A review of the FBI's Handling:Chapter 5 III

❌

In this section of the report, we discuss in detail the five junctures before September 11, 2001, during which the FBI had an opportunity to obtain or develop information about Mihdhar and Hazmi but did not. We describe in chronological order the sequence of events regarding these five opportunities, including the information that the FBI obtained or could have obtained about Hazmi and Mihdhar. Many of the witnesses told the OIG they did not have specific recollection of the events and conversations related to the Hazmi and Mihdhar matter. In addition, we found few notes and documents relating to these events and conversations. The following is our best reconstruction of the events based on the participants’ recollections and the existing documentary evidence. 234 We show a timeline of the Hazmi and Mihdhar events described in this chapter on the next two pages of the report. A. Identification in January 2000 of Hazmi and Mihdhar as al Qaeda operatives This section describes the initial development and dissemination of intelligence information concerning Hazmi and Mihdhar. This intelligence was obtained by the NSA in late 1999 and early 2000. The intelligence led to a surveillance operation in Malaysia in which it was discovered that Mihdhar had a valid multiple-entry U.S. visa and photographs of Mihdhar meeting with other al Qaeda operatives were taken. There were several ways the FBI could have acquired this information from the CIA – through a CIR from the CIA to the FBI, informally through conversations between a CIA employee and FBI Headquarters employees, and through the FBI employees detailed to the CIA reviewing the CIA cable traffic. We reviewed whether this information was in fact passed to the FBI by the CIA, and based on the evidence, concluded that while the CIA passed some of the information about Mihdhar to the FBI, it did not contemporaneously pass the information about Mihdhar’s U.S. visa to the FBI. We concluded it was not disclosed by the CIA until late August 2001, shortly before the September 11 terrorist attacks. We also reviewed whether FBI detailees to the CIA contemporaneously acquired this information and what action, if any, they took with respect to this information. Hazmi and Mihdhar Timeline – Part I 235 9/11/2001 Hazmi and Mihdhar and 17 other terrorists attack the United States. 8/29/2001 FBI New York opens an intelligence investigation to locate Mihdhar. 8/22/2001 CIA personnel inform FBI HQ analyst of Mihdhar's U.S. visa and July 4, 2001, entry in New York. 6/11/2001 FBI HQ analyst meets with New York FBI agents working on the Cole investigation. CIA personnel also attend the meeting. New York agents are not informed of identification of Khallad in photos. 5/15/2001 Some time in May, CIA personnel advise FBI HQ analyst about the Malaysian meetings and provide photos. FBI not informed of Mihdhar's U.S. visa or identification of Khallad in the photos. 1/4/2001 CIA shows joint source photos from Kuala Lumpur. Source identifies Khallad in photos. FBI ALAT is present for most of meeting with source but does not become aware of this identification. 12/16/2000 CIA shows joint source the Yemeni photo of Khallad. Source identifies him as mastermind of Cole attack. 10/12/2000 U.S.S. Cole is attacked in Aden, Yemen. Shortly thereafter, Yemeni officials provide FBI with photo of "Khallad," the purported mastermind of the attack. 6/10/2000 Mihdhar departs the United States. 5/31/2000 Hazmi and Mihdhar rent rooms in the residence of an FBI asset. 5/1/2000 Beginning in mid-2000, CIA and FBI begin debriefing joint source. Source provided significant information about Bin Laden and Al Qaeda. 5/1/2000 9/15/2001 7/1/2000 10/1/2000 1/1/2001 4/1/2001 7/1/2001 Hazmi and Mihdhar Timeline – Part II 236 237 In addition, the CIA learned in March 2000 that Hazmi had boarded a United Airlines flight in Bangkok, Thailand, bound for Los Angeles, California, on January 15, 2000.168 We also reviewed whether the FBI was informed of this information, and concluded that it did not learn about this information until August 2001. 1. Background In late 1999, the Intelligence Community developed significant intelligence information regarding Hazmi and Mihdhar. At this time, the Intelligence Community was on high alert because of concerns involving possible terrorist activity planned in conjunction with the coming of the new Millennium. In addition to concerns about attacks at New Year’s Eve celebrations, the Intelligence Community was concerned that a terrorist attack was planned for January 3, 2000, which in the Islamic calendar is considered a “night of destiny.”169 There were additional concerns about potential terrorist attacks coinciding with the end of Ramadan, around January 6, 2000.170 Several of these planned attacks were uncovered in December 1999. For example, on December 1, 1999, in Jordan, a plot to disrupt New Year activities with explosives designed to kill thousands of revelers, including U.S. citizens, was uncovered and thwarted with the arrest of 16 people. On December 14, 1999, Ahmad Ressam was stopped at the United States/Canadian border in Washington state as he attempted to enter the United States in a vehicle loaded with explosives. It was determined later that he had intended to detonate the explosives at the Los Angeles airport. To be prepared for possible terrorist activity at the end of 1999, the FBI activated its Strategic Information Operations Center (SIOC). The SIOC is 168 Mihdhar was also on the same flight, but that fact apparently was not known within the Intelligence Community until much later, in August 2001. 169 During the course of the Cole bombing investigation, it was learned that an attack also had been planned against the U.S.S. The Sullivans in Aden, Yemen, on the same date. That attack failed because the attack boat sank before reaching its target. 170 Ramadan is the ninth month of the Islamic calendar. Ramadan begins when authorities in Saudi Arabia sight the new moon of the ninth month. 238 located in a secure area within FBI Headquarters and contains several meeting rooms, conferencing equipment, communications equipment, computers, and other operational equipment. It allows the FBI to manage major investigations or other significant operations 24 hours a day, 7 days a week. During the Millennium period, the FBI operated its International Terrorism Operations Section from within the SIOC. In addition, the FBI detailed field supervisors with counterterrorism experience and other counterterrorism personnel to the SIOC for around-the-clock monitoring and response to possible terrorist activities. At the CIA, additional personnel were called in to work at the CTC and planned leave was canceled. In addition, personnel from the CIA and other Intelligence Community agencies were detailed to work in the FBI’s SIOC. During this period, personnel in the FBI’s SIOC prepared two daily briefings for the FBI Director and his executive staff, one at 7:30 a.m. and the other at 4:30 p.m. The daily briefings contained summaries of significant terrorism investigations and the latest intelligence related to counterterrorism. Accompanying the briefings were daily threat updates prepared each afternoon for the Director and his executive staff. The briefings and the threat updates were prepared by various people throughout the course of the day and night in the SIOC. 2. NSA provides intelligence regarding planned travel by al Qaeda operatives to Malaysia In the midst of the Millennium period concerns in late 1999, the NSA analyzed communications associated with a suspected terrorist facility in the Middle East linked to Al Qaeda activities directed against U.S. interests. The communications indicated that several members of an “operational cadre” were planning to travel to Kuala Lumpur, Malaysia, in early January 2000. Analysis of the communications revealed that persons named Nawaf, Khalid and Salem were involved. In early 2000, the NSA analyzed what appeared to be related communications concerning a “Khalid.”171 (continued) 171 The NSA had additional information in its database further identifying “Nawaf” as Nawaf al-Hazmi, a friend of Khalid. However, the NSA informed the OIG that it was not 239 The NSA’s reporting about these communications was sent, among other places, to FBI Headquarters, the FBI’s Washington and New York Field Offices, and the CIA’s CTC. At the FBI, this information appeared in the daily threat update to the Director on January 4, 2000. 