CHAPTER ONE
JENINS, SWITZERLAND

Six people—five men and a woman—approached a whitewashed house in the postcard-pretty village of Jenins in eastern Switzerland. Glancing cautiously up and down the narrow, darkened street, two members of the team walked to the door while the others hung back. They knew that no one was home. The owner was a few miles away, just across the border in Liechtenstein. One of the men pulled out a leather pouch and extracted a slender piece of metal. He slipped the metal into the lock and gently wiggled it deeper into the mechanism. As he twisted the pick, the slight torque turned against the lock’s internal pins and, one by one, they fell into place and the lock opened. Less than a minute later, the pick man and four other team members slipped silently into the apartment and drew the curtains. The sixth stayed outside, motionless in the shadows, watching the street.

Inside, the intruders moved with an economy of motion, each carrying out a preassigned task. Their instructions were precise: Search for and copy every document and computer file in the house. One of the intruders sat down at a desk in a spare bedroom being used as an office and powered up the computer. Removing two screws from the back of the computer, he exposed its hard drive. He plugged a small device about the size of a deck of cards into the computer. The device enabled the technician to download the entire contents of the computer quickly. Two other team members were busy opening drawers and rifling through the bookshelves. They photographed every document that appeared to bear any relation to the occupant’s business. While the others were doing their jobs, the team leader moved into the other bedroom, where he pulled open dresser drawers, searching beneath the socks and underwear for anything suspicious. It did not take long. He was short, barely five foot eight, so all he could do was run a hand along the top shelf of the closet. That was where he found the first laptop. Pulling it down, he took the laptop to the person sitting at the computer in the other room. “Have a crack at this,” he said.

The team leader, who was known by his nickname Mad Dog, took out his cell phone and hit speed dial. It was just after midnight on June 21, 2003. Back in Langley, Virginia, where it was early evening, the call was answered on the first ring. Mad Dog used clipped, careful language to tell the person on the other end that the operation was going according to plan. The team expected to be back on the street within a couple of hours.

The call contributed to a building sense of anticipation four thousand miles away. On the third floor of the Central Intelligence Agency’s main building on the campus at Langley, a handful of senior officers from the agency’s Counter-Proliferation Division had been waiting for word from Switzerland. One of them picked up the telephone to relay the status of the first phase up the chain of command. The call went to Stephen Kappes, the ambitious ex-marine who was the deputy director of clandestine operations. Kappes had a strong personal interest in the goings-on in the small village in eastern Switzerland that night. He was no doubt pleased with the news.

The break-in was an ultrasensitive, “compartmentalized” operation. Only a handful of agency personnel with a “need to know” were aware that a specially formed CIA team was inside the home of a private citizen in an allied nation. Certainly, the Swiss authorities knew nothing of the operation. Even the CIA station chief in Bern was in the dark so that he would have deniability if events went sour. The B&E squad had been assembled outside Switzerland. There were two pick-and-lock specialists from the agency’s secret facility in Springfield, Virginia. In a warehouse-like building there, the CIA trains a cadre of technical officers to bug offices, break into houses, and penetrate computer systems. A third team member was a nuclear weapons expert who actually worked for the national weapons laboratory in Oak Ridge, Tennessee. He had come along to provide an instant analysis of documents that would later be scrutinized far more carefully back at Langley. The team’s chief, Mad Dog, was a veteran case officer who had spent his career carrying out delicate and sometimes dangerous assignments overseas. These days, he was posted to the counterproliferation unit at Langley. The four-man crew from the States had been augmented by two agents from the CIA’s huge station in Vienna, Austria. One of them was the woman in charge of the counterproliferation section there; the other was a case officer who had been left outside the house to watch.

The team members had arrived in the country via separate flights a few days earlier. They held a final planning session to make sure everyone understood the mission and their individual responsibilities. Then there had been an initial break-in at the target’s office to copy information from files and computers there. Entering the office was relatively easy because it was in a fairly isolated industrial area, surrounded by a small parking lot, other businesses, and open fields. There had been little chance of someone stumbling across the operation. Entering an apartment in a tiny village was a riskier enterprise. A neighbor or passerby might catch a glimpse of what was going on and call the police.

