The 9/11 Commission report [electronic resource] : final report of the National Commission on Terrorist Attacks upon the United States

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

^^

8

'THE SYSTEM WAS
BLINKING RED"

8.1 THE SUMMER OF THREAT

As 2001 began, counterterrorisni officials were receiving frequent but fragmen-
tary reports about threats. Indeed, there appeared to be possible threats almost
everywhere the United States had interests — including at home.

To understand how the escalation in threat reporting was handled in the
summer of 2001, it is useful to understand ho^v threat information in general
is collected and conveyed. Information is collected through several methods,
including signals intelligence and interviews of human sources, and gathered
into intelligence reports. Depending on the source and nature of the report-
ing, these reports may be highly classified — and therefore tightly held — or less
sensitive and widely disseminated to state and local law enforcement agencies.
Threat reporting must be disseminated, either through individual reports or
through threat advisories. Such advisories, intended to alert their recipients,
may address a specific threat or be a general ^varning.

Because the amount of reporting is so voluminous, only a select fraction can
be chosen for briefing the president and senior officials. During 2001, Direc-
tor of Central Intelligence George Tenet was briefed regularly regarding threats
and other operational information relating to Usama Bin Ladin.i He in turn
met daily with President Bush, who was briefed by the CIA through what is
known as the Presidents Daily Brief (PDB). Each PDB consists of a series of
six to eight relatively short articles or briefs covering a broad array of topics;
CIA staff decides \vhich subjects are the most important on any given day.
There were more than 40 intelligence articles in the PDBs from January 20
to September 10, 2001, that related to Bin Ladin. The PDB is considered
highly sensitive and is distributed to only a handful of high-level officials. -

The Senior Executive Intelligence Brief (SEIB), distributed to a broader
group of officials, has a similar format and generally covers the same subjects
as the PDB. It usually contains less information so as to protect sources and

254

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

^^

"THE SYSTEM WAS BLINKING RED" 255

methods. Like their predecessors, the Attorney General, the FBI Director, and
Richard Clarke, the National Security Council (NSC) counterterrorism coor-
dinator, all received the SEIB, not the PDB.^ Clarke and his staff had extensive
access to terrorism reporting, but they did not have access to internal, nondis-
seminated information at the National Security Agency (NSA), CIA, or FBI.

The Drumbeat Begins

In the spring of 2001, the level of reporting on terrorist threats and planned
attacks increased dramatically to its highest level since the millennium alert. At
the end of March, the intelligence community disseminated a terrorist threat
advisory, indicating a heightened threat of Sunni extremist terrorist attacks
against U.S. facilities, personnel, and other interests. '^

On March 23, in connection with discussions about possibly reopening
Pennsylvania Avenue in front of the White House, Clarke ^varned National
Security Advisor Condoleezza Rice that domestic or foreign terrorists might
use a truck bomb — their "weapon of choice" — on Pennsylvania Avenue. That
would result, he said, in the destruction of the West Wing and parts of the res-
idence. ^ He also told her that he thought there were terrorist cells within the
United States, including al Qaeda.

The next week. Rice was briefed on the activities of Abu Zubaydah and on
CIA efforts to locate him. As pointed out in chapter 6, Abu Zubaydah had been
a major figure in the millennium plots. Over the next fe\v weeks, the CIA repeat-
edly issued warnings — including calls from DCI Tenet to Clarke — that Abu
Zubaydah \vas planning an operation in the near future. One report cited a source
indicating that Abu Zubaydah ^vas planning an attack in a country that CIA ana-
lysts thought might be Israel, or perhaps Saudi Arabia or India. Clarke relayed
these reports to Rice.!^

In response to these threats, the FBI sent a message to all its field offices on
April 13, summarizing reporting to date. It asked the offices to task all
resources, including human sources and electronic databases, for any informa-
tion pertaining to "current operational activities relating to Sunni extremism."
It did not suggest that there was a domestic threat.^

The interagency Counterterrorism Security Group (CSG) that Clarke
chaired discussed the Abu Zubaydah reports on April 19. The next day, a brief-
ing to top officials reported "Bin Ladin planning multiple operations." When
the deputies discussed al Qaeda policy on April 30, they began ^vith a briefing
on the threat. 8

In May 2001, the drumbeat of reporting grew louder with reports to top
officials that "Bin Ladin public profile may presage attack" and "Bin Ladin net-
work's plans advancing." In early May, a walk-in to the FBI claimed there was
a plan to launch attacks on London, Boston, and New York. Attorney General
John Ashcroft was briefed by the CIA on May 1 5 regarding al Qaeda gener-
ally and the current threat reporting specifically. The next day brought a report

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

^^

256 THE 9/11 COMMISSION REPORT

that a phone call to a U.S. embassy had ^varned that Bin Ladin supporters were
planning an attack in the United States using "high explosives." On May 17,
based on the previous day's report, the first item on the CSG's agenda was
"UBL: Operation Planned in U.S.'"' The anonymous caller's tip could not be
corroborated.

Late May brought reports of a possible hostage plot against Americans abroad
to force the release of prisoners, including Sheikh Omar Abdel Rahman, the
"Blind Sheikh," who was serving a life sentence for his role in the 1993 plot to
blow up sites in Ne^vYork City. The reporting noted that operatives might opt
to hijack an aircraft or storm a U.S. embassy This report led to a Federal Avia-
tion Administration (FAA) information circular to airlines noting the potential
for "an airline hijacking to free terrorists incarcerated in the United States."
Other reporting mentioned that Abu Zubaydah was planning an attack, possi-
bly against Israel, and expected to carry out several more if things went ^vell.
On May 24 alone, counterterrorism officials grappled with reports alleging plots
in Yemen and Italy, as well as a report about a cell in Canada that an anonymous
caller had claimed might be planning an attack against the United States. lo

Reports similar to many of these were made available to President Bush in
morning intelligence briefings with DCI Tenet, usually attended by Vice Pres-
ident Dick Cheney and National Security Advisor Rice. While these briefings
discussed general threats to attack America and American interests, the specific
threats mentioned in these briefings were all overseas.

On May 29, Clarke suggested that Rice ask DCI Tenet what more the
United States could do to stop Abu Zubaydah from launching"a series of major
terrorist attacks," probably on Israeli targets, but possibly on U.S. facilities.
Clarke wrote to Rice and her deputy, Stephen Hadley, "When these attacks
occur, as they likely ^vill, we will ^vonder ^vhat more we could have done to
stop them." In May, CIA Counterterrorist Center (CTC) Chief Cofer Black
told Rice that the current threat level was a 7 on a scale of 1 to 10, as com-
pared to an 8 during the millennium. ^^

High Probability of Near- Term "Spectacular" Attacks

Threat reports surged in June and July, reaching an even higher peak of urgency.
The summer threats seemed to be focused on Saudi Arabia, Israel, Bahrain,
Kuwait, Yemen, and possibly Rome, but the danger could be any^vhere —
including a possible attack on the G-8 summit in Genoa. A June 12 CIA report
passing along biographical background information on several terrorists men-
tioned, in commenting on Khalid Sheikh Mohammed, that he was recruiting
people to travel to the United States to meet with colleagues already there so
that they might conduct terrorist attacks on Bin Ladin 's behalf. On June 22,
the CIA notified all its station chiefs about intelligence suggesting a possible
al Qaeda suicide attack on a U.S. target over the next fe^v days. DCI Tenet asked
that all U.S. ambassadors be briefed. '^

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

i:>

"THE SYSTEM WAS BLINKING RED" 257

That same day, the State Department notified all embassies of the terrorist
threat and updated its worldwide public warning. In June, the State Depart-
ment initiated the Visa Express program in Saudi Arabia as a security measure,
in order to keep long lines of foreigners away from vulnerable embassy spaces.
The program permitted visa applications to be made through travel agencies,
instead of directly at the embassy or consulate. ^-^

