Reports that Matter

The 9/11 Commission Report · 2004

8.2 Late Leads—Mihdhar, Moussaoui, and KSM

Section 39 of 63

8.2 Late Leads—Mihdhar, Moussaoui, and KSM

In chapter 6 we discussed how intelligence agencies successfully detected some of the early travel in the planes operation, picking up the movements of Khalid al Mihdhar and identifying him, and seeing his travel converge with someone they perhaps could have identified but did not—Nawaf al Hazmi—as well as with less easily identifiable people such as Khallad and Abu Bara. These observations occurred in December 1999 and January 2000.The trail had been lost in January 2000 without a clear realization that it had been lost, and without much effort to pick it up again. Nor had the CIA placed Mihdhar on the State Department's watchlist for suspected terrorists, so that either an embassy or a port of entry might take note if Mihdhar showed up again.

On four occasions in 2001, the CIA, the FBI, or both had apparent opportunities to refocus on the significance of Hazmi and Mihdhar and reinvigorate the search for them. After reviewing those episodes we will turn to the handling of the Moussaoui case and some late leads regarding Khalid Sheikh Mohammed.

January 2001: Identification of Khallad

Almost one year after the original trail had been lost in Bangkok, the FBI and the CIA were working on the investigation of the Cole bombing. They learned of the link between a captured conspirator and a person called "Khallad." They also learned that Khallad was a senior security official for Bin Ladin who had helped direct the bombing (we introduced Khallad in chapter 5, and returned to his role in the Cole bombing in chapter 6).55 See CIA cable, Base/FBI comments on draft cable, Nov. 27, 2000; FBI electronic communication, USS Cole investigation, Nov. 21, 2000; FBI electronic communication, USS Cole investigation, Jan. 10, 2001 (draft).

One of the members of the FBI's investigative team in Yemen realized that he had heard of Khallad before, from a joint FBI/CIA source four months earlier. The FBI agent obtained from a foreign government a photo of the person believed to have directed the Cole bombing. It was shown to the source, and he confirmed that the man in that photograph was the same Khallad he had described.56 For the recollection of the FBI agent, see Al S. interviews (Aug. 26, 2003; Sept. 15, 2003). See also FBI report of investigation, interview of source, July 18, 2000; attachment to FBI electronic communication, USS Cole investigation, Jan. 10, 2001 (draft); FBI electronic communication, UBL investigation, Jan. 16, 2001.

The CIA asked that a Kuala Lumpur surveillance photo of Mihdhar be shown to the joint source who had identified Khallad. In early January 2001, two photographs from the Kuala Lumpur meeting were shown to the source. One was a known photograph of Mihdhar, the other a photograph of a then unknown subject. The source did not recognize Mihdhar. But he indicated he was 90 percent certain that the other individual was Khallad.58 CIA cable, "Request for January 2000 Malaysian Surveillance Photos," Dec. 12, 2000; CIA cable, "Photo of UBL Associate," Dec. 27, 2000; CIA cable,"Review of Malaysia 'Khaled' Photos," Jan. 5, 2001.

This meant that Khallad and Mihdhar were two different people. It also meant that there was a link between Khallad and Mihdhar, making Mihdhar seem even more suspicious.59 The CIA knew that Mihdhar and Khallad had both been to Bangkok in January 2000.They had not yet discovered that Khallad, traveling under an alias, had actually flown to Bangkok with Mihdhar. Still, as Director Tenet conceded in his testimony before the Joint Inquiry, the Kuala Lumpur meeting took on additional significance once Khallad was identified as having attended the meeting. See Joint Inquiry report, p. 149. Yet we found no effort by the CIA to renew the long-abandoned search for Mihdhar or his travel companions.

267

In addition, we found that the CIA did not notify the FBI of this identification. DCI Tenet and Cofer Black testified before Congress's Joint Inquiry into 9/11 that the FBI had access to this identification from the beginning. But drawing on an extensive record, including documents that were not available to the CIA personnel who drafted that testimony, we conclude this was not the case. The FBI's primary Coleinvestigators had no knowledge that Khallad had been in Kuala Lumpur with Mihdhar and others until after the September 11 attacks. Because the FBI had not been informed in January 2000 about Mihdhar's possession of a U.S. visa, it had not then started looking for him in the United States. Because it did not know of the links between Khallad and Mihdhar, it did not start looking for him in January 2001.60 For Tenet and Black testimony, see Joint Inquiry testimony of George Tenet, Oct. 17, 2002; Joint Inquiry testimony of Cofer Black, Sept. 26, 2002. For documents not available to CIA personnel who drafted the testimony, see, e.g., FBI electronic communication, UBL investigation, Jan. 16, 2001; FBI emails between Al S. and Michael D., re: source, Jan. 9-11, 2001; FBI electronic communication, USS Cole investigation, Jan. 4, 2001; DOJ Inspector General interview of Jennifer M., Dec. 9, 2002. For the views of the FBI investigators, see DOJ Inspec tor General interviews of Steve B., Sept. 16, 2002; Nov. 14, 2002; Al S. interviews (Aug. 26, 2003; Sept. 15, 2003). The DOJ Inspector General came to the same conclusion. See DOJ Inspector General report,"A Review of the FBI's Handling of Intelligence Information Related to the September 11 Attacks" (hereinafter "DOJ IG 9/11 Report"), July 2, 2004, pp. 308–310.

This incident is an example of how day-to-day gaps in information sharing can emerge even when there is mutual goodwill. The information was from a joint FBI/CIA source who spoke essentially no English and whose languages were not understood by the FBI agent on the scene overseas. Issues of travel and security necessarily kept short the amount of time spent with the source. As a result, the CIA officer usually did not translate either questions or answers for his FBI colleague and friend.61 DOJ Inspector General interview of Michael D., Nov. 6, 2002; Michael D. interview (May 4, 2004); DOJ Inspector General interview of Chris, Nov. 27, 2002.

For interviews without simultaneous translation, the FBI agent on the scene received copies of the reports that the CIA disseminated to other agencies regarding the interviews. But he was not given access to the CIA's internal operational reports, which contained more detail. It was there—in reporting to which FBI investigators did not have access—that information regarding the January 2001 identification of Khallad appeared. The CIA officer does not recall this particular identification and thus cannot say why it was not shared with his FBI colleague. He might not have understood the possible significance of the new identification.62 For the internal CIA reports to which the FBI did not have access, see CIA cable,"UBL Operative Khallad," Jan. 3, 2001; CIA cable, source debriefing, Jan. 5, 2001.The FBI agent informed us that he was unaware how such internal CIA communications worked, or that the operational cables even existed, and so did not know to ask for them. Such messages are routinely not shared in order to protect intelligence sources and methods. In this case, application of the routine procedure did not serve that purpose because the FBI agent was aware of the source's identity as well as the methods used to obtain the information. Moreover, the FBI agent also may have been absent from the room when the identification was made.The source had brought a sheaf of documents with him that the FBI agent left the room to copy while the interview of the witness continued. Because of the circumstances of the interview site, the agent would have been absent for a significant period of time. In addition, the case officer was frequently given photographs from a broad range of CIA stations to show to this particular witness. He did not focus on the purpose of showing the photographs; he was only concerned with whether the source recognized the individuals. DOJ Inspector General interview of Michael D., Nov. 6, 2002; Michael D. interview (May 4, 2004); DOJ Inspector General interview of Chris, Nov. 27, 2002.

