Account of Spy Trip on Kabul PC Matches Travels of Richard Reid

21 January 2002. See New York Times report on why the Wall Street Journal shared files with the US Department of Defense:

Account of Spy Trip on Kabul PC
Matches Travels of Richard Reid

By ALAN CULLISON and ANDREW HIGGINS
Staff Reporters of THE WALL STREET JOURNAL

KABUL, Afghanistan -- Less than a month before hijacked airplanes slammed into the World Trade Center and the Pentagon, al Qaeda chieftains received a report spelling out "exceptionally good opportunities" for terrorism in Israel and Egypt. Among the suggested targets: tall buildings and planes.

The report, found on a computer used by Osama bin Laden's lieutenants in the Afghan capital, details a target-scouting mission by an operative who flew from Amsterdam to Tel Aviv on El Al with a new British passport. After traveling around Israel, he went to Egypt by bus and then to Turkey and Pakistan by air.

The report calls the peripatetic operative "brother Abdul Ra'uff." As it happens, his travels bear a striking similarity to those of Richard Reid, the airline passenger who allegedly tried to set off explosives hidden in his shoe during a trans-Atlantic flight on Dec. 22. Mr. Reid went to the same countries, in the same order, and also got a new passport in Amsterdam just before setting out on El Al.

U.S. intelligence officials, who have reviewed the computer files, believe that "Abdul Ra'uff's" true identity "may well be" Mr. Reid, as one puts it. A senior Israeli intelligence official says Israel is "positive" Mr. Reid had been sent to Israel by al Qaeda to scope out possible targets.

Mr. Reid is now in a Massachusetts jail on a charge of interfering with a flight attendant.

His court-appointed lawyer, Tamar Birckhead, said Tuesday she was "not aware of any evidence" linking him to any terrorist group or individual.

Whether Mr. Reid was in fact the scout or the similarity between his activities and "Abdul Ra'uff's" is simply coincidence, the computer file on the scouting mission provides a striking view inside al Qaeda's workings. The lengthy report is among more than 1,750 text and video files on the hard drives of two computers that a looter offered for sale to a Kabul computer merchant. The looter said he got them from an office al Qaeda abandoned as its Taliban protectors were fleeing Kabul in mid-November. A Wall Street Journal reporter acquired them for $1,100.

A Dec. 31 Wall Street Journal article described some of these files, including some from 1999 that outlined al Qaeda efforts to build germ and chemical weapons. Other files were protected by passwords and encryption that were much harder to crack, but the Journal has now managed to access some of these as well, and has translated them from Arabic.

They contain no clear reference to the Sept. 11 attack in New York and Washington. But the files provide new details about al Qaeda's meticulous planning, its global roster of operatives and its security procedures in the period just before the attack. The contents include:

Many of the text documents are not only protected by passwords but also couched in elliptical, coded language. The Taliban regime, for example, is apparently referred to as Omar & Brothers Company. Mr. bin Laden's al Qaeda is the Abdullah Contracting Company.

The report of the target-spotting tour shows how members encoded their lives as well as their messages, wrapping even the mundane in subterfuge. It notes approvingly that "Abdul Ra'uff" took care to conceal his puritanical Islamic faith during a 10-day stay in the Netherlands. "At the hotel he would take empty alcohol bottles from the street and put them into trash containers in his room," it says. He scavenged cigarette butts from adjacent rooms and dumped them in his own ashtray.

When asked by an airline security agent why he was visiting Amsterdam, he said he had come for the hashish.

Just before leaving Amsterdam for Israel, the operative obtained a replacement passport at the British consulate. The al Qaeda report says he had put his old one in a washing machine and removed a visa sticker for Pakistan, which he worried might set off alarms at security checks.

"He went to the consulate and met with an employee who asked what happened to the passport," relates the report. "He said: 'I was drunk and washed my passport.' " Four days later, he received a new passport. A day after that, he left for Tel Aviv on El Al, Israel's national airline.

