http://articles.baltimoresun.com/1995-12-08/news/1995342001_1_durell-eavesdroppers-undercover

Double lives: Elite eavesdroppers work undercover abroad, drawing closer to their targets

No Such Agency

December 8, 1995

By Tom Bowman and Scott Shane

After U.S. consulate employee Gary C. Durell was killed by terrorist bullets this spring in Pakistan, Amer-ican officials met his flag-draped coffin at Andrews Air Force Base near Washington and mourned the loss of the 44-year-old father of two from Severn.

They praised him for serving his country. But they carefully sidestepped the nature of his work.

Mr. Durell was a spy for the Special Collection Service, an elite eavesdropping unit culled from the ranks of the National Security Agency and Central Intelligence Agency. In Karachi, Pakistan, SCS operatives picked up secrets on drug trafficking, terrorist networks and nuclear arms from a windowless room deep inside the U.S. consulate.

Even within the closed intelligence community, SCS has been a secret within a secret since it was created in the late 1970s. The directorship of the special service is switched every four years between the two spy agencies, most of whose employees know little about it.

Interviews with SCS veterans and other NSA employees, together with condolence letters and documents provided by Mr. Durell's family, offer a unique glimpse into this ultrasecret organization.

Mr. Durell and other SCS operatives officially resign from intelligence work to pose as diplomats, corporate employees or government workers in U.S. embassies and consulates overseas.

In Karachi, Mr. Durell was listed as a "State Department communications officer." He was targeted with two other U.S. consulate workers as they drove along a busy street in a commuter van.

The more volatile the country, the more likely SCS will be there listening; Mr. Durell's death underscored the danger to these undercover operatives.

As foreigners use stronger encryption and more sophisticated efforts to shield their communications, such hands-off techniques as spy satellites often can be ineffective. American eavesdroppers must draw closer to their prey.

Before heading overseas, Mr. Durell and his SCS colleagues prepared at a training site in Maryland, disguised as a high-tech company and hidden by thick woods. It does not appear on zoning maps. At the end of a long driveway is a guardhouse. A uniformed guard will say only that it's a Department of Defense facility.

From this massive two-building complex, Mr. Durell left for covert assignments in distant countries: Djibouti in East Africa, Thailand, India and finally Pakistan.

At what is cryptically called the "Maryland field site" in unclassified NSA documents, the undercover eavesdroppers learn to use sophisticated listening equipment, some the size of a briefcase and others stacked like a living-room stereo set. They are trained to work from locked rooms inside diplomatic facilities to glean political and military secrets from the ether.

Those who join SCS are told to be on guard when they head down a wooded road toward the Maryland field site.

"They tell people, 'Always be aware,' " says one NSA employee. "If someone's following, go around a loop, take the tag number and notify security."

NSA has often been derided in the spy world as a haven for desk-bound technicians who rarely venture far from their ranch homes in the quiet subdivisions around NSA headquarters at Fort Meade. But there are hundreds of people working for SCS whose lives mirror the characters in spy novels.

When they leave the Maryland field site, they have cover stories, foreign currency and business cards - complete with the phone number of a fictitious boss who will vouch for them. To avoid asking directions or otherwise calling attention to themselves, they have studied photograph albums detailing the landmarks and intersections in their new neighborhoods. Most have been formally appointed to the U.S. Foreign Service, bearing a certificate signed by the secretary of state and the president.

They must also memorize how they purportedly traveled to State Department headquarters, where they supposedly worked in Washington. What bus did they take? What Metro stop was closest? Nothing is left to chance.

More than an attache

Gary Durell was a perfect SCS recruit. Not only did he have a military background with postings overseas, but he was unassuming and discreet. Even his hobbies were the solitary pursuits of hunting and fishing.

A native of Alliance, Ohio, he learned his craft in the Air Force, serving as a military eavesdropper at U.S. bases in Texas and Italy. Joining NSA in 1977, he spent the next eight years at the Chicksands Royal Air Force Base, an NSA listening post in the English countryside north of London. In 1987, Mr. Durell left one spy world for another, and joined SCS.