3. Mihdhar’s travel and discovery of his U.S. visa A CIA desk officer working in the Bin Laden Unit who we call “Michelle” determined that there were links between these people and Al Qaeda as well as the 1998 East African embassy bombings. In addition, the CIA identified “Khalid” as Khalid al-Mihdhar. Mihdhar arrived in Kuala Lumpur, Malaysia, on January 5, 2000. Mihdhar was traveling on a Saudi passport. This passport contained a valid U.S. visa. Mihdhar’s passport was photocopied and sent to CIA Headquarters. Several CIA cables contemporaneously discussed Mihdhar’s travel and the discovery of his U.S. visa in his Saudi passport. CIA records show that a CIA employee, who we call “James”172 and who was detailed to FBI Headquarters during the Millennium period, accessed one of these cables approximately two hours after it was disseminated in the morning, and he accessed another of the cables about eight hours after it was disseminated on the next morning. James discussed some information about Mihdhar with two FBI Headquarters employees on the evening of January 5, which we detail in Section 7 below. 4. CIR is drafted to pass Mihdhar’s visa information to the FBI Dwight, the special agent detailed to the CIA’s Bin Laden Unit from the FBI’s Washington Field Office, also read the cables discussing Mihdhar’s U.S. visa within hours of each cable being disseminated. CIA records also show (continued) asked to conduct research on these individuals at that time, and it did not uncover that information on Hazmi. It was thought at the time that Salem might be Hazmi’s younger brother, and this was later confirmed. 172 The CIA has asked the OIG not to identify the true names of CIA employees for operational reasons. 240 that Dwight’s immediate supervisor in the Bin Laden Unit opened one of the cables soon after Dwight. Dwight opened one of the cables, which reported that Mihdhar’s visa application had been verified and that he had listed New York as his intended destination. Around 9:30 a.m. on the same morning, Dwight began drafting in the CIA’s computer system a CIR addressed to the UBL Unit Chief at FBI Headquarters and an SSA in the UBL Unit at FBI Headquarters who we call “Bob.” Dwight’s CIR also was addressed to the FBI’s New York Field Office. The CIR first described the NSA information that had been received about Mihdhar, including the planned travel to Kuala Lumpur, Malaysia in early January. The CIR also discussed the potential links between the suspected terrorist facility in the Middle East and the 1998 East Africa embassy bombings. The CIR stated that photographs of Mihdhar had been obtained and would be sent to the FBI under separate cover. The CIR detailed Mihdhar’s passport and visa information, including that Mihdhar had listed on his visa application his intended destination as New York and that he planned to stay three months. Dwight also wrote that the CTC was requesting “feedback” on “any intelligence uncovered in FBI’s investigation” resulting from the information in the CIR. Michelle, the Bin Laden Unit desk officer who originally had taken notice of the information about Mihdhar and his connections to Al Qaeda, accessed Dwight’s draft CIR less than an hour after Dwight drafted it at approximately 9:30 a.m. Around 4:00 p.m. on the same day, Michelle added a note to the CIR in the CIA’s computer system: “pls hold off on CIR for now per [the CIA Deputy Chief of Bin Laden Unit].” CIA records show that the same morning, the CIA Deputy Chief of Bin Laden Unit, who we will call “John,” also had read the cable indicating that Mihdhar’s visa was valid and that New York had been listed as his intended destination. Around 6:30 p.m. on the same day, John again accessed this cable and then another cable, the same two CIA cables about Hazmi and Mihdhar in 241 the CIA’s computer system that Dwight had used in drafting the CIR. CIA records do not indicate that John accessed Dwight’s draft CIR.173 CIA records show that the CIA employee detailed to FBI Headquarters who we call James and who discussed the Mihdhar information with two FBI Headquarters employees, also accessed the draft CIR on the day it was drafted. In addition, two other FBI detailees accessed the draft CIR: Eric, the other Deputy Chief of the Bin Laden Unit, accessed it two hours after Dwight began writing it, and Malcolm, the New York Field Office’s detailee to the Bin Laden Unit, accessed it two days later. CIA records show that as of eight days later the CIR had not been disseminated to the FBI. In an e-mail to John in mid-January, Dwight had attached the draft CIR and wrote, “Is this a no go or should I remake it in some way.” The CIA was unable to locate any response to this e-mail. By mid-February, the CIR had not been sent to the FBI and was still in draft form in the CIA’s computer system. CIA records show that Dwight emailed a CIA contractor who handled computer matters and asked him to delete several draft cables in the computer system unrelated to this matter, but to save the draft CIR concerning Mihdhar. The contractor accessed the draft cable in the system the next day. When we interviewed all of the individuals involved with the CIR, they asserted that they recalled nothing about it. Dwight told the OIG that he did not recall being aware of the information about Mihdhar, did not recall drafting the CIR, did not recall whether he drafted the CIR on his own initiative or at the direction of his supervisor, and did not recall any discussions about the reasons for delaying completion and dissemination of the CIR. Malcolm said he did not recall reviewing any of the cable traffic or any information regarding Hazmi and Mihdhar. Eric told the OIG that he did not recall the CIR. The CIA employees also stated that they did not recall the CIR. Although James, the CIA employee detailed to FBI Headquarters, declined to 173 According to John, once CIRs were drafted the CIA’s standard operating procedure was for the drafter to “coordinate” the CIR in the computer system, which notified the persons designated by the drafter that there was a CIR that required their attention. He said that it was not standard operating procedure to access CIRs in draft form. 242 be interviewed by us, he told the CIA OIG that he did not recall the CIR. John (the Deputy Chief of the Bin Laden Unit) and Michelle, the desk officer who was following this issue, also stated that they did not recall the CIR, any discussions about putting it on hold, or why it was not sent. 5. Mihdhar in Dubai On the same day that Dwight was drafting the CIR, the CIA reported in an internal cable additional information about Mihdhar. The cable stated that it appeared that, despite his multiple entry visa, Mihdhar had not yet traveled to the United States. The cable then stated that it was up to the CTC as to whether anyone should inquire with the INS to verify whether Mihdhar had traveled to the United States.174 The cable also reported additional information about Mihdhar while he was in Dubai. CIA records reveal that this cable also was read by FBI detailee Dwight. However, Dwight did not include in the draft CIR the additional information about the lack of any indication that Mihdhar had traveled to United States or the additional information about Mihdhar in Dubai.175 6. CIA cable stating that Mihdhar’s visa and passport information had been passed to FBI Also on the same day that Dwight was preparing the CIR, Michelle, the Bin Laden Unit desk officer who was following the issue of Mihdhar, prepared a lengthy cable to several stations summarizing the information that had been collected at that point on Mihdhar and three other individuals who also were possibly traveling to Malaysia. The cable began, “After following the various reports, some much more credible than others, regarding a possible [Bin 174 We did not determine whether the CIA actually contacted the INS pursuant to this suggestion. As we discuss below, we did determine INS records reflect that Mihdhar first entered the United States on January 15, 2000, and only entered again on July 4, 2001. 