Despite what you read in thrillers or see at the movies, break-ins are rare in the world of espionage. This is particularly true for the CIA when it involves an allied country like Switzerland. A few months earlier, two CIA counterterrorism officers had come from Washington to interview an Iraqi defector in Zurich. While they were conducting what they thought was a secret meeting with their asset, someone had slashed the tires of their rented car. They were certain the vandalism was a not-so-subtle warning from their Swiss counterparts: Swiss law prohibited foreign intelligence agents from operating on Swiss soil without prior approval. Frankly, no country likes having the CIA or any foreign intelligence service operating on its soil. Intelligence operations are tolerated only when they are compatible with the interests of the country and remain secret. Simply interviewing an Iraqi defector was a minor infraction, meriting nothing more than a warning. As part of their professed neutrality, the Swiss had a reputation in intelligence circles for being particularly rigorous in enforcing the legal restrictions imposed on foreign intelligence operatives.

The break-in that June night was a much riskier operation. It had the potential for embarrassment that would extend far beyond slashed tires and Swiss borders if the Swiss authorities found out about it or, far worse, if it ever became public. But Kappes and Mad Dog had decided that the potential rewards far outweighed the risks.

THE EVENTS THAT LED THE agents to take that risk can be traced back almost thirty years to the activities of a Pakistani scientist named Abdul Qadeer Khan. Khan had done more to destabilize the world’s delicate nuclear balance than anyone in history, emerging as the common thread in today’s most dangerous nuclear threats. For nearly three decades, Khan had been the mastermind of a vast clandestine enterprise designed to obtain the technology and equipment to make atomic bombs—first for Pakistan and then later for the highest bidder. After helping Pakistan achieve its goal, a task that earned him the nickname “the father of the Islamic bomb,” Khan had provided critical assistance to Iran’s nuclear efforts. In addition, he had helped North Korea develop an alternative source of nuclear material in the face of international sanctions, which had crippled its plutonium-based bomb program. And finally, he had sold more than a hundred million dollars’ worth of nuclear technology to Libya, including plans for an atomic warhead. The fact that Khan was still operating in the summer of 2003 was rooted in the failure of the Central Intelligence Agency to take decisive action to stop him at several junctures over three decades and the failure of American policymakers to insist that the threat of nuclear annihilation take priority over all other tactical and strategic objectives.

Khan had first appeared on the CIA’s radar in the fall of 1975, when he was a young metallurgist working in Amsterdam for Urenco, a consortium of European countries developing the technology to enrich uranium to fuel civilian nuclear plants. With a freshly minted doctorate from a Dutch university, Khan had started working on the project in 1972. He became such a fixture at the research center in Amsterdam and at a nearby enrichment plant that he had the run of both facilities, even though his low security clearance should have prevented him from seeing the most sensitive designs.

In October 1975, the Dutch security service had become suspicious about some of Khan’s actions and his contacts outside the Netherlands. Some of the senior officials were certain he had stolen top-secret designs for the centrifuges that Urenco was developing to enrich uranium. The designs were considered secret not only because they had commercial value, but also because the same centrifuges could be used to turn uranium gas into fissile material for a nuclear weapon. The security service went so far as to draw up detailed plans for arresting Khan, but then they were stopped by senior officials in the Dutch government. The officials worried that exposure of a spy within the Dutch arm of Urenco would alarm the other partners in the consortium, Germany and Britain, and damage the budding high-technology business that the Netherlands was trying to develop. Faced with this resistance, the Dutch security service turned for help to the CIA station chief for the Netherlands, assuming that he too would argue for Khan’s arrest. They described the situation to him and asked that he persuade Washington to weigh in with the Dutch government.

