The Content and Context of Anwar Awlaki's E-mails with Fort Hood Shooter Nidal Hasan

Probably the most difficult, bedeviling problem in combating terrorism through law enforcement is interpreting the words of suspects to divine their real intentions, then to build a case from that interpretation.

It seems to me that this issue is exemplified by the long-withheld e-mail exchange between the radical American cleric Anwar Awlaki and the Fort Hood shooter, Major Nidal Hasan.

My friend Daveed Gartenstein-Ross has a new entry over at Gunpowder and Lead, with Lauren Morgan, outlining the case for rating the e-mail exchange as a high threat and arguing that it should have prompted more aggressive investigative action. The post was prompted by a question from Charles Cameron.

I waited for this post before ringing in, because I wanted to see if I would be swayed by Daveed's argument, which he broadly telegraphed on Twitter last week. While we ultimately reach the same conclusion -- that the FBI and Defense Department should have investigated Hasan more aggressively -- we get there by a different path and with somewhat different areas of emphasis.

I'm not going to summarize the G&L post, which you should read before proceeding, precisely because it so thorough in its treatment of the question. But therein lies the rub. We're scrutinizing these emails and how they were handled. Why? Because we now know one person involved carried out a horrific act of terrorism and the other became a top Al Qaeda propagandist.

Nothing in Daveed's argument is wrong and it all falls within the scope of what he and Lauren set out to examine. There are clearly markers of concern in these e-mails, and the fact they involve an active duty military officer and a known radicalizer with links to September 11 is alone sufficient reason for the Washington Field Office to have escalated the case, at least to the point of an interview with Hasan and his immediate superiors.

But I think there are distractions lurking here, which move us away from what actually went wrong and what lessons we should learn.

I want to raise two key issues in this respect, because I think it's hard to really understand the case without them. This doesn't negate the points raised by Daveed and Lauren, but I feel that the context here is so important that it's misleading to consider the issue without acknowledging them.

The first issue has to do with the relationship between the FBI's San Diego and Washington Field Offices. If you read the more thorough Senate Homeland Security Committee report, the more telling Webster Commission Report, and records released by the 9/11 Commission, you don't have to squint very hard between the lines to see there were political tensions between the two offices, which I have also heard from multiple sources with knowledge of the situation.

Much of this tension specifically revolved around Awlaki and long preceded the Hasan emails. The Awlaki investigation ping-ponged back and forth between the two offices like a hot potato since 2001. These tensions resulted in strained and often inadequate communication between the two branches, which creates inertia and resistance and obstacles to effective, objective functioning.

This doesn't excuse the handling of the case. If anything, an institutional management failure is more damnable than a simple oversight or misinterpretation. But the testy relationship between the offices, clearly illuminated in the Webster report, has little to do with the content of the investigation.

When we're looking for lessons learned, it's my opinion (based on what we know today) that the will to analyze may have been a larger issue than the approach to analysis.

The characterization of the e-mails by unnamed officials as "fairly benign," which Daveed rightly attacks, was an after-the-fact effort at spin. It deserves to be refuted but also points to the second issue.

Anyone who has spent time with raw intelligence knows that you have to triage leads. For every intercept that states "I've bought the fertilizer and I'm loading it in the truck tonight down by the lake," there are literally thousands and thousands that say "I hate America," "I love Al Qaeda," "I'd like to kill those bastards," "I swear to God it's time for action and not words," "If I was James Holmes, here's how I would have done it better," "You need to start mentally preparing now to kill your neighbors when the revolution comes," and "Would you consider someone like Hasan Akbar to be fighting jihad, and if he died would he be a martyr?" (All of the above are paraphrases of actual extremist content I've reviewed.)

The words of suspects -- whether recounted in e-mails, phone intercepts, informant reports, or online postings -- must be interpreted and prioritized relative to dozens or hundreds or thousands of other leads. This can be a science if you're a trained FBI profiler, but it's strictly an art if you're anyone else. Zach Chesser's online output, to the layman, was pretty alarming and seemed to indicate he might try to act out violently on U.S. soil, but he never did. And even profilers cannot read intent from most verbal and written content with absolute reliability.

Based on who Hasan was (a military officer), who he was talking to (a suspected 9/11 accomplice), and the fact he repeatedly tried to get Awlaki's attention using a variety of stratagems, the case should have been escalated and Hasan's superiors should have been informed.

But when you place the content of Hasan's messages alongside all the other raw intelligence that counterterrorism investigations generate, it's extremely hard to argue from a subjective, non-psychoanalytical reading that they represented a red flag.

Even putting aside the broad universe of raw intelligence, consider just the workload generated by the Awlaki Web site intercept and what we don't know about the nature of that content.

If you get 60 leads per day featuring people writing to Awlaki, are half asking what concrete steps they can take to participate in jihad? Are the other half are oblique in the same way Hasan was oblique? Which would you prioritize?

Hasan's e-mails didn't exist in a vacuum; they competed for attention with an unknown number of other e-mails featuring unknown content from Awlaki's Web site but also his email accounts as well as traffic from other investigations. The Webster report indicates that two San Diego analysts were processing an average of 65 to 70 electronic intercepts per day. Although it does not specify if all of those were related to Awlaki, other figures quoted in the report would be consistent with that conclusion. (H/T @emptywheel) The exact content distribution is unknown.

It's difficult to separate hindsight from our analysis. We approach these emails looking for evidence of Hasan's intentions, but we already know his actual intentions. If we read the thousands of e-mails generated during the period Hasan was corresponding with Awlaki, without any names attached, would we pick Hasan's messages as the most important? Would they even make the top 10 or the top 100? I suspect they would not.

It would be interesting to approach this subject from the perspective of a blind study, analyzing dozens of unlabeled intercepts -- some from people who went on to act violently, and some from people who did not. I'd bet serious money such an experiment would be a massive failure and would not reliably identify which subjects became violent and which did not.

Without such a study in hand (and if you have one, please send), we need to acknowledge the lack of hard data correlating different types of talk with physical action and the subjectivity of the exercise. The content certainly informs our understanding, but I don't think it leads to a "lesson learned" moment.

I don't disagree with the content markers noted by Daveed and Lauren, but I think it's a mistake to say those markers can be interpreted with much certainty without the benefit of hindsight. I'm not claiming this is their actual argument -- I think they're arguing to include context -- but I came away from reading the piece feeling that there was too much emphasis on the content and too much certainty about its significance.

It is, of course, important to understand and study content, but you can't point to a reference to Hasan Akbar in a vacuum and say it's significant, unless you've looked at a constellation of similar references and attempted to correlate them to action.

I don't think this particular example illustrates useful investigative triggers that are likely to result in improved screening, and I don't think it illustrates a systemic failure that requires correction. The "lesson learned" is that the context of the messages should have escalated the investigation (and prompted more attention to the content).

If the content of the Hasan e-mails represents a threshold for escalated investigative concern, we're going to need a whole lot more FBI agents. I see dozens of online postings and messages per day that are far more worrisome than these e-mails, yet it is extraordinarily rare for these posts to connect with terrorist acts in any way. We need more study of how talk correlates to action, but the art of textual interpretation is not simple and rarely leads to black-and-white answers.

For more about American jihadists, check out J.M. Berger's new book, Jihad Joe: Americans Who Go to War in the Name of Islam, on sale everywhere.


This post was updated at 1:47 p.m. 

Labels: American-Al-Qaeda, American-Terrorists, Anwar-Awlaki, Fort-Hood, Jihad-Joe, Nidal-Malik-Hasan

Views expressed on INTELWIRE are those of the author alone.

Posted by J.M. Berger | Permalink