The FBI and the Bombing at the Boston Marathon in 2013

Two opposite mistakes in an after-the-fact review of a terrorist incident are equally damaging. One is to fail to recognize the powerful difference between foresight and hindsight in evaluating how an investigative or intelligence agency should have behaved.  After the fact, we know on whom we should have focused attention as a suspect, and we know what we should have protected as a target. With foresight alone, we know neither of these critically important clues to what happened and why. With hindsight, we can focus all of our attention narrowly; with foresight, we have to spread it broadly, as broadly as the imagination of our attackers may roam. The second mistake is equally important. It is to confuse the fact that people in official positions, like others, will inevitably make mistakes in carrying out any complicated task, with the idea that no mistakes were really made.  We can see mistakes with hindsight that can be avoided in the future by recognizing them clearly and designing solutions.  After mistakes are made, nothing is more foolish than to hide them or pretend that they were not mistakes.  Both the Congressional Committee and the group of Inspectors General asked by the DNI to examine the Marathon bombing complain of the latter: difficulty in getting timely cooperation from the FBI. The Inspectors General are steely-eyed in recognizing what was done that should have been done differently, but extremely reluctant to call anything a mistake. The Director of the FBI notes in expressing appreciation to the Inspectors General that “I am proud of the work that the Boston field office did in this case, before the bombings as well as after them….” This post is intended to look, sympathetically but frankly, at the mistakes that were made, and to note corrections that go far beyond what the Inspectors General  recommended: “that the FBI considers sharing threat information with state and local partners more proactively by establishing a procedure for notifying state and local representatives…when it conducts a counterterrorism assessment of a subject residing in or having a nexus to a representative’s area of responsibility.”

The Nature of the Problem

The starting point is to recognize that the FBI was dealing with an unusually difficult challenge. If it had firm evidence of the involvement of a particular person or someone among a small group of suspects in a particular plot, it would pursue the case using traditional investigative techniques and powers, just as it does with any other serious criminal investigation, with prosecution and conviction in mind. But here in the case of the 2013 Boston Marathon, it was asked to take protective steps against an initially unidentifiable suspect to prevent a terrorist crime that could take place anywhere at any time within a given jurisdiction. The difficulty of that task is reflected in the fact that we generally rely on four quite broad measures to provide some security against attack.

• We seek to deter anyone –including people never specifically identified – contemplating a terrorist attack, either by threatening a severe punishment if he is caught or by showing him how unlikely a successful attack is.

• We try to generate widespread social disapproval of terrorist acts, including and particularly within the community to which the unidentified individual is attached emotionally and socially, hoping to benefit from powerful moral/social persuasion.

• We protect likely targets by physical barriers, guards, and systems for limiting access.

• We try to monitor or limit the sale of equipment needed for a terrorist act, such as explosives.

We are here examining a fifth category of protection where, supplementing the measures just listed, we seek to identify a previously unidentified individual or group in a community who may attempt an unspecified terrorist attack; and then we seek to disrupt the terrorist plan and to reduce the risk that it succeeds. This is obviously going to be a difficult effort because in a metropolitan area of perhaps a million and a half people, only a tiny fraction of the population is toying with the idea of a terrorist attack (and only a small fraction of that tiny fraction is already planning a terrorist attack). Our effort is to identify people in either category; indeed it will not only be difficult to distinguish them from each other at first, but also hard to distinguish the members of either category from the many others in the population who are hardly different, if at all, from those in the dangerous categories. Indeed, the problem is even more difficult than this suggests. Not having done more than explore an idea, those in the first category – those toying with the idea of engaging in a terrorist attack – are not subject to arrest or prosecution. They might be thought of as those so alienated from American society that they might very well be recruited into agreeing to a terrorist attack, seeking associates with the same view, and developing singly or jointly a plan to the point where it is likely to go forward. That is the category into which the Tsarnaev brothers first fell before moving on to a commitment to a terrorist attack – the second category. Finally, seeking to find an “unidentified individual or group in a community” as a suspect for terrorism inevitably means casting a wide net of at least slight suspicion over the broader community and all its members. This is unfair to the vast majority of those in the community. The unfairness is costly to counterterrorism, for it reduces the fund of willingness to volunteer information or help. A preliminary question is whether these costs exceed any likely benefits from this fifth type of protective step. But if the potential benefits of the undertaking are considered worth these costs, it is all the more important to pursue the effort thoughtfully.