175 This cable also was read by James, the CIA employee detailed to the FBI’s SIOC. As detailed below, he later discussed some of its contents with an FBI Headquarters employee. 243 Laden]-associated threat against U.S. interests in East Asia, we wish to note that there indeed appears to be a disturbing trend of [Bin Laden] associates traveling to Malaysia, perhaps not for benign reasons.” This cable then summarized the CIA’s information that indicated several individuals were planning to travel to Malaysia. In the paragraph describing Mihdhar, Michelle stated that Mihdhar’s travel documents, including a multiple entry U.S. visa, had been copied and passed “to the FBI for further investigation.” This cable –the fifth CIA cable to discuss Mihdhar’s U.S. visa – did not state by whom or to whom Mihdhar’s travel documents were passed. It also did not indicate how they had been passed, or provide any other reference to the passage of the documents. Because this cable was an internal, operational cable, it was not forwarded to or copied to the FBI. This cable was disseminated to various CIA stations approximately three hours after Michelle had noted in the cable system that Dwight was directed to hold off on sending his draft CIR to the FBI “for now per [the CIA Deputy Chief of the Bin Laden Unit].” When we interviewed Michelle, she stated that she had no recollection of who told her that Mihdhar’s travel documents had been passed to the FBI or how they had been passed. She said she would not have been the person responsible for passing the documents. According to Michelle, the language in the cable stating “[the documents] had been passed” suggested to her that someone else told her that they had already been passed, but she did not know who it was. The CIA Deputy Chief of the Bin Laden Unit also said he had no recollection of this cable, and he did not know whether the information had been passed to the FBI. Neither we nor the CIA OIG was able to locate any other witness who said they remembered anything about Mihdhar’s travel documents being passed to the FBI, or any other documents that corroborated the statement that the documents were in fact passed to the FBI. 7. The Malaysia meetings and surveillance of Mihdhar After he arrived in Malaysia, Mihdhar was followed and photographed in various locations meeting with several different people. These events are 244 referred to as “the Malaysia meetings.” CIA employees wrote several cables contemporaneously about the Malaysia meetings, which we discuss below. a. First cable regarding Mihdhar in Malaysia The CIA prepared an internal cable stating that Mihdhar had arrived in Kuala Lumpur on the evening of January 5. The cable also described his activities with other Arabs who were unidentified at the time. This cable, which we refer to as the “first Malaysia meetings cable,” did not contain any information regarding passports or visas. b. January 5 FBI threat update It appears that this first Malaysia meetings cable was provided to the FBI. Sometime before the daily FBI executive briefing that took place on January 6 at 7:30 a.m., the January 5 threat update information concerning Mihdhar was edited in the FBI’s SIOC. This January 5 threat update reflected an almost verbatim recitation of portions of the CIA’s first Malaysia meetings cable, including the same spelling mistake in reference to a particular place in Malaysia, which indicates that the CIA provided a copy of the first Malaysia meetings cable to the FBI. However, we were not able to determine who in the FBI received this information from the CIA or who edited the January 5 threat update. No one we interviewed at the FBI said they recalled handling information related to Mihdhar or the January 5 threat update. The threat update contained no reference to Mihdhar’s passport information or his U.S. multiple-entry visitor’s visa. The January 5 threat update also was made part of the January 6 7:30 a.m. executive briefing document. This briefing did not contain any additional information about Mihdhar. The January 5 threat update was the only official document from this period located by the FBI that referenced the Malaysia meetings that were discussed in the first CIA Malaysia meetings cable. 245 c. Discussion between CIA and FBI employees about Malaysia meetings As noted above, computer records show that James, the CTC employee detailed to the FBI’s SIOC, read the cables and the draft CIR indicating that Mihdhar had a U.S. visa. Contemporaneous e-mails show that James discussed the Malaysia meetings with two FBI Headquarters employees in the SIOC in the early morning hours of January 6. Below we detail the cables and the evidence about the discussions that took place between the CIA and FBI personnel in the SIOC about the Malaysia meetings. Contemporaneous e-mail messages among CIA employees show that during the night of January 5 James briefed the FBI SSA who we call Bob about Mihdhar’s travel. At the time, Bob was an SSA in the UBL Unit in FBI Headquarters, which was operating out of the SIOC during this period. James wrote an e-mail to several CIA employees in which he stated that he was detailing “exactly what [he] briefed [the FBI] on” in the event the FBI later complained that they were not provided with all of the information about Mihdhar.176 This e-mail did not discuss Mihdhar’s passport or U.S. visa. As previously mentioned, James told the CIA OIG that he had no recollection of these events. He declined to be interviewed by us. Bob told the OIG that he had no independent recollection of any briefing from a CIA employee regarding the Malaysia meetings. However, he was able to locate a scant contemporaneous note that confirmed he had been briefed regarding Mihdhar and his trip to Malaysia. This note contained no details as to the content of the briefing and no reference to Mihdhar’s U.S. visa. Bob told the OIG that he does not believe that he had been told in this conversation about Mihdhar’s U.S. visa. Bob stated to us that the presence of a 176 James wrote these e-mails in response to an e-mail from another CIA employee who was detailed to the FBI SIOC. That employee reported on the morning of January 6 that he had been asked by an FBI employee for the latest on Mihdhar. James responded in a series of e-mails that he had already briefed the FBI. The final e-mail by James sets forth the details of his briefings. 