Database: National Security Vetting Failures

Dilbar Gul Dilbar, a 33-year-old Afghan national, was arrested in Monroe County, N.Y., in April 2025 and charged with violating 18 U.S.C. § 1546(a), concerning visa fraud and misuse of immigration documents. He currently resides in the Western District of New York with his wife and five children. Dilbar entered the United States on April 4, 2024, after fraudulently securing a Special Immigrant Visa (SIV), and was issued a 10-year green card just three months later on July 22, 2024. He had applied for the SIV on the basis of his alleged service as a U.S.-affiliated interpreter during the War in Afghanistan. However, the evidence reveals a long trail of fraudulent conduct and security red flags, which U.S. authorities failed to catch.

Before his arrival in the U.S., Dilbar used at least two identities: “Dilbar Gul Taj Ali Khan”, listed on earlier Afghan identification documents, and “Dilbar Gul Dilbar”, which began appearing around 2020 on his second Afghan passport and his Afghan national ID card. The latter name was used in his SIV application and later to obtain a New York State driver’s license. His immigration filings portrayed him as a pharmacist and translator who had loyally served U.S. operations in Afghanistan. In reality, Dilbar had been terminated from a translator position in 2009 and was arrested in 2011 for impersonating a criminal investigator with the Afghan National Police. That same year, the U.S. Department of Defense’s Terrorist Explosive Device Analytical Center (TEDAC) linked his fingerprints to a handwritten note recovered at a crime scene, believed to potentially contain coordinates related to a terrorist plot.

Despite these red flags, Dilbar pursued U.S. entry multiple times. In 2016, he submitted an SIV application to the U.S. Department of State that included a counterfeit Chief of Mission (COM) approval letter, a forged employment letter, and a fraudulent letter of recommendation. All three documents were falsely certified under penalty of perjury. The State Department denied his application on August 10, 2017. However, just three months later, on November 13, 2017, Dilbar filed a USCIS Form I-360 in furtherance of that same application. Again, he signed under penalty of perjury and submitted the previously rejected and fraudulent documents. Although USCIS ultimately denied this 2017 application in January 2018, the fact that he had submitted fraudulent documentation should have been logged and flagged for future immigration scrutiny. This 2017 episode marks the first missed opportunity to permanently bar him from entry and refer him for prosecution.

Undeterred, Dilbar attempted again. In 2021, he submitted a second SIV application — once more attaching a counterfeit COM letter and fraudulent supporting documents. His employment verification came from a known fraudulent document mill that sold fake letters for a fee. His letter of recommendation, dated January 5, 2021, came from a “Ray James”, who claimed to be a U.S. Army Corps of Engineers contractor. In fact, James was later confirmed to be involved in an advance-fee scam that sold fake recommendation letters to Afghan nationals seeking immigration benefits. Nonetheless, Dilbar’s application was approved on March 20, 2024. He entered the United States two weeks later, and on the same day filed for Lawful Permanent Resident status, which USCIS approved in July 2024. These events, from 2021 to 2024, constitute the second major missed opportunity — culminating in a national security risk being admitted to and embedded within the United States.

Dilbar's conduct in the U.S. immediately raised additional concerns. One of his first actions was to apply for a New York State license to become a security guard. In December 2024, a federal warrant executed on his Google Mail account revealed communication with Ray James about fraudulent documents. Digital evidence also showed Dilbar had access to large sums of cash in 2025 via another Afghan national in Rochester, who transferred him money in March of that year.

On April 29, 2025, Dilbar was arrested by federal authorities. He was charged under 18 U.S.C. § 1546(a) and appeared in court on May 1. As of August 2025, Dilbar’s case is pending. Although his charge currently carries a guideline sentence of 0–6 months, that could dramatically increase if the ongoing investigation confirms that his fraud facilitated terrorism or concealed affiliation with the Haqqani Network — a U.S.-designated Foreign Terrorist Organization.

Abdullah Ezzeldin Taha Mohamed Hassan, an Egyptian national, entered the United States in July 2022 as a juvenile and lived in Falls Church, Va., outside Washington, D.C., although as of January 2025 the visa granted for him to enter had not been publicly reported. As a juvenile, he may have with parents or relatives on a temporary non-immigrant visa, such as a tourist visa or a J-2 student exchange visa, or even on an F-1 student visa, as there is no age limit for student visas. The U.S. State Department would, however, approve any of these visa types and conduct a personal interview of minors older than 14, like Hassan, who was 15 at the time. However it was that Hassan entered, perhaps even if he illegally crossed a land border and claimed asylum, he was clearly already radicalized as an Islamic extremist, a circumstance that visa adjudicators or even federal law enforcement agents at the border, could have discovered in his online social media accounts. Within weeks or months of the juvenile Hassan’s 2022 entry, his social media accounts alerted FBI agents to interview him “due, in part, to Hassan’s support for ISIS online”, an FBI agent affidavit said. Although no charges were filed in 2022, at some point soon after the FBI interviews, the U.S. government reportedly put Hassan into deportation proceedings, which were pending at the time he enrolled in George Mason University to study information technology, probably in 2023 or 2024. He was still an enrolled active student in the summer and fall of 2024 when FBI agents were again actively investigating him and saw him on the GMU campus, an agent affidavit said.

Again, Hassan’s online activities on several X social media accounts had drawn FBI attention. The bureau sent in an undercover agent upon discovering that Hassan, who portrayed himself as an admirer of Osama bin Laden and ISIS branches in Afghanistan and West Africa, was openly fantasizing about killing infidels and wanted to martyr himself in a mass-casualty attack.

Court documents reveal examples of Hassan’s alleged posts where he mused about killing Jews and, in one case, noted that a football player’s forehead was a “sniper’s dream”.

In one X account, Hassan boastfully shared an AI analysis of his profile that stated: “Based on our AI agent’s analysis of your tweets, you are a young radical Islamist extremist who is obsessed with jihad and violence against perceived enemies. Your tweets suggest a deep-seated hatred and intolerance towards those of other faiths, particularly Jews”.

“Yep I am an extremist”, Hassan later posted.

