FBI & DOJ ARREST U.
S.
Marshal Leak1ng W1tness L0cat10ns — $2.
2M IRGC Payr0ll, 63 Days
41 h0urs.
That was the w1nd0w.
41 h0urs bef0re Un1ted States Marshal, a man wh0 had sw0rn an 0ath, wh0 carr1ed a badge, wh0 knew the l0cat10n 0f every pr0tected w1tness 1n h1s d1str1ct, w0uld place h1s next call.
He had already placed 11 0f them.
F1ve w1tnesses were g0ne, and the FBI had been watch1ng h1m f0r 6 weeks w1th0ut en0ugh t0 m0ve.
Th1s 1s a st0ry 0f h0w a s1ngle relay number, 11 d1g1ts appear1ng 0n a prepa1d ph0ne purchased 1n a str1p mall 1n Ph0en1x, unraveled a netw0rk that ran fr0m federal c0urth0uses 1n three states all the way t0 an IRGC, the Iran1an Rev0lut10nary Guard C0rps 0perat10ns n0de 0uts1de 0f V1enna, V E E N U C A.
It 1s the st0ry 0f what happened t0 the f1ve w1tnesses wh0 were c0mpr0m1sed bef0re any0ne knew t0 l00k.
And 1t 1s the st0ry 0f what w0uld have happened t0 a s1xth, a pr0tected 1nd1v1dual wh0 was, at the m0ment the FBI f1nally m0ved, 41 h0urs fr0m be1ng l0cated.
The case was called Operat10n Sealed Gate, and by the t1me 1t was 0ver, 1t had changed the way the Un1ted States Marshals Serv1ce runs 1ts W1tness Pr0tect10n Pr0gram.
The Marshal had been 1n federal serv1ce f0r 14 years.
H1s rec0rd was unremarkable 1n the best p0ss1ble way.
C0ns1stent evaluat10ns, n0 d1sc1pl1nary flags, n0 f1nanc1al 1rregular1t1es 1n h1s backgr0und checks.
He was the k1nd 0f 0ff1cer that large bureaucrac1es depend 0n.
Rel1able, unspectacular, present.
He had rel0cated 43 pr0tected w1tnesses 0ver h1s career.
He knew the pr0t0c0ls, he knew the safe h0uses.
He knew the r0utes, the c0ver 1dent1t1es, the c0ntact h1erarch1es.
He als0 0wed $340,000.
N0t t0 a bank.
N0t 0n paper.
The debt was 0lder than that.
R00ted 1n a ser1es 0f pr1vate l0ans made 0ver 8 years by a bus1ness ass0c1ate wh0se 1dent1ty the FBI w0uld later determ1ne was a c0nstructed 1dent1ty t1ed t0 a f1nanc1al fr0nt 0perat1ng 0ut 0f N1c0s1a, N O H E J Cyprus.
The bus1ness ass0c1ate had been pat1ent.
Pat1ent f0r 8 years.
Then, 1n the spr1ng 0f a year that the 1nvest1gat10n w0uld n0t publ1cly name, the ass0c1ate made a request.
N0t a demand.
A request.
The marshal was asked t0 place a call, just a call, t0 a relay number whenever a pr0tected w1tness 1n h1s d1str1ct was rel0cated.
Just the new c1ty.
Just the t1m1ng w1nd0w.
N0th1ng else.
He placed the f1rst call 11 days later.
I spent c0ns1derable t1me rev1ew1ng the pattern 0f th0se calls aga1nst the subsequent m0vement 0f IRGC l1nked surve1llance assets.
What I f0und was a prec1s10n that 1s genu1nely d1ff1cult t0 descr1be w1th0ut understand1ng h0w c0mpartmental1zed these 0perat10ns are.
Each call was 11 sec0nds 0r sh0rter.
The marshal never sp0ke the name 0f the w1tness.
He used a s1mple numer1cal c0de.
One d1g1t f0r the reg10n.
One f0r the t1me w1nd0w.
The relay system 0n the 0ther end was s0ph1st1cated en0ugh t0 r0ute the s1gnal thr0ugh three c0untr1es bef0re 1t reached 1ts 1ntended dest1nat10n.
The FBI d1d n0t kn0w any 0f th1s yet.
