Findings from Pensacola Investigation Released, Steps Already Taken

20 November 2020WASHINGTON, DC – The Navy released the Command Investigation report Nov. 20 from the December 6, 2019 Naval Air Station Pensacola Shooting.

In line with FBI findings released in May, the Pensacola investigation concluded that the self-radicalization of 2nd Lt Al-Shamrani was the primary cause of the fatal terrorist attack, and that the heroic actions by the victims on scene and responding forces limited what was already a catastrophic event.

The Navy convened the Command Investigation to specifically examine the facts and circumstances surrounding the fatal shooting, including resulting injuries, death, property damage, security, personnel, and other factors related to the incident. In order to ensure the safety and well-being of uniformed and civilian personnel, the investigating officer was also directed to include an assessment of whether all laws, regulations, programs, policies, and procedures related to Force Protection (FP), emergency response management, insider threat and active shooter training, personal firearms, and vetting of International Military Students were followed.   

The investigation examined the adequacy of Force Protection in light of the threat known at the time of the shootings, if the emergency response management was properly executed and if there were any possible deficiencies with FP doctrine, organization, training, materiel, leadership and education, personnel, facilities (DOTMLPF). Investigators also assessed other individual risk factors as well as the appropriateness of Department of the Navy (DON) post-incident response, including medical response, support to victims, survivors, and their families.

The investigation found a number of potential contributing and primary non-contributing factors that will be addressed by a special working group, organized by the Navy’s Security Coordination Board (SCB).

Following the attack, DoD and the Navy took immediate steps to address the safety and security of our installations, service members and their families. The Secretary of the Navy directed a Fleet-wide security stand down, and the Chief of Naval Operations directed the immediate completion of Insider Threat and Active Shooter Training. Naval Forces Northern Command (NAVNORTH) mandated the completion of active shooter table-top training for all Navy personnel in the U.S. Northern Command area of responsibility. Additional Random Antiterrorism Measures (RAMs) were also implemented at naval installations. In January, the Department of Defense directed enhanced screening, vetting and continuous review and monitoring processes for international military students, prohibited IMS from purchasing, owning or handling firearms while training in the United States and limited access to installations where they have an official duty.

Further measures are in work, including improved mass warning and alert notification capabilities, physical security improvements, policy changes, and cultural changes as to how the Navy views Anti-Terrorism/Force Protection (ATFP), as well as post-incident response measures.

The SCB is the senior-level governance body for the integration and policy coordination of the Navy Security Enterprise and will implement findings and recommendations from the investigation to make the Navy safer and more secure. It serves as a forum for stakeholders who are responsible for coordinating cross-functional Navy security issues. As the Navy’s cross-functional team for security issues, the working group will also provide recommendations on key policy issues regarding best security practices and standardization.

VIDEO: During a May 18, 2020 press conference, Attorney General William P. Barr and FBI Director Christopher Wray announced significant developments in the FBI’s investigation of the December 6, 2019 shooting at Naval Air Station Pensacola that killed three U.S. sailors and severely wounded eight other Americans.

FBI Director Christopher Wray’s Remarks at Press Conference Regarding Naval Air Station Pensacola Shooting Investigation

FBI Director Christopher Wray delivered the following remarks during a virtual press conference with Attorney General William P. Barr at the Department of Justice today announcing updates in the criminal investigation of the December 6, 2019 shootings at the Naval Air Station Pensacola in Florida that killed three U.S. service members and wounded eight other Americans. (Remarks prepared for delivery) FBI

Thank you very much. I deeply appreciate the attorney general’s leadership and support for the FBI—both in our relentless fight against terrorism, and in our drive to obtain the vital evidence we need to protect the American people.

Investigation Update

We’re here today because of a tragic reminder of just how grave, how imminent, the terrorism threat still is—an al Qaeda in the Arabian Peninsula associate’s murder of three people, and wounding of eight others, right here in America.

As the AG described, through a combination of skill and determination, the men and women of the FBI have succeeded in accessing the terrorist’s two phones—both of which he tried to destroy.

Our investigation into December’s terror attack in Pensacola continues, so there are limits to what I can say today. But this is an important moment in an important case.

