The Khost Attack and the Intelligence War Challenge

By George Friedman and Scott Stewart

As Khalil Abu-Mulal al-Balawi exited the vehicle that brought him onto Forward Operating Base (FOB) Chapman in Khost, Afghanistan, on Dec. 30, 2009, security guards noticed he was behaving strangely. They moved toward al-Balawi and screamed demands that he take his hand out of his pocket, but instead of complying with the officers’ commands, al-Balawi detonated the suicide device he was wearing. The explosion killed al-Balawi, three security contractors, four CIA officers and the Jordanian General Intelligence Department (GID) officer who was al-Balawi’s handler. The vehicle shielded several other CIA officers at the scene from the blast. The CIA officers killed included the chief of the base at Khost and an analyst from headquarters who reportedly was the agency’s foremost expert on al Qaeda. The agency’s second-ranking officer in Afghanistan was allegedly among the officers who survived.

Al-Balawi was a Jordanian doctor from Zarqa (the hometown of deceased al Qaeda in Iraq leader Abu Musab al-Zarqawi). Under the alias Abu Dujanah al-Khurasani, he served as an administrator for Al-Hesbah, a popular Internet discussion forum for jihadists. Jordanian officers arrested him in 2007 because of his involvement with radical online forums, which is illegal in Jordan. The GID subsequently approached al-Balawi while he was in a Jordanian prison and recruited him to work as an intelligence asset.

Al-Balawi was sent to Pakistan less than a year ago as part of a joint GID/CIA mission. Under the cover of going to school to receive advanced medical training, al-Balawi established himself in Pakistan and began to reach out to jihadists in the region. Under his al-Khurasani pseudonym, al-Balawai announced in September 2009 in an interview on a jihadist Internet forum that he had officially joined the Afghan Taliban.

A Lucky Break for the TTP
It is unclear if al-Balawi was ever truly repentant. Perhaps he cooperated with the GID at first, but had a change of heart sometime after arriving in Pakistan. Either way, at some point al-Balawi approached the Tehrik-i-Taliban Pakistan (TTP), the main Pakistani Taliban group, and offered to work with it against the CIA and GID. Al-Balawi confirmed this in a video statement recorded with TTP leader Hakeemullah Mehsud and released Jan. 9. This is significant because it means that al-Balawi’s appearance was a lucky break for the TTP, and not part of some larger, intentional intelligence operation orchestrated by the TTP or another jihadist entity like al Qaeda.

The TTP’s luck held when a group of 13 people gathered to meet al-Balawi upon his arrival at FOB Chapman. This allowed him to detonate his suicide device amid the crowd and create maximum carnage before he was able to be searched for weapons.

In the world of espionage, source meetings are almost always a dangerous activity for both the intelligence officer and the source. There are fears the source could be surveilled and followed to the meeting site, or that the meeting could be raided by host country authorities and the parties arrested. In the case of a terrorist source, the meeting site could be attacked and those involved in the meeting killed. Because of this, the CIA and other intelligence agencies exercise great care while conducting source meetings. Normally they will not bring the source into a CIA station or base. Instead, they will conduct the meeting at a secure, low-profile offsite location.

Operating in the wilds of Afghanistan is far different from operating out of an embassy in Vienna or Moscow, however. Khost province is Taliban territory, and it offers no refuge from the watching eyes and gunmen of the Taliban and their jihadist allies. Indeed, the province has few places safe enough even for a CIA base. And this is why the CIA base in Khost is located on a military base, FOB Chapman, named for the first American killed in Afghanistan following the U.S. invasion. Normally, an outer ring of Afghan security around the base searches persons entering FOB Chapman, who the U.S. military then searches again at the outer perimeter of the U.S. portion of the base. Al-Balawi, a high-value CIA asset, was allowed to skip these external layers of security to avoid exposing his identity to Afghan troops and U.S. military personnel. Instead, the team of Xe (the company formerly known as Blackwater) security contractors were to search al-Balawi as he arrived at the CIA’s facility.

A Failure to Follow Security Procedures
Had proper security procedures been followed, the attack should only have killed the security contractors, the vehicle driver and perhaps the Jordanian GID officer. But proper security measures were not followed, and several CIA officers rushed out to greet the unscreened Jordanian source. Reports indicate that the source had alerted his Jordanian handler that he had intelligence pertaining to the location of al Qaeda second-in-command Ayman al-Zawahiri. (There are also reports that al-Balawi had given his handlers highly accurate battle damage assessments on drone strikes in Pakistan, indicating that he had access to high-level jihadist sources.) The prospect of finally receiving such crucial and long-sought information likely explains the presence of the high-profile visitors from CIA headquarters in Langley and the station in Kabul — and their exuberance over receiving such coveted intelligence probably explains their eager rush to meet the source before he had been properly screened.

The attack, the most deadly against CIA personnel since the 1983 Beirut bombing, was clearly avoidable, or at least mitigable. But human intelligence is a risky business, and collecting human intelligence against jihadist groups can be flat-out deadly. The CIA officers in Khost the day of the bombing had grown complacent, and violated a number of security procedures. The attack thus serves as a stark reminder to the rest of the clandestine service of the dangers they face and of the need to adhere to time-tested security procedures.