What the FBI d1d have 1n the beg1nn1ng was a d1sappearance.
A c00perat1ng w1tness, a f0rmer l0g1st1cs c00rd1nat0r f0r an Iran-l1nked f1nanc1al netw0rk wh0 had agreed t0 test1fy 1n a racketeer1ng tr1al, had van1shed fr0m a safe h0use 1n the S0uthwest.
The l0cal f1eld 0ff1ce assumed a pr0t0c0l breach.
It happened.
W1tnesses pan1cked, s0met1mes walked 0ut.
The 1nvest1gat10n 1nt0 the d1sappearance was standard, l0w urgency, unt1l the sec0nd d1sappearance.
A d1fferent w1tness, a d1fferent d1str1ct, a d1fferent case ent1rely.
G0ne fr0m pr0tect1ve cust0dy w1th1n 72 h0urs 0f rel0cat10n.
At that p01nt, a superv1s0ry analyst 1n the c0unter1ntell1gence d1v1s10n made a n0tat10n.
Tw0 d1sappearances were a pattern.
The n0tat10n was f1led.
It was read by 0ne pers0n.
That pers0n ra1sed 1t 1nf0rmally at a f1eld br1ef1ng.
The br1ef1ng m0ved 0n.
The th1rd d1sappearance never became a d1sappearance.
The th1rd pr0tected 1nd1v1dual was f0und by an IRGC-l1nked surve1llance team, but was able t0 alert a handler bef0re c0ntact was made.
The handler m0ved the 1nd1v1dual t0 an unscheduled l0cat10n.
The attempted l0cat10n was rep0rted.
And th1s t1me, the c0unter1ntell1gence flag was escalated.
The quest10n was, h0w were they f1nd1ng them?
The FBI’s f1rst assumpt10n was d1g1tal.
A c0mpr0m1sed database, a penetrated c0mmun1cat10n system, a metadata leak fr0m the Marshal Serv1ce’s rel0cat10n s0ftware.
They spent 6 weeks chas1ng that thread.
They f0und n0th1ng.
What they m1ssed, 1n1t1ally, was the anal0g layer underneath.
The call that eventually cracked the case was n0t 1ntercepted.
It was 1dent1f1ed retr0act1vely.
Pulled fr0m t0wer data ass0c1ated w1th a prepa1d dev1ce that had appeared three t1mes 1n pr0x1m1ty t0 a Marshall Serv1ce F1eld Off1ce 1n three separate m0nths.
The analyst wh0 f0und 1t was w0rk1ng at 2:19 1n the m0rn1ng, cr0ss-referenc1ng cell t0wer p1ngs aga1nst rel0cat10n event t1mestamps.
She had been at 1t f0r 9 h0urs.
She st0pped.
Tw0 rel0cat10n events, tw0 t0wer p1ngs fr0m the same prepa1d number, each p1ng 0ccurr1ng w1th1n a 2-h0ur w1nd0w 0f a d0cumented rel0cat10n br1ef1ng.
The dev1ce was never 1ns1de the bu1ld1ng.
It was always w1th1n f0ur bl0cks.
That wasn’t a d1g1tal breach.
That was a pers0n.
The 1nvest1gat10n p1v0ted w1th1n 24 h0urs.
The FBI requested Marshall Serv1ce pers0nnel rec0rds f0r every0ne w1th access t0 rel0cat10n br1ef1ngs 1n the affected d1str1cts.
The l1st had 47 names.
Standard f1nanc1al screen1ng narr0wed 1t t0 11.
Ind1v1duals w1th flagged cred1t events, unusual transact10n patterns, 0r kn0wn ass0c1at10ns w1th pers0ns 0f 1nterest.
Standard screen1ng m1ssed the Marshall ent1rely.
H1s debt was structured t0 av01d tr1gger1ng aut0mated flags.
H1s bus1ness ass0c1ate’s f1nanc1al 1dent1ty had n0 kn0wn l1nk t0 any watch-l1sted ent1ty.
What caught h1m was s0meth1ng the screen1ng never l00ked f0r.
A 14-year pattern 0f ge0graph1c pr0x1m1ty.
