Database: National Security Vetting Failures
The Center for Immigration Studies’ Vetting Failure Database presents the first known collection of preventable federal government vetting failures that enabled entries of foreign nationals who threatened and harmed American national interests and public safety. Its purpose is to be a constant reminder to the American public and to government employees in a position to effect remedies that they are obliged to do so as soon as practicable. Additionally, the database points America’s homeland security establishment and its congressional overseers to previously unidentified fail points in the highly complex immigration security screening array so that they may more ably block future entries of foreign threat actors.
The pool of cases selected for inclusion is far from comprehensive and should not be construed as reflecting either problem-set totality or representative weight in any given area. It is by necessity, rather, a compilation selected almost solely on the basis of public information availability to reverse-engineer cases for analysis and from which to draw reasonable conclusions that security failure most likely occurred.
Only vetting opportunities on or after the year 2008 are included. The year 2008 was chosen as the starting point on the assumption that the first series of 9/11 visa vetting reforms would have fully vested by then and, in essence, remain in current use. The year 2008 also was chosen because certain significant new process improvements were implemented that year.
View About the National Security Vetting Failures Database to read more about database inclusions and exclusions in detail. For suggestions on additions to the database, please e-mail [email protected].
Year of First Vetting* | Name | National Security Crime Type | Summary | Immigration Status Type | Opportunities Missed | Time from US Entry to Discovery | Case Outcome | Read More | Link to edit Content |
---|---|---|---|---|---|---|---|---|---|
Vetting Year
|
Name Abdullah Ezzeldin Taha Mohamed Hassan |
|
Summary An 18-year-old Egyptian national who entered the United States as a juvenile in 2022 and was attending George Mason University in Virginia as a freshman when the FBI arrested him on December 17, 2024 on allegations that he plotted a mass-casualty attack on Israel’s consulate at the United Nations in New York. |
Immigration Status Type Unknown, possibly an F-1 student visa. |
Opportunities Missed 1 |
Time from US Entry to Discovery 25 Months |
Case Outcome Pending in the Eastern District of Virginia as of January 2025 |
Details
x
Vetting Year
Time from US Entry to Discovery 25 Months National Security Crime Type Terrorism-Related
Immigration Status Type Unknown, possibly an F-1 student visa. Agency Responsible for Failure State Department Opportunities Missed 1
Criminal Charges Distributing information relating to explosives, destructive devices, and weapons of mass destruction in furtherance of the commission of a federal crime of violence under 18 U.S.C. 1116 (a), 1116 (b)(4()(B), 1111 (first-degree murder of internationally protected persons) Case Outcome Pending in the Eastern District of Virginia as of January 2025
Abdullah Ezzeldin Taha Mohamed Hassan, an Egyptian national, entered the United States in July 2022 as a juvenile and lived in Falls Church, Va., outside Washington, D.C., although as of January 2025 the visa granted for him to enter had not been publicly reported. As a juvenile, he may have with parents or relatives on a temporary non-immigrant visa, such as a tourist visa or a J-2 student exchange visa, or even on an F-1 student visa, as there is no age limit for student visas. The U.S. State Department would, however, approve any of these visa types and conduct a personal interview of minors older than 14, like Hassan, who was 15 at the time. However it was that Hassan entered, perhaps even if he illegally crossed a land border and claimed asylum, he was clearly already radicalized as an Islamic extremist, a circumstance that visa adjudicators or even federal law enforcement agents at the border, could have discovered in his online social media accounts. Within weeks or months of the juvenile Hassan’s 2022 entry, his social media accounts alerted FBI agents to interview him “due, in part, to Hassan’s support for ISIS online”, an FBI agent affidavit said. Although no charges were filed in 2022, at some point soon after the FBI interviews, the U.S. government reportedly put Hassan into deportation proceedings, which were pending at the time he enrolled in George Mason University to study information technology, probably in 2023 or 2024. He was still an enrolled active student in the summer and fall of 2024 when FBI agents were again actively investigating him and saw him on the GMU campus, an agent affidavit said. Again, Hassan’s online activities on several X social media accounts had drawn FBI attention. The bureau sent in an undercover agent upon discovering that Hassan, who portrayed himself as an admirer of Osama bin Laden and ISIS branches in Afghanistan and West Africa, was openly fantasizing about killing infidels and wanted to martyr himself in a mass-casualty attack. Court documents reveal examples of Hassan’s alleged posts where he mused about killing Jews and, in one case, noted that a football player’s forehead was a “sniper’s dream”. In one X account, Hassan boastfully shared an AI analysis of his profile that stated: “Based on our AI agent’s analysis of your tweets, you are a young radical Islamist extremist who is obsessed with jihad and violence against perceived enemies. Your tweets suggest a deep-seated hatred and intolerance towards those of other faiths, particularly Jews”. “Yep I am an extremist”, Hassan later posted. After the FBI introduced an undercover agent, Hassan enthusiastically “recruited” him to conduct a mass casualty attack using either a semi-automatic rifle or a bomb, even though he communicated that he assumed the FBI was watching him because of the 2022 interview. The pair eventually settled on killing “Yahuds” (Jews) in New York because so many live in the city, and decided on the Israeli consulate. Hassan also decided on a weapon of choice. “Two options: lay havoc on them with an assault rifle or detonate [an explosive] vest in the midst of them”, court documents quoted Hassan saying to the FBI agent. While Hassan allegedly said he thought gunfire was more effective, the bomb would be cheaper. Court charging documents describe how Hassan helped the undercover agent learn how to build the bomb and set about micromanaging its construction to include a recommendation for the most damaging kind of ball bearings to pack inside and a way to carry it, in a backpack. Hassan allegedly told the FBI agent how to make a “martyrdom video” just before the attack, which he arranged with ISIS propagandists overseas to livestream the attack through “the ISIS media department”. Hassan was in his apartment arranging the livestream at his computer when FBI agents burst in to arrest him. |
|
Vetting Year
|
Name Isnardo Garcia-Amado |
|
Summary Illegally crossed the U.S. Southwest border and flagged, initially inconclusively, on the FBI terrorism watch list but was released into the U.S. interior before the hit could be resolved. Free after the mistake was discovered for two weeks until re-arrest in Florida. |
Immigration Status Type None; “Alternatives to Detention” personal recognizance release |
Opportunities Missed 2 |
Time from US Entry to Discovery Approximately 10 days |
Case Outcome Arrested but the whereabouts of Isnardo Garcia-Amado today are not publicly known. |
Details
x
Vetting Year
Time from US Entry to Discovery Approximately 10 days National Security Crime Type Terrorism-related
Immigration Status Type None; “Alternatives to Detention” personal recognizance release Agency Responsible for Failure CBP Opportunities Missed 2
Criminal Charges Unknown Case Outcome Arrested but the whereabouts of Isnardo Garcia-Amado today are not publicly known.U.S. Border Patrol agents encountered Isnardo Garcia-Amado on April 18, 2022 near Yuma, Ariz., and quickly released him with a GPS monitoring device as an alternative to detention, a policy commonly used all along the U.S. southern border to avoid detentions and to instead release millions of illegal border crossers since 2021. Garcia-Amado crossed among record-breaking 30,000 migrants crossing per month in the Border Patrol’s Yuma Sector at the time through an unfinished, cancelled section of the earlier Trump administration border wall known locally as “the Yuma gap.” A June 2023 report from the U.S. Department of Homeland Security Office of Inspector General, Border Patrol agents ran the Colombian’s name through national security databases, which initially flagged him – inconclusively – as a suspected terrorist on the FBI Terrorist Screening Database “watchlist.” But the report states that because border agents working a Central Processing Center (CPC) “were busy processing an increased flow of migrants”, agents released the suspect into the interior before the inconclusive alert could be resolved, which normally would happen quickly under established inter-agency routines. Instead, under the pressure of processing historic numbers of illegal aliens pouring through the Yuma Sector all that spring (28,681 that April, compared to 298 the same month in 2020), Border Patrol released the suspect with most of the rest on alternatives-to-detention personal recognizance, with a GPS tracking device, and an honor-system promise that he voluntarily report in to an ICE office later. Only after CPC officers released this suspect to board a commercial flight from Palm Springs, Calif., to Tampa, Fla. – where pre-check routines confirmed the watch list hit – did agencies eventually realize the alien was a positive match on the terrorist watchlist. But the discovery came too late. Not until after two more weeks of foul-ups did ICE agents track down and, on May 6, 2022, finally arrest the suspected terrorist in Tampa. In their response to the OIG findings, DHS administration officials seemed to suggest the Colombian was associated with the Revolutionary Forces of Colombia (FARC), the main body of which was “de-designated” as a foreign terrorist organization just a few months earlier, in December 2021. However, many former FARC members are still considered dangerous and remain on the watch list, while two FARC splinter groups remain designated terrorist organizations, including the Revolutionary Armed Forces of Colombia – People’s Army (FARC-EP) and a rival of FACR-EP, the Segunda Marquetalia. Both groups partake in bombings, violence against civilians, kidnappings, attacks on utilities and against military and police facilities, according to the U.S. State Department. The OIG report lays out established government processes for handling illegal border-crossers who appear on the FBI’s terrorism watchlist. Cases when aliens flag on the watchlist after routine national security database checks inside Border Patrol stations and processing centers are forwarded for general reporting purposes (or confirmation) to the FBI’s Terrorist Screening Center in Virginia, which manages the Terrorist Screening Dataset. Terrorist Screening Center analysts may request additional identifying information like fingerprints or copies of travel or identity documents through U.S. Customs and Border Protection’s National Targeting Center (NTC) or contact a Mexican intelligence group known as Grupo Conjunto de Inteligencia Fronteriza, that works closely with