In June 2000, Mihdhar left California and returned to Yemen. It is possible that if, in January 2001, the CIA had resumed its search for him, placed him on the State Department's TIPOFF watchlist, or provided the FBI with the information, he might have been found—either before or at the time he applied for a new visa in June 2001, or when he returned to the United States on July 4.

Spring 2001: Looking Again at Kuala Lumpur

By mid-May 2001, as the threat reports were surging, a CIA official detailed to the International Terrorism Operations Section at the FBI wondered where the attacks might occur. We will call him "John." Recalling the episode about the Kuala Lumpur travel of Mihdhar and his associates, "John" searched the CIA's databases for information regarding the travel. On May 15, he and an official at the CIA reexamined many of the old cables from early 2000, including the information that Mihdhar had a U.S. visa, and that Hazmi had come to Los Angeles on January 15, 2000.63 John interview (Apr. 2, 2004). See also CIA email, Dave to John, "Re: Liaison Response," May 18, 2001. The old reporting from early 2000 that was reexamined included CIA cable, "Transit of UBL Associate Khalid Through Dubai," Jan. 4, 2000; CIA cable,"Recent Influx of Suspected UBL Associates to Malaysia," Jan. 5, 2000; CIA cable,"UBL Associates: Flight Manifest for MH072," Jan. 9, 2000; CIA cable,"UBL Associates: Identification of Possible UBL Associates," Mar. 5, 2000. For cable information, see CIA records, audit of cable databases.

The CIA official who reviewed the cables took no action regarding them. "John," however, began a lengthy exchange with a CIA analyst, whom we will call "Dave," to figure out what these cables meant. "John" was aware of how dangerous Khallad was—at one point calling him a "major league killer." He concluded that "something bad was definitely up." Despite the U.S. links evident in this traffic, "John" made no effort to determine whether any of these individuals was in the United States. He did not raise that possibility with his FBI counterpart. He was focused on Malaysia.64 For a record of the exchange between John and Dave, see CIA emails, Dave to John, May 17, 18, 24, 2001; CIA email, Richard to Alan, identification of Khallad, July 13, 2001. For the account of John's FBI counterpart, see Michael Rolince interview (Apr. 12, 2004). For John's focus on Malaysia, see DOJ Inspector General interview of John, Nov. 1, 2002.

268

"John" described the CIA as an agency that tended to play a "zone defense." He was worrying solely about Southeast Asia, not the United States. In contrast, he told us, the FBI tends to play "man-to-man."65 DOJ Inspector General interview of John, Nov. 1, 2002.

Desk officers at the CIA's Bin Ladin unit did not have "cases" in the same sense as an FBI agent who works an investigation from beginning to end. Thus, when the trail went cold after the Kuala Lumpur meeting in January 2000, the desk officer moved on to different things. By the time the March 2000 cable arrived with information that one of the travelers had flown to Los Angeles, the case officer was no longer responsible for follow-up. While several individuals at the Bin Ladin unit opened the cable when it arrived in March 2000, no action was taken.66 For the account of the desk officer, see DOJ Inspector General interview of Michael D., Oct. 31, 2002. For cable information, see CIA records, audit of cable databases.

The CIA's zone defense concentrated on "where," not "who." Had its information been shared with the FBI, a combination of the CIA's zone defense and the FBI's man-to-man approach might have been productive.

June 2001: The Meeting in New York

"John's" review of the Kuala Lumpur meeting did set off some more sharing of information, getting the attention of an FBI analyst whom we will call "Jane." "Jane" was assigned to the FBI's Cole investigation. She knew that another terrorist involved in that operation, Fahd al Quso, had traveled to Bangkok in January 2000 to give money to Khallad.67 DOJ Inspector General interviews of Jane, Nov. 4, 2002; July 16, 2003.

"Jane" and the CIA analyst, "Dave," had been working together on Cole-related issues. Chasing Quso's trail, "Dave" suggested showing some photographs to FBI agents in New York who were working on the Cole case and had interviewed Quso.68 DOJ Inspector General interview of Jane, Nov. 4, 2002; DOJ Inspector General interview of Dave, Oct. 31, 2002.

"John" gave three Kuala Lumpur surveillance pictures to "Jane" to show to the New York agents. She was told that one of the individuals in the photographs was someone named Khalid al Mihdhar. She did not know why the photographs had been taken or why the Kuala Lumpur travel might be significant, and she was not told that someone had identified Khallad in the photographs. When "Jane" did some research in a database for intelligence reports, Intelink, she found the original NSA reports on the planning for the meeting. Because the CIA had not disseminated reports on its tracking of Mihdhar, "Jane" did not pull up any information about Mihdhar's U.S. visa or about travel to the United States by Hazmi or Mihdhar.69 DOJ Inspector General interviews of Jane, Nov. 4, 2002; July 16, 2003.

"Jane," "Dave," and an FBI analyst who was on detail to the CIA's Bin Ladin unit went to New York on June 11 to meet with the agents about the Cole case. "Jane" brought the surveillance pictures. At some point in the meeting she showed the photographs to the agents and asked whether they recognized Quso in any of them. The agents asked questions about the photographs—Why were they taken? Why were these people being followed? Where are the rest of the photographs?70 DOJ Inspector General interview of Jane, Nov. 4, 2002; DOJ Inspector General interview of Dave, Oct. 31, 2002; DOJ Inspector General interview of Russ F., Sept. 17, 2002; DOJ Inspector General interview of Steve B., Sept. 16, 2002.

