KHARTOUM EAC CONVENED TO REVIEW TELEPHONE THREAT

S E C R E T KHARTOUM 000133 SIPDIS NOFORN DEPT FOR S/ES-O, M, DS, DS/DSS/CC, DS/IP/AF, DS/ICI/PII, AF, AF/EX, AND USSES CAIRO FOR LEGAT E.O. 12958: DECL: 25X1- HUMAN TAGS: ASEC PTER AEMR SU SUBJECT: KHARTOUM EAC CONVENED TO REVIEW TELEPHONE THREAT CLASSIFIED BY: MARK L. ASQUINO, DEPUTY CHIEF OF MISSION, U.S. DEPARTMENT OF STATE, U.S. EMBASSY KHARTOUM; REASON: 1.4(C),(D),(G) ¶1. (S/NF) SUMMARY: Embassy Khartoum's Emergency Action Committee (EAC) convened on February 28 to review a telephone threat received by the Embassy on Saturday, February 27. The caller warned of an attack against the Embassy and urged personnel to evacuate. RSO and GRPO updated EAC members on the host government's investigation and the results of local and global telephone traces. The EAC members agreed that the additional police and security presence at the Embassy's six official facilities in Khartoum is commensurate with this non-specific threat, and that Post should remain open absent any further investigative developments. Shortly after the EAC meeting concluded, the IMO was able to retrieve the recording of the threat calls. These files have been passed to CIA HDQs for audio quality enhancement and analysis. The Embassy remains on high alert and will provide any additional developments via septel. END SUMMARY. -------------- -------------- BACKGROUND ON TELEPHONE THREAT -------------- -------------- ¶2. (SBU) The DCM convened Embassy Khartoum's EAC on Sunday, February 28 (a work day here),to review a telephone threat received by the Embassy the previous day. The CDA, POL, CONS, PAO, CLO, MGT, OBO SSM, RAO, DLO, IMO, USAID, MSG, DRSO, and RSO were in attendance. The RSO briefed the EAC that at 3:02 p.m. on February 27 the Embassy's Tactical Operations Center (TOC) received a call on the main embassy telephone line from an individual warning that the Embassy should evacuate the building because of a pending attack. When asked to speak slowly and to confirm the location of the attack, the caller hung up. ¶3. (SBU) Approximately four minutes later the same individual called again and urged that personnel evacuate the Embassy due to what he said would be an attack with explosives. The caller identified himself as "Khalid Ibrahim," but did not specify a time, location, or nature of the attack. The TOC supervisor said the caller sounded like a young male, but he could not detect a Sudanese or other discernable accent because the caller only spoke in English. The TOC supervisor believed the caller to be sympathetic, and said he sounded genuinely concerned about warning Embassy personnel. The guard recorded the caller's number, which was displayed on the switchboard, but was unable to detect any background noise or other distinguishing identifiers during the call. The number, 904 397 870, appears to be a Sudanese cell phone operated by the Zain/Mobitel carrier. -------------- IMMEDIATE ACTIONS TAKEN -------------- ¶4. (S/NF) All of the RSOs were present at the Embassy packing for the upcoming NEC move when the threat call was received. RSO immediately notified GRPO who passed the threat information, along with the caller's telephone number, to the Sudanese National Intelligence and Security Service (NISS) for immediate investigation. The RSO contacted the Sudanese National Police's Criminal Investigative Division (CID) and the Diplomatic Police Unit to increase security at all office facilities. Senior RSO locally-engaged staff (LES),including the Defensive Systems Commander (DSC) and the Senior Foreign Service National Investigator (S/FSNI),responded to the Embassy to follow-up with their police and security service contacts. The Sudanese National Police immediately placed their officers on heightened alert and deployed armed riot police to the Chancery. The CID Director General assigned Colonel Ahmed Ali of the Khartoum State Police's Criminal Investigative Division as the officer-in-charge of the investigation and provided his cell phone contact to the S/FSNI. ¶5. (SBU) RSO notified the DCM, OBO SSM, MSG DetCmdr, and ConGen Juba RSO. The DCM informed the CDA via an email, as the latter was out of the country and scheduled to return later that night from the AF/E COM Conference in Nairobi. The DCM also called CG Juba and the USAID Acting Mission Director in Khartoum. The after-hours emergency cascade system was activated to inform Mission personnel of the threat, and to remind all staff to increase their vigilance, to be on the lookout for suspicious activity or possible surveillance, and to keep their radio and cell phone with them at all times. The RSO Section conducted internal defense drills on the evening of February 27 to review operational plans for several different possible attack scenarios at the existing Chancery. The MSG Detachment had already pre-positioned their personal protective equipment at the NEC in anticipation of the March 24 NEC move, but returned one set of this gear to the Chancery and observed the RSO's internal defense drill to be familiar with the current operation plans. -------------- INVESTIGATIVE UPDATE -------------- ¶6. (S/NF) GRPO informed the EAC that traces were still ongoing, but preliminary results revealed two January 2, 2010 calling events made in Cairo that were possibly linked to the caller's number. GRPO stated he would be coordinating with Cairo for possible assistance from the Egyptian service. He also confirmed that NISS took this threat very seriously and had spent the night investigating it. ¶7. (SBU) After the EAC concluded, the CID requested the Embassy to allow the TOC guard supervisor to be interviewed. He went to the police station for a one hour interview and subsequently reported to RSO that he recounted the call to investigators, made a statement, and was treated very cordially. ¶8. (S/NF) IMO was also able to obtain the recording of the calls from the telephone switch threat recorder. Copies of the .wav files were passed to GRPO to send to CIA HDQs for audio enhancement and analysis. RSO requested assistance from an Embassy linguist who provided the following unofficial transcript of the calls: BEGIN TEXT -------------- First Call - 27FEB2010 1502h -- American Embassy, may I help you? -- Listen, there's a terrorist attack that's ... there s/l car full of (3- garbled words) of sl/nitro or nitrates, there's a car full of explosive materials sl/directed on U.S. Embassy. (It's an) emergency situation. -- Where (is) the emergency? -- I repeat, they're plan (a) terrorist attack. -- Yes, please, please. Could you speak slowly? -- There's s/l car full of s/l 100 million of s/l nitro and ... (call disconnected). Second Call - 27FEB2010 1506h -- Yes, American Embassy. -- I call about the terrorist attack. (It's) a terrible situation. -- Where, where? Where, which location? -- They're trying attack United States Embassy. -- The United States Embassy where? -- In Khartoum Embassy. -- In where? -- In Khartoum Embassy. -- Khartoum DC? -- Yes. -- s/l Planned job, you have to listen. -- Who...What's your name? -- Yes, I'm Khalid (says his name with a "k" sound) -- Khalid -- Yes, Khalid Ibrahim -- Ibrahim ... from where? -- Yes, I'm not from here. -- Where? -- Okay. -- Where are you, where are you...yes? -- Evacuate the Embassy right now ... I'm telling you, this (is) a terrible situation. -- Could I, could you....I will link you to one of my supervisors? -- I don't have this time, listen. -- Yes? -- s/l time is gone, okay? -- What? What can happen, what can happen? (Call ends.) END TEXT -------------- ¶9. (SBU) Post requests that DS/ICI/PII assign a case number to this threat for future reference. Any investigative update will be sent via septel. POC is RSO Chuck Lisenbee who can be reached at lisenbeenx@state.gov or mobile +249 912 308 731. WHITEHEAD