the American agencies on these cases. Often in the end, federal agents, including the Border Patrol’s Tactical Terrorism Response Team, get dispatched to border holding facilities for face-to-face interviews with terrorism suspects to help with confirmations and to collect intelligence information. The OIG report found communications breakdowns at the NTC, as well as with overwhelmed CBP agents on the ground in Yuma’s Central Processing Center, in large part due to the pressure from a human torrent that had been underway for months. It’s long been customary that the FBI Screening Center request that the NTC facilitate an interview with the migrant before a release. Neither the interview nor hit confirmation happened before release, at least in part because the NTC sent the request to an incorrect email distribution list for the Border Patrol’s Tactical Terrorism Response Team, but also because those in Yuma who did receive the request were too swamped to read it. The same interview request went successfully to the emails of supervisors working in the Border Patrol’s Yuma Sector, according to footnote 17. Those Yuma supervisors never responded. Why? “A Yuma CPC [Central Processing Center] agent explained that he and his colleagues try to respond to NTC emails as quickly as possible but were busy processing an increased flow of migrants,” the report stated. “As a result, the Tactical Terrorism Response Team did not receive the NTC’s request and did not interview the migrant.” Elsewhere, the report noted that central processing center agents “explained that the Yuma CPC was over capacity following an increase in apprehensions, which created pressure to quickly process migrants and decreased the time available to review each file.” The NTC also was clearly overwhelmed at the time, which would explain two other vital communications failures. At one point, the NTC asked for – and received – the critical desired information from the Mexican intelligence group it normally works with. But two NTC officials who received it never forwarded it and “told us they did not recall why they did not forward it…,” the OIG report said. And, when the now-freed terrorist suspect flagged a second time prior to boarding the flight to Tampa, the Transportation Security Administration at the Palm Springs airport notified the NTC that the match was positive. This set in motion an arrest plan, but the mass-migration-related foul-ups did not end there, even as the clock was ticking on a potential national security event. With the suspect free and roaming in Florida on April 22, 2022, the case went straight to ICE officers to arrest the suspect, who was supposed to voluntarily report in on June 1 of that year. ICE in Tampa changed it to an earlier date “because the migrant was a positive Terrorist Watchlist match, and the office was concerned that… the migrant could post a national security risk.” Two other reasons are redacted. Working with the FBI, ICE put a surveillance team on the suspect and asked for the “Alien File,” from Border Patrol, which would include helpful photographs and potential evidence that would indicate whether the suspect had any history of violence or criminality. But ICE officers couldn’t act because they didn’t get the file for eight days, even for a national security priority like this. That’s because Border Patrol’s Yuma Sector operation was unable to sort, box, and ship any more than a thousand files “once or twice a week” from that overwhelmed processing center to ICE offices across the country, the OIG report found. They were tens of thousands behind. One final snafu almost derailed the arrest. When the arresting ICE team showed up at the suspect’s residence and waited for the suspect to leave so they could make the arrest, they learned Border Patrol’s electronic monitoring (Alternatives to Detention) office didn’t open until 7 a.m. and also that system did not share GPS tracking information with ICE, which the team needed to confirm the suspect was in one of the vehicles that departed. The team made do by trailing the vehicle until an officer could call the ATD office when it opened at 7 a.m. They arrested the suspect without incident at 7:30 a.m. on May 6, 2022. The whereabouts of Isnardo Garcia-Amado today are not publicly known. |
|
Vetting Year
|
Name Nasir Ahmad Tawhedi |
|
Summary Disrupted plot to conduct an Election Day 2024 terror attack. |
Immigration Status Type Temporary Humanitarian Parole, Special Immigrant Visa |
Opportunities Missed 2 |
Time from US Entry to Discovery 2.5 years (approx.) |
Case Outcome Indicted but not convicted as of December 2024 |
Details
x
Vetting Year
Time from US Entry to Discovery 2.5 years (approx.) National Security Crime Type Terrorism
Immigration Status Type Temporary Humanitarian Parole, Special Immigrant Visa Agency Responsible for Failure DHS (humanitarian parole), U.S. State Department (Special Immigrant Visa) Opportunities Missed 2
Criminal Charges Terrorism Case Outcome Indicted but not convicted as of December 2024
Nasir Ahmad Tawhedi, who worked in Afghanistan as an outside guard for a Central Intelligence Agency facility and was authorized for air evacuation from a third country a month after the August 2021 fall of Kabul to Dallas, Texas, on a hastily approved humanitarian parole. He was among nearly 100,000 mostly Afghan evacuees, of whom about 77,000 were initially admitted into the United States via humanitarian parole through a program called Operation Allies Welcome. All became eligible for more permanent Special Immigrant Visas (SIV), mainly intended to protect Afghans who collaborated with U.S. military operations from reprisals by the Taliban group that seized control of the country. After arriving in the United States on September 9, 2021, on humanitarian parole, Tawhedi settled with his wife and infant near Oklahoma City on an SIV. He initially worked as a Lyft driver in Dallas and later as an auto mechanic in Oklahoma. Some 37 months after arriving, in October 2024, the FBI arrested the 27-year-old Tawhedi and a juvenile co-conspirator — Tawhedi’s brother-in-law — for an alleged plot to conduct an Election Day terrorist firearms attack in the United States on behalf of the Islamic State of Iraq and al-Sham (ISIS), a designated foreign terrorist organization still active in Afghanistan. The unidentified co-conspirator, an Afghan, entered the United States in 2018 also on an SIV, but little else is known about his vetting processes. Their plot involved liquidating a house and personal assets to fund the repatriation of Tawhedi’s wife and child to Afghanistan and weapons necessary for him and the juvenile to conduct a mass-casualty attack during which they would be killed, a criminal complaint alleged. The pair obtained semi-automatic rifles and ammunition for the attack, although by then FBI undercover agents had penetrated the plot by then. Shortly after the arrests, U.S. government officials claimed that Tawhedi had “thoroughly” vetted three times: first to work for the CIA in Afghanistan, then “recurrently” by DHS for the humanitarian parole status allowing him to fly into the United States, and then the Special Immigrant Visa once he was settled, probably sometime in 2022. No red flags turned up, they asserted, without providing evidence. "Afghan evacuees who sought to enter the United States were subject to multilayered screening and vetting against intelligence, law enforcement and counterterrorism information. If new information emerges after arrival, appropriate action is taken," a DHS spokesperson told Fox News Digital in October 2024. But within weeks of making those assertions, U.S. officials reversed course and acknowledged that Tawhedi did not undergo the previously claimed vetting. The State Department, in fact, never vetted or approved Tawhedi, nor had he been very thoroughly vetted for his CIA guard post job in Afghanistan, they said. DHS did not “thoroughly” vet Tawhedi for humanitarian parole on a recurring basis as initially claimed about all Afghan evacuees, either, before allowing him to fly from the unknown third country into the United States. The screening process for Afghan evacuees in the program includes probing for any possible ties to terrorism, ISIS or the Taliban using databases the U.S. compiled over 20 years in Afghanistan, using data from applicant electronic devices, biometrics and other sources. It's unclear when Tawhedi might have radicalized in ways that might have been detected. U.S. officials initially told U.S. media they believed that happened only after he was admitted into the United States. In court records, the FBI pegs Tawhedi’s initial crime – sending $540 in cryptocurrency to ISIS — occurred in March 2024. But his ties and extremist proclivities almost certainly predated the currency transfer. Had Tawhedi been thoroughly vetting when he was supposed to be, red flags were more likely than not available to be found both before and after he arrived in the U.S. For instance, adjudicators might have found pre-existing extremist ideological proclivities within Tawhedi’s immediate family because two brothers evacuated to France also were arrested in September 2024 for a terrorism plot there to attack a French soccer match or shopping center, according to numerous media accounts and information that surfaced during an October 2024 Oklahoma City federal court hearing. (The French and Americans collaborated on both cases). Furthermore, court records reveal that Tawhedi maintained relationships with well-known ISIS figures that were sufficiently trusting to have enabled direct communications with them by phone and on encrypted apps. In fact, Tawhedi trusted these operatives to care for his repatriated wife and child after he was killed in the U.S. attack and to gift substantial remaining funds from the sale of the Oklahoma house. Lastly, an FBI investigator in the October 2024 court complaint indicated that most extended family members in Tawhedi’s Oklahoma circle were aware of the plot, approved, and could still be charged as co-conspirators as of that time. The fact that many family members in the U.S. and abroad felt this way about Tawhedi’s plans further indicates that their extremism pre-dated U.S. entry and might have red-flagged during face-to-face interviews, database checks, and other standard security vetting practices. Underscoring the admitted Tawhedi vetting failure, a September 2022 DHS Office of Inspector General report found, in part, that U.S. Customs and Border Protection “admitted or paroled evacuees who were not fully vetted into the United States” and that, “As a result, DHS may have admitted or paroled individuals into the United States who pose a risk to national security and the safety of local communities.” |
|
Vetting Year
|
Name Shihab Ahmed Shihab Shihab |
|
Summary Iraqi citizen who entered the U.S. on a visitor’s visa, applied for asylum, and immediately began a conspiracy to smuggle over the U.S. southern border members of ISIS for a plot to assassinate former President George W. Bush in Dallas, Texas. |
Immigration Status Type B-1 or B-2; Asylum |
Opportunities Missed 1 |
Time from US Entry to Discovery 7 months |
Case Outcome Agreement to plead guilty as of March 2023. |
Details
x
Vetting Year
Time from US Entry to Discovery 7 months National Security Crime Type Terrorism-Related
Immigration Status Type B-1 or B-2; Asylum Agency Responsible for Failure State Department Opportunities Missed 1
Criminal Charges Attempted material support for terrorism Case Outcome Agreement to plead guilty as of March 2023.