269

The only information "Jane" had about the meeting—other than the photographs-were the NSA reports that she had found on Intelink. These reports, however, contained caveats that their contents could not be shared with criminal investigators without the permission of the Justice Department's Office of Intelligence Policy and Review (OIPR).Therefore "Jane" concluded that she could not pass on information from those reports to the agents. This decision was potentially significant, because the signals intelligence she did not share linked Mihdhar to a suspected terrorist facility in the Middle East. The agents would have established a link to the suspected facility from their work on the embassy bombings case. This link would have made them very interested in learning more about Mihdhar.71 "Jane" did not seek OIPR's permission to share this information at the meeting."Jane" also apparently did not realize that one of the agents in attendance was a designated intelligence agent, so she could have shared all of the information with that agent regardless of the caveats. No one who was at the meeting suggested that option, however. DOJ Inspector General interview of Steve B., Sept. 16, 2002; DOJ Inspector General interview of Jane, July 16, 2003.These caveats were different from the legal limits we discussed in section 3.2.The Attorney General's July 1995 procedures concerned FISA information developed in an FBI intelligence investigation.This, however, was NSA information.These particular caveats were the result of the Justice Department's and NSA's overabundance of caution in December 1999. During the millennium crisis,Attorney General Reno authorized electronic surveillance of three U.S. persons overseas. Because the searches were not within the United States, no FISA warrant was needed. Reno approved the surveillances pursuant to section 2.5 of Executive Order 12333 with the proviso that the results of these particular surveillances not be shared with criminal investigators or prosecutors without the approval of the Office of Intelligence Policy and Review. Because of the complexity of determining whether particular reporting was the fruit of particular surveillances, NSA decided to place these caveats on all its Bin Ladin–related reporting, not just reporting on the surveillances authorized by Reno.As a result, these caveats were placed on the reports relating to Mihdhar even though they were not covered by Reno's December 1999 order. See DOJ memo, Reno to Freeh, FISA surveillance of a suspected al Qaeda operative, Dec. 24, 1999; NSA email, William L. to Karen C.,"distribution restrictions," Dec. 10, 1999; NSA email,William L. to Anthony L.,"doj restrictions," Dec. 20, 1999; NSA email,William L. to Brian C.,"dissemination of terrorism reporting," Dec. 29, 1999. See also NSA memo,Ann D. to others,"Reporting Guidance," Dec. 30, 1999. In May 2000, it was brought to the Attorney General's attention that these caveats prevented certain attorneys in the Terrorism and Violent Crime Section (TVCS) from reading the reporting. After discussions with NSA, the caveats were changed to specifically permit dissemination of these reports to designated attorneys in the TVCS and two attorneys in the U.S. Attorney's Office for the Southern District of New York. See NSA memo, Joan R. to Townsend and Reynolds,"Resumed Delivery of Classified Intelligence to TVCS," June 9, 2000; NSA memo, Hayden to Asst.Attorney General,"Proposal to Provide UBL-related Product to U.S.Attorney's Office/Southern District of New York," Aug. 30, 2000. The sad irony is that the agents who found the source were being kept from obtaining the fruits of their own work.

"Dave," the CIA analyst, knew more about the Kuala Lumpur meeting. He knew that Mihdhar possessed a U.S. visa, that his visa application indicated that he intended to travel to New York, that Hazmi had traveled to Los Angeles, and that a source had put Mihdhar in the company of Khallad. No one at the meeting asked him what he knew; he did not volunteer anything. He told investigators that as a CIA analyst, he was not authorized to answer FBI questions regarding CIA information. "Jane" said she assumed that if "Dave" knew the answers to questions, he would have volunteered them. The New York agents left the meeting without obtaining information that might have started them looking for Mihdhar.72 For the facts known by Dave at this time, see CIA records, audit of cable databases; see also CIA email, Dave to John, timeline entries, May 15, 2001. For CIA analyst's role, see DOJ Inspector General interview of Dave, Oct. 31, 2002. For Jane's account, see DOJ Inspector General interview of Jane, July 16, 2003.

Nevertheless, in this case KSM's fears were not realized. Mihdhar received a new U.S. visa two days after the CIA-FBI meeting in New York. He flew to New York City on July 4. No one was looking for him.

August 2001: The Search for Mihdhar and Hazmi Begins and Fails

During the summer of 2001 "John," following a good instinct but not as part of any formal assignment, asked "Mary," an FBI analyst detailed to the CIA's Bin Ladin unit, to review all the Kuala Lumpur materials one more time. She had been at the New York meeting with "Jane" and "Dave" but had not looked into the issues yet herself. "John" asked her to do the research in her free time.73 DOJ Inspector General interview of Mary, Oct. 29, 2002.

270

"Mary" began her work on July 24.That day, she found the cable reporting that Mihdhar had a visa to the United States. A week later, she found the cable reporting that Mihdhar's visa application—what was later discovered to be his first application—listed New York as his destination. On August 21, she located the March 2000 cable that "noted with interest" that Hazmi had flown to Los Angeles in January 2000. She immediately grasped the significance of this information.74 For Mary's account, see DOJ Inspector General interview of Mary, Oct. 29, 2002. For the reporting regarding Mihdhar and Hazmi, see CIA cable, Khalid's passport, Jan. 4, 2000; CIA cable, Mihdhar's visa application, Jan. 5, 2000; CIA cable, Hazmi entered U.S., Mar. 6, 2000. For Mary's cable access information, see CIA records, audit of cable databases.

"Mary" and "Jane" promptly met with an INS representative at FBI headquarters. On August 22, the INS told them that Mihdhar had entered the United States on January 15, 2000, and again on July 4, 2001. "Jane" and "Mary" also learned that there was no record that Hazmi had left the country since January 2000, and they assumed he had left with Mihdhar in June 2000. They decided that if Mihdhar was in the United States, he should be found.75 DOJ Inspector General interview of Mary, Oct. 29, 2002; DOJ Inspector General interview of Jane, Nov. 4, 2002.

They divided up the work. "Mary" asked the Bin Ladin unit to draft a cable requesting that Mihdhar and Hazmi be put on the TIPOFF watchlist. Both Hazmi and Mihdhar were added to this watchlist on August 24.76 DOJ Inspector General interview of Mary, Oct. 29, 2002; Intelligence report, Watchlisting of Bin Ladin–related individuals,Aug. 23, 2001; Joint Inquiry testimony of Christopher Kojm, Sept. 19, 2002.The watchlist request included Mihdhar, Nawaf al Hazmi, Salah Saeed Mohammed Bin Yousaf (they did not yet realize this was an alias for Tawfiq bin Attash, a.k.a. Khallad), and Ahmad Hikmat Shakir (who assisted Mihdhar in Kuala Lumpur).