It's one of the details pointing to Mr. Reid, even though whether he was, in fact, the scout remains uncertain. The British Foreign Office says Mr. Reid, of British-Jamaican heritage, received a new British passport in Amsterdam on July 6, just before he flew to Tel Aviv on El Al.

Parallel Lives

The travels of Richard Reid and those of "Abdul Ra'uff," an al Qaeda target scout featured in a report stored on a computer in Kabul, coincide in several ways.

Richard Reid Abdul Ra'uff

Visited Netherlands, Israel, Egypt, Turkey and Pakistan in July 2001. Visited same countries in same order. A debriefing report on his journey was stored on computer on Aug. 19, 2001.

Acquired new passport at British consulate in Amsterdam, Netherlands, July 6. Acquired new passport at British consulate in Amsterdam. Date not known.

Bought plane ticket to Israel on day of departure. Bought ticket to Israel on day of departure at Amsterdam airport.

Flew from Amsterdam to Tel Aviv on Israeli airline El Al after being searched and grilled by airline officials. Shoes examined by security. He was seated in the back of the plane near a sky marshal. Flew El Al from Amsterdam to Tel Aviv after he was searched and questioned for 90 minutes. Shoe examined by security. Seated at rear after flight attendants reshuffled seating around him.

Crossed from Israel to Egypt through Rafah in southern Gaza Strip. Crossed from Israel to Egypt by bus through Rafah border crossing.

Five months later, as Mr. Reid was preparing to board an American Airlines Paris-to-Miami flight, allegedly with explosives in a shoe, he repeated much the same procedure. He applied for a new passport at the British Embassy in Brussels. Several pages of the old one were torn out.

The computer report on the travels of the al Qaeda scout notes that "washing the passport is a practical way of ridding the passport of any Pakistani visas," but it warns that doing this more than once could attract suspicion.

The unsigned report, protected by a complex password, was created on Aug. 19, according to the Kabul computer's internal record. The Wall Street Journal commissioned an array of high-speed computers programmed to crack passwords. They took five days to access the file.

A key part of the scouting mission evidently was to scope out El Al's security procedures. The report gives a detailed account of an uncomfortable encounter the operative had with Israeli security agents at Amsterdam airport. They "searched his shoes ... and also his hat," it says, and grilled him repeatedly about his work, the purpose of his trip, the source of his money and his ticket.

To help prepare future operatives for flights on El Al, the report includes a verbatim transcript of 10 questions Israeli security agents asked. "Why do you want to go to Israel?" was one. The operative's answer: to see the holy sites. "Have you ever traveled to the Middle East before?" His answer: No.

The unsigned account, apparently written by an al Qaeda operations manager who debriefed the scout, matches Mr. Reid's own troubles with El Al security at Amsterdam airport. He, too, picked up his ticket to Tel Aviv on the day of departure, faced close scrutiny from suspicious security staff and had all his belongings, including his shoes, searched.

The onboard treatment of the operative and Mr. Reid, who converted to Islam in a British juvenile prison, also match. The al Qaeda report notes that its target scout was "seated in the last seat away from the pilots' cabin" under the "watchful eye" of cabin crew. Two passengers sitting next to him were moved, and "a different man and woman were put into their seats." Mr. Reid, an Israeli government official says, was given a seat at the rear of the aircraft near an armed El Al sky marshal.

Israeli officials say they lost track of Mr. Reid after he passed through immigration at Ben Gurion International Airport in July but caught up with him again when he crossed by bus into Egypt through Rafah, at the southern end of the Gaza strip. A senior Israeli intelligence official says Mr. Reid stayed 10 days in Israel.

"Abdul Ra'uff," according to the account of his journey stored on the Kabul computer, spent the same amount of time in Israel before crossing by bus into Egypt through the same Rafah border point.