246 U.S. visa in Mihdhar’s passport would have been extremely important and would have triggered a more significant response than his minimal notes. Bob also told the OIG that he did not know why James chose to brief him about Mihdhar. Bob said that he was not a designated point of contact for the CIA while the SIOC was activated, although he also said that he did not know whether there was a designated point of contact in the SIOC. Bob said that he knew James because James had previously been detailed from the CTC to FBI Headquarters and had worked in ITOS with Bob. d. Second cable regarding Mihdhar and the Malaysia meetings The day after the CIA employee discussed the Malaysia meetings with the two FBI SIOC employees, the CIA sent another internal cable providing new information about the activities of Mihdhar. This cable, “the second Malaysia meetings cable,” provided information about Mihdhar’s activities once he left the Kuala Lumpur airport and his meetings with various individuals. e. Discussion between CTC officer and FBI employee about Malaysia meetings Shortly after 7:30 a.m. on January 6, James briefed another FBI SSA – who we call “Ted” – who was detailed to the SIOC from an FBI field office, about information contained in the second Malaysia meetings cable. Ted told the OIG he was working in the SIOC as an “assistant” to the day shift commander and the UBL Unit Chief, but that he had no specific duties. Because Bob had left FBI Headquarters on a trip to New York by this time, James briefed Ted to ensure that someone at FBI Headquarters had the latest information on Mihdhar. In the same e-mail in which he had detailed what he told Bob, James provided specifics of what he told Ted. The e-mail also stated that the CIA would “continue to run this down and keep the FBI in the loop.” The e-mail did not contain any reference to Mihdhar’s passport or U.S. visa. Based on this briefing by James, Ted prepared an update for the January 6 afternoon FBI executive briefing. Ted e-mailed the update to the ITOS Assistant Section Chief at 8:40 a.m. This update reflected the details of the 247 information Ted had received from James. It did not contain any reference to Mihdhar’s passport or U.S. visa. Like Bob, Ted told the OIG that he had no recollection of being briefed regarding the Malaysia meetings. Although he said he did not recall these events, Ted asserted he did not believe that he had received Mihdhar’s passport or U.S. visa information because if he had he would have unquestionably recognized their significance and documented such information in the update for the executive briefing. Ted told the OIG that he did not know why James briefed him about the Mihdhar information. Like Bob, Ted stated he was not a designated point of contact for the CIA while the SIOC was activated. Ted also knew James because of James’ previous detail to ITOS in FBI Headquarters when Ted served as an SSA in the RFU. f. Cables updating the Malaysia meetings information, including Mihdhar’s travel to Bangkok On January 8, the CIA reported in another internal cable that a new individual had joined Mihdhar and the others, and that additional surveillance photographs were taken. The cable did not state how many photographs were taken or what would be done with the photos. In another cable sent five hours later, the CIA reported in an internal cable that Mihdhar and two of the unidentified men – one of whom turned out to be Hazmi – departed Malaysia from Kuala Lumpur airport en route to Bangkok, Thailand. g. Cables regarding Hazmi’s travel to the United States On January 9, the CIA’s Bin Laden Unit prepared a cable asking that Mihdhar and his associates be identified while in Thailand. CIA records show that on January 13, the CIA was attempting to locate Mihdhar and his traveling companions. In addition, Mihdhar had been watchlisted at the airport in the event that he attempted to leave Thailand. Several weeks later, CIA officers in Kuala Lumpur followed up with their Bangkok counterparts for additional information about Mihdhar and his traveling companions. Approximately two weeks later, Bangkok reported that 248 there was a delay in responding due to difficulties in obtaining the requested information. In early March 2000, officials in Bangkok reported internally that it had identified one of Mihdhar’s traveling companions as Nawaf al-Hazmi. The cable reported that Hazmi had traveled to Bangkok on January 8 and had subsequently traveled on a United Airlines flight to Los Angeles, California on January 15. The cable also stated that Mihdhar had arrived in Bangkok on January 8 but that it was unknown if and when he had departed.177 In addition, the cable identified the third traveler as Salah Saeed Mohammed Bin Yousaf.178 CIA records show that none of the FBI detailees accessed this early March cable. The OIG found no documents or witnesses indicating that the information that Hazmi had traveled to Los Angeles on January 15, 2000, was shared with the FBI at this time. Rather, as we discuss below, this fact was not shared with the FBI until August 2001. We found no indication that CTC personnel took any action with regard to the important information that Hazmi had traveled to the United States. For example, he was not placed on any U.S. watchlists. The day after Bangkok Station reported about Hazmi’s travel to Los Angeles, one office that received the Bangkok cable sent a cable to the CTC stating the Bangkok cable regarding Hazmi’s travel had been read “with interest.” Yet, despite this effort to flag the significance of this information, the cable was not shared with the FBI and did not result in any specific action by the CIA. As we discuss below, it was not until August 2001 that FBI Headquarters personnel learned that on January 15, 2000, both Mihdhar and Hazmi had left Thailand and traveled to Los Angeles, California, where they were both 177 In fact, Mihdhar had traveled to the U.S. with Hazmi on January 15, 2000. This fact was not discovered by anyone in the Intelligence Community until August 2001. 178 Yousaf left Bangkok on January 20 for Karachi, Pakistan. Some time after September 11, Yousaf was determined to be Tawfiq Muhammad Salih Bin Rashid al Atash, a/k/a Khallad, the purported mastermind of the Cole attack. We discuss the FBI’s discovery of information about Khallad and the Cole attack, and the FBI’s opportunities to connect Khallad to the Malaysia meetings, in Section III, C below. 249 admitted into the United States on non-immigrant visas and authorized to remain until July 14, 2000. 8. OIG findings regarding FBI’s knowledge about Mihdhar and the Malaysia meetings We discuss here our findings regarding the FBI’s knowledge of information about Mihdhar and the January 2000 Malaysia meetings, including whether the intelligence information concerning Mihdhar’s valid multiple entry U.S. visa and Hazmi’s travel to the United States in January 2000 was passed to the FBI. Several witnesses told the OIG that Mihdhar’s possession of a U.S. visa provided a clear domestic nexus that should have triggered the passing of this information from the CIA to the FBI. At the outset, we note that the CIA has acknowledged that it obtained information that Mihdhar had a U.S. visa and that Hazmi had traveled to the United States, and that the CIA should have placed their names on U.S. watchlists, but that this did not occur.179 The CIA OIG is reviewing this matter to determine why this failure occurred and who is responsible for it. a. Formal passage of information from the CIA to the FBI As noted above, the formal method of communicating intelligence information between the CIA and the FBI was an intelligence report called a CIR. CIA records show that between July 1999 and September 10, 2001, the Bin Laden Unit disseminated over 1,000 CIRs, most of which were sent to the FBI. CTC employees as well as FBI detailees to Bin Laden Unit had authority to draft CIRs, and the detailees collectively drafted over 150 CIRs to the FBI during this period. However, CIRs could only be disseminated by persons with authority to “release” the CIRs.180 In the Bin Laden Unit, only supervisors, 179 Mihdhar and Hazmi were placed on watchlists by other countries, including Thailand. 180 Once a supervisor approved a CIR for release, it was electronically disseminated by a unit in the CIA known as the Policy Community Action Staff. 