ABCDE

THURSDAY, OCTOBER 17, 2013 NSA role in drone strikes is revealed

Bin Laden associate 2004 and helped expose bin Laden’s cou- Hassan Ghul was killed as rier network before spending two years at a part of targeted U.S. program secret CIA prison. Then, in 2006, the Unit- ed States delivered him to his native Paki- by Greg Miller, stan, where he was released and returned Julie Tate to the al-Qaeda fold. and Barton Gellman But beyond filling in gaps about Ghul, the documents provide the most detailed It was an innocuous e-mail, one of account of the intricate collaboration be- millions sent every day by spouses with up- tween the CIA and the NSA in the drone dates on the situation at home. But this one campaign. was of particular interest to the National The Post is withholding many details Security Agency and contained clues that about those missions, at the request of U.S. put the sender’s husband in the cross hairs intelligence officials who cited potential of a CIA drone. damage to ongoing operations and national Days later, Hassan Ghul — an associ- security. ate of who provided a The NSA is “focused on discovering critical piece of intelligence that helped the and developing intelligence about valid for- CIA find the al-Qaeda leader — was killed eign intelligence targets,” an NSA spokes- by a drone strike in ’s tribal belt. woman said in a statement provided to The U.S. government has never pub- The Post on Wednesday, adding that the licly acknowledged killing Ghul. But docu- agency’s operations “protect the nation and ments provided to by its interests from threats such as terrorism former NSA contractor Edward Snowden and the proliferation of weapons of mass confirm his demise in October 2012 and re- destruction.” veal the agency’s extensive involvement in In the search for targets, the NSA has the targeted killing program that has served draped a surveillance blanket over dozens as a centerpiece of President Obama’s coun- of square miles of northwest Pakistan. In terterrorism strategy. Ghul’s case, the agency deployed an arse- An al-Qaeda operative who had a nal of cyber-espionage tools, secretly seiz- knack for surfacing at dramatic moments ing control of laptops, siphoning audio files in the post-Sept. 11 story line, Ghul was an and other messages, and tracking radio emissary to Iraq for the terrorist group at transmissions to determine where Ghul the height of that war. He was captured in might “bed down.” The e-mail from Ghul’s wife “about her current living conditions” contained enough detail to confirm the coordinates of that household, according to a docu- ment summarizing the mission. “This in- formation enabled a capture/kill operation Hassan Ghul against an individual believed to be Hassan THURSDAY, OCTOBER 17, 2013 KLMNO PAGE 2

Ghul on October 1,” it said. The file is part of a collection of records in the Snowden trove that make clear that the drone campaign — often depicted as the CIA’s exclusive domain — re- lies heavily on the NSA’s ability to vacuum up enormous quantities of e-mail, phone calls and other fragments of signals intelligence, or SIGINT.