It’s important because of what accessing the evidence on this killer’s phones allows us to do to protect the American people. In just the short time since we finally accessed that evidence, we and our partners have already put it to good use. Among other steps we’ve taken, just a moment ago you heard the attorney general describe the recent counterterrorism operation targeting Abdullah al-Maliki, one of the overseas AQAP operatives that al-Shamrani associated with while here in the U.S.

It’s also important because it underlines just how serious our fight against terrorism is—and how vital it is for the FBI to maintain its unflagging vigilance against this threat.

What We’ve Learned

The evidence we’ve been able to develop from the killer’s devices shows that the Pensacola attack was actually the brutal culmination of years of planning and preparation, by a longtime AQAP associate.

The new evidence shows that al-Shamrani had radicalized not after training here in the U.S. but at least as far back as 2015, and that he had been connecting and associating with a number of dangerous AQAP operatives ever since. It shows that al-Shamrani described a desire to learn about flying years ago, around the same time he talked about attending the Saudi Air Force Academy in order to carry out what he called a “special operation.” And he then pressed his plans forward, joining the Air Force and bringing his plot here—to America.

Thanks to a lot of hard work by our people, we now know that al-Shamrani continued to associate with AQAP even while living in Texas and in Florida; and that in the months before the attack, while he was here among us, he talked with AQAP about his plans and tactics—taking advantage of the information he acquired here, to assess how many people he could try to kill.

He was meticulous in his planning. He made pocket-cam videos as he cased his classroom building. He wrote a final will, purporting to explain himself, and saved it in his phone—the exact same will that AQAP released two months later when they initially claimed responsibility. He wasn’t just coordinating with them about planning and tactics—he was helping the organization make the most it could out of his murders. And he continued to confer with his AQAP associates right until the end, the very night before he started shooting.

We are still exploiting the evidence we’ve now obtained from al-Shamrani’s phones. And we’re continuing to run our investigation, now with the benefit of a lot more insight into the murderer’s mind and intentions, his relations with AQAP, and his tactics.

We have more to learn. But we know enough now to see al-Shamrani for what he was—a determined AQAP terrorist, who spent years preparing to attack us.

We now have a picture of him we didn’t have before we obtained this evidence—before we could confirm that his connection to AQAP was real, before we could track his long and methodical path to violence—a picture we would never had obtained without accessing his devices.

Side-by-side comparison of Pensacola shooter Mohammed Saeed al-Shamrani’s notes (left side) with al Qaeda in the Arabian Peninsula’s original claim of responsibility.

The Terrorism Threat Remains Our Top Priority

This case is a potent reminder, for anyone who needed one, of the stakes of our work.

We protect the American people from a staggering range of threats. But make no mistake, securing the homeland against terrorism remains our top priority.

The men and women of the FBI are deployed around the clock, all over our country and around the world, identifying and disrupting threats, and pursuing those who would do us harm. At the FBI, we remain laser-focused on the terrorism threat, not just because of how much damage an attack can cause our country, but also because we also know that even as we speak, there are evolving and sophisticated groups around the world, intent on striking us. Whether core al Qaeda or its offshoots like AQAP, ISIS, or the many others—we are working with our partners to find and disrupt them, wherever they are, whether they’re plotting attacks on Americans here at home or abroad.

Our people are attacking every aspect of the terrorism threat—international, like we’re here talking about today, and domestic—with dedication and expertise; with innovation to more than match the evolving threat; and with a commitment to getting the job done right.

Accessing the Killer’s Phones

On the topic of innovation—I want to thank and congratulate the men and women at the FBI who devoted months of hard work to accessing these devices. They successfully tackled a problem that required tenacity, creativity, and technical expertise. Those qualities are valuable in any organization—so I know how fortunate we are, and how fortunate the American people are, that we have so many people with those qualities at the Bureau. That’s why we work to recruit the kind of people we do.

The magnitude of the challenge they faced is hard to overstate.

We received effectively no help from Apple. We canvassed every partner, and every company, that might have had a solution to access these phones. None did, despite what some claimed in the media. So we did it ourselves.

