FBI Missed Signs of Espionage in Filipino Case

By the government's own account, FBI analyst Leandro Aragoncillo was spying in plain sight. He rummaged through FBI computers for intelligence reports unrelated to his work and then e-mailed the classified documents to opposition leaders in the Philippines.

He traveled more than a dozen times to the Asian country on personal business since 2000. And records show he carried debt of at least a half-million dollars — on Marine retirement pay and an entry-level FBI salary.

But for at least seven months, the bureau that makes catching spies its No. 2 mission after fighting terrorism missed signs of espionage in its own ranks — again.

Safeguards the FBI put in place after it was rocked by the Robert Hanssen spy scandal in 2001 failed to raise red flags about Aragoncillo's activities, according to interviews and court papers reviewed by The Associated Press.

It took a stroke of luck — U.S. customs officials separately developed suspicions about Aragoncillo — to alert the FBI. The bureau soon discovered he was sending sensitive U.S. intelligence assessments about the Philippines' government to Filipino opposition leaders, court records say.

One such document, obtained by the AP, described Filipino President Gloria Macapagal Arroyo, a U.S. ally in the war on terror, as "a weak reactive leader" with an "overbearing personal style." The report was labeled an "informal assessment by a senior USG (U.S. government) policymaker." Arroyo has demanded an explanation from the U.S. Embassy.

Those who helped the FBI after Hanssen's deadly betrayal to Russia are astonished that Aragoncillo appeared to exploit some of the same weaknesses that were supposed to have been fixed.

"I don't know why they had to wait until somebody turned him in," said former Attorney General Griffin B. Bell, a member of the panel that investigated FBI security after Hanssen. "They should have been policing their systems. The question is, how could he get by that long?"

Rep. Jane Harman, D-Calif., whose House Intelligence Committee received a classified briefing on Aragoncillo, agreed. "Bells and whistles should have gone on some place, and they didn't," she said.

The FBI acknowledged it did not suspect Aragoncillo until the tipoff from Customs but said it eventually would have detected its analyst's behavior.

"I'm confident our security procedures would have picked this up," said Leslie Wiser Jr., head of the FBI's New Jersey office and a lead investigator in the 1994 spy case against CIA officer Aldrich Ames. "I'm glad we didn't have to wait for that; we'll take it any way we can."

The Justice Department inspector general has told Congress he was reviewing the adequacy of the FBI's spy-catching techniques even before Aragoncillo's arrest. That probe is continuing.

Meanwhile, Aragoncillo's lawyers and prosecutors are trying to wrap up a plea deal that would secure a guilty plea and his cooperation. Prosecutors have said Aragoncillo has "essentially admitted" to taking classified documents.

The 47-year-old was born in the Philippines and became a naturalized U.S. citizen in 1991. He served 21 years in the Marines, ultimately as a gunnery sergeant. He worked at the White House on the security detail for Vice Presidents Al Gore and Dick Cheney between 1999 and 2002 before joining the FBI as a civilian intelligence analyst at Fort Monmouth, N.J.

He is not charged with espionage, which carries a maximum penalty of capital punishment, as plea discussions continue. Instead, he's charged in court papers with conspiring to reveal government secrets, acting as a foreign agent and improperly using FBI computers. Those charges carry a maximum of 25 years.

Aragoncillo declined on three occasions through his lawyer, U.S. public defender Chester Keller, to speak with AP.

Prosecutors have not identified a motive for Aragoncillo, except to say that he was deeply in debt and appeared loyal to former Philippines President Joseph Estrada. In one e-mail message cited in court records, Aragoncillo allegedly wrote to the former president, "I would rather you take over, if the constitution would suggest."

Once tipped about Aragoncillo, the FBI's spy-hunters tracked his every move until they arrested him Sept. 10. They followed him in traffic, watched him outside his New Jersey home, hid a camera in his office cubicle, listened during phone calls and opened his personal e-mails.

Peering through a hidden video lens, investigators said they watched Aragoncillo download a report marked "secret" off the FBI's computer system, copy it to a floppy disk then slide the disk into a bag to take home.

"Please protect the source," Aragoncillo wrote Estrada in an e-mail that was meant to transmit the three-page FBI report, according to the criminal complaint

By the time FBI agents arrested him, Aragoncillo had downloaded at least 101 classified documents related to the Philippines, officials said.

It wasn't supposed to happen that way.

After the FBI in 2001 arrested Hanssen, who admitted spying for Moscow for cash and diamonds over two decades, the agency was instructed to adopt tough new safeguards to catch spies in its ranks. "We've moved to address that," FBI Director Robert Mueller promised in April 2002.