Shihab Ahmed Shihab Shihab is a citizen and national of Iraq. He entered the United States in September 2020 on a B1/B2 tourist visitor visa and then promptly filed an asylum claim with USCIS before the visitor visa had expired. But according to a later FBI terrorism investigation and prosecution documents, the State Department approved this visitor visa despite Shihab’s long experience as an al Qaeda fighter who specialized in killing U.S. soldiers during the U.S. war there, as well as his purported past imprisonments by the American military and the Iraqi government. Within seven months of settling in the Columbus, Ohio, area on the visitor’s visa (April 2021), an undercover government informant reported that Shihab was willing to help a fictitious brother of the informant illegally enter the United States through the Southern border even though Shihab was told that European officials had denied entry to the brother on grounds of his membership in ISIS. This scheme soon led to an FBI terrorism investigation and discovery that Shihab was already well enmeshed in a global conspiracy with an overseas terrorist group fighting unit associated with the Islamic State of Iraq and Syria (ISIS) to smuggle them into the United States over the southern border for the purpose of assassinating former President George W. Bush as revenge for the 2003 Operation Iraqi Freedom, court records assert. During the investigation, Shihab disclosed to the informants that he had already arranged the smuggling of three people from Iraq into the United States over the border, including an agent of the designated terrorist group Hizballah. The alleged conspiracy to murder former President Bush involved Shihab arranging to smuggle four fighters in his old unit, “al Raed”, into Brazil and then over the Southern border, including two former Iraqi intelligence agents and one who served as the secretary of an ISIS financial minister, as well as potentially more members of ISIS and al Raed. At issue in the vetting of Shihab for his initial visitor’s visa is the fact that, in relaying the plan to the informant, Shihab disclosed that he had killed many Americans in Iraq between 2003 and 2006 while fighting with the ISIS predecessor group known as al Qaeda in Iraq (AQI). For example, Shihab told informants he’d transported vehicles and weapons from Syria into Iraq and supplied explosives inside them to AQI. But he also disclosed that American, Iraqi, Syrian, and Jordanian authorities had arrested him at various times during his war years, which if true, means that database checks or interviews with family or friends during the visitor visa process should have picked up his disqualifying history. Security vetting for Shihab’s asylum claim would be moot because, by the time of his interview with USCIS adjudicators, the FBI was deeply involved in its undercover investigation. It should be acknowledged here that court filings and other public information do not disclose whether his past claimed detentions by American, Iraqi, and Jordanian authorities actually happened. But the claims likely are rooted in truth because the investigation did show that Shihab was in fact affiliated enough with al Raed, as a trusted former member, that he was in actual contact with real current members and the group’s real new leader in Qatar. Shihab’s long association with al Raed and his combat against American troops should have registered in classified databases. Shihab and the al Raed members, working through a new al Raed leader based in Qatar, planned to create a vehicle bomb for use in the attack on Bush in Dallas, Texas, an FBI complaint stated, and also “that he wanted to be involved in the actual attack and assassination of former president Bush and did not care if he died as he would be proud to have been involved in killing former president Bush.” He budgeted about $3 million in ISIS money for the operation that would be made available by the ISIS finance officer. His role was to facilitate the cross-border smuggling, then conduct surveillance and acquire the necessary weapons and explosives, and he actually traveled to Dallas to conduct surveillance. By this time, however, the FBI informants had fully penetrated the scheme, and the FBI arrested him in May 2022. By March 2023, Shihab had agreed to plead guilty to an information charge of attempted material support for terrorism. |
|
Vetting Year
|
Name Malik Faisal Akram |
|
Summary British subject used visa-waiver system between the United Kingdom and the United States to apply electronically for fast-track, visa-less entry, then traveled to the Dallas/Fort Worth, Texas, area to conduct a kidnapping attack to demand the release of a locally imprisoned terrorist. |
Immigration Status Type Electronic System for Travel Authorization (ESTA) |
Opportunities Missed 1 |
Time from US Entry to Discovery 18 days |
Case Outcome Killed by FBI agents. |
Details
x
Vetting Year
Time from US Entry to Discovery 18 days National Security Crime Type Terrorism-Related
Immigration Status Type Electronic System for Travel Authorization (ESTA) Agency Responsible for Failure U.S. Customs and Border Protection Opportunities Missed 1
Criminal Charges None; killed in attack Case Outcome Killed by FBI agents.British national Malik Faisal Akram, entered the United States in accordance with fast-track visa waiver travel requirements between Great Britain and 40 countries and the United States, which allow tens of millions of travelers per year to visit for up to 90 days without a visa. After registering through the Electronic System for Travel Authorization system (ESTA), which requires that travelers pass a background check and “establish their eligibility”, Akram flew to New York City on December 29, 2021, and then on to Dallas, Texas, two days later. U.S. Customs and Border Protection inspectors at the John F. Kennedy International Airport in New York City let him pass through. The system, administered by CBP, did not catch prior criminal history and terrorism-related intelligence information held by the British, which is closely allied with the United States on intelligence-sharing matters. As a result, once in Texas, Akram was free to buy a handgun, stay in homeless shelters for a week plotting, and then to attack a Colleyville, Texas, synagogue during Shabbat services. At gunpoint and claiming he had explosives, Akram took the rabbi and three congregants hostage for 11 hours, threatening to kill them on behalf of a foreign terrorist organization to secure the release of convicted terrorist and MIT neuroscientist Aafia Siddiqui, known in counterterrorism circles as “Lady al Qaeda”, who had been serving an 86-year sentence at Carswell Air Force Base prison near Fort Worth. She was in prison on a 2010 conviction of assaulting and attempting to murder U.S. soldiers sent to interrogate her in 2008 in Pakistan. During the standoff, Akram ranted on a Facebook livestream about her imprisonment in Texas. Akram let some hostages go, but the rabbi attacked him with a chair, allowing FBI agents to shoot him to death. President Joe Biden dubbed the attack an act of terrorism. Akram’s brother disclosed that Akram, 44 at the time, had been known to the UK’s MI5 domestic intelligence agency in the second half of 2020 for possible involvement in Islamist terrorism. British officials had placed Akram on a watch list in 2020, but later decided he no longer posed a threat and removed him. He also had a criminal history for drugs and violent behavior dating to when he was 19 on to later convictions on theft and harassment charges. The ESTA system checks for criminal history records strictly by paper and database, using biographical information provided by travelers, who could lie on the electronic forms. But his criminal convictions and jail sentence crimes involving drugs and, once, a “violent disorder” when Akram was 19, never flagged U.S. authorities during the quick online visa waiver application process between the two nations, NBC News reported. Neither did intelligence information about his predilection for Islamist violence. He served one spell behind bars when an imam reported him for “concerning behavior” and disrupting Friday night prayer services. He was once banned from a British court in 2001 for praising the 9/11 attacks and was a frequent visitor to Pakistan, with connections to the controversial Islamic sect Tablighi Jamaat. After a 2012 conviction for theft, Akram reportedly conducted himself in an “extreme” manner when attending the jail’s mosque, and one observer noted he was “obsessed with Islam”, a Fox News report found. According to The Spectator, he was twice referred to the Counter Terrorism Prevent program, as recently as 2019, which screens people thought to be at risk of being drawn into ideological violence, the newspaper reported. “That’s one hell of a breadcrumb trail,” the media outlet concluded. “It seems incredible that with this number of concerns, Akram could simply step on a plane, presumably lie on his entry forms, and set off for the U.S. completely unimpeded. Two sets of borders were breached and the result was a terrifying ten-hour ordeal for innocent worshippers before his deranged antics were terminated with extreme prejudice.” One reason the terrorism information may not have been shared in a lasting or permeable way with American agencies is because the British removed Akram from their watch list, so he may never have been on any U.S. government watch list. Not long after the 2021 incident, the U.S. Department of Homeland Security opened a probe into how Akram defeated the visa waiver security vetting systems. The results of the probe were not publicly available as of March 2023, however. It is possible that improvements were since implemented that remain publicly unknown. |
|
Vetting Year
|
Name Jun Wei Yeo (a.k.a. Dickson Yeo) |
|
Summary Singaporean national worked under control of China's intelligence services to obtain valuable non-public information from the U.S.; used internet and social media sites to target individuals with high security clearances and paid them to write reports |
Immigration Status Type J-1 or F-1 |
Opportunities Missed 2 |
Time from US Entry to Discovery 10 months |