The report recounts in detail the al Qaeda scout's travels inside Israel. After casing possible sites for attack in Tel Aviv, he continued his survey in Jerusalem, Haifa and Bethlehem, it says. The report then observes that it might be possible to "bring explosives from Bethlehem to Jerusalem" because soldiers at checkpoints, once shown the operative's British passport, didn't search his travel bag.

"It appears that brothers with European passports are able to move about in Israel with greater freedom and can be treated as Israelis," says the report, in a 26-point summary. It repeatedly stresses the advantages of a European passport. It doesn't mention any contacts with Hamas or other militant Palestinian groups.

Although focused on Israel, the August reconnaissance report foreshadowed some of the terrorist tradecraft used in the Sept. 11 attacks in New York and Washington. It recommended that terrorists dress smartly and sit in first or business class "to be near the pilots' cabin without arousing suspicion." Many of the Sept. 11 hijackers sat in business or first class.

The account suggests that al Qaeda may have been considering a hijack attack in Israel: The scout photographed tall buildings in Tel Aviv, disguising his interest by mixing the shots with shots "of the beach and such." On his flight into Tel Aviv, he noted details of the plane's approach and of onboard security measures.

"Upon the aircraft's approach to Tel Aviv, our brother did not see any movement near the pilot's cabin because he was quite far away," the report says. "Generally flight attendants are security and there are [security] people sitting among the passengers." The report adds that "the aircraft remained above the city before descending to the airport for 3-4 minutes only. During these 3-4 minutes it is possible to see the city clearly."

While hinting at terror attacks involving planes, the report deals largely with "opportunities" for conventional attacks: bombings and ambushes. On a visit to northern Israel, the operative cased out a kibbutz in Tiberias. He spent the night and was never searched.

In Jerusalem, he checked out security at the Wailing Wall and found it "quite minimal." An attack there, notes the report, would have an "immensely strong" propaganda impact because of its proximity to sacred Islamic sites under Israeli control.

Public transport in Israel, says the report, offers "an exceptionally good opportunity" for bombings, "because our brother boarded with his bag more than once and was not subject to searches." The report describes buses' different colors and says which are used mostly by Jews. It lists security measures at various railway stations, noting that guards at the Haifa station were sometimes too busy to check everyone entering.

"If the striker is unable to enter the train station without being searched," counsels the report, "it is then possible to strike the reception area because it can be entered without being searched and contains no less than 100 people."

Another good potential target, the unnamed writer adds, is Tel Aviv railway station on a Saturday night: It's full of military people arriving or departing after the end of the Jewish sabbath.

Egypt, too, was scrutinized for attack possibilities. The operative took a bus through the town of Ismailia on his way to Cairo. "Before Ismailia," the report says, "there is a good place to bomb the bus because there is a wooded area and there is a side road that is covered by trees." In general, though, the author of the computer report is dissatisfied with the operative's work in Egypt. "There is not a lot of information from this trip and a [new] trip ... is absolutely necessary."

After Egypt, the report says, the operative flew to Turkey. After an unsuccessful attempt to go to Iran, he flew to Karachi, Pakistan.

It isn't known whether Mr. Reid tried to enter Iran, a nation that has sometimes been used by al Qaeda as a conduit for travel into neighboring Afghanistan. Prisoners interrogated in Afghanistan by U.S. forces say they saw Mr. Reid at an al Qaeda training camp in Afghanistan. U.S. officials don't consider their identifications conclusive, however.

The report says a follow-up trip will refine planning for future bomb attacks. On the next trip, it says, the agent, preferably a European, should carry "an article that would imitate a container to be carried during an actual operation."

The report also calls for more study of security aboard El Al. On the next trip, it says, "the brother has to enter the lavatory of the aircraft and see the extent of security staff's attention." And it suggests that future scouting missions look into renting an apartment in Tel Aviv, to see whether Israeli agencies "pay attention to the presence of a European tourist."

