FBI hunts for electronic trail that could link San Bernardino shooters to foreign terror groups

As FBI divers continue to paddle the murky waters of a lake in San Bernardino, the federal investigation into the massacre at a county health department gathering is reaching a critical juncture: With whom were the two shooters in contact?

Officials have described Syed Rizwan Farook and his wife, Tashfeen Malik, as "self-radicalized" terrorists since they killed 14 people and wounded 21 in the Dec. 2 attack.

But several federal law enforcement officials, speaking confidentially Friday and Saturday because the investigation is ongoing, are also concerned that the two shooters could have been jointly or independently in direct contact with members of one or more foreign terror operations.

Interested in the stories shaping California? Sign up for the free Essential California newsletter >>

The Islamic State group has described both shooters as "supporters" but has not claimed responsibility for the attack, unlike its immediate move to do so after the Paris terrorist assaults last month. The couple had pledged allegiance to the terror organization shortly before they launched their assault on the Inland Regional Center.

Whether Farook and Malik were ordered to carry out a terrorist attack may well be determined based on what the divers bring up from the bottom of Seccombe Lake.

Several undisclosed items were retrieved Friday, and the divers went back into the water Saturday in search of the couple's computer hard drive and other electronic components. Officials are working on a tip that the shooters hurried to the area near the lake on the day of the attack and disposed of personal items there.

In addition, agents have recovered from a large trash container two smashed cellphones, and are examining those and other items from the couple's Redlands home at the FBI's crime lab in Quantico, Va.

The items are surfacing as key pieces of evidence that officials hope will eventually unravel the mystery behind the worst terror attack in the U.S. since Sept. 11, 2001.

At a Senate Judiciary Committee hearing last week, FBI Director James Comey was asked whether a foreign terror network arranged the couple's introduction and eventual marriage in order for Malik, a Pakistani related to several radical Islamic militants, to slip from Saudi Arabia into the United States after Farook, a self-radicalized American, combed the Internet and traveled abroad in search of a wife.

Evidence of a terror group's involvement in the San Bernardino plot would be a significant development.

"Somebody had to put these two people together," said one FBI source. "It's a big world for them to just find each other."

Farook and Malik were separately radicalized before they started courting and were married, Comey testified. Farook escorted Malik to the U.S. in July 2014, two years after he discussed an earlier terrorist plot with a local friend. That friend, Enrique Marquez, has told investigators that he provided the couple with two semi-automatic assault rifles used in the San Bernardino attack, federal sources said.

Comey also has noted that the couple sent a joint digital message pledging their allegiance to Islamic State on the day of the San Bernardino attack, either just before or after they entered the holiday party in camouflage with guns blazing.

Like the 9/11 hijackers who were recruited, trained and financed in their airplane attacks, were Farook and Malik directed to carry out some kind of an assault before deciding on the gathering at the Inland Regional Center?

Or, as in other, smaller terrorist attacks in the U.S., were they simply so caught up in the social media vitriol from foreign terror groups that the couple acted on their own after stockpiling a huge cache of firearms, ammunition and pipe bomb components?

"At the least, they were inspired to do this," one federal law enforcement official said. "At the worst, they were not only told to do something, but got help. We're working toward the worst."

"This could end up either way," another source said. But, the source added, "it's likely we'll find some other hands involved, some way."

Finding those answers will not be easy. Officials cautioned that it could take weeks or months.

And it is often difficult to prove direction from a terrorist group even after confirmation that someone in the U.S. has been in contact with a foreign terror operative. The difference between inspiring and directing someone to act, the sources said, can be a very fine line.

In the days before the 2009 attack at Ft. Hood, Texas, Anwar al-Awlaki, an American citizen-turned-Al Qaeda recruiter, sent Army Maj. Nidal Hasan at least two direct emails. In the attack, Hasan shouted "Allahu Akbar!" as he killed 13 people.

Afterward, Awlaki posted on his blog, "Nidal Hasan did the right thing." He hailed Hasan as a "hero" and a "man of conscience."

Hasan was court-martialed and sentenced to death; Awlaki was killed in a 2011 U.S. drone strike in Yemen.

In May, two radicals from the Phoenix area attempted to storm a gathering of cartoonists drawing the prophet Muhammad in Garland, Texas. Elton Simpson and Nadir Soofi leaped from their car firing semiautomatic weapons and wounded one security officer before they were killed.

Simpson had been in contact with Mohamed Abdullahi Hassan, an Islamic State recruiter known as Mujahid Miski. Hassan, who grew up in Minneapolis, moved to Somalia reportedly to join the Al-Shabab terror group as a recruiter and has a history of sending computer messages encouraging "lone-wolf-style" attacks.

Simpson and Soofi drove to Texas after Hassan reportedly posted a challenge on Twitter encouraging extremists in the U.S. to follow the lead of two brothers who in January attacked the headquarters of the satirical weekly magazine Charlie Hebdo in Paris, killing 11 people and a police officer.

Shortly before the men opened fire in Garland, they pledged allegiance to "Amirul Mu'mineen," a name authorities believe refers to the Islamic State leadership. After the incident, an Islamic State propagandist tweeted, "Allahu Akbar!!!! 2 of our brothers just opened fire."

Simpson had previously tweeted complaining about the upcoming cartoon contest in Texas. "When will they ever learn?" he asked.

Hassan saw the tweet and reportedly responded, "The brothers from the Charlie Hebdo attack did their part. It's time for brothers in the #US to do their part."

Last month, Hassan turned himself into Somali authorities and told Voice of America's Somali Service that he has left Al-Shabab and denied any involvement in the San Bernardino shootings or any Islamic militant movement. He was indicted in Minnesota for allegedly providing material support to a terrorist group and conspiring to kill people abroad.

"I don't have anything to do with that attack or have any connections with those people," he told the VOA. "I am not part of ISIS [Islamic State] and I have nothing to do with … any other jihadi movement."

Federal authorities are searching for these kinds of social media communications in the San Bernardino case.

The officials said the FBI lab's science and technology teams will probably be able retrieve any erased communications the couple tried to hide by smashing phones or sinking the hard drive, and restore their digital past.

Said one source, "We will find it."

richard.serrano@latimes.com

Twitter: @RickSerranoLAT

teresa.watanabe@latimes.com

Twitter: @TeresaWatanabe

MORE ON SAN BERNARDINO

Amid Farook family violence, brothers were a study in contrasts

Victim of San Bernardino terror attack is recalled as 'one of the good guys'

Enrique Marquez focus of intrigue and mystery in San Bernardino terrorism probe

Copyright © 2016, Los Angeles Times

Updates

7:34 p.m.: This story was updated throughout with new details and background.

2:20 p.m.: This story was updated with new information about investigation.

63°