"48 Hours: NCIS:" The Terrorists, The Spies, The Hackers

Real-life agents of the Naval Criminal Investigative Service reveal their approach to the most important threats of our time

Produced by Josh Gelman

A Navy contractor who wanted to sell secrets, two hackers who stole 220,000 U.S. military personal records and 17 sailors killed in a terrorist attack aboard the USS Cole. NCIS agents open up about their emotions, fears, frustrations and successes in solving investigations that have national and international impact -- the cases they can't forget.

A SPY AMONGST US

NCIS Special Agent Giorgios Sekeroglou:  Espionage has been around for many, many years. …Those are core problems we face on a daily basis.

NCIS Special Agent Sekeroglou: Mostafa Awwad was an espionage investigation. …I was the primary case agent from NCIS.

NCIS Special Agent Sekeroglou: In the fall of 2014, I received a phone call from the FBI … regarding an investigation into Mostafa Awwad. …Mostafa Awwad, a civilian for the Department of Navy, attempted to gather -- information, national defense information, and provide that to a foreign government.

Special Agent James Dougherty | FBI Counterintelligence Division, Norfolk,Va.: NCIS was brought in within hours of us opening the investigation. …The FBI has its strengths and NCIS has its strengths. And so we combined those to-- fully and comprehensively investigate Awwad.

NCIS Special Agent Giorgios Sekerglou

NCIS Special Agent Giorgios Sekerglou

CBS News/Josh Gelman

NCIS Special Agent Sekeroglou: Mostafa Awwad was living in Yorktown, Virginia, not far from Portsmouth where he was working at the Norfolk Naval Shipyard. He had two -- two little kids. He had a family.

FBI Special Agent Dougherty: The Norfolk/Tidewater/Newport News/Hampton Roads-area combined equates to basically the largest naval base on the world, something around the area of 20 percent of all people in this area work for the Navy, the military or one of its cleared defense contractors.

NCIS Special Agent Sekeroglou: Mostafa Awwad was born in Saudi Arabia -- raised in Egypt, and then -- came over to the United States after he married his wife … who was a U.S. citizen.

FBI Special Agent Dougherty: He realized that by marrying her he would be able to quickly obtain U.S. citizenship. It was then his plan to obtain a degree in electrical engineering, which he did at Old Dominion University in Norfolk. And from there, to seek employment either at local cleared defense contractors or with the U.S. Navy, where he could steal secrets on behalf of Egypt.

NCIS Special Agent Sekeroglou: He came onboard approximately February 2014, as a general engineer at the Norfolk Naval Shipyard.

Mostafa Awwad

Mostafa Awwad

FBI

 FBI Special Agent Dougherty: His position in general engineering allowed him widespread access throughout the base.

Just how this newly-hired civilian engineer first caught the attention of the FBI Counterintelligence division is a well-guarded secret.

FBI Special Agent Dougherty: The timing and the circumstances of us opening the investigation on Mostafa Awwad are classified. …As a result, I'm not presently disposed to discuss that. I can tell you when we did open on him we brought to bear the full weight of the FBI and NCIS down on him.

NCIS Special Agent Sekeroglou: During September 2014, Mostafa Awwad engaged an undercover agent that worked for the FBI.

FBI Special Agent Dougherty: We decided to launch what's called a false flag operation. A false flag is essentially an undercover operation in which the FBI poses as a foreign adversary's intelligence service, in this case the Egyptian intelligence service. …The first meeting … occurred … in the Sandy Bottom Nature Park in Hampton, Virginia.

Awwad and undercover agent

Mostafa Awwad, right,meets with "Yousef" -- an FBI undercover agent who Awwad believed was an Egyptian intelligence officer.

FBI

FBI Special Agent Dougherty: This is the park bench that Awwad first met with an individual he knew as Yousef. Now in reality, Yousef was an FBI undercover agent, but Awwad believed that he was an Egyptian intelligence officer. … They introduced each other, per custom for Arab males, they hugged each other and the first thing our undercover noticed was that Awwad was armed. He was carrying a .45-caliber handgun as well as four magazines of ammunition.

FBI Special Agent Dougherty: They sat … for a period of about 45 minutes, at which point Awwad outlined his plans to conduct espionage against the United States.

NCIS Special Agent Sekeroglou: It was at that moment that we realized that Mostafa Awwad's intention was to gather national defense information and provide that to a foreign entity.