Case Outcome Convicted 07/2020 for acting as illegal agent of foreign power |
Details
x
Vetting Year
Time from US Entry to Discovery 10 months National Security Crime Type Espionage-related
Immigration Status Type J-1 or F-1 Agency Responsible for Failure State Department for F-1 or J-1 Opportunities Missed 2
Criminal Charges Acting within the U.S. as an illegal agent of a foreign government and a foreign official without prior notification to the attorney general Case Outcome Convicted 07/2020 for acting as illegal agent of foreign power
Singaporean national Jun Wei Yeo, who also used the name Dickson Yeo, entered the United States in January 2019 and was a George Washington University fellow until July 2019. The FBI arrested him in November 2019 on suspicion of espionage-related activity. Neither court records nor open sources specify a visa or full range of dates during which Yeo was a GWU fellow in the Washington, D.C., area. However, for a university fellowship, he would have been required to have obtained either a J-1 cultural exchange visa or an F-1 student visa, either of which would have entailed State Department national security vetting in his native Singapore before he received a visa. An eventual FBI counterintelligence investigation discovered that Yeo had been working clandestinely as a People’s Republic of China Intelligence Services (PRCIS) spy since at least 2015, several years before the university fellowship was approved. His mission was “to obtain valuable nonpublic information from the United States about matters of economic, military, and political importance, and then provide that information to his PRCIS handlers”, court records from his 2019 prosecution state. That included classified information if Yeo could obtain it. Yeo had been recruited by Chinese intelligence officers during a 2015 trip as a PhD student and accepted the mission out of anti-American fervor and greed, prosecutors alleged. “Yeo, a highly educated Ph.D. candidate, understood that his work on behalf of the PRCIS contributed to a much larger effort to diminish American power and influence relative to China,” prosecutors argued in a sentencing memorandum. After his 2019 arrest for acting as an unregistered foreign agent, “Yeo conceded that he was motivated to work for the PRCIS, in part, because he was ideologically aligned with China’s goal of diminishing U.S. influence in international affairs.” While security vetting for J and F visas in 2018 and 2019 was not geared toward discovering foreign spies trained in the art of evasion, State Department efforts in Singapore apparently missed at least one opportunity to do so. Starting in 2018, before he became a GWU fellow, Yeo used the business social media platform LinkedIn to lure American job applicants who held security clearances to his “consulting company”. But the company he listed for his social media account did not actually exist. For his fake consulting company, Yeo used the same name as a prominent U.S. consulting firm that conducts public and government relations, a ruse that potentially could have been discovered had State Department personnel checked public records and called for an employment check during the visa vetting process. Another potentially discoverable red flag was that Yeo’s PhD supervisor had been a high profile academic named Huang Jing. In 2017, two years before his student secured the George Washington University fellowship, Singapore expelled Jing from the country for being an “agent of influence of a foreign country” that was not identified in public reporting, according to the BBC. Any publicly available linkage between Jing and Yeo should have been discovered and pursued. Instead, Yeo went on to use his fellowship time to collect hundreds of resumes from U.S. military and government personnel with security clearances, and he passed some of these resumes to Chinese intelligence operatives. In addition, he used his time at GWU to network with lobbyists and defense contracting companies. He was arrested in the United States in November 2019 and later sentenced to 14 months imprisonment. He returned to Singapore in December 2020 and was arrested there. |
|
Vetting Year
|
Name Murat Kurashev |
|
Summary A Russian national from the Kabardino-Balkaria region near Chechnya illegally crossed the U.S. Southwest Border from Mexico in 2018 with his wife and young children and began plotting to provide money and weapons to the U.S.-designated al-Nusra Front terrorist group in Syria, which later renamed itself Hayat Tahrir al-Sham (HTS). FBI investigators believed him to be a direct threat inside the United States. |
Immigration Status Type Asylum |
Opportunities Missed 1 |
Time from US Entry to Discovery 1 year, 2 months |
Case Outcome 12-year prison sentence. |
Details
x
Vetting Year
Time from US Entry to Discovery 1 year, 2 months National Security Crime Type Terrorism-related, providing material support
Immigration Status Type Asylum Agency Responsible for Failure U.S. Customs and Border Protection Opportunities Missed 1
Criminal Charges Material Support for Terrorism Case Outcome 12-year prison sentence.
Murat Kurashev is a citizen and national of Russia’s Kabardino-Balkaria republic in the northern Caucasus region. According to court records from his 2021-2024 prosecution in the Eastern District of California, Kurashev entered the United States on December 19, 2018, by crossing the U.S. southern border. The crossing occurred during a high surge of family units, and he took advantage of a legal loophole that was forcing U.S. Customs and Border Protection to quickly release them on asylum claims and had drawn a crush of family groups over the border. As early as February 2020, some 14 months after arriving, Kurashev began sending money overseas through terrorist HTS couriers, and the FBI arrested him in February 2021 following a months-long investigation that began when agents discovered his social media and encrypted phone app communications with a well-known HTS fundraiser and recruiter in Syria. His crimes and prosecution could have been avoided at the border when Kurashev first crossed because the narrative on his asylum claim was that he was fleeing repeated harassments by Russian counterterrorism intelligence officers who continuously interrogated him about specific attacks and terrorist associations. Learning Kurashev’s narrative at the border would have flagged him for detention, rather than quick release, and spurred routine checks using an established partnership protocol with Russian intelligence services. The resulting information exchange would have showed Kurashev to be fully enthralled with violent extremist ideology and perhaps in communication with HTS at the time. In turn, these revelations would not only have prevented Kurashev’s later terrorism crimes but also the threat exposure he personally posed as an attack risk inside the United States. Instead, it was the FBI who later discovered his extremism-motivated criminal terrorism activities in social media and later in encrypted phone chat applications with HTS operatives overseas. The FBI asserted that it discovered Kurashev was wiring money overseas in at least February 2020, about 14 months after his border crossing arrival in the United States. Over the next year, he sent $13,000 earned in California to HTS, which used the money for battle equipment, including an AK-47 rifle and at least one combat motorcycle. HTS associates overseas sent Kurashev a photo of one motorcycle he purchased bearing his online nickname, “Abus Salim” on the gas tank and reminding the audience that “donating for the purchase of a motorcycle was tantamount to participating in the frontlines of the war in Syria”. Furthermore, the investigating FBI office assessed in court records that “had he not been arrested, he may have become an operational participant in terrorist activities. Kurashev’s behavior firmly places him on the continuum for mobilizing to violence.” In January 2024, the border-crossing terrorist pleaded guilty to material support for terrorism charges. In April 2024, a judge issued a 12-year prison sentence. |
|
Vetting Year
|
Name Kaseba Katambwa |
|
Summary Congolese national living in Connecticut entered the country despite four child rape convictions in the United Kingdom |
Immigration Status Type Asylum |
Opportunities Missed 2 |
Time from US Entry to Discovery 1year, one month |
Case Outcome Convicted 07/2019 for false statements |
Details
x
Vetting Year
Time from US Entry to Discovery 1year, one month National Security Crime Type Immigration fraud, violent criminality
Immigration Status Type Asylum Agency Responsible for Failure USCIS for Asylum Opportunities Missed 2
Criminal Charges One count of making a false statement in an immigration document Case Outcome Convicted 07/2019 for false statements