The move backfired. Instead of insisting on stopping Khan in the name of counterproliferation, the bosses at CIA headquarters recommended that the Dutch move him to a less sensitive position and monitor his activities. At the time, Pakistani prime minister Zulfikar Ali Bhutto had embarked on a nuclear weapons project to match that of rival India and the Americans wanted to see how the Pakistanis were getting along. It was better, they told their Dutch counterparts, to watch Khan to see what kind of procurement network the Pakistanis were building. Then, they argued, everything could be rolled up at once. The CIA’s attitude was also shaped by the conviction at the agency and among U.S. nuclear weapons experts that Pakistan was too backward technologically to build a nuclear weapon, and that a metallurgist like Khan had no chance of altering his country’s fortunes.

So Khan operated without interruption until December 1975, when he told his coworkers that he and his family were returning to Pakistan for their annual holiday. He promised to return with small gifts for everyone, as he had done in previous years. But when Khan left that time, he took the gifts with him. Over the past year, he had managed to copy the most advanced centrifuge designs from the most secret portions of the Urenco facilities. He also had assembled a list of Urenco suppliers in Europe who could sell Pakistan the technology required to enrich uranium for its nuclear arsenal. It was a major espionage coup that put Pakistan on the road to nuclear parity with India, and a major blunder by the CIA, though it would be years until anyone realized what had happened. In the meantime, the CIA watched and waited while Khan went to work.

Khan was fond of saying that when he returned to Pakistan in late 1975, the country was so backward that it could not build a good bicycle. How then did he hope to master the enrichment of uranium for a nuclear weapon, one of the most complex technological tasks in the world? He would do it by creating an international black market, tapping the same European suppliers who had sold their equipment to Urenco.

One of the names on the Urenco list was that of Friedrich Tinner. In the years Khan was at Urenco, Tinner had been in charge of exports for a German firm called Vakuum Apparat Technik, known as VAT. Khan started buying vacuum valves from VAT through Tinner not long after he began building his government-financed enrichment complex at Kahuta, on the outskirts of the Pakistani capital of Islamabad. Tinner was one of dozens of businessman willing to provide nuclear-related technology to Khan, who had been given a blank check by Bhutto, and was spending money freely to get his plant up and running as soon as possible. Unlike some of the others, however, Tinner worked for a company that had scruples. When U.S. intelligence identified nuclear-related shipments of technology from VAT to Pakistan, Tinner was forced to leave the company and return to his native Switzerland.

There he started his own company, CETEC, in a village called Sax, which was in the high-tech corridor known as Vacuum Valley in eastern Switzerland, only a few miles from the border with Liechtenstein. In the laissez-faire world of Swiss export regulations, Tinner was free to resume his dealings with Khan.

Tinner was a talented mechanical engineer. While at VAT, he had patented several types of valves that were used in the elaborate systems of pipes and pumps that suck the air from machinery to create the vacuum required for optimum performance. These valves had applications in all kinds of sophisticated technologies, but it was their use in uranium enrichment that had made Tinner attractive to Khan. Centrifuges are slender metal cylinders that spin at nearly twice the speed of sound to produce the enriched uranium required to fuel nuclear plants that generate electricity. With slight adjustments, the same machines can produce a higher level of enriched uranium that can be used in nuclear weapons.

Khan’s acquisitions eventually expanded to suppliers in Asia, Canada, and the United States. The growing procurement web did not escape the notice of the CIA and other American agencies. Tinner was among many suppliers who were identified as part of the black market that became known as “the Pakistani pipeline.” The U.S. government sent legal notifications, called demarches, to the Swiss and other countries, asking them to impose restrictions on people like the Tinners. The responses from Europe were uniformly negative; the Germans and the Swiss, in particular, believed the Americans were simply trying to restrain their development of high-tech businesses. Other countries said their export laws did not cover the types of equipment going to Pakistan.

Khan did not stop with producing fissile material for Pakistan’s nuclear arsenal. Beginning in 1987, he reversed the flow of equipment and expertise to create the beginnings of a private global proliferation ring the likes of which the world had never seen. The first customer was Iran. For help, he had turned to some of his original suppliers. The deal with Iran required Khan and his accomplices to provide the centrifuge designs and other equipment required to build a secret enrichment plant. As part of the arrangement, Khan or someone within his network also provided the Iranians with some rudimentary designs for parts of a nuclear weapon.

