Brian Regan: The Spy Who Could Not Spell

Yudhijit Bhattacharjee

October 26, 2016

The spy who couldn’t spell: how the biggest heist in the history of US espionage was foiled

The classrooms and hallways of Farmingdale High in Long Island were deserted on the morning of Saturday 19 August 2001, when a van pulled into the school’s parking lot. Turning off the engine, the driver – a tall man in his late 30s – stepped out into the warm summer sun. He cast a sweeping gaze upon the institution he had graduated from two decades earlier.

Whatever nostalgia he might have felt for his old school was tinged with bitterness. It was here that he had suffered some of life’s early humiliations: taunted by classmates for his apparent dimwittedness; held in low esteem by his teachers. If they remembered him at all, they would remember him as the boy who had difficulty reading. The boy who was so bad with spellings. His bearish frame may have protected him from physical bullying, but combined with his severe dyslexia and his social awkwardness, it had also cemented his image as a dolt. 

That image had stuck with him, despite a successful career in US intelligence, where he had been given access to some of the country’s most valued secrets. Being underestimated – by family, classmates and colleagues – had been the theme of his life, a curse he had borne silently since childhood. But for the mission he had now embarked upon, it was a blessing. None of his co-workers or managers in the intelligence community could have imagined that he of all people was capable of masterminding a complex espionage conspiracy.

From the parking lot, he walked to the edge of the school grounds. Squeezing through a hole in the barbed wire fence next to the handball courts, he stepped into a wooded area that separated the nearby highway from the school perimeter. Walking a few yards, he stopped by a tree and dug a hole in the ground. He took a laminated list of phone numbers out of his pocket and buried it there before walking back to his van, confident that nobody had seen him.

He had already pulled off what was then the biggest heist of classified information in the history of American espionage. In just a few days, he hoped to execute the final step of a meticulous plan to exchange those secrets for millions of dollars. If he succeeded, he would have enough money to pay off the mortgages of his brothers and sisters, settle his personal debts and secure the financial future of his children.

With fortune, he imagined, respect would follow. Those who had known him would no longer doubt his intelligence. Once and for all, he would shake off the image that had dogged him since childhood.

One Monday morning in December 2000, FBI Special Agent Steven Carr hurried out of his cubicle at the bureau’s Washington DC field office and bounded down two flights of stairs to pick up a package that had just arrived by FedEx from the FBI’s office in New York. Carr was 38, thoughtful and intense, meticulous in his work.

Since he joined the FBI in 1995, he had played a supporting role in a series of high-profile espionage cases, but like most agents starting out in their careers, Carr was keen to lead a high-stakes investigation himself. A devout Catholic, Carr would sometimes bow his head in church and say a silent prayer requesting divine assistance in landing a good case. That’s why he had responded so quickly when his squad supervisor had asked him to pick up the package that morning. “Whatever it is, it’s yours,” she had said.

Carr raced back to his desk and laid out the contents of the package in front of him: a sheaf of papers running into a few dozen pages. They were from three envelopes that had been handed to the FBI by a confidential informant at the Libyan consulate in New York. The envelopes had been individually mailed to the consulate by an unknown sender.

Breathlessly, Carr thumbed through the sheets. Based on directions sent from New York, he was able to sort the papers into three sets, corresponding to the three envelopes. All three had an identical cover sheet, at the top of which was a warning in all caps. “THIS LETTER CONTAINS SENSITIVE INFORMATION.” Below, it read, in part:

This letter is confidential and directed to your President or Intelligence Chief. Please pass this letter via diplomatic pouch and do not discuss the existence of this letter in your offices or homes or via any electronic means. If you do not follow these instructions the existence of this letter and its contents may be detected and collected by US intelligence agencies.

In the first envelope was a four-page letter with 149 lines of typed text consisting of alphabets and numbers. The second envelope included instructions on how to decode the letter. The third envelope included two sets of code sheets. One set contained a list of ciphers. The other, running to six pages, listed dozens of words along with their encoded abbreviations: a system commonly known as brevity codes. Together, the two sets were meant to serve as the key for the decryption.

