Return to Transcripts main page

The Situation Room

U.S. Military Increases Alert Level for Yemen; Bloody Power Struggle Aids al Qaeda; Hunt for A Terror Cell Mastermind; Official: Mastermind is Key ISIS Operative; Report: U.S. Infiltrated North Korean Cyber Warriors; Investigators Hear AirAsia Jet's Cockpit Recordings

Aired January 19, 2015 - 17:00   ET

THIS IS A RUSH TRANSCRIPT. THIS COPY MAY NOT BE IN ITS FINAL FORM AND MAY BE UPDATED.

WOLF BLITZER, CNN HOST: Happening now, terror vacuum -- al Qaeda's most dangerous affiliate is ready to take advantage of the bloody chaos in the capital of a U.S. ally and U.S. troops stand ready to evacuate the American embassy.

On the run -- after bloody attacks and counterattack raids, police connect the dots across Europe and the Middle East, looking for a terror cell mastermind.

First strike -- we have new details on how the U.S. broke into North Korean computers long before the devastating cyber attack on Sony Pictures.

And black box -- we're hearing, for the first time, what was in the crucial recorder recovered from the AirAsia crash scene.

I'm Wolf Blitzer.

You're in THE SITUATION ROOM.

Heavy fighting in the capital of an American ally against al Qaeda. The presidential palace in the line of fire. The prime minister surrounded by gunmen. U.S. troops ready to evacuate the American embassy on a moment's notice.

It's all happening in Yemen, where a power struggle between the government and rebels works to the advantage of al Qaeda's most dangerous affiliate tied to this month's Paris massacre.

There is supposed to be a cease-fire now, but it's very, very dangerous. The situation, extremely worrisome.

Our correspondents, our analysts and our newsmakers, they're all standing by.

And we also have the only Western TV reporter on the ground in Yemen for us, Nick Paton Walsh.

Let's begin with our Pentagon correspondent, Barbara Starr.

She's got the very latest -- Barbara. BARBARA STARR, CNN PENTAGON CORRESPONDENT: Wolf, this evening, government forces in Yemen are said to be in control of the presidential palace. But the surrounding hillsides are in control of the rebels. Everyone is looking for a cease-fire agreement to be signed in the morning. But no one is expecting peace.

(BEGIN VIDEOTAPE)

STARR (voice-over): Gunfire, rebel fighters, checkpoints, smoke rising near the presidential palace. Yemen facing chaos. Many say this is the beginning of an attempted coup by Houthi rebels, even as there were claims of a cease-fire.

LT. COL. JAMES REESE (RET.), CNN GLOBAL AFFAIRS ANALYST: I do not think that the cease-fire will hold. That's what my gut tells me based off of what we've been watching over the last year going on in Sana'a and throughout Yemen.

STARR: Shiite Houthi rebels backed by Iran have been challenging Yemeni authority for months. Yemen's information minister tells CNN's Christiane Amanpour the Yemeni prime minister is surrounded by militias stationed on rooftops around his home.

CHRISTIANE AMANPOUR, CNN INTERNATIONAL ANCHOR: What is the state of control of the government?

UNIDENTIFIED FEMALE: NADIA AL-SAKKAF, YEMEN INFORMATION MINISTER: Almost nonexistent.

AMANPOUR: Are you telling me the government is not in control?

AL-SAKKAF: Yes. Shocking, huh?

STARR: For U.S. Embassy workers, if there is an order to evacuate, they could leave by State Department chartered aircraft, but only if it is safe enough to drive to the airport. If the airport closes, there is another route.

CNN has learned the U.S. military has just increased its alert level. Marines and Special Forces on board the USS Iwo Jima offshore are ready to go immediately, according to a U.S. official in the region.

V-22 and CH-53 helicopters could land on the embassy grounds and quickly airlift out everyone, including nearly 100 Marines already there guarding the embassy.

But an even deeper national security worry -- as Yemen unravels, al Qaeda in the Arabian Peninsula, AQAP, headquartered in Yemen, and laying claim to the Paris "Charlie Hebdo" attacks, has a dangerous advantage.

REESE: When there is turmoil, it's great for AQAP, because everyone is focusing on internally on the country and AQAP kind of sits in the shadows and continues to have some safe haven, continue to train.

(END VIDEO TAPE) STARR: So against the backdrop of all of this, what to do now about al Qaeda in Yemen?

Officials say there is very little they can do but watch and wait.

What about more drone strikes?

Well, first, they are going to have to find where those al Qaeda leaders are hiding out -- Wolf.

BLITZER: But, Barbara, if they have to send those helicopters or those V-22 ospreys from the Iwo Jima to evacuate Americans from the embassy, those kind of aircraft, they are very vulnerable to shoulder- fired surface to air missiles, right?

