Andrew Britton - The Operative

It was here that the National Operations Center, or the NOC, worked year-round, twenty-four hours a day, seven days a week, to monitor, protect against, and manage foreign and domestic threats to the United States under the umbrella of the DHS Office of Operations Coordination and Planning. While it shared some similarities with the FBI-SIOC synergy, the DHS-NOC relationship was a much more separate and different wheel on the massive wagon driving the nation’s homeland security efforts. Thus, while SIOC served as an intelligence hub for law enforcement and investigative agencies, the NOC was the focal point for information flowing between state, regional, and tribal governments abroad, as well as private infrastructure elements-power and telecommunications grids, mass transit companies, airlines, school systems, hospitals, and other essential service providers. The idea was for these wheels to spin in smooth coordination and keep the wagon moving forward, rather than flying off its axles when things got bumpy.

Despite all the happy talk about cooperation, there were still rivalries between the subsystems in each of the branches. SIOC and the NOC competed for funds and thus competed with one another. Brenneman had learned that early on, which was why only SIOC had a voice in today’s meeting. But that did not mean the NOC hadn’t turned its considerable resources on the convention center attack.

The NOC’s Social Network Monitoring Center, or SNMC, was located on the second floor of the building, in a large, nondescript room with rows of computer workstations along the aisles. Established in 2008, the unit monitored social media networks and other public Web sites for information related to terrorist activities. In accordance with Constitutional privacy guarantees, the NOC was barred from setting up fraudulent user accounts and was restricted to utilizing publicly available search engines and content browsers. But its Web-based platforms had been configured to skim through and pluck potentially valuable morsels of intelligence from Internet traffic.

Of the social networks, Facebook, Twitter and, to a lesser extent, Myspace-with their combined 800,000,000 unique monthly visitors-received the most attention, although there were scores of other personal and professional networking sites, from Plaxo to LinkedIn, which accounted for millions of additional users. Also identified, sorted, and analyzed were scraps of information collected from blogs, news sites, online forums, and message boards that might, in NOC parlance, contribute to “situational awareness and establish a common operating picture” of a particular threat or event.

On the day of the Baltimore Convention Center attack, DHS 10:00-5:30 action officers Dick Siegel and Clare Karl were preparing to carpool home to the Arlington County suburb where they both lived. Workers on the 5:30-1:00 shift were just beginning to arrive. They exchanged quick, impersonal hellos with their daytime counterparts. All the shifts shared desks, which limited the personalization and added to the sterility of a room that was already function oriented.

It was Siegel’s turn to drive, and he’d been about to grab his cell phone from his desk when there was a three-tone computer ping alerting him to a “situation.” He glanced at the leftmost of his three monitors, the one earmarked for general use, and saw the red-boxed “alert” prompt.

“Got something,” he told Karl, who was already watching other officers checking the update. She stepped behind Siegel as he leaned over the keyboard.

“Hope it’s not important,” she said. “I have a T-ball game to get to.”

“I think we’re playing you,” Siegel said.

Almost as soon as word of the attack reached the NOC, the first dribbles of intel began coming from the center. The SNMC’s automated software applications, or web robots, generated hundreds of meta tags that enabled them to sniff around for suspicious or otherwise noteworthy keywords, and the ones that got the Twitter bots hopping at approximately 5:15 p.m. that Sunday evening were all of a kind: explosion, blast, bomb.

“What the hell is this?” Siegel wondered aloud as updates came up on the other two computer screens.

Karl had moved to her desk.

“You seeing these tweets?” Siegel asked.

Sitting at the workstation on Siegel’s right, Karl was nodding slowly. “I think we should report this to-” She suddenly interrupted herself. “Holy Mother of God, Dick. Look at the TA board!”

Her eyes had snapped up to a sixty-five-inch flat-panel angled downward from the top of the wall in front of her, where the national threat assessment level was on constant display. It had jumped straight from “guarded” to “severe,” bypassing the “high” alert advisory.

She looked at Siegel and he at her, but only for a moment. They had been here several years apiece and had never seen that kind of leap.

It took only seconds for reports of what was happening in Baltimore to flash across the lower third of their screens. These were identified by their sources: Fox News on top, CNN in the middle, MSNBC at the bottom. At the same time phones throughout the room started ringing, beeping, and singing, and there was a low hum of voices talking to sources, superiors, and one another. The room crackled with portent; this was why the unit had been formed, its reason for being, validation for all the stiff necks, sore backs, and strained eyes that went with monitoring Internet chatter day after day.

Siegel felt like he had as a boy of ten, a budding fisherman in a deep pool of water who’d suddenly, unexpectedly felt his boat rocked by something big and powerful. He knew, now as then, what he had to do, what his father had trained him for. But in an instant he was no longer navel-gazing in dreamy tranquility but was aware of the much bigger, much more active world around him.

For NOC cyber-snoops, the responsibilities and protocols of data collection during a crisis were well defined. Each action officer had a preassigned duty, and Siegel’s was to trawl the Twitter feed, capturing and sorting meta-tagged updates of interest while scanning subjects trending within Twitter’s own network. This was a simple matter, since trending topics were determined by commonly repeated terms that were either user hashtagged or detected by Twitter’s internal search bots. Twitter then listed these on a home-page sidebar that could be set to view either worldwide or localized trends.

Siegel had picked up on the tweets from Colwriter123 early in his search. Showing up on the network as frequent re-tweets-when one user copied and posted another user’s message to disseminate the information-they appeared to originate from the convention center. They had been floated to the top by the scan programs because there was an event taking place with a larger than normal number of dignitaries from the D.C. area. Now that he looked at the latest tweets, they seemed to give very precise information about what was going on inside the center, even indicating where a particular group of hostages had been segregated. Appeared and seemed being the operative words, because Siegel had to allow for the possibility that the tweets were part of a ghoulish hoax. His gut told him they weren’t, though, because a number of the abbreviations Colwriter123 had used were not standard and they came at irregular times, as though the tweeter were trying to impart information in a hurry. Fully 80 percent of faux tweets could be ruled out by those two criteria.

Added digging reinforced Siegel’s initial conviction. According to his user profile, Colwriter123’s real name was Colin Dearborn and he was a journalism major at the University of Virginia, a self-described “new media evangelist.” The profile page also bore a link to a column he wrote for the school newspaper, where a peek at his most recent piece revealed that he had been planning to tweet what he termed “live dispatches” from the career fair at the Baltimore Convention Center.