Awwad promised he could deliver valuable secrets, but no one imagined that what he had in mind was possibly the navy's biggest, most valuable secret of all. 

FBI Special Agent Dougherty: Behind me is the USS Gerald R. Ford, which is the latest ship in the Navy's newest class of nuclear supercarriers.

FBI Special Agent Dougherty

Special Agent James Dougherty of the FBI Counterintelligence Division. The USS Gerald R. Ford, the latest ship in the Navy's newest class of nuclear supercarriers, is in the background.

CBS News

Under construction for the past seven years at nearby Newport News Shipbuilding, the USS Gerald R. Ford is the most complicated and sophisticated piece of military hardware in the world. 

FBI Special Agent Dougherty: When that ship puts to sea, she'll have between 4,000 and 4,500 American sailors on board. … It's 1,100 feet long, about 250 feet tall, and at $17.5 billion, it's the largest, most expensive, and most powerful warship ever built.

NCIS Special Agent Sekeroglou: Mostafa Awwad had access to a closed-circuit network … called Navy Nuclear Propulsion Information … The layout of the USS Ford resided on this server.

NCIS Special Agent Sekeroglou: It showed the design of every level, every deck of the USS Ford. …It was very critical information that, to a foreign government, they could utilize that information to … identify its vulnerabilities … to a potential attack.

FBI Special Agent Dougherty: Revealing the schematics, and, in particular, the vulnerabilities of the ship, would have been exceptionally dangerous to the individuals on board because it would've given that advantage to an adversary who intended to damage or sink the vessel.

With this much at stake, the success of the FBI/NCIS undercover operation was critical.   

NCIS Special Agent Sekeroglou: Some of our adversaries would've paid a lotta money to get their hands on those design schematics.

INSIDER THREAT

NCIS Special Agent Sekeroglou: Espionage is a very serious threat to the United States.

FBI Special Agent Dougherty: As long as there's two different nations on the planet, there will always be espionage.

NCIS Special Agent Sekeroglou: In this case, Mostafa Awwad had access to the USS Ford … design schematics. He offered that information up to who he believed to be -- an individual from a foreign government, in this case, the Egyptian Intelligence Service.

That "individual" Awwad believed to be an Egyptian agent named Yousef, was in fact an undercover agent for the FBI. 

FBI Special Agent Dougherty: On October 9th, he and Yousef agreed to meet in -- in a hotel room near the Norfolk airport. Prior to departing work that day we saw him download illegally the schematics of the Ford off the Navy's restricted computer system. He put 'em on a disk and he left with them in his coat pocket.

It was at this meeting that Awwad delivered a sample of the Ford's schematics, and then revealed his true intentions.

Mostafa Awwad surveillance

During a meeting between Mostafa Awwad, left, and "Yousef" in a hotel room near the Norfolk airport, Awwad delivered a sample of the USS Ford's schematics, and then revealed his true intentions.

FBI

 FBI Special Agent Dougherty: He pointed to the computer screen and he said, "Here. Right here. You strike this ship with a missile right here, bye-bye, that's it. Sink it." …Well, I think those of us sitting in the -- room down the hall, you probably coulda heard a pin drop when he said that.

NCIS Special Agent Sekeroglou: Mostafa Awwad, in my eyes, was a dangerous person. He proactively, willfully intended to do us harm.

FBI Special Agent Dougherty: He clearly wanted to provide these plans to the Egyptian government, knowing that at some point that ship was gonna go through the Suez and they could sink it with 4,000 American souls on board.

Awwad offered to deliver more of the plans, but this time, for a price.  

NCIS Special Agent Sekeroglou: Mostafa Awwad requested … money in order to purchase -- hidden cameras, in order to better penetrate the defense line of the -- base.

FBI Special Agent Dougherty: On October 23, 2014, down the Wood Duck trail, Mostafa Awwad filled a dead drop. A dead drop is a form of tradecraft in which two individuals … can communicate material and information in a location where neither of them have to meet.

FBI Special Agent Dougherty: This is the actual concealment device that we used for the dead drop. …We placed it a hole down here. …He came down … took it out, unscrewed it. Inside he found $3,000 … Inside of it, he placed an external hard drive containing schematics for the USS Ford and two passport photos which he intended to be used to produce a fraudulent passport and an escape plan.

FBI Special Agent Dougherty: This was a significant moment in the investigation because it showed that he was knowledge and willing to commit espionage.