Word that Khan was engaged in nuclear deals with the Iranians reached the Central Intelligence Agency by 1988. Certainly there was time to intercede by pressuring the Pakistani government to put a stop to the proliferation activities of its senior nuclear scientist. But the CIA and U.S. nuclear weapons experts once again underestimated Khan. Just as the Americans had decided in 1975 to watch as Khan helped Pakistan develop nuclear weapons, this time they decided that his sales to Iran did not pose a real threat. The assessment by the CIA was that Iran was unlikely to develop a nuclear capacity. This would turn out to be a major miscalculation, which would mire the United States and its allies in a dangerous diplomatic game two decades later as they attempted to stop Iran from taking the last steps into the circle of nuclear weapons powers.

The blunders were not all committed by the CIA. In the mid-1970s, the United States had taken some steps to curtail Pakistan’s clandestine nuclear efforts. Pressure had been brought to bear on governments whose companies were selling goods to the program, and in April 1979, President Jimmy Carter slapped sanctions on Pakistan. But eight months later, after the Soviet invasion of Afghanistan on Christmas Day, Carter lifted the sanctions in order to secure the cooperation of Pakistan and its intelligence service in supplying American-purchased weapons to the guerrillas in Afghanistan who were fighting the Soviets. It became American policy to ignore the nuclear aspirations of its temporary ally.

A decade later, when the first reports arrived that Khan was helping Iran, the tide was turning against the Soviets in Afghanistan. President Ronald Reagan and his successor, George H. W. Bush, remained unwilling to do anything that might upset the relationship with Pakistan at a critical moment in history.

Unimpeded by the Americans, and encouraged by his own government, Khan continued to expand his black market. In 1990, he offered to sell his nuclear expertise to Iraqi president Saddam Hussein. Saddam was operating his own clandestine nuclear weapons program at the time, and had actually moved fairly close to developing a weapon. But when Khan’s offer arrived in October that year, the Iraqi leader had other things on his mind. Troops from the United States and other countries were massing in Saudi Arabia, preparing to try to oust the Iraqis from Kuwait. Fearing that the offer was an American sting, Saddam did not take Khan up on the proposal. But before long at least two other countries would. By the end of the 1990s, Khan had provided North Korea with enrichment technology and he was in the early stages of building a complete atomic bomb factory for the Libyan strongman Moammar Kaddafi.

Friedrich Tinner had continued to work with Khan, and by the time the Libyan project rolled around in 1997, he had been joined in the family business by his two sons, Urs and Marco. The Tinners were established citizens in the small village of Haag. Friedrich was the head of the local school board and an avid ham radio operator, and collected orchids. But there had always been a dark side to the business, and the father and two sons signed up to help Khan fulfill Kaddafi’s nuclear ambitions.

OVER THE YEARS, THERE HAD been many internal debates within American intelligence and among other government agencies over the right time to shut down Khan’s nuclear bazaar. The CIA and its backers always argued that they needed more information, more evidence, more time. The rationale was that they wanted to know everything about the ring so they could wipe it all out at once. They also needed a foolproof case against Khan, who was a national hero in Pakistan for his role in building the Islamic bomb. By the spring of 2003, however, American and British intelligence had penetrated Khan’s network enough so that almost everyone believed it was time to act. They had tracked shipments to Libya. They had secretly dispatched sabotaged nuclear equipment to Libya and to Iran, where a massive underground enrichment plant was nearing completion. And they had developed a family of moles deep inside the network, people who were providing them with real-time information about the status of nuclear weapons work in countries that worried the United States the most—Iran, Libya, and North Korea. The waiting was about to come to an end. But first the CIA had to make sure that it understood everything it could about the reach of the Khan network.