A separate, undated document stored on the Kabul desktop computer outlines a planned scouting trip to the U.S.-Canada border, by someone it calls Abu Bakr al-Albani. A summary of his tasks includes scoping out nightclubs frequented by U.S. servicemen.

It lays out code words. The phrase "I visited my teacher," for example, will mean "I entered America." The memo says the operative assigned to the mission has been given $1,500 and a ticket "to return to us after four months, God willing."

Other files suggest that al Qaeda had grand plans afoot by late last spring. A flurry of jittery and sometimes tetchy memos stored on a computer in May seem to reflect a feverish mood among al Qaeda chiefs in Kabul and operatives abroad. There was heated discussion of an unnamed "project" that proponents said could bring an end to a period of lethargy and internal squabbling within the organization. A memo dated last May 2, apparently using coded language, says the success of this project "may well be a way out of the bottleneck and transfer our activities to the stage of multinationals and [bring] joint profit."

The memo is drafted under an alias used by Ayman al-Zawahri, a former Egyptian surgeon who is considered Mr. bin Laden's senior strategist. It is addressed to Abu Mohammed al-Masri, an alias used by Abdullah Ahmed Abdullah, an Egyptian who U.S. authorities say was involved in the U.S. Embassy bombings in Kenya and Tanzania in 1998 and the killing of American soldiers in Somalia five years earlier.

"Brothers, the competition has escalated. We cannot stand idly by as observers," reads another Zawahri memo. "We cannot wait. Events are happening quickly."

In an undated note, a writer using a common alias for Mr. bin Laden makes his own pitch to Mr. Abdullah. "We all support this project and believe that it will provide a way out," he writes.

Others weren't so gung-ho. An unsigned note rails against "unprofitable" ventures and blindly following the direction of the "contractor" -- a frequent alias for Mr. bin Laden.

Correspondence stored on the computer dropped off sharply after Sept. 11. Among a handful of text files is the draft of an open message to the American people, stored on Oct. 3. It says the U.S. government was itself to blame for the Sept. 11 attacks because of its pro-Israel policies, and it calls on ordinary Americans to be the "ax to break all these chains."

The draft, written in Arabic, is unfinished. In late October, as U.S. bombing in Afghanistan intensified and anti-Taliban forces closed in on Kabul, users of the desktop computer wrote messages -- only to delete them promptly. The hard drive contains at least a half-dozen such ghost documents. A short memo that survived asks that money be deposited to a bank account, apparently outside Afghanistan, "due to the difficulties in making withdrawals in this region."

The last retrievable document on the hard drive is a rambling denunciation of the U.S. Apocalyptic in tone and in places barely coherent, it was stored on the computer Nov. 10, three days before Taliban troops fled the Afghan capital and the Northern Alliance moved in, killing some Arabs left in the city. In apparent fury at the failure of Muslims to rally against the West, the tract fumes that "weapons used against you exist in your home, to entertain you, and to amuse your sons." America, says the tract, has a "strong plan -- total domination of peoples' lives."

-- Chris Cooper, Dan Bilefsky, Jonathan Karp and Dan Michaels contributed to this article.

The unsigned report appears to have been written by an al Qaeda operations manager who debriefed the traveling scout. It was stored on the computer in August 2001. There are no dates referred to in the report.

Has an old computer revealed that Reid toured world searching out new targets for al-Qa'ida?

When a young man with unkempt hair sauntered into the British consulate in Amsterdam in July and asked for a new passport, the officials wanted to know what had happened to the old one. He gave a fairly credible answer: he had put the document into the washing machine after drinking too much, and it was ruined.

You might think it strange, however, that the same man was able to get yet another replacement passport five months later, but this time at the British consulate in Brussels. He gave no particular reason this time, except that the one he had received in July had become ragged and was missing a few pages. He surrendered it, as required, and took the new one away with him.

This eager traveller was Richard Reid, 28, who is now in Boston as a guest of the US justice system, for allegedly trying to blow up an American Airlines passenger jet bound for Miami from Paris on 22 December. He was flying with the British passport issued the same week in Brussels. In between, he is known to have visited Israel, Egypt, Turkey and Pakistan.