A terrorist threat advisory distributed in late June indicated a high proba-
bility of near-term "spectacular" terrorist attacks resulting in numerous casu-
alties. Other reports' titles warned, "Bin Ladin Attacks May be Imminent" and
"Bin Ladin and Associates Making Near- Term Threats." The latter reported
multiple attacks planned over the coming days, including a "severe blow"
against U.S. and Israeli "interests" during the next two weeks. ^^

On June 21 , near the height of the threat reporting, U.S. Central Command
raised the force protection condition level for U.S. troops in six countries to
the highest possible level. Delta. The U.S. Fifth Fleet moved out of its port in
Bahrain, and a U.S. Marine Corps exercise in Jordan was halted. U.S. embassies
in the Persian Gulf conducted an emergency security review, and the embassy
in Yemen was closed. The CSG had foreign emergency response teams, known
as FESTs, ready to move on four hours' notice and kept up the terrorism alert
posture on a "rolling 24 hour basis.''^^

On June 25, Clarke warned Rice and Hadley that six separate intelligence
reports showed al Qaeda personnel warning of a pending attack. An Arabic tel-
evision station reported Bin Ladin 's pleasure \vith al Qaeda leaders who were
saying that the next weeks "will witness important surprises" and that U.S. and
Israeli interests will be targeted. Al Qaeda also released a ne^v recruitment and
fund-raising tape. Clarke wrote that this was all too sophisticated to be merely
a psychological operation to keep the United States on edge, and the CIA
agreed. The intelligence reporting consistently described the upcoming attacks
as occurring on a calamitous level, indicating that they would cause the world
to be in turmoil and that they would consist of possible multiple — but not nec-
essarily simultaneous — attacks. ^"^

On June 28, Clarke wrote Rice that the pattern of al Qaeda activity indi-
cating attack planning over the past six weeks "had reached a crescendo." "A
series of new reports continue to convince me and analysts at State, CIA, DIA
[Defense Intelligence Agency], and NSA that a major terrorist attack or series
of attacks is likely in July," he noted. One al Qaeda intelligence report warned
that something "very, very, very, very" big was about to happen, and most of
Bin Ladin 's network was reportedly anticipating the attack. In late June, the
CIA ordered all its station chiefs to share information on al Qaeda with their
host governments and to push for immediate disruptions of cells. ^^

The headline of a June 30 briefing to top officials ^vas stark:"Bin Ladin Plan-
ning High-Profile Attacks." The report stated that Bin Ladin operatives
expected near-term attacks to have dramatic consequences of catastrophic pro-

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2^

258 THE 9/11 COMMISSION REPORT

portions. That same day, Saudi Arabia declared its highest level of terror alert.
Despite evidence of delays possibly caused by heightened U.S. security, the
planning for attacks was continuing.!^

On July 2, the FBI Counterterrorisni Division sent a message to federal
agencies and state and local law enforcement agencies summarizing informa-
tion regarding threats from Bin Ladin. It warned that there was an increased
volume of threat reporting, indicating a potential for attacks against U.S. tar-
gets abroad from groups "aligned with or sympathetic to Usama Bin Ladin."
Despite the general warnings, the message further stated, "The FBI has no
information indicating a credible threat of terrorist attack in the United States."
However, it went on to emphasize that the possibility of attack in the United
States could not be discounted. It also noted that the July 4 holiday might
heighten the threats. The report asked recipients to "exercise extreme vigilance"
and "report suspicious activities" to the FBI. It did not suggest specific actions
that they should take to prevent attacks. ^^

Disruption operations against al Qaeda— affiliated cells were launched
involving 20 countries. Several terrorist operatives were detained by foreign
governments, possibly disrupting operations in the Gulf and Italy and perhaps
averting attacks against t^vo or three U.S. embassies. Clarke and others told us
of a particular concern about possible attacks on the Fourth of July. After it
passed uneventfully, the CSG decided to maintain the alert. -'^

To enlist more international help,Vice President Cheney contacted Saudi
Crown Prince Abdullah on July 5. Hadley apparently called European coun-
terparts, while Clarke worked ^vith senior officials in the Gulf. In late July,
because of threats, Italy closed the airspace over Genoa and mounted antiair-
craft batteries at the Genoa airport during the G-8 summit, which President
Bush attended. 21

At home, the CSG arranged for the CIA to brief intelligence and security
officials from several domestic agencies. On July 5, representatives from the
Immigration and Naturalization Service (INS), the FAA, the Coast Guard, the
Secret Service, Customs, the CIA, and the FBI met with Clarke to discuss the
current threat. Attendees report that they were told not to disseminate the
threat information they received at the meeting. They interpreted this direc-
tion to mean that although they could brief their superiors, they could not send
out advisories to the field. An NSC official recalls a somewhat different empha-
sis, saying that attendees \vere asked to take the information back to their home
agencies and "do what you can" with it, subject to classification and distribu-
tion restrictions. A representative from the INS asked for a summary of the
information that she could share with field offices. She never received one.22

That same day, the CIA briefed Attorney General Ashcroft on the al Qaeda
threat, warning that a significant terrorist attack was imminent. Ashcroft was
told that preparations for multiple attacks were in late stages or already com-

Final 8-9. 5pp l/ll/OA 1:24 PM Page 25^

"THE SYSTEM WAS BLINKING RED" 259

plete and that little additional warning could be expected. The briefing
addressed only threats outside the United States. ^3

The next day, the CIA representative told the CSG that al Qaeda members
believed the upcoming attack \vould be "spectacular," qualitatively diflierent
fi-om anything they had done to date.-^

Apparently as a result of the July 5 meeting with Clarke, the interagency
committee on federal building security was tasked to examine security meas-
ures. This committee met on July 9, ^vhen 37 officials from 27 agencies and
organizations were briefed on the "current threat level" in the United States.
They \vere told that not only the threat reports from abroad but also the recent
convictions in the East Africa bombings trial, the conviction of Ahmed
Ressani, and the just-returned Khobar Towers indictments reinforced the need
to "exercise extreme vigilance." Attendees were expected to determine
whether their respective agencies needed enhanced security measures. -^

On July 18, 2001, the State Department provided a warning to the public
regarding possible terrorist attacks in the Arabian Peninsula. -^

Acting FBI DirectorThomas Pickard told us he had one of his periodic con-
ference calls with all special agents in charge on July 19. He said one of the
items he mentioned was the need, in light of increased threat reporting, to have
evidence response teams ready to move at a moment's notice, in case of an
attack. 2'' He did not task field offices to try to determine ^vhether any plots
were being considered within the United States or to take any action to dis-
rupt any such plots.

In mid-July, reporting started to indicate that Bin Ladin's plans had been
delayed, maybe for as long as two months, but not abandoned. On July 23, the
lead item for CSG discussion was still the al Qaeda threat, and it included men-
tion of suspected terrorist travel to the United States. ^^

On July 31, an FAA circular appeared alerting the aviation community to
"reports of possible near-term terrorist operations . . . particularly on the Ara-
bian Peninsula and/or Israel." It stated that the FAA had no credible evidence
of specific plans to attack U.S. civil aviation, though it noted that some of the
"currently active" terrorist groups were known to "plan and train for hijack-
ings" and were able to build and conceal sophisticated explosive devices in lug-
gage and consumer products. ^9

Tenet told us that in his world "the system was blinking red." By late July,
Tenet said, it could not "get any worse."-'" Not everyone ^vas convinced. Some
asked whether all these threats might just be deception. On June 30, the SEIB
contained an article titled "Bin Ladin Threats Are Real." Yet Hadley told Tenet
in July that Deputy Secretary of Defense PaulWolfowitz questioned the report-
ing. Perhaps Bin Ladin was trying to study U.S. reactions. Tenet replied that he
had already addressed the Defense Department's questions on this point; the
reporting was convincing. To give a sense of his anxiety at the time, one senior