Six weeks later, Awwad made arrangements for one final delivery.  

FBI Special Agent Dougherty: He woke up to his last sunrise as a free man. He kissed his wife and left her for the last time as he went to work. Only on the way to work he stopped at a local hotel room to meet with Yousef one more time.

NCIS Special Agent Sekeroglou: Mostafa Awwad provided the … the last schematics of the U.S.S. Ford to the undercover agent in exchange for money.

FBI Special Agent Dougherty: At a prearranged time and with a signal to our undercover officers -- FBI SWAT agents came through the door.

NCIS Special Agent Sekeroglou: We arrested Mostafa Awwad, and he was processed.

FBI Special Agent Dougherty: When I first spoke with him he was very stoic. He was surprised, he was shocked. He couldn't believe what had happened.

But once in custody, it didn't take long for Awwad to accept that he had been caught red-handed.

spy-arrest-agents.jpg

Mustafa Awwad, center, in the custody of NCIS Special Agent Giorgios Sekeroglou, left, and
FBI Special Agent James Dougherty"These agents who work in counterintelligence … much of their work is done detouring threats that the public may never know about," ADA Ben Hatch said at an award ceremony honoring Sekerglou, Dougherty and other agents. "As a result of their efforts, this country is made safer every day and our freedoms secured."


NCIS

NCIS Special Agent Sekeroglou: We were fortunate enough to identify Mostafa Awwad and kinda get in front of him before, potentially, he would have caused grave damage to the United States.

FBI Special Agent Dougherty: Ultimately, he was charged with two counts of export violations, but pled to the espionage charge once he and his attorney understood the weight of the evidence against him.

NCIS Special Agent Sekeroglou: Part of the plea agreement was to receive a sentence somewhere between eight and 11 years.

FBI Special Agent Dougherty: The only thing left then was to actually be sentenced by the judge. …Well, unbeknownst to all of us in the courtroom, Judge Jackson … was also the same judge who swore him … as a U.S. citizen.

NCIS Special Agent Sekeroglou: I was shocked to hear that, that just two years earlier … he swore allegiance to the United States government.

FBI Special Agent Dougherty: Judge Jackson was outraged … and he said to Awwad, "You stood before me two years ago … And now you stand before me in this same courtroom as I sentence you for espionage."

FBI Special Agent Dougherty:  He's currently serving 11 years in the federal correctional facility in La Tuna, Texas. …His family moved from the area and are tryin' to rebuild their lives.

With Awwad now behind bars, one question still remains. Was he acting alone or as an agent for a foreign government? 

FBI Special Agent Dougherty: He maintained a dual citizenship with Egypt. …One of the Navy's policies is that you cannot have secret security clearance and be a dual citizen….Records would show that he drove to the Egyptian Embassy in Washington, D.C. …Then later, by his own admission, he admitted that … they would help falsify documents on his behalf saying that he had renounced the citizenship, when in fact he had not, in order to gain that secret security clearance. …And it was soon after that that he began spying.

NCIS Special Agent Sekeroglou: It looked like he was tryin' to start a career -- collectin' information and providing that information to the Egyptian Intelligence Service.

NCIS Special Agent Sekeroglou: One of the takeaways from this case is that insider threat is real, and it's-- it's close to us.

FBI Special Agent Dougherty:  None of us are as smart as all of us. And so the ability of NCIS and FBI to combine resources dramatically increased our efficiency and effectiveness in conducting this investigation.

NCIS Special Agent Sekeroglou: It's very rewarding that … we thwarted someone from attempting to do the U.S. harm. At the same time, we realize that there's folks out there that are intending to do us harm.

CYBERCRIME

Special Agent In Charge Jay Doyle | NCIS: The Department of the Navy and the Department of Defense, as a whole, is always a target for cyberattacks in some way. … When I first started with NCIS, there was six of us really doing cybercrime. And now, I run an office of about 130 people.

Special Agent Mike DeBolt | NCIS: It's a constant game of a chess match between-- law enforcement … and adversaries who want to access and damage our Navy systems.

Special Agent Jay Doyle: Michael DeBolt is … pretty much our expert on cybercrime. He started one of our earliest operations… on criminal activity in cyberspace.

Special Agent DeBolt: In June, 2012 … a group … posted and claimed that they had hacked into a Navy database called the Smart Web Move.

The Smart Web Move database, used to relocate military personnel around the world, contains the personal and private records of every member of the United States Armed Forces and their families.