Carr flipped through the letter, skimming the alphanumeric sequence. It looked like gibberish. There was no way to make sense of it without the code sheets and the decoding instructions. By mailing the three separately, the sender had sought to secure the communication against the possibility that one envelope might get intercepted by a US intelligence agency. Carr saw that the sender had included a message in typed, plain text in each envelope, informing the consulate of the other two envelopes in the mail and instructing the receiver of the message to place a car ad in the Washington Post if any of the other envelopes failed to arrive. The sender had not anticipated that all three envelopes could fall into theFBI’s hands.

FBI New York had already decoded a few lines of the letter. Carr’s pulse quickened further as he read the deciphered text.

“I am a Middle East North African analyst for the Central Intelligence Agency. I am willing to commit espionage against the US by providing your country with highly classified information. I have a top secret clearance and have access to documents of all of the US intelligence agencies, National Security Agency (NSA), Defense Intelligence Agency (DIA), Central Command (Centcom) as well as smaller agencies.”

To prove that this wasn’t a bluff, the sender had included in all three envelopes an identical set of government documents, 23 pages in all, some marked “CLASSIFIED SECRET”, some “CLASSIFIED TOP SECRET”. Most of them were aerial images taken by US spy satellites, showing military sites in the Middle East and other parts of the world. Some of the documents were intelligence reports about regimes and militaries in the Middle East. It was evident from the markings on these images and reports that they had been printed after being downloaded from Intelink, a classified network of servers that constituted the intelligence community’s internet.

There were some additional documents, including a monthly newsletter of theCIA, circulated internally among agency employees, and aerial photographs of Colonel Gaddafi’s yacht in the Mediterranean. They had been taken from a low-flying aircraft deployed not by the United States but by a foreign intelligence service. How the sender of the package could have acquired them was unclear.

Carr had never seen anything like it before. The sender of the envelopes was no doubt a bona fide member of the US intelligence community, with access to “top secret” documents, intent on establishing a clandestine relationship with a foreign intelligence service. The person had, in fact, already committed espionage by giving classified information to an enemy country. Carr might as well have been looking at a warning sign for a national security threat flashing in neon red.

Carr filed the sheets neatly into a binder before stepping into the office of his supervisor, Lydia Jechorek. “Lydia,” he said, sliding the binder across her desk. “You have to look at this.”

Jechorek, a counter-intelligence veteran in her early 50s, leafed through the pages. Carr explained to her why FBI New York had couriered the pages to Washington. In the portion of the coded letter that agents in New York had deciphered, they had found an email address the sender wanted to use for further communication. With special permission from the US attorney general, the nation’s top law enforcement official, the agents asked the email service provider to let them pry into the account: jacobscall@mail.com.

They discovered that the account had been created four months earlier, on 3 August, using internet access from a public library in Prince George’s County, Maryland. In the account registration, the user had identified himself as “Steven Jacobs,” having a residential address in Alexandria, Virginia. The account had been accessed half a dozen times from public libraries around Washington DC. There were no emails in the account except for test messages the person had sent to himself, and a reply from the Fraud Bureau in response to an inquiry he had made about an online company that sold fake IDs.

“What are we going to do?” Jechorek asked. It was imperative that the FBI find this person as quickly as possible. Perhaps it was already too late.

Carr showed Jechorek a series of clues about the sender’s identity that he had gleaned from the intercepted pages. The system of brevity codes the sender had used – along with the concern for operational security – pointed to somebody with a military background. He had a “top secret” security clearance, which reduced the potential suspect pool from a few hundred thousand workers in the US intelligence community who have a “secret” security clearance to a more limited population, of tens of thousands, with the higher level of clearance. He also had access to Intelink. And he was probably married, with children, as evidenced by a line in the letter, stating: “If I commit espionage, I will be putting myself and family at great risk.”

There was one other thing: the man was a terrible speller. Scanning the six pages of brevity codes, Carr spotted one misspelled word after another.

AP: Anonmus

NH: Alligations

GR: Reveil

16: Precausion

CN: Negotianalable

DZ: Airbourn

KJ: Assocation

MY: Netralize

YF: Confrimed

The list went on and on. Here was a person who had gone to great lengths to accomplish “op sec”, but failed to run a basic spellcheck.