After the FBI introduced an undercover agent, Hassan enthusiastically “recruited” him to conduct a mass casualty attack using either a semi-automatic rifle or a bomb, even though he communicated that he assumed the FBI was watching him because of the 2022 interview.

The pair eventually settled on killing “Yahuds” (Jews) in New York because so many live in the city, and decided on the Israeli consulate. Hassan also decided on a weapon of choice.

“Two options: lay havoc on them with an assault rifle or detonate [an explosive] vest in the midst of them”, court documents quoted Hassan saying to the FBI agent. While Hassan allegedly said he thought gunfire was more effective, the bomb would be cheaper.

Court charging documents describe how Hassan helped the undercover agent learn how to build the bomb and set about micromanaging its construction to include a recommendation for the most damaging kind of ball bearings to pack inside and a way to carry it, in a backpack.

Hassan allegedly told the FBI agent how to make a “martyrdom video” just before the attack, which he arranged with ISIS propagandists overseas to livestream the attack through “the ISIS media department”.

Hassan was in his apartment arranging the livestream at his computer when FBI agents burst in to arrest him.

U.S. Border Patrol agents encountered Isnardo Garcia-Amado on April 18, 2022 near Yuma, Ariz., and quickly released him with a GPS monitoring device as an alternative to detention, a policy commonly used all along the U.S. southern border to avoid detentions and to instead release millions of illegal border crossers since 2021. Garcia-Amado crossed among record-breaking 30,000 migrants crossing per month in the Border Patrol’s Yuma Sector at the time through an unfinished, cancelled section of the earlier Trump administration border wall known locally as “the Yuma gap.”

A June 2023 report from the U.S. Department of Homeland Security Office of Inspector General, Border Patrol agents ran the Colombian’s name through national security databases, which initially flagged him – inconclusively – as a suspected terrorist on the FBI Terrorist Screening Database “watchlist.”

But the report states that because border agents working a Central Processing Center (CPC) “were busy processing an increased flow of migrants”, agents released the suspect into the interior before the inconclusive alert could be resolved, which normally would happen quickly under established inter-agency routines.

Instead, under the pressure of processing historic numbers of illegal aliens pouring through the Yuma Sector all that spring (28,681 that April, compared to 298 the same month in 2020), Border Patrol released the suspect with most of the rest on alternatives-to-detention personal recognizance, with a GPS tracking device, and an honor-system promise that he voluntarily report in to an ICE office later.

Only after CPC officers released this suspect to board a commercial flight from Palm Springs, Calif., to Tampa, Fla. – where pre-check routines confirmed the watch list hit – did agencies eventually realize the alien was a positive match on the terrorist watchlist. But the discovery came too late.

Not until after two more weeks of foul-ups did ICE agents track down and, on May 6, 2022, finally arrest the suspected terrorist in Tampa.

In their response to the OIG findings, DHS administration officials seemed to suggest the Colombian was associated with the Revolutionary Forces of Colombia (FARC), the main body of which was “de-designated” as a foreign terrorist organization just a few months earlier, in December 2021. However, many former FARC members are still considered dangerous and remain on the watch list, while two FARC splinter groups remain designated terrorist organizations, including the Revolutionary Armed Forces of Colombia – People’s Army (FARC-EP) and a rival of FACR-EP, the Segunda Marquetalia. Both groups partake in bombings, violence against civilians, kidnappings, attacks on utilities and against military and police facilities, according to the U.S. State Department.

The OIG report lays out established government processes for handling illegal border-crossers who appear on the FBI’s terrorism watchlist.

Cases when aliens flag on the watchlist after routine national security database checks inside Border Patrol stations and processing centers are forwarded for general reporting purposes (or confirmation) to the FBI’s Terrorist Screening Center in Virginia, which manages the Terrorist Screening Dataset.

Terrorist Screening Center analysts may request additional identifying information like fingerprints or copies of travel or identity documents through U.S. Customs and Border Protection’s National Targeting Center (NTC) or contact a Mexican intelligence group known as Grupo Conjunto de Inteligencia Fronteriza, that works closely with the American agencies on these cases.

Often in the end, federal agents, including the Border Patrol’s Tactical Terrorism Response Team, get dispatched to border holding facilities for face-to-face interviews with terrorism suspects to help with confirmations and to collect intelligence information.

The OIG report found communications breakdowns at the NTC, as well as with overwhelmed CBP agents on the ground in Yuma’s Central Processing Center, in large part due to the pressure from a human torrent that had been underway for months.

It’s long been customary that the FBI Screening Center request that the NTC facilitate an interview with the migrant before a release.

Neither the interview nor hit confirmation happened before release, at least in part because the NTC sent the request to an incorrect email distribution list for the Border Patrol’s Tactical Terrorism Response Team, but also because those in Yuma who did receive the request were too swamped to read it.

The same interview request went successfully to the emails of supervisors working in the Border Patrol’s Yuma Sector, according to footnote 17. Those Yuma supervisors never responded.

Why?

“A Yuma CPC [Central Processing Center] agent explained that he and his colleagues try to respond to NTC emails as quickly as possible but were busy processing an increased flow of migrants,” the report stated. “As a result, the Tactical Terrorism Response Team did not receive the NTC’s request and did not interview the migrant.”

Elsewhere, the report noted that central processing center agents “explained that the Yuma CPC was over capacity following an increase in apprehensions, which created pressure to quickly process migrants and decreased the time available to review each file.”

The NTC also was clearly overwhelmed at the time, which would explain two other vital communications failures. At one point, the NTC asked for – and received – the critical desired information from the Mexican intelligence group it normally works with.

But two NTC officials who received it never forwarded it and “told us they did not recall why they did not forward it…,” the OIG report said.

And, when the now-freed terrorist suspect flagged a second time prior to boarding the flight to Tampa, the Transportation Security Administration at the Palm Springs airport notified the NTC that the match was positive.

This set in motion an arrest plan, but the mass-migration-related foul-ups did not end there, even as the clock was ticking on a potential national security event.