All of this, you might imagine, would be enough to cause red faces at the Foreign Office. But the affair becomes significantly more serious when you consider information coming to light that suggests Mr Reid, far from a deranged loner with a grudge against America, may well have been working for al-Qa'ida, the terror network of Osama bin Laden.

The evidence for this supposition, which has yet to be proved, comes from the hard drives of two computers that used to belong to senior figures of al-Qa'ida, which fell into the hands of two reporters for The Wall Street Journal who were in Kabul late last month. The drives have provided the paper – and US investigators – with a trove of new information about the inner machinations of the terrorist group.

The drives contain more than 17,000 files. Though all of them are related to al-Qa'ida in some way, many are humdrum and dull. Others are not. The interesting files tend to be protected by sophisticated passwords or are encrypted, and the Journal is still working to decode them. One file, in particular, took five days to crack, using several computers. The reporters gained access to it on Sunday.

What they found was a report, written by an unidentified author, detailing the recent labours of someone working for al-Qa'ida, who was travelling the globe scouting out possible targets for terrorist attacks. He had attempted in particular to consider the possibility of striking at the Israeli airline, El Al. There are also references to possible plans for attacks against US soldiers stationed near the Canada border.

The journalists also noted that the travel schedule of the al-Qa'ida scout, who is identified as Abdul Ra'uff, matched almost exactly what we know of the wanderings of Richard Reid, the accused "shoe bomber", since July. American intelligence officials, the newspaper said, have already decided that Abdul Ra'uff and Mr Reid "may well be" the same man. Israeli officials are "positive" this is true.

"This is very significant," said Andrew Higgins, a one of the authors of the Journal report and a former long-time foreign correspondent of The Independent. "This may turn out to be the first conclusive proof we have that Reid was not a hapless drifter but rather an al-Qa'ida operative," he said. Mr Reid is a British-Jamaican who converted to Islam while he was serving time in a British young offenders' institution.

Mr Higgins and another Journal writer, Alan Cullison, found themselves in Kabul with a broken lap-top computer last month. They needed to buy a replacement. What they eventually bought for $1,100 (about £800) was a new laptop and a desktop computer that, as it turned out, had been looted from a building in the city that had been an al-Qa'ida office before it fell to the Northern Alliance on 7 December.

The extent to which the activities of Richard Reid and Abdul Ra'uff match is compelling. Both men – if they are not one – visited the same four countries in the same order in July. Both of them acquired a new passport from the British consulate in Amsterdam. Both of them flew first to Israel, buying ticket on an El Al flight on the date of departure. Both were grilled by Israeli agents before boarding. Both entered Egypt from Israel at the same border crossing.

The Foreign Office did not address the issue of Mr Reid's real identity last night. But a spokeswoman defended the action of the consulate staff in Brussels and Amsterdam in giving him new passports twice in such short order. "You can have a new passport issued every day of the year if you like, so as the old one is properly invalidated, which happened here," she said, emphasising that all normal procedures had been followed by officials at the office. "They know what they are doing," she said.

The report drawn from the computer drive and apparently written on 19 August explains that the excuse about having put the passport in the washing machine was part of a wider ruse by Abdul Ra'uff to disguise his religion during his 10-day stay in Amsterdam by pretending to drink and smoke. "At the hotel he would take empty alcohol bottles from the street and put them into trash containers in his room," the computer report notes.

The report's author, who apparently was fresh from debriefing Abdul Ra'uff, also describes his visit to the British consulate. "He said, 'I was drunk and washed my passport.'" The author notes that Abdul Ra'uff had indeed put his passport in the washing machine, as a means of washing away a Pakistani visa sticker that might have caused problems on his travels. This is a trick that al-Qa'ida recommends to its operatives, as long as they do it just once.