STARR: They would be, if those kinds of weapons are in the city. And I would think it would be a safe bet that at least some of them are. The thinking is -- and I have to -- you know, really qualify and caveat this -- the thinking is that the Houthis are -- the rebel forces -- are not out to attack Americans. I think that, however, it is very realistic to consider if they have to go, it will be a very dangerous mission for those Marines -- Wolf.

BLITZER: All right, Barbara, thanks very much.

Barbara Starr at the Pentagon.

With fighting in the streets, the prime minister surrounded, U.S. troops ready to evacuate the American embassy if needed.

Let's go live to Yemen right now.

Our senior international correspondent, Nick Paton Walsh, is the only Western TV correspondent on the ground in Yemen.

He's risking his own life right now -- so, Nic, set the scene for us.

What's the latest you're seeing on the streets of the capital?

I know, at times, it can be misleading.

NICK PATON WALSH, CNN SENIOR INTERNATIONAL CORRESPONDENT: Well, it's 1:00 in the morning here, so you would normally expect it to be terrifyingly quiet. But it's a very eerie calm here. Intermittently, we hear gunfire. But a key issue here is the clock is ticking on a political process that's happening behind closed doors and kind of what's being held -- the gun being held to the government's head is that the Houthi militia are said to be around the residence of the prime minister and around the presidential administration, too, the building that we saw today, to the right of me, being slugged out, the artillery, for hours.

Now, of course, the fear is, that we understand from the minister of information, that the Houthis want some sort of change to the constitution in order to release the chief of staff that they say, in their words, they detained in order to make sure the constitution wasn't put in its current form. We really are going to have to have a pretty miraculous common vision from the three or four different sides involved in this process to stop the potential for violence on the streets again tomorrow morning.

We really have -- we see militias on the ground here, not entirely always under the control of their commanders. There were supposed to be two or three cease-fires. Even the cease-fire negotiations themselves came under fire. So it's a very perilous situation here. And each time we see this country spiral more out of control, that simply makes life easier for al Qaeda in the Arabian Peninsula -- Wolf.

BLITZER: I know that they kidnapped these rebels, what, the chief of staff to the Yemeni president. You had a chance, I think, to go over to the U.S. Embassy. There are what, 100 Marines there, diplomats. There are a lot of other American civilians working with NGOs, non- governmental organizations.

What are they doing?

What are they saying to you?

ROBERTSON: I have to be honest, they were comparatively calm. I mean, at times, there are moments where, obviously, they can hear the same things we can hear, the shelling in the distance. And that raises a sense of alarm.

But I have to bear in mind that a lot of the Western embassies here are pretty well fortified and they're in a pretty well protected area. The American one, in particular, it has a lot of defenses in place there over a particularly sprawling compound.

So it's going to take a lot, I think, for them to want to pull out of here. But the precautions you're talking about are really a result, obviously, of Benghazi. The State Department doesn't want to be seen to have not put preparations in here in case the situation wildly spirals out of control.

The Houthis, well, one of their slogans is "Death To America!" they don't seem to want that fight right now here in Yemen. But the real issue, I think, is al Qaeda in the Arabian Peninsula. All this chaos here, everyone reminds us that that kind of vacuum, that kind of mess, frankly, on the streets just gives them a better opportunity to attack at will wherever they wish. That's another threat potentially in the days ahead.

BLITZER: All right, Nic, we're going to check back with you.

Be careful over there.

Nick Paton Walsh in Sana'a, Yemen.

Meanwhile, mass killings, shootouts, police raids, mass arrests -- over the span of just a few days, Europe has been rocked by terror. And with troops now in the streets of major European cities, there are growing concerns that the threat is far larger than imagined. There's a stepped-up hunt for terror suspects. Foreign ministers are gathering in Brussels today, urgently trying to stay ahead of that threat. And it's very grave.

CNN's Phil Black is joining us now from Brussels with more.

What's the latest there -- Phil?

PHIL BLACK, CNN CORRESPONDENT: Wolf, this was the first meeting of European foreign ministers since the attacks in Brussels and since police disrupted another terror plot here in Belgium.

And in a statement that followed, there was a surprise admission. Only now, it said, for the first time was there a real awareness by European countries of the need to work together to fight the common threat of terrorism.

(BEGIN VIDEOTAPE)

BLACK (voice-over): Heavily armed security on the streets of Brussels and Antwerp, a sight that country hasn't seen in 35 years. Officials say five Belgian nationals have been charged with participation in a terrorist organization following last week's raids.

But the hunt for the presumed mastermind behind the suspected terror cell continues, according to Belgium's justice minister.