For the moment, though, Carr was focused on another set of clues: the locations of the public libraries the sender had accessed the jacobscall email account from. He had marked them with pins on a large map of the Washington DC metropolitan area. The pins were clustered in and around the towns of Bowie and Crofton in Maryland. The intelligence agency in closest proximity was the NSA.

Located in Fort Meade, Maryland, the NSA has thousands of military employees, many with a background in cryptology, many with homes in the towns of Bowie and Crofton. Carr’s hunch was that the mole was probably from within the NSA’s ranks, even though he had introduced himself as a CIA analyst. That line – and the CIA newsletter in the materials he had sent – was possibly a red herring.

“We need to call Mac,” Carr said.

Jechorek picked up the phone and dialed Robert McCaslin, the head of counterintelligence at the NSA.

The idea of committing espionage began taking shape in Brian Regan’s mind through the early months of 1999, after he had spent four years working at the National Reconnaissance Office (NRO), the agency responsible for managing the United States’ spy satellites. Regan worked in an office that helped military units in the field to access and use intelligence collected through reconnaissance from space.

He was feeling humiliated at work, his financial situation was getting worse, and his marriage was deteriorating. From the average evaluations he had been getting, he knew he wasn’t going to be promoted any time soon. The air force wanted to transfer him to Europe, but Regan wasn’t willing to move because of the disruption it would cause to his family. When the air force turned down his request to defer overseas deployment, he had to choose between accepting the transfer and retiring a year later at the age of 37, on August 31, 2000, when he would complete 20 years of service. Grudgingly, he opted for the latter.

With the clock ticking towards retirement, Regan’s anxieties about the future transformed into a rising sense of panic. Because of the narrow scope of the work he had been doing at the NRO, he wasn’t sure he would be able to find a well-paying job in industry, certainly not with the ease that his colleagues expected to. Clutching at straws, Regan finally saw a way out of this insecurity. He would cash in on the nation’s secrets.

Growing up, he had learned that getting what he wanted sometimes meant having to break the rules. He had not experienced any negative consequences for having stolen the ceramic art tools from his neighbour’s house, or for cheating on his military entrance test. All that mattered, he felt, was not getting caught. As long as he could get away with it, espionage was a legitimate answer to his troubles.

It was also one that seemed to lie within easy grasp. One of Regan’s secondary responsibilities at his job was to help maintain his division’s web page on Intelink. He knew that on the network’s thousands of pages and databases there was an array of secrets the US had spent billions to acquire. The way Regan came to see it, Intelink was the doorway to a basement stuffed with treasures waiting to be sold to the country’s enemies.

Regan began exploring Intelink, browsing content that went far beyond his assigned responsibilities. Through the autumn and winter months, he accessed a diverse selection of images and intelligence reports – a profile of a Libyan general, the US’s capabilities for destroying military sites hidden deep underground, an adversary’s handbook for conducting biological warfare. As he continued, these sessions became longer, and more frequent.

Regan devoted part of his surfing to educating himself about espionage. He searched Intelink for reports by analysts on how spies through US history had gone about stealing secrets and transferring them to other governments, how they were discovered and investigated. He even took time out of his job at the NRO to attend a counter-intelligence course, where he heard former FBI and CIA agents present counter-intelligence case studies.

Regan wanted to avoid the mistakes that traitors before him had made. With sufficient foresight and planning, he told himself, he would pull off the perfect conspiracy. Unbeknownst to all those co-workers and classmates who had ever doubted his intelligence, he would transform himself into the ultimate spy.

By autumn 1999, Regan was using the office printer to compile hundreds of pages of classified information from Intelink. As he began accumulating these documents, Regan thought carefully about the next steps in his plan. Most US spies who had betrayed the country were tasked by a foreign government to steal and pass information, but Regan had initiated his espionage scheme on his own. He had no relationship with intelligence agents of another country. He was going to have to devise his own way of contacting a foreign service and marketing the information he was gathering.