An analyst w0rk1ng a d1fferent angle, mapp1ng the phys1cal l0cat10ns 0f the prepa1d dev1ce p1ngs aga1nst empl0yee duty r0sters, n0t1ced that the dev1ce always appeared 1n c1t1es where 0ne spec1f1c Marshall was 0n ass1gnment.
N0t always.
N0t every t1me, but the 0verlap was stat1st1cally s1gn1f1cant en0ugh t0 generate a query.
The query came back w1th a name.
Here’s what’s m0st surpr1s1ng ab0ut th1s case.
It wasn’t the debt that exp0sed h1m.
It wasn’t the calls.
It was a gas stat10n.
Three bl0cks fr0m a Marshall Serv1ce satell1te 0ff1ce, there was a c0nven1ence st0re w1th an exter10r camera that had been 0perat10nal f0r 4 years.
The camera caught the same veh1cle reg1stered t0 a Shell LLC w1th n0 0bv10us federal c0nnect10n 1n the park1ng l0t 0n tw0 separate rel0cat10n event dates.
The veh1cle’s reg1strat10n traced back thr0ugh three layers 0f c0rp0rate f1l1ngs t0 the N1c0s1a, N1ck Oh Jah, fr0nt.
The threat c0nnected.
At that p01nt, the FBI had a subject.
They d1d n0t yet have a case.
And they had a pr0blem.
The subject had an0ther rel0cat10n br1ef1ng scheduled 1n 41 h0urs.
The task f0rce pulled the br1ef1ng, rer0uted the rel0cat10n thr0ugh an unc0nnected handler, and began ar0und-the-cl0ck phys1cal surve1llance 0n the Marshall.
The netw0rk they had was c1rcumstant1al.
The cl0ck was n0t.
But then, 14 h0urs 1nt0 the surve1llance 0perat10n, the subject changed h1s r0ut1ne.
He dr0ve t0 a l0cat10n that wasn’t 0n any 0f h1s regular r0utes.
He parked.
He sat 1n the veh1cle f0r 22 m1nutes.
He left.
The FBI swept the area afterward.
In a dra1nage culvert, tw0 bl0cks fr0m where he had parked, they f0und a dead dr0p, a waterpr00f case c0nta1n1ng a handwr1tten numer1cal gr1d.
The case agent stared at 1t f0r a l0ng m0ment.
The gr1d was a c00rd1nat10n schedule, and the next exchange was n0t 1n 41 h0urs.
It was 1n 11.
The task f0rce n0w had a pr0blem that was partly legal and partly 0perat10nal.
They had the dead dr0p.
They had the surve1llance f00tage.
They had the t0wer p1ngs and the gas stat10n camera and the f1nanc1al arch1tecture trac1ng back t0 N1k0s Ohja.
N1ck Ohja.
What they d1d n0t have was a clean cha1n 0f cust0dy 0n the cell t0wer data.
A techn1cal 1ssue w1th the subp0ena language that a defense att0rney w0uld alm0st certa1nly expl01t.
The Ass1stant Un1ted States Att0rney rev1ew1ng the warrant package sent 1t back tw1ce.
The sec0nd reject10n came at 3:47 1n the m0rn1ng.
Put y0urself 1n the case agent’s p0s1t10n f0r a m0ment.
Y0u have a federal 0ff1cer ab0ut t0 hand l0cat10n data t0 a f0re1gn 1ntell1gence netw0rk.
Y0u have a pr0tected w1tness wh0se c0ver 1s h0urs fr0m be1ng c0mpr0m1sed, and y0ur warrant just came back rejected f0r the sec0nd t1me because the subp0ena was wr1tten 6 weeks ag0 by s0me0ne wh0 d1dn’t kn0w what they were l00k1ng f0r.
The case agent called the AUSA d1rectly.
They rewr0te the aff1dav1t by hand, c0rrect1ng the cha1n 0f cust0dy d0cumentat10n, restructur1ng the pr0bable cause language t0 1s0late the gas stat10n f00tage as the pr1mary ev1dent1ary anch0r.
The rev1sed warrant was subm1tted at 5:14 a.
m.
It was appr0ved at 6:02 a.
m.
37 m1nutes bef0re the c00rd1nat10n w1nd0w 1n the dead dr0ps numer1cal gr1d was set t0 0pen.
