on known and suspected terrorists and international terror groups.”* As such, NCTC consolidates
all information on known and suspected international terrorists in the Terrorist Identities Datamart
Environment. NCTC then makes this data available to the FBI-led Terrorist Screening Center
(TSC), which reviews nominations for inclusion in the master watchlist called the Terrorist
Screening Database (TSDB). The TSC provides relevant extracts to each organization with a
screening mission.

Hindsight suggests that the evaluation by watchlisting personnel of the information contained in the
State cable nominating Mr. Abdulmutallab did not meet the minimum derogatory standard to
watchlist. Watchlisting would have required all of the available information to be fused so that the
derogatory information would have been sufficient to support nomination to be watchlisted in the
Terrorist Screening Database. Watchlist personnel had access to additional derogatory information
in databases that could have been connected to Mr. Abdulmutallab, but that access did not result in
them uncovering the biographic information that would have been necessary for placement on the
watchlist. Ultimately, placement on the No Fly List would have been required to keep Mr.
Abdulmutallab off the plane inbound for the U.S. Homeland.

VISA ISSUE

Mr. Abdulmutallab possessed a U.S. visa, but this fact was not correlated with the concerns of Mr.
Abdulmutallab’s father about Mr. Abdulmutallab’s potential radicalization. A misspelling of Mr.
Abdulmutallab’s name initially resulted in the State Department believing he did not have a valid
U.S. visa. A determination to revoke his visa, however, would have only occurred if there had been
a successful integration of intelligence by the CT community, resulting in his being watchlisted.

KEY FINDINGS EMERGING FROM PRELIMINARY INQUIRY & REVIEW

¢ The U.S. government had sufficient information to have uncovered and potentially disrupted
the December 25 attack—including by placing Mr. Abdulmutallab on the No Fly list -- but
analysts within the CT community failed to connect the dots that could have identified and
warned of the specific threat. The preponderance of the intelligence related to this plot was
available broadly to the Intelligence Community.

« NCTC and CIA are empowered to collate and assess all-source intelligence on the CT threat,
but all-source analysts highlighted largely the evolving “strategic threat” AQAP posed to the
West, and the U.S. Homeland specifically, in finished intelligence products. In addition,
some of the improvised explosive device tactics AQAP might use against U.S. interests
were highlighted in finished intelligence products.

¢ The CT community failed to follow-up further on this “strategic warning” by moving
aggressively to further identify and correlate critical indicators of AQAP’s threat to the U.S.
Homeland with the full range of analytic tools and expertise that it uses in tracking other
plots aimed at the U.S. Homeland.

“50 U.S.C. § 4040(d)(6).


unidentified extremists, and had planned to travel to Yemen. Though this information alone
could not predict Mr. Abdulmutallab’s eventual involvement in the attempted 25 December
attack, it provided an opportunity to link information on him with earlier intelligence reports
that contained fragmentary information.

e Analytic focus during December was on the imminent AQAP attacks on Americans and
American interests in Yemen, and on supporting CT efforts in Yemen.

Despite these opportunities and multiple intelligence products that noted the threat AQAP could
pose to the Homeland, the different pieces of the puzzle were never brought together in this case—
the dots were never connected, and, as a result, steps to disrupt the plot involving Mr.
Abdulmutallab were not taken prior to his boarding of the airplane with an explosive device and
attempting to detonate it in-flight.

BREAKDOWN OF ACCOUNTABILITY FOR THREAT WARNING & RESPONSE

Intelligence is not an end to itself, nor are analytic products—they are designed to provide senior
government leaders with the necessary information to make key decisions, but also to trigger action,
including further collection, operational steps, and investigative adjustments. As noted above,
NCTC and CIA have the primary and overlapping responsibility to conduct all-source analysis on
terrorism. As with this intentional analytic redundancy, the CT community also has multiple and
overlapping warning systems to ensure that departments and agencies are kept fully aware of
ongoing threat streams.

NCTC is the primary organization that provides situational awareness to the CT community of
ongoing terrorist threats and events, including through several daily written products that
summarize current threat reporting for a broad audience, as well as meetings and video
teleconferences that provide the opportunity for the CT community to engage in a real-time manner
on this information. While the threat warning system involves analysis, it also extends to other
elements within the CT community that should be responsible for following up and acting on leads
as a particular threat situation develops.

In this context, the preliminary review suggests that the overlapping layers of protection within the
CT community failed to track this threat in a manner sufficient to ensure all leads were followed
and acted upon to conclusion. In addition, the White House and the National Security Staff failed to
identify this gap ahead of time. No single component of the CT community assumed responsibility
for the threat reporting and followed it through by ensuring that all necessary steps were taken to
disrupt the threat. This argues that a process is needed to track terrorist threat reporting to ensure
that departments and agencies are held accountable for running down all leads associated with high
visibility and high priority plotting efforts, in particular against the U.S. Homeland.

