How the FBI, CIA, and Pakistani intelligence worked together -- or didn't -- in the global hunt for the mastermind behind September 11, 2001.
KARACHI, Pakistan, Autumn 2002 -- Everything the Americans could rustle up pointed to Karachi. Every source and bit of information said Khalid Sheikh Mohammed was operating out of the capital of Pakistan's Wild West. Back at Langley, the CIA's newly formed "KSM targeting team" had assembled a massive file on him that included all the disparate dots that the U.S. government had previously failed to connect. By then, a congressional joint inquiry was already cataloguing those failures. Once the Pakistani security services started looking in earnest, they found the same thing. Almost every Al Qaeda suspect they picked up in the last year had some connection to Mohammed. Many of those arrested had no links to one another, but they all knew Mohammed.
The Americans knew Karachi was a much tougher target than almost anywhere else in Pakistan, perhaps the world. Karachi in the best of times is a difficult city. With its "no-go" zones, rampant organized crime, and seemingly perpetual sectarian wars, it has been a kidnapping and murder capital for years. Much as California localities post warnings on what to do in case of an earthquake, bulletin boards in public buildings in Karachi routinely display advice on what to do in case of a kidnapping.
It is a mark of Karachi's cosmopolitanism that most of its millions of citizens carry on life as if this underworld does not exist. In that regard, it is in many ways no different from any other 21st century metropolis -- ungainly, exciting, raucous, difficult. There are hip clubs with DJs, cool new restaurants with enigmatic names, a burgeoning middle class. Kids ride bikes, markets hawk DVDs and digital cameras, the bright shiny silks of upscale ladies-about-town billow in the breeze. It is Pakistan's most progressive city, former home to its first female prime minister, Benazir Bhutto, and thousands of women go about the city unescorted, unveiled, running errands, going to jobs, lunch dates, and prenatal classes. Graduates of its university engineering programs are prized in technology centers and other outposts of the new world economy.
Still, especially after the 2002 murder of Wall Street Journal reporter Daniel Pearl, it seemed a woolly, scary place to do business. Agents routinely felt they needed to run what they called surveillance detection routes, SDRs, when they went to and from their living quarters.
Raids, even when they were able to mount them, didn't seem to produce much. Karachi was terribly overbuilt. Much of the construction industry was controlled by the military, and much of the military's money was illicit. It couldn't just sit around; it had to be put to use. It built buildings whether the market existed for them or not. So even a city that was growing an average of 5 percent a year had a perpetually high rate of vacant buildings. It made Karachi an easy place to hide. You could slip in and out of empty places -- a new one every day if you wanted; you could rent them for almost nothing. A series of raids in the spring and summer of 2002 had found a lot of empty flats.
. . .
In August, the FBI caught a break when it questioned a brother-in-law of KSM, Abdul Samad Din Muhammad, who had been arrested and questioned in the United Arab Emirates in November 2001 and extradited to Pakistan in 2002. Muhammad told FBI agents that Aziz Ali was in constant contact with his uncle, KSM. He also said Aziz Ali received a constant stream of Arab visitors from Pakistan at the airport and that Ali had suddenly bolted from the UAE a day or two before the Sept. 11 attacks. He didn't have his belongings together, but insisted on leaving. When Muhammad asked Aziz Ali why he was in such a rush to leave, he didn't get a satisfactory answer. FBI deputy legal attaché Jennifer Keenan, who was working closely on the case, was now certain that the way to get to KSM was through his nephew.
More raids initially yielded nothing, but in early September, the Pakistani police got lucky. Neighbors had pointed out that there was an awful lot of traffic through a house in the Gulshan-e-Iqbal neighborhood. Police nabbed a man leaving the house on his way to pay utility bills. Agents of the ISI investigated and detained the man, a Saudi native, who said he managed the house. His name was Mohammed Ahmad Rabbani. Rabbani's driver proved to be quite talkative. He said Rabbani and his brother managed several similar guesthouses, all of which had a constant stream of guests. He helpfully gave police the addresses of the houses.