"Jane" took responsibility for the search effort inside the United States. As the information indicated that Mihdhar had last arrived in New York, she began drafting what is known as a lead for the FBI's New York Field Office. A lead relays information from one part of the FBI to another and requests that a particular action be taken. She called an agent in New York to give him a "headsup" on the matter, but her draft lead was not sent until August 28. Her email told the New York agent that she wanted him to get started as soon as possible, but she labeled the lead as "Routine"-a designation that informs the receiving office that it has 30 days to respond.77 Jane told investigators that she viewed this matter as just another lead and so assigned no particular urgency to the matter. DOJ Inspector General interviews of Jane, July 16, 2003; Nov. 4, 2002. For the draft lead, see attachment to FBI email, Jane to Craig D., "Re: FFI Request," Aug. 28, 2001. For the final version, see FBI electronic communication,"Request to Open a Full Field Investigation," Aug. 28, 2001.

The agent who received the lead forwarded it to his squad supervisor. That same day, the supervisor forwarded the lead to an intelligence agent to open an intelligence case—an agent who thus was behind "the wall" keeping FBI intelligence information from being shared with criminal prosecutors. He also sent it to the Cole case agents and an agent who had spent significant time in Malaysia searching for another Khalid: Khalid Sheikh Mohammad.78 FBI email, Craig D. to John L., "Fwd: Re: FFI Request," Aug. 28, 2001; FBI email, John L. to Steve and others,"Fwd: Re: FFI Request,"Aug. 28, 2001. For an introduction to these legal limits and "the wall," see section 3.2. In December 2000, pursuant to concerns of the FISA Court, the New York Field Office began designating certain agents as either intelligence or criminal agents. Intelligence agents could see FISA materials and any other information that bore cautions about sharing without obtaining the FISA Court's permission or permission from the Justice Department's OIPR. FBI electronic communication,"Instructions re FBI FISA Policy," Dec. 7, 2000.

The suggested goal of the investigation was to locate Mihdhar, determine his contacts and reasons for being in the United States, and possibly conduct an interview. Before sending the lead, "Jane" had discussed it with "John," the CIA official on detail to the FBI. She had also checked with the acting head of the FBI's Bin Ladin unit. The discussion seems to have been limited to whether the search should be classified as an intelligence investigation or as a criminal one. It appears that no one informed higher levels of management in either the FBI or CIA about the case.79 While one witness recalls a discussion with a senior FBI official, that official denies that such a discussion took place. The other alleged participant does not recall such a meeting. John interview (Apr. 2, 2004); Michael Rolince interview (Apr. 12, 2004); Jane interview (July 13, 2004); DOJ Inspector General interview of Rodney M., Nov. 5, 2002. For investigation's goal, see FBI electronic communication,"Request to Open a Full Field Investigation," Aug. 28, 2001. There is no evidence that the lead, or the search for these terrorist suspects, was substantively discussed at any level above deputy chief of a section within the Counterterrorism Division at FBI headquarters.

271

One of the Cole case agents read the lead with interest, and contacted "Jane" to obtain more information. "Jane" argued, however, that because the agent was designated a "criminal" FBI agent, not an intelligence FBI agent, the wall kept him from participating in any search for Mihdhar. In fact, she felt he had to destroy his copy of the lead because it contained NSA information from reports that included caveats ordering that the information not be shared without OIPR's permission. The agent asked "Jane" to get an opinion from the FBI's National Security Law Unit (NSLU) on whether he could open a criminal case on Mihdhar.80 DOJ Inspector General interviews of Jane, July 16, 2003; Nov. 4, 2002; DOJ Inspector General interviews of Steve B., Sept. 16, 2002; Nov. 14, 2002; Jane interview ( July 13, 2004). FBI email, Jane to John L.,"Fwd: Re: FFI Request," Aug. 29, 2001. The analyst's email, however, reflects that she was confusing a broad array of caveats and legal barriers to information sharing and rules governing criminal agents' use of information gathered through intelligence channels. There was no broad prohibition against sharing information gathered through intelligence channels with criminal agents.This type of sharing occurred on a regular basis in the field.The court's procedures did not apply to all intelligence gathered regardless of collection method or source. Moreover, once information was properly shared, the criminal agent could use it for further investigation.

"Jane" sent an email to the Cole case agent explaining that according to the NSLU, the case could be opened only as an intelligence matter, and that if Mihdhar was found, only designated intelligence agents could conduct or even be present at any interview. She appears to have misunderstood the complex rules that could apply to this situation.81 FBI email, Jane to Steve, NSLU Response,Aug. 29, 2001."Jane" says she only asked whether there was sufficient probable cause to open the matter as a criminal case and whether the criminal agent could attend any interview if Mihdhar was found. She said the answer she received to both questions was no. She did not ask whether the underlying information could have been shared. Jane interview ( July 13, 2004). The NSLU attorney denies advising that the agent could not participate in an interview and notes that she would not have given such inaccurate advice.The attorney told investigators that the NSA caveats would not have precluded criminal agents from joining in any search for Mihdhar or from participating in any interview. Moreover, she said that she could have gone to the NSA and obtained a waiver of any such caveat because there was no FISA information involved in this case.There are no records of the conversation between "Jane" and the attorney. "Jane" did not copy the attorney on her email to the agent, so the attorney did not have an opportunity to confirm or reject the advice "Jane" was giving to the agent. DOJ Inspector General interview of Sherry S., Nov. 7, 2002. "Jane" asked the New York agent assigned to the Mihdhar search to sign a FISA acknowledgment form indicating the agent understood how he had to treat FISA information. Because no FISA information was involved, she should not have required him to sign such a form. To the extent she believed, incorrectly, that the Attorney General's 1995 procedures applied to this situation, there was in fact an exception in place for New York. DOJ Inspector General interview of Sherry S., Nov. 7, 2002. More fundamentally,"Jane" apparently understood the welter of restrictions to mean, in workday shorthand, that any information gathered by intelligence agencies should not be shared with criminal agents.This was incorrect. DOJ Inspector General interviews of Jane, July 16, 2003; Nov. 4, 2002.

The FBI agent angrily responded:

Whatever has happened to this—someday someone will die—and wall or not—the public will not understand why we were not more effective and throwing every resource we had at certain "problems."

Let's hope the National Security Law Unit will stand behind their decisions then, especially since the biggest threat to us now, UBL, is getting the most "protection."

"Jane" replied that she was not making up the rules; she claimed that they were in the relevant manual and "ordered by the [FISA] Court and every office of the FBI is required to follow them including FBI NY."82 FBI emails between Steve B. and Jane, re: NSLU Response, Aug. 29, 2001.While the agent expressed his frustration with the situation to "Jane," he made no effort to press the matter further by discussing his concerns with either his supervisor or the chief division counsel in New York.