A better process might have prevented some of the deaths, but it would not have solved the fundamental problem: The CIA had an asset who turned out to be a double agent. When he turned is less important than that he was turned into — assuming he had not always been — a double agent. His mission was to gain the confidence of the CIA as to his bona fides, and then create an event in which large numbers of CIA agents were present, especially the top al Qaeda analyst at the CIA. He knew that high-value targets would be present because he had set the stage for the meeting by dangling vital information before the agency. He went to the meeting to carry out his true mission, which was to deliver a blow against the CIA. He succeeded.

The Obama Strategy’s Weakness
In discussing the core weakness in the Afghan strategy U.S. President Barack Obama has chosen, we identified the basic problem as the intelligence war. We argued that establishing an effective Afghan army would be extremely difficult, if not impossible, because the Americans and their NATO allies lacked knowledge and sophistication in distinguishing friend from foe among those being recruited into the army. This problem is compounded by the fact that there are very few written documents in a country like Afghanistan that could corroborate identities. The Taliban would seed the Afghan army with its own operatives and supporters, potentially exposing the army’s operations to al Qaeda.

This case takes the problem a step further. The United States relied on Jordanian intelligence to turn a jihadist operative into a double agent. They were dependent on the Jordanian handler’s skills at debriefing, vetting and testing the now-double agent. It is now reasonable to assume the agent allowed himself to be doubled in an attempt to gain the trust of the handler. The Jordanians offered the source to the Americans, who obviously grabbed him, and the source passed all the tests to which he was undoubtedly subjected. Yet in the end, his contacts with the Taliban were not designed to provide intelligence to the Americans. The intelligence provided to the Americans was designed to win their trust and set up the suicide bombing. It is therefore difficult to avoid the conclusion that al-Balawi was playing the GID all along and that his willingness to reject his jihadist beliefs was simply an opportunistic strategy for surviving and striking.

Even though encountering al-Balawi was a stroke of luck for the TTP, the group’s exploitation of this lucky break was a very sophisticated operation. The TTP had to provide valuable intelligence to allow al-Balawi to build his credibility. It had to create the clustering of CIA agents by promising extraordinarily valuable intelligence. It then had to provide al-Balawi with an effective suicide device needed for the strike. And it had to do this without being detected by the CIA. Al-Balawi had a credible cover for meeting TTP agents; that was his job. But what al-Balawi told his handlers about his meetings with the TTP, and where he went between meetings, clearly did not indicate to the handlers that he was providing fabricated information or posed a threat.

In handling a double agent, it is necessary to track every step he takes. He cannot be trusted because of his history; the suspicion that he is still loyal to his original cause must always be assumed. Therefore, the most valuable moments in evaluating a double agent are provided by intense scrutiny of his patterns and conduct away from his handlers and new friends. Obviously, if this scrutiny was applied, al-Balawi and his TTP handlers were still able to confuse their observers. If it was not applied, then the CIA was setting itself up for disappointment. Again, such scrutiny is far more difficult to conduct in the Pakistani badlands, where resources to surveil a source are very scarce. In such a case, the intuition and judgment of the agent’s handler are critical, and al-Balawi was obviously able to fool his Jordanian handler.

Given his enthusiastic welcome at FOB Chapman, it would seem al-Balawi was regarded not only as extremely valuable but also as extremely reliable. Whatever process might have been used at the meeting, the central problem was that he was regarded as a highly trusted source when he shouldn’t have been. Whether this happened because the CIA relied entirely on the Jordanian GID for evaluation or because American interrogators and counterintelligence specialists did not have the skills needed to pick up the cues can’t be known. What is known is that the TTP ran circles around the CIA in converting al-Balawi to its uses.

The United States cannot hope to reach any satisfactory solution in Afghanistan unless it can win the intelligence war. But the damage done to the CIA in this attack cannot be overestimated. At least one of the agency’s top analysts on al Qaeda was killed. In an intelligence war, this is the equivalent of sinking an aircraft carrier in a naval war. The United States can’t afford this kind of loss. There will now be endless reviews, shifts in personnel and re-evaluations. In the meantime, the Taliban in both Pakistan and Afghanistan will be attempting to exploit the opportunity presented by this disruption.

Casualties happen in war, and casualties are not an argument against war. However, when the center of gravity in a war is intelligence, and an episode like this occurs, the ability to prevail becomes a serious question. We have argued that in any insurgency, the insurgents have a built-in advantage. It is their country and their culture, and they are indistinguishable from everyone else. Keeping them from infiltrating is difficult.

This was a different matter. Al-Balawi was Jordanian; his penetration of the CIA was less like the product of an insurgency than an operation carried out by a national intelligence service. And this is the most troubling aspect of this incident for the United States. The operation was by all accounts a masterful piece of tradecraft beyond the known abilities of a group like the TTP. Even though al-Balawi’s appearance was a lucky break for the TTP, not the result of an intentional, long-term operation, the execution of the operation that arose as a result of that lucky break was skillfully done — and it was good enough to deliver a body blow to the CIA. The Pakistani Taliban would thus appear far more skilled than we would have thought, which is the most important takeaway from this incident, and something to ponder.

SOURCE: gLOBAL iNTELLIGENCE