Unfortunately, the technique that we developed is not a fix for our broader Apple problem—it’s of pretty limited application. But it has made a huge difference in this investigation.

These images of al-Shamrani’s phone were displayed during a January 13, 2019 press conference.

Cost of the Effort

While we’re thanking the FBI’s computer scientists, engineers, and other professionals for their hard work, we should also be thinking about the cost of all that work.

Public servants, already swamped with important things to do to protect the American people—and toiling through a pandemic, with all the risk and hardship that entails—had to spend all that time just to access evidence we got court-authorized search warrants for months ago. Our engineers and computer scientists working to access these phones were also needed on other, pressing, national security and criminal investigations.

But the delay getting into these devices didn’t just divert our personnel from other important work. It’s also seriously hampered this investigation.

Finally getting our hands on the evidence al-Shamrani tried to keep from us is great. But we really needed it months ago, back in December, when the court issued its warrants.

In the aftermath of the attack, we and our Joint Terrorism Task Force partners worked urgently to collect and analyze evidence. In the weeks immediately following December 6, we conducted over 500 interviews of witnesses, base personnel, and the shooter’s friends, classmates, and associates—among many other efforts. Because the crucial evidence on the killer’s phones was kept from us, we did all that investigating not knowing what we do now: valuable intelligence about what to ask, what to look for. If we had, our round-the-clock, all-hands-on-deck effort would have been a lot more productive.

Now, months after the attack, anyone he spoke to—here or abroad—has had months to concoct and compare stories with co-conspirators, destroy evidence, or disappear. As a result, there’s a lot we just can’t do at this point that we could have done months ago.

You’ll hear more from the attorney general in just a moment on just how vital lawful access is to every part of both our law enforcement and national security missions. Cybercrime, opioid trafficking, child sexual exploitation—you name it. Lack of lawful access affects every fight we’re in.

And Americans need to understand this isn’t just an issue for law enforcement. Lack of lawful access certainly affects our ability to do our jobs, but we know where the harm really falls when evidence is kept unavailable—it falls on innocent people, the people we’re sworn to protect.

In this case, we and our partners aren’t the only ones who needed this information months ago. The victims—those who were wounded or lost loved ones that day—deserved to know then what happened. Not to have to wait to hear it from AQAP months after the fact, when one of the killer’s own associates, the operative Abdullah al-Maliki the attorney general and I mentioned earlier, issued AQAP’s claim of responsibility for the attack.

We at the FBI never forget that three brave members of our armed forces were killed in this attack. They were Airman Mohammed Sameh Haitham, from St. Petersburg, Florida; Ensign Joshua Kaleb Watson, of Coffee, Alabama; and Airman Cameron Scott Walters, from Richmond Hill, Georgia. They were serving our country. They died as heroes. And we have them front of mind every day as we continue to battle the same threat they did.

BACKGROUND JAN 2020 The Department of Justice and the FBI today provided new details about a shooting last month at Naval Air Station Pensacola that left three U.S. sailors dead and eight others wounded.

Attorney General William P. Barr said the December 6 attack by a member of the Royal Saudi Air Force who was studying at the Florida military base was “an act of terrorism” motivated by “jihadist ideology.” Barr said Mohammed Saeed Alshamrani visited the 9/11 Memorial in New York City last year and posted a message on social media last September 11 stating that “the countdown has started.”

In addition to releasing new information about the shooter’s actions leading up to the attack, the attorney general and FBI Deputy Director David Bowdich drew special attention to the selfless acts of first responders, who they credited with saving lives.

Barr and Bowdich also highlighted a significant hurdle in the ongoing counterterrorism investigation—the inability to extract information from the deceased shooter’s encrypted Apple iPhones despite court authorization and probable cause.

“It’s very important for us to know with whom and about what the shooter was communicating before he died,” Barr said during the press conference at Department of Justice Headquarters in Washington, D.C. “This situation perfectly illustrates why it is critical that investigators be able to get access to digital evidence once they have obtained a court order based on probable cause.”