With the suspect free and roaming in Florida on April 22, 2022, the case went straight to ICE officers to arrest the suspect, who was supposed to voluntarily report in on June 1 of that year. ICE in Tampa changed it to an earlier date “because the migrant was a positive Terrorist Watchlist match, and the office was concerned that… the migrant could post a national security risk.”

Two other reasons are redacted.

Working with the FBI, ICE put a surveillance team on the suspect and asked for the “Alien File,” from Border Patrol, which would include helpful photographs and potential evidence that would indicate whether the suspect had any history of violence or criminality.

But ICE officers couldn’t act because they didn’t get the file for eight days, even for a national security priority like this. That’s because Border Patrol’s Yuma Sector operation was unable to sort, box, and ship any more than a thousand files “once or twice a week” from that overwhelmed processing center to ICE offices across the country, the OIG report found.

They were tens of thousands behind.

One final snafu almost derailed the arrest. When the arresting ICE team showed up at the suspect’s residence and waited for the suspect to leave so they could make the arrest, they learned Border Patrol’s electronic monitoring (Alternatives to Detention) office didn’t open until 7 a.m. and also that system did not share GPS tracking information with ICE, which the team needed to confirm the suspect was in one of the vehicles that departed. The team made do by trailing the vehicle until an officer could call the ATD office when it opened at 7 a.m.

They arrested the suspect without incident at 7:30 a.m. on May 6, 2022.

The whereabouts of Isnardo Garcia-Amado today are not publicly known.

Nasir Ahmad Tawhedi, who worked in Afghanistan as an outside guard for a Central Intelligence Agency facility and was authorized for air evacuation from a third country a month after the August 2021 fall of Kabul to Dallas, Texas, on a hastily approved humanitarian parole.

He was among nearly 100,000 mostly Afghan evacuees, of whom about 77,000 were initially admitted into the United States via humanitarian parole through a program called Operation Allies Welcome. All became eligible for more permanent Special Immigrant Visas (SIV), mainly intended to protect Afghans who collaborated with U.S. military operations from reprisals by the Taliban group that seized control of the country.

After arriving in the United States on September 9, 2021, on humanitarian parole, Tawhedi settled with his wife and infant near Oklahoma City on an SIV. He initially worked as a Lyft driver in Dallas and later as an auto mechanic in Oklahoma.

Some 37 months after arriving, in October 2024, the FBI arrested the 27-year-old Tawhedi and a juvenile co-conspirator — Tawhedi’s brother-in-law — for an alleged plot to conduct an Election Day terrorist firearms attack in the United States on behalf of the Islamic State of Iraq and al-Sham (ISIS), a designated foreign terrorist organization still active in Afghanistan. The unidentified co-conspirator, an Afghan, entered the United States in 2018 also on an SIV, but little else is known about his vetting processes.

Their plot involved liquidating a house and personal assets to fund the repatriation of Tawhedi’s wife and child to Afghanistan and weapons necessary for him and the juvenile to conduct a mass-casualty attack during which they would be killed, a criminal complaint alleged. The pair obtained semi-automatic rifles and ammunition for the attack, although by then FBI undercover agents had penetrated the plot by then.

Shortly after the arrests, U.S. government officials claimed that Tawhedi had “thoroughly” vetted three times: first to work for the CIA in Afghanistan, then “recurrently” by DHS for the humanitarian parole status allowing him to fly into the United States, and then the Special Immigrant Visa once he was settled, probably sometime in 2022.

No red flags turned up, they asserted, without providing evidence.

"Afghan evacuees who sought to enter the United States were subject to multilayered screening and vetting against intelligence, law enforcement and counterterrorism information. If new information emerges after arrival, appropriate action is taken," a DHS spokesperson told Fox News Digital in October 2024.

But within weeks of making those assertions, U.S. officials reversed course and acknowledged that Tawhedi did not undergo the previously claimed vetting. The State Department, in fact, never vetted or approved Tawhedi, nor had he been very thoroughly vetted for his CIA guard post job in Afghanistan, they said. DHS did not “thoroughly” vet Tawhedi for humanitarian parole on a recurring basis as initially claimed about all Afghan evacuees, either, before allowing him to fly from the unknown third country into the United States.

The screening process for Afghan evacuees in the program includes probing for any possible ties to terrorism, ISIS or the Taliban using databases the U.S. compiled over 20 years in Afghanistan, using data from applicant electronic devices, biometrics and other sources.

It's unclear when Tawhedi might have radicalized in ways that might have been detected. U.S. officials initially told U.S. media they believed that happened only after he was admitted into the United States. In court records, the FBI pegs Tawhedi’s initial crime – sending $540 in cryptocurrency to ISIS — occurred in March 2024. But his ties and extremist proclivities almost certainly predated the currency transfer.

Had Tawhedi been thoroughly vetting when he was supposed to be, red flags were more likely than not available to be found both before and after he arrived in the U.S.

For instance, adjudicators might have found pre-existing extremist ideological proclivities within Tawhedi’s immediate family because two brothers evacuated to France also were arrested in September 2024 for a terrorism plot there to attack a French soccer match or shopping center, according to numerous media accounts and information that surfaced during an October 2024 Oklahoma City federal court hearing. (The French and Americans collaborated on both cases).

Furthermore, court records reveal that Tawhedi maintained relationships with well-known ISIS figures that were sufficiently trusting to have enabled direct communications with them by phone and on encrypted apps.

In fact, Tawhedi trusted these operatives to care for his repatriated wife and child after he was killed in the U.S. attack and to gift substantial remaining funds from the sale of the Oklahoma house. Lastly, an FBI investigator in the October 2024 court complaint indicated that most extended family members in Tawhedi’s Oklahoma circle were aware of the plot, approved, and could still be charged as co-conspirators as of that time.

The fact that many family members in the U.S. and abroad felt this way about Tawhedi’s plans further indicates that their extremism pre-dated U.S. entry and might have red-flagged during face-to-face interviews, database checks, and other standard security vetting practices.

Underscoring the admitted Tawhedi vetting failure, a September 2022 DHS Office of Inspector General report found, in part, that U.S. Customs and Border Protection “admitted or paroled evacuees who were not fully vetted into the United States” and that, “As a result, DHS may have admitted or paroled individuals into the United States who pose a risk to national security and the safety of local communities.”