One of the houses was nearby, on Tariq Road. Authorities raided it and found the brother there, along with two other men, two women, and three children. They also found 20 carefully wrapped passports and almost two dozen SEGA game consoles that had been modified for use as detonators for explosives. The passports were for members of Osama bin Laden's family. The police interrogated the children to determine if they were bin Laden's. One of the women was a caretaker, and one child was hers. Two of the children were brothers. The other woman was a nanny to the brothers -- and the man was her companion. The two boys, ages seven and nine, were named Omar and Abdullah. No, they said, their father's name was not bin Laden; it was Khalid Sheikh Mohammed. The women were caretakers and nannies. They couldn't say where Mohammed was, but they knew there were large parties of Arab men at guesthouses in the Defence Housing Authority, a generally upscale part of the city. The intelligence agents also learned that the men staying there were well-armed, and cautious. Rabbani had been instructed to rent the apartment two months earlier and wait, but was given no further details. The men had come one by one over a period of two weeks and had taken precautions to avoid detection. Once inside, they hadn't left for a month, while food, weapons and supplies were brought to them.
Khalid Sheikh Mohammed
The ISI retreated for the day. They contacted the Americans and organized for operations the next morning. They moved in overnight with a large assemblage of ISI, local Sindhi police, and Pakistani Army Rangers for backup. The American embassy in Islamabad had gotten a call at about 8:00 a.m. that morning about a possible big fish in Karachi. The new FBI legal attaché, Chuck Riley, dispatched Don Borelli, the WMD expert from Dallas, and another agent on temporary duty from Kansas City, Dave Cudmore. "Grab an overnight bag, head to Karachi, and haul ass," Riley told them. It took until 2:00 p.m. to get there.
When they got to Karachi, the two agents were told to sit tight. The Pakistanis babysat the house through the night.
The immediate neighborhood was just beyond the nicer sections of Defence; it was a commercial-industrial tract full of five- and six-story buildings, most with low-rent light-industry tenants: textile plants, zipper and button factories, and small machine shops. The streets were paved but the buildings were separated by bare dirt; they were shuttered in the front with metal roll-up doors. The streets were empty and dark.
After dawn, they stopped the caretaker coming back from morning prayers. He told them that the entire top floor, the fourth, was filled with Arabs. They'd been there for two months, he said, and overpaid on the rent. The soldiers moved in at sunrise and all hell broke loose. Hundreds of rounds, hours of shooting and grenade throwing, and two dead men later, the authorities secured the building. They searched room by room, and in a storage space under a stairwell they found the man who just weeks before had declared himself the coordinator of the September 11 attacks, Ramzi bin al-Shibh. He and another man held knives to their own throats, threatening to silence themselves before they could ever be made to talk. But Pakistani agents jumped them, and wrestled them down.
They raided the second building as well, with much less incident.
When the dust settled from the massive shootout at the Defence address, Borelli and Cudmore were taken to ISI headquarters in Karachi. They had put on their shalwar kameez, a traditional South Asian dress, before noticing that many of the ISI officers wore Western clothes, some of them jeans.
"We don't need to blend in; you do," the Americans were told.
The combined team of Pakistanis and Americans swept the houses.
They went to the location of the first shootout and found the place badly damaged. They entered to find an unexploded grenade, IED components, and a large cache of documents, including passports. It was late, so they called it a night and hit the next location in the morning. By then, FBI and CIA agents were on the lookout for Mukhtar. They were looking for other al-Qaeda operatives, too, including Walid bin Attash. At the Tariq Road location, they had found a prosthetic leg they thought was his. They didn't know whether it was a spare, or if he'd left in such haste that he had abandoned it.
The Americans processed the men who had been detained. They fingerprinted them and asked them to hold up a piece of cardboard with their names on it -- the closest thing to a mug shot they could muster. Ramzi bin al-Shibh was much bigger than the Americans had expected. He, too, had gained a lot of weight in his months of hiding in Pakistan. Most of the others were sullen, even angry. But bin al-Shibh had a smug look on his face. As Borelli took his picture, a CIA officer asked him if he had made a video -- a reference to the martyrdom tapes made by al-Qaeda fighters that were being found regularly on raids, including one that was believed to have been his.
He didn't say anything. Then "he got this weird goofy smile," one observer recalled. "A shit-eating grin, actually."
