Almost Real-Time

Recently, we postulated that senior U.S. officials were actively monitoring the September attack on the U.S. consulate in Benghazi, Libya that claimed the lives of Ambassador Chris Stevens and three other Americans:

"...there is reason to believe that Mr. Obama may have learned of events in Libya long before the three-hour mark, and here's why: reports of escalating threats to U.S. interests in the Middle East should have put the National Security Agency (and its global intercept capabilities) on heightened alert.

It's also worth noting that the U.S. (read: NSA) monitored several phone conversations between Al Qaida operatives and representatives of the Ansar al Sharia group.  During the calls, they discussed the attack on the American consulate in Benghazi.  So far, U.S. officials have not revealed if the chatter was related to planning the assault, or if it occurred while the attack was in progress.

But let's assume that the conversations occurred just prior to the attack and while it unfolded.  We make this assumption (hoping) that if NSA had advance notice that our consulate was being targeted, protective measures would be implemented to safeguard our personnel.  Obviously, we cannot make this assumption with complete certainty; after all, the agency collects millions of bits of information on a daily basis.  There are delays in translation, and even with sophisticated data-mining and keyword search techniques, analysts don't always receive information required to provide timely warning.

Still, if we're reading the tea leaves correctly, it appears that NSA was monitoring terrorist communications for a period that included the actual attack on the consulate and the murder of Ambassador Stevens.  If that's the case, then the agency most likely issued its highest priority message traffic (known in the trade as FLASH/CRITICs).

These alerts, reserved for the most important global events, are supposed to be in the hands of the President--and other senior officials--within 10 minutes of receipt.  There are established guidelines for events considered worthy of a CRITIC, and NSA has sometimes rejected submissions from lower levels in the signals intelligence (SIGINT) community.  For example, when U.S. listening posts in Japan detected the shoot down of Korean Airlines Flight 007 in 1983, initial CRITICS sent to NSA were rejected, on the grounds of insufficient information.  However, as the situation became more clear, FLASH/CRITIC traffic was quickly forwarded to President Reagan and key members of his national security team.

Based on what we're hearing, it seems likely that President Obama was in receipt of similar messages on the night our consulate was breached and Ambassador Stevens was murdered, along with three other Americans.  And, if NSA was monitoring terrorist phone calls in the run-up to the attack, there is a very real possibility that the commander-in-chief knew what was going on well before the "three hour" mark.  That possibility raises very real questions about what Mr. Obama knew, when he knew it, and his initial response to the crisis.

Now, our theory has been confirmed.  From the Danger Room:

U.S. officials in Washington monitored the September 11 attack on the American mission in Benghazi as it was happening. But don’t blame American policymakers for initially blaming the unrest in Benghazi on protesters.

Those are those are just two of the somewhat contradictory messages coming from State Department employees as they testify before the House Oversight Committee, which held hearings Wednesday on the attack. But they’re not only only contradictions. Depending on which witness you believe, security at the embassy were either just fine — “the correct number of assets,” one State Department official said — or woefully inadequate.

“When the attack began, a Diplomatic Security agent working in the tactical operations center immediately activated the imminent danger notification system,” explained Charlene Lamb, the Deputy Assistant Secretary of State for International Programs, in her prepared testimony (.pdf). “Based on our security protocols, he also alerted the annex U.S. quick reaction security team stationed nearby… and the Diplomatic Security Command Center in Washington. From that point on, I could follow what was happening in almost real-time.” 

That latter description--"Almost Real-Time"--is a thinly-veiled reference to U.S. SIGINT capabilities.  So clearly, there was a trail of SIGINT reporting as the attack unfolded, and it was flowing to key officials in Washington.  If Ms. Lamb was monitoring events near real-time, then it's a certainty that the same message traffic was being received at other locations, including the National Military Joint Intelligence Center (NMJIC) in the Pentagon, and the Situation Room at the White House.

Based on previous accounts, we know that President Obama was briefed on the night of the attack, and those updates were almost certainly based on the same intel traffic received at the State Department.  Once again, the question is elementary: what did the President (and Secretary of State Clinton) know, and when did they know it?