Shihab Ahmed Shihab Shihab is a citizen and national of Iraq. He entered the United States in September 2020 on a B1/B2 tourist visitor visa and then promptly filed an asylum claim with USCIS before the visitor visa had expired. But according to a later FBI terrorism investigation and prosecution documents, the State Department approved this visitor visa despite Shihab’s long experience as an al Qaeda fighter who specialized in killing U.S. soldiers during the U.S. war there, as well as his purported past imprisonments by the American military and the Iraqi government.

Within seven months of settling in the Columbus, Ohio, area on the visitor’s visa (April 2021), an undercover government informant reported that Shihab was willing to help a fictitious brother of the informant illegally enter the United States through the Southern border even though Shihab was told that European officials had denied entry to the brother on grounds of his membership in ISIS.

This scheme soon led to an FBI terrorism investigation and discovery that Shihab was already well enmeshed in a global conspiracy with an overseas terrorist group fighting unit associated with the Islamic State of Iraq and Syria (ISIS) to smuggle them into the United States over the southern border for the purpose of assassinating former President George W. Bush as revenge for the 2003 Operation Iraqi Freedom, court records assert. During the investigation, Shihab disclosed to the informants that he had already arranged the smuggling of three people from Iraq into the United States over the border, including an agent of the designated terrorist group Hizballah.

The alleged conspiracy to murder former President Bush involved Shihab arranging to smuggle four fighters in his old unit, “al Raed”, into Brazil and then over the Southern border, including two former Iraqi intelligence agents and one who served as the secretary of an ISIS financial minister, as well as potentially more members of ISIS and al Raed.

At issue in the vetting of Shihab for his initial visitor’s visa is the fact that, in relaying the plan to the informant, Shihab disclosed that he had killed many Americans in Iraq between 2003 and 2006 while fighting with the ISIS predecessor group known as al Qaeda in Iraq (AQI). For example, Shihab told informants he’d transported vehicles and weapons from Syria into Iraq and supplied explosives inside them to AQI. But he also disclosed that American, Iraqi, Syrian, and Jordanian authorities had arrested him at various times during his war years, which if true, means that database checks or interviews with family or friends during the visitor visa process should have picked up his disqualifying history.

Security vetting for Shihab’s asylum claim would be moot because, by the time of his interview with USCIS adjudicators, the FBI was deeply involved in its undercover investigation.

It should be acknowledged here that court filings and other public information do not disclose whether his past claimed detentions by American, Iraqi, and Jordanian authorities actually happened. But the claims likely are rooted in truth because the investigation did show that Shihab was in fact affiliated enough with al Raed, as a trusted former member, that he was in actual contact with real current members and the group’s real new leader in Qatar. Shihab’s long association with al Raed and his combat against American troops should have registered in classified databases.

Shihab and the al Raed members, working through a new al Raed leader based in Qatar, planned to create a vehicle bomb for use in the attack on Bush in Dallas, Texas, an FBI complaint stated, and also “that he wanted to be involved in the actual attack and assassination of former president Bush and did not care if he died as he would be proud to have been involved in killing former president Bush.” He budgeted about $3 million in ISIS money for the operation that would be made available by the ISIS finance officer. His role was to facilitate the cross-border smuggling, then conduct surveillance and acquire the necessary weapons and explosives, and he actually traveled to Dallas to conduct surveillance.

By this time, however, the FBI informants had fully penetrated the scheme, and the FBI arrested him in May 2022. By March 2023, Shihab had agreed to plead guilty to an information charge of attempted material support for terrorism.

British national Malik Faisal Akram, entered the United States in accordance with fast-track visa waiver travel requirements between Great Britain and 40 countries and the United States, which allow tens of millions of travelers per year to visit for up to 90 days without a visa.

After registering through the Electronic System for Travel Authorization system (ESTA), which requires that travelers pass a background check and “establish their eligibility”, Akram flew to New York City on December 29, 2021, and then on to Dallas, Texas, two days later. U.S. Customs and Border Protection inspectors at the John F. Kennedy International Airport in New York City let him pass through. The system, administered by CBP, did not catch prior criminal history and terrorism-related intelligence information held by the British, which is closely allied with the United States on intelligence-sharing matters.

As a result, once in Texas, Akram was free to buy a handgun, stay in homeless shelters for a week plotting, and then to attack a Colleyville, Texas, synagogue during Shabbat services.

At gunpoint and claiming he had explosives, Akram took the rabbi and three congregants hostage for 11 hours, threatening to kill them on behalf of a foreign terrorist organization to secure the release of convicted terrorist and MIT neuroscientist Aafia Siddiqui, known in counterterrorism circles as “Lady al Qaeda”, who had been serving an 86-year sentence at Carswell Air Force Base prison near Fort Worth. She was in prison on a 2010 conviction of assaulting and attempting to murder U.S. soldiers sent to interrogate her in 2008 in Pakistan. During the standoff, Akram ranted on a Facebook livestream about her imprisonment in Texas.

Akram let some hostages go, but the rabbi attacked him with a chair, allowing FBI agents to shoot him to death. President Joe Biden dubbed the attack an act of terrorism.

Akram’s brother disclosed that Akram, 44 at the time, had been known to the UK’s MI5 domestic intelligence agency in the second half of 2020 for possible involvement in Islamist terrorism. British officials had placed Akram on a watch list in 2020, but later decided he no longer posed a threat and removed him. He also had a criminal history for drugs and violent behavior dating to when he was 19 on to later convictions on theft and harassment charges.

The ESTA system checks for criminal history records strictly by paper and database, using biographical information provided by travelers, who could lie on the electronic forms.

But his criminal convictions and jail sentence crimes involving drugs and, once, a “violent disorder” when Akram was 19, never flagged U.S. authorities during the quick online visa waiver application process between the two nations, NBC News reported. Neither did intelligence information about his predilection for Islamist violence. He served one spell behind bars when an imam reported him for “concerning behavior” and disrupting Friday night prayer services. He was once banned from a British court in 2001 for praising the 9/11 attacks and was a frequent visitor to Pakistan, with connections to the controversial Islamic sect Tablighi Jamaat. After a 2012 conviction for theft, Akram reportedly conducted himself in an “extreme” manner when attending the jail’s mosque, and one observer noted he was “obsessed with Islam”, a Fox News report found.