The Pakistani officers questioned the men caught at the various locations, including Rabbani. It was all very civilized. An ISI colonel served Rabbani tea as they talked. It was more like a chat; nothing like the rumored tales of ISI beatings of detainees. Rabbani described how he paid the bills, and was sort of an administrator. On further questioning, he said he was also watching KSM's children. At one point, the kids were brought into the room. They were scared, but brightened up after being given Coca-Colas.
"You have to help us out for the sake of the kids," the ISI colonel said. Most of the questions focused on KSM's whereabouts, and why was it that he wasn't at any of the locations when the raids occurred. Rabbani didn't know. Neither did his children, they said. KSM had vanished.
The FBI men combed through the buildings. They found automatic weapons, grenades, ammunition. They found cell phones, address books, laptop hard drives, desktop computers. KSM was not there. They had apparently just missed him at the first house the previous day -- again possibly by just a matter of minutes or hours. They found a letter he had signed "Mukh," for Mukhtar, advising a subordinate about a future attack on a pair of hotels.
If you were on the ground and asked, you could collect an address for KSM from almost every person you talked to. He was here in Defence, in a mansion. It was an apartment in Sharafabad, a mud hut in the swamp flats of Korangi, in the Baluch colony of Lyari, in a third-floor walk-up in that Arab neighborhood full of money changers and bucket shops. A man who was arrested had a phone number for Mohammed that was traced to the other end of town, a middle-class preserve of single-family homes with clean modern lines, behind pale stucco walls.
Suddenly, the man who had been nowhere for a decade was everywhere.
Everybody wanted to own the Ramzi bin al-Shibh capture. It was a huge score by nearly every measure -- the numbers of people arrested, the cache of materials recovered, the cooperation between the Pakistanis and the Americans. There had been hundreds of previous raids, but none had yielded the young children of an al-Qaeda captain or passports for a large part of Osama bin Laden's family.
As much as everyone involved wanted some credit for its successes, no one wanted even a small piece of the Khalid Sheikh Mohammed escape. The Pakistanis, in particular, were confounded by Mohammed.
"Karachi can never become a control center for al-Qaeda," one high-ranking ISI officer said. "We have informers on every street. Our total concentration is on Karachi, followed by Lahore, Faisalabad, and Peshawar, Quetta. That vendor on the street? He can be working for us. We are covering every street, every nook and corner. Let me tell you, you people have the habit of over-exaggerating the importance of these people. This KSM, I don't care a hoot about him. Their mobility has been brought to zero. We have this highly sophisticated electronic gadgetry, we have the [National] Crisis Management Cell center, we have PISCES [the U.S.-originated Personal Identification Secure Comparison and Evaluation System] ... and can tell anybody going in and out." The obvious question, of course, was that if the ISI had Pakistan so well covered, how had KSM been allowed to build the al-Qaeda network there before September 11 in the first place, and then rebuild it once again afterward?
Belief in their own infallibility was so deep that several top Pakistani military and intelligence officials maintained for months afterward that, in fact, KSM had been captured -- or, if not captured, killed. There were news reports that he was lying in state in a morgue; one senior government official told a journalist that KSM's "widow" had been returned to Egypt.
Pakistan as a society was accustomed to dealing with imperfect information about almost everything. It was often supposed that much public discourse was intended to mislead or obscure. Analysts routinely assumed as a starting point that a piece of public information was untruthful and proceeded from there, trying to discern in what way it was a lie, why it was told, and what it meant. In this case, one conclusion that could be drawn was that although the authorities had nearly caught KSM, they now had no idea exactly where he was.
KSM wasn't, of course, dead or captured; once again, he had somehow gotten away. No matter how close the call -- one Pakistani intelligence officer likened it to a Hollywood Western in which the good guys arrive to find the campfire coals still burning but their quarry gone -- the raid was a failure in that sense. But every raid told KSM's pursuers something, and this one had validated the broader notion that KSM had been in Karachi and that he had built a substantial infrastructure there.
All the evidence that had pointed to the sprawling city -- Yosri Fouda's interview and the resulting satellite intercepts; raids on other safe houses, one of which yielded copies of several 9/11 hijackers' passports; evidence from Ganczarski, Zubaydah, Padilla, and Guantanamo detainees -- had been correct. Connections to every al-Qaeda plot ran through the city. The ISI's claims notwithstanding, Karachi was a hub. More, Karachi was the hub.