FAILURE TO WATCHLIST
Although Umar Farouk Abdulmutallab was included in the Terrorist Identities Datamart

Environment (TIDE), the failure to include Mr. Abdulmutallab in a watchlist is part of the overall
systemic failure. Pursuant to the IRTPA, NCTC serves “as the central and shared knowledge bank


NCTC and CIA personnel who are responsible for watchlisting did not search all available
databases to uncover additional derogatory information that could have been correlated with
Mr. Abdulmutallab.

A series of human errors occurred—delayed dissemination of a finished intelligence report
and what appears to be incomplete/faulty database searches on Mr. Abdulmutallab’s name
and identifying information.

“Information sharing” does not appear to have contributed to this intelligence failure;
relevant all-source analysts as well as watchlisting personnel who needed this information
were not prevented from accessing it.

Information technology within the CT community did not sufficiently enable the correlation
of data that would have enabled analysts to highlight the relevant threat information.

There was not a comprehensive or functioning process for tracking terrorist threat reporting
and actions taken such that departments and agencies are held accountable for running down
all leads associated with high visibility and high priority plotting efforts undertaken by al-
Qa‘ida and its allies, in particular against the U.S. Homeland.

Finally, we must review and determine the ongoing suitability of legacy standards and
protocols in effect across the CT community, including criteria for watch lists, protocols for
secondary screening, visa suspension and revocation criteria, and business processes across
the government.


SUBECT: Summary of the White House Review of the December 25, 2009 Attempted Terrorist
Attack

On December 25, 2009 a Nigerian national, Umar Farouk Abdulmutallab attempted to
detonate an explosive device while onboard flight 253 from Amsterdam to Detroit. The
device did not explode, but instead ignited, injuring Mr. Abdulmutallab and two other
passengers. The flight crew restrained Mr. Abdulmutallab and the plane safely landed. Mr.
Abdulmutallab was taken into custody by Customs and Border Protection (CBP) and later
was questioned by the Federal Bureau of Investigation (FBI). Mr. Abdulmutallab was not on
the U.S. Government’s (USG) terrorist watchlist, but was known to the U.S. Intelligence
Community (IC).

BACKGROUND

Following the December 25, 2009 attempt to bring down the flight by detonating an explosive
device onboard flight 253, the President directed that Assistant to the President for Homeland
Security and Counterterrorism John Brennan conduct a complete review of the terrorist watchlisting
system and directed that key departments and agencies provide input to this review. What follows
is a summary of this preliminary report.

First, it should be noted that the work by America’s counterterrorism (CT) community has had
many successes since 9/11 that should be applauded. Our ability to protect the U.S. Homeland
against terrorist attacks is only as good as the information and analysis that drives and facilitates
disruption efforts. The thorough analysis of large volumes of information has enabled a variety of
departments and agencies to take action to prevent attacks. On a great number of occasions since
9/11, many of which the American people will never know about, the tremendous, hardworking
corps of analysts across the CT community did just that, working day and night to track terrorist
threats and run down possible leads in order to keep their fellow Americans safe. Yet, as the
amount of information continues to grow, the challenge to bring disparate pieces of information —
about individuals, groups, and vague plots — together to form a clear picture about the intentions of
our adversaries grows as well.

These actions, informed by the excellent analytic work of the very same individuals and structure
that is under review, have saved lives. Unfortunately, despite several opportunities that might have
allowed the CT community to put these pieces together in this case, and despite the tireless effort
and best intentions of individuals at every level of the CT community, that was not done. Asa
result, the recent events highlight our need to look for ways to constantly improve and assist our CT
analysts, who are at the forefront of providing warning of terrorist attacks and keeping Americans
safe.

' This report reflects preliminary findings to facilitate immediate corrective action. Neither the report nor its findings
obviate the need for continued review and analysis to ensure that we have the fullest possible understanding of the
systemic problems that led to the attempted terrorist attack on December 25, 2009. Note further that sensitive
intelligence data was removed from this public report to protect sources and methods.