‘Ours is a noble cause’ To handle the expanding workload, the NSA created a se- cretunit known as the Counter-Terrorism information that wouldn’t otherwise be Mission Aligned Cell, or CT MAC, to con- trapped in surveillance nets that it has set centrate the agency’s vast resources on at key Internet gateways. hard-to-find terrorism targets. The unit The new documents are self-congrat- spent a year tracking Ghul and his courier ulatory in tone, drafted to tout the NSA’s network, tunneling into an array of systems counterterrorism capabilities. One is titled and devices, before he was killed. Without “CT MAC Hassan Gul Success.” The files those penetrations, the document conclud- make no mention of other agencies’ roles ed, “this opportunity would not have been in a drone program that escalated dramati- possible.” cally in 2009 and 2010 before tapering off At a time when the NSA is facing in- in recent years. tense criticism for gathering data on Amer- Even so, former CIA officials said the icans, the drone files may bolster the agen- files are an accurate reflection of the NSA’s cy’s case that its resources are focused on contribution to finding targets in a cam- fighting terrorism and supporting U.S. op- paign that has killed more than 3,000 peo- erations overseas. ple, including thousands of alleged mili- “Ours is a noble cause,” NSA Director tants and hundreds of civilians, in Pakistan, Keith B. Alexander said during a public according to independent surveys. The of- event last month. “Our job is to defend this ficials said the agency has assigned senior nation and to protect our civil liberties and analysts to the CIA’s Counterterrorism privacy.” Center, and deployed others to work along- The documents do not explain how side CIA counterparts at almost every ma- the Ghul e-mail was obtained or whether it jor U.S. embassy or military base overseas. was intercepted using legal authorities that “NSA threw the kitchen sink at the have emerged as a source of controversy in FATA,” said a former U.S. intelligence of- recent months and enable the NSA to com- ficial with experience in Afghanistan and pel technology giants including Microsoft Pakistan, referring to the Federally Admin- and Google to turn over information about istered Tribal Areas, the region in north- their users. Nor is there a reference to an- west Pakistan where al-Qaeda’s leadership other NSA program facing scrutiny after is based. Snowden’s leaks, the agency’s metadata col- NSA employees rarely ventured be- lection of numbers dialed by nearly every yond the security gates of the U.S. Embassy person in the United States. in Islamabad, officials said. Surveillance To the contrary, the records indicate operations that required placing a device or that the agency depends heavily on highly sensor near an al-Qaeda compound were targeted network penetrations to gather handled by the CIA’s Information Opera- THURSDAY, OCTOBER 17, 2013 KLMNO PAGE 3

tions Center, which specializes in high-tech led to a trove of files that could be used to devices and “close-in” surveillance work. “help NSA map out the movement of ter- “But if you wanted huge coverage of rorists and aspiring extremists between Ye- the FATA, NSA had 10 times the manpow- men, Syria, Turkey, Egypt, Libya and Iran,” er, 20 times the budget and 100 times the according to the documents. “This may en- brainpower,” the former intelligence official able NSA to better flag the movement of said, comparing the surveillance resources these individuals” to allied security services of the NSA to the smaller capabilities of that “can put individuals on no-fly lists or the agency’s IOC. The two agencies are the monitor them once in country.” largest in the U.S. intelligence community, A single penetration yielded 90 en- with budgets last year of $14.7 billion for crypted al-Qaeda documents, 16 encryp- the CIA and $10.8 billion for the NSA. “We tion keys, 30 unencrypted messages as well provided the map,” the former official said, as “thousands” of chat logs, according to an “and they just filled in the pieces.” inventory described in one of the Snowden In broad terms, the NSA relies on in- documents. creasingly sophisticated versions of online The operations are so easy, in some attacks that are well-known among securi- cases, that the NSA is able to start down- ty experts. Many rely on software implants loading data in less time than it takes the developed by the agency’s Tailored Access targeted machine to boot up. Last year, a Operations division with code-names such user account on a social media Web site as UNITEDRAKE and VALIDATOR. In provided an instant portal to an al-Qaeda other cases, the agency runs “man-in-the- operative’s hard drive. “Within minutes, we middle” attacks in which it positions itself successfully exploited the target,” the docu- unnoticed midstream between computers ment said. communicating with one another, divert- ing files for real-time alerts and longer- Pursuing Ghul term analysis in data repositories. The hunt for Ghul followed a more Through these and other tactics, the elaborate path. NSA is able to extract vast quantities of Ghul, who is listed in other documents digital information, including audio files, as Mustafa Haji Muhammad Khan, had imagery and keystroke logs. The operations surfaced on U.S. radar as early as 2003, amount to silent raids on suspected safe when an al-Qaeda detainee disclosed that houses and often are carried out by experts Ghul escorted one of the intended hijackers sitting behind desks thousands of miles to a Pakistani safe house a year before the from their targets. Sept. 11, 2001, attacks. A trusted facilitator and courier, Ghul Wide-ranging reach was dispatched to Iraq in 2003 to deliver a The reach of the NSA’s Tailored Access message to Abu Musab al-Zarqawi, the al- Operations division extends far beyond Qaeda firebrand who angered the network’s Pakistan. Other documents describe efforts leaders in Pakistan by launching attacks to tunnel into systems used by al-Qaeda af- that often slaughtered innocent Muslims. filiates in Yemen and Africa, each breach When Ghul made another attempt exposing other corridors. to enter Iraq in 2004, he was detained by An operation against a suspected fa- Kurdish authorities in an operation di- cilitator for al-Qaeda’s branch in Yemen rected by the CIA. Almost immediately,