For more than five years, he worked under State Department cover in Bangkok, Thailand; Bombay, India; and Djibouti, a small country above the horn of Africa. His clandestine reports were sent by satellite link to a vast complex of antennas adjoining the Maryland field site.

Unlike the overt military eavesdroppers who serve NSA from air bases in allied countries, where mammoth microwave dishes betray their mission to surrounding residents, the SCS agents must shield their true role in the countries where they are sent.

Among foreign intelligence services there is an unspoken agreement that espionage remain shrouded behind a benign diplomatic occupation, such as military attache or, as in Mr. Durell's case, "communications technician." But when a foreign spy is caught in a flagrant act, the host country may send him packing, as France did recently with four CIA "diplomats" trying to buy trade and telecommunications secrets.

In more hostile countries, where discovery of a spy could lead to prison or execution, a deeper cover is necessary. An SCS operative might serve as an embassy political officer, working on the same diplomatic chores as other Foreign Service staffers each day before disappearing into a secret room, usually on an upper floor. There, they tune in to the local airwaves.

It was inside the American consulate in Karachi that Mr. Durell spent four months intercepting communications on narcotics trafficking, terrorism and nuclear proliferation.

That posting ended tragically March 8. The spy was heading to work in a consulate van when terrorists leaped from a stolen taxi and opened fire with AK-47 automatic assault rifles. Sixteen bullets tore into the van, killing Mr. Durell and a consulate secretary, and wounding a third employee.

It was deemed an anti-American attack, perhaps to avenge the arrest in Pakistan of Ramzi Ahmed Yousef, who is accused of masterminding the 1993 bombing of the World Trade Center in New York. There is no evidence the attackers knew Mr. Durell's real job, officials say.

Back in Ohio, Mr. Durell's parents never knew much about his work, only that their son was employed by the federal government and that what he did was classified.

"I don't know what department," says his mother, Ellen. She recalls feeling "uneasy" about his work in Pakistan, but he wrote her not to worry.

"He was a good one for secret work," she says, "because Gary never said anything."

John Aldridge, a former next-door neighbor in the Wedgewood Forest subdivision in Severn, says: "He couldn't quite tell me what it was - 'military secret,' that's what he told me."

One day, he remembers, a moving van pulled up. Before Mr. Durell and his family disappeared into the car, the SCS spy called out, "We're going to Pakistan."

More than 300 cards and letters arrived at the Durell home after the death of their son - letters from members of Congress, and condolences from President Clinton; the acting director of central intelligence, Adm. William O. Studeman; and Vice Adm. John M. "Mike" McConnell, NSA's director.

He said Mr. Durell was a "loyal and valued employee during his employment and earned the highest respect and admiration of his colleagues."

Also among the papers at his parents' modest house on the outskirts of Alliance is a February 1993 letter addressed "To Whom It May Concern," verifying his employment as an "analyst" with the Department of Defense, his salary of $45,670 and the name of a personnel officer. It is headed with a four-letter acronym and the address of the Maryland field site.

After the funeral, the federal government tried to tie up any loose ends that might reveal Gary Durell's secret life. Two FBI agents from Canton, Ohio, appeared at his parents' front door, offering assistance and condolences. They casually asked the parents how much they knew about what their son did for a living, and left when the answers were comfortably vague.

'Gizmos everywhere'

Each month, NSA's employee newsletter includes a list of retirees. Most are graying Cold War veterans eager to collect their pensions and travel. But others are moving only deeper into the secret world.

The strange process of recruitment, training, establishment of cover and assignment abroad was described in detail by an SCS veteran now retired in Maryland.

He was no different from the thousands of other linguists at NSA, spending years translating intercepts of Turkish and Greek diplomats as they reported home from their Washington embassies and the United Nations' headquarters in New York.

Then one day in the fall of 1982, he saw an employment notice in the interoffice mail for a Persian-speaking linguist. The posting was overseas, although no location was given.

Eager for something different, he applied. Nine months later, he was approached by NSA's liaison to SCS, who took him to a quiet spot in the agency's cafeteria.