What countries could he target? He turned his sights to the Middle East and North Africa, a part of the world he had concentrated on during much of his career. In the decade since the end of the cold war, the region had become a focus of increasing attention for US military planners. Following the collapse of the Soviet Union, the US no longer had a single, rival superpower to worry about. Instead, it had to contend with a growing military challenge from China, and a host of smaller adversaries, many of them oil-rich countries with a majority-Muslim population: Iraq, Libya, Iran, Sudan. Each of these nations, Regan thought, would be willing to pay for secrets that might help them militarily against the United States.

Regan tailored his explorations on Intelink accordingly. He collected images and reports on China. He entered “Top Secret Iran” into the intranet’s search engine and sifted through the results. He cast another wide net by searching for “Top Secret Libya,” misspelling “Libya” on more than one occasion. He looked for material that would be valuable to the Iraqi regime. Regan did not just gather information that would help the countries he had in mind – Libya, Iraq and Iran among them – in hostilities against the US. He also downloaded whatever intelligence he could find on the military capabilities of regional neighbours, such as Israel, which he expected his target countries would be equally interested in.

Regan could not simply stack this growing volume of printouts on his desk. He stored them in a free-standing cupboard that sat between his cubicle and his neighbour’s. Every now and then, he would open it, add a new bundle of documents, and lock it up again. Nobody asked him any questions.

The storage proved to be more secure than he could have imagined. Once, when Regan was travelling on assignment, members of NRO’s building management staff came by his office looking to pick up unused furniture. Nobody spoke up for the cupboard, and so they took it away. Later, when they discovered that it was locked, they used a drill to unlock it. Inside they found hundreds of documents.

When Regan returned, one of them called him to ask if the papers belonged to him. He replied in the affirmative, trying to stay calm despite feeling a wave of panic about being found out. The staff wrapped up the documents and sent them all back to him. Relieved, he stuffed the printouts in an overhead cabinet, which felt like a safer storage space, even if only because it was affixed to the wall.

One day in March 2000, Regan pulled out a sheaf of documents from his stash and placed it at the bottom of his gym bag, underneath his sweaty workout clothes. At around 5pm, he logged out of his computer, picked up the bag and walked out of his cubicle towards the building exit.

Regan’s heart was racing, but he walked unhurriedly as he approached the turnstiles. He looked at the security guards who milled around at the front desk, chit-chatting among themselves as people streamed out of the building on their way home. Regan knew that the guards had the authority to stop anyone for a search. There was a chance, however slim, that one of them would want to look into his gym bag, rifle through the clothes and discover the classified documents concealed underneath. 

But the guards had seen him come in and go out of the building with that same gym bag hundreds of times in the past; they had no reason to suspect him, and he slipped through the turnstiles, unimpeded. As he walked to his car, the tension draining from his body, Regan thought about how easy it had been to smuggle the documents out. He had got away by being just another face in the crowd, a signal drowned by a sea of noise.

In the weeks that followed, Regan removed hundreds of pages of documents from the office in his gym bag, transferring his holdings, bit by bit, into the basement of his townhouse in Bowie. None of the things he had collected over the years – comic books, baseball cards, action figures – had made him rich; now, finally he was hoarding materials with real value.

His stash was not limited to documents any more. He was copying information from the NRO’s computers on to CDs and taking home training videos on VHS. Late at night, while his wife Anette and the kids slept, he would go down to the basement and copy the tapes.

It was around the same time, in April 2000, that Regan started working on a plan to market what he had stolen. From the spy cases he had researched, he knew he would have to contact the intelligence services of the countries he was targeting.

Regan began writing a letter addressed to the head of the Libyan intelligence service, whose name he had dug up on Intelink. Introducing himself as a CIA analyst, he highlighted some of the secrets he was willing to offer in exchange for $13m. By the time he had finished typing up his detailed instructions for how the transaction was to occur – the Libyans would have to set up a 1-800 number for him to call, and communicate that this had been done via a used-car ad in The Washington Post – the letter had run to 13 pages. Drafting it was only the first step, however. To be secure, Regan decided he had to communicate the letter in code.

