Index

The Intelligence Community's
Knowledge of the September 11 Hijackers
Prior to September 11, 2001

Eleanor Hill, Staff Director, Joint inquiry Staff
September 20, 2002

Introduction

Mr. Chairmen, members of this Joint Committee, good morning. I appreciate the opportunity to appear before the Committees, and the American public, once again.

Previously, we have reported on what our review has, to date, confirmed about the evolution of the terrorist threat, as known to the Intelligence Community, prior to the September 11, 2001 attacks on the United States. To summarize:

Today, we will report on the Intelligence Community's knowledge, prior to September 11, 2001, of the September 11 hijackers, particularly three of the five individuals who hijacked American Flight 77, which crashed into the Pentagon. In future hearings, we will report on the July 10, 2001 electronic communication (EC) from the Federal Bureau of Investigation's (FBI) Phoenix field office to FBI headquarters and on the FBI's investigation, prior to September 11, 2001, of Zacarias Moussaoui.

While each of these areas is individually important, I want also to emphasize the significance of these matters when viewed collectively. The information regarding these three matters was available in the same section at the FBI headquarters in late August 2001. The first and third matters were addressed in the Director of Central Intelligence's (DCI) Counterterrorist Center (CTC) at approximately the same time. In neither unit did anyone see the potential collective significance of the information, despite the increasing concerns throughout the summer of 2001 of an impending terrorist attack.

Our review has confirmed that in each of these areas there were missed opportunities by the Intelligence Community. In each area, there were indications of larger, systemic issues that, at least in part, drove those missed opportunities. And finally, in each area, there were individuals within the Intelligence Community who recognized the importance of what potentially was at stake and tried though ultimately without success, to get organizations within the Intelligence Community to do the same.

The September 11 Hijackers

Of particular interest to the Joint Inquiry Staff is the extent to which the Intelligence Community had any intelligence or law enforcement information linking any of the suspected September 11 hijackers to terrorism or a terrorist group, prior to September 11, 2001. This would exclude civil or administrative information such as visa applications, driver's licenses, or other types of identification that may have been available to various agencies. That type of information would not have normally triggered any suspicions absent information linking the hijackers to terrorism or a terrorist group.

In pursuing this question of prior knowledge, the Joint Inquiry Staff employed several means of seeking relevant information:

As of this date, the Joint Inquiry Staff has determined from the fruits of these efforts that, prior to September 11, 2001, the Intelligence Community possessed no intelligence or law enforcement information linking 16 of the 19 hijackers to terrorism or terrorist groups. Indeed, the Joint Inquiry has heard testimony and reviewed documents indicating that the hijackers may have been selected for the September 11 operation at least partly because they did not have previously established ties to terrorist organizations.

The three remaining hijackers - all of whom were aboard American Flight 77, which crashed into the Pentagon - did come to the attention of the Intelligence Community prior to September 11, 2001. The three hijackers in question are: Khalid al-Mihdhar, Nawaf al-Hazmi, and Nawaf's brother, Salim al-Hazmi. All three were citizens of Saudi Arabia. Before September 11, 2001, the Intelligence Community had acquired significant information regarding al-Mihdhar and Nawaf al-Hazmi. The Intelligence Community initially acquired some information about Salim al-Hazmi's identity and association with the other two, but nothing further until after September 11, 2001.

The Joint Inquiry Staff is aware of a media report that Ziad Jarrah, a September 11 hijacker suspected of having been the pilot aboard United Flight 93, was stopped by United Arab Emirate (UAE) officials at the behest of the CIA as he arrived in Dubai in January 2001. Based on our investigation, the media reports are incorrect. The Joint Inquiry Staff requested and reviewed all pertinent CIA records to determine whether such a request was made. The Joint Inquiry Staff determined that Jarrah was unknown to the CIA prior to September 11, 2001. UAE officials had detained Jarrah because of an irregularity in his passport, not at the request of the CIA, a fact acknowledged by them to U.S. Government officials. Additionally, the date in the media stories is incorrect. Jarrahwas stopped in January 2000, not January 2001 as reported by the media. Further, our investigation could find no evidence that any other U.S. officials asked that Jarrah be stopped.

Three September 11 Hijackers Who Came to the Attention
of the Intelligence Community Prior to September 11, 2001

What follows is a description of how the Intelligence Community developed information on three of the hijackers, and when the Intelligence Community had, but missed, opportunities both to deny them entry into the United States and, subsequently, to generate investigative and surveillance action regarding their activities within the United States. At this stage, we must also reiterate that this is only an unclassified summary of these events. While the Joint Inquiry Staff has studied this intelligence trail in great detail some aspects involving intelligence sources and methods remain classified. A separate and more detailed classified report is also being submitted to the two Committees.

As mentioned earlier, the Joint Inquiry Staff has also requested that the written statements of the DCI and Director of the FBI be declassified. When they become available, they will further describe what the Intelligence Community now knows about the September 11 plot.

As background, we mention here that watchlists are important to U.S. Government efforts aimed at preventing criminals and terrorists from entering the United States from overseas. The State Department, the Immigration and Naturalization Service (INS) and the U.S. Customs Service all maintain watchlists of named individuals. Names are added to the watchlists based on information provided by the Intelligence Community and various law enforcement agencies. When individuals apply for visas to enter the United States or present themselves to immigration officers at U.S. ports of entry -- airports, seaports, and land border crossings -- .U.S. consular officers, INS officers, and Customs agents check their names against watchlists maintained by their respective agencies. If an individual's name is on a U.S. Government watchlist, he or she may be denied visas or denied entry into the United States.