According to The Spectator, he was twice referred to the Counter Terrorism Prevent program, as recently as 2019, which screens people thought to be at risk of being drawn into ideological violence, the newspaper reported.

“That’s one hell of a breadcrumb trail,” the media outlet concluded. “It seems incredible that with this number of concerns, Akram could simply step on a plane, presumably lie on his entry forms, and set off for the U.S. completely unimpeded. Two sets of borders were breached and the result was a terrifying ten-hour ordeal for innocent worshippers before his deranged antics were terminated with extreme prejudice.”

One reason the terrorism information may not have been shared in a lasting or permeable way with American agencies is because the British removed

Akram from their watch list, so he may never have been on any U.S. government watch list. Not long after the 2021 incident, the U.S. Department of Homeland Security opened a probe into how Akram defeated the visa waiver security vetting systems. The results of the probe were not publicly available as of March 2023, however. It is possible that improvements were since implemented that remain publicly unknown.

Singaporean national Jun Wei Yeo, who also used the name Dickson Yeo, entered the United States in January 2019 and was a George Washington University fellow until July 2019. The FBI arrested him in November 2019 on suspicion of espionage-related activity.

Neither court records nor open sources specify a visa or full range of dates during which Yeo was a GWU fellow in the Washington, D.C., area. However, for a university fellowship, he would have been required to have obtained either a J-1 cultural exchange visa or an F-1 student visa, either of which would have entailed State Department national security vetting in his native Singapore before he received a visa.

An eventual FBI counterintelligence investigation discovered that Yeo had been working clandestinely as a People’s Republic of China Intelligence Services (PRCIS) spy since at least 2015, several years before the university fellowship was approved. His mission was “to obtain valuable nonpublic information from the United States about matters of economic, military, and political importance, and then provide that information to his PRCIS handlers”, court records from his 2019 prosecution state. That included classified information if Yeo could obtain it. Yeo had been recruited by Chinese intelligence officers during a 2015 trip as a PhD student and accepted the mission out of anti-American fervor and greed, prosecutors alleged.

“Yeo, a highly educated Ph.D. candidate, understood that his work on behalf of the PRCIS contributed to a much larger effort to diminish American power and influence relative to China,” prosecutors argued in a sentencing memorandum. After his 2019 arrest for acting as an unregistered foreign agent, “Yeo conceded that he was motivated to work for the PRCIS, in part, because he was ideologically aligned with China’s goal of diminishing U.S. influence in international affairs.”

While security vetting for J and F visas in 2018 and 2019 was not geared toward discovering foreign spies trained in the art of evasion, State Department efforts in Singapore apparently missed at least one opportunity to do so.

Starting in 2018, before he became a GWU fellow, Yeo used the business social media platform LinkedIn to lure American job applicants who held security clearances to his “consulting company”. But the company he listed for his social media account did not actually exist. For his fake consulting company, Yeo used the same name as a prominent U.S. consulting firm that conducts public and government relations, a ruse that potentially could have been discovered had State Department personnel checked public records and called for an employment check during the visa vetting process.

Another potentially discoverable red flag was that Yeo’s PhD supervisor had been a high profile academic named Huang Jing. In 2017, two years before his student secured the George Washington University fellowship, Singapore expelled Jing from the country for being an “agent of influence of a foreign country” that was not identified in public reporting, according to the BBC. Any publicly available linkage between Jing and Yeo should have been discovered and pursued.

Instead, Yeo went on to use his fellowship time to collect hundreds of resumes from U.S. military and government personnel with security clearances, and he passed some of these resumes to Chinese intelligence operatives. In addition, he used his time at GWU to network with lobbyists and defense contracting companies. He was arrested in the United States in November 2019 and later sentenced to 14 months imprisonment. He returned to Singapore in December 2020 and was arrested there.

Murat Kurashev is a citizen and national of Russia’s Kabardino-Balkaria republic in the northern Caucasus region. According to court records from his 2021-2024 prosecution in the Eastern District of California, Kurashev entered the United States on December 19, 2018, by crossing the U.S. southern border. The crossing occurred during a high surge of family units, and he took advantage of a legal loophole that was forcing U.S. Customs and Border Protection to quickly release them on asylum claims and had drawn a crush of family groups over the border. 

As early as February 2020, some 14 months after arriving, Kurashev began sending money overseas through terrorist HTS couriers, and the FBI arrested him in February 2021 following a months-long investigation that began when agents discovered his social media and encrypted phone app communications with a well-known HTS fundraiser and recruiter in Syria.

His crimes and prosecution could have been avoided at the border when Kurashev first crossed because the narrative on his asylum claim was that he was fleeing repeated harassments by Russian counterterrorism intelligence officers who continuously interrogated him about specific attacks and terrorist associations. Learning Kurashev’s narrative at the border would have flagged him for detention, rather than quick release, and spurred routine checks using an established partnership protocol with Russian intelligence services. The resulting information exchange would have showed Kurashev to be fully enthralled with violent extremist ideology and perhaps in communication with HTS at the time.

In turn, these revelations would not only have prevented Kurashev’s later terrorism crimes but also the threat exposure he personally posed as an attack risk inside the United States. Instead, it was the FBI who later discovered his extremism-motivated criminal terrorism activities in social media and later in encrypted phone chat applications with HTS operatives overseas.

The FBI asserted that it discovered Kurashev was wiring money overseas in at least February 2020, about 14 months after his border crossing arrival in the United States. Over the next year, he sent $13,000 earned in California to HTS, which used the money for battle equipment, including an AK-47 rifle and at least one combat motorcycle.

