Finding the militants who overwhelmed a small security force at the consulate isn't going to be easy.
The key suspects are members of the Libyan militia group Ansar al-Shariah. The group has denied responsibility, but eyewitnesses saw Ansar fighters at the consulate, and U.S. intelligence intercepted phone calls after the attack from Ansar fighters to leaders of al-Qaida in the Islamic Maghreb, or AQIM, bragging about it. The affiliate's leaders are known to be mostly in northern Mali, where they have seized a territory as large as Texas following a coup in the country's capital.
But U.S. investigators have only loosely linked "one or two names" to the attack, and they lack proof that it was planned ahead of time, or that the local fighters had any help from the larger al-Qaida affiliate, officials say.
If that proof is found, the White House must decide whether to ask Libyan security forces to arrest the suspects with an eye to extraditing them to the U.S. for trial, or to simply target the suspects with U.S. covert action.
U.S. officials say covert action is more likely. The FBI couldn't gain access to the consulate until weeks after the attack, so it is unlikely it will be able to build a strong criminal case. The U.S. is also leery of trusting the arrest and questioning of the suspects to the fledgling Libyan security forces and legal system still building after the overthrow of Moammar Gadhafi in 2011.
The burden of proof for U.S. covert action is far lower, but action by the CIA or special operations forces still requires a body of evidence that shows the suspect either took part in the violence or presents a "continuing and persistent, imminent threat" to U.S. targets, current and former officials said.
"If the people who were targeted were themselves directly complicit in this attack or directly affiliated with a group strongly implicated in the attack, then you can make an argument of imminence of threat," said Robert Grenier, former director of the CIA's Counterterrorism Center.
But if the U.S. acts alone to target them in Africa, " it raises all kinds of sovereignty issues ... and makes people very uncomfortable," said Grenier, who has criticized the CIA's heavy use of drones in Pakistan without that government's support.
Even a strike that happens with permission could prove problematic, especially in Libya or Mali where al-Qaida supporters are currently based. Both countries have fragile, interim governments that could lose popular support if they are seen allowing the U.S. unfettered access to hunt al-Qaida.
The Libyan government is so wary of the U.S. investigation expanding into unilateral action that it refused requests to arm the drones now being flown over Libya. Libyan officials have complained publicly that they were unaware of how large the U.S. intelligence presence was in Benghazi until a couple of dozen U.S. officials showed up at the airport after the attack, waiting to be evacuated — roughly twice the number of U.S. staff the Libyans thought were there. A number of those waiting to be evacuated worked for U.S. intelligence, according to two American officials.
In Mali, U.S. officials have urged the government to allow special operations trainers to return, to work with Mali's forces to push al-Qaida out of that country's northern area. AQIM is among the groups that filled the power vacuum after a coup by rebellious Malian forces in March. U.S. special operations forces trainers left Mali just days after the coup. While such trainers have not been invited to return, the U.S. has expanded its intelligence effort on Mali, focusing satellite and spy flights over the contested northern region to track and map the militant groups vying for control of the territory, officials say.