The story begins in December 1999 with the Intelligence Community on heightened alert for possible terrorist activity as the world prepared to celebrate the new Millennium. A meeting of individuals believed at the time to be associated with Usama Bin Ladin's terrorist network took place in Kuala Lumpur, Malaysia from January 5 to 8, 2000. Khalid al-Mihdhar and Nawaf al-Hazmi were among those attending the meeting in Malaysia, along with an individual later identified as Khallad bin-Atash, a key operative in Usama Bin Ladin's terrorist network. The meeting took place at a condominium owned by an individual named Yazid Sufaat. Sufaat is the same individual who would later, in October 2000, sign letters identifying Zacarias Moussaoui as a representative of his company. U.S. authorities found these letters in the possession of Moussaoui after the September 11 attacks. Although it was not known what was discussed at the Malaysia meeting, the CIA believed it to be a gathering of al-Qaida associates. Several of the individuals attending the meeting, including al-Mihdhar and al-Hazmi, then proceeded to another Southeast Asian country.

By the time these individuals entered Malaysia, the CIA had determined Khalid al-Mihdhar's full name, his passport number, and birth information. Significantly, it also knew that he held a U.S. B-1/B-2 multiple-entry visa that had been issued to him in Jeddah, Saudi Arabia on April 7, 1999 and would not expire until April 6, 2000. Soon after these individuals departed Malaysia for another country on January 8, 2001, the CIA also received indications that Nawaf's last name might be al-Hazmi. Unbeknownst to the CIA, another arm of the Intelligence Community, the NSA, had information associating Nawaf al-Hazmi with the Bin Ladin network. NSA did not immediately disseminate that information, although it was in NSA's database. At this stage, Salim was known to the rest of the Intelligence Community as an associate of Khalid's and Nawaf's and that he was possibly Nawaf's brother. Al-Mihdhar's and Nawaf al-Hazmi's names could have been, but were not, added at this time to the State Department, INS, and U.S. Customs Service watchlists denying individuals entry into the United States.

A CIA communication in early January 2000 states that al-Mihdhar's travel documents, including his multiple entry visa for the United States, were shared with the FBI for further investigation. No one at the FBI recalls having received such documents at the time. No confirmatory record of the transmittal of the travel documents has yet been located at either the CIA or the FBI. In addition, while the Malaysian meeting was in progress, a CIA employee sent an e-mail to a CIA colleague, advising that he had briefed two FBI agents about what the CIA had learned about al-Mihdhar's activities. The CIA employee told us that he had, at the time, been assigned to work at the FBI Strategic Information Operations Center to fix problems "in communicating between the CIA and the FBI." His e-mail, however, makes no mention of the CIA's determination that al-Mihdhar held a U.S. multiple-entry visa. The CIA employee notes in his e-mail that he had told the second FBI agent that:

The CIA employee told the Joint Inquiry Staff that he does not recall telling the FBI about Mihdhar's visa information and potential travel to the United States.

When interviewed by the Joint Inquiry Staff, neither FBI agent initially recalled discussions with the CIA employee about al-Mihdhar. The first agent did locate his own handwritten notes that indicated that he did speak with the employee about the Malaysia activities, probably in early January 2000. The second agent knows the CIA employee, but does not recall learning about al-Mihdhar or the Malaysia meeting until after September 11, 2001. An e-mail from the second FBI agent to a superior at FBI headquarters has been located that relates the basic facts of the conversation with the CIA employee. The e-mail makes no mention of al-Mihdhar's visa information or possible travel to the United States. It concludes with "CIA is reporting relevant information as it becomes available."

The CIA maintained its interest in al-Mihdhar and al-Hazmi after their departure from Malaysia, with assistance from foreign authorities. A February 2000 CIA cable in response to a request by foreign authorities to become involved reiterated CIA's primacy in the case and intent "to determine what the subject is up to."

In early March 2000, CIA headquarters, including both the CTC and the special Bin Ladin unit, received information from an overseas CIA station involved in the matter that Nawaf al-Hazmi had entered the United States via Los Angeles International Airport on January 15, 2000. No further destination for Khalid al-Mihdhar was noted in the CIA cable. The cable carrying the information was marked "Action Required: None, FYI." The following day, another overseas CIA station noted, in a cable to the Bin Ladin unit at CIA headquarters, that it had "read with interest" the March cable, "particularly the information that a member of this group traveled to the U.S...." The-CIA did not act on this information. Nor did it consider the possibility that, because Nawaf al-Hazmi and Khalid al-Mihdhar had been together in Malaysia and continued on together to another Southeast Asian country, there was a substantial probability that they would travel further together. In fact, al-Mihdhar, who had traveled with al-Hazmi, continued on with him to the United States on January 15, 2000.

Again, at this point, these two individuals, who later participated in the September 11 attacks, could have been added to the State Department's watchlist for denying individuals entry into the United States. Although the individuals had already entered the United States, the sharing of this information with the FBI and appropriate law enforcement authorities could have prompted investigative efforts to locate these individuals and surveil their activities within the United States. Unfortunately, none of these things happened. The Joint Inquiry Staff has interviewed the individual at CIA headquarters who had direct responsibility for taking the movement of individuals at this meeting in Malaysia. That person does not recall seeing the March message. In his testimony before the Joint Inquiry on June 18, 2001, the DCI acknowledged that the CIA should have acted to add these individuals to the State Department's watchlist in March 2000 and characterized this omission as a mistake.

During the course of our interviews, we attempted to identify the reasons why that mistake occurred. We were told that there was, at the time, no formal system in place at the CTC for watchlisting suspected terrorists with indications of travel to the United States. CIA personnel also told us that they received no formal training on watchlisting. One CIA employee said they learned about the watchlisting process through "on-the-job training." Another CIA employee who had been aware of al-Mihdbar's participation in the Malaysia meeting told us that, prior to September 11, 2001, it was "not incumbent" on CTC's special Bin Ladin unit to watchlist such individuals. Finally, a CTC employee who in 2000 handled the cable traffic on the Malaysia meeting told us that the meeting was not considered "important" (relative to other counterterrorist activities occurring at that time) and that there were "not enough people" to handle CTC's workload at the time. As a result, informational cables - such as the March 2000 message - received less attention than "action" items. Several other employees told us that they typically did not have time to even read information cables.