Authorities say the group, which included individuals returning from Syria, planned to target police officers. Orders for the failed terror plot may have come from ISIS, according to Belgian newspaper reports.

France also remains on high alert, while the search continues for the person whose DNA was found on the kosher market assailant's gun. Sources tell CNN another person, whose DNA was found in Amedy Coulibaly's car, is one of nine suspects already in custody. Coulibaly had proclaimed allegiance to ISIS.

There's growing concern terror groups are directing European recruits to return home and launch attacks. European officials are meeting in Brussels on Monday to tackle the spread of terrorism and potential threats.

FEDERICA MOGHERINI, E.U. HIGH REPRESENTATIVE FOR FOREIGN AFFAIRS: As the threat is not only the one we faced in Paris, but also spreading in many other parts of the world, starting from Muslim countries, we need to strengthen our way of cooperating together, first of all with other countries, and then internally.

BLACK: The spate of violence began when Cherif and Said Kouachi attacked the "Charlie Hebdo" office. An ongoing investigation into the gunmen reveals intelligence failures by French officials. Authorities thought Cherif gave up terror activities when he started selling counterfeit goods, so they stopped monitoring him. But a source tells CNN Cherif used that money to buy weapons. Another misstep -- a delay in passing along an alert about one of the brothers' phones. By the time it reached the country's main domestic spy agency, a source tells CNN the brothers were no longer under surveillance.

And investigators now believe Cherif and his brother traveled to Yemen in 2011 via Oman, even though Cherif's passport was confiscated a year earlier.

It's believed the brothers received funding for the terror attacks from al Qaeda in the Arabian Peninsula, which has claimed responsibility for the "Charlie Hebdo" attack.

(END VIDEO TAPE)

BLACK: One of the suspects in the Belgium terror plot, who was and survived a shootout with police, today denied, through his lawyer, any involvement in the planned attack against police officers here. He says that he was only delivering a pair of shoes on behalf of his mother to another one of the suspects, who was killed during the police raid.

So far, five people have been charged here, one man in Greece, two more in France. But the authorities here do not believe they have found everyone connected to this attack -- Wolf.

BLITZER: Yes, I suspect those numbers are going to go up in the coming days.

Phil Black, thanks very much.

Let's get the latest now on the investigation.

Our justice correspondent, Pamela Brown, is joining us from Paris -- Pamela, what are you hearing from your sources specifically about the role of ISIS in these various terror plots, in Belgium particularly?

PAMELA BROWN, CNN CORRESPONDENT: Well, it appears, Wolf, that with the Belgian terror cell, that it appears ISIS actually had a very heavy hand in this plot, this imminent plot to attack police officers there. This is according to a senior Belgian counterterrorism official we've been speaking with.

The belief among officials there is that ISIS was directing this plot through a point person who was in Greece and that some of the suspects now in police custody and the two that were killed in Verviers had actually fought alongside ISIS in Syria.

So you see there, there is a tie there and there is a belief, Wolf, speaking to sources, that other jihadis returning from Syria who fought alongside ISIS are spread out throughout Europe and that is who authorities, of course, are trying to track down right now. There's really a manhunt underway as we speak -- Wolf.

BLITZER: How much -- what are you hearing about the concern, I assume it's significant, about the unraveling situation in Yemen -- you heard Nick Paton Walsh report there -- given that the Paris killers, the Kouachi brothers, had trained there, al Qaeda in the Arabian Peninsula, in Yemen?

BROWN: Well, Yemen has been a tremendous concern among U.S. authorities for years. It's been con -- you know, there's been a pipeline over there for years, where people have gone and trained alongside AQAP in Yemen, including the Kouachi brothers, as you point out.

And so as the situation continues to unravel and escalate in Yemen, the concern is heightened among sources I've been speaking with. Of course, the concern here, Wolf, is that AQAP will gain even more control, have more free rein in Yemen and continue to use it as sort of a breeding ground for other terrorists. And sources I've been speaking with, they say they are just as concerned about Yemen as they are about the situation in Syria with ISIS -- Wolf.

BLITZER: Pamela Brown in Paris for us.

Thank you.

Let's go in depth now with CNN intelligence and security analyst Bob Baer. He's a former CIA operative.

Also joining us, CNN terrorism analyst, Paul Cruickshank.

And our military analyst, retired Lieutenant General Mark Hertling -- Bob, we heard Phil Black's reporting. Authorities there stopping -- stopped monitoring Cherif Kouachi after he began supposedly selling counterfeit goods, because they believed he had given up terror activities.

Is that common, for authorities to stop surveillance on individuals that they think have moved on and are not going to necessarily get involved in terrorism?