250 including John and Eric as the deputy chiefs of the station, had authority to release CIRs.181 Dwight drafted a CIR in which he summarized the information that had been disseminated by the NSA about Mihdhar. He also provided detailed information about Mihdhar’s passport, visa, and visa application indicating that New York had been his intended destination. According to CIA records, this CIR never was disseminated to the FBI. A desk officer’s note on the draft CIR indicated that the Deputy Chief of the Bin Laden Unit, John, had instructed the draft CIR be put on hold, and Dwight contacted him through an e-mail about the disposition of the CIR a week later. Despite this e-mail, the evidence clearly shows that the CIR never was disseminated to the FBI. The evidence shows, however, that Dwight acted in accordance with the system that was in place at the time by drafting the CIR to formally pass the visa information to the FBI. In accordance with Bin Laden Unit policy, Dwight was not permitted to pass the CIR to the FBI without permission. All of the witnesses stated, however, that they did not recall the CIR or any communications about it. Other than the note written by the desk officer, we found no documentary evidence about why the CIR was not disseminated. Thus, we were unable to determine why it was not sent. The information in the CIR, which was documented in the appropriate format for passage to the FBI, was potentially significant to the FBI and should have been passed to the FBI. We believe it was a significant failure for the CIR not to be sent to the FBI. b. Informal passage of information from CIA to FBI We also considered what information that James, a CIA detailee to the FBI, informally passed to FBI Headquarters and whether he informed anyone of the visa information about Mihdhar. Based on the contemporaneous e-mails in which James documented in detail what he told FBI SSAs Bob and Ted, we concluded that he reported to the FBI the information regarding Mihdhar’s 181 CIA records show that Eric released five CIRs during his tenure at the Bin Laden Unit. 251 transit through Dubai, his arrival in Kuala Lumpur, his activities after his arrival, and his meeting with other suspected al Qaeda operatives. It is far less clear, however, whether he provided Mihdhar’s passport and U.S. visa information to the FBI. We do not believe that James briefed either Bob or Ted on Mihdhar’s passport or U.S. visa information. First, nothing in Bob’s contemporaneous notes or Ted’s e-mail or briefing update referred to Mihdhar’s passport or visa information. Bob and Ted also stated forcefully and credibly to us that they would have recognized the significance of a U.S. visa in the hands of a suspected al Qaeda operative and at a minimum would have included such information in their notes or reports. Moreover, James wrote a detailed e-mail to document the contents of his conversations with Bob and Ted. Since the stated purpose of James’ e-mail was to prevent the FBI from later claiming he had failed to brief them on some important details, he had every incentive to include all relevant details in that email. At the time he wrote this e-mail, he had read three of the CIA cables indicating that Mihdhar had a U.S. visa, as well as the draft CIR. Yet, James’ e-mail contained no mention of Mihdhar’s passport or visa. We found only one piece of evidence suggesting that the FBI was made aware in January 2000 of Mihdhar’s U.S. visa – the early January cable by the desk officer who we call Michelle which stated that Mihdhar’s travel documents, including a multiple entry U.S. visa, had been copied and passed “to the FBI for further investigation.” We could not, however, find any evidence to corroborate that this information actually had been passed to the FBI. This cable did not state by whom or to whom the documents were passed or make any other reference to the passage of the documents. The cable was an internal cable, which means it would not have been forwarded to or accessible to the FBI. In addition, Michelle, the CIA desk officer who wrote the cable, had no recollection of who told her that the documents had been passed or how they had been passed. She said that she would not have been responsible for passing the information but instead would have been told by someone else that the documents had been passed. We were unable to locate any witness who said they remembered anything about the documents being passed to the FBI, as Michelle’s cable 252 asserted. Even if her cable was accurate, and she had been told by someone that the documents had been passed to the FBI, there is no evidence that such information was correct. The CIA and FBI witnesses we interviewed described this period as very hectic and said they were flooded with information. Several witnesses suggested that these hectic circumstances could have created an environment where unintentional misunderstandings might have occurred about whether information was actually passed to other Intelligence Community agencies. We also searched ACS for any FBI record of the travel documents having been provided to the FBI, since this cable indicated that a physical copy of the documents, not merely information about the documents, was passed. We found no reference to the documents. Aside from this cable, we found no other evidence that the information or documents about Mihdhar’s passport or visa information was in fact provided to the FBI during this time period. c. FBI detailees’ handling of information on Mihdhar As discussed above, five FBI employees were detailed to the CTC to work on Bin Laden matters during 2000 and 2001, and all had access at their desks to CIA internal cable traffic. Four of those employees – the supervisor who we call Eric, the IOS who we call Mary, and the agents who we call Dwight and Malcolm – were at the Bin Laden Unit in January 2000 when the Malaysia meetings occurred.182 We considered how each handled the intelligence information concerning Mihdhar during this period. After reading two of the cables indicating that Mihdhar had a U.S. visa, Dwight prepared a draft CIR to officially notify the FBI about that information, since the U.S. visa presented a nexus between Mihdhar and the United States. But the CIR was not provided to the FBI. However, we also examined whether any of the detailees took any other action to notify FBI Headquarters or, in Malcolm’s case, the New York Field Office, about the information concerning Mihdhar. 182 The fifth detailee – the manager who we call Craig – did not arrive at the CTC until July 2000. 253 The evidence shows that each FBI detailee reviewed some of the cables about Mihdhar’s U.S. visa. Dwight accessed several of the cables that indicated Mihdhar had a U.S. visa, such as the cables stating that Mihdhar had transited through Dubai and had a U.S. visa, the cable stating that Mihdhar’s visa application listed New York as his intended destination in May 1999, and the cable stating that based on a review of Mihdhar’s visa, it did not appear that he had actually traveled to the United States. Malcolm also accessed the cable stating that Mihdhar’s visa application listed New York as his intended destination in May 1999, and the cable stating that it did not appear that Mihdhar had actually traveled to the United States. Malcolm also accessed the two cables stating that Mihdhar had arrived in Kuala Lumpur and that surveillance photos showed him meeting with others in Malaysia. Malcolm also accessed Dwight’s draft CIR indicating passage of the visa information to the FBI, including the New York Field Office. Mary accessed the January cable stating that Mihdhar’s travel documents, including a multiple-entry U.S. visa, had been passed to the FBI, but she did not access the previous cables reflecting the visa information or Dwight’s CIR. She also accessed the two cables stating that Mihdhar had arrived in Kuala Lumpur and that surveillance photos showed him meeting with others in Malaysia. Eric did not access these cables, but he accessed Dwight’s draft CIR which detailed Mihdhar’s visa information and which summarized the NSA information. However, Dwight, Malcolm, Mary, and Eric all told the OIG that they did not recall anyone from the CIA bringing to their attention the fact that Mihdhar had a U.S. visa. In addition, despite the records of their access to the cable traffic or the CIR, they all told the OIG that they did not recall discovering at the time – such as by reading a cable – that Mihdhar had a U.S. visa.183 As discussed above, Dwight told the OIG that he did not even recall 183 The detailees also told the OIG that they did not necessarily read all of the cables they accessed. They explained that they often skimmed cables to determine if any action was required on their part or to find specific information in connection with a particular assignment or issue. 