The failure to watchlist al-Mihdbar and al-Hazmi or, at a minimum, to advise the FBI of their travel to the United States, is perhaps even more puzzling because it occurred shortly after the peak of Intelligence Community alertness to possible Millennium-related terrorist attacks. In the fall of 1999, there was debate within the Intelligence Community about whether intelligence information that had been collected earlier that year meant that Usama Bin Ladin's network intended to carry out terrorist attacks in the midst of the celebrations ushering in the new Millennium. Intelligence information, along with the arrest of Ahmed Ressam at the US-Canadian border, prompted the U.S. Government and various foreign governments to arrest, detain, and otherwise disrupt numerous individuals associated with Bin Ladin's network in various locations around the world. These disruption operations occurred between December 1999 and February 2000. Thus, the Malaysia meeting of January 5-8, 2000 and the March 2000 information that al-Hazmi had entered the United States developed at a time when the Intelligence Community had only recently confronted the real possibility of a Bin Ladin attack. However, it apparently was still focused on the organization and aftermath of the previous operations.

In interviews with the Joint inquiry Staff, a number of working level CIA personnel who were following the Malaysia meeting and other terrorist activities in the Millennium timeframe have characterized the Malaysia meeting as just one of many counterterrorist efforts occurring at that time. In contrast, documents reviewed by the Joint Inquiry Staff show that the Malaysia meeting was deemed sufficiently important at the time that it was included - along with several other counterterrorst activities -in several briefings to the DCI in January 2000. We were told, however, that the matter was "dropped" when the CIA employee handling the matter moved on to other issues and, as a result, no CIA officer was following the al-Mihdhar group by the summer of 2000.

By March 2000, al-Mihdhar and Nawaf al-Hazmi had settled into a residence in San Diego. In the course of their time in San Diego, they used their true names on a rental agreement, as al-Mihdhar also did in obtaining a California motor vehicle photo identification card. In May 2000, they took flight lessons in San Diego but abandoned the effort. On June 10, 2000, al-Mihdhar left the United States on a Lufthansa flight from Los Angeles to Frankfurt.

Nawaf al-Hazmi remained in the United States. On July 7, 2000, a week shy of the expiration of the six-month visa to stay in the United States that he had been granted on January 15, 2000, al-Hazmi applied to the INS for an extension to his visa. He used on his INS application the Lemon Grove, California address for the residence that he shared with al-Mihdhar before the latter's departure in early June 2000. The INS recorded receipt of the extension request on July 27, 2000. The INS has advised the Joint Inquiry Staff that it assumes a receipt was generated and sent to al-Hazmi at the address he listed. Lemon Grove is the community al-Hazmi lived in until December 2000. At that time, he moved to Mesa, Arizona with Hani Hanjour, who in December had just returned to the United States and would later be the most likely hijacker to have piloted American Flight 77. The INS does not have a record of a further extension request by al-Hazmi, who remained in the United States illegally after his initial extension expired in January 2001.

On October 12, 2000, two individuals with ties to Usama Bin Ladin's terrorist network carried out an attack on USS Cole as the Navy destroyer was refueling in Aden, Yemen. In the course of its investigation of the attack, the FBI developed information indicating that an individual named Tawfiq Mahomed Saleh Atash, also known as Khallad, had been a principal planner in the Cole bombing and that two other participants in the Cole conspiracy had delivered money to Khallad at the time of the January 2000 Malaysia meeting. The FBI shared this information with the CIA, and it prompted analysts at CIA to take another look at the January 2000 meeting in Malaysia.

In that process, the CIA acquired information in January 2001 indicating that Khallad had attended the meeting in Malaysia. This information was significant because it meant that the other attendees, including al-Mihdhar and Nawaf al-Hazmi, had been indirect contact with the key planner in Usama Bin Ladin's terrorist network behind the Cole attack. However, CIA again apparently did not act and did not add Khalid al-Mihdhar and Nawaf al-Hazmi to the State Department's watchlist for denying individuals entry into the United States. At this time, Khalid al-Mihdhar was abroad, while Nawaf al-Hazmi was still in the United States.

In May 2001, personnel at the CIA provided an Intelligence Operations Specialist (IOS) at FBI headquarters with photographs taken in Malaysia, including one of al-Mihdhar. The CIA wanted the FBI to review the photographs to determine whether an individual in custody in connection with the FBI's Cole investigation (who had carried the money to a Southeast Asian country for Khallad in January 2000) could be identified in the photographs. When interviewed, the FBI IOS who received the photographs told the Joint Inquiry Staff that the CIA told her about Mihdhar's meeting in Malaysia and travel to another Southeast Asian country, but said nothing about his potential travel to the United States. Nor did the CIA advise the FBI that the photographs were from a meeting that it believed Khallad had attended. Again, no action was taken to watchlist al-Mihdhar or al-Hazmi.

On June 11, 2001, FBI headquarters representatives and CIA representatives met with the New York FBI agents handling the Cole investigation. The New York agents were shown, but not given copies of the photographs and told they were taken in Malaysia. When interviewed, one of the New York agents recalled al-Mihdhar's name being mentioned. He also recalled asking for more information on why the people in the photographs were being followed and for access to that information. The New York agents were advised they could not be told why al-Mihdhar and the others were being followed. An FBI headquarters representative told us in her interview that the FBI was never given specific information until it was provided after September 11, 2001. The CIA analyst who attended the New York meeting acknowledged to the Joint Inquiry Staff that he had seen the information regarding al-Mihdhar's U.S. visa and al-Hazmi's travel to the United States. But he stated that he would not share information outside of the CIA unless he had authority to do so and unless that was the purpose of the meeting.

