The clue that turned the case was a microchip, a tiny piece of a triggering device to detonate a bomb.
From it, American and Scottish investigators found a new trail that refuted the conclusions of almost two years of arduous legwork by thousands of agents worldwide--and eventually changed major assumptions about the downing of Pan Am Flight 103 over a small Scottish village just four days before Christmas, 1988.
A key breakthrough, which came just as the largest international criminal probe in history neared an impasse, was almost a fluke. A "brilliant young CIA analyst," as one insider described him, decided to try a new hypothesis: Could someone besides the widely suspected culprits--Palestinian radicals, their Syrian patrons or Iranian militants--have been involved?
The analyst started with a hunch.
He searched for a "signature" that would match the Pan Am bombing with earlier incidents to prove his suspicions. Culling through CIA files, he came up with the 1984 bombing of a French UTA airliner in Chad. A premature explosion blew up the baggage compartment while the plane was still on the ground and wounded 27 people.
He also found a link with the 1986 attempt to blow up the U.S. Embassy in Togo. Officials in Lome, the Togolese capital, had arrested nine people with two suitcases full of plastic explosives.
But the biggest find was an obscure case in Senegal involving the arrest of two men at Dakar airport in February, 1988. In their possession were 20 pounds of sophisticated Semtex plastic and TNT explosives, weapons and several triggering devices.
The analyst's hunch was right.
In all three cases, the "signature" was distinctly Libyan.
In Senegal, the two men who were arrested--Mohammed Marzouk, alias Mohammed Naydi, and Mansour Omran Saber--were both agents of Libyan intelligence. And the triggering devices in their possession matched the microchip fragment from the Pan Am bomb.
The connection has since provided a new set of answers to how and why Pan Am 103 blew up over Lockerbie, Scotland, and who masterminded the blast.
Based on the forensic breakthrough and the links with earlier cases, investigators now believe:
* The regime of Moammar Kadafi carried out the bombing. Libyan intelligence, headed by Abdullah Sanussi, orchestrated the plot.
* The primary motive was revenge for the 1986 U.S. bombing of Tripoli in which about 40 people, including Kadafi's adopted daughter, were killed. "The notion that the 1986 bombing of Tripoli deterred Libyan terrorism is greatly flawed," a leading counterterrorism expert concluded.
* The mysterious bag carrying the bomb-laden Toshiba radio-cassette player on the blown-up Pan Am 103 came from Malta. Investigators believe the bomb was probably flown on an Air Malta flight to Frankfurt, Germany--although the passenger and cargo log has disappeared. In Germany, the cassette player was loaded on Pan Am 103 as an interline bag, unattached to any passenger.
Vital missing pieces in the puzzle finally fell into place. "We followed a lot of leads that looked promising at the beginning but turned out to be nothing," a counterterrorism specialist said. "All the streets followed down to dead ends."
The breakthroughs mean that, unlike the unsolved cases of half a dozen terrorist spectaculars against U.S. targets in the 1980s, the bombing of Pan Am Flight 103 may go to court.
Assistant Atty. Gen. Robert S. Mueller III, who heads the Justice Department's Criminal Division and has been meeting frequently with the FBI on the investigation, appears poised to take the case to a grand jury, according to U.S. officials.
Should the grand jury return sealed indictments, the biggest obstacle may not be just arresting those involved. U.S. authorities already are working with French police now seeking to apprehend one of the Libyan suspects somewhere in North Africa, the officials said.
The problem instead may be competition over which country will get them for trial. French intelligence now believes yet another terrorist attack--the 1989 bombing of UTA Flight 772 over the West African country of Niger--was also directed by Libyan intelligence.
Although the method differed in each case, the signature was once again the telltale clue. The UTA explosive, part of which did not blow up and was retrieved from the Sahara desert, was one of five "suitcase bombs" that investigators believed Libyan intelligence purchased earlier from the notorious Mideast bomb maker Abu Ibrahim.
The primary motive, French officials suspect, was revenge for French aid that enabled Chad--where the UTA flight took on most of its passengers--to rout Libyan troops occupying parts of the neighboring state in 1987. The bomb was probably loaded in Brazzaville, the Congolese capital where the flight originated.
The new evidence on the Pan Am bombing, which began to emerge last summer, contradicts the longstanding belief that it was linked to the Popular Front for the Liberation of Palestine-General Command (PFLP-GC) headed by Ahmed Jibril. The radical PFLP-GC, based in Syria, is outside the PLO umbrella.
The original case was based on the arrest of a cell of 16 operatives in Germany two months before the 1988 Pan Am bombing. The group was found to have five sophisticated bombs, especially designed to blow up aircraft, hidden in electronic equipment.