It is now clear that everyone involved was confused about the rules governing the sharing and use of information gathered in intelligence channels. Because Mihdhar was being sought for his possible connection to or knowledge of the Cole bombing, he could be investigated or tracked under the existing Cole criminal case. No new criminal case was needed for the criminal agent to begin searching for Mihdhar. And as NSA had approved the passage of its information to the criminal agent, he could have conducted a search using all available information. As a result of this confusion, the criminal agents who were knowledgeable about al Qaeda and experienced with criminal investigative techniques, including finding suspects and possible criminal charges, were thus excluded from the search.83 Attorney General Ashcroft testified to us that this and similar information-sharing issues arose from Attorney General Reno's 1995 guidelines, discussed in chapter 3, and specifically from a March 1995 memorandum of then Deputy Attorney General Jamie Gorelick. John Ashcroft testimony, Apr. 13, 2004; DOJ memo, Gorelick to White, "Instructions on Separation of Certain Foreign Counterintelligence and Criminal Investigations," Mar. 4, 1995. We believe the Attorney General's testimony does not fairly or accurately reflect the significance of the 1995 documents and their relevance to the 2001 discussions.Whatever the merits of the March 1995 Gorelick memorandum and the subsequent July 1995 Attorney General procedures on information sharing, they did not apply to the information the analyst decided she could not share with the criminal agent. As discussed earlier, the reason "Jane" decided she could not share information was because the initial information on Mihdhar had been analyzed by the NSA.This reason was unrelated to either of the 1995 documents.The Gorelick memorandum applied to two particular criminal cases, neither of which was involved in the summer 2001 information-sharing discussions. As the FBI agent observed in his email, Part A of the 1995 procedures applied only to information obtained pursuant to a FISA warrant. None of the Mihdhar material was FISA information.There was an exemption for the Southern District of New York from Part B of the 1995 procedures, so they did not apply. Also, the 1995 procedures did not govern whether information could be shared between intelligence and criminal agents within the FBI, a separation that the Bureau did not begin making formally until long after the procedures were in place.The 1995 procedures governed only the sharing of information with criminal prosecutors. Even in that situation, the restriction obliged running the information through the OIPR screen. What had happened, as we discussed in chapter 3, was a growing battle within the Justice Department during the 1990s, and between parts of Justice and the FISA Court, over the scope of OIPR's screening function and the propriety of using FISA-derived information in criminal matters.The FISA Court's concern with FBI sloppiness in its FISA applications also began to take a toll: the court began designating itself as the gatekeeper for the sharing of intelligence information; the FBI was required to separately designate criminal and intelligence agents; and the court banned one supervisory FBI agent from appearing before it. By late 2000, these factors had culminated in a set of complex rules and a widening set of beliefs—a bureaucratic culture—that discouraged FBI agents from even seeking to share intelligence information. Neither Attorney General acted to resolve the conflicting views within the Justice Department. Nor did they challenge the strict interpretation of the FISA statute set forth by the FISA Court and OIPR. Indeed, this strict interpretation remained in effect until the USA PATRIOT Act was passed after 9/11. Simply put, there was no legal reason why the information the analyst possessed could not have been shared with the criminal agent. On August 27,"Jane" requested the NSA's permission to share the information with the criminal agents, but she intended for the information only to help the criminal agents in their ongoing Cole investigation. She still did not believe they could be involved in the intelligence investigation even if the NSA permitted the information to be shared. DOJ IG 9/11 Report, July 2, 2004, p. 339. The next day the NSA notified its representative at FBI headquarters that it had approved the passage of the information to the criminal agents. NSC email, Carlene C. to Richard K.,"Response to FBI Sanitization Request,"Aug. 28, 2001.Thus,"Jane" had permission to share the information with the criminal agent prior to their August 29 emails.

The search was assigned to one FBI agent, and it was his very first counterterrorism lead. Because the lead was "routine," he was given 30 days to open an intelligence case and make some unspecified efforts to locate Mihdhar. He started the process a few days later. He checked local New York databases for criminal record and driver's license information and checked the hotel listed on Mihdhar's U.S. entry form. Finally, on September 11, the agent sent a lead to Los Angeles, because Mihdhar had initially arrived in Los Angeles in January 2000.84 DOJ Inspector General interview of Robert F., Dec. 18, 2002; FBI electronic communication, Los Angeles lead, Sept. 10, 2001.

272

We believe that if more resources had been applied and a significantly different approach taken, Mihdhar and Hazmi might have been found. They had used their true names in the United States. Still, the investigators would have needed luck as well as skill to find them prior to September 11 even if such searches had begun as early as August 23, when the lead was first drafted.85 Hazmi and Mihdhar used their true names to obtain California driver's licenses and open New Jersey bank accounts. Hazmi also had a car registered and had been listed in the San Diego telephone book. Searches of readily available databases could have unearthed the driver's licenses, the car registration, and the telephone listing. A search on the car registration would have unearthed a license check by the South Hackensack Police Department that would have led to information placing Hazmi in the area and placing Mihdhar at a local hotel for a week in early July 2001.The hijackers actively used the New Jersey bank accounts, through ATM, debit card, and cash transactions, until September 10. Among other things, they used their debit cards to pay for hotel rooms; and Hazmi used his card on August 27 to purchase tickets on Flight 77 for himself and his brother (and fellow hijacker), Salem al Hazmi.These transactions could have helped locate them if the FBI had obtained the bank records in time.There would have been no easy means, however, to determine the existence of these accounts, and obtaining bank cooperation pre-9/11 might have been problematic.The most likely means of successfully finding the men in the short time available was one not often used pre-9/11 for suspected terrorists: an FBI BOLO (be on the lookout) combined with a media campaign.This alone might have delayed or disrupted the plot, even if the men had not been physically located before September 11. But this would have been considered only if the FBI believed that they were about to carry out an imminent attack. No one at the FBI—or any other agency—believed that at the time. See FBI report, financial spreadsheet re: 9/11 hijackers, undated; South Hackensack, N.J., Police Department report, Detective Bureau Report, Oct. 17, 2001 (case no. 20018437). According to Ramzi Binalshibh, had KSM known that Moussaoui had been arrested, he would have canceled the 9/11 attacks. Intelligence report, interrogation of Ramzi Binalshibh, Feb. 14, 2003. The publicity regarding Mihdhar and Hazmi might have had a similar effect because they could have been identified by the airlines and might have jeopardized the operation.

Many FBI witnesses have suggested that even if Mihdhar had been found, there was nothing the agents could have done except follow him onto the planes. We believe this is incorrect. Both Hazmi and Mihdhar could have been held for immigration violations or as material witnesses in the Cole bombing case. Investigation or interrogation of them, and investigation of their travel and financial activities, could have yielded evidence of connections to other participants in the 9/11 plot. The simple fact of their detention could have derailed the plan. In any case, the opportunity did not arise.