On June 13, 2001, Khalid al-Mihdhar obtained a new U.S. visa in Jeddah, using a different passport than the one he had used to enter the United States on January 15, 2000. On his visa application, he checked "no" in response to the question of whether he had ever been in the United States. On July 4, 2001, al-Mihdhar re-entered the United States.

On or about July 13, 2001, a CIA officer assigned to the FBI accessed CIA's electronic database and located a CIA cable, for which he had been searching, that contained information the CIA had acquired in January 2001 indicating that Khallad had attended the meeting in Malaysia. The presence of Khallad in Malaysia deeply troubled the CIA officer, who immediately sent an email from FBI headquarters to the DCI's CTC saying of Khallad: "This is a major league killer, who orchestrated the Cole attack and possibly the Africa bombings."

A review at the CIA of all prior cables concerning the Malaysia meeting was launched, a task that fell to an FBI arwyst assigned to the CTC. On August 21, 2001, the FBI analyst put together two key pieces of information. These were the intelligence that the CIA had received in January 2000 that al-Mihdhar had a multiple-entry visa to the United States and the information it had received in March 2000 that Nawaf al-Hazmi had entered the United States on January 15, 2000. Working with an INS representative assigned to the CTC, the analyst obtained information that al-Mihdhar had entered the United States on January 15, 2000 and had departed on June 10, 2000. Additional investigation revealed that al-Mihdhar had re-entered the United States on July 4, 2001, with a visa that allowed him to stay in the United States through August 22. CIA suspicions were further aroused by the timing of al-Mihdhar's and al-Hazmi's arrival in Los Angeles in January 2000, the same general time frame in which Algerian terrorist and Bin Ladin associate Ahmed Ressam was to have arrived in Los Angeles to conduct terrorist operations.

On August 23, 2001, the CIA sent a cable to the State Department, INS, Customs Service, and FBI requesting that "Bin Ladin related individuals" - al-Mihdhar, Nawaf al-Hazmi, and two other individuals at the Malaysia meeting - be watchlisted immediately and denied entry into the United States "due to their confirmed links to Egyptian Islamic Jihad operatives and suspicious activities while traveling in East Asia." Although the CIA believed al-Mihdhar was in the United States, placing him on the watchlist would enable authorities to detain him if he attempted to leave.

Meanwhile, the FBI headquarters' Usama Bin Ladin Unit sent to the FBI's New York field office a draft document recommending the opening of an intelligence investigation on al-Mihdhar "...to determine if al-Mihdhar is still in the United States." It also stated that al-Mihdhar's confirmed association with various elements of Bin Ladin' s terrorist network, including potential association with two individuals involved in the attack on USS Cole, "make him a risk to the national security of the United States." The goal of the investigation was to locate al-Mihdhar and determine his contacts and reasons for being in the United States." This document was sent to New York in final form on August 28. New York FBI agents told us that they tried to convince FBI headquarters to open a criminal investigation on al-Mihdhar, given the importance of the search and the limited resources that were available to intelligence investigations. FBI headquarters declined to do so because there was, in its view, no way to connect al-Mihdhar to the ongoing Cole investigation without using some intelligence information.

At the State Department, a visa revocation process was begun immediately. Al-Mihdhar, Nawaf al-Hazmi, Khallad, and the other individual who had been at the Malaysia meeting were added to the watchlists maintained by INS and Customs Service, on the chance that they had not yet entered the United States.

The FBI contacted the Bureau of Diplomatic Security at the State Department on August 27, 2001 to obtain al-Mihdhar's and Nawaf al-Hazmi's visa information. The visa information was provided to the FBI on August 29, 2001. It revealed that on entering the United States on July 4, 2001, al-Mihdhar had indicated on his application that h ewould be staying at a Marriott hotel in New York City. An FBI agent working with a Naval Criminal Investigative Service agent determined on September 5, 2001 that al-Mihdhar had not registered at any New York area Marriott hotel, including the Marriott World Trade Center Hotel. On September 10, 2001, the New York FBI field office prepared a request that the FBI office in Los Angeles check registration records for all Sheraton Hotels located in the Los Angeles metropolitan area. The request also asked the Los Angeles field office to check with United Airlines and Lufthansa for travel and alias information since al-Mihdhar and al-Hazmi had used those airlines when they entered and when al-Mihdhar departed the United States. The Los Angeles FBI office conducted the search after September 11, 2001, with negative results.

In short, the CIA had obtained information identifying two of the 19 hijackers, al-Mihdhar and al-Hazmi, as suspected terrorists carrying visas for travel to the United States as long as eighteen months prior to the time they were eventually watch-listed on August 24, 2001. There were numerous opportunities during the tracking of these two suspected terrorists when the CIA could have alerted the FBI and other U.S. law enforcement authorities to the probability that these individuals either were or would soon be in the United States. That was not done, nor were they placed on watchlists denying them entry into the United States. In his closed-door testimony of June 18, 2002 before the Joint Inquiry, as mentioned earlier, the DCI acknowledged that the CIA had made a mistake in not watch-listing these two individuals prior to August 2001.

It is worth noting that the watchlists mentioned above are aimed at denying named individuals from entering the United States. Prior to September 11, 2001, these watchlists were not used to screen individuals boarding domestic flights within the United States. Thus, even though al-Mihdhar and al-Hazmi had been placed on U.S. watchlists two weeks prior to September 11, 2001, this did not prevent them from boarding American Flight 77 on September 11.