From his base in Damascus, Jibril was also known to have worked closely with Iran, where he frequently traveled. Investigators believed that Tehran commissioned the PFLP-GC to target an American plane in retaliation for the accidental 1988 U.S. downing of Iran Air Flight 655 over the Persian Gulf in which 290 people died.
The crucial clues that changed the direction of the probe were the detonators. The Palestinian group's detonators were all Czech-made. They were attached to altimeter devices that were set to go off once a plane reached a certain altitude.
But, as forensic experts discovered, the detonator fragment that was culled from the wreckage of Flight 103, which had been scattered over 845 square miles of Scottish countryside, had important discrepancies.
It was of Swiss manufacture--from the same firm that had made the triggering devices that were found on the Libyan agents in Senegal. And it was attached to an ordinary timer that had been set to go off at a certain hour.
The "fingerprints"--as forensic experts call the telltale characteristics of sophisticated explosive devices--of the Pan Am bomb and the PFLP-GC bombs were vastly different. But the fingerprint of the Pan Am bomb was identical to the devices carried by the Libyan agents who were caught in Senegal.
Unfortunately, Senegal freed the Libyan agents, who were never formally charged, in June, 1988. U.S. officials believe their release was part of a package deal in exchange for ending Libyan support for Senegal's opposition forces and for restoring diplomatic relations between the two countries, which had been severed eight years earlier.
At the time, the State Department issued a largely unnoticed--but perhaps tragically prescient--official comment: "We are extremely disappointed by Senegal's action, which raises questions about that country's commitment to the struggle against international terrorism."
Six months later, all 259 people on board Pan Am 103 and 11 others on the ground died when the New York-bound plane, flying 31,000 feet over Scotland, exploded just 38 minutes after takeoff from London's Heathrow Airport.
Crucial evidence held by Senegalese authorities also subsequently disappeared. U.S. investigators have had to rely on photographs of the Libyan agents' materiel to match up the fingerprints of the two bombs.
U.S. officials are unwilling to say where the two Libyans are today, but there are hints that they may be suspects in the Pan Am case. Investigators do believe, however, that the same top Libyan intelligence officials--including Sanussi--masterminded both the operation that was uncovered in Senegal and the Pan Am bombing.
Sanussi has been a constant headache to counterterrorism officials in the United States, Europe, Africa and the Middle East, a well-placed U.S. source said. In 1986, he was sentenced in absentia by an Egyptian court to 10 years' imprisonment for conspiring to assassinate a group of prominent Libyan exiles.
Sanussi also reportedly makes regular use of Libyan Arab Airlines, the national carrier, as a cover for intelligence and terrorist activities. He is believed to have recruited baggage-handlers and airport personnel in Europe and Africa to facilitate his operations.
The new case against Libya has effectively absolved Syria, the PFLP-GC's primary sponsor, of involvement in the Pan Am bombing, counterterrorism officials say.
But neither Damascus nor Jibril has been cleared of plotting terrorist activities. U.S. officials also believe the arrests that broke up the radical Palestinian cell operating in Germany probably foiled what could have been an even bigger terrorist spectacular: the bombing of three other planes over a period of only a few days.
Counterterrorism analysts suggest that one of the Palestinian group's targets was an Iberia Airlines flight from Madrid to Israel via Barcelona. Among its scheduled passengers were members of an Israeli sports team.
A former U.S. intelligence official says that PFLP-GC operatives also had surveyed the Pan Am counter at Frankfurt airport, although no evidence indicated specific plans against Flight 103 as one of the three planes.
The biggest outstanding question in the investigation is what role, if any, Iran may have played, several key U.S. sources say.
"Unlike the connection established between Iran and Jibril, we have nothing to prove Iran's link with Libya," one official said. "But some still believe there's a link (that) we haven't found yet."
Another added: "I'll go to my grave believing Iranians had a role in Pan Am 103."
By contrast, before the latest breakthrough, investigators felt they had a strong circumstantial case of Iranian links with the PFLP-GC cell on the Pan Am bombing.
Through electronic intercepts, intelligence services had monitored messages from Iranian officials known for their militancy who expressed concern after arrests of the PFLP-GC cell. They apparently were worried about the implications for an operation they wanted carried out.
Investigators initially thought the PFLP-GC and Libyan plots were directly connected. One early scenario suggested that Iran funded two separate cells for the same operation. The second cell was to provide a backup if the first one failed.
But investigators have increasingly moved away from the so-called "Cell A, Cell B" scenario.
So far, investigators have no evidence from intercepts or secret meetings of direct contact between Libya and Iran. Indeed, relations between Tripoli and Tehran have been erratic.
But if the PFLP-GC and Libyan plots were not linked, the implications are even more serious. "You have to be terrified that there were two groups out there in the fall of 1988 plotting to bomb planes," the well-placed official said. "That's even scarier."