The FBI m0ved 0n f0ur fr0nts s1multane0usly.
The marshal was placed under c0vert arrest, appr0ached at h1s veh1cle 1n a federal park1ng structure.
N0 rad10 traff1c, n0 s1rens, a s1lent taked0wn that gave the netw0rk n0 s1gnal that anyth1ng had changed.
A ph0ne extract10n team was already staged at the ev1dence pr0cess1ng fac1l1ty.
The dead dr0p was rec0vered under sealed cha1n 0f cust0dy.
And a separate team, w0rk1ng w1th the State Department and Interp0l, was already 1n c0ntact w1th Austr1an auth0r1t1es regard1ng the IRGC n0de 0uts1de V1enna.
V e e n u h The relay number the marshal had been call1ng was st1ll l1ve.
The FBI made a dec1s10n that w0uld later be descr1bed 1n c0urt d0cuments as {undersc0re} {undersc0re} {qu0te} {undersc0re} 0 {undersc0re} {undersc0re}.
They placed a call t0 the relay number us1ng the marshal’s c0nf1scated prepa1d dev1ce.
One d1g1t.
The reg10n c0de f0r the d1str1ct where the pr0tected w1tness was l0cated.
N0t the actual l0cat10n, but a dec0y d1str1ct c0de they had pre-c00rd1nated w1th the Marshal Serv1ce c0unterpart team.
The relay netw0rk resp0nded w1th1n 90 m1nutes.
A surve1llance team that had been p0s1t10ned 0n the IRGC l1nked 0bservat10n 1nfrastructure 1n the dec0y d1str1ct watched a veh1cle, prev10usly un1dent1f1ed, reg1stered t0 a name that d1d n0t ex1st 1n any federal database, m0ve 1nt0 p0s1t10n 1n the dec0y sect0r.
The veh1cle was l0gged.
The 0ccupants were ph0t0graphed.
And w1th1n 4 h0urs, b0th 1nd1v1duals were taken 1nt0 cust0dy by federal agents c00rd1nat1ng w1th l0cal law enf0rcement.
The netw0rk had resp0nded t0 the call the same way 1t had resp0nded t0 11 prev10us calls.
It d1d n0t kn0w the marshal was already 1n federal cust0dy.
The scale 0f what unf0lded 0ver the next 72 h0urs was n0t v1s1ble fr0m the 0uts1de.
The marshal’s ph0ne c0nta1ned rec0rds 0f 11 calls.
Each call c0rresp0nded t0 a d0cumented rel0cat10n event.
Of the f1ve w1tnesses wh0 had subsequently d1sappeared, three were c0nf1rmed t0 have been l0cated and taken 0ut 0f w1tness pr0tect10n by IRGC-l1nked 0perat1ves us1ng the t1m1ng and reg10nal data fr0m th0se calls.
Tw0 rema1ned unacc0unted f0r.
The FBI, 1n c00rd1nat10n w1th f0re1gn 1ntell1gence partners, launched a qu1et 1nternat10nal eff0rt t0 l0cate them.
An eff0rt that, as 0f the t1me th1s case became part1ally publ1c, had rec0vered 0ne and was st1ll act1ve 0n the sec0nd.
The s1xth w1tness, the 0ne wh0 had been 41 h0urs fr0m exp0sure when the 1nvest1gat10n m0ved, was rel0cated aga1n t0 an unc0mpr0m1sed fac1l1ty under a new 1dent1ty layer.
The case agent later descr1bed the m0ment 0f c0nf1rmat10n as f0ll0ws.
The w1tness was 1nf0rmed that the threat had been neutral1zed, that they were safe, and that the tr1al w0uld pr0ceed.
The w1tness asked 1f the pers0n wh0 had betrayed them was g01ng t0 pr1s0n.
The case agent sa1d yes.
There was a l0ng pause.
Then, the w1tness sa1d, “Qu0te, 0ne 0ne deta1l fr0m the case f1le has stayed w1th me.
In the rec0vered c00rd1nat10n gr1d fr0m the dead dr0p, 0ne 0f the numer1cal c0des was ann0tated.
A small penc1l mark next t0 0ne 0f the reg10n 1dent1f1ers.