Beyond the watchlist issue, the story of al-Mihdhar and al-Hazmi also graphically illustrates the gulf that apparently existed, at least prior to September 11, 2001, between intelligence and law enforcement counterterrorist efforts. An effective defense against terrorist groups such as al-Qa'ida requires close collaboration between both law enforcement and foreign intelligence agencies as well as within the FBI between the unit responsible for criminal investigations and the unit responsible for counterintelligence and counterterrorism investigations. There are a number of factors that make effective integration of law enforcement and intelligence investigations against terrorism difficult. These include differences in experience, tactics, objectives, legal authorities, and concern for protecting intelligence sources and methods. A brief explanation of certain legal distinctions between law enforcement and foreign intelligence investigations is important to understand aspects of how CIA and FBI dealt with information about the hijackers as well as the FBI's handling of the Moussaoui investigation.

The May 17, 2002 opinion of the United States Foreign Intelligence Surveillance Court (FISC) concerning "minimization prowdures" that control the dissemination of information collected by the FBI pursuant to the Foreign Intelligence Surveillance Act (FISA) addresses the legal issue of the appropriate relationship between the law enforcement and foreign intelligence aspects of a counterterrorism investigation. Historically, the U.S. Government has recognized two distinct, albeit occasionally overlapping, spheres of investigative activity: domestic criminal investigations and foreign intelligence collection. The former is the exclusive province of federal, state and local law enforcement agencies; the National Security Act of 1947 forbids the CIA from having any internal security or law enforcement powers. Domestic law enforcement activity is carefully circumscribed by constitutional protections in the 4th, 5th, and 6th amendments and various statutory controls on electronic surveillance and physical searches. In general, the government is required to establish probable cause to believe a search will obtain evidence of criminal activity in order to obtain a search warrant in a criminal investigation.

Foreign intelligence collection, on the other hand, is the responsibility of the Intelligence Community under the guidance of the DCI. Collection of such information is carefully regulated when U.S. persons are the targets or when electronic surveillance or physical searches are conducted in the United States against foreign powers or their agents pursuant to FISA. The rules governing foreign intelligence collection are different than those pertaining to the collection and dissemination of information for law enforcement purposes. In general, this differentiation is explained by the national security purpose of foreign intelligence collection, i.e., to enable the conduct of foreign policy and military operations and to counter hostile intelligence services and international terrorists. While it is possible that evidence of criminal conduct may be obtained in the course of such a surveillance, the FISC's May 17 opinion holds that the acquisition of such evidence may not be the primary purpose of such a surveillance. Surveillance for domestic law enforcement purposes, by contrast, obviously may be conducted for the purpose of subsequent criminal prosecution.

The existence of two categories of surveillance rules and the perceived need to keep them discrete raises practical problems in managing an investigation that straddles the divide as counterintelligence and counterterrorist investigations often do. The first question is whether to apply criminal or foreign intelligence rules in a particular case. The second is how to regulate coordination and interaction between intelligence and law enforcement personnel.

One way to ensure against violation of rules limiting such coordination and interaction is the imposition of a "wall" that requires someone not involved in either the foreign intelligence surveillance or the criminal investigation to decide what information should be passed from intelligence personnel to criminal investigators. That is one issue the FISC addresses in the May 2002 opinion mentioned above.

There is, however, a second type of wall that can also limit the flow of information to criminal investigators from intelligence agencies; that wall exists to protect foreign intelligence sources and methods from disclosure in a criminal prosecution. Intelligence agencies often provide information to the FBI, for example, with a limitation that it may only be used for lead purposes as distinct from evidentiary purposes. In the case of al-Mihdhar and al-Hazmi, evidently, assisting the Cole criminal investigation was deemed insufficient to justify breaching the "wall" that prevented the full sharing of relevant intelligence information with the agents handling that criminal investigation.

An August 29, 2001 e-mail exchange between FBI headquarters and a FBI agent in New York is illustrative. The agent, who had been involved in the Cole criminal investigation since the day of that attack, asked FBI headquarters to allow New York to use the full criminal investigative resources available to the FBI to find al-Mihdhar. Headquarters responded that its National Security Law Unit advised that this could not be done. This was the exchange:

Within two weeks after the September 11 attacks, the FBI prepared an analysis of Bin Ladin's responsibility as part of the State Department's development of a "White Paper" that could be shared with foreign governments. That analysis relied, at least in part, on the connection between the attack on the USS Cole investigation and al-Mihdbar and al-Hazmi:

The two hijackers referred to were al-Mihdhar and al-Hazmi. The senior al-Qa'ida terrorist was Khallad. The place that they met was Malaysia. Thus, the facts linking these two individuals to Khallad and therefore to Usama Bin Ladin formed the crux of the case made by the State Department to governments around the world that Usama Bin Ladin should be held accountable for the September 11 attacks.

Data Flow to the TIPOFF Watchlist

The case of the two hijackers who were watchlisted too late, al-Hazmi and al-Mihdhar, and the case that will be discussed later of another suspected terrorist, who, according to the State Department, was watchlisted in time, dramatically illustrate that the prompt, routine, and accurate flow of names of suspected terrorists from U.S. intelligence and law enforcement agencies to the State Department's TIPOFF watchlist is an important part of the U.S. Government's efforts to keep terrorists out of the United States.

The Consular Lookout and Support System (CLASS) watchlist is an automated database that was created in 1994 to prevent issuance of visas to inadmissible aliens. Congress required the Department of State to implement the automated database after it was reported that the mastermind of the 1993 attack against the World Trade Center, Sheik Abdul Rahman ("the Blind Sheik"), had been issued a visa even though the United States had information to deny him entry to the United States. Today, CLASS contains over six million names. The derogatory information on those individuals (crimes, drug dealing, etc.) comes from a variety of sources.

