attack on the Turkish aid flotilla off the coast of Gaza four years ago. Shayetet Thirteen was the unit that boarded the Turkish freighter, the SS Ardahan . According to the CIA, Colonel Yacoby led the boarding party. If you remember, nine Palestinians were killed in the raid, including three combatant commanders of the AlQassam Brigades.” Delvecchio paused for effect, then added, “Which is the same unit the CIA believes orchestrated the attack in India over the weekend.”
He paused to shuffle some papers on the lectern and, while he did so, the ADD of combating terrorism strategy asked, “How does CIA know Yacoby was part of the IDF raid on the Turkish ship?”
“Our friends at Langley had a paid informant on the SS Ardahan . This agent passed crucial intelligence about the security of the ship to his handler and then, after conferring here with the NSC, POTUS ordered the CIA to feed the intelligence on to the Israelis. In the back-and-forth of this communication, a meeting occurred in Tel Aviv between CIA officers and Shayetet Thirteen commandos, including Colonel Yacoby. His name made it into the CIA database after the meeting. After the flotilla raid by Shayetet Thirteen, the CIA wrote up an after-action review for internal dissemination.” Delvecchio paused. “Colonel Yacoby’s name was put in the AAR.” He added, “In error.”
Someone—Ross thought it was Pak from South and Central Asia—said, “That is a significant error.”
“Agreed,” Delvecchio said, “It should have been redacted and code worded. It wasn’t our file, we didn’t do it.” He hastened to add. “Not that it matters to Colonel Yacoby and his family.”
Madeline Crossman, the compliance and security director, said, “We have serious concerns the Palestinian terrorists learned Mr. Yacoby’s name from the CIA report.”
Beth Morris spoke up. She was assistant deputy director for Western Hemisphere. “I’m sorry, Henry. Madeline. Is there some linkage here with NSC that I don’t understand?”
Henry Delvecchio nodded. “Beth, we have reason to believe there has been an insider compromise.”
There were soft gasps throughout the room.
When they subsided he said, “The complete CIA file on the SS Ardahan , including the name of the Shayetet Thirteen team leader, was accessed on the network here in the NSC office four months ago. The files were copied and moved into a file-sharing section of the server. From there, we can only assume they were printed out or downloaded.”
Morris asked, “They were accessed by who ?”
Crossman said, “We do not know. There was a breach of forty-five documents classified at the secret level or above. Whoever moved the files disguised the electronic fingerprint of the breach.”
Morris’s voice rose in indignation. “And you think one of us stole the files and gave them to the Al-Qassam Brigades?”
Crossman replied, “Beth, there was, without question, anomalous behavior. That’s all we know at this point for sure. We need to rule out any nefarious actions.”
Morris looked over to the IT staffers in the room, who were all more or less sitting together. “It had to have been someone who knew how to disguise the electronic fingerprint, whatever the hell that is.”
The entire IT department bristled at the comment, but they were generally quieter than the regional staffers. One of them said, “These files were taken off JWICS?” JWICS was the Joint Worldwide Intelligence Communications System, an Internet of sorts for America’s intelligence agencies.
“Yes, that’s correct,” confirmed Crossman. “Specifically, the files were accessed on Intelink-TS.” This was a top-secret network that ran on JWICS.
“How many people had access to the TS files?”
“Including staffers and IT administrators, and adding in those outside contractors with access to both the TS files and the NSC terminals . . . thirty-four.”
Ethan Ross looked around the room, but while he was