Phoenix Memo

The Phoenix memo was investigated thoroughly by the Joint Inquiry and the Department of Justice Inspector General.86 Joint Inquiry report, pp. xiii, 325–335; DOJ IG 9/11 Report, July 2, 2004, pp. 59–106. We will recap it briefly here. In July 2001, an FBI agent in the Phoenix field office sent a memo to FBI headquarters and to two agents on international terrorism squads in the New York Field Office, advising of the "possibility of a coordinated effort by Usama Bin Ladin" to send students to the United States to attend civil aviation schools. The agent based his theory on the "inordinate number of individuals of investigative interest" attending such schools in Arizona.87 FBI electronic communication, Phoenix memo, July 10, 2001.

The agent made four recommendations to FBI headquarters: to compile a list of civil aviation schools, establish liaison with those schools, discuss his theories about Bin Ladin with the intelligence community, and seek authority to obtain visa information on persons applying to flight schools. His recommendations were not acted on. His memo was forwarded to one field office. Managers of the Usama Bin Ladin unit and the Radical Fundamentalist unit at FBI headquarters were addressees, but they did not even see the memo until after September 11. No managers at headquarters saw the memo before September 11, and the New York Field Office took no action.88 Ibid.; Joint Inquiry report, pp. 325–335; DOJ IG 9/11 Report, July 2, 2004, pp. 59–106.

As its author told investigators, the Phoenix memo was not an alert about suicide pilots. His worry was more about a Pan Am Flight 103 scenario in which explosives were placed on an aircraft. The memo's references to aviation training were broad, including aeronautical engineering.89 DOJ Inspector General interview of Kenneth Williams, July 22, 2003. If the memo had been distributed in a timely fashion and its recommendations acted on promptly, we do not believe it would have uncovered the plot. It might well, however, have sensitized the FBI so that it might have taken the Moussaoui matter more seriously the next month.

273

Zacarias Moussaoui

On August 15, 2001, the Minneapolis FBI Field Office initiated an intelligence investigation on Zacarias Moussaoui. As mentioned in chapter 7, he had entered the United States in February 2001, and had begun flight lessons at Airman Flight School in Norman, Oklahoma. He resumed his training at the Pan Am International Flight Academy in Eagan, Minnesota, starting on August 13. He had none of the usual qualifications for flight training on Pan Am's Boeing 747 flight simulators. He said he did not intend to become a commercial pilot but wanted the training as an "ego boosting thing." Moussaoui stood out because, with little knowledge of flying, he wanted to learn how to "take off and land" a Boeing 747.90 Unlike Moussaoui, the typical student at Pan Am Flight Academy holds an FAA Airline Transport Pilot rating or the foreign equivalent, is employed by an airline, and has several thousand flight hours. Moussaoui also stood out for several other reasons. He had paid nearly $9,000 in cash for the training, yet had no explanation for the source of these funds; he had asked to fly a simulated flight from London's Heathrow Airport to New York's John F. Kennedy Airport; and he was also particularly interested in the operation of the aircraft doors. FBI electronic communication, Request OIPR permission to contact U.S.Attorney's Office regarding Zacarias Moussaoui,Aug. 18, 2001. For a detailed, step-by-step chronology of activities taken regarding Moussaoui prior to September 11, see DOJ IG 9/11 Report, July 2, 2004, pp. 109–197.

The agent in Minneapolis quickly learned that Moussaoui possessed jihadist beliefs. Moreover, Moussaoui had $32,000 in a bank account but did not provide a plausible explanation for this sum of money. He had traveled to Pakistan but became agitated when asked if he had traveled to nearby countries while in Pakistan (Pakistan was the customary route to the training camps in Afghanistan). He planned to receive martial arts training, and intended to purchase a global positioning receiver. The agent also noted that Moussaoui became extremely agitated whenever he was questioned regarding his religious beliefs. The agent concluded that Moussaoui was "an Islamic extremist preparing for some future act in furtherance of radical fundamentalist goals." He also believed Moussaoui's plan was related to his flight training.91 FBI electronic communication, Request OIPR permission to contact U.S. Attorney's Office regarding Zacarias Moussaoui, Aug. 18, 2001.

Moussaoui can be seen as an al Qaeda mistake and a missed opportunity. An apparently unreliable operative, he had fallen into the hands of the FBI. As discussed in chapter 7, Moussaoui had been in contact with and received money from Ramzi Binalshibh. If Moussaoui had been connected to al Qaeda, questions should instantly have arisen about a possible al Qaeda plot that involved piloting airliners, a possibility that had never been seriously analyzed by the intelligence community.

The FBI agent who handled the case in conjunction with the INS representative on the Minneapolis Joint Terrorism Task Force suspected that Moussaoui might be planning to hijack a plane. Minneapolis and FBI headquarters debated whether Moussaoui should be arrested immediately or surveilled to obtain additional information. Because it was not clear whether Moussaoui could be imprisoned, the FBI case agent decided the most important thing was to prevent Moussaoui from obtaining any further training that he could use to carry out a potential attack.92 DOJ Inspector General interview of Harry S., June 6, 2002; DOJ Inspector General interview of Greg J., July 9, 2002; FBI letterhead memorandum, Zacarias Moussaoui, Aug. 19, 2001.

As a French national who had overstayed his visa, Moussaoui could be detained immediately. The INS arrested Moussaoui on the immigration violation. A deportation order was signed on August 17, 2001.93 DOJ IG 9/11 Report, July 2, 2004, p. 128.

The agents in Minnesota were concerned that the U.S. Attorney's Office in Minneapolis would find insufficient probable cause of a crime to obtain a criminal warrant to search Moussaoui's laptop computer.94 Criminal search warrants must be approved by Department of Justice attorneys before submission to the court.Therefore, approval from the Minneapolis U.S.Attorney's Office was required before a criminal search warrant could be obtained. DOJ Inspector General interview of Coleen Rowley, July 16, 2002. Another agent, however, said that he spoke to an Assistant U.S. Attorney in the Minneapolis office and received advice that the facts were almost sufficient to obtain a criminal warrant. DOJ Inspector General interview of Greg J., July 9, 2002.The Assistant United States Attorney said that if the FBI had asked for a criminal warrant that first night, he would have sought it. He believed that there was sufficient probable cause for a criminal warrant at that time. DOJ Inspector General interview of William K., May 29, 2003. Mary Jo White, the former U.S. Attorney for the Southern District of New York, told us that based on her review of the evidence known pre-9/11, she would have approved a criminal search warrant. Mary Jo White interview (May 17, 2004). Because the agents never presented the information to the Minneapolis U.S.Attorney's Office before 9/11, we cannot know for sure what its judgment would have been or whether a judge would have signed the warrant. In any event, the Minneapolis agents were concerned that if they tried to first obtain a criminal warrant but the U.S. Attorney's Office or the judge refused, the FISA Court might reject an application for a FISA warrant on the grounds that the agents were attempting to make an end run around the criminal process.Therefore, it was judged too risky to seek a criminal warrant unless it was certain that it would be approved. DOJ Inspector General interview of Greg J., July 9, 2002. In addition, FBI headquarters specifically instructed Minneapolis that it could not open a criminal investigation. DOJ IG 9/11 Report, July 2, 2004, p. 138. Finally, the Minneapolis Field Office mistakenly believed that the 1995 Attorney General procedures required OIPR's approval before it could contact the U.S. Attorney's Office about obtaining a criminal warrant. Agents at FBI headquarters believed there was insufficient probable cause. Minneapolis therefore sought a special warrant under the Foreign Intelligence Surveillance Act to conduct the search (we introduced FISA in chapter 3).

