How the FBI Caught the Times Square Bomber

Within hours after a smoking Nissan Pathfinder was discovered in Times Square on May 1, 2010, Linda Walsh, FBI special agent assigned to the New York Joint Terrorism Task Force, was hot on the trail of the perpetrator.

In an effort to do extensive damage, Faisal Shahzad had abandoned the explosives-loaded Pathfinder on a Saturday evening in the height of Broadway show traffic. A quick-acting food vendor noticed smoke coming from the car and immediately alerted police.

“Propane tanks in the back of the car is always the first investigative clue that you have a bomb on your hands,” Walsh joked with an audience of securities experts at the Fordham-FBI International Conference on Cyber Security. “And red gas cans? Another very bad sign . . . “

The FBI discovered one VIN number on the Pathfinder that the perpetrator forgot to scratch off, and traced it to a woman in Connecticut.

The woman had recently sold the car on Craig’s List for cash, and had no receipt or name of the buyer. But she did have a phone number.

That number was a prepaid cell, but the FBI was able to find the vendor, get records and link the card owner to a number in Pakistan. Checking U.S. entry records from Pakistanis, they discovered the same number tied to Shahzad.

By May 3, agents initiated surveillance on Shahzad’s Connecticut residence only to discover he was already at JFK Airport boarding a plane headed for Dubai. They arrested him just in time.

From there, the FBI recovered his cell phone and computer and traced Shahzad’s descent into radical Muslim extremism through records. What they found, Walsh said, was an “eye opener.”

Shahzad had been in regular contact with the Pakistani Tereek-e-Taliban (TTP) through a proxy IP and Virtual Private Networks (VPN) at file sharing locations, Walsh said.

Among the sites the terrorists used were www.esnips.com, RapidShare and the German-based TeamViewer. In order to avoid detection, Shahzad’s Pakistani contacts had taken great care to choose particular features and to know the laws of the country they were operating in.

In all, the FBI required 700 grand jury subpoenas to access 18 email accounts, 20,000 emails and 10,000 unique telephone numbers, she said. For three years, she said, Shahzad had operated very much “under the radar”— free of dogmatic rhetoric and working within respectable professions. In fact, he became a U.S. citizen in 2009 and held an MBA in finance.

“I have worked terrorist cases with Internet nexus’ since 2004, and the terrorists are getting much better at it,” said Walsh. “As we develop more cloud computing and different storage, we ask ourselves ‘if I were a terrorism subject, what would I use?’ And then we investigate.”

--Janet Sassi