A Failure to Follow Security Procedures
Had proper security procedures been followed, the attack should only have killed the security contractors, the vehicle driver and perhaps the Jordanian GID officer. But proper security measures were not followed, and several CIA officers rushed out to greet the unscreened Jordanian source. Reports indicate that the source had alerted his Jordanian handler that he had intelligence pertaining to the location of al Qaeda second-in-command Ayman al-Zawahiri. (There are also reports that al-Balawi had given his handlers highly accurate battle damage assessments on drone strikes in Pakistan, indicating that he had access to high-level jihadist sources.) The prospect of finally receiving such crucial and long-sought information likely explains the presence of the high-profile visitors from CIA headquarters in Langley and the station in Kabul — and their exuberance over receiving such coveted intelligence probably explains their eager rush to meet the source before he had been properly screened.
The attack, the most deadly against CIA personnel since the 1983 Beirut bombing, was clearly avoidable, or at least mitigable. But human intelligence is a risky business, and collecting human intelligence against jihadist groups can be flat-out deadly. The CIA officers in Khost the day of the bombing had grown complacent, and violated a number of security procedures. The attack thus serves as a stark reminder to the rest of the clandestine service of the dangers they face and of the need to adhere to time-tested security procedures.
A better process might have prevented some of the deaths, but it would not have solved the fundamental problem: The CIA had an asset who turned out to be a double agent. When he turned is less important than that he was turned into — assuming he had not always been — a double agent. His mission was to gain the confidence of the CIA as to his bona fides, and then create an event in which large numbers of CIA agents were present, especially the top al Qaeda analyst at the CIA. He knew that high-value targets would be present because he had set the stage for the meeting by dangling vital information before the agency. He went to the meeting to carry out his true mission, which was to deliver a blow against the CIA. He succeeded.
The Obama Strategy’s Weakness
In discussing the core weakness in the Afghan strategy U.S. President Barack Obama has chosen, we identified the basic problem as the intelligence war. We argued that establishing an effective Afghan army would be extremely difficult, if not impossible, because the Americans and their NATO allies lacked knowledge and sophistication in distinguishing friend from foe among those being recruited into the army. This problem is compounded by the fact that there are very few written documents in a country like Afghanistan that could corroborate identities. The Taliban would seed the Afghan army with its own operatives and supporters, potentially exposing the army’s operations to al Qaeda.
This case takes the problem a step further. The United States relied on Jordanian intelligence to turn a jihadist operative into a double agent. They were dependent on the Jordanian handler’s skills at debriefing, vetting and testing the now-double agent. It is now reasonable to assume the agent allowed himself to be doubled in an attempt to gain the trust of the handler. The Jordanians offered the source to the Americans, who obviously grabbed him, and the source passed all the tests to which he was undoubtedly subjected. Yet in the end, his contacts with the Taliban were not designed to provide intelligence to the Americans. The intelligence provided to the Americans was designed to win their trust and set up the suicide bombing. It is therefore difficult to avoid the conclusion that al-Balawi was playing the GID all along and that his willingness to reject his jihadist beliefs was simply an opportunistic strategy for surviving and striking.
Even though encountering al-Balawi was a stroke of luck for the TTP, the group’s exploitation of this lucky break was a very sophisticated operation. The TTP had to provide valuable intelligence to allow al-Balawi to build his credibility. It had to create the clustering of CIA agents by promising extraordinarily valuable intelligence. It then had to provide al-Balawi with an effective suicide device needed for the strike. And it had to do this without being detected by the CIA. Al-Balawi had a credible cover for meeting TTP agents; that was his job. But what al-Balawi told his handlers about his meetings with the TTP, and where he went between meetings, clearly did not indicate to the handlers that he was providing fabricated information or posed a threat.
In handling a double agent, it is necessary to track every step he takes. He cannot be trusted because of his history; the suspicion that he is still loyal to his original cause must always be assumed. Therefore, the most valuable moments in evaluating a double agent are provided by intense scrutiny of his patterns and conduct away from his handlers and new friends. Obviously, if this scrutiny was applied, al-Balawi and his TTP handlers were still able to confuse their observers. If it was not applied, then the CIA was setting itself up for disappointment. Again, such scrutiny is far more difficult to conduct in the Pakistani badlands, where resources to surveil a source are very scarce. In such a case, the intuition and judgment of the agent’s handler are critical, and al-Balawi was obviously able to fool his Jordanian handler.
Given his enthusiastic welcome at FOB Chapman, it would seem al-Balawi was regarded not only as extremely valuable but also as extremely reliable. Whatever process might have been used at the meeting, the central problem was that he was regarded as a highly trusted source when he shouldn’t have been. Whether this happened because the CIA relied entirely on the Jordanian GID for evaluation or because American interrogators and counterintelligence specialists did not have the skills needed to pick up the cues can’t be known. What is known is that the TTP ran circles around the CIA in converting al-Balawi to its uses.
The United States cannot hope to reach any satisfactory solution in Afghanistan unless it can win the intelligence war. But the damage done to the CIA in this attack cannot be overestimated. At least one of the agency’s top analysts on al Qaeda was killed. In an intelligence war, this is the equivalent of sinking an aircraft carrier in a naval war. The United States can’t afford this kind of loss. There will now be endless reviews, shifts in personnel and re-evaluations. In the meantime, the Taliban in both Pakistan and Afghanistan will be attempting to exploit the opportunity presented by this disruption.
Casualties happen in war, and casualties are not an argument against war. However, when the center of gravity in a war is intelligence, and an episode like this occurs, the ability to prevail becomes a serious question. We have argued that in any insurgency, the insurgents have a built-in advantage. It is their country and their culture, and they are indistinguishable from everyone else. Keeping them from infiltrating is difficult.
This was a different matter. Al-Balawi was Jordanian; his penetration of the CIA was less like the product of an insurgency than an operation carried out by a national intelligence service. And this is the most troubling aspect of this incident for the United States. The operation was by all accounts a masterful piece of tradecraft beyond the known abilities of a group like the TTP. Even though al-Balawi’s appearance was a lucky break for the TTP, not the result of an intentional, long-term operation, the execution of the operation that arose as a result of that lucky break was skillfully done — and it was good enough to deliver a body blow to the CIA. The Pakistani Taliban would thus appear far more skilled than we would have thought, which is the most important takeaway from this incident, and something to ponder.