For this letter, Regan used a complex encryption scheme. He first assigned brevity codes to the different words in his text – for example, using the code “JK” to represent the word “signals”. He then converted, through further encryption, this encoded version of the letter into another string of letters and numbers. In a separate document, Regan typed up the steps for decrypting the letter. After weeks of painstaking effort, he had what he thought was a foolproof way of reaching out to the Libyans without risking his anonymity.

In July, when Anette and the kids were away in Sweden, Regan went through the trove of classified material in his basement. By now, he had more than 20,000 pages, plus the CDs and videotapes. Sitting at home, he sorted the information by target country, bundling the printouts, CDs and tapes into packages intended for Libya and Iraq – the two nations that he felt most optimistic about selling to. He separated about 5,000 pages of documents into another pile. They contained what Regan believed to be the most sensitive of all the secrets he had pilfered.

He packed these documents in Tupperware containers, along with CDs and videotapes containing information of similarly high sensitivity. He put the containers – and whatever he couldn’t fit into them – into garbage bags, and wrapped them up into packages.

One rainy day in July, Regan drove out to Patapsco Valley State Park near Baltimore, about 30 miles from his house. The woods in the park were lush green, the hiking trails damp from the rain. Regan got out of the car with a backpack and walked into the forest.

After he had trekked deep into the forest, Regan stopped and looked around. There was no one in sight. He took out a shovel from his backpack and began digging a hole in an open patch between the trees. The air was hot and humid, and by the time he had dug a-foot-and-a-half into the ground, Regan’s brow was beaded with sweat. He dropped one of the packages into the hole, and covered it up with dirt.

Then he walked over to a tree several feet away, and hammered some roofing nails into it. Next, reaching into his backpack, he pulled out a GPS logger that he had brought home from work. He had used the device hundreds of times to record the positions of air defence systems deployed in training exercises. He peered at the logger’s screen to read out the coordinates of where he stood, next to the tree he had just marked with the nails, and wrote them down on a piece of paper.

Over two more visits to the park, Regan finished burying all of the seven packages that he had determined to be highly sensitive, logging their coordinates each time.

He was not going to trade these secrets for money. Their value was much greater. They were part of his insurance plan.

On 23 May 2001, in the middle of the day, Regan pressed his foot hard on the accelerator as he pulled out of the parking lot at his new workplace. He had retired from the air force in August 2000, and joined the defence contracting company TRW a few months later, working in their offices in Chantilly, Virginia. TRW planned to assign him back to the National Reconnaissance Office as a contract employee to do the same kind of work he had been doing before. But for now, while he waited to regain his security clearance, the only thing keeping him busy was his paranoia.

Since November, when he had mailed his secret offer to the Libyans, his mind had been gripped by a constant fear of being found out. He found himself worrying constantly about being watched. He had recently taken to getting on the subway and then hopping off at the last minute, right before the doors closed, to see if anybody stepped out of the train to shadow him.

On this morning, just a short while after he had come into work, he drove out from TRW and sped through the streets of Chantilly, darting glances at the rear view mirror. As he approached an exit for Interstate 66, he swerved from the left lane all the way over to the right, just in time to get on the ramp for I-66 West. If a car was following him, he assumed, it would have to switch lanes as suddenly as he had, revealing itself to him. He raced on at breakneck speed for 10 miles, and got off at an exit for Manassas National Battlefield Park.

Entering the park, he drove up a one-way dirt road. When he got halfway to the end, he stopped the van and turned off the engine. He scanned his surroundings. There were no cars driving up from behind, which he took to be a reassuring sign. He sat there for 20 minutes, watching for any activity that might indicate surveillance. He saw none.

An old pick-up truck drove past; it looked nothing out of the ordinary. Regan stepped out of the van. Walking a few yards into the forested area by the road, he placed a couple of Mad magazines on the ground. Then he hopped back into the van and returned to work, stopping for lunch along the way.

Later that day, he drove back to the park to retrieve the magazines. They were exactly where he had left them. He felt certain that he was not being watched.

He was wrong.

