This article was first published on the Stratfor website.
The author, George Friedman, is chairman and CEO of Stratfor, the
world’s leading online publisher of geopolitical intelligence.
As Khalil Abu-Mulal al-Balawi exited the vehicle that brought him
onto Forward Operating Base (FOB) Chapman in Khost, Afghanistan, on
Dec. 30, 2009, security guards noticed he was behaving strangely. They
moved toward al-Balawi and screamed demands that he take his hand out
of his pocket, but instead of complying with the officers’ commands,
al-Balawi detonated the suicide device he was wearing. The explosion
killed al-Balawi, three security contractors, four CIA officers and the
Jordanian General Intelligence Department (GID) officer who was
al-Balawi’s handler. The vehicle shielded several other CIA officers at
the scene from the blast. The CIA officers killed included the chief of
the base at Khost and an analyst from headquarters who reportedly was
the agency’s foremost expert on al Qaeda. The agency’s second-ranking
officer in Afghanistan was allegedly among the officers who survived.
Al-Balawi was a Jordanian doctor from Zarqa (the hometown of
deceased al Qaeda in Iraq leader Abu Musab al-Zarqawi). Under the alias
Abu Dujanah al-Khurasani, he served as an administrator for Al-Hesbah,
a popular Internet discussion forum for jihadists. Jordanian officers
arrested him in 2007 because of his involvement with radical online
forums, which is illegal in Jordan. The GID subsequently approached
al-Balawi while he was in a Jordanian prison and recruited him to work
as an intelligence asset.
Al-Balawi was sent to Pakistan less than a year ago as part of a
joint GID/CIA mission. Under the cover of going to school to receive
advanced medical training, al-Balawi established himself in Pakistan
and began to reach out to jihadists in the region. Under his
al-Khurasani pseudonym, al-Balawai announced in September 2009 in an
interview on a jihadist Internet forum that he had officially joined
the Afghan Taliban.
A Lucky Break for the TTP
It is unclear if al-Balawi was ever truly repentant. Perhaps he
cooperated with the GID at first, but had a change of heart sometime
after arriving in Pakistan. Either way, at some point al-Balawi
approached the Tehrik-i-Taliban Pakistan (TTP), the main Pakistani
Taliban group, and offered to work with it against the CIA and GID.
Al-Balawi confirmed this in a video statement recorded with TTP leader
Hakeemullah Mehsud and released Jan. 9. This is significant because it
means that al-Balawi’s appearance was a lucky break for the TTP, and
not part of some larger, intentional intelligence operation orchestrated by the TTP or another jihadist entity like al Qaeda.
The TTP’s luck held when a group of 13 people gathered to meet
al-Balawi upon his arrival at FOB Chapman. This allowed him to detonate
his suicide device amid the crowd and create maximum carnage before he
was able to be searched for weapons.
In the world of espionage, source meetings are almost always a
dangerous activity for both the intelligence officer and the source.
There are fears the source could be surveilled and followed to the
meeting site, or that the meeting could be raided by host country
authorities and the parties arrested. In the case of a terrorist
source, the meeting site could be attacked and those involved in the
meeting killed. Because of this, the CIA and other intelligence
agencies exercise great care while conducting source meetings. Normally
they will not bring the source into a CIA station or base. Instead,
they will conduct the meeting at a secure, low-profile offsite location.
Operating in the wilds of Afghanistan is far different from
operating out of an embassy in Vienna or Moscow, however. Khost
province is Taliban territory, and it offers no refuge from the
watching eyes and gunmen of the Taliban and their jihadist allies.
Indeed, the province has few places safe enough even for a CIA base.
And this is why the CIA base in Khost is located on a military base,
FOB Chapman, named for the first American killed in Afghanistan
following the U.S. invasion. Normally, an outer ring of Afghan security
around the base searches persons entering FOB Chapman, who the U.S.
military then searches again at the outer perimeter of the U.S. portion
of the base. Al-Balawi, a high-value CIA asset, was allowed to skip
these external layers of security to avoid exposing his identity to
Afghan troops and U.S. military personnel. Instead, the team of Xe (the
company formerly known as Blackwater) security contractors were to
search al-Balawi as he arrived at the CIA’s facility.
A Failure to Follow Security Procedures
Had proper security procedures been followed, the attack should only
have killed the security contractors, the vehicle driver and perhaps
the Jordanian GID officer. But proper security measures were not
followed, and several CIA officers rushed out to greet the unscreened
Jordanian source. Reports indicate that the source had alerted his
Jordanian handler that he had intelligence pertaining to the location
of al Qaeda second-in-command Ayman al-Zawahiri. (There are also
reports that al-Balawi had given his handlers highly accurate battle
damage assessments on drone strikes in Pakistan, indicating that he had
access to high-level jihadist sources.) The prospect of finally
receiving such crucial and long-sought information likely explains the
presence of the high-profile visitors from CIA headquarters in Langley
and the station in Kabul — and their exuberance over receiving such
coveted intelligence probably explains their eager rush to meet the
source before he had been properly screened.
The attack, the most deadly against CIA personnel since the 1983
Beirut bombing, was clearly avoidable, or at least mitigable. But human
intelligence is a risky business, and collecting human intelligence
against jihadist groups can be flat-out deadly. The CIA officers in
Khost the day of the bombing had grown complacent, and violated a
number of security procedures. The attack thus serves as a stark
reminder to the rest of the clandestine service of the dangers they
face and of the need to adhere to time-tested security procedures.