Congolese national Kaseba Katambwa, an ethnic Rwandan, illegally immigrated to the United Kingdom in 1996 on fraudulent identity documents belonging to a dead cousin. In 2009, the British criminal justice system convicted Katambwa of four times raping a 14-year-old girl and sentenced him to serve four terms of 13 years each, concurrently, for a total of 49 years. He also was convicted, in separate related cases, of drunken driving and criminal schemes to acquire property. He gained early prison release in 2017 for unknown reasons and filed an asylum claim in the UK to forestall deportation back to Congo, according to a U.S. sentencing memorandum filed as part of his defense later. It was denied, and British immigration deported him to Congo. In about March 2018, he flew under a false name and date of birth on a temporary visitor's work visa related to a "non-profit" he created and then filed a U.S. asylum claim, according to defense and government sentencing memoranda in his later U.S. immigration fraud case. After the 90-day visitor's visa expired, in June 2018, he applied for asylum in Bridgeport, Conn., under the same fraudulent identity. The investigating ICE agent's complaint notes that Katambwa provided fingerprints for this earlier visa. The USCIS visa adjudicator, however, apparently never cross-checked the print in shared databases that would have included the UK, perhaps because Katambwa was not coming directly from the UK and attested that he had been living in Congo continuously since 1969. Still, a cursory database run would have uncovered the fraud at this point. The U.S. and the UK share sex offender and criminal history databases for immigration security purposes, and by 2018, fingerprint checks in asylum claims were required. Later, during the investigation, the ICE agent did so and immediately found the match in the UK's shared sex offender database. A second missed opportunity came and went when a USCIS adjudicator in New Jersey approved Katambwa's asylum application just three months later, in September 2018, under a pressure campaign put on by a Congolese expatriate community in Connecticut. By 2018, fingerprint checks for asylum claimants were required. But it never happened. All of his claims were accepted at face value in the absence of a fingerprint check or investigation into his "non-profit". Had the prints been run against all databases, authorities with USCIS would have quickly discovered the false name and birth date, fake persecution story, that he had been living in security for decades in the UK and no Congo, and that he had been convicted of child rape and other criminality. These two USCIS security vetting failures allowed a convicted serial rapist convicted of fraud elsewhere into the United States. It was an ICE’s Homeland Security Investigation inquiry that discovered the fingerprints matched the rapist convict’s fingerprints in the UK. HSI arrested Katambwa in February 2019 on immigration fraud charges. A judge sentenced him to nine months in prison. |
|
Vetting Year
|
Name Mohammed Saeed Alshamrani |
|
Summary Saudi Air Force pilot on a diplomatic A-2 visa conducted a December 6, 2019, terror attack at the Naval Air Station in Pensacola that killed three, in concert with several other Saudi Air Force students who filmed and supported the attack |
Immigration Status Type A-2 |
Opportunities Missed 1 |
Time from US Entry to Discovery 2 years, 4 months (28 months) |
Case Outcome Killed in shooting |
Details
x
Vetting Year
Time from US Entry to Discovery 2 years, 4 months (28 months) National Security Crime Type Terrorism-related, attack resulting in death
Immigration Status Type A-2 Agency Responsible for Failure Department of Defense and State Department for A-2 Opportunities Missed 1
Criminal Charges Killed Case Outcome Killed in shooting
Mohammed Saeed Alshamrani was a 21-year-old Saudi Royal Air Force 2nd lieutenant training with other Saudi pilots at the U.S. Naval Air Station in Pensacola, Fla., on December 6, 2019, when he opened fire on American soldiers, killing three, in a jihad-inspired terror attack supported by several other of the Saudi students. Local sheriff’s deputies who responded shot Saeed dead, ending the attack. According to a Daily Mail report, the U.S. embassy in Riyadh issued Alshamrani an A-2 diplomatic visa, and he arrived in Pensacola for military training in August 2017. Alshamrani was among an estimated 5,000 foreign military trainees in the country training at the time on A-2 diplomatic visas, Saudis making up the majority of them. According to a Military.com story, Saeed and all other foreign military trainees cleared security screenings for the A-2 diplomatic visa, first by their own countries and then by a three-level screening process by U.S. embassies in the host nations. The applicants for training alongside U.S. troops would have their names run through databases maintained by the Departments of Defense, State, and Homeland Security to check for criminal activity or substance abuse. The trainees would also have to submit to a physical and psychological examination by a doctor approved by the U.S. embassy and then pass requirements for a visa from the State Department, officials told the media after the attack. But the security screenings evidently still missed publicly available and potentially discoverable evidence that in 2015 Alshamrani controlled a Twitter account on which he often posted his interest in jihadiist videos, literature, and well-known extremist Saudi clerics Abdulaziz al-Turaifi and Ibrahim al-Sakran, Kuwaiti Hakim al-Mutairi, and Jordanian Eyad Qunaibi. A Saudi government analysis obtained by the Washington Post showed that Alshamrani posted anti-American screeds calling the country "evil" and that, prior to the attack, he hosted a dinner party in which his guests were entertained with video clips of previous mass terror attacks. Several of his fellow Saudi trainees called in sick the morning of the attack. All were sent back to Saudi Arabia afterward, their visas revoked. |
|
Vetting Year
|
Name Yanqing Ye |
|
Summary Lied on J-1 visa application about connection to Chinese military while sending People's Liberation Army information on American projects. Links to PLA likely discoverable |
Immigration Status Type J-1 |
Opportunities Missed 1 |
Time from US Entry to Discovery 1 year,5 months |
Case Outcome At-large; prosecution pending. |
Details
x
Vetting Year
Time from US Entry to Discovery 1 year,5 months National Security Crime Type Espionage, immigration fraud
Immigration Status Type J-1 Agency Responsible for Failure State Department for J-1 Opportunities Missed 1
Criminal Charges Visa fraud, making false statements, acting as a foreign agent, and conspiracy Case Outcome At-large; prosecution pending.
Chinese national Yanqing Ye applied for a J-1 cultural exchange visa in August 2017 and had one a month later when she entered the United States and joined Boston University’s Department of Physics, Chemistry, and Biomedical Engineering. On the application, Ye identified herself as a “student” and indicated that she had never been a member of any military. But according to a later 2019 federal indictment stemming from an FBI counter-espionage investigation, Ye was a lieutenant of China’s People’s Liberation Army (PLA) and active with China’s top military academy, the National University of Defense Technology (NUDT), which is directed by the Chinese Community Party of which Ye also was a member. While ostensibly “studying” at Boston University from October 2017 to April 2019, Ye worked at the direction of PLA officers assessing U.S. military websites and sending U.S. documents and information back to China. The FBI later found that, at the direction of one NUDT professor, who was a PLA colonel, Ye had accessed U.S. military websites, researched U.S. military projects, and compiled information for the PLA on two U.S. scientists with expertise in robotics and computer science. Furthermore, a review of a WeChat conversation revealed that Ye and the other PLA official from NUDT were collaborating on a research paper about a risk assessment model designed to decipher data for military applications. American State Department officers responsible for her security vetting background check in August 2017, had they mounted a robust investigation, likely would have found evidence of her active-duty military service and association with key, high-ranking NUDT professors, perhaps in publicly available information on the internet about the joint research paper at NUDT, or a check of U.S. intelligence sources about Chinese military personnel, or merely during more penetrating interviews with Ye like one the FBI conducted with her. In one such FBI interview at Logan International Airport, Ye admitted she held the rank of lieutenant in the PLA and that she was a member of the CCP. Ye apparently was a fugitive as of March 2023. The FBI was unable to arrest Ye after she was indicted for acting as an unregistered agent of a foreign government, visa fraud, false statements, and conspiracy. The FBI posted a Wanted poster for Ye based on an unfulfilled January 2020 arrest warrant. |
|
Vetting Year
|
Name Muhammad Mahmood Masood |
|
Summary Plotted terror attack under cover of an H-1B visa as researcher and Pakistan-licensed doctor at the Mayo Clinic |
Immigration Status Type H-1B |
Opportunities Missed 1 |
Time from US Entry to Discovery 1 year, 11 months |
Case Outcome Convicted 08/2022 for material support for terrorism |
Details
x
Vetting Year
Time from US Entry to Discovery 1 year, 11 months National Security Crime Type Terrorism-related, false statements to federal authorities
Immigration Status Type H-1B Agency Responsible for Failure State Department for H-1B Opportunities Missed 1
Criminal Charges Material support for terrorism (ISIS) Case Outcome Convicted 08/2022 for material support for terrorism
Pakistani national Muhammad Masood, a licensed medical doctor in Pakistan, was able to obtain an H-1B skilled worker visa in February 2018 to work as a research coordinator for the Mayo Clinic in Rochester, Minn. In this case, it’s not entirely clear that State Department officers in Pakistan responsible for vetting local Pakistani applicants for U.S. visas could have discovered Masood’s mindset. But it seems more likely than not that the 28-year-old medical doctor was already radicalized and held violent extremist views, judging by the extent of his commitment to violent jihad he was observed espousing within 24 months of his arrival at the Mayo Clinic. Perhaps because he was a doctor, U.S. State Department consular officers in Pakistan did not investigate deeply. But by at least January 2020, when an FBI counterterrorism investigation started, Masood was already deeply enmeshed in a circle of foreign jihadists with whom he frequently communicated online. To them, he explained that he had regarded his visa and Mayo Clinic job as having enabled him to get “behind enemy lines“ where “not many people can’t [sic] even reach here to attack”. Between January 2020 and March 2020, the FBI found, Masood was pledging his allegiance to the Islamic State and its leader online. He expressed his desire to travel to Syria to fight for ISIS or, failing that, to conduct “lone wolf” terrorist attacks in the United States. Some of those with whom Masood communicated were FBI informants. “I want to kill and get killed...and kill and get killed … and again and again. This is what … Allah wished,” he told one. Masood followed through on his words with deeds. On Feb. 21, 2020, Masood purchased a plane ticket from Chicago, Ill., to Amman, Jordan, and from there planned to travel to Syria. On March 16, 2020, Masood’s travel plans changed because Jordan closed its borders to incoming travel due to the Coronavirus pandemic. Masood made a new plan to fly from Minneapolis to Los Angeles to meet up with an individual who he believed would assist him with travel via cargo ship to deliver him to ISIS territory. On March 19, 2020, Masood traveled from Rochester to Minneapolis-St. Paul International Airport (MSP) to board a flight bound for Los Angeles, Calif. Upon arrival at MSP, Masood checked in for his flight and was subsequently arrested by the FBI’s Joint Terrorism Task Force. Masood was charged with attempting to provide material support to a designated foreign terrorist organization. In August 2022, Masood pleaded guilty to attempting to provide material support for ISIS, a terrorist organization. State Department adjudicators in Pakistan would not likely have approved an H-1B visa for Masood had they detected, perhaps through penetrating interviews with Masood or relatives or by reviewing his social media accounts, his apparent predilection for violent jihad or associations with violent jihadists. Denial of the visa at the application stage undoubtedly would have preempted the threat Masood posed to the American public. |