The FBI began surveilling Brian Regan in late April 2001, following a six-month spy hunt that culminated in Carr and his fellow investigators connecting the Intelink documents in the intercepted package to Regan’s computer at the NRO. When agents discovered that Regan was a bad speller, they grew more confident that he was their man. Teams of surveillance specialists followed Regan on his commute to and from TRW’s offices in Chantilly.

If there were any doubts in Carr’s mind about Regan being the spy, they were laid to rest on 23 May 2001 when surveillance teams observed Regan driving like a lunatic from TRW to Manassas Battlefield National Park. Just because Regan had failed to notice any cars following him didn’t mean there weren’t any. When Regan was parked on the dirt road, Carr was on the phone with a surveillance specialist nicknamed Smitty who was watching Regan’s van from a distance.

“We’ve got a live one,” Smitty told Carr.

“What do you mean?” Carr asked.

Smitty described how Regan had been driving, and how he had come to a stop in the middle of nowhere.

“What are you doing?” Carr wanted to know.

Smitty said surveillance couldn’t possibly drive up the dirt road in the car they were using, as it would look suspicious.

“Do you have any pickup trucks or anything?”

“Yes, we do.” Smitty answered. The team had a pickup truck drive by Regan’s van. Smitty called Carr back.

“He’s just sitting in the van.”

None of these observations would have any value in court. Regan hadn’t broken any laws by leaving a couple of magazines in the park and collecting them later. But his unusual behaviour showed that he was watching to see if he was being watched. In Carr’s eyes, it was undeniable proof of guilt.

On 23 August 2001, a few weeks after Regan had returned to the NRO to work as a contractor, he drove into work as usual and promptly logged onto Intelink for a 20-minute session, during which he jotted down notes while browsing information such as the coordinates of Chinese missile sites. Logging off, he scribbled more notes in a small pad, unaware that FBI agents were watching him through surveillance cameras.

It was Regan’s last day at work before a week’s vacation. He had told his supervisor that he was driving to Orlando with his wife and kids. Instead, at about 4pm, Regan drove out to Washington Dulles airport to catch a flight to Zurich, where he planned to meet with Iraqi and Libyan embassy officials with an offer to spy on the United States. After going through security, he boarded a crowded airport shuttle to get to his departure gate. 

As the shuttle doors were closing, Carr and a colleague entered the carriage and started making their way through the crowd to the front. “Excuse me. Pardon me. Coming through,” Carr said as they inched forward. Finally, the two agents stood face-to-face with Regan. “Mr Regan,” Carr said, holding up his badge. “I’m with the FBI. We have a couple of questions for you. Do you mind coming with us?”

Regan stared at Carr with a dazed expression. Carr thought he looked like a teddy bear. “Sure,” Regan replied, picking up his duffel bag. The agents led him out of the coach and on to the concourse. Holding him by the elbow, they marched him into a room for questioning before putting him in handcuffs.

On searching Regan, officials found a piece of paper tucked between the inner and outer soles of his right shoe, on which were written addresses of Iraqi and Chinese embassies in Europe. The other materials they found on him and in his belongings were more mystifying. In a trouser pocket, Regan was carrying a spiral pad containing a page with 13 words that didn’t add up to anything: like tricycle, rocket and glove. He had another 26 random words scribbled on an index card. Among the contents of Regan’s wallet was a piece of paper with a string of letters and numbers that read “5-6-N-V-O-A-I …” And in a folder he was carrying in his duffel bag were four sheets with handwritten lines of three-digit numbers.

Regan, who would admit to nothing, was not about to tell the investigators what these various writings meant. But Carr knew, beyond a shadow of doubt, that they were clues to understanding the full extent of Regan’s conspiracy. Although the investigators could legitimately pat themselves on the back for having identified and nabbed the spy, they knew that their job, as of yet, was only half done. What they could not have foreseen was that Regan’s cat-and-mouse game with them would continue well after his arrest, and that it would take them another two years to unravel his plot and bring him to justice.

This is an edited extract from The Spy Who Couldn’t Spell: A Dyslexic Traitor, an Unbreakable Code, and the FBI’s Hunt for America’s Stolen Secrets, which will be published by New American Library on 1 November.