FINDINGS

The preliminary White House review of the events that led to the attempted December 25 attack
highlights human errors and a series of systematic breakdowns failed to stop Umar Farouk
Abdulmutallab before he was able to detonate an explosive device onboard flight 253. The most
significant failures and shortcomings that led to the attempted terror attack fall into three broad
categories:

A failure of intelligence analysis, whereby the CT community failed before December 25 to
identify, correlate, and fuse into a coherent story all of the discrete pieces of intelligence
held by the U.S. Government related to an emerging terrorist plot against the U.S.
Homeland organized by al-Qa’ida in the Arabian Peninsula (AQAP) and to Mr.
Abdulmutallab, the individual terrorist;

A failure within the CT community, starting with established rules and protocols, to assign
responsibility and accountability for follow up of high priority threat streams, run down all
leads, and track them through to completion; and

Shortcomings of the watchlisting system, whereby the CT community failed to identify
intelligence within U.S. government holdings that would have allowed Mr. Abdulmutallab
to be watchlisted, and potentially prevented from boarding an aircraft bound for the United
States.

The most significant findings of our preliminary review are:

The U.S. Government had sufficient information prior to the attempted December 25
attack to have potentially disrupted the AQAP plot—i.e., by identifying Mr.
Abdulmutallab as a likely operative of AQAP and potentially preventing him from
boarding flight 253.

The Intelligence Community leadership did not increase analytic resources working on
the full AQAP threat.

The watchlisting system is not broken but needs to be strengthened and improved, as
evidenced by the failure to add Mr. Abdulmutallab to the No Fly watchlist.

A reorganization of the intelligence or broader counterterrorism community is not
required to address problems that surfaced in the review, a fact made clear by
countless other successful efforts to thwart ongoing plots.

FAILURE TO “CONNECT THE DOTS”

It is important to note that the fundamental problems identified in this preliminary review are
different from those identified in the wake of the 9/11 attacks. Previously, there were formidable
barriers to information sharing among departments and agencies--tied to firmly entrenched patterns
of bureaucratic behavior as well as the absence of a single component that fuses expertise,

2


information technology (IT) networks, and datasets—that have now, 8 years later, largely been
overcome.

An understanding of the responsibilities of different analytic components of the CT community is
critical to identifying what went wrong and how best to fix it. The National Counterterrorism
Center (NCTC) was created by the Intelligence Reform and Terrorism Prevention Act of 2004
(IRTPA) to be “the primary organization in the U.S. government for analyzing and integrating all
intelligence possessed or acquired by the U.S. government pertaining to terrorism and
counterterrorism’.” Intelligence Community guidance in 2006 further defined counterterrorism
analytic responsibilities and tasked NCTC with the primary role within the Intelligence Community
for bringing together and assessing all-source intelligence to enable a full understanding of and
proper response to particular terrorist threat streams. Additionally, the Director of NCTC is in
charge of the DNI Homeland Threat Task Force, whose mission is to examine threats to the U.S.
Homeland from al-Qa‘ida, its allies, and homegrown violent extremists.

Notwithstanding NCTC’s central role in producing terrorism analysis, CIA maintains the
responsibility and resource capability to “correlate and evaluate intelligence related to national
security and provide appropriate dissemination of such intelligence.”> CIA’s responsibility for
conducting all-source analysis in the area of counterterrorism is focused on supporting its operations
overseas, as well as informing its leadership of terrorist threats and terrorist targets overseas.
Therefore, both agencies - NCTC and CIA ~ have a role to play in conducting (and a responsibility
to carry out) all-source analysis to identify operatives and uncover specific plots like the attempted
December 25 attack.

The information available to the CT community over the last several months — which included
pieces of information about Mr. Abdulmutallab, information about AQAP and its plans, and
information about an individual now believed to be Mr. Abdulmutallab and his association with
AQAP and its attack planning — was obtained by several agencies. Though all of that information
was available to all-source analysts at the CIA and the NCTC prior to the attempted attack, the dots
were never connected, and as a result, the problem appears to be more about a component failure to
“connect the dots,” rather than a lack of information sharing. The information that was available to
analysts, as is usually the case, was fragmentary and embedded in a large volume of other data.

Though the consumer base and operational capabilities of CIA and NCTC are somewhat different
the intentional redundancy in the system should have added an additional layer of protection in
uncovering a plot like the failed attack on December 25. However, in both cases, the mission to
“connect the dots” did not produce the result that, in hindsight, it could have — connecting
identifying information about Mr. Abdulmutallab with fragments of information about his
association with AQAP and the group’s intention of attacking the U.S.

e The majority of these discreet pieces of intelligence were gathered between mid-October
and late December 2009.

e For example, on November 18, Mr. Abdulmutallab’s father met with U.S. Embassy officers
in Abuja, Nigeria, to discuss his concerns that his son may have come under the influence of

250 U.S.C. § 4040(d)(1).
* 50 U.S.C. § 403-4a(d)(2).