One of the keys to understanding the Khan network was Urs Tinner. In late 1999, Tinner had moved to Dubai and gone to work overseeing Khan’s efforts to build centrifuges there for shipment to Libya. The CIA case officer who used the nickname Mad Dog had followed on Tinner’s heels, and eventually he had used sweet talk, money, and veiled threats to turn the young Swiss technician into a spy in the heart of the Khan operation.

Newly obtained records, including detailed travel records and material from the files of the Tinners themselves, show that by the end of 2002, spying for the Americans was a Tinner family affair. Some details and dates remain unclear about how the Tinners came to spy for the CIA. But the new information, and interviews with people who were involved in tracking the network, provide the fullest and most accurate account to date of how the CIA recruited Urs, Marco, and Friedrich Tinner, and the role played by some of Khan’s most trusted accomplices in bringing down his network.

The world of espionage is never clear-cut. The players on both sides are often trained liars, steeped in deceit and misdirection. So, at the same time the Tinners were betraying Khan, the CIA was worried that it was being deceived by its spies.

In the summer of 2003, the agency was preparing to shut down Khan’s operation. But at CIA headquarters in Virginia, there were concerns about whether the Tinners had been withholding critical information. If the agency shut down the network without knowing as much as possible, there was a real danger that elements would remain in place and open for business. In an attempt to learn as much as possible about the network, and determine how truthful the Tinners were being, Mad Dog had invited all three of the Tinners to a hotel across the border in Vaduz, the picturesque capital of the tiny principality of Liechtenstein, for a final debriefing before the curtain was brought down on Khan’s long-running atomic bazaar.

Mad Dog, who was using a cover name of Jim Kinsman, was in Vaduz to supervise the sessions. He was joined by several other CIA officers and a nuclear weapons expert from the national weapons laboratory at Oak Ridge, Tennessee. From June 16 until June 25, the Americans met daily with the Tinners. During the days, the CIA and its experts interrogated the Tinners relentlessly about every aspect of the network and its global operations. At night they adjourned for drinks and dinner, which was all part of the CIA’s strategy for creating the sense that they were all playing on the same side.

The Tinners were asked in painstaking detail about shipments made to Iran, Libya, Dubai, and elsewhere. The Tinners admitted providing components and designs to Libya, explaining where the components were manufactured and how they were shipped using false invoices and other deceptions. They provided the names, dates, and places that gave the CIA a view of the overall architecture of the Khan network. But they flatly denied helping Khan on his deals with Iran and North Korea.

When there were doubts about the information the Tinners were providing, the interrogators returned to the beginning, starting a line of questioning all over again. Over the course of nine days, the Tinners listed witting and unwitting suppliers in a dozen countries around the world who had provided sensitive equipment for the network. They identified collaborators in Africa, the Middle East, Europe, and Asia. Over and over, the Americans stressed that they had to understand everything possible about the network before they shut it down. It was vital that they close off every avenue for future proliferation.

The Tinners’ help did not come cheap. Over the previous months, Kinsman had paid them a total of about a hundred thousand dollars. But in Vaduz, the final price tag went up dramatically. Kinsman and a second CIA operative, who called himself Sean Mahaffey, signed a contract agreeing to pay the Tinners a million dollars for their help. The contract was on letterhead from a CIA front company called Big Black River Technologies. Its address was nothing more than a mail drop in Washington, D.C. At the end of the debriefings, the money would be wired to a bank account for Marco’s company, Traco Holdings, in the British Virgin Islands. But despite the payment and the extensive debriefing, the CIA still did not trust the Tinners.

In any intelligence operation, the people running it must recognize that there are elements that they do not know. The key to a successful outcome is minimizing the risks associated with those unknowns. In the case of Khan’s nuclear ring, the CIA officials knew they would have only one shot at closing down the network. If they missed a major customer or a huge shipment of deadly technology—if some major unknown existed—a significant intelligence victory could turn into a career-ending embarrassment and yet another in a series of failed missions that had dogged the CIA over the years. Far worse, the failure to identify and stop another country or even a terrorist organization with access to the means to build an atomic weapon would be a colossal risk to international security. It also would contribute to the potential resurgence of the nuclear proliferation ring the CIA hoped to eliminate.