NCIS agents DeBolt and Doyle

NCIS special agents Mike DeBolt. left, and Jay Doyle

CBS News

Special Agent DeBolt: The group …stole 220,000 records. They then went on to post 30 of those records … publically for everyone to see.

Special Agent Doyle: Names, birth dates, Social Security… The information also had some national security input, because now we had personal information of active-duty members and their families.

Special Agent DeBolt: This was quite alarming to us. We didn't know at this point if this was a terrorist group. We didn't know … if these were foreign adversaries … We just didn't know.

NCIS investigators scoured the internet and found their answer, in of all places, Twitter -- discovering that a hacking group, "Team Digi7al," had executed the breakin, as well as 50 other intrusions into corporate and government data sites. 

Special Agent DeBolt: Team Digi7al members were quite vocal about their activities … Sometimes even taunting police and federal law enforcement, saying, "Come and get me."

Which is exactly what the NCIS investigators did -- following a trail of clues scattered around the internet.

Special Agent DeBolt: One online interview … identified the Team Digi7al leader as Inertia. …We ultimately found Inertia, the user name, in a hacking forum. …It listed out Inertia's former user names that he used. And the very first one … was Nicholas Knight.

Special Agent DeBolt: That was really the break in the case. …We found very quickly a Facebook page and a Twitter page.

Knight's social media revealed a stunning fact: the perpetrator of one of the most damaging cyberattacks on the U.S. Navy was one of their own. 

Nick Knight

NCIS investigators followed a trail of clues  that led them to one of their own: Nick Knight, 27, an enlisted member of the U.S. Navy serving as a system administrator on the USS Truman, a nuclear aircraft carrier.

Facebook

Special Agent DeBolt: He had pictures, some selfies, that he had taken of himself in his Navy uniform. …Nick Knight was a 27-year-old Navy enlisted member.

Special Agent DeBolt: He was a system administrator on a nuclear aircraft carrier, the USS Truman in the nuclear propulsion plant … And not only was he a part of the Navy, but he was about two miles away from my office at that time of the discovery.

Special Agent DeBolt: Now we had to figure out how far would Mr. Knight go? Is he really a terrorist? Is he after all of our secrets?

To find out, Agent DeBolt flew out to the USS Truman, then in the Atlantic on exercises, and set up a fake server on the ship's network, to tempt Knight into repeating his hack.

Special Agent DeBolt: The intent for this reverse cybersting, as I call it, was to see how far Knight would go.

Special Agent DeBolt: In the middle of the night when he went off of his watch, he went to his computer. He saw that this database existed. And he went ahead and conducted an attack … and it succeeded, or so he thought.

When the USS Truman returned to port two weeks later, NCIS was on the dock waiting, and took Knight into custody.

Special Agent DeBolt: I took Knight to an interview room on that day.

Agent DeBolt: What's the name of your group?

Nick Knight: Team Digital.

Nick Knight: Team D-I-G-I-7-T-A-L

Agent DeBolt: Who came up with that?

Nick Knight: I did.

Special Agent DeBolt: He divulged to me that he was doing most of his activities based on the joy, based on the excitement. …He wanted to be a top notch hacker, and he wanted everybody to know it.

Agent DeBolt: Who started it? Who was the leader?

Nick Knight: Me, I guess. I started it.

NCIS agents suspected Knight wasn't working alone and when asked, he didn't hesitate to give up his partner. 

Special Agent DeBolt: His response was, "Daniel Krueger." This other individual that we identified … as Thor.

Daniel Krueger

Daniel Kruger, a civilian, was a 19-year-old computer science student at a community college in Illinois, who met Nick Knight online. Knight and Krueger cofounded Team Digi7al.

Facebook

Daniel Kruger, a civilian, was a 19-year-old computer science student at a community college in Illinois, who had met Knight online. 

Agent DeBolt: You mentioned Navy.Move site and Krueger being involved in that?

Nick Knight: Yeah, he was the only person. He does pretty much 90 percent of the stuff.

Special Agent DeBolt: Knight and Krueger had both cofounded Team Digi7al together … primarily with a -- bunch of juveniles that were listening to Knight and Krueger -- basically list out targets of who they wanted to attack next.

Krueger was arrested at his home and using a federally-issued search warrant, NCIS recovered the stolen data from his computer.

Agent DeBolt to Daniel Krueger: Everything that we're seeing on the Team Digital twitter stuff suggests that it's either you or one other person.