|
Vetting Year
|
Name Mustafa Alowemer |
|
Summary Syrian refugee plotted to blow up Pittsburgh church |
Immigration Status Type Refugee classification |
Opportunities Missed 1 |
Time from US Entry to Discovery 3 years |
Case Outcome Convicted 09/2021 for material support for terrorism |
Details
x
Vetting Year
Time from US Entry to Discovery 3 years National Security Crime Type Terrorism-related, material support for terrorism
Immigration Status Type Refugee classification Agency Responsible for Failure USCIS for Refugee classification Opportunities Missed 1
Criminal Charges Material support to a terrorist organization, distributing information relating to an explosive, destructive device, or weapon of mass destruction Case Outcome Convicted 09/2021 for material support for terrorism
While living in Jordan, the Syria-born Mustafa Alowemer applied for and received U.S. refugee status when he was 17. In August 2016, Alowemer entered the United States and settled in Pittsburgh, Pa. But undiscovered by U.S. Citizenship and Immigration Services security vetting in Jordan was the fact that Alowemer apparently consorted with Islamist “mujahadeen”, and Jordanian authorities had detained him three times for doing so. FBI investigation much later inside the United States turned up communications that Alowemer at the time believed were private with active-duty ISIS operatives fighting in the war zone. In one of these conversations, Alowemer boasted:
Instead of a potential denial that would have left him in Jordan, Alowemer received refugee status and allegedly went on three years later to plot what he believed was going to be a bombing of the Legacy International Worship Center church in Pittsburgh. The FBI had answered his call for help and set up a sting operation. Alowemer thought he was plotting online and in person with fellow ISIS sympathizers and bought six boxes of nails for shrapnel in a bomb he was going to hide in a backpack and detonate by remote control. Investigators said he wanted to hide a second bomb, timed to go off just as Pittsburgh police and first responders arrived at the scene. In the FBI’s criminal complaint, Alowemer is quoted as saying, "After two hours, three hours when the police want to come – then when they've all come together. They'll have to lock down the whole of Pittsburgh." The complaint said that Alowemer wanted to leave an ISIS flag to claim credit and a sign saying, "We've arrived." Prosecutors charged Alowemer with providing material support to a terrorist organization and disseminating bomb-making instructions. He was proclaiming his innocence as of August 2021, when the prosecution was still in progress. |
|
Vetting Year
|
Name Maria Butina |
|
Summary Russian agent with high-level Kremlin connections entered U.S. on a student visa and conducted political influence operations by penetrating the National Rifle Association and connecting with other Washington, D.C., officials with influence in the White House |
Immigration Status Type F-1 |
Opportunities Missed 1 |
Time from US Entry to Discovery 1 year 11 months |
Case Outcome Convicted 12/2018 for failure to register as a foreign agent |
Details
x
Vetting Year
Time from US Entry to Discovery 1 year 11 months National Security Crime Type Espionage, operating as an unregistered foreign agent
Immigration Status Type F-1 Agency Responsible for Failure State Department for F-1 Opportunities Missed 1
Criminal Charges Not registering as a foreign agent Case Outcome Convicted 12/2018 for failure to register as a foreign agent
Russian national Maria Butina obtained an F-1 student visa in August 2016 to pursue graduate studies at American University in Washington, D.C. But a much later FBI counterintelligence investigation learned what State Department security screeners for the F-1 visa apparently overlooked: Since at least 2015 and possibly as early as 2013, Butina worked as special assistant to a ranking Russian politician close to the Kremlin and presumably connected to Russian intelligence. He was identified in court papers only as “the Russian Official”, but in media reports as Alexander Torshin. Torshin was a well-known and politically connected public figure who parlayed his position as a legislator in the Russian Federation to appointment as a top official of the Russian Central Bank, with presumable links to federation intelligence services. Hints were publicly available beyond Butina’s work relationship with Torshin. For instance, prior to obtaining the August 2016 student visa, Butina demonstrated her Kremlin connections in December 2015 when she arranged meetings between National Rifle Association officials and “high-level Russian officials” organized by Torshin, an identifiable hallmark of an influence operation. Screeners might also have explored Butina’s own political dedication to Vladimir Putin’s Kremlin and raised questions about it. As a college student, Butina had been politically active in the youth wing of Vladimir Putin’s United Russia Party, the BBC later reported. While studying political and educational science at the Altai State University in her Siberian home town of Barnaul, Butina was politically engaged and active in the university debating society, where her views could have been plumbed. State Department visa vetting for the F-1 likely did not uncover Butina’s work relationship with Torshin, her devotion to Putin’s Kremlin, her involvement in arranging meetings with the NRA in Russia before getting her student visa, and her early political activism. Any of this reasonably would have led to a visa-approval delay for further counterintelligence investigation or a denial. An earlier counterintelligence investigation could have short-circuited further damage from Butina’s and Torshin’s continuation of political influence operations in Washington, D.C., after she received the visa, activities that targeted conservative American political circles close to the White House. Instead, Butina’s case only came to light amid later scandals over Russian efforts to influence the 2016 election, according to the Washington Post. With the F-1 visa placing her in Washington, D.C., Butina and Torshin built social networks in Washington among conservative U.S. lawmakers and other conservative Americans with presumed influence at the White House. She more fully penetrated the National Rifle Association as part of the Torshin-directed operation. Federal prosecutors in the case alleged that Butina’s work – illegal mainly because she did not register with the U.S. Department of Justice as a foreign agent – served the Russian strategy of creating political wedges within the American population, thus undermining and weakening American democracy, shaping public opinion for that purpose, and furthering Russian interests at the expense of the United States, prosecutors later alleged. “Penetrating the U.S. national decision-making apparatus and the Intelligence Community are primary objectives for numerous foreign intelligence entities, including Russia,” a probable cause complaint stated. “The objective of the Russian Federation leadership is to expand its sphere of influence and strength, and it targets the United States and U.S. allies to further that goal.” The complaint further explained that “Russian influence operations are a threat to U.S. interests as they are low-cost, relatively low-risk, and deniable ways to shape foreign perceptions and to influence populations. Moscow seeks to create wedges that reduce trust and confidence in democratic processes, degrade democratization efforts, weaken U.S. partnerships with European allies, undermine Western sanctions, encourage anti-U.S. political views, and counter efforts to bring Ukraine and other former Soviet states into European institutions.” In July 2018, the FBI arrested Butina on charges of illegally operating as an unregistered foreign agent. After serving 15 months in prison, Butina was deported to Russia in 2019. |
|
Vetting Year
|
Name Hawazen Sameer Mothafar |
|
Summary Iraqi LPR recipient managed online propaganda and email accounts for ISIS officials for nearly five years while pursuing U.S. citizenship; allegedly incited readers to violence with ISIS propaganda and recruiting material on social media and online articles describing how to kill and maim with a knife |
Immigration Status Type Lawful Permanent Residence; Naturalized Citizenship |
Opportunities Missed 1 |
Time from US Entry to Discovery 3 years, 6 months |
Case Outcome Pending as of 12/2022 |
Details
x
Vetting Year
Time from US Entry to Discovery 3 years, 6 months National Security Crime Type Terrorism-related, material support for a terrorist organization, immigration fraud
Immigration Status Type Lawful Permanent Residence; Naturalized Citizenship Agency Responsible for Failure USCIS for Refugee classification and Lawfful Permanent Residence Opportunities Missed 1
Criminal Charges Material support to a terrorist organization, false statements, immigration fraud Case Outcome Pending as of 12/2022