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

^^

260 THE 9/11 COMMISSION REPORT

official in the Counterterrorist Center told us that he and a colleague were con-
sidering resigning in order to go public -with their concerns. ^^

The Calm Before the Storm

On July 27, Clarke informed Rice and Hadley that the spike in intelligence
about a near-term al Qaeda attack had stopped. He urged keeping readiness
high during the August vacation period, warning that another report suggested
an attack had just been postponed for a few months "but wiU still happen."^^

On August 1, the FBI issued an advisory that in light of the increased vol-
ume of threat reporting and the upcoming anniversary of the East Africa
embassy bombings, increased attention should be paid to security planning. It
noted that although most of the reporting indicated a potential for attacks on
U.S. interests abroad, the possibility of an attack in the United States could not
be discounted. ^-^

On August 3, the intelligence community issued an advisory concluding
that the threat of impending al Qaeda attacks would likely continue indefi-
nitely. Citing threats in the Arabian Peninsula, Jordan, Israel, and Europe, the
advisory suggested that al Qaeda ^vas lying in wait and searching for gaps in
security before moving forward with the planned attacks. ^^^

During the spring and summer of 2001, President Bush had on several occa-
sions asked his briefers whether any of the threats pointed to the United States.
Reflecting on these questions, the CIA decided to write a briefing article sum-
marizing its understanding of this danger. Two CIA analysts involved in prepar-
ing this briefing article believed it represented an opportunity to communicate
their view that the threat of a Bin Ladin attack in the United States remained
both current and serious. ^5 The result was an article in the August 6 Presiden-
tial Daily Brief titled "Bin Ladin Determined to Strike in US." It was the 36th
PDB item briefed so far that year that related to Bin Ladin or al Qaeda, and
the first devoted to the possibility of an attack in the United States.

The President told us the August 6 report ^vas historical in nature. President
Bush said the article told him that al Qaeda ^vas dangerous, which he said he
had known since he had become President. The President said Bin Ladin had
long been talking about his desire to attack America. He recalled some oper-
ational data on the FBI, and remembered thinking it was heartening that 70
investigations were under way. As best he could recollect. Rice had mentioned
that the Yemenis' surveillance of a federal building in New York had been
looked into in May and June, but there was no actionable intelligence.

He did not recall discussing the August 6 report ^vith the Attorney General
or whether Rice had done so. He said that if his advisers had told him there
was a cell in the United States, they would have moved to take care of it. That
never happened. ^^

Although the following day's SEIB repeated the title of this PDB, it did not
contain the reference to hijackings, the alert in New York, the aUeged casing

Final 8-9. 5pp 7/17/04 1:24 PM Page 2

^^

"THE SYSTEM WAS BLINKING RED"

261

The following is the text of an item from the Presidential Daily Brief received by
President George W Bush on August 6, 2001J'' Redacted material is indicated
by brackets.

Bin Ladin Determined To Strike in US

Clandestine, foreign government, and media reports indicate Bin Ladin
since 1997 has wanted to conduct terrorist attacks in the US. Bin Ladin
implied in US television interviews in 1997 and 1998 that his followers
would follow the example of World Trade Center bomber RamziYousef
and "bring the fighting to America."

After US missile strikes on his base in Afghanistan in 1998, Bin
Ladin told followers he wanted to retaliate in Washington, accord-
ing to a [ — ] service.

An Egyptian Islamic Jihad (EIJ) operative told an [ — ] service
at the same time that Bin Ladin was planning to exploit the oper-
ative's access to the US to mount a terrorist strike.

The millennium plotting in Canada in 1999 may have been part of Bin
Ladin 's first serious attempt to implement a terrorist strike in the US.

Convicted plotter Ahmed Ressam has told the FBI that he conceived
the idea to attack Los Angeles International Airport himself, but that Bin
Ladin lieutenant Abu Zubaydah encouraged him and helped facilitate
the operation. Ressam also said that in 1998 Abu Zubaydah was plan-
ning his own US attack.

Ressam says Bin Ladin was aware of the Los Angeles operation.

Although Bin Ladin has not succeeded, his attacks against the US
Embassies in Kenya and Tanzania in 1998 demonstrate that he prepares
operations years in advance and is not deterred by setbacks. Bin Ladin
associates surveilled our Embassies in Nairobi and Dar es Salaam as early
as 1993, and some members of the Nairobi cell planning the bombings
were arrested and deported in 1997.

Al-Qa'ida members — including some who are US citizens — have resided
in or traveled to the US for years, and the group apparently maintains a
support structure that could aid attacks. Two al-Qua' da members found

Final 8-9. 5pp 7/17/04 1:24 PM Page 26

262

THE 9/11 COMMISSION REPORT

guilty in the conspiracy to bomb our embassies in East Africa were US
citizens, and a senior EIJ member lived in California in the mid-1990s.

A clandestine source said in 1998 that a Bin Ladin cell in New York
was recruiting Muslim-American youth for attacks.

We have not been able to corroborate some of the more sensational threat
reporting, such as that from a [ — ] service in 1998 saying that Bin Ladin
wanted to hijack a US aircraft to gain the release of "Blind Shaykh"
'Umar 'Abd al-Rahman and other US-held extremists.

Nevertheless, FBI information since that time indicates patterns of
suspicious activity in this country consistent with preparations for
hijackings or other types of attacks, including recent surveillance of
federal buildings in New York.

The FBI is conducting approximately 70 full field investigations
throughout the US that it considers Bin Ladin-related. CIA and
the FBI are investigating a call to our Embassy in the UAE in May
saying that a group of Bin Ladin supporters was in the US plan-
ning attacks with explosives.

of buildings in New York, the threat phoned in to the embassy, or the fact that
the FBI had approximately 70 ongoing bin Ladin— related investigations. ^^ No
CSG or other NSC meeting was held to discuss the possible threat of a strike
in the United States as a result of this report.

Late in the month, a foreign service reported that Abu Zubaydah was con-
sidering mounting terrorist attacks in the United States, after postponing pos-
sible operations in Europe. No targets, timing, or method of attack were
provided. 39

We have found no indication of any further discussion before September
11 among the President and his top advisers of the possibility of a threat of an
al Qaeda attack in the United States. DCI Tenet visited President Bush in
Crawford, Texas, on August 17 and participated in PDB briefings of the Pres-
ident between August 31 (after the President had returned to Washington) and
September 10. But Tenet does not recall any discussions with the President of
the domestic threat during this period.^o

Most of the intelligence community recognized in the summer of 2001 that
the number and severity of threat reports were unprecedented. Many ofliicials
told us that they knew something terrible was planned, and they were desper-
ate to stop it. Despite their large number, the threats received contained few

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

^^

"THE SYSTEM WAS BLINKING RED" 263

specifics regarding time, place, method, or target. Most suggested that attacks
were planned against targets overseas; others indicated threats against unspeci-
fied "U.S. interests." We cannot say for certain whether these reports, as dra-
matic as they ^vere, related to the 9/11 attacks.