But despite similarities to Hanssen, Aragoncillo's activities failed to trigger alarms with any of the FBI's new computer monitoring, financial checks, polygraph tests and rules on foreign travel.


The government said Aragoncillo began searching FBI computers for reports on political unrest in the Philippines and downloaded them without detection even though he wasn't working on the subject.

"If somebody is going into computer files where they have no business, that ought to be picked up immediately," Bell said.

The commission Bell served, led by former FBI Director William Webster, urged the bureau after Hanssen to create "electronic tripwires" to alert managers when employees access secrets that they shouldn't.

To avoid tipping off spies, the FBI will not describe exactly how it protects classified computer files. But it said its most sensitive reports — including details about internal espionage cases — are not accessible to every employee.

Still, the FBI acknowledges it does not routinely monitor how its roughly 30,000 workers use its classified computer network, known as its Automated Case Support system.

"There are ways we can do that," said Charles S. Phalen, the FBI's assistant director over its security division. "We have the capability of monitoring in real time under certain circumstances."

Phalen said improved protections will be key to the FBI's next-generation computer network, known as Sentinel. But upgrades to FBI computers have been plagued by scheduling and cost problems. "We'll never get to where we need to go with ACS," Phalen said.

The FBI said Aragoncillo was concerned about e-mailing from his personal account so many classified documents from FBI computers, and he asked one recipient, Filipino opposition Sen. Panfilo "Ping" Lacson, whether he was a nuisance.

The reply, court records say, came back two days later in a cell phone message intercepted by the FBI: "What you are sending are never a nuisance to me. They are in fact informative and very useful."

Some reports passed to the Philippines were deeply critical of Filipino leaders. An April 2005 report from the State Department, pulled from the FBI's computer system, said it was "certainly" in Filipinos' interest to upend Arroyo's government. Another described Estrada, the former president, as "the most direct and legally acceptable potential successor."

Estrada has acknowledged receiving some of the reports taken from FBI computers.

An FBI intelligence report described Arroyo's vice president, Noli De Castro, as unsophisticated with poor speaking skills and no interest in world affairs.


Immigration records show Aragoncillo traveled 15 times since 2000 to the Philippines at his own expense. The most recent trip was June 12, more than two months after the FBI was first tipped about him.

FBI officials refused to say whether the analyst reported any of his foreign trips to supervisors as required. But they acknowledged they have no safeguards systemwide to catch suspicious travel if an employee doesn't volunteer it.

Frequent overseas travel by employees with security clearances can raise red flags. "Certainly multiple trips could invite scrutiny," Phalen said. But he said that a disloyal employee could commit espionage even on a single trip.


The FBI said Aragoncillo, like all employees, underwent a background check before July 2004 that included reviews of his finances. Officials won't say whether they questioned Aragoncillo about his $200,000 in personal debt and $300,000 mortgage, which prosecutors cited in court.

Aragoncillo was living on his Marine retirement pay and an entry-level FBI salary, which ranges from $38,300 to $56,000.

The disparity should have been another red flag. In unrelated cases outside the FBI, credit debt as low as $2,000 has caused employment problems for government workers with access to classified information.

"I can't believe they haven't figured that out yet," said Nina J. Ginsberg, the defense lawyer for convicted spy Brian Patrick Regan, a retired Air Force sergeant. Regan, serving a life sentence, ran up $116,000 in credit debt that authorities believe drove him to offer secrets in 2001 to Iraq, China and Libya for $13 million.

Owing large amounts of money "makes you vulnerable, makes people desperate," Ginsberg said. "It means you're more likely to be compromised, more likely to make decisions for money."


Aragoncillo finally came under investigation after he tried to intervene in an immigration case against Michael Ray Aquino, a former senior Philippines police official arrested in New York on an expired visa. The Immigration and Customs Enforcement agency quietly notified the FBI.

Wiser, the senior FBI official in New Jersey, said agents moved quickly once they determined this was an espionage case. "They worked their tails off," he said. "We made this case, really brought it forward in about eight weeks, which is pretty extraordinary given the complexity of these cases."

Meanwhile, questions remain about Aragoncillo's case. Some answers may lie in the trust FBI agents afford each other.

Paul Moore, who shared a carpool with Hanssen when both worked at FBI headquarters, said he never suspected his co-worker was a Russian spy. Inside the FBI, Moore said, "suspicion isn't automatic. You tend to find explanations for anomalous behavior."