274

To do so, however, the FBI needed to demonstrate probable cause that Moussaoui was an agent of a foreign power, a demonstration that was not required to obtain a criminal warrant but was a statutory requirement for a FISA warrant.95 The FISA definition of "foreign power" includes "a group engaged in international terrorism or activities in preparation therefor." The case agent did not have sufficient information to connect Moussaoui to a "foreign power," so he reached out for help, in the United States and overseas.

The FBI agent's August 18 message requested assistance from the FBI legal attaché in Paris. Moussaoui had lived in London, so the Minneapolis agent sought assistance from the legal attaché there as well. By August 24, the Minneapolis agent had also contacted an FBI detailee and a CIA desk officer at the Counterterrorist Center about the case.96 FBI electronic communication, Request to contact U.S. Attorney's Office regarding Zacarias Moussaoui, Aug. 18, 2001. For CTC contact, see FBI email, Harry S. to Chuck F.,"Please Pass To [desk officer],"Aug. 24, 2001; FBI email, Harry S. to Chuck F.,"Re: Fwd: 199M-MP-60130 (Zacarias Moussaoui)," Aug. 24, 2001.

After receiving the written request for assistance, the legal attaché in London had promptly forwarded it to his counterparts in the British government, hand-delivering the request on August 21. On August 24, the CIA also sent a cable to London and Paris regarding "subjects involved in suspicious 747 flight training" that described Moussaoui as a possible "suicide hijacker." On August 28, the CIA sent a request for information to a different service of the British government; this communication warned that Moussaoui might be expelled to Britain by the end of August. The FBI office in London raised the matter briefly with British officials as an aside, after a meeting about a more urgent matter on September 3, and sent the British service a written update on September 5. The case was not handled by the British as a priority amid a large number of other terrorist-related inquiries.98 FBI letterhead memorandum, Zacarias Moussaoui, Aug. 21, 2001; CIA cable, subjects involved in suspicious 747 flight training,Aug. 24, 2001; CIA cable,"Zacarias Moussaoui and Husayn 'Ali Hasan Ali-Attas,"Aug. 28, 2001; Joseph H., interview (May 4, 2004); FBI letterhead memorandum, Zacarias Moussaoui, Sept. 5, 2001.

On September 4, the FBI sent a teletype to the CIA, the FAA, the Customs Service, the State Department, the INS, and the Secret Service summarizing the known facts regarding Moussaoui. It did not report the case agent's personal assessment that Moussaoui planned to hijack an airplane. It did contain the FAA's comment that it was not unusual for Middle Easterners to attend flight training schools in the United States.99 FBI teletype,"Zacarias Moussaoui—International Terrorism," Sept. 4, 2001.

Although the Minneapolis agents wanted to tell the FAA from the beginning about Moussaoui, FBI headquarters instructed Minneapolis that it could not share the more complete report the case agent had prepared for the FAA. The Minneapolis supervisor sent the case agent in person to the local FAA office to fill in what he thought were gaps in the FBI headquarters teletype.100 DOJ Inspector General interview of Greg J., July 9, 2002. No FAA actions seem to have been taken in response.

275

There was substantial disagreement between Minneapolis agents and FBI headquarters as to what Moussaoui was planning to do. In one conversation between a Minneapolis supervisor and a headquarters agent, the latter complained that Minneapolis's FISA request was couched in a manner intended to get people "spun up." The supervisor replied that was precisely his intent. He said he was "trying to keep someone from taking a plane and crashing into the World Trade Center." The headquarters agent replied that this was not going to happen and that they did not know if Moussaoui was a terrorist.101 Minneapolis may have been more concerned about Moussaoui's intentions because the case agent and the supervisory agent were both pilots.They were, therefore, more highly sensitized to the odd nature of Moussaoui's actions and comments regarding flying. DOJ Inspector General interview of Greg J., July 9, 2002; DOJ Inspector General interview of Harry S., June 20, 2002.

There is no evidence that either FBI Acting Director Pickard or Assistant Director for Counterterrorism Dale Watson was briefed on the Moussaoui case prior to 9/11. Michael Rolince, the FBI assistant director heading the Bureau's International Terrorism Operations Section (ITOS), recalled being told about Moussaoui in two passing hallway conversations but only in the context that he might be receiving telephone calls from Minneapolis complaining about how headquarters was handling the matter. He never received such a call. Although the acting special agent in charge of Minneapolis called the ITOS supervisors to discuss the Moussaoui case on August 27, he declined to go up the chain of command at FBI headquarters and call Rolince.102 DOJ Inspector General interview of Michael Rolince, May 5, 2004; Michael Rolince interview (Apr. 12, 2004); DOJ IG 9/11 Report, July 2, 2004, pp. 168–170, 188.

On August 23, DCI Tenet was briefed about the Moussaoui case in a briefing titled "Islamic Extremist Learns to Fly."103 CIA briefing materials, DCI Update, "Islamic Extremist Learns to Fly," Aug. 23, 2001. Deputy Director of Central Intelligence John McLaughlin testified that he was told about Moussaoui several days before Tenet was briefed, although he did not recall the specific date of the briefing. John McLaughlin testimony, Apr. 14, 2004. Tenet was also told that Moussaoui wanted to learn to fly a 747, paid for his training in cash, was interested to learn the doors do not open in flight, and wanted to fly a simulated flight from London to New York. He was told that the FBI had arrested Moussaoui because of a visa overstay and that the CIA was working the case with the FBI. Tenet told us that no connection to al Qaeda was apparent to him at the time. Seeing it as an FBI case, he did not discuss the matter with anyone at the White House or the FBI. No connection was made between Moussaoui's presence in the United States and the threat reporting during the summer of 2001.104 George Tenet interviews (Jan. 28, 2004; July 2, 2004).