Government Response to the Threats

National Security Advisor Rice told us that the CSG was the "nerve center"
for running the crisis, although other senior officials were involved over the
course of the summer. In addition to his daily meetings with President Bush,
and weekly meetings to go over other issues \vith Rice,Tenet was speaking reg-
ularly ^vith Secretary of State Colin Powell and Secretary of Defense Donald
Rumsfeld. The foreign policy principals routinely talked on the telephone
every day on a variety of topics. '*i

Hadley told us that before 9/1 1, he and Rice did not feel they had the job
of coordinating domestic agencies. They felt that Clarke and the CSG (part of
the NSC) were the NSC's bridge between foreign and domestic threats. ^^^

There was a clear disparity in the levels of response to foreign versus domes-
tic threats. Numerous actions were taken overseas to disrupt possible attacks —
enlisting foreign partners to upset terrorist plans, closing embassies, moving
military assets out of the way of possible harm. Far less was done domestically —
in part, surely, because to the extent that specifics did exist, they pertained to
threats overseas. As noted earlier, a threat against the embassy in Yemen quickly
resulted in its closing. Possible domestic threats were more vague. When reports
did not specify where the attacks were to take place, officials presumed that they
would again be overseas, though they did not rule out a target in the United
States. Each of the FBI threat advisories made this point. ^^^

Clarke mentioned to National Security Advisor Rice at least t^vice that al
Qaeda sleeper cells were likely in the United States. In January 2001, Clarke
forwarded a strategy paper to Rice warning that al Qaeda had a presence in
the United States. He noted that t^vo key al Qaeda members in the Jordanian
cell involved in the millennium plot were naturalized U.S. citizens and that one
jihadist suspected in the East Africa bombings had "informed the FBI that an
extensive network of al Qida 'sleeper agents' currently exists in the US." He
added that Ressam's abortive December 1999 attack revealed al Qaeda sup-
porters in the United States. '^'^ His analysis, however, was based not on new
threat reporting but on past experience.

The September 1 1 attacks fell into the void between the foreign and domes-
tic threats. The foreign intelligence agencies were watching overseas, alert to
foreign threats to U.S. interests there. The domestic agencies were waiting for
evidence of a domestic threat from sleeper cells within the United States. No
one was looking for a foreign threat to domestic targets. The threat that was
coming was not from sleeper cells. It was foreign — but from foreigners who
had infiltrated into the United States.

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

^^

264 THE 9/11 COMMISSION REPORT

A second cause of this disparity in response is that domestic agencies did
not know ^vhat to do, and no one gave them direction. Cressey told us that the
CSG did not tell the agencies ho\¥ to respond to the threats. He noted that the
agencies that were operating overseas did not need direction on how to
respond; they had experience ^vith such threats and had a"playbook." In con-
trast, the domestic agencies did not have a game plan. Neither the NSC (includ-
ing the CSG) nor anyone else instructed them to create one.'^s

This lack of direction was evident in the July 5 meeting with representa-
tives from the domestic agencies. The briefing focused on overseas threats. The
domestic agencies were not questioned about how they planned to address the
threat and were not told what was expected of them. Indeed, as noted earlier,
they were specifically told they could not issue advisories based on the brief-
ing.'** The domestic agencies' limited response indicates that they did not per-
ceive a call to action.

Clarke reflected a different perspective in an email to Rice on September
15, 2001. He summarized the steps taken by the CSG to alert domestic agen-
cies to the possibility of an attack in the United States. Clarke concluded that
domestic agencies, including the FAA, kne^v that the CSG believed a major al
Qaeda attack was coming and could be in the United States.

Although the FAA had authority to issue security directives mandating new
security procedures, none of the fe\v that ^vere released during the summer of
2001 increased security at checkpoints or on board aircraft. The information
circulars mostly urged air carriers to "exercise prudence" and be alert. Prior to
9/11, the FAA did present a CD-ROM to air carriers and airport authorities
describing the increased threat to civil aviation. The presentation mentioned
the possibility of suicide hijackings but said that "fortunately, we have no indi-
cation that any group is currently thinking in that direction." '^^ The FAA con-
ducted 27 special security briefings for specific air carriers bet^veen May 1,
2001, and September 11, 2001. Two of these briefings discussed the hijacking
threat overseas. None discussed the possibility of suicide hijackings or the use
of aircraft as weapons. No new security measures were instituted. '*8

Rice told us she understood that the FBI had tasked its 56 U.S. field offices
to increase surveillance of suspected terrorists and to reach out to informants
who might have information about terrorist plots. An NSC staff document at
the time describes such a tasking as having occurred in late June but does not
indicate whether it ^vas generated by the NSC or the FBI. Other than the pre-
viously described April 13 communication sent to all FBI field offices, how-
ever, the FBI could not find any record of having received such a directive.The
April 13 document asking field offices to gather information on Sunni
extremism did not mention any possible threat within the United States and
did not order surveillance of suspected operatives. The NSC did not specify
what the FBI's directives should contain and did not review what had been
issued earlier. 49

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

^^

"THE SYSTEM WAS BLINKING RED" 265

Acting FBI Director Pickard told us that in addition to his July 19 confer-
ence call, he mentioned the heightened terrorist threat in individual calls ^vith
the special agents in charge of field offices during their annual performance
revie\v discussions. In speaking -with agents around the country, ^ve found lit-
tle evidence that any such concerns had reached FBI personnel beyond the
New York Field Office, ^o

The head of counterterrorism at the FBI, Dale Watson, said he had many
discussions about possible attacks with Cofer Black at the CIA. They had
expected an attack on July 4. Watson said he felt deeply that something was
going to happen. But he told us the threat information was "nebulous." He
wished he had kno^vn more. He wished he had had "500 analysts looking at
Usama Bin Ladin threat information instead of two."^^

Attorney General Ashcroft was briefed by the CIA in May and by Pickard
in early July about the danger. Pickard said he met with Ashcroft once a week
in late June, through July, and twice in August. There is a dispute regarding
Ashcrofts interest in Pickard's briefings about the terrorist threat situation.
Pickard told us that after two such briefings Ashcroft told him that he did not
want to hear about the threats anymore. Ashcroft denies Pickard's charge.
Pickard says he continued to present terrorism information during further
briefings that summer, but nothing further on the "chatter" the U.S. govern-
ment was receiving. 5-

The Attorney General told us he asked Pickard ^vhether there was intelli-
gence about attacks in the United States and that Pickard said no. Pickard said
he replied that he could not assure Ashcroft that there would be no attacks in
the United States, although the reports of threats were related to overseas tar-
gets. Ashcroft said he therefore assumed the FBI ^vas doing what it needed to
do. He acknowledged that in retrospect, this was a dangerous assumption. He
did not ask the FBI ^vhat it was doing in response to the threats and did not
task it to take any specific action. He also did not direct the INS, then still part
of the Department of Justice, to take any specific action. ^^

In sum, the domestic agencies never mobilized in response to the threat.
They did not have direction, and did not have a plan to institute. The borders
were not hardened. Transportation systems were not fortified. Electronic sur-
veillance was not targeted against a domestic threat. ^^ State and local law
enforcement \vere not marshaled to augment the FBI's efforts. The public was
not warned.

The terrorists exploited deep institutional failings within our government.
The question is whether extra vigilance might have turned up an opportu-
nity to disrupt the plot. As seen in chapter 7, al Qaeda's operatives made nfis-
takes. At least two such nnstakes created opportunities during 2001, especially
in late August.

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

^^

266 THE 9/11 COMMISSION REPORT

8.2 LATE LEADS— MIHDHAR,MOUSSAOUI, AND KSM

In chapter 6 we discussed how intelligence agencies successfully detected some
of the early travel in the planes operation, picking up the movements of Khalid
al Mihdhar and identifying him, and seeing his travel converge ^vith someone
they perhaps could have identified but did not — Nawaf al Hazmi — as well as with
less easily identifiable people such as Khallad and Abu Bara. These observations
occurred in December 1999 and January 2000. The trail had been lost in Janu-
ary 2000 \vithout a clear realization that it had been lost, and without much effort
to pick it up again. Nor had the CIA placed Mihdhar on the State Department's
watchlist for suspected terrorists, so that either an embassy or a port of entry
might take note if Mihdhar showed up again.

On four occasions in 2001, the CIA, the FBI, or both had apparent oppor-
tunities to refocus on the significance of Hazmi and Mihdhar and reinvigorate
the search for them. After reviewing those episodes we ^vill turn to the han-
dling of the Moussaoui case and some late leads regarding Khalid Sheikh
Mohammed.

