Class Exercise Simulated Report NSA 2 Final Report

Executive Summary NSA, CIA, FBI, and State Department intelligence indicate a large-scale attack will take place against the United States of America. The plan of attack is in its final stages and will take place on an upcoming Tuesday, most likely to take place on November 18, 2014. The primary plan of attack is believed to be a brute-force attack on an airplane. A group of 20 Middle Eastern men trained in martial arts plan to hijack an airplane departing from Harrisburg, PA bound to Florida. The group of men plans to take over the plane using martial arts skills and have a back up supply of binary explosives in soda bottles in case the primary plan fails. The final destination of the hijacked airplane is to crash into the United States Capitol Building in Washington D.C. in order to “finish the leg that was aborted in melee of 2001”. The attack will put thousands of American lives at risk, especially those with government power, and has potential to create nationwide panic.

Ayman Al-Zawahiri, the current leader of al Qaeda, is the leader of the planned terrorist plot. Abu Laith al-Libi is the gatekeeper for Ayman and Thirwat Shehata is the playmaker for the operation. Mahmoud Es Sayyid Jaballah is the operational and organizational lead. Ramadan Abdullah Mohammad Shallah is the financer of the operation and is in charge of recruitment and weapon procurement. Attila Selek provided logistical support and Sharif Mobley was tasked with recruiting and training martyrs. A strike team consisting of 20 martyrs is tasked with carrying out the attack and hijack. All of those included in the plot were under direct orders from Ayman Al-Zawahiri but were given the orders through multiple leaders to conceal the identity of the ultimate “ustaz”.

Analysis The leaders and those recruited for the attack were assigned specific task in order to create a successful operation. Ayman Al-Zawahiri is the “ustaz” of the planned terrorist operation. Al-Zawahiri is the current known leader of al Qaeda. Collected intelligence provides reliable information indicating the actors carrying out the terror plot are members of Islamist Extremist groups, including al Qaeda. Analysis of the CIA report of an email sent from an “amin”, which is believed to be a mistranslation and is actually supposed to be Ayman, supports the conclusion that Al-Zwahiri is the leader of the terror attack.

1

Abu Laith al-Libi is the gatekeeper for the terror plot. Al-Libi is the main actor that relays information to and from Al-Zawahiri in order to protect his identity for the greater good of the plot. The October 20 State Department report indicated Al-Libi was sen alive when it was believed that he was killed by a drone attack in early 2008. This information supports the notion that he would make a successful gatekeeper for he was not originally suspected to have not participated in the plot what so ever considering he was believed to be dead for six years.

Thirwat Salah Shehata is believed to be the playmaker in the terrorist plot. Thirwat, or sometimes referred to as Tarwat Salah Abdallah, is in charge of recruiting main players for fulfilling the plot. He recruited Mahmoud Es Sayyid Jaballah and continued to advise him. Thirwat is one of the main roles in the terror plot because of his connections.

Mahmoud Es Sayyid Jaballah, also believed to have the alias of “Khalil”, is the operational lead in the plot. Although he has been under house arrest for several years, he has recently been in contact with other known Islamic radicalists through the use of satellite phones. Mahmoud is the brother-in-law to Thirwat, which connects to Thirwat referring to recruiting his “brother”, Khalil. Mahmoud is literally Thirwat’s brother by marriage, not just his brother religiously, and Khalil is one of Mahmoud’s many aliases that he is known to have.

Ramadan Abdullah Mohammad Shallah is the financer of the plot. He has a PHD in banking and economics. He was contacted by Thirwat and Jaballah and requested to lend financial assistance. He is known as another “ustaz” which in this case means teacher for he was a professor at the University of Southern Florida before returning to Syria where he is now believed to be in hiding.

Ahmed Ressam is tasked with weaponry procurement. He has great skills in weapons, explosives, and poisons which can be explained by his training in Afghanistan where he was under the alias Benni Norris. Ressam contacts Sharif Mobley to assist weaponry procurement for he is an expert in hand-to-hand combat. Together, Ressam and Mobley, because of their respective expertise, are tasked with recruiting martyrs and obtaining necessary weaponry to carryout the plot.

Finally, Attila Selek is a necessary actor in the plot for creating the passports, which are vital to a successful operation. Jaballah contacted Attila for creating the 20 passports necessary for the strike team. The strike team, consisting of 20 martyrs, plans to use the passports in order to purchase flight tickets to carry out the attack on the flight from Harrisburg to Florida.

Refer to the Social Network Map on page 7 for a visual representation of the major actors involved in the terrorist attack and their position relative to the others involved. The Network Map provided was created with the help of the FBI in order to promote interagency collaboration.

The target of the planned attack is believed by to be the State Capitol in Washington D.C. by means of a hijacked flight departing from Harrisburg International Airport to some unspecified airport in Florida.

