I was scratching my head,” a counterterror official told me. “I was trying to figure out how N.S.A. played a role. My recollection is that it wasn’t that much at all.”

The mystery soon deepened when ProPublica gained access to a trove of Snowden’s classified materials. Suddenly a new, previously hidden layer in the story emerged, one that largely contradicted the government’s claims and revealed Mumbai as a tragic case study in the strengths and limitations of high-tech surveillance – a rare look at how counterterrorism really works.

Our reporting airs tonight in “American Terrorist,” a major update of the 2011 Frontline film. It details the story of Headley’s eventual capture as well as the secret surveillance of Mumbai plotters that took place before and during the attacks. (We first reported some of the material in December with the New York Times.)

The Snowden documents show that, months before Mumbai, British intelligence began spying on the online communications of Zarrar Shah, a key plotter who was the technology chief for the Pakistani terror group Lashkar-e-Taiba.

Britain’s General Communications Headquarters, or GCHQ, had the ability to monitor many of Shah’s digital activities, including Web searches and emails, during weeks in which he did research on targets, handled reconnaissance data, and set up an internet phone system for the attack.

But based on documents and interviews, it appears that the British spy agency did not use its access to closely analyze data from Shah until a Lashkar attack squad invaded Mumbai on Nov. 26, 2008. Nor did the British tell the Americans they were watching Shah beforehand, despite the close alliance between GCHQ and the N.S.A.

The British data could have complemented separate chatter that the N.S.A. and C.I.A. were collecting about a potential attack on Mumbai, none of it related to Headley.

Senior US intelligence officials gave us their first account of their warnings to India about a Lashkar threat to sites in Mumbai frequented by Westerners, including the Taj Mahal Palace Hotel, the eventual ground zero.

Meanwhile, Indian intelligence had separately tracked Shah’s communications before the attack, another layer of a complex international scenario.

Once the shooting started, the spy agencies went into high gear. The British realized that prior targeting of Shah gave them real-time access to the Karachi control room from which Lashkar chiefs directed the three-day siege using phones and computers.

GCHQ and N.S.A. pulled a haul of intelligence from the monitoring of Shah and others that enabled analysts to assemble a “complete operations plan” of the plot, according to an N.S.A. document. The evidence helped the Western and Indian governments push Pakistan to crack down on Lashkar.

US officials emphasized that they had warned the Indians. British officials disputed the idea that they had information that could have prevented an attack; they said they would have shared such intelligence with India.

The Indian government did not respond to requests for official comment, though an official in the Intelligence Bureau, India’s counterterror service, told me his agency was not involved in monitoring Shah.

As with past failures to prevent terrorist attacks, more aggressive analysis and better intelligence-sharing could have made a difference. But high-tech spying has its limits.

“I’m not saying that the capacity to intercept the communications is not valuable,” said Charles (Sam) Faddis, a former C.I.A. counterterror chief. “Clearly that’s valuable.” Nonetheless, he added, it is a mistake to rely heavily on bulk surveillance programs in isolation.

“You’re going to waste a lot of money, you’re going to waste a lot of time,” Faddis said. “At the end, you’re going have very little to show for it.”

Headley represents another potential stream of intelligence that could have made a difference before Mumbai. He is serving 35 years in prison for his role. He was a Pakistani-American son of privilege who became a heroin addict, drug smuggler and DEA informant, then an Islamic terrorist and Pakistani spy, and finally, a prize witness for US prosecutors.

In recounting that odyssey, we previously explored half a dozen missed opportunities by US law enforcement to pursue tips from Headley’s associates about his terrorist activity. New reporting and analysis traces Headley’s trail of suspicious electronic communications as he did reconnaissance missions under the direction of Lashkar and Pakistan’s Inter-Services Intelligence Directorate (ISI).

Headley discussed targets, expressed extremist sentiments and raised other red flags in often brazen emails, texts and phone calls to his handlers, one of whom worked closely on the plot with Shah, the Lashkar communications chief targeted by the British.