Bowdich called the investigation “incredibly complex,” involving hundreds of FBI personnel, including the Jacksonville Field Office, and dozens of partner agencies and entities. The FBI has conducted more than 500 interviews and collected more than 42 terabytes of digital media in an effort to determine if Alshamrani was acting alone.

“So far, we have not identified any solid evidence that the shooter acted with any co-conspirators or that he was inspired by a specific group,” Bowdich said. The shooter’s social media posts suggested he harbored anti-U.S. military and anti-Israel sentiments.

The shooting lasted about 15 minutes, and Naval Security Forces intervened about eight minutes after the first shots. Alshamrani was killed by law enforcement officers who responded to the scene, where the FBI found a lawfully purchased semi-automatic handgun, several ammunition magazines, and about 180 rounds of ammunition.

“We want to work together with private sector companies so that we can lawfully access the evidence and information we need to keep our country and its citizens safe.”

FBI Deputy Director David Bowdich

Attorney General Barr singled out several individuals for their heroism during the attack, including two unarmed U.S. Marines who confronted the shooter and later provided medical treatment to shooting victims, as well as a Navy airman who was shot five times yet still shielded a fellow sailor from being shot.

“We are grateful as well for the bravery of the base personnel and local law enforcement responders who initially arrived at the scene and engaged the shooter,” Barr said.

Barr also acknowledged the Kingdom of Saudi Arabia for supporting the investigation, which has not found any evidence of pre-knowledge of the attack by other Saudi Royal Air Force and Royal Navy trainees. But investigators did find that 17 of the Saudi trainees in Florida had social media containing jihadi or anti-American content, and 15 (including some of the 17) had contact with child pornography. These findings led Saudi Arabia to withdraw 21 students from the training curriculum in the U.S.

Barr said federal prosecutors evaluated the individual cases. “The relevant U.S. Attorneys Offices independently reviewed each of the 21 cases involving derogatory information and determined that none of them would, in the normal course, result in federal prosecution,” Barr explained. 

Barr and Bowdich both closed their remarks with pleas to the California-based tech company Apple to work with the FBI and DOJ to collectively find a solution to the issue of mobile devices that are, by default, encrypted. The inability to lawfully access user data on mobile devices is leading promising cases to dead-ends, giving an edge to criminals and terrorists.

Alshamrani left two iPhones at the crime scene—one he shot through with a bullet before being killed. The FBI Laboratory was able to restore both phones to working order but is unable to unlock either of them.

“Even with a court order, to date we cannot access the contents of the two phones that the attorney general referred to in this investigation—and countless other investigations,” Bowdich said. “We want to work together with private sector companies so that we can lawfully access the evidence and information we need to keep our country and its citizens safe.”

“We’re not trying to weaken encryption,” he added. “After all, data security is a central part of our mission.

From FBI

FBI Deputy Director David Bowdich’s Remarks at Press Conference on Naval Air Station Pensacola Shooting

FBI Deputy Director David Bowdich issued the following statement during a press conference at the Department of Justice. (Remarks prepared for delivery.)

I’d like to offer a brief overview of our investigation into this attack.

This has been a large and incredibly complex investigation, with dozens of investigative entities involved. Let me start with what we’ve done so far.

Since the beginning of this investigation, the FBI and our partners have been united in our goal: to confirm whether the shooter acted alone or if anyone helped him.

So far, we’ve conducted more than 500 interviews with witnesses, base personnel, and the shooter’s friends, classmates, and associates.

And even today, we continue to run down any new leads in an effort to find as many answers as possible for the victims and their families.

For more than a month, this has been an around-the-clock operation, involving hundreds of FBI special agents, intelligence analysts, and professional experts from across the country.

We’ve employed dozens of surveillance teams, and executed, served, or obtained numerous search warrants, subpoenas, court orders, and emergency disclosure requests.

We’ve also collected more than 42 terabytes of digital media—and the effort to exploit that data is ongoing.

While we’re still searching for more information, so far, we have not identified any solid evidence that the shooter acted with any co-conspirators, or that he was inspired by a specific group.

Social media attributed to the shooter suggests that he harbored anti-U.S. military and anti-Israel sentiments, and that he thought violence was necessary to defend Muslim countries.