January 2001: Identification of Khallad

Almost one year after the original trail had been lost in Bangkok, the FBI and
the CIA were working on the investigation of the Cole bombing. They learned
of the link between a captured conspirator and a person called "Khallad."They
also learned that Khallad was a senior security official for Bin Ladin who had
helped direct the bombing (we introduced Khallad in chapter 5, and returned
to his role in the Cole bombing in chapter 6).55

One of the members of the FBI's investigative team in Yemen realized that
he had heard of Khallad before, from a joint FBI/CIA source four months ear-
lier.The FBI agent obtained from a foreign government a photo of the person
believed to have directed the Cole bombing. It ^vas shown to the source, and
he confirmed that the man in that photograph ^vas the same Khallad he had
described. 5'^

In December 2000, on the basis of some links associated with Khalid al
Mihdhar, the CIA's Bin Ladin unit speculated that Khallad and Khalid al Mihd-
har might be one and the same.^^

The CIA asked that a Kuala Lumpur surveillance photo of Mihdhar be
sho^vn to the joint source who had identified Khallad. In early January 2001,
two photographs from the Kuala Lumpur meeting were shown to the source.
One ^vas a known photograph of Mihdhar, the other a photograph of a then
unkno\vn subject. The source did not recognize Mihdhar. But he indicated he
was 90 percent certain that the other individual was Khallad. ^^

This meant that Khallad and Mihdhar were two different people. It also
meant that there was a link between Khallad and Mihdhar, making Mihdhar
seem even more suspicious. ^^ Yet we found no effort by the CIA to renew the
long-abandoned search for Mihdhar or his travel companions.

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

^^

"THE SYSTEM WAS BLINKING RED" 267

In addition, we found that the CIA did not notify the FBI of this identifi-
cation. DCI Tenet and Cofer Black testified before Congress's Joint Inquiry into
9/11 that the FBI had access to this identification from the beginning. But
drawing on an extensive record, including documents that were not available
to the CIA personnel ^vho drafted that testimony, ^ve conclude this was not
the case.The FBI's primary Cole investigators had no kno^vledge that Khallad
had been in Kuala Lumpur with Mihdhar and others until after the Septem-
ber 11 attacks. Because the FBI had not been informed in January 2000 about
Mihdhar's possession of a U.S. visa, it had not then started looking for him in
the United States. Because it did not kno^v of the links between Khallad and
Mihdhar, it did not start looking for him in January 2001. *"

This incident is an example of ho^v day-to-day gaps in information sharing
can emerge even when there is mutual good^vill.The information was from a
joint FBI/CIA source who spoke essentially no English and whose languages
were not understood by the FBI agent on the scene overseas. Issues of travel
and security necessarily kept short the amount of time spent with the source.
As a result, the CIA officer usually did not translate either questions or answers
for his FBI colleague and friend. "^^

For interviews without simultaneous translation, the FBI agent on the scene
received copies of the reports that the CIA disseminated to other agencies
regarding the interviews. But he was not given access to the CIA's internal
operational reports, which contained more detail. It was there — in reporting
to ^vhich FBI investigators did not have access — that information regarding the
January 2001 identification of Khallad appeared.The CIA officer does not recall
this particular identification and thus cannot say why it was not shared ^vith
his FBI colleague. He might not have understood the possible significance of
the new identification. "^^

In June 2000, Mihdhar left California and returned to Yemen. It is possible
that if, in January 2001, the CIA had resumed its search for him, placed him
on the State Department's TIPOFF watchlist, or provided the FBI with the
information, he might have been found — either before or at the time he
applied for a new visa in June 2001, or when he returned to the United States
on July 4.

Spring 2001: Looking Again at Kuala Lumpur

By mid-May 2001, as the threat reports were surging, a CIA official detailed
to the International Terrorism Operations Section at the FBI wondered where
the attacks might occur. We will call him "John." Recalling the episode about
the Kuala Lumpur travel of Mihdhar and his associates, "John" searched the
CIA's databases for information regarding the travel. On May 15, he and an
official at the CIA reexamined many of the old cables from early 2000, includ-
ing the information that Mihdhar had a U.S. visa, and that Hazmi had come
to Los Angeles on January 15, 2000. *3

The CIA official ^vho reviewed the cables took no action regarding them.

Final 8-9. 5pp l/ll/OA 1:24 PM Page 26

268 THE 9/11 COMMISSION REPORT

"John," however, began a lengthy exchange with a CIA analyst, ^vhonl we -will
call "Dave," to figure out what these cables meant. "John" was aware of how
dangerous Khallad was — at one point calling him a "major league killer." He
concluded that "something bad was definitely up." Despite the U.S. links evi-
dent in this traffic, "John" made no effort to determine whether any of these
individuals was in the United States. He did not raise that possibility with his
FBI counterpart. He was focused on Malaysia. <^'*

"John" described the CIA as an agency that tended to play a "zone defense."
He was worrying solely about Southeast Asia, not the United States. In con-
trast, he told us, the FBI tends to play "man-to-nian."'^^

Desk officers at the CIA's Bin Ladin unit did not have "cases" in the same
sense as an FBI agent who works an investigation from beginning to end. Thus,
when the trail went cold after the Kuala Lumpur meeting in January 2000, the
desk officer moved on to different things. By the time the March 2000 cable
arrived with information that one of the travelers had flown to Los Angeles,
the case officer was no longer responsible for follow-up. While several individ-
uals at the Bin Ladin unit opened the cable when it arrived in March 2000, no
action was taken, i^*

The CIA's zone defense concentrated on "where," not "who." Had its infor-
mation been shared with the FBI, a combination of the CIA's zone defense
and the FBI's man-to-man approach might have been productive.

June 2001: The Meeting in New York

"John's" review of the Kuala Lumpur meeting did set off some more shar-
ing of information, getting the attention of an FBI analyst whom we will call
"Jane." "Jane" was assigned to the FBI's Cole investigation. She knew that
another terrorist involved in that operation, Fahd al Quso, had traveled to
Bangkok in January 2000 to give money to Khallad.*^

"Jane" and the CIA analyst, "Dave," had been working together on Cole-
related issues. Chasing Quso's trail, "Dave" suggested showing some photo-
graphs to FBI agents in New York who were working on the Cole case and had
interviewed Quso.!^*

"John" gave three Kuala Lumpur surveillance pictures to "Jane" to show to
the New York agents. She was told that one of the individuals in the photo-
graphs was someone named Khalid al Mihdhar. She did not know why the
photographs had been taken or why the Kuala Lumpur travel might be signif-
icant, and she was not told that someone had identified Khallad in the photo-
graphs. When "Jane" did some research in a database for intelligence reports,
Intelink, she found the original NSA reports on the planning for the meeting.
Because the CIA had not disseminated reports on its tracking of Mihdhar,
"Jane" did not puU up any information about Mihdhar's U.S. visa or about travel
to the United States by Hazmi or Mihdhar. ^^

"Jane," "Dave," and an FBI analyst who was on detail to the CIA's Bin Ladin

Final 8-9. 5pp l/ll/OA 1:24 PM Page 26^

"THE SYSTEM WAS BLINKING RED" 269

unit went to New York on June 11 to meet \¥ith the agents about the Cole case.
"Jane" brought the surveillance pictures. At some point in the meeting she
shoAved the photographs to the agents and asked ^vhether they recognized
Quso in any of them. The agents asked questions about the photographs —
Why -were they taken? Why -were these people being followed? Where are the
rest of the photographs?^'^

The only information "Jane" had about the meeting — other than the pho-
tographs — ^were the NSA reports that she had found on Intelink. These reports,
however, contained caveats that their contents could not be shared with crim-
inal investigators \vithout the permission of the Justice Department's Office of
Intelligence Policy and Review (OIPR). Therefore "Jane" concluded that she
could not pass on information from those reports to the agents. This decision
was potentially significant, because the signals intelligence she did not share
linked Mihdhar to a suspected terrorist facility in the Middle East. The agents
would have established a link to the suspected facility from their work on the
embassy bombings case. This link would have made them very interested in
learning more about Mihdhar.^i The sad irony is that the agents who found
the source were being kept from obtaining the fruits of their own work.

