He searched for Sun Tzu's "Art of War," previous terror strikes in India and weather forecasts in the Arabian Sea, typed "4 star hotel in delhi" and "taj hotel," and visited mapsofindia.com to pore over sites in and around Mumbai, the documents show.
Still, the sheer scale of his ambition might have served as a smokescreen for his focus on the city. For example, he also showed interest in Kashmir, the Indian Punjab, New Delhi, Afghanistan and the United States Army in Germany and Canada. He constantly flipped back and forth among Internet porn and entertainment sites while he was carrying out his work. He appeared to be fascinated with the actor Robert De Niro, called up at least one article on the singer Taylor Swift, and looked at funny cat videos. He visited unexplainable.net, a conspiracy theory website, and conducted a search on "barak obama family + muslim."
In late September and again in October, Lashkar botched attempts to send the attackers to Mumbai by sea. During that period, at least two of the C.I.A. warnings were delivered, according to American and Indian officials. An alert in mid-September mentioned the Taj hotel among a half-dozen potential targets, causing the facility to temporarily beef up security. Another on Nov. 18 reported the location of a Pakistani vessel linked to a Lashkar threat against the southern coastal area of Mumbai, where the attack would occur.
Eventually Mr. Shah did set up the VoIP service through the New Jersey company, ensuring that many of his calls to the terrorists would bear the area code 201, concealing their actual origin. But in November, the company's owner wrote to the fictitious Indian reseller, Mr. Singh, complaining that no traffic was running on the digital phone network. Mr. Shah's reply was ominous, according to Indian law enforcement officials, who obtained evidence from the company's communications records with F.B.I. assistance after the attack."Dear Sir," Mr. Shah replied, "i will send trafic by the end of this month."
More from The New York Times:
Obama to See if North Korea Should Return to Terror List
A Scourge Is Spreading. M.T.A.'s Cure? Dude, Close Your Legs
Cuba Seizures Now Present Opportunities
By Nov. 24, Mr. Shah had moved to the Karachi suburbs, where he set up an electronic "control room" with the help of an Indian militant named Abu Jundal, according to his later confession to the Indian authorities. It was from this room that Mr. Mir, Mr. Shah and others would issue minute-by-minute instructions to the assault team once the attacks began. On Nov. 25, Abu Jundal tested the VoIP software on four laptops spread out on four small tables facing a pair of televisions as the plotters, including Mr. Mir, Mr. Shah and Mr. Lakhvi, waited for the killings to begin.
In a plan to pin the blame on Indians, Mr. Shah typed a statement of responsibility for the attack from the Hyderabad Deccan Mujahadeen — a fake Indian organization. Early on Nov. 26, Mr. Shah showed more of his hand: he emailed a draft of the phony claim to an underling with orders to send it to the news media later, according to American and Indian counterterrorism officials.
Before the attacks started that evening, the documents show, Mr. Shah pulled up Google images of the Oberoi Hotel and conducted Wikimapia searches for the Taj and the Chabad House, the Jewish hostel run by an American rabbi from Brooklyn who would die in the strike along with his pregnant wife. Mr. Shah opened the hostel's website. He began Googling news coverage of Mumbai just before the attacks began.
An intercept shows what Mr. Shah was reading, on the news website NDTV, as the killings proceeded.
"Mumbai, the city which never sleeps, was brought to its knees on Wednesday night as it came under an unprecedented multiple terror attack," the article said. "Even as heavily armed police stormed into Taj Hotel, just opposite the Gateway of India where suspected terrorists were still holed up, blood-soaked guests could be seen carried out into the waiting ambulances."
A trove of data
In the United States, Nov. 26 was the Wednesday before Thanksgiving. A long presidential election fight was over, and many officials in Washington had already drifted away for their long weekend. Anish Goel, director for South Asia at the National Security Council in the White House, left around 6 a.m. for the eight-hour drive to his parents' house in Ohio. By the time he arrived, his BlackBerry was filled with emails about the attacks.
The Pakistani terrorists had come ashore in an inflatable speedboat in a fishermen's slum in south Mumbai about 9 p.m. local time. They fanned out in pairs and struck five targets with bombs and AK-47s: the Taj, the Oberoi Hotel, the Leopold Cafe, Chabad House, and the city's largest train station.
The killing was indiscriminate, merciless, and seemingly unstoppable over three horrific days. In raw, contemporaneous notes by analysts, the eavesdroppers seem to be making a hasty effort to understand the clues from the days and weeks before.
"Analysis of Zarrar Shah's viewing habits" and other data "yielded several locations in Mumbai well before the attacks occurred and showed operations planning for initial entry points into the Taj Hotel," the N.S.A. document said.
That viewing history also revealed a longer list of what might have been future targets. M.K. Narayanan, India's national security adviser at the time, appeared to be concerned about that data from Mr. Shah in discussions with American officials shortly after the attacks, according to the WikiLeaks archive of American diplomatic cables.
A top secret GCHQ document described the capture of information on targets that Mr. Shah had identified using Google Earth. The analysts seemed impressed by the intelligence haul — "unprecedented real-time active access in place!" — one GCHQ document noted. Another agency document said the work to piece the data together was "briefed at highest levels nationally and internationally, including the US National Security Adviser."