ROBERT BAER, FORMER CIA OPERATIVE: The way you have to -- a lot of people flirt with Islamic jihad, show up in Syria or in Yemen, don't like it, come home, lead normal lives.

It happens with Hamas and the Islamic jihad in Israel. You know, and so to keep them on a list, they have to appear active. And what these guys, I'm sure, didn't do is call back to Yemen or call back to known members of ISIS or al Qaeda. So they stayed off the lines. They apparently used their wives' phones to communicate with each other. And it looks like they went out of country for personal meetings, maybe Athens, maybe Madrid. That's yet to be determined.

So these guys would have gotten instructions in Yemen: Go home, be quiet, stay out of the mosques, shave your beard, don't espouse Islamic doctrine or the rest of it, and it worked, apparently. And the French have so many people to watch, 5,000 on that list, as we understand, that they probably moved down the list, unfortunately.

BLITZER: Yes, and if you're going to do significant surveillance, you need at least ten, maybe 15 people per person you're watching in order to maintain around-the-clock surveillance.

General Hertling, it's believed that Cherif Kouachi used the money he earned selling those counterfeit goods to buy weapons. Here's the question. Can authorities follow that money trail now to find others who may have aided the Kouachi brothers in their attack on the "Charlie Hebdo" offices?

HERTLING: Absolutely. In fact, that's the critical piece. A smart counterintelligence guy will not go after cells. They'll go after the network. So the key issue is you find the arms dealers. You find the guys giving the orders. You find the financiers. Those are the important pieces of the network that you go after. You have to attack that network while defending after -- against the cells, Wolf.

BLITZER: Paul, Europe, as you know, remains very much on high alert right now, especially in Belgium. There are armed guards on the streets. This for the first time in more than 30 years. Why is Belgium so particularly vulnerable?

CRUICKSHANK: Well, there's been a lot of radicalization for quite some time in Belgium. But the big part of the vulnerability comes from the fact so many Belgian nationals, extremists in Belgium, have traveled to Syria to join groups like ISIS. Around 350 have traveled from Belgium. Belgium is a pretty small country, so that's a big number for a country like Belgium.

About 200 are thought to be there right now, mostly with ISIS, and about 100 are thought to have returned, including the gunmen who were killed in that operation against a suspected ISIS-related cell in Verviers, Wolf.

One of the reasons why so many have traveled is there's a facilitation network in Belgium called Sharia for Belgium. And they transported a lot of people early on to Syria to join with groups like ISIS, and so they already have people there to welcome more and more people. And it was like a snowball effect. More and more people could go, because there were people to welcome them when they got there.

So those are some of the reasons why Belgium has got such a huge problem right now when it comes to returning foreign fighters. There's a concern, as well, that part of this cell that they took down last week remains still at large. They feel they've disrupted the major part of the plot, but some of these people may still be at large with access to weapons and may try to avenge the two comrades of theirs that were killed in this operation last week in Verviers, Wolf.

BLITZER: Bob Baer, western intelligence sources have told CNN there may be as many as 20 so-called sleeper terrorist cells in Belgium, France, Germany, the Netherlands, maybe other countries in Europe. How likely is it that there are similar cells here in the United States?

BAER: Well, Wolf, as I've said, I think it's inevitable we're going to get hit at some point as long as we're engaged in the Middle East, which we will be for years. We're going to -- someone's going to take revenge against us. Now, whether they're Europeans that come in without a visa or there's

cells established, and I've talked to law enforcement. And they believe that they're here, there are cells, but they cannot get any details on them. They just -- there's fragmentary intelligence. There are cells in this country. This is what I'm told. I, of course, have not seen the evidence. But I trust these law enforcement officials.

BLITZER: Paul, you've got some more information you're picking up on what's going on in Europe right now, right?

CRUICKSHANK: That's right, Wolf. I just got off the phone with a senior Belgian counterterrorism official, and this is in regard to somebody who was picked up in Greece over the weekend. A lot of speculation that this could have been the key link person between the group and ISIS.

Well, it turns out it's not the guy the Belgians suspect was the key link person, but somebody else; but they think that he may have played some kind of role. But an individual who's suspected to be the key link person is still at large. He's a Belgian Moroccan ISIS fighter who traveled from Syria to Greece. And you see him on screen right now. He's name is Abdul Hamid Abiud, and he's suspected of recently being in Syria, so travel to Greece and to be -- have been in phone contact with the cell in Verviers, who were in that safe house, running the show from Greece, being the key link person back to the ISIS leadership in Syria and Iraq, Wolf.

And this really is a game changer, with ISIS involved in orchestrating a terrorist plot in the west, in Europe. The leadership have not been involved in this way before.