254 writing the CIR or even being aware of the Malaysia meetings or of the fact that Mihdhar had a U.S. visa. Eric told the OIG that his CIA counterpart – John, the CIA Bin Laden Unit Deputy Chief – mentioned the Malaysia meetings and that surveillance photos had been taken, but Eric did not recall ever hearing anything about Mihdhar having a U.S. visa. Mary told the OIG that she did not recall even being contemporaneously aware of the Malaysia meetings.184 Mary explained that she did not have reason to be made aware of the Malaysia meetings at the time because the matter had been assigned to another CIA desk officer – Michelle (the one who wrote the cable indicating that Mihdhar’s travel documents had been passed to the FBI). Malcolm said he was not aware of the fact that Mihdhar had a U.S. visa until after September 11. He stated that he recalled being shown the Kuala Lumpur photos, but he could not remember whether that was before or after September 11. He said that it was not until he was shown the Kuala Lumpur photos that he became aware of the Malaysia meetings. Yet, the evidence shows that all had accessed contemporaneously cables indicating that Mihdhar had a U.S. visa, which was important intelligence information that was never provided to FBI Headquarters. They did not violate any specific policy or procedure in their handling of the information, and they did not have the authority to unilaterally pass CTC information to the FBI without permission. This restriction included any informal passage of the information, such as by telephone call or in-person discussions. However, none of them, particularly Dwight, ensured that the information was provided to the FBI. Dwight drafted a CIR that would have provided the FBI with the important information about Mihdhar, but the CIR was not released by the CIA. Although Dwight followed up a few days later to ask whether the cable was going to be sent or whether he should remake it in some other way, there is no record of a response to his request, and no one could explain why the cable was not sent. We believe it was critical that the information be sent. We found no indication that this ever happened. 184 When we showed Mary copies of an e-mail written by the CTC officer who had briefed SSA Bob and Ted, which indicated that she was copied on the e-mail, she said that she did not recall having read the e-mail. 255 This failure to send the information to the FBI, in our view, was also attributable to problems in how the detailees were instructed and supervised, and that these problems significantly impeded the flow of information between the CIA and the FBI. We discuss these systemic problems in detail in our analysis section later in this chapter. d. OIG conclusion In sum, the evidence shows that in January and March 2000, the CIA uncovered important intelligence information about Mihdhar and Hazmi: • They were al Qaeda operatives who had traveled to Malaysia, where they were photographed meeting with other suspected al Qaeda operatives; • They traveled to Bangkok with a third person; • Mihdhar had a valid, multiple-entry U.S. visa; and • Hazmi had traveled to Los Angeles in January 2000. Yet, we found that the CIA did not share significant pieces of this information with the FBI – that Mihdhar had a U.S. visa and that Hazmi had traveled to Los Angeles. An FBI detailee at the CIA drafted a CIR to share this information with the FBI, but that information was not released by the CIA to the FBI. We were unable to determine why this did not occur. No one we interviewed said they remembered the CIR or why it was not sent to the FBI. We consider it a significant failure for this CIR not to be sent to the FBI. In addition, the evidence shows that the limited information that was provided to FBI Headquarters – that Mihdhar traveled to Malaysia and met with other suspected al Qaeda operatives – was never documented by the FBI in any system that was retrievable or searchable, thus limiting the usefulness of the information that was shared. The FBI’s only official record of having received this information was in the hard copies of the January 5 threat update, which was attached to the January 6 executive briefing, and Ted’s e-mail summarizing information from his discussion with the CIA employee. We discuss this and other systemic problems in our analysis section below. 256 B. Hazmi and Mihdhar in San Diego 1. Introduction The second set of events that may have led the FBI to discover Mihdhar and Hazmi’s presence in the United States related to their stay in San Diego. As noted above, on January 15, 2000, Mihdhar and Hazmi boarded a flight in Bangkok, Thailand, for Los Angeles. They were admitted to the United States on non-immigrant visitor visas and authorized to remain in the U.S. until July 14, 2000. Shortly after arriving in Los Angeles, they traveled to San Diego, California, where they were aided in finding a place to stay by Omar al-Bayoumi. Bayoumi had been the subject of an FBI preliminary intelligence investigation that had been closed. In late May 2000, Hazmi and Mihdhar rented a room in the residence of an FBI asset.185 Mihdhar remained in San Diego until June 10, 2000, when he left the United States.186 Hazmi remained in the San Diego area until approximately December 2000, when he moved to the Phoenix, Arizona area. In Phoenix, Hazmi lived for approximately three months with another September 11 hijacker, Hani Hanjour. In April 2001, Hazmi and Hanjour moved to New Jersey and remained on the East Coast until September 11. While residing in San Diego in 2000, Mihdhar and Hazmi did not act in an unusual manner that would draw attention, but they did not attempt to hide their identities. Using the same names contained in their travel documents and known to at least some in the Intelligence Community, they rented an apartment, obtained driver’s licenses from the state of California Department of Motor Vehicles, opened bank accounts and received bank credit cards, purchased a used vehicle and automotive insurance, took flying lessons at a local flying school, and obtained local phone service that included Hazmi’s listing in the local telephone directory. 185 This kind of individual is often referred to as an “informant” - the common vernacular for an individual providing information to an investigative agency. Within the FBI’s foreign intelligence program, they are known as assets. 186 Mihdhar departed from Los Angeles on Lufthansa Airlines. 257 Although Hazmi and Mihdhar were in San Diego for a significant period of time, the FBI did not learn of their presence there until after September 11, 2001. After September 11, much would be learned about Hazmi and Mihdhar’s time in San Diego and the Intelligence Community’s missed opportunities to find and investigate them before the terrorist attacks in which they participated. In this section, we describe the facts surrounding Hazmi and Mihdhar’s residence in San Diego, including their associations with two persons known to the FBI. 2. Hazmi and Mihdhar’s association with Bayoumi Omar al-Bayoumi is a Saudi Arabian national who came to the United States in 1993. In early 2000 he had been living with his wife and four children in San Diego for at least four years. Although he described himself to others in San Diego as a graduate student in business administration, he took classes intermittently and was not enrolled in a program of study. He did not work in the United States and received a monthly stipend of $4,000 plus “other allowances,” ranging from $465 to $3,800 each month, from Dallah/Avco, a Saudi contractor to the Presidency of Civil Aviation.187 Bayoumi was active in the San Diego Muslim community and was involved in the establishment of several mosques in the United States. In September 1998, the FBI’s San Diego Field Office opened a preliminary inquiry on Bayoumi based on allegations raised by the manager in the apartment complex where he was living at the time. The manager alleged that Bayoumi had received a suspicious package from the Middle East, and the maintenance worker for the apartment complex had noted strange wires in Bayoumi’s bathroom. In addition, the manager reported frequent gatherings of young Middle Eastern males at Bayoumi’s apartment on weekend nights. The FBI case agent conducted a limited investigation of Bayoumi, but the preliminary inquiry was closed in June 1999 and was not converted to a full 187 Bayoumi was employed by the Saudi Presidency of Civil Aviation from 1975 until 1995 and became a contractor for the organization beginning in 1995. 