“This information enabled a capture/kill operation against an individual believed to be Hassan Ghul on October 1.” A document summarizing the mission THURSDAY, OCTOBER 17, 2013 KLMNO PAGE 4

Ghul provided a piece of intelligence that techniques,” Feinstein said in the state- would prove more consequential than he ment, which was signed by Sen. Carl Levin may have anticipated: He disclosed that bin (D-Mich.). Laden relied on a trusted courier known as The George W. Bush administration’s al-Kuwaiti. decision to close the secret CIA prisons in The ripples from that revelation 2006 set off a scramble to place prisoners wouldn’t subside for years. The CIA went whom the agency did not regard as dan- on to determine the true identity of al-Ku- gerous or valuable enough to transfer to waiti and followed him to a heavily fortified Guantanamo Bay. Ghul was not among the compound in Abbottabad, Pakistan, where original 14 high-value CIA detainees sent bin Laden was killed in 2011. to the U.S. installation in Cuba. Instead, he Because of the courier tip, Ghul be- was turned over to the CIA’s counterpart in came an unwitting figure in the contentious Pakistan, with ostensible assurances that debate over CIA interrogation measures. he would remain in custody. He was held at a CIA in Eastern A year later, Ghul was released. There Europe, according to declassified Justice was no public explanation from Pakistani Department memos, where he was slapped authorities. CIA officials have noted that and subjected to stress positions and sleep Ghul had ties to Lashkar-e-Taiba, a mili- deprivation to break his will. tant group supported by Pakistan’s intelli- Defenders of the interrogation pro- gence service. By 2007, he had returned to gram have cited Ghul’s courier disclosure al-Qaeda’s stronghold in Waziristan. as evidence that the agency’s interrogation In 2011, the Treasury Department program was crucial to getting bin Laden. named Ghul a target ofU.S. counterterror- But others, including former CIA opera- ism sanctions. Since his release, the depart- tives directly involved in Ghul’s case, said ment said, he had helped al-Qaeda reestab- that he identified the courier while he was lish logistics networks, enabling al-Qaeda being interrogated by Kurdish authorities, to move people and money in and out of who posed questions scripted by CIA ana- the country. The NSA document described lysts in the background. Ghul as al-Qaeda’s chief of military opera- The debate resurfaced amid the release tions and detailed a broad surveillance ef- of the movie “” last year, in fort to find him. which a detainee’s slip after a brutal inter- “The most critical piece” came with a rogation sequence is depicted as a break- discovery that “provided a vector” for com- through in the bin Laden hunt. Ghul’s case pounds used by Ghul, the document said. also has been explored in detail in a 6,000- After months of investigation, and surveil- page investigation of the CIA interrogation lance by CIA drones, the e-mail from his program by the Senate Intelligence Com- wife erased any remaining doubt. mittee that has yet to be released. Even after Ghul was killed in Mir Ali, Sen. Dianne Feinstein (D-Calif.), the the NSA’s role in the drone strike wasn’t chairman of the panel, sought to settle the done. Although the attack was aimed at “an Ghul debate in a statement last year that al- individual believed to be” the correct tar- luded to his role but didn’t mention him by get, the outcome wasn’t certain until later name. when, “through SIGINT, it was confirmed “The CIA detainee who provided the that Hassan Ghul was in fact killed.” most significant information about the [email protected] courier provided the information prior to [email protected] being subjected to coercive interrogation [email protected]