"Dave," the CIA analyst, knew more about the Kuala Lumpur meeting. He
knew that Mihdhar possessed a U.S. visa, that his visa application indicated that
he intended to travel to Ne^v York, that Hazmi had traveled to Los Angeles,
and that a source had put Mihdhar in the company of Khallad. No one at the
meeting asked him what he knew; he did not volunteer anything. He told
investigators that as a CIA analyst, he was not authorized to answer FBI ques-
tions regarding CIA information. "Jane" said she assumed that if "Dave" knew
the answers to questions, he would have volunteered them. The New York
agents left the meeting without obtaining information that might have started
them looking for Mihdhar.^-

Mihdhar had been a weak link in al Qaeda's operational planning. He had
left the United States in June 2000, a mistake KSM realized could endanger
the entire plan — for to continue with the operation, Mihdhar would have to
travel to the United States again. And unlike other operatives, Mihdhar was not
"clean": he had jihadist connections. It was just such connections that had
brought him to the attention of U.S. ofliicials.

Nevertheless, in this case KSM's fears were not realized. Mihdhar received
a new U.S. visa two days after the CIA-FBI meeting in New York. He flew
to New York City on July 4. No one was looking for him.

August 2001: The Search for Mihdhar and Hazmi Begins and Fails

During the summer of 2001 "John," follo^ving a good instinct but not as part
of any formal assignment, asked "Mary," an FBI analyst detailed to the CIA's
Bin Ladin unit, to review all the Kuala Lumpur materials one more time. She
had been at the New York meeting with "Jane" and "Dave" but had not

Final 8-9. 5pp l/ll/OA 1:24 PM Page a'/

270 THE 9/11 COMMISSION REPORT

looked into the issues yet herself. "John" asked her to do the research in her
free tinieJ^

"Mary" began her -work on July 24. That day, she found the cable reporting
that Mihdhar had a visa to the United States. A week later, she found the cable
reporting that Mihdhar 's visa application — what was later discovered to be his
first application — listed New York as his destination. On August 21, she
located the March 2000 cable that "noted with interest" that Haznii had flown
to Los Angeles in January 2000. She immediately grasped the significance of
this information. ^4

"Mary" and "Jane" promptly met with an INS representative at FBI head-
quarters. On August 22, the INS told them that Mihdhar had entered the
United States on January 15, 2000, and again on July 4, 2001. "Jane" and
"Mary" also learned that there was no record that Hazmi had left the coun-
try since January 2000, and they assumed he had left with Mihdhar in June
2000. They decided that if Mihdhar was in the United States, he should be
found. ^5

They divided up the work. "Mary" asked the Bin Ladin unit to draft a cable
requesting that Mihdhar and Hazmi be put on the TIPOFF watchlist. Both
Hazmi and Mihdhar were added to this watchlist on August 24. ^^

"Jane" took responsibility for the search effort inside the United States. As
the information indicated that Mihdhar had last arrived in New York, she began
drafting what is known as a lead for the FBI's New York Field Office. A lead
relays information from one part of the FBI to another and requests that a par-
ticular action be taken. She called an agent in New York to give him a "heads-
up" on the matter, but her draft lead was not sent until August 28. Her email
told the New York agent that she wanted him to get started as soon as possi-
ble, but she labeled the lead as "Routine" — a designation that informs the
receiving office that it has 30 days to respond. ^^

The agent who received the lead forwarded it to his squad supervisor. That
same day, the supervisor forwarded the lead to an intelligence agent to open
an intelligence case — an agent who thus was behind "the wall" keeping FBI
inteUigence information from being shared with criminal prosecutors. He also
sent it to the Cole case agents and an agent who had spent significant time in
Malaysia searching for another Khalid: Khalid Sheikh Mohammad. ^^

The suggested goal of the investigation was to locate Mihdhar, determine
his contacts and reasons for being in the United States, and possibly conduct
an interview. Before sending the lead, "Jane" had discussed it with "John," the
CIA official on detail to the FBI. She had also checked with the acting head
of the FBI's Bin Ladin unit. The discussion seems to have been limited to
whether the search should be classified as an intelligence investigation or as a
criminal one. It appears that no one informed higher levels of management in
either the FBI or CIA about the case.^' There is no evidence that the lead, or
the search for these terrorist suspects, was substantively discussed at any level

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

l^

"THE SYSTEM WAS BLINKING RED" 271

above deputy chief of a section within the Counterterrorisni Division at FBI
headquarters.

One of the Cole case agents read the lead with interest, and contacted "Jane"
to obtain more information. "Jane" argued, however, that because the agent was
designated a "criminal" FBI agent, not an intelligence FBI agent, the wall kept
him from participating in any search for Mihdhar. In fact, she felt he had to
destroy his copy of the lead because it contained NSA information from reports
that included caveats ordering that the information not be shared ^vithout
OIPR's permission. The agent asked "Jane" to get an opinion from the FBI's
National Security Law Unit (NSLU) on whether he could open a criminal
case on Mihdhar. ^o

"Jane" sent an email to the Cole case agent explaining that according to the
NSLU, the case could be opened only as an intelligence matter, and that if
Mihdhar ^vas found, only designated intelligence agents could conduct or even
be present at any interview. She appears to have misunderstood the complex
rules that could apply to this situation. ^^

The FBI agent angrily responded:

Whatever has happened to this — someday someone ^vill die — and wall
or not — the public will not understand why we were not more effective
and thro\ving every resource we had at certain "problems."

Let's hope the National Security Law Unit will stand behind their
decisions then, especially since the biggest threat to us now, UBL, is get-
ting the most "protection."

"Jane" replied that she was not making up the rules; she claimed that they
were in the relevant manual and "ordered by the [FISA] Court and every office
of the FBI is required to follow them including FBI NY."^^

It is now clear that everyone involved was confused about the rules govern-
ing the sharing and use of information gathered in intelligence channels.
Because Mihdhar was being sought for his possible connection to or knowl-
edge of the Cole bombing, he could be investigated or tracked under the exist-
ing Cole criminal case. No new criminal case was needed for the criminal agent
to begin searching for Mihdhar. And as NSA had approved the passage of its
information to the criminal agent, he could have conducted a search using all
available information. As a result of this confusion, the criminal agents who
were knowledgeable about al Qaeda and experienced with criminal investiga-
tive techniques, including finding suspects and possible criminal charges, were
thus excluded from the search. ^^

The search was assigned to one FBI agent, and it was his very first coun-
terterrorism lead. Because the lead was "routine," he was given 30 days to open
an intelligence case and make some unspecified efforts to locate Mihdhar. He
started the process a few days later. He checked local New York databases for

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

'^

272 THE 9/11 COMMISSION REPORT

criminal record and driver's license information and checked the hotel listed
on Mihdhar's U.S. entry form. Finally, on September 11, the agent sent a lead
to Los Angeles, because Mihdhar had initially arrived in Los Angeles in Janu-
ary 2000.84

We believe that if more resources had been applied and a significantly dif-
ferent approach taken, Mihdhar and Haznii might have been found. They had
used their true names in the United States. Still, the investigators would have
needed luck as well as skill to find them prior to September 11 even if such
searches had begun as early as August 23, when the lead was first drafted.^s

Many FBI witnesses have suggested that even if Mihdhar had been found,
there ^vas nothing the agents could have done except follow him onto the
planes. We believe this is incorrect. Both Hazmi and Mihdhar could have been
held for immigration violations or as material witnesses in the Cole bombing
case. Investigation or interrogation of them, and investigation of their travel and
financial activities, could have yielded evidence of connections to other par-
ticipants in the 9/11 plot. The simple fact of their detention could have derailed
the plan. In any case, the opportunity did not arise.