US intelligence officials disclosed to me for the first time that, after the attacks, intensified N.S.A. monitoring of Pakistan did scoop up some of Headley’s suspicious emails. But analysts did not realize he was a US-based terrorist involved in the Mumbai attacks who was at work on a new plot against Denmark, officials admitted.

The sheer volume of data and his use of multiple email addresses and his original name, Daood Gilani, posed obstacles, US intelligence officials said. To perfect his cover as an American businessman, Headley had legally changed his name in 2006.

“They detected a guy named ‘Gilani’ writing to bad guys in Pakistan, communicating with terror and ISI nodes,” a senior US intelligence official said. “He wrote also in fluent Urdu, which drew interest. Linking ‘Gilani’ to ‘Headley’ took a long time. The N.S.A. was looking at those emails post-Mumbai. It was not clear to them who he was.”

“They hadn’t connected the dots,” the official said. “They had only some of the puzzle pieces. They needed something external, like a specific entity helping us.”

In fact, it was the FBI and Customs and Border Protection which finally zeroed in on Headley — with foreign help. FBI agents in Chicago told us the story for the first time during our reporting for the film.

On July 22, 2009, a lead landed on the desk of a youthful FBI agent named Jeremy Francis. He had joined a Chicago counterterror squad five days earlier. The tip was brief but specific: British intelligence was monitoring two suspected Al Qaeda militants in a northern city called Derby. The duo had received phone calls from a man in Chicago named David who planned to travel to meet them soon.

Francis and his partner traced the calls to a pay phone on Chicago’s north side. The agents worked with border protection analysts in Washington, D.C., who pored through flight manifests looking for passengers with the first name “David” who had imminent plans to fly Lufthansa from Chicago to Manchester via Frankfurt.

Border protection analysts whittled down the list to Headley, whom airport inspectors had questioned in the past. The FBI relayed his identity to British counterterror officers as his flight was in the air on July 25.

The British shadowed Headley in Derby. The suspected Al Qaeda men told him they couldn’t give him the $20,000, guns and volunteers he wanted for an attack on a Danish newspaper that had published cartoons of the Prophet Muhammad. European agencies monitored Headley as he traveled to Sweden and Copenhagen, where he did reconnaissance for the newspaper plot.

He came home to Chicago. FBI surveillance teams deployed. The case grew.

“At some point nearly every agent and analyst in the Chicago field office was working some aspect of this case,” Francis told us. “There were hundreds of people back in FBI headquarters that were working this case.”

Their most urgent fear: a plot in the United States. Headley’s simultaneous ties to Al Qaeda, Lashkar and Pakistan’s ISI were unprecedented.

“What’s the ISI’s role, what are they doing … is he working for them?” Robert J. Holley, the special agent in charge of the FBI’s Chicago Division, recalled thinking. “We don’t know what we have here.”

Once Headley had been identified, the N.S.A. played a role in the investigation. But our reporting showed that its contributions were more modest than the accounts offered by the intelligence community in 2013.

Senior officials had asserted that Headley’s Denmark plot was stopped by the N.S.A.’s 215 program, which involves bulk collection of US phone records: date, duration, numbers called. When a White House-appointed panel reviewed the 215 program’s role in counterterrorism investigations, however, it concluded the claim was wrong.

“We are aware of no indication that bulk collection of telephone records through section 215 made any significant contribution to the David Coleman Headley investigation,” David Medine, who chaired the Privacy and Civil Liberties Oversight Board, told us in an interview.

Senior officials also had suggested that the N.S.A.’s 702 program, which collects the content of overseas emails and other communications, foiled Headley’s plot. Interviews with counterterror officials showed that, in reality, it played only a support role.

The 702 program was “a piece of the investigation” that helped to map out Headley’s overseas contacts, Holley said. But he made it clear that the N.S.A. did not crack the Denmark case or identify Headley.

