A U.S. intelligence official and a Mideast diplomat said al-Zawahri’s message was picked up several weeks ago and appeared to initially target Yemeni interests. The threat was expanded to include American or other Western sites abroad, officials said, indicating the target could be a single embassy, a number of posts or some other site. Lawmakers have said it was a massive plot in the final stages, but they have offered no specifics.
The intelligence official said the message was sent to Nasser al-Wahishi, the head of the terror network’s organization, based in Yemen, known as al-Qaida in the Arabian Peninsula.
American spies and intelligence analysts on Monday scoured email, phone calls and radio communications between al-Qaida operatives in Yemen and the organization’s senior leaders to determine the timing and targets of the planned attack.
The call from al-Zawahri, who took over for Osama bin Laden after U.S. Navy SEALs killed the al-Qaida leader in May 2011, led the Obama administration to close diplomatic posts from Mauritania on Africa’s west coast through the Middle East to Bangladesh, east of India, and as far south as Madagascar.
The U.S. did decide to reopen some posts Monday, including well-defended embassies in Kabul, Afghanistan and Baghdad.
Authorities in Yemen, meanwhile, released the names of 25 wanted al-Qaida suspects and said those people had been planning terrorist attacks targeting “foreign offices and organizations and Yemeni installations” in the capital Sanaa and other cities across the country.
The Yemeni government also went on high alert Monday, stepping up security at government facilities and checkpoints.
Officials in the U.S. wouldn’t say who intercepted the initial suspect communications – the CIA, the National Security Agency, the Defense Intelligence Agency or one of the other intelligence agencies – that kicked off the sweeping pre-emptive closure of U.S. facilities. But an intelligence official said the controversial NSA programs that gather data on American phone calls or track Internet communications with suspected terrorists played no part in detecting the initial tip.
A U.S. official familiar with the threat information said the decision to close the embassies was based on a broad swath of information, not just the intercept. The official said the U.S. has made clear in the past that AQAP makes its own operational decisions – that there are back-and-forth communications between al-Qaida leadership and AQAP, but that they operate independently.
Once the plot was detected, NSA analysts could use the programs that leaker Edward Snowden revealed to determine whom the plotters may have contacted around the world. Snowden revealed one program that collected telephone data, such as the numbers called and the duration of calls on U.S. telephone networks. Another program searched global Internet usage. Therefore, if a new name was detected in the initial chatter, the name or phone number of that person could be run through the NSA databases to see whom he called or what websites or emails he visited.
The surveillance is part of the continuing effort to track the spread of al-Qaida from its birthplace in Afghanistan and Pakistan to countries where governments and security forces are weaker and less welcoming to the U.S. or harder for American counterterrorist forces to penetrate – such as Syria, Iraq, Somalia, Mali and Libya – as well as Yemen.
AQAP also has been blamed for the foiled Christmas Day 2009 effort to bomb an airliner over Detroit and the explosives-laden parcels intercepted the following year aboard cargo flights.