258 field investigation.188 As a result, the FBI was no longer investigating Bayoumi at the time that Hazmi and Mihdhar met Bayoumi in February 2000. However, the following paragraphs describe what was later learned about Bayoumi’s interactions with Hazmi and Mihdhar. On February 1, 2000, Bayoumi traveled by car from San Diego to Los Angeles, to resolve a visa issue at the Saudi consulate. Bayoumi invited an associate, Isamu Dyson, to accompany him.189 Dyson provided the following account to the FBI of the trip with Bayoumi.190 Dyson said that at the time of the invitation, Bayoumi mentioned a Los Angeles restaurant serving halal food where they could eat lunch after Bayoumi’s meeting at the consulate.191 After Bayoumi spent approximately one hour at the Saudi consulate, he and Dyson went to the restaurant but discovered it had been converted to a butcher shop. The butcher shop employees recommended another nearby halal restaurant, the “Mediterranean Gourmet.” Bayoumi and Dyson walked to that restaurant. While they were eating there, Hazmi and Mihdhar entered the restaurant and the four talked in Arabic. Although Dyson had limited Arabic language skills, he said that Bayoumi kept him apprised of the content of the conversation. Hazmi and Mihdhar told Bayoumi that they were in the United States to study English, but they did not like living in Los Angeles. Bayoumi invited the men to visit San Diego and offered to assist them. Bayoumi provided the men with his phone number. Bayoumi and Dyson left the restaurant, and after stopping at a nearby mosque for sunset prayers, returned to San Diego. Dyson asserted that the encounter with Hazmi and Mihdhar seemed to be a coincidental meeting. Within several days of the meeting, Hazmi and Mihdhar accepted Bayoumi’s invitation and traveled to San Diego. In San Diego, Bayoumi 188 In Section IV B 1 of this chapter, we examine the investigative steps taken by the FBI in this preliminary inquiry and assess the appropriateness of the decision to close the inquiry. 189 Dyson is an American Caucasian who converted to Islam. He has since changed his name to Caysan Bin Don. 190 Dyson provided the information to the FBI in an interview after September 11. 191 Halal is an Arabic word meaning “lawful” or “permitted.” 259 arranged for Hazmi and Mihdhar to rent an apartment on Mount Ada road in the same apartment complex where Bayoumi lived. Bayoumi also co-signed their lease. Shortly after Hazmi and Mihdhar moved into the apartment, Bayoumi hosted a party to introduce them to the local Muslim community. Within a few weeks of moving into the apartment, Hazmi and Mihdhar filed a 30-day notice to vacate the apartment, apparently to move to another apartment. However, they later rescinded the vacate notice and continued to lease the apartment until June 2, 2000.192 The apartment manager told the FBI that Bayoumi paid Hazmi and Mihdhar’s first month’s rent and security deposit because they had not yet established a local bank account and the apartment complex would not accept cash. A review of Bayoumi and Mihdhar’s financial records after September 11, 2001, indicate that Bayoumi was reimbursed for this expense on the same day it was paid.193 3. Hazmi and Mihdhar’s communications On March 20, 2000, a long distance telephone call was placed from Mihdhar and Hazmi’s Mount Ada apartment to a suspected terrorist facility in the Middle East linked to al Qaeda activities. (See section III, A, 2 above.) A record of the call was captured in the toll records. After the September 11 attacks, the call was identified through a record check. 192 Bayoumi left the United States for some of the time Hazmi and Mihdhar lived in the apartment. INS records do not indicate when Bayoumi left the country, but the records indicate that he obtained a United States visa in Jeddah on May 10, 2000, and returned to the United States on May 31, 2000. Bayoumi left the United States permanently in July 2001 and was living in England on September 11, 2001. 193 Bayoumi’s bank records show a cash deposit in the exact amount of the rent and security deposit ($1,558). Mihdhar’s financial records also indicate that he opened an account with a deposit of $9,900 in cash within seven minutes of Bayoumi’s cash deposit, which suggests that they were in the bank together. 260 4. Hazmi and Mihdhar’s association with an FBI asset beginning in May 2000 Sometime in May 2000, Hazmi and Mihdhar moved out of the apartment Bayoumi had found for them on Mount Ada Road and moved as boarders into the home of an asset of the FBI’s San Diego Field Office.194 Hazmi and Mihdhar met the asset at the mosque they attended.195 Mihdhar stayed at the asset’s residence until June 10, 2000, when he left the United States. Hazmi resided in the asset’s house until December 10, 2000, when he moved to Arizona. a. Background on the FBI asset In 1994, the asset was recruited by San Diego FBI Special Agent who we call “Stan.” The FBI had interviewed the asset in connection with a bombing investigation several years before. Stan remained the asset’s handling agent – or “control agent” – until Stan retired in February 2002.196 The asset was opened as an asset on May 14, 1994.197 He worked as an informational source, providing to the FBI information acquired in his normal daily routine. He normally was questioned about specific individuals who were under investigation by the FBI, although he occasionally volunteered information that he thought might be relevant. According to Stan, during some 194 The OIG was not able to interview the asset. The Joint Intelligence Committee Inquiry had attempted to interview the asset without success. The Committee then submitted interrogatories that the asset declined to answer, asserting his Fifth Amendment privilege. The asset indicated through his attorney that if subpoenaed by the Committee, he would not testify without a grant of immunity. 195 There is some dispute about whether Hazmi and Mihdhar actually responded to an advertisement for boarders posted by the asset or whether they were introduced to the asset. The OIG did not have access to the witnesses who could address this issue. 196 Stan was interviewed twice by the JICI staff, and he testified before the Joint Intelligence Committee. After his retirement from the FBI, Stan declined repeated requests for an OIG interview. The OIG does not have authority to subpoena individuals and cannot compel former Department of Justice employees to submit to an interview. 197 Initially the asset was not paid. In July 2003, the asset was given a $100,000 payment and closed as an asset. 