2 Although no specific target was outright stated in the collected intelligence, our analysis allowed us to narrow down the suspected target to being the Washington D.C. area, more specifically the Capitol Building. As specified in the email from “Amin” to Ressam, the flight is bound to Florida from KHIA. Upon further analysis we believe that KHIA is a mistranslation, which is actually meant to be Harrisburg International Airport, which is one of the northeastern airports that has reported suspicious activity. As well as reports of suspicious activity, Harrisburg International Airport was included in the fight data printouts found when the FBI searched Sharif Mobley’s residence. Upon inquiring more information of the flight path from Harrisburg to Florida we determined that the path does not fly to far from the Washington D.C. area which makes it an ideal flight to hijack and crash into the Capitol Building. As stated on November 6 NSA intelligence the main goal of the terrorist attack is to finish the final leg of the journey that was aborted in melee of 2001. The aborted attack in 2001 was set to crash into the Capitol Building. Based on the NSA intelligence there is further evidence that supports the intended target that is believed to be the Capitol Building, Washington D.C.

The attack will take place on November 18, 2014 mostly to occur in the morning during the Congress Session in the Cannon Building . CIA intelligence collection intercepted an email between Islamic terrorists involving an aircraft flight. The email is from “Amin”, which is believed to be Ayman Al-Zawahiri, to Ahmed Ressam finalizing plans for a flight from KHIA to Florida on a Tuesday. The intelligence indicates the plans are in the final stage indicating the attack will be on October 18, 2014. On October 18 Congress will be in session at 10 AM, coincidentally assessing interoperability communications progress after 9/11. The meeting is to be held in the Cannon Office, which is 0.3 miles from the Capitol Building. With important members of Congress present at the meeting, there will be high security focused on the Cannon building rather than on the Capitol. The more security on the Cannon Building means there is likely to be less security on the Capitol Building making it an ideal target for an attack. An attack on the Capitol Building is close enough to the meeting to cause a major disturbance, as well as widespread panic, and potential for massive amounts of casualties.

Weapons to be used for the attack are the bodies of martyrs and binary explosives. The bodies of martyrs as weapons indicate it will be a suicide mission. The primary means of attack for the operation is a brute-force attack. The 15-20 recruited and trained martyrs from the Toronto area have been training for months in a Tai Chi training facility. Early September CIA intelligence indicates the specific Tai Chi program the martyrs are enrolled in has the motto “turn your body into the ultimate weapon” which supports the conclusion that the primary attack will be brute-force. The 15-20 martyrs will take over the flight from Harrisburg to Florida by sheer combat and redirect it’s path to the capitol building. If the brute-force attack fails, the binary explosives will be used as the secondary plan in order to assist a successful takeover of the flight.

An early report from the State Department provided information of stolen military equipment and explosives from Canadian forces ammunition depot. The stolen goods included long-range sniper rifles, 200 rounds of ammunition, 600 grams of RDX, and various protective clothing and gear. It is believed the powder from the ammunition can be used as a detonator for the binary explosives if necessary. Based on the report October 12 FBI report of sounds of fireworks and

3 remnants of bottles and components of binary explosives, the binary explosives are successful and can be used if at all necessary.

The weapons have been procured through recruitment and training of martyrs as well as using the finances to purchase various amount of supplies for the binary explosives. Ahmed Ressam and Sharif Mobley are the experts in firearms, explosives, poisons, and hand-to- hand combat. Together they are the recruiters and trainers of martyrs who will do the work of Allah and carry out the attack on the infidels. Ahmed was tasked to use his expertise in firearms, explosives, and poisons to obtain the necessary supplies for creating the binary explosives as well as recruiting more martyrs to assist in the plot. Ahmed contacted Sharif Mobley as the sole recruiter and trainer for the group of 15-20 men to carry out the brute-force attack. Mobley recruited at least 12 Middle Eastern men from Toronto and trained at a Tai Chi facility for months leading up to the event. Information from an early August CIA report indicates that not only is Ressam acquiring binary explosive supplies, but the recruited martyrs and families are assisting in obtaining the supplies. CIA intelligence indicates the father of a man with a suspected terror affiliation attempted to acquire fixor explosive materials, which is a type of binary explosive made from two plastic bottles, one with flammable liquid, and the other with inert powder, that is activated when the powder and liquid are combined and shaken. This information indicates that there were many persons attempting to acquire a sufficient amount of supplies thus supporting the notion that this attack is bound to be a large-scale attack.

The attack is fully funded by a 4.21 million US dollar “donation” from known Islamist member, Ramadan Shallah, into the bank account of the Toronto branch of the Islamic Relief Organization. Intelligence from the US Department of Terrorist Finance Tracking Program indicated a deposit of 4.21 million US dollars into a Canadian bank account for the Toronto branch of International Islamic Relief Organization. Ramadan Shallah, who is on the FBI’s most wanted list and has educational history in banking and economics, made the deposit. The deposit provided routing information that indicates that the sender was physically in the area of Damascus Syria, which is consistent with the speculation that Shallah is hiding out in the Damascus area of Syria.

The deposited 4.21 million US dollars is believed to be use for financing the 20 necessary passports, the Tai Chi classes, airplane flights, payment to the martyrs and their families in case of death, and supplies for the binary explosives.