HTS associates overseas sent Kurashev a photo of one motorcycle he purchased bearing his online nickname, “Abus Salim” on the gas tank and reminding the audience that “donating for the purchase of a motorcycle was tantamount to participating in the frontlines of the war in Syria”. Furthermore, the investigating FBI office assessed in court records that “had he not been arrested, he may have become an operational participant in terrorist activities. Kurashev’s behavior firmly places him on the continuum for mobilizing to violence.”

In January 2024, the border-crossing terrorist pleaded guilty to material support for terrorism charges. In April 2024, a judge issued a 12-year prison sentence.

Congolese national Kaseba Katambwa, an ethnic Rwandan, illegally immigrated to the United Kingdom in 1996 on fraudulent identity documents belonging to a dead cousin. In 2009, the British criminal justice system convicted Katambwa of four times raping a 14-year-old girl and sentenced him to serve four terms of 13 years each, concurrently, for a total of 49 years. He also was convicted, in separate related cases, of drunken driving and criminal schemes to acquire property. He gained early prison release in 2017 for unknown reasons and filed an asylum claim in the UK to forestall deportation back to Congo, according to a U.S. sentencing memorandum filed as part of his defense later.

It was denied, and British immigration deported him to Congo. In about March 2018, he flew under a false name and date of birth on a temporary visitor's work visa related to a "non-profit" he created and then filed a U.S. asylum claim, according to defense and government sentencing memoranda in his later U.S. immigration fraud case. After the 90-day visitor's visa expired, in June 2018, he applied for asylum in Bridgeport, Conn., under the same fraudulent identity.

The investigating ICE agent's complaint notes that Katambwa provided fingerprints for this earlier visa. The USCIS visa adjudicator, however, apparently never cross-checked the print in shared databases that would have included the UK, perhaps because Katambwa was not coming directly from the UK and attested that he had been living in Congo continuously since 1969. Still, a cursory database run would have uncovered the fraud at this point.

The U.S. and the UK share sex offender and criminal history databases for immigration security purposes, and by 2018, fingerprint checks in asylum claims were required.

Later, during the investigation, the ICE agent did so and immediately found the match in the UK's shared sex offender database.

A second missed opportunity came and went when a USCIS adjudicator in New Jersey approved Katambwa's asylum application just three months later, in September 2018, under a pressure campaign put on by a Congolese expatriate community in Connecticut. By 2018, fingerprint checks for asylum claimants were required.

But it never happened.

All of his claims were accepted at face value in the absence of a fingerprint check or investigation into his "non-profit". Had the prints been run against all databases, authorities with USCIS would have quickly discovered the false name and birth date, fake persecution story, that he had been living in security for decades in the UK and no Congo, and that he had been convicted of child rape and other criminality.

These two USCIS security vetting failures allowed a convicted serial rapist convicted of fraud elsewhere into the United States. It was an ICE’s Homeland Security Investigation inquiry that discovered the fingerprints matched the rapist convict’s fingerprints in the UK. HSI arrested Katambwa in February 2019 on immigration fraud charges. A judge sentenced him to nine months in prison.

Mohammed Saeed Alshamrani was a 21-year-old Saudi Royal Air Force 2nd lieutenant training with other Saudi pilots at the U.S. Naval Air Station in Pensacola, Fla., on December 6, 2019, when he opened fire on American soldiers, killing three, in a jihad-inspired terror attack supported by several other of the Saudi students. Local sheriff’s deputies who responded shot Saeed dead, ending the attack. According to a Daily Mail report, the U.S. embassy in Riyadh issued Alshamrani an A-2 diplomatic visa, and he arrived in Pensacola for military training in August 2017.

Alshamrani was among an estimated 5,000 foreign military trainees in the country training at the time on A-2 diplomatic visas, Saudis making up the majority of them. According to a Military.com story, Saeed and all other foreign military trainees cleared security screenings for the A-2 diplomatic visa, first by their own countries and then by a three-level screening process by U.S. embassies in the host nations. The applicants for training alongside U.S. troops would have their names run through databases maintained by the Departments of Defense, State, and Homeland Security to check for criminal activity or substance abuse. The trainees would also have to submit to a physical and psychological examination by a doctor approved by the U.S. embassy and then pass requirements for a visa from the State Department, officials told the media after the attack.

But the security screenings evidently still missed publicly available and potentially discoverable evidence that in 2015 Alshamrani controlled a Twitter account on which he often posted his interest in jihadiist videos, literature, and well-known extremist Saudi clerics Abdulaziz al-Turaifi and Ibrahim al-Sakran, Kuwaiti Hakim al-Mutairi, and Jordanian Eyad Qunaibi. A Saudi government analysis obtained by the Washington Post showed that Alshamrani posted anti-American screeds calling the country "evil" and that, prior to the attack, he hosted a dinner party in which his guests were entertained with video clips of previous mass terror attacks. Several of his fellow Saudi trainees called in sick the morning of the attack. All were sent back to Saudi Arabia afterward, their visas revoked.

Chinese national Yanqing Ye applied for a J-1 cultural exchange visa in August 2017 and had one a month later when she entered the United States and joined Boston University’s Department of Physics, Chemistry, and Biomedical Engineering. On the application, Ye identified herself as a “student” and indicated that she had never been a member of any military.

But according to a later 2019 federal indictment stemming from an FBI counter-espionage investigation, Ye was a lieutenant of China’s People’s Liberation Army (PLA) and active with China’s top military academy, the National University of Defense Technology (NUDT), which is directed by the Chinese Community Party of which Ye also was a member.

While ostensibly “studying” at Boston University from October 2017 to April 2019, Ye worked at the direction of PLA officers assessing U.S. military websites and sending U.S. documents and information back to China. The FBI later found that, at the direction of one NUDT professor, who was a PLA colonel, Ye had accessed U.S. military websites, researched U.S. military projects, and compiled information for the PLA on two U.S. scientists with expertise in robotics and computer science. Furthermore, a review of a WeChat conversation revealed that Ye and the other PLA official from NUDT were collaborating on a research paper about a risk assessment model designed to decipher data for military applications.

American State Department officers responsible for her security vetting background check in August 2017, had they mounted a robust investigation, likely would have found evidence of her active-duty military service and association with key, high-ranking NUDT professors, perhaps in publicly available information on the internet about the joint research paper at NUDT, or a check of U.S. intelligence sources about Chinese military personnel, or merely during more penetrating interviews with Ye like one the FBI conducted with her.