TIPOFF is a small part of CLASS. TIPOFF is an intelligence database that receives information on suspected terrorists from U.S. law enforcement, intelligence, and other agencies. It currently contains over 70,000 names of suspected terrorists who are either members of foreign terrorist organizations, known hijackers, car bombers, assassins, or hostage-takers. It was designed to enhance border security by using classified intelligence information and privileged law enforcement material to identify terrorists, sanitizing the information into basic identification indicators and making that information available to consular officers abroad, and to INS agents and Customs officials performing security checks at U.S. borders and points of entry. Consular officers must certify that they have checked the CLASS and TIPOFF systems before issuing visas, and are liable to criminal penalties if they do not. Any name that is checked and results in a "hit," i.e., a double zero (00), must be adjudicated by a State Department officer in Washington, D.C. and requires a formal response to the field before a visa may be issued.

The CIA, FBI, and NSA collect information on terrorist threats to the United States. The Federal Aviation Administration (FAA), Drug Enforcement Agency (DEA), INS, and other agencies also perform a limited amount of collection. As names emerge in connection with those terrorist threats, names of terrorist suspects are provided to the State Department managers of the TIPOFF system. The threshold for adding a name to TIPOFF is low. If there is reasonable suspicion that the named individual is a terrorist or affiliated with a terrorist organization, that individual may be watchlisted in TIPOFF. Therefore, TIPOFF depends on intelligence flowing to it from all of these agencies, but particularly the NSA, CIA, and FBI.

The Joint Inquiry Staff has examined the extent to which these agencies supported the TIPOFF system before and after September 11, 2001, including the intelligence data flow into the TIPOFF watchlist. Despite Congressional concern regarding the flow of data, including a Fiscal Year 1996 Commerce/Justice/State Appropriations Report, and despite a signed January 2001 Memorandum of Understanding (MOU) between CIA, FBI, NSA, and State's TIPOFF Program regarding procedures and safeguards for sharing data, State Department officials we interviewed complained that a number of Central Intelligence Reports (CIRs) from CIA containing terrorist names were not provided to the TIPOFF program prior to September 11, 2001. The Joint Inquiry Staff also learned that at least 1,500 CIRs that had not been disseminated to the TIPOFF Program by CIA prior to September 11, 2001 were provided by CIA to the TIPOFF Program approximately one month after September 11, 2001. Because of this large volume of data and its limited resources, the TIPOFF Program asked that the CIA analyze these CIRs. That analysis yielded the names of approximately 150 suspected terrorists and resulted in the addition of 58 new suspected terrorist names on the TIPOFF watchlist.

As further evidence of shortcomings in the flow of intelligence data to the TIPOFF system, State Department officials pointed to a 455% increase in names being entered into the TIPOFF system after September 11, 2001. Specifically, according to data from the TIPOFF Program, 1,761 names of suspected terrorists were added to TIPOFF from June 1, 2001 to September 11, 2001, whereas 4,251 suspected terrorists were added to TIPOFF from September 12, 2001 to December 24, 2001. An official in the State Department's TIPOFF program states that this post-September 11, 2001 spike in terrorist names being provided was, in large part, due to the fact that our intelligence and investigatory assets were on a "war footing."

In response to a Joint Inquiry Staff question, CIA acknowledged:

State Department personnel who had briefed CIA personnel prior to September 11, 2001 regarding the TIPOFF program reported that they found little awareness of watchlisting policies and procedures among these personnel. In addition, during the Joint Inquiry's closed hearing on June 18 and 19, 2002, CIA officials testified that, prior to September 11, 2001, officers in the CTC had different understandings of their responsibilities to the watchlist process and the criteria for watchlisting. Representatives of the CIA also acknowledged that, prior to September 11, 2001, the organization had not made clear to CTC personnel what they needed to know about the watchlist process.

There has also been, according to State Department officials, difficulty obtaining data for watchlisting purposes from the National Crime Information Center's Interstate Identification Index (NCIC III), which is managed by the FBI. The former Assistant Secretary of State in the Bureau of Consular Affairs advised the Joint Inquiry Staff that, until legislation was enacted after September 11, 2001, the State Department had never had access to the names and criminal history record information contained in that index. The former Assistant Secretary says that the State Department had attempted to secure access to that information for ten years, without success, because of its utility to the CLASS watchlist. While this database had been made available to local and state law enforcement officers on laptop computers, it had not been made available to the State Department to help prevent potential terrorists from entering the United States.

In addition to the Department of State, intelligence officers at the Departments of Transportation and Energy also expressed strong opinions regarding the desirability of access to the NCIC III information for watchlist and other security purposes. The Commerce, Justice, and State Appropriations Bills for Fiscal Years 1996 and 1997 requested that State and FBI prepare a report detailing their plan for the sharing and utilization of this FBI information. The USA Patriot Act sought to resolve this issue, even though pursuant to 28 U.S.C. Section 534, the Attorney General had been permitted to exchange criminal history record information with other agencies and authorized officials of the Federal Government. Agreements are now being developed between the FBI and the State Department concerning the incorporation of certain files from NCIC III into CLASS, with the eventual goal of incorporation of all useable and relevant data.

Review of the Hijackers' Visas and the Visa Issuance Process

The Joint Inquiry Staff has conducted a review of the passport and visa history of the 19 hijackers who were involved in the September 11 attacks to determine whether they entered the United States legally. In addition, the review concerned whether there might have been any indicators or anomalies in the process by which the hijackers obtained U.S. visas and were enabled to enter the United States. Based on the information provided thus far to the Joint Inquiry there appears to be very little in the visa process regarding the September 11 hijackers that should have aroused suspicions or otherwise triggered actions by the U.S. Government to deny them entry into the United States.

An important reality to understand about the visa process is its magnitude. Visas are issued by the Department of State through embassies and consular offices abroad. The State Department reports that there are over 10 million applications per year worldwide for visas to the United States at approximately 250 consular locations. Visa applications are submitted and selected applicants are interviewed. Consular officers at the posts abroad review all applications for completeness and accuracy. Consular officers average 3 to 5 minutes per application. Consular officers must certify in writing, as has been explained earlier, that they have checked the applicant's name against the State Department's CLASS, which includes TIPOFF, a database fed by intelligence and other information. Therefore, the visa issuance process at consular offices abroad is the first opportunity to screen out suspected terrorists by not issuing them a visa.