"We need someone to go to Kabul [Afghanistan's capital], and listen in on their communications," the liaison told him. NSA was eager to pick up the communications of the Soviet forces and their puppet regime to assist the U.S.-backed mujahedeen guerrillas and study the Russian military in action.

One morning, the SCS liaison drove the linguist to an industrial area of College Park, past the warehouses that border a tiny airport where the Wright brothers once flew. Pulling up to a long brick building with no ground-floor windows, the liaison officer said, "This place doesn't exist."

The liaison officer held a plastic card up to a metal plate and a heavy door clicked open. Inside, the linguist sat before a three-member panel.

"You probably think this is a strange place. We're all from the agency, some from CIA," said an NSA official who chaired the panel. "We work the embassies."

From the late 1970s until SCS moved to the wooded Maryland field site a decade later, NSA and CIA employees trained there for their new assignments. Most just called it College Park.

The covert headquarters of SCS was created to keep foreign agents from spotting U.S. employees at the well-traveled entrances and exits of the CIA and NSA, tracing their license plates and later tracking them overseas. The existence of the current SCS complex has never been reported, and The Sun has decided not to reveal its precise location.

Another visitor to the old SCS headquarters described it as "organized bedlam," with an eclectic band rushing about in T-shirts or three-piece suits.

"Wires everywhere, jerryrigged gizmos everywhere, computers all over the place," Mike Frost, a former Canadian spy who trained at College Park, wrote in his 1994 memoir, "Spyworld."

The creation of SCS in the late 1970s brought together NSA's skill at making bugs and CIA's greater experience at planting them abroad.

Tiny sensors hidden near a foreign office can intercept signals at the source and beam them to a U.S. satellite or a receiver inside an embassy.

A roving SCS van or a box attached to a telephone pole outside the window of, for example, an Iranian Foreign Ministry official may make it possible for an American linguist to read every message written in the Tehran office - at the moment it's being written.

Practice in 'the live room'

It took nearly a year for the NSA linguist to become a "diplomat."

After resigning from NSA, he reported to a secret CIA location in rural Warrenton, Va., to practice eavesdropping techniques. Then he was off to the Foreign Service Institute in Arlington, Va., to learn the finer points of diplomacy for his cover job as consular officer.

Back at College Park, the linguist spent weeks in "the live room," which could reproduce the electronic environment of any city in the world. By rebroadcasting signals taped in Kabul from antennas in the ceiling, SCS engineers were able to train the linguist on exactly what he would hear overseas.

The SCS complex also is staffed with expert technicians who design the radio receivers and antennas for a U.S. Embassy or another overseas location. One NSA technician specialized in creating antennas disguised as rooftop heating or cooling equipment - "anything you can put on top or on the side of a building." He would place an antenna inside an air-conditioning duct, curl it around a skylight or craft it to resemble an innocuous television antenna.

Even more unusual was the SCS pigeon fleet. Visiting College Park one day, Mr. Frost, the Canadian spy, asked why a top official had a mounted pigeon behind his desk.

The pigeon, he was told, was one of a flock that roosted outside the Soviet Embassy in Washington. An engineer came up with a brilliant idea. Why not bug the pigeons? Several were captured, fitted with small "bugs" and allowed to return to their perch - right outside an open office window.

The project yielded "incredibly good results," the Canadian spy was told. When the project was complete, one pigeon was stuffed as a memento.

Another bugging project described by Mr. Frost targeted a Chinese ambassador to Washington who often talked about sensitive matters on an outdoor bench in the embassy compound. SCS craftsmen made a "twig" from fiberglass, installed a listening device and tossed it into the compound near the bench.

SCS bugged crystal objects, mugs, Royal Doulton porcelain roses, dried floral arrangements, even a small totem pole. Mr. Frost also recalled an icon of the Virgin Mary holding the baby Jesus in her arms, painted on a 1-inch-thick piece of wood. The painting was hollow and contained a bug.

All of them were planted in offices or offered as gifts to diplomats, gifts that kept on giving.