Iraq-born Hawazen Sameer Mothafar immigrated to the United States, probably during a refugee resettlement spike in 2009, and settled in the Portland, Ore., suburb of Troutdale. He became a lawful permanent resident on October 28, 2010, and filed an application for naturalized citizenship in May 2016, passing his naturalization exam in February 2018, according to a later civil lawsuit against the U.S. government. Mothafar was awaiting final citizenship adjudication in November 2020 when federal prosecutors indicted and arrested him on terrorism charges related to at least five years of managing digital incitement propaganda publishing operations, extremist chat rooms, and email accounts for senior leaders of the ISIS terrorist organization. An FBI investigation, and apparently not national security vetting by USCIS on Mothafar's citizenship application, is what uncovered his support for ISIS. That support included his production of the pro-ISIS media site Al Dura'a al Sunni ("The Sunni Shield", that published 32 issues of the ISIS newspaper Al-Anfal that included articles with titles such as "Effective Stabbing Techniques" and "How Does a Detonator Work". In their indictment, federal prosecutors alleged that FBI investigators traced Mothafar’s support to as early as 2014 and “no later than February 2015”, which would indicate that USCIS adjudicators were unaware of nearly three years of his illicit activity in support of ISIS, which included setting up Facebook pages for known foreign terrorist leaders. For the subsequent years until his arrest, when Mothafar allegedly edited and produced Al Anfal, he was receiving orders directly from the ISIS central media office, known as Diwan, the indictment states. The indictment accuses him of conducting research for ISIS on how to fly a drone carrying an object for another arrested official, and regularly encouraged terror attacks. Two government charges of conspiracy to materially support terrorism remained unadjudicated as of December 2022 as the Department of Justice investigation continued overseas. Mothafar's illicit activity apparently came some years after he applied for refugee status and likely entered the United States in about 2009 and received Legal Permanent Residence in 2010. But although immigration-related security vetting for those benefits occurred prior to his ISIS activities, the vetting process for his May 2016 citizenship application apparently missed his intense, prominent social media activity for three years and about seven months after he began engaging in it, until he came to FBI attention in November 2019. Court filings indicate that the terrorism lead was generated during a November 25, 2019, interview in Iraq with captured ISIS propaganda operations leader Yasir al Anzi, a government motion to depose Al Anzi for Mothafar's trial indicates. In that Iraqi prison interview, Al Anzi disclosed details about an "American volunteer" who, in 2014, was among “strong [ISIS] supporters” in the United States, who was in a wheelchair and went by the name Abu Ubayda al-Rifai, a name used by the wheelchair-bound Mothafar. “The FBI has confirmed that Abu Ubayda al-Rifai is the defendant,” the government said in its motion to depose the Iraqi prisoner. It is reasonable to judge, given the extent to which Mothafar was radicalized by 2014 and operating inside the U.S. that at least the earlier vetting for refugee status and a Legal Permanent Residency in 2009 or 2010 would have found little. But he was well involved by the time he filed a citizenship application in 2016 and vetting cleared him enough to take his citizenship exam in 2018. Mothafar was thus able to remain free to continue operating ISIS’s digital communications and email accounts until his November 2020 FBI arrest. It was the FBI investigation that ultimately held up the Mothafar application’s adjudication. (The FBI is able to request that USCIS delay adjudications on applicants who are investigative targets, under a policy known as the Controlled Application Review and Resolution Program.) This timing indicates that security vetting for the citizenship application, which is supposed to be concluded within six months, failed by not delving into Mothafar's social media activity or deeply interviewing him or associates. Oregon’s FBI Special Agent in Charge Renn Cannon was quoted as saying that Mothafar’s alleged online propaganda aimed to incite lone actor operators in the United States and was especially dangerous. “When it comes to cases like this one,” Cannon stated, “a computer and keyboard can be powerful weapons against the enemies of the Islamic State.” For example, a month after filing for citizenship, Mothafar is alleged to have shared 70 images of explosives and western cities, telling Sunni Shield members, “The images of destroyed infidel cities will be useful,” the indictment said. He continued inciting to violence online throughout 2019 and well into 2020, and continued supporting ISIS officials overseas until the day of his arrest. These are activities that authorities undoubtedly would have prevented with an arrest had they known of them. Prosecution was pending as of January 2023. |
|
Vetting Year
|
Name Chasib Hafedh Saadoon Al Fawadi |
|
Summary Iraqi who received refugee status in Turkey in 2015 despite detectable membership, since age 16, with the violent Iran-backed Shia militia group As'ib Ahl al-Haq; hid his travel to Iran, Syria, and Jordan on behalf of the virulently anti-American uniformed paramilitary force; AAH launched more than 6,000 attacks on American and Iraqi forces during his service, including a rocket attack on the American embassy in Baghdad |
Immigration Status Type Refugee classification; Lawful Permanent Residence |
Opportunities Missed 2 |
Time from US Entry to Discovery 4 years, 9 months |
Case Outcome Convicted 09/2021 for false statements to a government agency |
Details
x
Vetting Year
Time from US Entry to Discovery 4 years, 9 months National Security Crime Type Terrorism-related, immigration fraud, false statements
Immigration Status Type Refugee classification; Lawful Permanent Residence Agency Responsible for Failure USCIS for Refugee classification and Lawful Permanent Residence Opportunities Missed 2
Criminal Charges False statements in an immigration application and to a government agency Case Outcome Convicted 09/2021 for false statements to a government agency
Iraq-born Chasib Hafedh Saadoon Al Fawadi, his wife, and two minor sons applied for U.S. refugee status in Turkey and, after six months of ostensible security vetting, secured it right after a September 2015 personal interview with a U.S. Citizenship and Immigration Services officer in Istanbul, required as a reform following the 9/11 attacks. Al Fawadi claimed he couldn’t return to Iraq because the Iran-backed extremist Shiite militia group Asa’ib Ahl al-Haq (AAH) had tried to force him to participate in kidnappings. The Al Fawadi family entered the United States in January 2016, settling initially in San Antonio, Texas, and later moving to Syracuse, N.Y., and, the requisite one year later for refugees, applied for lawful permanent resident green cards. But many months of prospective security vetting for his green card would not lead to revelations that Al Fawadi had served a virulently anti-American, Iran-backed paramilitary insurgent organization during the years when it mounted thousands of attacks on American soldiers in Iraq. A 2020 FBI and ICE counterterrorism investigation later showed the 35-year-old Al Fawadi easily lied his way through both screenings despite his offering the clue that the AAH paramilitary militia had communicated with him about conducting violent criminal activity. The reality was that, since at least the age of 16, Al Fawadi had served AAH as an armed, trained, and uniformed insurgent right up until he applied for refugee status, and that he participated in the Iranian group’s extensive sabotage, kidnapping, political assassination, hijacking, and terrorism operations, according to court records and government press releases. Iran’s Islamic Revolutionary Guard Corps Quds Force, an entity designated by the United States as a terrorist organization, extensively funded and trained AAH, which claimed responsibility for 6,000 attacks against American and coalition forces since 2006, according to a State Department release announcing that AAH had been designated a terrorist group in 2020. The FBI learned that Al Fawadi fought with and traveled far on behalf of AAH while it was attacking American troops. He fought in Syria on behalf of the government during the civil war with Sunni terrorist groups, spent time in Jordan, and traveled to Iran itself during his years with the group. During their investigation, the FBI found numerous photographs of Al Fawadi, dating to 2012 and 2013, with his AAH unit, wearing the AAH uniform, posing with a shoulder-fired rocket grenade launcher, receiving an award from the terrorist group’s leader Qais al-Khazali, manning a heavy machine gun in the bed of a pickup truck, and of him with his unit in front of the Damascus, Syria, international airport carrying a semi-automatic assault rifle over a shoulder, and in front of the Fatimah Masumeh Shrine in Qom, Iran. How Al Fawadi was able to conceal all of this photographic evidence and personal history from USCIS refugee adjudicators in Turkey and later in the United States remains unclear. But undoubtedly his name would have been known to Iraqi or American intelligence services, which might have been detected with some checks. But even if Al Fawadi’s name was not known to allied intelligence services, his bogus claim that AAH members had communicated with him about kidnapping operations almost certainly should have triggered in-depth interviews of family and associates to turn up discrepancies in Al Fawadi’s proffered persecution narrative. And indeed, according to a government motion to keep Al Fawadi detained, federal prosecutors in New York pointed out that Al Fawadi told American screeners in Turkey that he had never traveled beyond Iraq and Turkey but slipped up a few years later in 2019 and told USCIS that he had traveled to Jordan, a significant discrepancy that should have triggered intense investigation, a denial of