“This was not a plot, though, that is discovered by that program?” I asked Holley.

“That’s correct,” he said.

In interviews about our findings, US intelligence officials conceded that some of the assertions about the N.S.A.’s role in Headley’s capture were overstated, though they insisted that the agency’s work on the case was valuable.

Officials reminded me of the super-heated atmosphere after the Snowden revelations. The Obama administration was under pressure to defend secret programs that had never been discussed before. As a result, statements about Headley and other cases sometimes lacked nuance and accuracy, officials say.

“These were highly classified programs, and it took a while to analyze the benefits of the programs and to articulate them publicly,” Medine said.

Experts say portraying bulk surveillance and other intelligence programs as a magic bullet that can stop attacks is too simplistic. In reality, a mosaic of intelligence from multiple sources is usually required.

“Most threats are not detected by this kind of bulk collection alone,” said Andrew Liepman, a former deputy chief of the National Counterterrorism Center now with the Rand Corp. “Most of it is a combination of good work from the FBI, intel from human sources, and the product from N.S.A. is essential in this mix.”

The N.S.A. contributed to the massive amount of data investigators used to build a portrait of Headley during the weeks they shadowed him. As agents planned the arrest in early October of 2009, they consulted with an FBI behavioral specialist and Headley’s former DEA handler.

The assessment: Headley saw himself as a soldier. He responded with deference to authority and was likely to cooperate, as he had after past drug busts. The trick was to treat him with respect, like a worthy foe surrendering on the battlefield.

Headley was planning to leave the country again. Holley’s team decided to arrest him at O’Hare Airport after he passed through a security checkpoint. They would approach him discreetly — no drawn guns, no shouted commands, no swarm of agents in body armor.

It worked. He politely complied. The agents who escorted him to the interrogation room at the Chicago field office made his former DEA handler briefly visible. The message: time to change sides again.

Two agents, military veterans chosen for their interrogation skills, sat down with Headley. He didn’t stop talking for two weeks.

Although the communications surveillance had hinted at links to the Mumbai attacks, the agents were stunned by the extent of his role in the plot and his high-level contacts. He gave the FBI unprecedented evidence and intelligence about Al Qaeda, Lashkar and the hardest target of all, the ISI. His testimony resulted in the unprecedented US indictment of a serving ISI officer, known only as Major Iqbal, for the terrorist murders of the six Americans in Mumbai.

Missed Signals Before the Attack

Intelligence agencies in three countries followed key figures with high-tech surveillance tools in advance of the Mumbai attacks that killed 166 people in 2008, but they did not put the pieces together that could have helped them disrupt the plot. It was not until the attacks started that the agencies shared the surveillance they had gathered and the picture came into focus.

Today, Major Iqbal and other fugitive masterminds are at large in Pakistan protected by the ISI, an intelligence service that is nominally a US ally, according to Western and Indian officials and court documents. Although Pakistan arrested a few Lashkar bosses, their trial remains stalled – six years later.

In the latest display of impunity, two weeks ago Pakistani authorities released on bail Zaki ur-Rehman Lakhvi, the military chief of Lashkar.

Even the defendants behind bars are still a threat. Shah, Lashkar’s technology and communications chief, and his fellow militants continue to direct terrorist activity from the prison, according to current and former Western and Indian counterterror officials.

“They’re able to continue operating unfettered there,” said Tricia Bacon of American University, a former State Department intelligence analyst. “The control room that they once had in Karachi to oversee the Mumbai attacks they essentially now have in the prison in the middle of the military capital in Pakistan.”

That’s another reason why Headley’s story is still relevant. Justice has not been done.

This story by Sebastian Rotella was originally published by ProPublica and PBS Frontline. Go to ProPublica to read read more of his reporting on counterterrorism, national security and David Coleman Headley and the Mumbai attacks.