On September 11, after the attacks, the FBI office in London renewed their appeal for information about Moussaoui. In response to U.S. requests, the British government supplied some basic biographical information about Moussaoui. The British government informed us that it also immediately tasked intelligence collection facilities for information about Moussaoui. On September 13, the British government received new, sensitive intelligence that Moussaoui had attended an al Qaeda training camp in Afghanistan. It passed this intelligence to the United States on the same day. Had this information been available in late August 2001, the Moussaoui case would almost certainly have received intense, high-level attention.105 For the renewed request, see FBI letterhead memorandum, Zacarias Moussaoui, Sept. 11, 2001. For the initial British response, see British Security Service memo, re: Zacarias Moussaoui, Sept. 12, 2001; information provided to the Commission by the British government; British liaison telex,"Zacarias Moussaoui—Background Information," Sept. 13, 2001. See also Joseph H. interview (May 4, 2004).

The FBI also learned after 9/11 that the millennium terrorist Ressam, who by 2001 was cooperating with investigators, recognized Moussaoui as someone who had been in the Afghan camps.106 Joint Inquiry report (classified version), pp. 340–341. Notably, the FBI analyst "Mary" who was looking at the Mihdhar information suggested that the U.S. government talk to Ressam to see if he knew anything about Mihdhar. See CIA email, Mary to John, seeking identification by Ressam,Aug. 21, 2001.There is no evidence that Ressam was asked about Moussaoui or Mihdhar prior to 9/11. As mentioned above, before 9/11 the FBI agents in Minneapolis had failed to persuade supervisors at headquarters that there was enough evidence to seek a FISA warrant to search Moussaoui's computer hard drive and belongings. Either the British information or the Ressam identification would have broken the logjam.

276

A maximum U.S. effort to investigate Moussaoui conceivably could have unearthed his connections to Binalshibh. Those connections might have brought investigators to the core of the 9/11 plot. The Binalshibh connection was recognized shortly after 9/11, though it was not an easy trail to find. Discovering it would have required quick and very substantial cooperation from the German government, which might well have been difficult to obtain.

However, publicity about Moussaoui's arrest and a possible hijacking threat might have derailed the plot.107 According to Ramzi Binalshibh, had KSM known that Moussaoui had been arrested, he would have cancelled the 9/11 attacks. Intelligence report, interrogation of Ramzi Binalshibh, Feb. 14, 2003. With time, the search for Mihdhar and Hazmi and the investigation of Moussaoui might also have led to a breakthrough that would have disrupted the plot.

Khalid Sheikh Mohammed

Another late opportunity was presented by a confluence of information regarding Khalid Sheikh Mohammed received by the intelligence community in the summer of 2001.The possible links between KSM, Moussaoui, and an individual only later identified as Ramzi Binalshibh would remain undiscovered, however.

Although we readily equate KSM with al Qaeda today, this was not the case before 9/11. KSM, who had been indicted in January 1996 for his role in the Manila air plot, was seen primarily as another freelance terrorist, associated with Ramzi Yousef. Because the links between KSM and Bin Ladin or al Qaeda were not recognized at the time, responsibility for KSM remained in the small Islamic Extremist Branch of the Counterterrorist Center, not in the Bin Ladin unit.

Moreover, because KSM had already been indicted, he became targeted for arrest. In 1997, the Counterterrorist Center added a Renditions Branch to help find wanted fugitives. Responsibility for KSM was transferred to this branch, which gave the CIA a "man-to-man" focus but was not an analytical unit.When subsequent information came, more critical for analysis than for tracking, no unit had the job of following up on what the information might mean.108 Joint Inquiry report (classified version), pp. 329–331; Joint Inquiry interview of Mike, Alice, Larry, John, Terry,Aug. 12, 2002.

For example, in September 2000, a source had reported that an individual named Khalid al-Shaykh al-Ballushi was a key lieutenant in al Qaeda. Al-Ballushi means "from Baluchistan," and KSM is from Baluchistan. Recognizing the possible significance of this information, the Bin Ladin unit sought more information.When no information was forthcoming, the Bin Ladin unit dropped the matter.109 CIA cable, Key UBL personalities, Sept. 25, 2000. When additional pieces of the puzzle arrived in the spring and summer of 2001, they were not put together.

277

The first piece of the puzzle concerned some intriguing information associated with a person known as "Mukhtar" that the CIA had begun analyzing in April 2001. The CIA did not know who Mukhtar was at the time—only that he associated with al Qaeda lieutenant Abu Zubaydah and that, based on the nature of the information, he was evidently involved in planning possible terrorist activities.110 CIA cable, Mukhtar information, May 23, 2002.

The second piece of the puzzle was some alarming information regarding KSM. On June 12, 2001, a CIA report said that "Khaled" was actively recruiting people to travel outside Afghanistan, including to the United States where colleagues were reportedly already in the country to meet them, to carry out terrorist-related activities for Bin Ladin. CIA headquarters presumed from the details of the reporting that this person was Khalid Sheikh Mohammed. In July, the same source was shown a series of photographs and identified a photograph of Khalid Sheikh Mohammed as the Khaled he had previously discussed.111 CIA cable, Biographical Information on Key UBL Associates in Afghanistan, June 11, 2001; Intelligence report, biographical information on Bin Ladin associates in Afghanistan, June 12, 2001. For the subsequent identification, see CIA cable, follow-up source on KSM, July 11, 2001.

The final piece of the puzzle arrived at the CIA's Bin Ladin unit on August 28 in a cable reporting that KSM's nickname was Mukhtar. No one made the connection to the reports about Mukhtar that had been circulated in the spring. This connection might also have underscored concern about the June reporting that KSM was recruiting terrorists to travel, including to the United States. Only after 9/11 would it be discovered that Muhktar/KSM had communicated with a phone that was used by Binalshibh, and that Binalshibh had used the same phone to communicate with Moussaoui, as discussed in chapter 7.As in the Moussaoui situation already described, the links to Binalshibh might not have been an easy trail to find and would have required substantial cooperation from the German government. But time was short, and running out.112 For the reporting identifying Mukhtar as KSM, see CIA cable, source information re: KSM,Aug. 28, 2001.

Time Runs Out

As Tenet told us, "the system was blinking red" during the summer of 2001. Officials were alerted across the world. Many were doing everything they possibly could to respond to the threats.

Yet no one working on these late leads in the summer of 2001 connected the case in his or her in-box to the threat reports agitating senior officials and being briefed to the President. Thus, these individual cases did not become national priorities. As the CIA supervisor "John" told us, no one looked at the bigger picture; no analytic work foresaw the lightning that could connect the thundercloud to the ground.113 John interview (Apr. 2, 2004).

We see little evidence that the progress of the plot was disturbed by any government action. The U.S. government was unable to capitalize on mistakes made by al Qaeda. Time ran out.

278