In addition, just prior to the attack, a statement was posted to his social media accounts that was nearly identical to a previous statement by Anwar al-Aulaqi, a now-deceased senior leader of al Qaeda in the Arabian Peninsula.

And during the attack, the shooter fired shots at pictures of the current U.S. president and a former president, and a witness at the scene recounted that he made statements critical of American military action overseas.

Regarding the attack, I can now share that the shooting lasted approximately 15 minutes.

Naval Security Forces engaged the shooter approximately eight minutes after the first shots were fired, and we’ve determined that he was killed by law enforcement officers.

At the crime scene, we found a semi-automatic handgun with an extended magazine, several ammunition magazines, and approximately 180 rounds of ammunition.

As announced previously, the ATF identified the shooter’s weapon as having been lawfully purchased in July 2019 in Florida. It was purchased under a hunting license exception.

This exception allows non-immigrant visa holders who otherwise are not permitted to buy firearms or ammunition to purchase them if they have a valid, state-issued hunting license, permit, or other required documentation.

Partnerships are crucial in a case like this, so I want to thank our many federal, state, and local agency partners for their hard work, including NCIS, Air Force Office of Special Investigations, ATF, Homeland Security Investigations, and the Florida Department of Law Enforcement.

I especially want to recognize the brave Naval Security Forces personnel who responded to the initial call for help, as well as deputies from the Escambia County Sheriff’s Office.

Those heroes saved many lives that day.

I’m also grateful to our FBI Jacksonville Field Office, and a host of supporting FBI Headquarters personnel and resources from other field offices.

Finally, I want to echo the attorney general’s point about the challenge that law enforcement faces from default user-controlled encryption.

The FBI continues to work with our private sector partners to find the right solution for accessing the digital evidence we need to stop criminals and terrorists.

We’re not trying to weaken encryption—after all, data security is a central part of our mission.

But even with a court order, to date we cannot access the contents of two phones in this investigation—and countless devices in other investigations.

We want to work together with private sector companies, so that we can lawfully access the evidence and information we need to keep our country safe.

From DOJ:

Attorney General William P. Barr Announces the Findings of the Criminal Investigation into the December 2019 Shooting at Pensacola Naval Air StationWashington, DC ~ Monday, January 13, 2020

We are here to discuss the results of the investigation into the shooting that occurred on Dec. 6, 2019 at Pensacola Naval Air Station.

Joining me today are David Bowdich, Deputy Director of the FBI; John Demers, Assistant Attorney General for National Security; Michael Sherwin, Associate Deputy Attorney General for National Security; Rachel Rojas, FBI Special Agent in Charge of the FBI Field Office in Jacksonville, Florida; and Larry Keefe, U.S. Attorney for the Northern District of Florida.

I want to thank the FBI and the other federal, state, and local law enforcement agencies involved in responding to and investigating the incident for their rapid and excellent work.  Many people worked long hours through the holidays, and I am grateful for their diligence and commitment to seeing this through.  You will be hearing from Deputy Director Bowdich shortly about the details of the FBI investigative work, which was superb.

In considering this case, we have to remember that there are thousands of allied pilots and other military personnel receiving training on military bases throughout the United States.  These military partnerships are critically important to the United States.  The Royal Saudi Air Force, which flies American-made aircraft, is an important military partner, and has long had a training relationship with us.  

On Dec. 6, 2nd Lt. Mohammed Saeed Alshamrani, a member of the Royal Saudi Air Force, entered a building on the grounds of Pensacola Naval Air Station and killed three U.S. sailors and severely wounded eight other Americans.  Alshamrani was killed during the attack.

This was an act of terrorism.

The evidence shows that the shooter was motivated by jihadist ideology.  During the course of the investigation, we learned that the shooter posted a message on social media on Sept. 11 of last year that said: “the countdown has begun.”  Over Thanksgiving weekend, he visited the 9/11 Memorial in New York City.  He also posted other anti-American, anti-Israeli, and jihadi messages on social media, and did so two hours before his attack at the naval base.