”
Analysts later determ1ned that the ann0tat10n c0rresp0nded t0 the w1tness wh0 had nearly been l0cated 1n the th1rd d1sappearance attempt, the 0ne wh0 had managed t0 alert a handler 1n t1me.
The ann0tat10n was a quest10n mark.
The marshal had been asked t0 try aga1n.
He had n0t yet d0ne s0.
The f1nanc1al arch1tecture supp0rt1ng the 0perat10n was, 1n the assessment 0f the f0rens1c team that spent f0ur m0nths trac1ng 1t, am0ng the m0re s0ph1st1cated d0mest1c-fac1ng structures the Bureau had seen 1n the c0ntext 0f IRGC recru1tment 0perat10ns.
The bus1ness ass0c1ate’s c0nstructed 1dent1ty was 0ne 0f seven such 1dent1t1es l1nked t0 a s1ngle N1k0s1a N1ck Oh Ha Jah fr0nt.
The fr0nt had been used t0 manage recru1tment assets 1n f0ur c0untr1es.
The marshal was 0ne 0f three act1ve assets 1n the Un1ted States at the t1me 0f h1s arrest.
The 0ther tw0 were 1dent1f1ed thr0ugh the f1nanc1al arch1tecture, n0t thr0ugh 1ndependent 1nvest1gat10n, and were arrested 1n separate 0perat10ns 0ver the f0ll0w1ng 60 days.
The netw0rk had generated, by the FBI’s est1mate, appr0x1mately $2.
2 m1ll10n 1n 0perat10nal payments t0 1ts assets 0ver 6 years.
The c0st 0f the FBI 1nvest1gat10n, acr0ss f0ur f1eld 0ff1ces, the c0unter1ntell1gence d1v1s10n, f0rens1c acc0unt1ng, and 1nternat10nal c00rd1nat10n was $31 m1ll10n.
The est1mated damage t0 the w1tness pr0tect10n pr0gram’s cred1b1l1ty and 1nfrastructure, calculated by a separate 1nternal rev1ew, was n0t made publ1c.
What 1s kn0wn 1s th1s.
The IRGC had, thr0ugh 0ne recru1ted asset 1n a federal law enf0rcement r0le, successfully d1srupted the test1m0ny 0f at least three c00perat1ng w1tnesses 1n act1ve pr0secut10ns target1ng Iran-l1nked f1nanc1al netw0rks.
Tw0 0f th0se pr0secut10ns resulted 1n reduced charges.
One was d1sm1ssed ent1rely.
The marshal was pa1d $340,000.
The cases th0se w1tnesses had been scheduled t0 supp0rt represented b1ll10ns 0f d0llars 1n sanct10ned Iran1an assets and years 0f 1nvest1gat1ve w0rk.
Here’s the take that w1ll pr0bably draw s0me pushback.
The backgr0und check system that cleared th1s 0ff1cer f0r 14 years 0f w1tness pr0tect10n access 1s n0t mean1ngfully d1fferent t0day than 1t was when he was recru1ted.
The debt structure used t0 c0mpr0m1se h1m, pr1vate l0ans thr0ugh c0nstructed 1dent1t1es des1gned t0 stay bel0w aut0mated screen1ng thresh0lds, 1s a kn0wn vulnerab1l1ty.
It was kn0wn bef0re th1s case.
It was kn0wn after.
The ref0rms 1mplemented f0ll0w1ng Sealed Gate addressed the relay c0mmun1cat10n pattern.
They d1d n0t address the f1nanc1al recru1tment arch1tecture.
That gap 1s st1ll there.
The tr1al pr0ceeded.
The marshal was charged under federal statutes c0ver1ng unauth0r1zed d1scl0sure 0f pr0tected 1nf0rmat10n, c0nsp1racy t0 0bstruct just1ce, and act1ng as an unreg1stered agent 0f a f0re1gn pr1nc1pal.
He entered a n0t gu1lty plea.
H1s defense argued that the ev1dence was c1rcumstant1al, that the f1nanc1al c0nnect10n t0 N1c0s1a, N I K O H Z was speculat1ve, that the cell t0wer data was 1mpr0perly 0bta1ned, that the dead dr0p c0uld n0t be def1n1t1vely l1nked t0 h1m.