The Evaluation of April 10, 2014 by the Inspectors General of the Intelligence Community, the CIA, the Department of Justice, and the Department of Homeland Security

What follows is from the unclassified summary by the Inspectors General:

Two years before the Boston Marathon bombings, Tamerlan Tsarnaev and [his mother] Zubeidat Tsarnaeva came to the attention of the Federal Bureau of Investigation (FBI) based on information received from the Russian Federal Security Service (FSB). In March 2011, the FBI received information from the FSB alleging that Tamerlan Tsarnaev and Zubeidat Tsarnaeva were adherents of radical Islam and that Tamerlan Tsarnaev was preparing to travel to Russia to join unspecified underground groups in Dagestan and Chechnya. [The report also noted that “Tamerlan Tsarnaev…had considered changing his last name to ‘Tsarni.’] The FBI-led Joint Terrorism Task Force in Boston (Boston JTTF) conducted an assessment of Tamerlan Tsarnaev to determine whether he posed a threat to national security and closed the assessment three months later having found no link or “nexus” to terrorism. Three months later, Tamerlan Tsarnaev traveled to Russia, as the lead information stated he was preparing to do. However, Tsarnaev’s travel to Russia did not prompt additional investigative steps to determine whether he posed a threat to national security.

The Inspectors General noted the following about the steps taken by the FBI:

The CT (Counter-Terrorism) Agent conducted database searches, reviewed references to Tsarnaev and his family in closed FBI counterterrorism cases, performed “drive-bys” of Tsarnaev’s residence, made an on-site visit to his former college, and interviewed Tsarnaev and his parents…. The DOJ OIG (Office of Inspector General) determined that the CT Agent did not take certain steps during the assessment, including contacting local law enforcement, visiting the mosque that Tsarnaev attended, and conducting interviews of Tsarnaev’s wife, a former girlfriend he had been arrested for assaulting in 2009, or friends and associates. The CT Agent told the DOJ OIG that he did not find sufficient derogatory information to justify taking these additional steps. The DOJ OIG  also determined that the CT Agent did not attempt to elicit certain information during interviews of Tsarnaev and his parents, including information about Tsarnaev’s plans to travel to Russia, changes in lifestyle, or knowledge of and sympathy for militant separatists in Chechnya and Dagestan.

On June 24, 2011, the file was closed on the assessment of the Russian allegations with regard to Tamerlan Tsarnaev and terrorism. A letter was sent to the Russian intelligence agency, the FSB, requesting any additional derogatory information about Tsarnaev “because the information in the original lead…wasn’t enough.” The FBI stated that it was not aware of any documents shared with state and local law enforcement prior to the bombings although “representatives of these agencies could have found some information in the FBI’s terrorist tracking system, the ‘Guardian system.’” No one seems to have checked on whether Tamerlan did in fact go to Russia or had in fact changed his name. Tamerlan went to Russia on January 21, 2012 and stayed for six months. No one noted his return or sought to question him about this long stay in an area adjacent to Chechnya. The Inspectors General note that the counterterrorism agent said that “the travel would not have been significant because the assessment was closed and the FBI had already asked the Russians for additional derogatory information.” When asked whether he would have considered taking further investigative steps had he learned of the travel at the time, the counterrorism agent said that he would not have done anything differently. His supervisor strongly disagreed, saying that “had he known about the travel, he probably would have reopened the assessment and probably would have interviewed Tsarnaev upon his return from Russia…” The assistant Special Agent in charge said that Tsarnaev’s travel would have “changed everything.” The FBI LEGAT in Moscow “characterized the travel as ‘huge’ …” The Inspectors General go on to say that “we believe that Tsarnaev’s travel to Russia in 2012 was significant in view of the FSB lead information and warranted further investigative action.” That summarizes the record the FBI was “proud of” and in which the Inspectors General found little in the way of mistakes in need of correction.