No one could say how Mohammed escaped. Some American agents believed the presence of the children at the house suggested he'd been tipped off and fled in haste. Why else would he leave the children there? But there were other indications that Mohammed had set up a system of care for the children so he could pop in for playtime with them whenever possible. A woman caretaker found with the children indicated she was hired by KSM to provide them with an education.
KSM's escape stoked already considerable U.S. fears that he was being protected by elements within the Pakistani police, military, and intelligence agencies. Such fellow travelers, Keenan and others surmised, had probably been harboring KSM in Pakistan and around the world -- even as the FBI had ratcheted up its efforts to find him. His "wanted" posters had been up all over the world for years, and he had been on dozens of watchlists. Yet he seemed to wander with ease, and without fear.
In photos found at the house with his children, KSM was dressed in traditional Muslim tunic and kaffiyeh. He was shown with "at least one wife'' and several more children besides the two sons. In many of them, the children were smiling, and KSM was too.
To those entrusted with finding him, KSM remained a cipher. "We know less about him than any of the others,'' a senior FBI official said. "He was under everybody's radar. We don't know how he did it. We wish we knew.''
One of the prizes in the bin al-Shibh raid was a large suitcase that contained a virtual road map of Khalid Sheikh Mohammed's life, including bank records and his neatly framed diploma from North Carolina A&T. That piece of paper became another battle in the turf war between FBI and CIA agents, with the FBI wanting to keep it as evidence and accusing a senior CIA officer of putting it on the wall of his Karachi office as some sort of trophy or conversation piece. The disagreement spoke volumes about the rapidly deteriorating relationship between the two U.S. agencies after CIA station chief Bob Grenier's departure, a time when the CIA increasingly tried to keep its raids and seizures away from the FBI's Jennifer Keenan, whose confrontations with the agency were growing ever more bitter.
Grenier and Keenan had trusted one another and built a relationship, guarded as it was. The CIA veteran appreciated the value of keeping the FBI in the loop and bringing a law enforcement agent on each raid team, if for no other reason than to gather evidence for possible prosecutions. His replacement who we'll call Vance, had a far less inclusive view of the role the FBI should play in the war on terror. Keenan's difficulties were exacerbated by the fact that Reimann's replacement as FBI legal attaché in June 2002, Chuck Riley, went along with the CIA's plan. Riley operated from a position of some weakness, as he had virtually no counter-terrorism background; his last post had been in Sacramento, Calif.
The situation boiled over when Keenan pushed to travel from Islamabad to Karachi to participate in the interrogation of bin al-Shibh. When Vance refused, Keenan appealed to Washington and he was overturned. The veteran Al Qaeda expert was allowed to attend. But when Keenan got there, she was told to sit and be quiet while a CIA interrogator asked questions. Keenan fumed to headquarters that because the CIA was running the show, efforts to follow up on KSM's bank records and other documents that could lead to him were ignored. That was especially frustrating given the treasures agents found in Mohammed's huge, tattered, taped-together suitcase. Besides the photos, authorities also found bank statements, financial and operational records. "It was his life's stuff,'' said one agent on scene. "Anything that was important to him was in there.''
One great value of the luggage was as evidence that KSM was in touch with bin Laden and his family, and on the move. He wasn't fixed, but mobile. To transport and shelter the Al Qaeda exodus through Karachi, KSM had built a network of safe houses. One estimate put the number as high as fifty. That network now gave him a lifeline.
As a blow to KSM's ambitions, the capture of bin al-Shibh turned out to be insignificant. Bin al-Shibh was a key figure in the 9/11 plot, relaying instructions to the hijackers and passing their information back to Mohammed, but he was a functionary, not a mover in that plot or any other.
What his pursuers didn't know yet was that at the very time their hunt for him was at its most intense -- and in some respects, at its most promising -- KSM was busier than ever plotting and orchestrating attacks in Pakistan, Saudi Arabia, the UK, and the United States.
Excerpted from Terry McDermott and Josh Meyer's The Hunt for KSM: Inside the Pursuit and Takedown of the Real 9/11 Mastermind, Khalid Sheikh Mohammed (Little, Brown).