The text also focuses on the journey Abdul Ra'uff subsequently made to Tel Aviv on an El Al jet. At the gate, Israeli security personnel searched him, his shoes and his hat. Once on board, he was "seated in the last seat away from the pilot's cabin" and was under the "watchful eye" of the cabin crew. Israeli officials have already confirmed that on his El Al flight, Mr Reid was also seated in the back of the plane.

The scout was enthusiastic about what he found in Israel. He offered details on how to bomb public transport, including the railway station in Haifa, in the north. He also noted that having a British passport was particularly helpful, saying, for example, that it had been enough to stop anyone searching his bags when he travelled from Bethlehem to Jerusalem.

The computer reports says: "It appears that brothers with European passports are able to move about in Israel with great freedom and can be treated as Israeli." There are no direct references to the World Trade Centre and Pentagon attacks of 11 September. But at one point, the report suggests that terrorists dress well when boarding aircraft and take seats in first or business class "to be near the pilot's cabin without arousing suspicion". Many of the hijackers involved in the September suicide attacks had first-class seats.

Abdul Ra'uff, whoever he ever he was, left Israel and did similar reconnaissance work in Egypt that apparently left his debriefer unimpressed. The report says a second trip to the country would have to be made.

It remains possible that the similarities between the movements of the man called Abdul Ra'uff and Mr Reid are coincidental. But that is hardly reassuring. "If not Reid, who is it?" Mr Higgins asked last night. "That would mean there were two people out there with British passports we didn't know about."

Getting to the heart of the documents contained in the al-Qa'ida computer bought by chance by the Wall Street Journal's reporter in Kabul meant cracking the encryption of Microsoft's Windows 2000 operating system installed on the machine, which had been used to protect the data.

That is not a trivial task. Microsoft will only say that if you lose the password that controls entry to a Windows 2000 system, your best option is to remember it or simply to wipe the machine and start again. And its Encrypting File System (EFS), which had been used to encode the files, is just as strong.

But the files were too valuable for that. Instead, the team embarked on the task of breaking through the encryption, which jumbles the contents of the files so that even someone reading the individual bytes of data stored on the actual hard disk (rather than trying to access them through the operating system, which had locked them out) would simply find rubbish.

Cracking the encryption meant finding the digital "key" that had previously been used to unlock it. That was not stored in any readable file on the machine, for it was itself encrypted.

The only way to reproduce it was to generate the key from first principles: by trying various combinations of random bits and trying to decrypt the file with them, and seeing if it produced sense or gibberish.

Luckily, the PC had a version of Windows 2000 with an "export-quality" key only 40-bits long, rather than the "US" quality, which being 128-bits long would have been billions of times harder to crack.

Even so, it took the equivalent of a set of supercomputers running for five days, 24 hours a day, to find the key. But find it they did.

The irony that the terrorists used a product made by one of the US's biggest corporations to protect plans it was making against it may not be lost on an administration that recently relaxed rules on the export of "strong" encryption. Tighter controls may follow.

Richard Reid	Abdul Ra'uff
Visited Netherlands, Israel, Egypt, Turkey and Pakistan in July 2001.	Visited same countries in same order. A debriefing report on his journey was stored on computer on Aug. 19, 2001.
Acquired new passport at British consulate in Amsterdam, Netherlands, July 6.	Acquired new passport at British consulate in Amsterdam. Date not known.
Bought plane ticket to Israel on day of departure.	Bought ticket to Israel on day of departure at Amsterdam airport.
Flew from Amsterdam to Tel Aviv on Israeli airline El Al after being searched and grilled by airline officials. Shoes examined by security. He was seated in the back of the plane near a sky marshal.	Flew El Al from Amsterdam to Tel Aviv after he was searched and questioned for 90 minutes. Shoe examined by security. Seated at rear after flight attendants reshuffled seating around him.
Crossed from Israel to Egypt through Rafah in southern Gaza Strip.	Crossed from Israel to Egypt by bus through Rafah border crossing.