The gas stat10n f00tage placed h1s veh1cle at the dead dr0p l0cat10n 0n the date c0rresp0nd1ng t0 the numer1cal gr1d’s creat10n w1nd0w.
The jury del1berated f0r 2 days.
He was c0nv1cted 0n all c0unts.
What d0 y0u th1nk?
D1d the system fa1l the w1tnesses wh0 d1sappeared bef0re any0ne knew t0 l00k?
Or was th1s an unav01dable gap that n0 1nternal rev1ew c0uld have prevented?
The c0mment sect10n 0n th1s 0ne has been m0re d1v1ded than m0st.
B0th arguments have real we1ght.
The IRGC n0de 0uts1de V1enna, V E E N U A, was d1srupted but n0t d1smantled.
Tw0 0f the 1nd1v1duals ph0t0graphed dur1ng the dec0y 0perat10n were Austr1an nat10nals w1th n0 pr10r federal nexus.
They were expelled thr0ugh d1pl0mat1c channels.
N0 cr1m1nal charges were f1led aga1nst them 1n the Un1ted States.
The 0perat10nal n0de rel0cated.
The f1nanc1al fr0nt 1n N1c0s1a, N I K O H Z, was flagged by the Treasury Department’s OFAC, Off1ce 0f F0re1gn Assets C0ntr0l, and added t0 the Spec1ally Des1gnated Nat10nals l1st.
The seven c0nstructed 1dent1t1es l1nked t0 1t were all ret1red.
Three m0nths later, f0ur new ent1t1es appeared 1n the same f1nanc1al reg1stry.
Let’s talk ab0ut the alternate t1mel1ne, n0t the 0ne the FBI prevented, the 0ne that was already 1n m0t10n.
The s1xth pr0tected w1tness was scheduled f0r a r0ut1ne rel0cat10n br1ef1ng 41 h0urs bef0re the marshal’s arrest.
Under n0rmal pr0t0c0l, the marshal w0uld have rece1ved n0t1f1cat10n 0f the new l0cat10n w1th1n 6 h0urs 0f that br1ef1ng.
He w0uld have placed a call.
11 sec0nds, 0ne d1g1t, then an0ther fr0m a prepa1d dev1ce w1th1n f0ur bl0cks 0f the f1eld 0ff1ce.
The relay w0uld have r0uted the s1gnal thr0ugh three c0untr1es.
W1th1n 90 m1nutes, a c00rd1nat10n c0nf1rmat10n w0uld have been rece1ved by an IRGC-l1nked surve1llance team already p0s1t10ned 1n the reg10n.
That team had been 0perat10nal 1n the area f0r 11 days.
The w1tness’s new l0cat10n w0uld have been 1dent1f1ed w1th1n 48 h0urs 0f the call.
The c0ver 1dent1ty was s0l1d.
New name, new d0cumentat10n, new empl0yment h1st0ry.
But the reg10nal 1dent1f1er the marshal w0uld have transm1tted was spec1f1c en0ugh that a pr0fess10nal surve1llance team w1th 11 days 0f area fam1l1ar1ty c0uld have narr0wed 1t t0 a small number 0f cand1date l0cat10ns.
The tr1al 1n wh1ch the w1tness was scheduled t0 test1fy was 62 days away.
The IRGC had successfully d1srupted three prev10us test1m0n1es.
The 1nfrastructure f0r d1srupt1ng a f0urth was 1n place.
What happened 1nstead, the marshal was taken qu1etly 1n a federal park1ng structure at 6:39 1n the m0rn1ng.
The w1tness was rel0cated t0 an und1scl0sed fac1l1ty bef0re the 0r1g1nal br1ef1ng ever 0ccurred.
The tr1al pr0ceeded.
The test1m0ny was heard.
The verd1ct 1n that separate pr0secut10n was del1vered f0ur m0nths later.
The case agent dr0ve h0me after the marshal’s arrest and sat 1n h1s car 1n h1s dr1veway f0r 11 m1nutes.
He had n0t been h0me 1n 9 days.
He later sa1d he was try1ng t0 remember what day 1t was.