False Leads include as the operational lead, as the target, and EuroDisney as the target of the attack. CIA intelligence indicates Fateh Kamel and Mahmoud Jaballah as the organizational/operational lead in the terrorist plot. The separate reports are contradictory to each other, which indicates one of the reports is a false lead. The CIA report indicating Fateh Kamel as the lead in the plot also designates the target of the attack as a European target, which is not consistent with the bulk of the intelligence. The inconsistency with the CIA reports about Kamel prompted extra analysis of the rest of CIA reports to check for more possible inconsistencies or misleads. The inconsistencies along with the NSA report indicating the terrorist group is feeding a CIA case officer false information have lead to the conclusion that the majority of the CIA reports are unreliable.

4 Various CIA reports give information of an attack on , more specifically, Paris. Another report from the State Department contradicted the reports of an attack on Paris by indicating there was going to be an attack on EuroDisney. The State Department report specifies there is terrorist movement east of Paris, which plans to attack the EuroDisney facility whereas earlier CIA reports provide information of terrorist movement in Northern France. The locations of the terrorist movement are contradictory to each other and further support the France attack is just a false lead to distract the infidels from the real target, The Capitol Building.

July CIA intelligene blatantly stated that Kamel as the operational leader of the terrorist plot, which raised concerns about how not-so-secretive the terrorists were being. The same CIA report, which stated Kamel as the operational leader also stated the target would be a European target which is inconsistent with the rest of the intelligence. A European target is highly unlikely due to the fact that almost all of the recruiting of martyrs has taken place in . If there were to be an attack on a European target it would be much more beneficial to the terrorists to recruit members on closer soil. The unlikelihood that the terrorist would recruit members from a very distant branch of the organization further acknowledges that the attack is to be on US soil and not on any European target.

5 Team Member Contributions • Lindsay Henzes – Powerpoint, Timeline, Speaker, Target Analyst, Date of Attack analyst • Jacob Sisko – Powerpoint, Character Map, Character Analyst • Joe Garnett – Weapon analyst, Weapon procurement analyst, Character analyst • Richard Rafferty – Executive Summary, Financial analyst, false leads analyst • All team members have been active and present throughout the course of this project. The workload from this Final Report and the previous BLUFs has been evenly distributed amongst the team members resulting in a completely combined effort for the project.

6

Social Network Ustaz Map LEADER *Made in conjunction with the FBI for Ayman Al greater interagency cooperation Zawahiri

Gatekeeper Abu Laith Al- Libi Financing

Ramadan Shallah

Strike Team Playmaker Thirwat Shehata 15-20 Middle Eastern Martyrs Operational

Lead

Mahmoud

Jaballah Logistical Support

“Khalil” Martyr Recruitment/ Training Attila Selek

Sharif Mobley

Weapon Procurement/ Recruitment

Ahmed Ressam

7

Event Timeline

July 2 July 10 July 15 July Member must find Confirmed help from Mahmoud Jaballah as GOP concerned with bother with contacts to Khalil organizational leader large scale terrorist the infidels attack

July 10 July July Theft of military July Increased radical Suspicious activity at Al equipment and Kamel tasked as Islamist activity in Qaida safe house in explosives from CFAD operational lead Toronto, Canada province of Khorasan

July 20 July 20 Late July August 4 Khalil contacts Ahmed to Ressam contacted Attack will involve Attila was contacted and recruit Attila Mobley to recruit and binary explosives asked to make the 20 train men passports

August 12 Early August August 8 August 5 4.21 mil US dollars Binary explosive Ahmed instructed to Concern of double agent deposited into Canadian obtaining activity in contact Ramadan arises bank Toronto Shallah for finances

September 5 Mid-August Late August Early September 12 men ready – need 20 Kamel organizing attack Sheer force or binary Movement of violent – crossing border from on Paris explosive attack likely individuals in N. France Canada

October 1 September 23 September 16 Early September Suspicious activities and Suspicious documents Khalil received sufficient 15 muslim men enrolled questions in found in Sharif Mobley’s amount of money from in Tai Chi training in northeastern airports car Ramadan Shallah Toronto

October 5 October 6 October 8 October 12 Suspicious bag with fake Trained group of Unidentified person Explosives heard near passports found near specialists will be ready feeding CIA false Englewood, NJ Watertown, NY soon information

October 22 October 20 October 18 Early October Mobley taken into custody Ressam plays important French intel says no Abu Laith Al-Libi seen - fake IDs, flightplans, role in the plot – final signs of terrorist attack alive traces of explosives target selected on Paris

October 24 Early November October 24 October 23 Selek detained at Philly Ressam concerned Recent increase of Eurodisney, France, airport with suspicious about Selek arrest, visitor’s to Mobley possible new target passports and supplies “Khalil” is not concerned

November 11 Mid November November 6 November 2 Major terrorist attack in Target finalized being Ustaz orders to finish Khalil contacted Tarwat final stages; analysis from KHIA to Florida on final leg of aborted worried about Selek continues a Tuesday journey in melee of 2001

8