In one such FBI interview at Logan International Airport, Ye admitted she held the rank of lieutenant in the PLA and that she was a member of the CCP. Ye apparently was a fugitive as of March 2023. The FBI was unable to arrest Ye after she was indicted for acting as an unregistered agent of a foreign government, visa fraud, false statements, and conspiracy. The FBI posted a Wanted poster for Ye based on an unfulfilled January 2020 arrest warrant.

Pakistani national Muhammad Masood, a licensed medical doctor in Pakistan, was able to obtain an H-1B skilled worker visa in February 2018 to work as a research coordinator for the Mayo Clinic in Rochester, Minn. In this case, it’s not entirely clear that State Department officers in Pakistan responsible for vetting local Pakistani applicants for U.S. visas could have discovered Masood’s mindset. But it seems more likely than not that the 28-year-old medical doctor was already radicalized and held violent extremist views, judging by the extent of his commitment to violent jihad he was observed espousing within 24 months of his arrival at the Mayo Clinic.

Perhaps because he was a doctor, U.S. State Department consular officers in Pakistan did not investigate deeply. But by at least January 2020, when an FBI counterterrorism investigation started, Masood was already deeply enmeshed in a circle of foreign jihadists with whom he frequently communicated online. To them, he explained that he had regarded his visa and Mayo Clinic job as having enabled him to get “behind enemy lines“ where “not many people can’t [sic] even reach here to attack”. Between January 2020 and March 2020, the FBI found, Masood was pledging his allegiance to the Islamic State and its leader online. He expressed his desire to travel to Syria to fight for ISIS or, failing that, to conduct “lone wolf” terrorist attacks in the United States. Some of those with whom Masood communicated were FBI informants.

“I want to kill and get killed...and kill and get killed … and again and again. This is what … Allah wished,” he told one.

Masood followed through on his words with deeds.

On Feb. 21, 2020, Masood purchased a plane ticket from Chicago, Ill., to Amman, Jordan, and from there planned to travel to Syria. On March 16, 2020, Masood’s travel plans changed because Jordan closed its borders to incoming travel due to the Coronavirus pandemic. Masood made a new plan to fly from Minneapolis to Los Angeles to meet up with an individual who he believed would assist him with travel via cargo ship to deliver him to ISIS territory.

On March 19, 2020, Masood traveled from Rochester to Minneapolis-St. Paul International Airport (MSP) to board a flight bound for Los Angeles, Calif. Upon arrival at MSP, Masood checked in for his flight and was subsequently arrested by the FBI’s Joint Terrorism Task Force. Masood was charged with attempting to provide material support to a designated foreign terrorist organization.

In August 2022, Masood pleaded guilty to attempting to provide material support for ISIS, a terrorist organization.

State Department adjudicators in Pakistan would not likely have approved an H-1B visa for Masood had they detected, perhaps through penetrating interviews with Masood or relatives or by reviewing his social media accounts, his apparent predilection for violent jihad or associations with violent jihadists. Denial of the visa at the application stage undoubtedly would have preempted the threat Masood posed to the American public.

In April 2014, Antonio Jose De Abreu Vidal Filho (referenced as “De Abreu”) joined the Ceara State Military Police, which conducts first-line street policing. In the early morning hours of November 12, 2015, he was among a large group of fellow officers who participated in the so-called “Slaughter of Curió” massacre, which was a police-precipitated mass killing of teenagers from the impoverished neighborhoods of Barroso, Messejana, Guajeru, Curió, and Lagoa Redonda in the state capital of Ceara. The killings were in retaliation for the death of another police officer who died trying to defend his wife who was being assaulted.

In total, the officers murdered 11 people, mostly teenagers, and seriously wounded or tortured many others. Brazilian authorities eventually arrested and charged a total of 35 perpetrators, including De Abreu, in a widely publicized sweep on August 31, 2016.

De Abreu wasted little time plotting to flee Brazil when authorities released him pending trial on May 24, 2017.

Just two weeks later, on June 9, 2017, De Abreu applied to the U.S. State Department for a non-immigrant B2 visitor visa, answering “no” under threat of perjury to questions as to whether he had ever been arrested for any offense or crime. The B2 visitor’s visa is valid for up to 10 years, allowing its holder to stay for up to six continuous months and to return after leaving the country during the decade.

“Official Brazilian court records, including De Abreu’s arrest record, are evidence that he was arrested and detained,” a U.S. government memorandum arguing for detention — years later — noted about the availability of information to adjudicators. “And the record of court proceedings corroborates the fact of his arrest and detention for the crimes described in the Indictment.”

U.S. State Department adjudicators apparently never checked with Brazilian authorities or conducted routine internet research, either of which would almost certainly have revealed his relatively recent arrest and charges for mass murder in Brazil, and thus resulted in a denial. Instead, State Department adjudicators quickly approved the visa on June 21, 2017, and as the Brazil prosecution approached, De Abreu flew to the United States on May 30, 2018.

Other U.S. adjudicators would repeatedly commit the same negligence later.

De Abreu settled in the Boston, Mass., area, immediately applying for and obtaining state a driver’s license, a Social Security card, travel documents, and employment authorization. None of the relevant authorities bothered to check with Brazil’s federal government either, including the Social Security Administration or other federal agencies.

De Abreu would comply with the visa by traveling back and forth to Brazil even while his murder prosecution was pending.

As the mass murder trial approached, on January 29, 2020, De Abreu filed an asylum application with U.S. Citizenship and Immigration Services (USCIS) in Boston, allowing him to stay for years and possibly permanently. Again, he lied on all the government asylum application forms to conceal his arrest and charges for the heinous Curió massacre.

The move meant that De Abreu was far away and safe from Brazilian justice on June 25, 2023, when the First Court of Fortaleza, Ceara, convicted him of 11 counts of murder, three counts of attempted murder, and four counts of physical and mental torture in. That same day, De Abreu was sentenced to 275 years and 11 months in prison and an arrest warrant issued.