The consular officers' review is predicated on two priorities: first, determining whether the individual is likely to return to his or her country of origin in accordancce with the visa; and, second, checking the CLASS and TTPOFF watchlists to make sure that the individual applying is not suspected of involvement in criminal or terrorist activities. As explained earlier, if a foreign applicant has been identified in the TIPOFF system, i.e., "watchlisted," as a suspected terrorist, a "double zero" (00) appears automatically on the consular officer's computer screen and a visa cannot be issued until that case is reviewed in Washington, DC.

A visa obtained legally at an overseas post does not guarantee entry into the United States. Rather, it is a travel document that allows the traveler to present himself or herself to an immigration officer at a port-of-entry. Thus, the next occasion for screening individuals entering the United States with non-immigrant visas takes place at U.S. ports-of-entry - airports, seaports, and land borders. The immigration officer is charged with reviewing the visa and determining the type and length of stay. It is the INS officer's action that makes the stay in the United States legal and official. The length of the visa's validity depends on the country of origin of the applicant and follows from government-to-govemment agreements. The INS watchlist is called NAILS and incorporates a subset of TIPOFF information on suspected terrorists as well as other lists of felons, drug dealers, and organized crime associates.

The Joint Inquiry Staff's review of the visa history of the 19 hijackers revealed that visas were issued to them at consular offices abroad in accordance with routine procedures. As noted earlier in this statement, two of the hijackers should have been included on the State Department's TIPOFF watchlist as of early 2000, but this was the responsibility of the intelligence and law enforcement agencies. According to data received thus far, it appears that the majority of the hijackers sought new passports shortly before requesting their visas. Requests for new passports are not unusual and frequently stem from their loss, or accidental destruction. However, the Joint Inquiry Staff was told that suspected terrorists often try to hide prior travel to countries that provide terrorist training.

Multiple-entry visas were issued to the hijackers for periods ranging from two to ten years. Eighteen of the 19 received B- 1/B-2 visas for tourist and business purposes in accordance with applicable procedures. The nineteenth hijacker, Hani Hanjour, was issued a B-1/B-2 visa in error. He should have been issued an F-1 visa for study in the United States since he had expressed a desire to study English while in the United States. Recognizing the error, the INS issued Hanjour an F-1 visa when he arrived in the United States. The normal issuance period for a B-1/B-2 visa is six months, whereas an F-1 visa is issued for the "duration of status" which would frequently be one or several years.

At their ports-of-entry, the 19 hijackers were issued "stay visas" by the INS. These are typically valid for a six-month tourist/business stay. Thus, some of the 19 hijackers - Mohamed Atta, Hani Hanjour, Marwan al-Shehhi, Khalid al-Mihdhar and Ziad Jarrah - entered and re-entered the United States for several six-month periods prior to September 11, 2001. They would stay for five or six months, return to their country of origin or another destination, stay abroad for a period of weeks or months, re-enter the United States, and seek an additional six-month business/tourist stay from the INS upon re-entry.

Since 15 of the 19 hijackers were Saudi nationals and were issued passports in Saudi Arabia, questions have been raised about a program called "Visa Express." "Visa Express" is the name given to a process that exists in many countries and that encourages visa applicants to submit their non-immigrant visa applications to designated travel agencies or other collection points that then forward the applications to the U.S. Embassy for processing. State Department officials tell the Joint Inquiry Staff that "Visa Express" is only an application collection process and not a visa adjudication, issuance, or determination process. According to State Department officials, all non-immigrant visas require a formal application and "Visa Express" is one way of "dropping the application off." The travel agencies assist by providing the applicants with the correct forms, helping non-English speakers fill out the required forms properly, and collecting the relevant fees. There are approximately 60 embassies and consulates throughout the world that have some type of arrangement to use travel agencies or business referrals in this manner. The real difference is that the "Visa Express" program in Saudi Arabia became the only way of delivering visa applications to the embassy; elsewhere, it was one of several ways of delivering the visa application, including delivering it in person to the embassy.

State Department officials advise the Joint Inquiry Staff that there is a formal vetting process to selecting the travel agencies, but those officials have not been able to identify the specific criteria that are used for this purpose. They state that the travel agencies have to be trustworthy and efficient and not overcharge the applicants for the service. Reasons for using travel agencies include physical space and security considerations in the U.S. Embassies. State Department officials who served as consular officers in the Middle East and in South America state that, until the Lebanon Marine barracks bombing in 1983, there was no physical protection between U.S. employees and applicants waiting for visas. This posed significant risks to U.S. Embassy employees. Designated collection points also allow the U.S. Embassies to shift the burden of data entry and grouping of applications - a mundane task - to travel agencies and free U.S Government employees to focus on reviewing the applications.

The "Visa Express" program in Saudi Arabia began in May 2001. Five of the nineteen hijackers applied for visas in Saudi Arabia after the "Visa Express" program began, so it is likely that these five individuals used travel agencies in Saudi Arabia to acquire the application forms and deliver them to the embassy. The five June 2001 applicants in Saudi Arabia were: Khalid al-Mihdhar, Abdulaziz al-Omari, Salem al-Hazmi, Saeed al-Ghamdi, and Fayez Banihammad. None of the five, including Khalid al-Mihdhar, were on the watchlist at that time. Thus, when the obligatory name check was performed before issuing their visas, the system showed no derogatory terrorist information. In cases where derogatory information did exist in the system, as was true with regard to another suspected terrorist, who applied for a visa in Saudi Arabia on August 5, 2001 under the "Visa Express" program, the applicant was denied a visa because the watchlist system blocked the visa issuance.