Phoenix Memo

The Phoenix memo ^vas investigated thoroughly by the Joint Inquiry and the
Department ofjustice Inspector General.^* We will recap it briefly here. In July
2001, an FBI agent in the Phoenix field office sent a memo to FBI headquar-
ters and to two agents on international terrorism squads in the New York Field
Office, advising of the "possibility of a coordinated effort by Usama Bin Ladin"
to send students to the United States to attend civil aviation schools.The agent
based his theory on the "inordinate number of individuals of investigative inter-
est" attending such schools in Arizona. ^^

The agent made four recommendations to FBI headquarters: to compile a
list of civil aviation schools, establish liaison with those schools, discuss his the-
ories about Bin Ladin \vith the intelligence community, and seek authority to
obtain visa information on persons applying to flight schools. His recommen-
dations were not acted on. His memo was forwarded to one field office. Man-
agers of the Usama Bin Ladin unit and the Radical Fundamentalist unit at FBI
headquarters ^vere addressees, but they did not even see the memo until after
September 11. No managers at headquarters saw the memo before September
11, and the New York Field Office took no action. ^^

As its author told investigators, the Phoenix memo was not an alert about
suicide pilots. His worry was more about a Pan Am Flight 103 scenario in
which explosives were placed on an aircraft. The memo's references to aviation
training were broad, including aeronautical engineering. *' If the memo had been
distributed in a timely fashion and its recommendations acted on promptly, we
do not believe it would have uncovered the plot. It might ^vell, however, have
sensitized the FBI so that it might have taken the Moussaoui matter more seri-
ously the next month.

Final 8-9. 5pp l/ll/OA 1:24 PM Page a'/

"THE SYSTEM WAS BLINKING RED" 273

Zacarias Moussaoui

On August 15, 2001, the Minneapolis FBI Field Office initiated an intelligence
investigation on Zacarias Moussaoui. As mentioned in chapter 7, he had entered
the United States in February 2001, and had begun flight lessons at Airman
Flight School in Norman, Oklahoma. He resumed his training at the Pan Am
International Flight Academy in Eagan, Minnesota, starting on August 13. He
had none of the usual qualifications for flight training on Pan Am s Boeing 747
flight simulators. He said he did not intend to become a commercial pilot but
wanted the training as an "ego boosting thing." Moussaoui stood out because,
with little kno\¥ledge of flying, he wanted to learn how to "take off and land"
a Boeing 747.90

The agent in Minneapolis quickly learned that Moussaoui possessed jihadist
beliefs. Moreover, Moussaoui had 132,000 in a bank account but did not pro-
vide a plausible explanation for this sum of money. He had traveled to Pakistan
but became agitated when asked if he had traveled to nearby countries while
in Pakistan (Pakistan was the customary route to the training camps in
Afghanistan). He planned to receive martial arts training, and intended to pur-
chase a global positioning receiver. The agent also noted that Moussaoui
became extremely agitated whenever he was questioned regarding his religious
beliefs. The agent concluded that Moussaoui was "an Islamic extremist prepar-
ing for some future act in furtherance of radical fundamentalist goals." He also
believed Moussaoui's plan was related to his flight training. 'i

Moussaoui can be seen as an al Qaeda mistake and a missed opportunity.
An apparently unreliable operative, he had fallen into the hands of the FBI. As
discussed in chapter 7, Moussaoui had been in contact with and received
money from Ramzi Binalshibh. If Moussaoui had been connected to al
Qaeda, questions should instantly have arisen about a possible al Qaeda plot
that involved piloting airliners, a possibility that had never been seriously ana-
lyzed by the intelligence community.

The FBI agent who handled the case in conjunction with the INS repre-
sentative on the Minneapolis Joint Terrorism Task Force suspected that Mous-
saoui might be planning to hijack a plane. Minneapolis and FBI headquarters
debated whether Moussaoui should be arrested immediately or surveilled to
obtain additional information. Because it was not clear whether Moussaoui
could be imprisoned, the FBI case agent decided the most important thing was
to prevent Moussaoui from obtaining any further training that he could use to
carry out a potential attack. ^2

As a French national who had overstayed his visa, Moussaoui could be
detained immediately The INS arrested Moussaoui on the immigration viola-
tion. A deportation order was signed on August 17, 2001.93

The agents in Minnesota were concerned that the U.S. Attorney s Office in
Minneapolis ^vould find insufficient probable cause of a crime to obtain a crim-
inal warrant to search Moussaoui's laptop computer.'^ Agents at FBI headquar-
ters believed there ^vas insufficient probable cause. Minneapolis therefore

Final 8-9. 5pp l/ll/OA 1:24 PM Page a'/

274 THE 9/11 COMMISSION REPORT

sought a special warrant under the Foreign Intelhgence Surveillance Act to
conduct the search (we introduced FISA in chapter 3).

To do so, however, the FBI needed to demonstrate probable cause that
Moussaoui was an agent of a foreign po^ver, a demonstration that \vas not
required to obtain a criminal warrant but ^vas a statutory requirement for a
FISA warrant.''^ The case agent did not have sufficient information to connect
Moussaoui to a "foreign power," so he reached out for help, in the United States
and overseas.

The FBI agent's August 18 message requested assistance from the FBI legal
attache in Paris. Moussaoui had lived in London, so the Minneapolis agent
sought assistance from the legal attache there as ^vell. By August 24, the Min-
neapolis agent had also contacted an FBI detailee and a CIA desk officer at the
Counterterrorist Center about the case.'*^

The FBI legal attache s office in Paris first contacted the French government
on August 16 or 17, shortly after speaking to the Minneapolis case agent on
the telephone. On August 22 and 27, the French provided information that
made a connection between Moussaoui and a rebel leader in Chechnya, Ibn al
Khattab. This set off a spirited debate bet^veen the Minneapolis Field Office,
FBI headquarters, and the CIA as to whether the Chechen rebels and Khattab
were sufficiently associated with a terrorist organization to constitute a "for-
eign power" for purposes of the FISA statute. FBI headquarters did not believe
this was good enough, and its National Security Law Unit declined to submit
a FISA application.^^

After receiving the written request for assistance, the legal attache in Lon-
don had promptly forwarded it to his counterparts in the British government,
hand-delivering the request on August 21. On August 24, the CIA also sent a
cable to London and Paris regarding "subjects involved in suspicious 747 flight
training" that described Moussaoui as a possible "suicide hijacker." On August
28, the CIA sent a request for information to a diflierent service of the British
government; this communication ^varned that Moussaoui might be expelled
to Britain by the end of August. The FBI office in London raised the matter
briefly with British officials as an aside, after a meeting about a more urgent
matter on September 3, and sent the British service a ^vritten update on Sep-
tember 5. The case ^vas not handled by the British as a priority amid a large
number of other terrorist-related inquiries. ^^

On September 4, the FBI sent a teletype to the CIA, the FAA, the Customs
Service, the State Department, the INS, and the Secret Service summarizing
the kno^vn facts regarding Moussaoui. It did not report the case agent's per-
sonal assessment that Moussaoui planned to hijack an airplane. It did contain
the FAA's comment that it was not unusual for Middle Easterners to attend
flight training schools in the United States. ''

Although the Minneapolis agents wanted to tell the FAA from the begin-
ning about Moussaoui, FBI headquarters instructed Minneapolis that it could

Final 8-9. 5pp l/ll/OA 1:24 PM Page 2

l^

"THE SYSTEM WAS BLINKING RED" 275

not share the more complete report the case agent had prepared for the FAA.
The Minneapohs supervisor sent the case agent in person to the local FAA
office to fill in what he thought -were gaps in the FBI headquarters teletype. 10°
No FAA actions seem to have been taken in response.