There had been clues in recent weeks that the Tinners had not been telling their handlers everything. As the clock wound down, it was imperative that the agency find a way to verify what they were hearing—and determine what, if anything, these particular spies were leaving out. “They needed confirmation that Urs and the others were not double dealing,” said a senior intelligence official who was involved in aspects of the Tinner case. “So I think they needed to go in and check what was on Marco’s computers to see if it coincided.”

Marco Tinner kept most of the family secrets on personal computers stored at his apartment in Jenins, a sleepy little Swiss village of a few hundred people about ten miles away from Vaduz. Kinsman had decided against asking for access to the computers. He feared that crucial information would be erased or transferred elsewhere. So with the Tinners tucked away in a Vaduz hotel in the midst of the debriefings, he informed them that a team of CIA specialists was going to enter Marco’s apartment and his office. They would make copies of everything on the computers there. He explained that this was part of the deal for the million dollars. He made it clear that the Tinners could not object. “I would say the Americans forced them to let them see their computers,” said a Swiss official involved in the later inquiry. “It was part of the agreement for the payment. Because no one trusted the other side.”

Kinsman tried to portray the break-in as protection for the Tinners. From the start, he had told the Tinners that he and his associates could not meet with them on Swiss soil. Doing so would mean that the Tinners and the CIA were violating Swiss espionage law, which prohibited Swiss citizens from working for foreign intelligence agencies and forbade foreign intelligence agents from operating on Swiss soil without written consent. That was why the debriefing was conducted across the border in Liechtenstein and why earlier meetings had always taken place outside Switzerland. And that was why Kinsman said the CIA would copy the records and the computers in the guise of a break-in. The story was created in the event the Swiss authorities learned later that the Tinners had cooperated with the CIA. If they could claim that the CIA had broken into their homes and offices, the Tinners would have a better chance of avoiding prosecution for violating Swiss espionage law. It was a flimsy justification for an unusual action. But the Tinners had to agree to allow the CIA to search their records if they wanted to collect their million dollars.

On June 20, the CIA intrusion team led by Kinsman had broken into Marco’s office. They knew that most of what they wanted was kept at Marco’s home. The next night, the team broke into the Jenins apartment and spent more than two hours downloading thousands of files from those computers and copying all of his business and personal correspondence and other records. Randomly examining some of the files before leaving, the CIA officer and the nuclear expert from Oak Ridge saw what appeared to be at least partial designs related to a sophisticated nuclear warhead. No one would know for sure until the contents of the computers were examined thoroughly back at Langley. But the discovery caused grave concern on several levels. The Tinners had never mentioned the existence of weapons designs. What else were they hiding? Even more frightening, the designs were completely transferrable because they were digital. Pushing the “send” button could send an e-mail, with the designs attached, anywhere in the world.

Even before the designs were evaluated fully back at Langley, the existence of these highly dangerous digital weapons plans on a computer belonging to someone with a long history of trafficking in nuclear goods should have rung the loudest possible alarm bells. There is no question that these were among the most sensitive nuclear designs imaginable. They were the road map to a bomb. Every computer in that apartment, and every computer, flash drive, and piece of paper from wherever the Tinners lived and worked, should have been confiscated immediately. It was the only way to eliminate the chance that the Swiss spies would send the material into the netherworld of the Internet. And that assumed they had not done so already. The discovery made it clear to Kinsman and his colleagues that the Tinners could not be trusted. Who knew what they might do? There was no justification for leaving those computers, with those designs, in place. But orders were orders. The break-in team had been instructed to make copies and leave the computers and original records behind. When Kinsman and the others locked the apartment door behind them on the way out, the most dangerous nuclear documents ever to have found their way into such an unsecure location were left in the hands of known traffickers who had been lying to the CIA even as they were paid huge sums.

© 2011 Catherine Collins