State Department officials say that the "Visa Express" program was terminated in Saudi Arabia as of July 19, 2002 because reporting about the program had created an impression that it somehow allowed Saudi applicants to skirt the normal visa issuance process. The Bureau of Consular Affairs at the Department of State has informed the Joint Inquiry Staff that travel agency and business referral programs to assist the delivery of completed applications to the consular officers exist in 60 embassies and consulates throughout the world. According to officials at the State Department, the "Visa Express" program did not affect the number of Saudis interviewed, since applicants were selected for interviews on the basis of indications in their applications that the individual might intend to immigrate. They also explain that all applications, including those delivered to consular officers under the "Visa Express" program in Saudi Arabia, were checked against the CLASS watchlist to determine if there were any indications that this individual might be a suspected terrorist. Currently, all Saudi applicants for visas between the ages of 16 and 45 are interviewed by consular affairs officers.

State Department officials tell the Joint Inquiry Staff that only U.S. consular officers who have been trained are authorized to review applications and issue visas. Furthermore, all consular officers must determine which applicants require a personal interview. This determination is based on the quality of the information provided in the application. While all visas are issued following a review of the CLASS system and determination of the potential for the applicant to become an illegal immigrant, it was not until September 11 that the State Department focused on terrorism as a key review item. However, State Department officials say that, unless there is derogatory information in CLASS, they are unable to determine who may be a potential terrorist. As to the value of personal interviews, State Department officials explain that they were of little value in Saudi Arabia before September 11, 2001 as Saudi Arabia was one of the countries that did not fit the profile for terrorism or illegal immigration.

Information provided by the State Department indicates that 15 of the 19 hijackers were Saudi nationals; all 15 were issued visas in Saudi Arabia. The Joint Inquiry Staff's review of the visa applications submitted by the hijackers indicates that at least one, Hani Hanjour, was interviewed by a State Department consular officer. Discussions with State Department officials indicate that this interview was not related to any concerns about terrorist activity. Our review and the State Department's review are unable to determine if any other hijackers appeared in person to discuss their applications with a U.S. official.

The Joint Inquiry Staff also received pertinent information from INS concerning the 19 hijackers. Two of the hijackers, Satam al-Suqami and Nawaf al-Hazmi, had overstayed the visas issued by the INS upon their entry into the United States. Hani Hanjour was, as mentioned earlier, issued an F-1 visa by the INS to study English in Oakland, California but he never registered for classes there so he was "a non-immigrant status violator." However, INS was not aware of this violation until after September 11, 2001.

Overstay violations on non-immigrant visas and students who choose not to register for classes pose an enormous problem for the INS. According to the INS, there are approximately four million overstays who initially entered the United States legally. INS only has some 1,300 agents nationwide to locate overstays, but that is a relatively low priority when considering other illegal alien violations. For purposes of comparison, the Capitol Hill Police Force has approximately the same number of police officers to cover about 270 acres as the INS has special agents to cover the entire United States. In the absence of other derogatory information, INS stipulates that there would have been no particular reason to seek out these two individuals for overstays or Hani Hanjour for not registering for his English language program.

The State Department was contacted by the CIA after regular business hours on August 23, 2001 regarding Khalid al-Mihdhar and Nawaf al-Hazmi as explained earlier. These two individuals were immediately watchlisted on August 24, 2001 and a process begun on August 24, 2001 to revoke their visas. The Bureau of Diplomatic Security at the State Department was contacted on August 28, 2001 and asked to supply the FBI with visa information but was not asked to assist in locating the individuals, nor was any other information provided to it that would have indicated either a high priority or imminent danger. The same is true of INS, since the notice regarding these two individuals was considered to be routine. Thus, INS provided FBI only with the address listed on al-Mihdhar's I-94 immigration form and did not query its database for other locator information.

INS indicates that, if it had been asked to locate the two suspected terrorists, Nawaf al-Hazmi and Khalid al-Mihdhar, in late August on an urgent, emergency basis, it would have been able to run those names through its extensive database system and might have been able to locate them. Absent a sense of highest priority, however, INS states that it equated the search for these two individuals with other, more routine name searches, sometimes 50 or more per day, that it was running at the time. The Bureau of Diplomatic Security at the State Department also has told the Joint Inquiry Staff that it has extensive means of locating individuals who are involved in visa fraud or visa violations and also contends that it might have been able to locate the two suspected terrorists if it had been asked to do so.

Preliminary Conclusions

September 11 hijackers Khalid al-Mihdhar and Nawaf al-Hazmi came to the attention of the Intelligence Community in early 2000 but entered the United States unobserved soon after. The Intelligence Community succeeded in determining that these Bin Laden operatives were in Malaysia in January 2000 and in obtaining important information about them. The system broke down, however, in making the best use of that information and in ensuring that it was effectively and fully shared with agencies, like the FBI, the State Department and the INS, that could have acted on it to either prevent them from entering the United States or surveil them and uncover their activities while in the United States.

In addition, the FBI and the CIA had responsibilities to respond to the October 2000 attack on USS Cole. Each had information that the other needed to carry out those responsibilities. But, at a key meeting in New York on June 11, 2001, the CIA did not provide to the FBI information about the Malaysian meeting and its participants that could have assisted the FBI in its investigation. These events reflect misunderstandings that have developed over the last several years about using information derived from intelligence gathering activities in criminal investigations.

The problems of communication between organizations that are demonstrated by the al-Mihdhar/al-Hazmi situation existed not only between the CIA and FBI, but also within the FBI itself. Once it was determined in late August 2001 that Khalid al-Mihdhar was in the United States, the search to determine his whereabouts was limited by U.S. Government policies and practices regarding the use of intelligence information in FBI criminal investigations. This limited the resources that were made available for the FBI to conduct the search during a time in which al-Mihdhar and al-Hazmi were purchasing their September 11 tickets and traveling to their last rallying points.

PDF Version