The beginning of the CIA’s cover and tradecraft crisis dates back to at least February 2003, when a Muslim cleric known as Abu Omar disappeared off the street in Milan. He didn’t resurface until 2004, when he called his wife from Cairo to tell her about his kidnapping, detention and torture at the hands of the CIA.
Italian investigators, eager to get to the bottom of the audacious abduction on their streets, were later able to track a web of cellphones communicating only with each other in close proximity to the disappearance, leading them to a series of hotel bills, credit card statements and other identifying indicators, according to a 2007 investigation unveiled at an annual hacker conference in 2013. Italian authorities charged 23 Americans, including the CIA’s former Milan station chief, for their roles in the scheme — most in absentia.
While Omar was just one target of the CIA’s aggressive post-9/11 antiterrorism campaign, several former intelligence officials described the Milan operation’s aftermath as a “come to Jesus” moment that revealed just how vulnerable the agency’s operators were to technology. At the time, some undercover officials naively believed that methods like using potato chip bags would mask cellphone signals, and operatives were generally “freewheeling,” according to one former senior intelligence official. In the space of a few short years, the rapid advance of technology, including nascent international surveillance systems, increasingly endangered the CIA’s traditional human intelligence gathering.
Singapore was one example, recall three former intelligence officials. By the early 2000s, the agency ceased running certain types of operations in the Southeast Asian city-state, because of the sweeping digital surveillance there. The Singaporeans had developed a database that incorporated real-time flight, customs, hotel and taxicab data. If it took too long for a traveler to get from the airport to a hotel in a taxi, the anomaly would trigger an alert in Singaporean security systems. “If there was a gap, they’d go to the hotel, they could flip on the TVs and phones and monitor what was going on” in the room of the suspicious traveler, says the same former senior intelligence official. “They had everything so wired.”
“You used to be able to fly into a country on one name and have meetings in another,” recalls this person. “It limited a lot of capabilities.”
Those concerns spread to other places, like London, where CCTV cameras are omnipresent, and the United Arab Emirates, where facial recognition is ubiquitous at the airport. Today there are “about 30 countries” where CIA officers are no longer followed on the way to meetings because local governments no longer see the need, given that surveillance in those countries is so pervasive, said Dawn Meyerriecks, the CIA’s deputy director for science and technology, in a 2018 speech.
In the 2000s, the explosion in biometrics — such as fingerprints, facial recognition and iris scans — propelled the conversation forward, according to multiple former intelligence officials. U.S. intelligence agencies concluded that in many parts of the world, within a short time, all alias work would likely become impossible.
These fears were largely borne out, say former CIA officials — especially in “hard target” countries like China and Iran. But this trend also affected CIA operations in friendlier countries. By 2012, recalls one former official, some officers were temporarily forbidden to travel for missions in the European Union over fear of exposure, due to widespread sharing of airport biometric data between EU member states. “Facial recognition and biometrics make it very difficult to travel in alias,” says Mike Morell, former acting CIA director and host of the “Intelligence Matters” podcast.
The rise in popularity of consumer DNA kits, which allow people to send in samples of their own DNA, is a growing part of the biometrics problem. Even if an undercover operative hasn’t used a consumer DNA kit, it’s highly likely, say experts, that one of their close relatives has. The Pentagon’s Dec. 20 warning to members of the military not to use these kits appears to be partly in response to that threat.
Greg Hampikian, a biologist at Boise State University and a leading DNA expert, says that with the advent of commercial genetic databases, exposing a spy or other covert operative could be as easy as taking a saliva sample from a cigarette butt or a drinking cup. A suspicious foreign government could send the sample in and potentially find out if the person has been operating under an assumed name.
“It’s right out of a spy novel,” he says.
For spy services, biometric data has become a highly valued currency — leading to a widespread and ongoing campaign by the U.S. and its allies, as well as hostile states, to hack into biometric databases from important airports worldwide. The U.S. has spearheaded breaches of its own, successfully hacking biometric data from the Dubai and Abu Dhabi airports, says a former official. Stealing biometric databases is an attractive strategy for other countries as well. In one case, Chinese intelligence successfully hacked into the biometric data from Bangkok’s airport. “The Chinese have consistently extracted data from all the major transit hubs in the world,” says another former senior official.