But his new American neighbors were not safe at all, U.S. prosecutors later argued in a motion for detention, sometime after ICE Homeland Security Investigations agents discovered him inside the United States.

“His subsequent conviction for eleven murders, demonstrates that he is a serious danger to the community,” the U.S. prosecutors argued. “The seriousness of the danger to others is enormous. The defendant has been convicted in Brazil of horrific acts of violence, and there is a significant risk that he will continue to engage in such conduct upon release on these charges.

It’s unclear how U.S. authorities discovered De Abreu, though it’s likely they did after the Brazil trial when INTERPOL issued an international “Red Notice” arrest warrant for De Abreu and finally found him — and all of his Brazilian arrest and prosecution case records that somehow eluded State Department and USCIS visa adjudicators.

While living in Jordan, the Syria-born Mustafa Alowemer applied for and received U.S. refugee status when he was 17. In August 2016, Alowemer entered the United States and settled in Pittsburgh, Pa.

But undiscovered by U.S. Citizenship and Immigration Services security vetting in Jordan was the fact that Alowemer apparently consorted with Islamist “mujahadeen”, and Jordanian authorities had detained him three times for doing so.

FBI investigation much later inside the United States turned up communications that Alowemer at the time believed were private with active-duty ISIS operatives fighting in the war zone. In one of these conversations, Alowemer boasted:

“I was raised in Jordan on loving the Jihad and the Mujahdeen [sic]. I met some Jordanian brothers, some of which did the Nafir [traveling to conduct jihad] in Raqqah [the self-proclaimed capital of the ISIS caliphate], and I, alongside some brothers, were [sic] arrested three times in Jordan, because I was one of the supporters.”

Instead of a potential denial that would have left him in Jordan, Alowemer received refugee status and allegedly went on three years later to plot what he believed was going to be a bombing of the Legacy International Worship Center church in Pittsburgh. The FBI had answered his call for help and set up a sting operation. Alowemer thought he was plotting online and in person with fellow ISIS sympathizers and bought six boxes of nails for shrapnel in a bomb he was going to hide in a backpack and detonate by remote control. Investigators said he wanted to hide a second bomb, timed to go off just as Pittsburgh police and first responders arrived at the scene.

In the FBI’s criminal complaint, Alowemer is quoted as saying, "After two hours, three hours when the police want to come – then when they've all come together. They'll have to lock down the whole of Pittsburgh."

The complaint said that Alowemer wanted to leave an ISIS flag to claim credit and a sign saying, "We've arrived."

Prosecutors charged Alowemer with providing material support to a terrorist organization and disseminating bomb-making instructions. He was proclaiming his innocence as of August 2021, when the prosecution was still in progress.

Russian national Maria Butina obtained an F-1 student visa in August 2016 to pursue graduate studies at American University in Washington, D.C.

But a much later FBI counterintelligence investigation learned what State Department security screeners for the F-1 visa apparently overlooked: Since at least 2015 and possibly as early as 2013, Butina worked as special assistant to a ranking Russian politician close to the Kremlin and presumably connected to Russian intelligence. He was identified in court papers only as “the Russian Official”, but in media reports as Alexander Torshin. Torshin was a well-known and politically connected public figure who parlayed his position as a legislator in the Russian Federation to appointment as a top official of the Russian Central Bank, with presumable links to federation intelligence services.

Hints were publicly available beyond Butina’s work relationship with Torshin. For instance, prior to obtaining the August 2016 student visa, Butina demonstrated her Kremlin connections in December 2015 when she arranged meetings between National Rifle Association officials and “high-level Russian officials” organized by Torshin, an identifiable hallmark of an influence operation. Screeners might also have explored Butina’s own political dedication to Vladimir Putin’s Kremlin and raised questions about it. As a college student, Butina had been politically active in the youth wing of Vladimir Putin’s United Russia Party, the BBC later reported. While studying political and educational science at the Altai State University in her Siberian home town of Barnaul, Butina was politically engaged and active in the university debating society, where her views could have been plumbed.

State Department visa vetting for the F-1 likely did not uncover Butina’s work relationship with Torshin, her devotion to Putin’s Kremlin, her involvement in arranging meetings with the NRA in Russia before getting her student visa, and her early political activism. Any of this reasonably would have led to a visa-approval delay for further counterintelligence investigation or a denial. An earlier counterintelligence investigation could have short-circuited further damage from Butina’s and Torshin’s continuation of political influence operations in Washington, D.C., after she received the visa, activities that targeted conservative American political circles close to the White House. Instead, Butina’s case only came to light amid later scandals over Russian efforts to influence the 2016 election, according to the Washington Post.

With the F-1 visa placing her in Washington, D.C., Butina and Torshin built social networks in Washington among conservative U.S. lawmakers and other conservative Americans with presumed influence at the White House. She more fully penetrated the National Rifle Association as part of the Torshin-directed operation.

Federal prosecutors in the case alleged that Butina’s work – illegal mainly because she did not register with the U.S. Department of Justice as a foreign agent – served the Russian strategy of creating political wedges within the American population, thus undermining and weakening American democracy, shaping public opinion for that purpose, and furthering Russian interests at the expense of the United States, prosecutors later alleged.

“Penetrating the U.S. national decision-making apparatus and the Intelligence Community are primary objectives for numerous foreign intelligence entities, including Russia,” a probable cause complaint stated. “The objective of the Russian Federation leadership is to expand its sphere of influence and strength, and it targets the United States and U.S. allies to further that goal.”

The complaint further explained that “Russian influence operations are a threat to U.S. interests as they are low-cost, relatively low-risk, and deniable ways to shape foreign perceptions and to influence populations. Moscow seeks to create wedges that reduce trust and confidence in democratic processes, degrade democratization efforts, weaken U.S. partnerships with European allies, undermine Western sanctions, encourage anti-U.S. political views, and counter efforts to bring Ukraine and other former Soviet states into European institutions.”

In July 2018, the FBI arrested Butina on charges of illegally operating as an unregistered foreign agent. After serving 15 months in prison, Butina was deported to Russia in 2019.