And now European intelligence agencies suspect that they are and this individual you just saw on the screen playing the key role they believe from Greece. He's believed to still be at large. The Belgians brought in the CIA to try and find him, but they have not been able to find him up til this point, Wolf.

BLITZER: Well, one of the problems is it's so easy in Europe to cross borders. You don't need passports. You don't need documents. You just drive across the border, right?

CRUICKSHANK: That's absolutely right. And we've seen a lot of these people come in through Greece and sort of drive into Europe. And you can go just about anywhere, especially in the Schengen area, which is most of continental Europe. There are no borders anymore. This is a border-free zone. There's some controls when you go into the United Kingdom and a few other countries, but when it comes to most of the continent of Europe, it's just like the United States. You can travel anywhere you like. There are no checkpoints.

And the trouble is that, unlike in the United States, there's not as good cooperation between all the various European intelligence agencies, so there are meetings going on right now where they're trying to improve this cooperation and intelligence sharing, Wolf.

BLITZER: I want you to stand by, Paul, Mark Hertling, Bob Baer. All of you stand by. We're going to continue to follow this story.

Also coming up, long before the devastating North Korean cyberattack on Sony Pictures, was the United States breaking into North Korea's computers? There's new information coming in.

And for the first time, we're hearing what was in that all-important so-called black box recovered from the AirAsia crash scene. We have details.

(COMMERCIAL BREAK)

BLITZER: We're watching for North Korean reaction to a new report that the United States broke in on the computer networks North Korea has been using for cyberattacks.

Today's "New York Times" made the revelation, saying that's how the U.S. quickly discovered North Korea was actually behind the attack on Sony Pictures.

CNN's Brian Todd is joining us here in THE SITUATION ROOM with new details on what we're learning. It's pretty amazing what's going on.

BRIAN TODD, CNN CORRESPONDENT: It is. U.S. intelligence agencies being hammered with some serious questions about this tonight. The "Times" report says the NSA started breaching North Korea's hacking networks back in 2010.

The North Koreans have denied hacking Sony, but this report says U.S. intelligence agencies were able to track it back so quickly because of the monitoring they had done for at least a few years.

(BEGIN VIDEOTAPE)

TODD (voice-over): Tonight, Kim Jong-un knows how the U.S. government came to point the finger at him for the Sony cyberattack.

BARACK OBAMA, PRESIDENT OF THE UNITED STATES: We can confirm that North Korea engaged in this attack.

TODD: How could the president be so confident just a few weeks after Sony had been hacked? The "New York Times" reports the National Security Agency, America's super-secret eavesdroppers, had infiltrated North Korea's shadowy cyber warriors since 2010.

IRA WINKLER, FORMER NSA ANALYST: It appears that what happened was NSA established footholds in various parts of North Korea's computer infrastructure. They basically established footholds in the Chinese region, and they apparently established footholds in the Malaysian region.

TODD: "The Times" reports the NSA began spying on North Korea's computer networks after becoming increasingly concerned that the regime was bolstering its teams of hackers.

Kim Jong-un's government has a secretive hacking team called Bureau 121 and a larger cyber branch called the Reconnaissance General Bureau, commanded by General Kim Yung Cho (ph), a former bodyguard for Kim's father and grandfather.

MARK RASCH, RASCH TECHNOLOGY AND CYBERLAW: One of the things that the North Koreans have done is they've built up effective and strong teams with skills and training designed simply to break into computers and to destroy them and also to gather intelligence.

TODD: If the U.S. intelligence community knew Kim's hackers were building their capabilities, did anyone in the U.S. government warn Sony that it could be attacked? North Korea had warned as early as last June that it considered Sony's movie "The Interview" an act of war.

JAMES FRANCO, ACTOR: Nice tank. Is that real?

UNIDENTIFIED MALE: It was a gift to my grandfather from Stalin.

FRANCO: In my country it's pronounced Stallone.

TODD: A U.S. intelligence official acknowledged to CNN Sony was not warned.

(END VIDEOTAPE)

TODD: But that same U.S. official said prior to the Sony hack, U.S. intelligence had not noticed North Korea doing anything more than its usual run-of-the-mill hacking activities. Denial-of-service attacks, so-called phishing e-mails. No one had any indication that such a massive cyberattack against Sony was in the works -- Wolf.

BLITZER: Brian, what about the meeting that the director of national intelligence, James Clapper, had with the North Koreans in early November? He went over there to bring an American back, as you recall. That was before the Sony hack. Did any of this at all come up?

TODD: No. No, the Clapper meeting with that General Yung Cho (ph), who demands North Korea's hackers, that was on November 7. The Sony hack began around November 24.