'Plugged in' in Kabul

Arriving in Kabul toward the end of 1984, the former NSA linguist found he had something in common with the U.S. Embassy staff.

"Everybody there was a spy - CIA, DIA [Defense Intelligence Agency]," says the linguist-turned-vice consul. "It was a besieged city when I was there."

He spent several hours each day playing diplomat, meeting with Afghanis who wanted to travel to the United States, visiting the Foreign Ministry and attending receptions.

But most of the time, often in 12-hour stretches, he worked in a windowless suite of three small rooms protected by an electronic lock.

One room served as a lounge. Another was a storage area for listening equipment, some damaged beyond repair. Still, the eavesdroppers had to take special precautions even with machines no longer useful: They had to disassemble them and ship them home piece by piece in a diplomatic pouch.

The third room was stacked to the ceiling with electronic devices, a wall of knobs and buttons, tape recorders and glowing oscilloscopes. Consulting a thick volume called "TEXTA," for Technical Extracts from Traffic Analysis, the spies would find what frequencies their targets used.

While one eavesdropper tried to pick up Soviet conversations, the new man trawled for Afghan government communications. They were aided by an NSA invention called Oratory.

The briefcase-sized black box contained a keyword selection computer. On one side, the operator targeted a list of words: "Soviet" or "mujahedeen" or "Babrak Karmal," the pro-Soviet Afghan leader.

Oratory eliminated the worthless chatter and allowed spies to focus on their precise needs, spewing to the printer only relevant messages. And its program could be changed if new keywords came to mind.

Perched on a stool, the SCS operative worked the knobs and scanned the airwaves around Kabul, listening to Afghan troops and police officials. Tuning to the frequencies for the nearby military airport tower, he noted on 3-by-5 cards aircraft types, arrival and departure times and destinations. And every time an Afghan government official sent a Teletype message, a copy would appear on a printer in this embassy room.

The SCS operators provided blanket coverage of Afghanistan, recalls one Reagan administration expert on Middle East policy, remembering one particularly chilling intercept: a Soviet report that resistance fighters peeled off the skin of a captured Russian soldier while he was still alive.

"They were plugged in on Afghanistan," says the former official. "We were soaking up everything."

'Raw, actual transcript'

THE EMBASSY IN WAR-torn Kabul was unusual in its complement of spies. In most embassies, the SCS eavesdroppers are a few mysterious staffers who mix little with ordinary diplomats.

"Very often in an embassy no one will know they're there. They're out of the social loop," says one former ambassador.

Most of the intercepts are flashed directly to Maryland. But occasionally, top embassy officials would get excerpts.

"Most of it was raw, actual transcript, translated into English," says one veteran State Department official. "We used to monitor very closely in Guatemala.

There was terrorism from both sides - police and military, and the opposition."

Often, the prime targets of SCS listeners are not the communications of the country where they are based.

"You shouldn't assume that if there are NSA people in an embassy they're necessarily collecting against the host country," says another former ambassador, noting that Soviet and Warsaw Pact embassies around the world were a high priority during the Cold War.

"Most ambassadors are wary of targeting the host country," he says. "The damage that would be done to relations with an allied country [if the eavesdropping was discovered] could be immense."

Others dispute the contention that SCS worries about offending allies. The eavesdroppers, they say, are everywhere.

"NSA reads everybody," says the linguist who worked in Kabul.

And Mr. Frost, who helped create a Canadian service modeled on SCS, saw the Americans in many countries.

"In the SIGINT [signals intelligence] community, NSA is god," he says. "They're very good and very rich. They have all the money and all the people and all the equipment."

He is convinced that SCS is spying even on Canada. Suspicious-looking air-handling equipment on the roof of the U.S. Embassy in Ottawa resembles the disguise the Americans taught him to use for his antennas, he says. Below, the top-floor windows are barred and the curtains always drawn. As for targets, Parliament is across the street and the prime minister's office is an unobstructed few hundred yards away.

"It's best to put your equipment on the top floor. If you can get in a corner, it's all the better," Mr. Frost says, adding: "I can only say that if NSA doesn't do it in Ottawa, it's the only capital in the world where they don't."