As early reports of many casualties came in, Mr. Goel said the focus in Washington shifted to a question already preoccupying the White House: "Is this going to lead to a war between Pakistan and India?" American officials who conducted periodic simulations of how a nuclear conflict could be triggered often began with a terror attack like this one.
On Nov. 30, Mr. Goel was back at his office, reading a stack of intelligence reports that had accumulated on his desk and reviewing classified electronic messages on a secure terminal.
Amid the crisis, Mr. Goel, now a senior South Asia Fellow at the New America Foundation, paid little attention to the sources of the intelligence and said that he still knew little about specific operations. But two things stood out, he said: The main conspirators in Pakistan had already been identified. And the quality and rapid pacing of the intelligence reports made it clear that electronic espionage was primarily responsible for the information. "During the attacks, it was extraordinarily helpful," Mr. Goel said of the surveillance.
But until then, the United States did not know of the British and Indian spying on Mr. Shah's communications. "While I cannot comment on the authenticity of any alleged classified documents, N.S.A. had no knowledge of any access to a lead plotter's computer before the attacks in Mumbai in November 2008," said Mr. Hale, the spokesman for the Office of the director of National Intelligence. As N.S.A. and GCHQ analysts worked around the clock after the attacks, the flow of intelligence enabled Washington, London and New Delhi to exert pressure on Pakistan to round up suspects and crack down on Lashkar, despite its alliance with the ISI, according to officials involved. In the stacks of intelligence reports, one name did not appear, Mr. Goel clearly recalls: David Coleman Headley. None of the intelligence streams from the United States, Britain or India had yet identified him as a conspirator.
The missing American
Mr. Headley's many-sided life — three wives, drug-smuggling convictions and a past as an informant for the United States Drug Enforcement Administration — would eventually collapse. But for now, he was a free man, watching the slaughter on television in Lahore, Pakistan, according to his later court testimony. At the time, he was with Faiza Outalha, his Moroccan wife, having reconciled with her after moving his Pakistani wife and four children to Chicago.
Mr. Headley's unguarded emails reflected euphoria about Lashkar's success. An exchange with his wife in Chicago continued a long string of incriminating electronic communications by Mr. Headley written in a transparent code, according to investigators and case files. "I watched the movie the whole day," she wrote, congratulating him on his "graduation."
About a week later, Mr. Headley hinted at his inside information in an email to fellow alumni of a Pakistani military school. Writing about the young terrorists who carried out the mayhem in Mumbai, he said: "Yes they were only 10 kids, guaranteed. I hear 2 were married with a daughter each under 3 years old." His subsequent emails contained several dozen news media photos of the Mumbai siege.
Almost immediately, Mr. Headley began pursuing a new plot with Lashkar against a Danish newspaper that had published cartoons of the Prophet Muhammad. He went to Denmark in January and cased the newspaper, meeting and exchanging emails with its advertising staff, according to his later testimony and court records. He sent messages to his fellow conspirators and emailed himself a reconnaissance checklist of sorts, with terms like "Counter-Surveillance," "Security (Armed?)" and "King's Square" — the site of the newspaper.
Those emails capped a series of missed signals involving Mr. Headley. The F.B.I. conducted at least four inquiries into allegations about his extremist activity between 2001 and 2008. Ms. Outalha had visited the United States Embassy in Islamabad three times between December 2007 and April 2008, according to interviews and court documents, claiming that he was a terrorist carrying out missions in India.
Mr. Headley also exchanged highly suspicious emails with his Lashkar and ISI handlers before and after the Mumbai attacks, according to court records and American counterterrorism officials. The N.S.A. collected some of his emails, but did not realize he was involved in terrorist plotting until he became the target of an F.B.I. investigation, officials said.
That inquiry began in July 2009 when a British tip landed on the desk of a rookie F.B.I. counterterrorism agent in Chicago. Someone named "David" at a Chicago pay phone had called two suspects under surveillance in Britain, planning to visit. He had contacted the Britons for help with the plot, according to testimony. Customs and Border Protection used his flight itinerary to identify him while en route, and after further investigation, the F.B.I. arrested him at Chicago O'Hare Airport that October, as he was preparing to fly to Pakistan. For his role in the Mumbai attacks, he pleaded guilty to 12 counts and was sentenced to 35 years in prison.
After disclosures last year of widespread N.S.A. surveillance, American officials claimed that bulk collection of electronic communications led to Mr. Headley's eventual arrest. But a government oversight panel rejected claims giving credit to the N.S.A.'s program to collect Americans' domestic phone call records. Case files and interviews with law enforcement officials show that the N.S.A. played only a support role in the F.B.I. investigation that finally identified Mr. Headley as a terrorist and disrupted the Danish plot.
The sole surviving attacker of the Mumbai attack, Mr. Kasab, was executed in India after a trial. Although Pakistan denies any role in the attacks, it has failed to charge an ISI officer and Mr. Mir, who were indicted by American prosecutors. Though Mr. Shah and other Lashkar chiefs had been arrested, their trial remains stalled six years after the attack. Mr. Menon, the former Indian foreign minister, said that a lesson that emerged from the tragedy in Mumbai was that "computer traffic only tells you so much. It's only a thin slice." The key is the analysis, he said, and "we didn't have it."