Now, Clapper, we are told, did know North Korea's hacking capabilities then, but a U.S. Official tells us he was there just to secure the release of Americans Kenneth Bae and Matthew Todd Miller, and because of the sensitivities of that mission, he had to focus on that. He could not derail that release by bringing up hacking. That meeting with that general was already very contentious, Wolf.

BLITZER: All right. Brian Todd, thanks very much.

Joining us now in THE SITUATION ROOM is the "New York Times" national security correspondent, David Sanger. He co-wrote today's article in the "New York Times" on the U.S. infiltration of North Korea's secret cyberwar networks.

Amazing reporting, David, to you and your team. Not the first time you have broken a story like this. Why couldn't the U.S. have warned Sony Pictures, "Get ready. This may be in the works"? Did they have some advance indication that Sony Pictures was going to be the target because of this film, "The Interview"?

DAVID SANGER, NATIONAL SECURITY CORRESPONDENT, "THE NEW YORK TIMES": Well, the interesting thing is the North Koreans themselves protested "The Interview" as far back as last June and said that, if Sony released it, it could be an act of war.

It's not clear that anybody in the intelligence community connected that with those spear (ph) phishing attacks and denial-of-service attacks that you just heard Brian refer to. In fact, in our reporting it showed that, when they saw the North Koreans do these, they thought it was the ordinary things the North Koreans do to many. Although the fact that there was so much at Sony, you would have thought might have raised some alarm bells. Apparently, it didn't. Sony executives tell me they never received any particular warning.

BLITZER: So from President Obama on down, the FBI director, the NSC director, everybody else, they're convinced 100 percent this was the work of North Korea, although some outside cyber warfare experts, they have their own doubts, right?

SANGER: That's right. There are a lot of people with a lot of doubts, and that's because the data that has been made public so far by the United States has to do with things like what I.P. addresses these came from, Internet protocol addresses, many of which are in China. And many of those experts have said, look, you can fake where you're sending a cyberattack from.

The difference here is, wolf, as soon as we saw President Obama make the statements that he made at that news conference on December 19, to accuse North Korea of it and their leadership of it, you knew, given his own caution on intel issues, that he must have seen or heard something. And we went out to try to figure out what that was, and what it was, of course, is just what we've reported now.

BLITZER: It's amazing reporting and really eye-opening. Here's the question. Did the administration try to tell the "New York Times," "Please, don't report this. This could undermine national security if, for example, North Korea and the Chinese, others knew exactly how sophisticated the U.S. operation was"?

SANGER: The administration is always concerned when you're reporting on national security issues, and this story was no different. And we try to be very careful when we do these, not only to show our conclusions back to the administration, but to hear their concerns.

And most of the time, those concerns are how specific are you about where this computer malware is put, because obviously, they don't want their adversaries to go after it.

In this case, I would say the objections were about as they usually are. We try to accommodate them on some issues while still telling this overall story. And I think in this case, Wolf, we've struck the balance right. But, you know, there are always going to be people who are going to disagree on that.

BLITZER: But there are certain details you withheld? SANGER: Some details we withheld. And you'll also recall that some

details are in the Snowden documents and "Der Spiegel," the German magazine, published some just this weekend that dealt with North Korea with some specificity, as well.

BLITZER: All right, David. I want you to stand by. We have more to discuss.

Also, helping us dig deeper on this story, Chris Whiton. He was the deputy special envoy for human rights on North Korea during the Bush administration. Also Gordon Chang, he's a columnist for Forbes.com. He's author of "Nuclear Showdown: North Korea Takes on the World."

I want everybody to stand by. All you guys stand by. Let's continue this conversation. New information coming in on North Korea cyber- warfare. We'll take a quick break. We'll be right back.

(COMMERCIAL BREAK)

BLITZER: So we now know why the United States quickly blamed North Korea directly for the cyberattacks on Sony Pictures. Today's "New York Times" revealed the U.S. National Security Agency actually infiltrated North Korea's cyber warfare network years ago. It's an amazing story.

David Sanger is still with us. Christian Whiton and Gordon Chang are with us, as well.

Christian, what -- what did you think when you read that story in "The New York Times"? It was sort of breathtaking to me, but you're an expert in this area. Were you surprised by what you heard?

CHRISTIAN WHITON, FORMER ENVOY TO NORTH KOREA: I wasn't. I'm a big fan of the NSA and of electronics intelligence. And I thought it was terrific that we have penetrated some of these networks and know what North Korea is up to, know the extent of Chinese cooperation and Chinese enabling of North Korean cyber technology.