There was substantial disagreement between Minneapolis agents and FBI
headquarters as to what Moussaoui ^vas planning to do. In one conversation
between a Minneapolis supervisor and a headquarters agent, the latter com-
plained that Minneapolis 's FISA request was couched in a manner intended to
get people "spun up." The supervisor replied that was precisely his intent. He
said he ^vas "trying to keep someone from taking a plane and crashing into the
World Trade Center." The headquarters agent replied that this was not going
to happen and that they did not kno^v if Moussaoui ^vas a terrorist. ^'^^

There is no evidence that either FBI Acting Director Pickard or Assistant
Director for Counterterrorism Dale Watson was briefed on the Moussaoui case
prior to 9/11. Michael Rolince, the FBI assistant director heading the Bureau's
International Terrorism Operations Section (ITOS), recalled being told about
Moussaoui in two passing hall^vay conversations but only in the context that
he might be receiving telephone calls from Minneapolis complaining about
how headquarters was handling the matter. He never received such a call.
Although the acting special agent in charge of Minneapolis called the ITOS
supervisors to discuss the Moussaoui case on August 27, he declined to go up
the chain of command at FBI headquarters and call Rolince. ^O-

On August 23, DCl Tenet was briefed about the Moussaoui case in a brief-
ing titled "Islamic Extremist Learns to Fly."i"3 Tenet was also told that Mous-
saoui wanted to learn to fly a 747, paid for his training in cash, ^vas interested
to learn the doors do not open in flight, and ^vanted to fly a simulated flight
from London to New York. He was told that the FBI had arrested Moussaoui
because of a visa overstay and that the CIA ^vas working the case \vith the FBI.
Tenet told us that no connection to al Qaeda ^vas apparent to him at the time.
Seeing it as an FBI case, he did not discuss the matter with anyone at the White
House or the FBI. No connection \vas made between Moussaoui's presence in
the United States and the threat reporting during the summer of 2001. 1°'*

On September 1 1 , after the attacks, the FBI office in London renewed their
appeal for information about Moussaoui. In response to U.S. requests, the
British government supplied some basic biographical information about
Moussaoui.The British government informed us that it also immediately tasked
intelligence collection facilities for information about Moussaoui. On Septem-
ber 13, the British government received ne^v, sensitive intelligence that Mous-
saoui had attended an al Qaeda training camp in Afghanistan. It passed this
intelligence to the United States on the same day. Had this information been
available in late August 2001, the Moussaoui case ^vould almost certainly have
received intense, high-level attention. 105

The FBI also learned after 9/11 that the millennium terrorist Ressam, who

Final 8-9. 5pp l/ll/OA 1:24 PM Page a'/

276 THE 9/11 COMMISSION REPORT

by 2001 was cooperating ^vith investigators, recognized Moussaoui as some-
one who had been in the Afghan camps. lO'^ As mentioned above, before 9/11
the FBI agents in Minneapolis had failed to persuade supervisors at headquar-
ters that there was enough evidence to seek a FISA warrant to search Mous-
saoui's computer hard drive and belongings. Either the British information or
the Ressam identification would have broken the logjam.

A maximum U.S. effort to investigate Moussaoui conceivably could have
unearthed his connections to Binalshibh. Those connections might have
brought investigators to the core of the 9/11 plot. The Binalshibh connection
was recognized shortly after 9/11, though it ^vas not an easy trail to find. Dis-
covering it ^vould have required quick and very substantial cooperation from
the German government, ^vhich might ^vell have been difficult to obtain.

However, publicity about Moussaoui s arrest and a possible hijacking threat
might have derailed the plot. ^"^ With time, the search for Mihdhar and Hazmi
and the investigation of Moussaoui might also have led to a breakthrough that
would have disrupted the plot.

Khalid Sheikh Mohammed

Another late opportunity was presented by a confluence of information
regarding Khalid Sheikh Mohammed received by the intelligence community
in the summer of 2001. The possible links between KSM, Moussaoui, and an
individual only later identified as Ramzi Binalshibh would remain undiscov-
ered, ho^vever.

Although we readily equate KSM with al Qaeda today, this was not the case
before 9/11. KSM, who had been indicted injanuary 1996 for his role in the
Manila air plot, was seen primarily as another freelance terrorist, associated
with Ramzi Yousef Because the links between KSM and Bin Ladin or al
Qaeda were not recognized at the time, responsibility for KSM remained in
the small Islamic Extremist Branch of the Counterterrorist Center, not in the
Bin Ladin unit.

Moreover, because KSM had already been indicted, he became targeted
for arrest. In 1997, the Counterterrorist Center added a Renditions Branch
to help find wanted fugitives. Responsibility for KSM was transferred to this
branch, which gave the CIA a "man-to-man" focus but was not an analyti-
cal unit. When subsequent information came, more critical for analysis than
for tracking, no unit had the job of following up on what the information
might mean. 1 '^8

For example, in September 2000, a source had reported that an individual
named Khalid al-Shaykh al-Ballushi was a key lieutenant in al Qaeda. Al-
Ballushi means "from Baluchistan," and KSM is from Baluchistan. Recogniz-
ing the possible significance of this information, the Bin Ladin unit sought
more information. When no information was forthcoming, the Bin Ladin unit

Final 8-9. 5pp l/ll/OA 1:24 PM Page a'/

"THE SYSTEM WAS BLINKING RED" 277

dropped the matCer.^o' When additional pieces of the puzzle arrived in the
spring and summer of 2001, they were not put together.

The first piece of the puzzle concerned some intriguing information asso-
ciated with a person known as "Mukhtar" that the CIA had begun analyzing
in April 2001. The CIA did not kno^v ^vho Mukhtar \vas at the time — only
that he associated with al Qaeda lieutenant Abu Zubaydah and that, based on
the nature of the information, he was evidently involved in planning possible
terrorist activities, no

The second piece of the puzzle was some alarming information regarding
KSM. On June 12, 2001, a CIA report said that "Khaled" was actively recruiting
people to travel outside Afghanistan, including to the United States ^vhere col-
leagues were reportedly already in the country to meet them, to carry out
terrorist-related activities for Bin Ladin. CIA headquarters presumed from the
details of the reporting that this person \vas Khalid Sheikh Mohammed. In July,
the same source ^vas shown a series of photographs and identified a photograph
of Khalid Sheikh Mohammed as the Khaled he had previously discussed, m

The final piece of the puzzle arrived at the CIA's Bin Ladin unit on August
28 in a cable reporting that KSM's nickname was Mukhtar. No one made the
connection to the reports about Mukhtar that had been circulated in the
spring. This connection might also have underscored concern about the June
reporting that KSM ^vas recruiting terrorists to travel, including to the United
States. Only after 9/11 would it be discovered that Muhktar/KSM had com-
municated \vith a phone that was used by Binalshibh, and that Binalshibh had
used the same phone to communicate with Moussaoui, as discussed in chap-
ter 7. As in the Moussaoui situation already described, the links to Binalshibh
might not have been an easy trail to find and would have required substantial
cooperation from the German government. But time was short, and running
out. 112

Time Runs Out

As Tenet told us, "the system was blinking red" during the summer of 2001.
Officials were alerted across the world. Many were doing everything they pos-
sibly could to respond to the threats.

Yet no one working on these late leads in the summer of 2001 connected
the case in his or her in-box to the threat reports agitating senior officials and
being briefed to the President. Thus, these individual cases did not become
national priorities. As the CIA supervisor "John" told us, no one looked at the
bigger picture; no analytic ^vork foresa^v the lightning that could connect the
thundercloud to the ground. n^

We see little evidence that the progress of the plot was disturbed by any gov-
ernment action. The U.S. government was unable to capitalize on mistakes
made by al Qaeda. Time ran out.