Early reports indicated that the shooter arrived at the site, accompanied by other Saudi cadets, who took video of the attack as it unfolded.  These reports turned out not to be accurate.  The shooter arrived by himself.  Other Saudi cadets happened to be in the area and, after the attack began, they took some videos of the resulting commotion.  They fully cooperated in the investigation, as did the other Saudi cadets who were interviewed by the FBI at Pensacola and at additional bases across the country. 

After Alshamrani entered the building and cased the facility, he proceeded to walk around shooting down his unarmed victims in cold blood.

During and after this heinous attack, there were many specific acts of courage, and I want to draw special attention to two U.S. Marines: Gunnery Sgt. Ryan Maisel and Staff Sgt. Samuel Mullins. 

They were outside the building when they heard gunfire and, although unarmed, they ran into the building to confront the shooter.  Their only weapon was a fire extinguisher that they had pulled off the wall as they ran toward the gunfire.  Who but the Marines?

Although they were unable to engage the shooter, they helped save many lives by performing CPR and other medical aid on the victims. 

I would also like to mention the heroic acts of Navy Airman Ryan Blackwell.  The shooter shot Airman Blackwell five times, yet Ryan still managed to jump on top of a fellow sailor to keep her from being shot.  He further assisted other students and helped them escape, all while taking additional fire from the shooter.  Airman Blackwell’s heroic acts also saved countless lives that day.

We are grateful as well for the bravery of the base personnel and local law enforcement responders who initially arrived at the scene and engaged the shooter.

I would also like to address the cooperation of the Kingdom of Saudi Arabia.

The Kingdom of Saudi Arabia gave complete and total support for our counter-terrorism investigation, and ordered all Saudi trainees to fully cooperate.  This assistance was critical to helping the FBI determine whether anyone assisted the shooter in the attack. 

While there was no evidence of assistance or pre-knowledge of the attack by other members of the Saudi military (or any other foreign nationals) who are training in the United States, we did learn of derogatory material possessed by 21 members of the Saudi military who are training here in the United States.

17 had social media containing some jihadi or anti-American content.  However, there was no evidence of any affiliation or involvement with any terrorist activity or group.  15 individuals (including some of the 17 just mentioned) had had some kind of contact with child pornography.  While one of these individuals had a significant number of such images, all the rest had one or two images, in most cases posted in a chat room by someone else or received over social media.

The relevant U.S. Attorneys offices independently reviewed each of the 21 cases involving derogatory information and determined that none of them would, in the normal course, result in federal prosecution. 

However, the Kingdom of Saudi Arabia determined that this material demonstrated conduct unbecoming an officer in the Saudi Royal Air Force and Royal Navy and the 21 cadets have been dis-enrolled from their training curriculum in the U.S. military and will be returning to Saudi Arabia (later today).

The Kingdom has assured me that it will review each of these cases under their code of military justice and criminal code.  The Kingdom has also agreed that we will have full access to anyone we want to interview in Saudi Arabia and any documents relevant to our investigation.  Indeed, it has already been providing documents.  Further, the Kingdom has assured us that, if we later decide to charge any of those being sent back to Saudi Arabia in connection with this counterterrorism investigation, it will return them for trial.  

We appreciate Saudi Arabia’s cooperation in this case.

Finally, I want to address an issue regarding the shooter’s phones. 

The shooter possessed two Apple iPhones, seen on posters here.

Within one day of the shooting, the FBI sought and received court authorization based on probable cause to search both phones in an effort to run down all leads and figure out with whom the shooter was communicating. 

During the gunfight with first responders, the shooter disengaged long enough to place one of the phones on the floor and shoot a single round into the device.  It also appears the other phone was damaged. 

Our experts at the FBI crime lab were able to fix both damaged phones so they are operational.

However, both phones are engineered to make it virtually impossible to unlock them without the password.  It is very important to know with whom and about what the shooter was communicating before he died. 

We have asked Apple for their help in unlocking the shooter’s iPhones.  So far Apple has not given us any substantive assistance.  This situation perfectly illustrates why it is critical that investigators be able to get access to digital evidence once they have obtained a court order based on probable cause.  We call on Apple and other technology companies to help us find a solution so that we can better protect the lives of Americans and prevent future attacks.