And you know, I think there are some lessons to be learned here. We have been on the defensive in the cyber realm. We've been on the offensive, as David has also reported, against countries like Iran, but not so much against other cyber adversaries. We focused a lot on defending U.S. government systems. And maybe we need to be better at going on the offensive and proactively defending U.S. companies in addition to the U.S. government. But I think the NSA is up to -- is, you know, doing a pretty good job.

BLITZER: Well, if you believe the story, it's amazing.

Gordon Chang, is it possible that North Korea didn't know it was being hacked, that this is all a big surprise to them?

GORDON CHANG, COLUMNIST, FORBES.COM: Actually, I think North Korea certainly knew what was going on, because the North Korean authorities worked very closely with the Chinese, and the Chinese know exactly what we're doing. So, you know, there's a cyberwar that's going on between the United

States and China. It is much more intensified than it was in the past. So the North Koreans certainly had to know what was going on in this case.

BLITZER: Let me ask David Sanger. What do you think?

SANGER: I think they did. You know, after the United States attacks with Israel on Iran and their nuclear facilities.

BLITZER: The Stuxnet.

SANGER: The Stuxnet attack, or a bigger program called Olympic Games. The North Koreans had to know that they would be high up on the target list. They may not know how or when. Actually, I think one of the more remarkable things is that we haven't seen more cyber activity against North Korea.

BLITZER: You think the North Koreans, Christian, actually did it? Or do you think that somebody made it look like they did it, and the administration, the U.S. government, bought into that?

WHITON: No, I think they did it. And I think what this reporting substantiates is that we really do have very good forensic tools in place. That was always probably the implication. even people like myself who have been critics of the Obama administration believed the president when this happened.

First of all, there's no incentive for a cover-up or for misleading the public. Second of all, if you looked at some of the skeptics who said this was disgruntled Sony employees, this wasn't a nation state, their evidence was really quite thin. It included monitoring things like chat rooms. You know, the tools available to the NSA, to cyber command, to the FBI, et cetera, are just much more substantial. And I think we now, you know, can conclude quite conclusively that the deniers were wrong, that the government was right in this case.

BLITZER: So Gordon, will this "New York Times" report, all the reporting now about this, will it hurt the U.S.'s ability to monitor North Korea down the road?

CHANG: Well, I think the Chinese certainly knew of our capabilities. They have very important capabilities of their own. You know, what they got, of course, was confirmation but nonetheless, this is no surprise to the Chinese either.

And I think that this is important. You know, the "Times" reporting here is extraordinary. It confirms what a lot of people suspected, but nonetheless, we learned a lot of detail here, but this is, of course, things the Chinese know day to day, because they are, you know, the No. 1 cyber hackers in the world.

BLITZER: One of the most fascinating things about the report, in addition to the main headline, is the discovery, at least I learned, the so-called beacons that the United States is using and the amount of money the U.S. government is spending in this cyber warfare. Billions, you say, right?

SANGER: That's right. Now, that covers offensive work, defensive work, but you know, you think about what we were discussing with the National Security Agency during the Snowden revelations of 2013. People were focused on the privacy issues, the bolt (ph) collection here in the United States.

That's not what the NSA spends most of its time and money doing. They spend most of their time and money defending systems and trying to get into the hardest to break into foreign systems. And North Korea has certainly been on that list.

BLITZER: I want everybody to stand by. Much more to assess. We'll take a quick break. We'll be right back.

(COMMERCIAL BREAK)

BLITZER: We now know why the United States quickly blamed North Korea for the attack on Sony Pictures. Today's "New York Times" revealed the U.S. National Security Agency had actually infiltrated North Korea's cyber warfare network years ago.

Christopher Whiton, if you believe all the reports out there, the North Koreans engaged in cyber warfare against South Korean banks, very effectively, in 2013. They went after Sony Pictures last year. Should we be bracing for more North Korean cyber warfare attacks?

CHRISTIAN WHITON, FORMER STATE DEPARTMENT SENIOR ADVISER: I think so. But they may very well combine it with other provocations that are from their toolkit which they frequently turn. You know, they sank a South Korean ship in 2010. They had their third nuclear test in 2013. We are sort of due for another. And people who look closely at North Korea's nuclear testing facility have seen some signs that they are getting ready potentially for another.

Could also be deception. So this is probably part of a phase of agitation that North Korea goes through, usually then it moderates a little and tries to extract concessions from South Korea or the U.S.

BLITZER: What do you anticipate happening next, Gordon?

GORDON CHANG, COLUMNIST, FORBES.COM: Well, I think there is certainly going to be more cyber attacks on the United States because there really has not been effective costs imposed on the North Koreans or the Chinese.