Special Agent Doyle: This type of case, where it looks like it's a couple kids, they're just hacking in for fun, really had much greater ramifications.

In fact, the Navy spent close to half a million dollars to recover from the cyberbreakin. 

Special Agent DeBolt: In the end -- Knight and Krueger were charged with several counts of computer fraud and abuse, as well as obstruction of justice. And they took a plea of conspiracy. …They were sentenced to two years confinement and $500,000 restitution back to the Navy.

Special Agent DeBolt: NCIS continues to bolster their cyberprogram.

NCIS Special Agent Doyle: Because we rely so much on computers to do our basic daily needs … that just provides another venue where we're vulnerable.

Special Agent DeBolt: So … evolving along with the times -- and technologies -- is going to be vital to our ability to protect the nation, and to protect our Department of Navy assets.

THE ATTACK ON THE USS COLE  

Special Agent Robert McFadden | NCIS: With the U.S. Navy and United States Marine Corps as worldwide presence, that represents a target for terrorists.

Special Agent Michael Marks | NCIS, retired: We're not just worried about al Qaeda. We're worried about al Qaeda in the Arabian Peninsula, we're worried about ISIS, we're worried about lone-wolf terrorists.The threat is ever-present. …And we have to remind ourselves that we are targets, that our flag is a target, that our ships are a target.

For NCIS, the critical mission of defending against the growing threat of terrorism was redefined by the United States Navy's guided-missile destroyer, USS Cole.   

Commanding Officer David P. Wroe | USS Cole: Cole is a unique ship. The legacy of what her sailors did. What had happened to her and how that impact on the entire Navy means you can't look at USS Cole like any other destroyer in the Navy.

Commanding Officer Wroe: We call this …the Hall of Heroes, because we have 17 stars inlaid in the deck to represent the 17 sailors that were lost on October 12, 2000.

Bob Schieffer | CBS News Special Report: A surge of violence in the Mideast today including apparent suicide bomb attack on a U.S. Navy warship.

The bombing of the USS Cole was the first successful terrorist attack on a U.S. naval ship in modern history. For NCIS, it would be their greatest challenge.

Special Agent McFadden: The attack against the USS Cole really was unprecedented. The investigation itself, myself, colleagues -- we'd never been involved in an investigation quite like this.

Special Agent Marks: It was a major, major event. It was the biggest crime scene I'd ever been to.

Special Agent Marks: The Cole was transiting from -- Norfolk, Virginia, which she was based at, through the Mediterranean, down through the Suez Canal … She was on her way to the Northern Arabian Gulf to enforce the sanctions against Iraq.

Special Agent McFadden: And then stopped for fuel in Aden, Yemen … before it was scheduled … to be on station as part of the Iraqi containment operations.

Special Agent Marks: Supposed to be no more than three hours. Pull in, top off the tanks and go. No liberty, nobody going ashore.

Special Agent McFadden: Aden was deemed to be the most efficient as well as affording the most stand-off distance for force protection. Because there was actually a facility built, called a refueling dolphin, that was hundreds of meters away from any land point.

USS Cole refueling dophin

The refueling dolphin in Aden-- described as an island out in the middle of the harbor -- is where the USS Cole was located when it was attacked.

Google Earth

Special Agent Marks: The dolphin was there for a counterterrorism measure.  It's like an island out in the middle of the harbor. It's a gas station, basically.

That fuel dock was the safest spot in the harbor for the Cole, because in October of 2000, Americans were not exactly welcome in Yemen.

Special Agent Marks: The whole political situation in the Middle East was very tense.

Special Agent McFadden: There were largest demonstrations I had ever seen in the country at that time. And a large part of the sentiment by the … crowds was against the U.S.

Special Agent Marks: Our operating in Yemen was -- kicking the hornet's nest.

Special Agent McFadden: At approximately 11:17 … a small boat with two individuals aboard approached the USS Cole. …The boat was kind of lost, if you will, amongst the white noise of all the other service vessels.

Special Agent Marks: There would be small ships coming to take off garbage. …There would be people bringing fresh fruits and vegetables. …There was no indication that this boat was any different than any other boat in the harbor.

Special Agent McFadden: The crew … had just gone to -- have lunch. So -- was pretty much ops normal aboard the ship at that time.

