FBI plotted Charlotte student’s arrest, but too late

A Charlotte blogger who became a major propagandist for al-Qaida before he was killed in a U.S. drone strike in Yemen was a subject of close FBI surveillance for years and a much bigger concern for U.S. authorities than previously known, according to records obtained by McClatchy.

Samir Khan, 25, was a big enough worry that federal agents asked the FBI’s special forces unit, Hostage Rescue Team, to help with a likely arrest before he disappeared in 2009, the files show.

But no arrest was made and Khan disappeared, re-emerging months later in Yemen, where he launched an English-language al-Qaida magazine, Inspire, that has been influential in radicalizing and recruiting extremists worldwide. He was killed Sept. 30, 2011.

Khan’s case, along with those of the perpetrators of attacks that include the Boston Marathon bombings and the Charlie Hebdo killings in Paris, reflects a new reality for those seeking to thwart terrorism: Many of the lone-wolf style attacks authorities fear most are the work of people already known to U.S. and international intelligence agencies.

Experts say future terrorists are becoming radicalized under the very noses of intelligence officials, who struggle to balance civil liberties with stopping potentially dangerous individuals now being referred to as “known wolves.”

“They only call HRT (Hostage Rescue Team) in if they’re going to extract a body,” said Jack Cloonan, a veteran FBI special agent who served in the bureau’s Osama Bin Laden unit. “Someone must have pushed forward the idea ‘let’s indict him and maybe we’ll get him.’ But somebody overruled it.”

The FBI has refused to answer questions about what happened between January 2009, when Charlotte FBI agents contacted the Hostage Rescue Team, and Khan’s subsequent disappearance. But hundreds of pages of heavily redacted investigation files document the FBI’s dogged pursuit of Khan, talk of turning him into an informant, and apparent frustration that they couldn’t find enough evidence to justify an arrest.

“Khan is becoming more radical and although working this case simply to gain intelligence on Khan’s contacts is certainly an option, it is the investigative team’s view that all work done in this case should be focused towards finding a resolution, i.e. a disruption via an arrest/prosecution,” FBI agents wrote in a Dec. 4, 2008 report.

Today, U.S. leaders are less concerned about an elaborate 9/11-type attack than a smaller one- or two-man operation, a lone-wolf style attack that’s considered more difficult to detect and stop. And yet because of advances in technology and intelligence-gathering methods, officials have more information than ever on potentially dangerous people.

The result is it’s very likely the next attack on U.S. soil will be conducted by someone who has been on U.S. law enforcement’s radar, said Patrick Skinner, a former CIA officer who specialized in counterterrorism.

Looking for signs

Intelligence agents knew that Khan, a U.S. citizen who grew up in New York before moving to Charlotte in 2004, was in contact with Anwar al-Awlaki, a top FBI target. Al-Awlaki, also a U.S. citizen, was the operations chief for al-Qaida in the Arabian Peninsula when he was killed by the same U.S. drone strike that killed Khan.

Intelligence agents knew about Cherif Kouachi, who helped lead the January massacre at the French satirical newspaper Charlie Hebdo. He was on U.S. and British watch lists and had been under surveillance by French authorities.

Intelligence agents knew about Tamerlan Tsarnaev, who orchestrated the 2013 Boston marathon attacks. FBI agents interviewed him and spoke to his family and friends after Russian authorities warned he was “a follower of radical Islam.”

It’s easy to look back and point to all the warning signs. But the reality is it’s very difficult to determine whether someone will actually act on threatening behavior, said Brian Jenkins, a longtime counterterrorism expert and senior adviser to the president of the RAND Corp., a nonprofit global policy think tank.

“We don’t have an X-ray for a man’s soul,” Jenkins said.

Watching ... and waiting

The sheer number of people on U.S. watch lists makes it difficult to track them all. As many as 1 million people are reported to be listed in the National Counterterrorism Center’s Terrorist Identities Datamart Environment, or TIDE, database. Tens of thousands more are on the more restrictive “no fly” list.

Skinner said agents are “literally drowning in data,” but don’t have the manpower or resources to analyze it properly.

And then there is the civil liberties issue. Someone can’t be arrested until they commit an actual crime. Security officials are left watching and waiting, said Skinner, who is now a security consultant with The Soufan Group.

“It’s a tremendous problem,” Skinner said. “You can’t just let people radicalize while under surveillance.”

‘Right in front of us’

One way around this challenge is to use undercover agents posing as terrorist operatives to catch suspects breaking the law. But the method has been criticized as entrapment.

The recent arrest of Christopher Cornell, who was accused of planning to bomb the U.S. Capitol, is one example. Cornell, 20, was sending messages to an FBI undercover agent. He was arrested after he purchased two semi-automatic weapons and 600 rounds of ammunition. Cornell’s family argues he was incapable of planning such an attack on his own.

In North Carolina, Khan’s early blog posts were nonthreatening. His writing became more aggressive over time. He wrote of the need to train physically. He grabbed the attention of law enforcement while posting hundreds of videos that depicted the killings of U.S. soldiers.

Charlotte-Mecklenburg police Chief Rodney Monroe said Khan’s case proves that terrorists can live in suburban settings as well as large metropolitan cities such as New York and Washington, D.C.

Monroe was scheduled to testify Feb. 26 in Washington on domestic terrorism and radicalization. He didn’t make it to Capitol Hill because of bad weather in Charlotte, but he states in his written testimony that Khan is not the only North Carolina example.

Salisbury resident and founder of the Islamic Center of Salisbury, Donald Morgan, 44, will be sentenced later this month after pleading guilty to terrorism charges. He was arrested last year after trying to fly to Syria to join the Islamic State.

Avin Marsalis Brown, 21, of Raleigh was arrested last year at the Raleigh airport before boarding a flight to Turkey on his way to Syria. He was charged with conspiring to provide material support to terrorists.

“They’re not living on a reservation or some isolated part of North Carolina,” Monroe said in an interview. “They’re in middle- and upper-level communities right in front of us.”

Leaving for Yemen

There appears to be no question that the FBI wanted to arrest Khan, but didn’t have the evidence to do so.

“The primary goal of this investigation is to determine if Khan is influencing/did influence anyone to commit or attempt to commit an act of terror,” reads an Oct. 2, 2008, FBI report. “A secondary goal is to determine if Khan is being directed by a higher authority/authorities to do so.”

An opportunity seemed to arrive late in 2008 when authorities learned that Khan had been communicating with al-Awlaki, a top FBI target. On Jan. 8, 2009, the FBI raised Khan’s investigation priority, an indication that FBI agents believed that he was not just an al-Qaida supporter but someone in close contact with al-Qaida’s core leadership.

The next day, on Jan. 9, Charlotte agents contacted the FBI’s Hostage Rescue Team, a Quantico, Va.,-based special forces unit created to respond to terrorist incidents and hostage situations such as aircraft hijackings. A meeting was scheduled in Charlotte for “finalizing operational plans” five days later.

What happened to those plans is not publicly known.

Subsequent entries in the heavily redacted documents make no mention of them. The last dated entry, on Feb. 17, 2009, said “an anonymous individual” had notified the National Counterterrorism Center that Khan had threatened a Sarasota, Fla., private investigator who’d played a role in shutting down a “jihadi website … owned by Samir Khan.”

Later that year, Khan left North Carolina for Yemen.

This story was originally published March 7, 2015 at 8:00 PM with the headline "FBI plotted Charlotte student’s arrest, but too late."