his LPR application, and deportation. The court records do not indicate whether USCIS ever granted Al Fawadi’s lawful permanent resident green card, perhaps because of intervening domestic assault charges. But the records do make clear that security vetting by USCIS was not what uncovered his anti-American insurgency past. The FBI did not arrest him until October 2020 following a counterterrorism investigation. “Based on discussions with an official from United States Citizenship and Immigration Services … it is government counsel’s understanding that Al Fawadi’s false statements about involvement in Asa’ib Ahl al-Haq and travel to Syria and Iran are alone sufficient for Al Fawadi’s application for lawful permanent resident status to be denied and for him to be deported from the United States, all without regard to the outcome of this criminal prosecution,” federal prosecutors wrote in their motion to detain. Although its outcome remains unclear, the 2017-2019 processing of Al Fawadi’s LPR application raises further questions as to why it lingered for so long and allowed Al Fawadi to pose a threat to his wife and American citizens. Less than a year after settling in San Antonio as refugees, local police on November 20, 2016, arrested Al Fawadi for committing an aggravated assault with a deadly weapon (a knife) against his wife, who was pregnant with their third child, a government memorandum recounted. She told police this act was part of a long pattern of physical abuse but later declined to press charges. In April 2017, his wife reported to local police in Syracuse that Al Fawadi had kidnapped her for several days, beat her and held a knife to her throat again. A few months later, Al Fawadi applied for his green card, which was not denied then or possibly ever despite its pending for two years. Instead, USCIS reviewers seem to have found no reason to deny it even after an April 9, 2019, interview with Al Fawadi, providing the opportunity for him to continue living inside the United States – and to allegedly abuse his wife. Twenty days after that USCIS interview, on April 29, 2019, local police arrested Al Fawadi and charged him with the first-degree rape of his wife, after which he repeatedly violated court protection orders to not contact her. USCIS officers would interview Al Fawadi about his application six months later, showing the application was still not denied and that his paramilitary past remained undiscovered during those months of prospective vetting. Any government knowledge of his AAH service would remain buried for many more months, until, evidently, Al Fawadi’s estranged wife had him arrested for rape and probably tipped off investigators. Prosecutors believed that allowing Al Fawadi to live inside the United States posed a violent threat to all Americans, mainly because his AAH group had publicly vowed revenge operations in the United States for President Donald Trump’s January 3, 2020, drone strike assassination of Quds Force commander Qasem Soleimani in Iraq. Prosecutors wrote in their motion to detain that:
In September 2020, federal investigators arrested Al Fawadi on a three-count indictment alleging that he made false statements in the immigration applications. He was already in state custody on charges that he raped his wife, according to a government motion that Al Fawadi posed a flight risk and should be detained. In September 2021, Al Fawadi pleaded guilty to lying to USCIS on his refugee and LPR applications. Sentencing was pending as of November 2021, although the plea agreement provides for his deportation after his federal sentence and also after his New York rape case is adjudicated. |
Key & Definitions
Types of cases
Espionage-Related: Cases begun under the auspices of federal law enforcement agencies as potential espionage involving the theft of sensitive U.S. government information, political influence operations by agents of foreign governments, theft of proprietary U.S. economic property for proliferation into foreign nations, illegal exports of U.S. technologies or restricted military-use commodities, and counter-intelligence.
Human-Rights Violation Related: Cases begun under the auspices of federal law enforcement agencies responsible for investigating global atrocities and perpetrators of human rights violations and war crimes. These would include individuals suspected of conducting murder, genocide, torture and other forms of serious human rights abuses who are living within the United States.
Terrorism Related: Cases begun under the auspices of the FBI as illegal violent acts of terrorism intending to murder, maim or destroy property to affect social and policy change; material support furthering acts of terrorism by U.S.-designated banned groups or individuals such as providing financial, material, or physical assistance or any other assistance that advances the illegal causes of those groups or individuals; the collection, use or plans to use of weapons of mass destruction in the commission of terrorism acts.
Visas
A-2: Derivative benefit given to spouse or child of an A-1 visa holder, which is a nonimmigrant visa for diplomat or government official physically present in the United States on assignment for their national government. (U.S. Department of State)
Asylum: A protection against deportation granted to beneficiaries determined to have suffered persecution or fear that they will suffer persecution on the basis of their race, religion, nationality, membership in a particular social group or political opinion (USCIS).
B-1: Nonimmigrant temporary business visitor participating in business activities of a commercial or professional nature (U.S. Citizenship and Immigration Service)
B-2: Nonimmigrant spouse and children of a B-1 temporary business visitor who is participating in business activities of a commercial or professional nature. (U.S. Citizenship and Immigration Service)
EB-5: Immigrant visa leading to lawful permanent residence (green cards) for foreign national entrepreneurs who invest capital in U.S.-based businesses that will employ U.S. citizens and residents. Part of the “immigrant Investor Program.” (U.S. Citizenship and Immigration Service)
Electronic System for Travel Authorization (ESTA): An online electronic application system allowing approved citizens of 40 select nations to enter the United States and remain without a visa for up to 90 days.
F-1: Nonimmigrant students enrolled full-time in an academic educational program, language-training program, or vocational program at an accredited college, university, seminary, conservatory, academic high school, elementary school, or other academic institution or language training program, culminating in a degree, diploma or certificate. (U.S. Department of State)
F-2: Nonimmigrant dependents of F-1 student visa holders who are enrolled in an academic education program. (U.S. Department of State)
H1-B: Nonimmigrant specialty occupation worker visas requiring higher education degree or equivalency. This temporary visa requires sponsoring employers to file petitions with U.S. Citizenship and Immigration Services and potentially expires when employer sponsorship ends. The duration is three years, extendable to six years after which the visa holder may need to reapply. (U.S. Citizenship and Immigration Service)
J-1: Nonimmigrant temporary cultural or scholarly exchange visas with participating countries often involving teachers, physicians, researchers, short-term scholars, advanced-degree students, interns and government visitors. (U.S. Department of State
L-1: Nonimmigrant visas for temporary intracompany transferees who work in managerial positions or have specialized knowledge. Holders typically work in executive positions in a company located outside the United States but are opening offices inside the United States. (U.S. Citizenship and Immigration Service)
LPR (Lawful Permanent Residence): Most commonly known as “green-card” holders, noncitizen immigrants lawfully authorized to live permanently within the United States, own property, receive public benefits, work authorization, financial assistance at public colleges or join the Armed Forces. Three broad classes cover foreign nationals seeking family reunification, or relief on economic and humanitarian bases. May apply to become U.S. citizens five years after LPR grant. (U.S. Citizenship and Immigration Services)
MAVNI (Military Accessions Vital to National Interest): Immigrant program leading to citizenship for foreign nationals who enlist in the U.S. Armed Forces for up to four years and who hold useful specialized critical skills such as language, cultural backgrounds, medical and nursing training. (U.S. Department of Defense)
Naturalized Citizenship: Process by which U.S. citizenship is granted to a lawful permanent resident after meeting requirements established by Congress in the Immigration and Nationality Act. Prerequisites include at least five years as a lawful permanent resident, “good moral character,” English language proficiency, test of U.S. history and government principles, physically present in the U.S. for at least 30 months and able to take an Oath of Allegiance. (U.S. Citizenship and Immigration Service)
Refugee: Immigrant status granted to applicants located outside the United States who can demonstrate persecution due to race, religion, nationality, political opinion, or membership in a particular social group. Those approved outside the United States are granted conditional Legal Permanent Residence. (U.S. Citizenship and Immigration Service
TPS (Temporary Protective Status): Nonimmigrant form of temporary residency and protection from removal bestowed by the Secretary of Homeland Security on foreign nationals who are already inside the United States whose home countries are regarded as unsafe for their returns. Eligible people without nationality, who last resided in the unsafe country, may also be granted TPS. Countries may be designated on grounds of ongoing armed conflict, environmental disaster or “extraordinary and temporary conditions.” The protection is renewable but not legally regarded as permanent and provides for work authorization and other benefits reserved for permanent legal residents. (U.S. Citizenship and Immigration Service)