Special Agent Marks: What was different about this boat is that it was lined with approximately 2,000 pounds of high explosiveThis was a bomb with a boat around it. A very, very big bomb.

Special Agent McFadden: According to some … of the sailors aboard the Cole, as the ship with the two individuals approached, at least one of them waved. And then detonated the explosives that were aboard that boat.

Press Conference of Sec. of Defense William Cohen: At 15:15 this morning Washington time, a large explosion blew a hole in the hull of the USS Cole as she was mooring in Aden, Yemen to refuel.

Special Agent Marks: The attack on the Cole was-- really was a watershed event for both NCIS and for the U.S. Navy.

Special Agent Marks: The minute that explosion happened they had 17 dead and 42 wounded.

USS Cole damage

The attack on the USS Cole left 17 dead, 42 injured, and a 40x40 foot hole in the port side of the ship after a suspected terrorist bomb exploded during a refueling operation in the port of Aden.

U.S. Navy

Special Agent McFadden: The damage was profound. Approximately a 40 foot by 40 foot hole in the port side of the ship.

Special Agent Marks: Within a couple of seconds -- the ship went from a sound warship to a casualty that was in danger of sinking.

Special Agent McFadden: The ship was in mortal danger at times of actually going under but the ship did an absolutely magnificent job, the crew members, in being able to keep the Cole afloat.

Special Agent Marks: They were performing rescues, they were doing triage, they were doing damage control. The ship was sinking, they had smoke and fire to deal with. And they dealt with it. That's the amazing thing about this whole story, is that they dealt with it, and the way they dealt with it.

President Bill Clinton press conference: If, as it now appears, this was an act of terrorism, it was a despicable and cowardly act. …I have directed the Department of Defense, the FBI and the State Department to send officials to Yemen to begin the investigation.

Special Agent Marks: We were the first response, the first people to actually go … on board the ship the next morning. …And it was evident after … the first five minutes on board that this was something that we'd never faced before.

Special Agent Cathy Clements | NCIS: NCIS's team was about seven people. …My specific mission was to help -- do body recovery of the individuals that they had not removed from the ship yet.

Special Agent Clements: So I teamed with three FBI agents and we began going through the ship -- on the inside of the ship, looking for the remains of those sailors.

Special Agent Marks: The ship had no power so it was dark when you went underneath. Everything was done by flashlight. It was filthy -- from fuel oil being blown all over the ship.

Special Agent Clements: All the decks were covered with diesel fuel. And then -- various -- other debris that we had to figure out if it was part of the device or something that belonged to the ship.

NCIS Special Agent Marks

Special Agent Marks, right, sifted through debris looking for clues following the attack on the USS Cole in October 2000.

NCIS

Special Agent Marks: I was placed in charge of the sifting operation, to look for pieces of the device -- biologic material, which is parts of the bombers. Anything that looked out of place. Things that weren't part of the ship.

Special Agent Marks: From our sifting -- we found-- parts of the device itself, wiring. We found obviously parts of the boats. We found -- parts of the bombers themselves -- which we could use for DNA evidence. And we also found tape -- electrical tape. ..Electrical tape was-- was fingerprint evidence.

Special Agent Clements: The morale of the crew, they were devastated. …They were quiet. And that's very -- unnatural for a Navy -- ship. …The only thing you really heard was the one generator that was keeping the ship afloat. The crew was silent. They were -- on the aft end or the back end of the ship -- under some tarps -- to keep them outta the sun. It was about 125 degrees in the shade.

Special Agent McFadden: But there was a dichotomy, though, because there was an enthusiasm and -- just -- a spirit of comradery that we must continue to carry on our duties and carry on for the sake of, of our fellow sailors that died in the attack. So that was really incredible to see.

NCIS spent 10 days on the USS Cole, combing every deck for the smallest piece of forensic evidence.  But their work was far from over.

Special Agent McFadden: The mission was to figure out who did this.

And their investigation would trigger a manhunt far beyond the Yemen border.

Special Agent Marks: The crime scene … was just the beginning … because the investigation really turned from a localized one to a global one.

Special Agent Clements: We knew that it was Osama bin Laden.

A DEFINING MOMENT 

Sixteen years have passed since terrorists attacked the USS Cole in Aden, Yemen, but those memories are still fresh.   

Special Agent Clements: The USS Cole is not one of those investigations or one of those scenes that you ever really truly forget about. …I think that the scene is indelibly marked on you, regardless of -- how long you're removed from it.