A better process might have prevented some of the deaths, but it
would not have solved the fundamental problem: The CIA had an asset who
turned out to be a double agent. When he turned is less important than
that he was turned into — assuming he had not always been — a double
agent. His mission was to gain the confidence of the CIA as to his bona
fides, and then create an event in which large numbers of CIA agents
were present, especially the top al Qaeda analyst at the CIA. He knew
that high-value targets would be present because he had set the stage
for the meeting by dangling vital information before the agency. He
went to the meeting to carry out his true mission, which was to deliver
a blow against the CIA. He succeeded.
The Obama Strategy’s Weakness
In discussing the core weakness in the Afghan strategy U.S. President Barack Obama has chosen,
we identified the basic problem as the intelligence war. We argued that
establishing an effective Afghan army would be extremely difficult, if
not impossible, because the Americans and their NATO allies lacked
knowledge and sophistication in distinguishing friend from foe among
those being recruited into the army. This problem is compounded by the
fact that there are very few written documents in a country like
Afghanistan that could corroborate identities. The Taliban would seed
the Afghan army with its own operatives and supporters, potentially
exposing the army’s operations to al Qaeda.
This case takes the problem a step further. The United States relied
on Jordanian intelligence to turn a jihadist operative into a double
agent. They were dependent on the Jordanian handler’s skills at
debriefing, vetting and testing the now-double agent. It is now
reasonable to assume the agent allowed himself to be doubled in an
attempt to gain the trust of the handler. The Jordanians offered the
source to the Americans, who obviously grabbed him, and the source
passed all the tests to which he was undoubtedly subjected. Yet in the
end, his contacts with the Taliban were not designed to provide
intelligence to the Americans. The intelligence provided to the
Americans was designed to win their trust and set up the suicide
bombing. It is therefore difficult to avoid the conclusion that
al-Balawi was playing the GID all along and that his willingness to
reject his jihadist beliefs was simply an opportunistic strategy for
surviving and striking.
Even though encountering al-Balawi was a stroke of luck for the TTP,
the group’s exploitation of this lucky break was a very sophisticated
operation. The TTP had to provide valuable intelligence to allow
al-Balawi to build his credibility. It had to create the clustering of
CIA agents by promising extraordinarily valuable intelligence. It then
had to provide al-Balawi with an effective suicide device needed for
the strike. And it had to do this without being detected by the CIA.
Al-Balawi had a credible cover for meeting TTP agents; that was his
job. But what al-Balawi told his handlers about his meetings with the
TTP, and where he went between meetings, clearly did not indicate to
the handlers that he was providing fabricated information or posed a
In handling a double agent, it is necessary to track every step he
takes. He cannot be trusted because of his history; the suspicion that
he is still loyal to his original cause must always be assumed.
Therefore, the most valuable moments in evaluating a double agent are
provided by intense scrutiny of his patterns and conduct away from his
handlers and new friends. Obviously, if this scrutiny was applied,
al-Balawi and his TTP handlers were still able to confuse their
observers. If it was not applied, then the CIA was setting itself up
for disappointment. Again, such scrutiny is far more difficult to
conduct in the Pakistani badlands, where resources to surveil a source
are very scarce. In such a case, the intuition and judgment of the
agent’s handler are critical, and al-Balawi was obviously able to fool
his Jordanian handler.
Given his enthusiastic welcome at FOB Chapman, it would seem
al-Balawi was regarded not only as extremely valuable but also as
extremely reliable. Whatever process might have been used at the
meeting, the central problem was that he was regarded as a highly
trusted source when he shouldn’t have been. Whether this happened
because the CIA relied entirely on the Jordanian GID for evaluation or
because American interrogators and counterintelligence specialists did
not have the skills needed to pick up the cues can’t be known. What is
known is that the TTP ran circles around the CIA in converting
al-Balawi to its uses.
The United States cannot hope to reach any satisfactory solution in
Afghanistan unless it can win the intelligence war. But the damage done
to the CIA in this attack cannot be overestimated. At least one of the
agency’s top analysts on al Qaeda was killed. In an intelligence war,
this is the equivalent of sinking an aircraft carrier in a naval war.
The United States can’t afford this kind of loss. There will now be
endless reviews, shifts in personnel and re-evaluations. In the
meantime, the Taliban in both Pakistan and Afghanistan will be
attempting to exploit the opportunity presented by this disruption.
Casualties happen in war, and casualties are not an argument against
war. However, when the center of gravity in a war is intelligence, and
an episode like this occurs, the ability to prevail becomes a serious
question. We have argued that in any insurgency, the insurgents have a
built-in advantage. It is their country and their culture, and they are
indistinguishable from everyone else. Keeping them from infiltrating is
This was a different matter. Al-Balawi was Jordanian; his
penetration of the CIA was less like the product of an insurgency than
an operation carried out by a national intelligence service. And this
is the most troubling aspect of this incident for the United States.
The operation was by all accounts a masterful piece of tradecraft
beyond the known abilities of a group like the TTP. Even though
al-Balawi’s appearance was a lucky break for the TTP, not the result of
an intentional, long-term operation, the execution of the operation
that arose as a result of that lucky break was skillfully done — and it
was good enough to deliver a body blow to the CIA. The Pakistani
Taliban would thus appear far more skilled than we would have thought,
which is the most important takeaway from this incident, and something