The real issue is going to be what's happening inside the regime in North Korea. There are signs of distress. We have seen things that are inconsistent with the dominant narrative that Kim Jong-Un, the ruler, has quickly consolidated control. So I expect that there is going to be more trouble in -- probably in the next couple of months ahead, especially as we head to the end of the year.

BLITZER: You're talking about unrest in North Korea, is that what you're talking about, Gordon? CHANG: Problems inside the regime itself, where you have basically

Kim Jong-Un has not been able to exert effective control, where you have a lot of regime elements who are trying to even the score.

We've got to remember that there has been a lot of unexplained deaths since 2010, most of them thought to be related to the transition of power to Kim Jong-Un from his father, Kim Jong-Il, and that's why I think that we're going to see problems.

BLITZER: All right.

CHANG: As this distress radiates out.

BLITZER: David, very quickly, based on all the conversations you've had with U.S. government officials, experts, what should we be bracing for?

DAVID SANGER, NEW YORK TIMES NATIONAL SECURITY CORRESPONDENT: You know, cyber weapons are useful for North Korea in the way that nuclear weapons and missiles are not. You know, nuclear weapons are an on/off switch, you drop one and then you wait for your country to be retaliated against in a massive way.

In as with a cyber weapon, I think the North Koreans believe they can turn it up or down and in this case, they may have misjudged to some degree because I don't think they necessarily expected that the United States would have a national response to it.

BLITZER: If you think about it, silly movie like "The Interview" to have caused this commotion.

David Sanger, excellent reporting as usual. Thanks very much.

Gordon Change, Christian Whiton, guys, thanks to you as well.

Coming up, we are hearing part of what's on that cockpit voice recording from the AirAsia jet that crashed into the Java Sea.

And at the top of the hour, we have more on the power struggle that's opening up new opportunities right now for al Qaeda.

(COMMERCIAL BREAK)

BLITZER: We're learning new details about what happened in the minutes before the AirAsia jet crash. Investigators now say they've actually listened to what's one -- jet's cockpit voice recorder.

Let's bring in our aviation correspondent Rene Marsh. She's working the story.

And you're learning new information.

RENE MARSH, CNN AVIATION CORRESPONDENT: That's right, Wolf. The investigators listened to what the pilots were saying and how they said it. They were also listening for other sounds like gunshots and explosions. Now tonight based on the cockpit recordings, investigators are taking one theory off the table.

(BEGIN VIDEOTAPE)

MARSH (voice-over): Indonesian investigators say they do not hear gunfire or explosions on AirAsia Flight 8501's cockpit voice recorder. But what brought down the plane still remains a mystery.

ANDREAS HANANTO, INDONESIAN AIR SAFETY INVESTIGATOR (Through Translator): The voice from the cockpit does not show any sign of a terrorist attack. There's only the pilot sounding very busy.

MARSH: The AirAsia flight was traveling through severe thunderstorms when it crashed. The question remains, was weather, mechanical failure or human error to blame?

CHRISTOPHER VOSS, MANAGING DIRECTOR, INSITE SECURITY: You want to make absolutely certain before you rule anything in for sure or rule anything out for sure.

MARSH: Former FBI agent Christopher Voss investigated the crash of TWA Flight 800.

VOSS: If it's not a terrorist problem that brought this plane down then that means that they potentially have to look for other manifestations of that problem, either on another flight crews or another airplanes. There has to be a hidden danger there for other planes that are still flying.

MARSH: The doomed flight was an Airbus A-320 with more than 3500 in operation worldwide. Meanwhile, the painstaking search for bodies continues. Two more found Sunday. But the waterlogged remains are decomposing. And only 53 of the 162 on board have been recovered.

SUPRIYADI, INDONESIAN SEARCH AND RESCUE (Through Translator): Due to currents, the divers couldn't even reach the bottom which constrained our operation.

MARSH: Divers were able to pull up debris like passenger seats. But the fuselage remains at the bottom of the Java Sea. It's the largest piece of wreckage at nearly 100 feet long and is believed to hold some of the missing bodies.

(END VIDEOTAPE)

MARSH: Well, there are so many outstanding questions like what exactly -- exactly were the pilots saying? The transcript of their conversation is only halfway complete. Investigators hope to finish this week. But before they draw any concrete conclusions, they will compare that information with information on the flight data recorders which, of course, has details of how the systems were functioning. They'll also look at the debris. That tells a story as well.

Wolf, as far as a big picture, we're expecting a preliminary report next week. We're hoping that we get more details on that report.

BLITZER: I'm sure you will. All right. Good work. Thanks very much.

Coming up, al Qaeda's most dangerous affiliate ready to take advantage of bloody chaos in the capital of a U.S. ally as U.S. troops stand ready to evacuate Americans.

(COMMERCIAL BREAK)