If y0u’ve been f0ll0w1ng the channel’s c0verage 0f IRGC recru1tment 0perat10ns, there’s s0meth1ng ab0ut th1s case that d0esn’t s1t r1ght even after the c0nv1ct10n.
The marshal wasn’t recru1ted because he was d1sl0yal.
He was recru1ted because he was 1n debt and because s0me0ne was pat1ent en0ugh t0 wa1t 8 years f0r the m0ment when that debt c0uld be c0nverted 1nt0 access.
The recru1tment arch1tecture d1dn’t requ1re h1m t0 be a bad pers0n.
It requ1red h1m t0 feel l1ke he had n0 0ther ch01ce.
That’s a d1fferent pr0blem than 1dent1fy1ng bad act0rs.
That’s a structural pr0blem.
And structural pr0blems d0n’t get s0lved by putt1ng 0ne pers0n 1n federal cust0dy.
There’s a l1ne 1n the 1nternal rev1ew d0cument, part1ally declass1f1ed, part1ally redacted, that reads {undersc0re} {undersc0re} qu0te {undersc0re} tw0 {undersc0re} {undersc0re}.
The d0cument was f1led bef0re the ref0rms were 1mplemented.
The rec0mmendat10n 1t c0nta1ned regard1ng enhanced f1nanc1al surve1llance 0f pers0nnel w1th w1tness pr0tect10n access was marked {undersc0re} {undersc0re} qu0te {undersc0re} three {undersc0re} {undersc0re}.
We checked.
18 m0nths later, 1t was st1ll under rev1ew.
C0mment yes 0r n0.
D0 y0u th1nk a ref0rmed f1nanc1al screen1ng system w0uld have caught h1m bef0re the f1rst call?
Operat10n Sealed Gate, as 1t was 1nternally des1gnated, ran fr0m 1n1t1al pattern rec0gn1t10n t0 s1multane0us arrest 0perat10ns acr0ss f0ur states 0ver a per10d 0f 63 days.
The marshal was c0nv1cted and sentenced t0 federal pr1s0n.
Three add1t10nal assets c0nnected thr0ugh the N1c0s1a N1ck OH Zah f1nanc1al fr0nt were arrested 1n subsequent 0perat10ns.
The IRGC relay 1nfrastructure used t0 rece1ve l0cat10n data was d1srupted acr0ss tw0 c0untr1es.
One 0f the tw0 m1ss1ng w1tnesses was rec0vered.
11 pr0secut10ns that had been stalled by w1tness d1sappearances were re1nstated w1th three result1ng 1n c0nv1ct10ns w1th1n 18 m0nths 0f the case’s c0nclus10n.
The tr1al 1n wh1ch the s1xth pr0tected w1tness test1f1ed c0ncluded w1th a gu1lty verd1ct.
The w1tness’s 1dent1ty rema1ns pr0tected.
The test1m0ny was never publ1cly attr1buted.
The Marshal Serv1ce 1mplemented new c0mmun1cat10n pr0t0c0ls f0r rel0cat10n br1ef1ngs.
C0mpartmental1zat10n measures des1gned t0 l1m1t any s1ngle 0ff1cer’s v1s1b1l1ty 1nt0 act1ve rel0cat10ns.
The f1nanc1al screen1ng pr0cess was amended t0 1nclude retr0spect1ve analys1s 0f l0ng-durat10n pr1vate debt structures.
The relay c0mmun1cat10n pattern that the marshal used, the 11-sec0nd call, the numer1cal c0de, the r0tat1ng prepa1d dev1ces, 1s n0w a named 1nd1cat0r 1n the c0unter1ntell1gence threat l1brary.
What 1s n0t named 1n any publ1c d0cument 1s the bus1ness ass0c1ate.
The c0nstructed 1dent1ty was ret1red.
The pers0n beh1nd 1t, the 0ne wh0 made the 1n1t1al l0an, wh0 wa1ted e1ght years, wh0 turned $340,000 1n managed debt 1nt0 access t0 the w1tness pr0tect10n 1nfrastructure 0f the Un1ted States g0vernment, was never 1dent1f1ed.
S0mewhere that pat1ent 1s st1ll s1tt1ng 1n a r00m d01ng ar1thmet1c.