Injured USS Cole sailor

A wounded USS Cole sailor departs a Yemeni hospital enroute to Germany following the Oct. 12, 2000, terrorist bombing attack on his ship in the port of Aden, Yemen.

U.S. Navy

Special Agent McFadden: By the time I arrived in Yemen, the FBI team and NCIS teams had been working for -- a number of days around the clock helping secure the scene aboard the ship. Conducted forensic examinations. And doing as much investigative activity as possible.

Special Agent Marks: This crime scene was like we were in somebody's home. …Those sailors lived on that ship. Those people who were killed were close to them, they were shipmates. And so we not only had the forensic responsibility to recover those bodies, but to do it with as much dignity as we could under the circumstances.

Special Agent Clements: It was very important to us as the -- as NCIS to make sure that we recovered everyone, because I think the families would've -- and they did, expect that of us.

As NCIS agents continued their on-board investigation, there was more work to be done on shore as well. 

Special Agent McFadden: I was assigned the co-leadership of one of the investigative teams that actually conducted the scene examination of the safe house that the two bombers were living in … the location where the cell actually worked on the boat … as well as … the lookout location, another safe house that had a panoramic, virtually perfect view of Tawahi Harbor.

ncis-clements-marks-mcfadde.jpg

NCIS special agents from left, Cathy Clements, Michael Marks and Robert McFadden

CBS News/Josh Gelman

Special Agent Marks: They used an observation post to time how long the U.S. Navy ships were coming in for their brief stops for fuel. So the terrorists realized by doing that after a period of time, they had a three-hour window from the time the ship came in to the time the ship left.

Special Agent McFadden: Ultimately, the results of the investigation, we determined who the, the two suicide attackers were … as well as the support element for the conspiracy.

Special Agent Marks: We knew in our hearts this was an al Qaeda operation.

The work onboard the Cole lasted 10 days before all American personnel, including NCIS, were sent home.  And the Cole, down but not out, was sent home as well.  

Special Agent McFadden: The U.S. Navy contracted with a special ship-hauling vessel that was able to actually lift the Cole up and … sail all the way back to the repair facility in Mississippi.

Special Agent Marks: The investigation shifted to, "Who was responsible for it? Who planned it? Who financed it? Who organized it?"

Special Agent Marks: As the investigation developed, it lead to -- the maritime chief for al-Qaeda, Nashiri. It led to bin Attash who was one of the main organizers of the attack. …Bin Laden trusted him very, very much when he sent him to Yemen to set this operation up.

Special Agent Marks: Bin Attash is in Guantanamo Bay. Nashiri is in Gitmo as well.

As for the Cole, it was repaired, and in 2002, returned to its home port at the Norfolk Naval Station in Virginia and restored to active duty.

Commanding Officer Wroe: You don't go a day without remembering when you're on board this ship that this is, this ship is a little bit more special than every other destroyer in the Navy. …So there's a resonance there that inspires all of us.

Special Agent Clements: NCIS and the Navy were both redefined by this event. …All the force protection -- limitations changed. Everything from NCIS being in every port prior to a ship coming in, to standoff and how close you could get to a Navy ship. …So yes, this was very much a defining moment for us as an agency, as well as the Navy.

Commanding Officer Wroe:  My crew and I are preparing to take Cole out later this year, back into harm's way, back near the waters where she was tested 16 years ago and to do our nation's business, to show the American flag and be prepared to conduct war at sea.

USS Cole Memorial

A memorial honors the 17 sailors on the USS Cole  who lost their lives : Eugene Clodfelter, Richard Costelow,  Lakeina Monique Francis, Timothy Lee Gauna, Cherone Louis Gunn, James Rodrick McDaniels, Mark Ian Nieto, Ronald Scott Owens, Lakiba Nicole Palmer, Joshua Langdon Parlett, Patrick Howard Roy, Kevin Shawn Rux, Ronchester Manangan Santiago, Timothy Lamont Saunders, Graham Swenchonis, Jr., Andrew Triplett and Craig Bryan Wibberley.

CBS News

Special Agent McFadden: As long as there exists -- a violent extremism … terrorism is going to be with us. And so … that remains one of the major planks of the NCIS investigation.

Special Agent Marks: The threat has expanded and the vigilance that goes along with that increasing threat is going to have to expand as well.

The next episode of "48 Hours: NCIS" airs Tuesday, June 6 at 10 p.m. ET/PT on CBS.