Major Mistakes

The Inspectors General have spoken clearly enough about the inadequacy of the assessment undertaken on the basis of the Russian lead. We can focus on four additional mistakes. 1. Assessing the Strength of the Russian Tip It was a mistake to conclude that the Russian tip was unreliable because it did not disclose the information on which it was based and was not supported by the discovery of other ties to terrorism.  The U.S. Supreme Court has examined cases of tips about crimes from either known or anonymous sources that either describe or fail to describe the factual basis that led the source to make the allegation.  It has concluded that, at least when the source is not secret, and has important practical stakes in not being caught lying, the only question that must be answered before a physical search or an arrest can take place based on that tip is whether the source had an adequate basis for himself believing the truth of what he alleged. The Supreme Court has pointed out that when the facts alleged are about future events that in fact take place after the tip and that could only have been known about in advance by someone with intimate knowledge of the plan, the police can assume that there was an adequate basis for the source believing what he alleges. It is, for example, appropriate to arrest or search the subject on that basis (if the tip alleged a crime). In this case, the Russians obviously had ample reasons not to want to be caught lying, and therefore not to lie. That the FSB’s basis for believing the allegation was reliable was established as soon as it was clear that the future events they predicted – travel to Dagestan, and an effort to change Tamerlan’s name – had occurred.  In all likelihood, this information was obtained by electronic surveillance or an informant among Tamerlan’s associates. The FSB could not be expected to reveal that there was an informant or electronic surveillance, let alone who the informant was or how the surveillance was undertaken. The tip should have been treated as reliable enough to be taken very seriously. 2. Remaining Capable of Adding New Information To That Which Raised Concerns Short of Justifying Further Criminal Investigation Even when and if all trails run dry without producing the probable cause necessary to bring charges or engage in an intrusive investigative step like a search or electronic surveillance*, a further step to assure continuing awareness of any ongoing or emerging plot is needed. The evidence obtained up until that point has to be recorded in a way that it can and will be available to supplement, or be supplemented by, any new and relevant information about the same individual – new information that makes further investigation more promising. Thus, any information that raised and continues to raise unrebutted concerns about whether an individual may be planning a terrorist event, or is likely in the future to come to participate in a terrorist event, should be retained. This accumulated information need only be reexamined if and when new information about the same individual emerges, but in that circumstance it should be available. It was clear in this case that the closing of the assessment on June 24, 2011, substantially reduced interest in any later indications of danger, including his travel to Dagestan seven months later. A combination of new information and old information may be much more probative than either one alone. In the Tsarnaev case, the fact that Tamerlan was initially the subject of a specific Russian tip (the basis of which had to be strong for the Russians to know, as they did, that he was about to change his name) should have been enough to take further steps. But, even if it was not adequate, when Tamerlan Tsarnaev went to Dagestan for about six months, the combination of that fact and the initial tip constituted much stronger evidence of possible danger than either alone. 3. Using Multiple Ways of Obtaining Information Relevant to an Individual’s Motivation, Association, and Preparation for Terrorism There is no reason why the FBI should have relied only on the tip from the FSB plus a somewhat cursory investigative assessment based on that tip. Besides these two sources of information, the FBI could have and should have used big data, either collected commercially or at the request of the government. Travel of a U.S. person to an area of dangerous jihad would be one such item of collected or easily collectible data; in another case, the purchase of explosives or even of pressure cookers would be another source. The attempts to determine Tamerlan’s travel were feeble at best. Discovering his travel plans would have confirmed the reliability of the tip from the Russians. It would also have added a second factual basis for being concerned about the risk he posed – i.e., it would have increased the assessment of the risk and the need for further steps, as most of the FBI officials, including the legal attaché in Moscow, strongly advised the Inspectors General.** 4. Taking Steps to Reduce the Risks That Do Not Satisfy the Requirements For Search, Electronic Surveillance, Arrest, or Prosecution When an investigation is closed because it does not have or show promise of getting evidence for an arrest, a search, or a prosecution, the matter should still be open for consideration and use of various non-punitive and non-coercive steps which might reduce the chance of a terrorist attack. Thus a final mistake was the failure to generate a set of intelligent steps to discourage any plan of terrorism even if the evidentiary basis for arrest and prosecution was lacking. The suspect and a record of the credible information suggesting danger should have been referred to an alternative, non-criminal process intended to discourage any further drift toward engaging in terrorism. State and local law enforcement would have been a sensible choice to “follow up.” As a follow up, the individual might be warned that he would be a suspect in any new terrorist event – a warning that would affect his plans if he feared punishment. Agents might talk to his family or close associates trying to get them to understand the danger in which the Tsarnaevs were putting themselves and others. There could be occasional physical surveillance of his activities or of his purchases. There might even be an attempt to address the source of his anger at the United States. None of these would guarantee that a Tamerlan Tsarnaev would not engage in terrorism, but neither is it clear that Tamerlan would have been indifferent to them. They might very well have made a difference.

Conclusion

The mistakes I have discussed may not have shown moral failures, but they do show ways in which the organization should improve its functioning. We have little indication that these steps are being taken in that light. A failure to do so would be the biggest mistake of all. Notes: * Under U.S. law we do not generally authorize administrative detention of intensive search without probable cause for U.S. persons or anyone else in the United States, so with neither probable cause for an arrest nor the real prospect of obtaining that probable cause in the future the criminal investigation must be closed. ** At a later stage, with more information, it might have made sense to use still another way of gaining information (besides tips, field investigation, and big data): an undercover effort to trick the suspect into revealing his intention to informants or undercover agents who have “offered to cooperate with anyone interested in a terrorist plot.” Philip Heymann is the James Barr Ames Professor of Law at the Harvard University Law School.  Heymann has served at high levels in both the State and Justice Departments during the Kennedy, Johnson, Carter, and Clinton administrations, including Deputy U.S. Attorney General (1993-1994).