261 periods, he would talk to the asset several times per day, but there were periods in which he did not talk to him for several weeks or months. Stan said that many of their conversations were about family matters, the informational asset’s health, and other non-substantive issues. In 1996, the asset began renting out rooms in his home. Prior to September 11, 2001, he had 14 different boarders in his house, including Hazmi and Mihdhar. When Hazmi and Mihdhar rented rooms from the asset in 2000, two other persons also were renting rooms there. b. Information from asset on Hazmi and Mihdhar It is not clear what information the asset provided to the FBI about Hazmi and Mihdhar before the September 11 attacks. After the September 11 attacks, the FBI interviewed the asset and asked about the conduct and activities of Hazmi and Mihdhar while they were living with the asset. In those interviews, the asset described them as quiet tenants who paid their rent. He said they were good Muslims who regularly prayed at the mosque. The asset said that Hazmi and Mihdhar often would go outside when using their cellular telephones. The asset insisted that he noted no indicators of nefarious activity by Hazmi or Mihdhar that should have resulted in his reporting their identities to the FBI.198 The asset was asked what information he provided to Stan about Hazmi and Mihdhar before September 11. In these interviews, the asset provided conflicting accounts regarding the information on Hazmi and Mihdhar that he had disclosed to Stan. The agent who interviewed the asset - this agent had taken over as the asset’s control agent after Stan’s retirement from the FBI - told us that the asset said he told Stan about his boarders in general terms, although he had not fully identified Hazmi and Mihdhar. The control agent said that the asset later said that he had not told Stan about the boarders at all. 198 The FBI opened an investigation after September 11 to determine whether the asset was involved in the attack. The asset has consistently maintained after September 11 that he had no suspicions about Hazmi and Mihdhar. The results of a polygraph examination on his potential role were inconclusive. Based on its investigation, however, the San Diego FBI concluded that the informational asset had not been complicit in plotting the attacks. 262 Although Stan declined to be interviewed by the OIG, after September 11, his FBI supervisors had interviewed him about the asset. Stan also had discussed the asset with co-workers and was interviewed by, and subsequently testified in, a closed session before the Joint Intelligence Committee.199 Stan reported that the asset had told him contemporaneously that two Saudi national visitors were residing in a room at his residence. Stan said that the asset merely provided the first names of the boarders, Nawaf and Khalid. Stan contended that he had asked the asset for the boarders’ last names but never received them and did not follow up. He said that the asset told him that his boarders were in the U.S. on valid visitors’ visas, and they planned to visit and to study while they were in the country. In addition, Stan said that the asset told him that he believed that the two boarders were good Muslims because of the amount of time that they spent at the mosque. Stan stated that he did not recall the asset ever telling him that either of the boarders had moved out. According to Stan, the asset did not describe his boarders as suspicious or otherwise worthy of further scrutiny. Stan reported that he never obtained Hazmi and Mihdhar’s full identities from the asset and that he did not conduct any investigation of them. 5. OIG conclusion In sum, the FBI did not obtain information about Mihdhar’s and Hazmi’s time in San Diego, either as a result of the Bayoumi preliminary inquiry or from the asset. In the analysis section of this chapter, we evaluate Stan’s actions with regard to Hazmi and Mihdhar and whether he should have pursued additional information about who was living with one of his assets. C. Mihdhar’s association with Khallad, the purported mastermind of the Cole attack The third potential opportunity for the FBI to acquire information about Hazmi and Mihdhar occurred in January 2001, when a joint FBI/CIA source identified an al Qaeda operative in photographs of the January 2000 Malaysia meetings that Hazmi and Mihdhar had attended. However, the FBI has 199 The OIG was permitted to review the transcripts of Stan’s testimony before the Joint Intelligence Committee’s Inquiry. 263 asserted that it did not learn of the source’s identification of the al Qaeda operative at the Malaysia meetings until much later in 2001, just before the September 11 attacks. This section of the report describes the events surrounding this third opportunity for the FBI to focus on Hazmi and Mihdhar. 1. Background In 2000, the CIA and the FBI began debriefing a source who provided significant information on operatives and operations related to Usama Bin Laden. The source gave the CIA and the FBI information about an al Qaeda operative known as “Khallad” and described him as being involved with the East African embassy bombings in August 1998. Shortly after the U.S.S. Cole was attacked in October 2000, the CIA and the FBI received a photograph and information that a man named “Khallad” was the purported mastermind behind the attack on the Cole. In December 2000, the CIA and the FBI showed the source the photograph of Khallad, and the source identified the person in the photograph as the same Khallad he had described as involved with the East African bombings. As part of the Cole investigation, the FBI sought to find Khallad. In January 2001, the source was shown photographs from the Malaysia meetings in an effort to determine whether Khallad was in the photographs. The source identified Khallad in one of the photographs, thus connecting the purported mastermind of the attack on the Cole with the Malaysia meetings known to have been attended by Mihdhar and others.200 FBI officials told the OIG, however, that the FBI was not aware of the identification of Khallad in the Kuala Lumpur photographs. The FBI officials said that if they had known that Khallad – the purported mastermind of the Cole attack who they were seeking to find – was identified in the Kuala Lumpur photographs, they would have aggressively pursued information on the circumstances of the Malaysia meetings and the other participants, including Mihdhar. As a result, they said, they may have uncovered earlier the CIA’s 200 Information developed after September 11, 2001, revealed this was a misidentification, and the person identified as Khallad was actually Hazmi. We discuss this misidentification in detail below. 264 information about Mihdhar and Hazmi and found them in the United States well before the summer of 2001. On the other hand, the CIA has contended the FBI in fact was aware in January 2001 of the source’s identification of Khallad from the Kuala Lumpur surveillance photographs. For example, on September 26, 2002, Cofer Black, who served as Director of the CIA’s CTC from 1999 until May 2002, testified before the Joint Intelligence Committee: FBI agents and analysts had full access to information [the CIA] acquired about the Cole attack. For example, we ran a joint operation with the FBI to determine if a Cole suspect was in a Kuala Lumpur surveillance photo. I want to repeat – it was a joint operation. The FBI had access to that information from the beginning. More specifically, our records establish that the Special Agents from the FBI’s New York Field Office who were investigating the USS Cole attack reviewed the information about the Kuala Lumpur photo in late January 2001. We therefore examine in detail the evidence relating to whether the FBI was aware of the identification of Khallad in the photographs of the Malaysia meetings. 2. Source’s identification of Khallad a. The source In mid-2000, Drug Enforcement Administration (DEA) personnel arranged for FBI Legal Attaché (Legat) Office personnel overseas to meet a source who had substantial information on Bin Laden and his operatives and operations. This particular FBI Legat office was staffed by the Legal Attaché (the “Legat”) and the Assistant Legal Attaché (the ALAT), who were FBI Special Agents.201 (continued) 201 The primary mission of FBI Legat Offices is to establish liaison with foreign law enforcement agencies to support the FBI’s investigative activities overseas. While Legat staff may become involved in specific investigations, they have no law enforcement authority in foreign countries. For a description of the role and responsibilities of FBI 265 Because of the FBI Legat personnel’s inability to converse in any of the source’s languages, limits on the FBI’s authority to conduct unilateral intelligence activities overseas, and the source’s potential value as a source of intelligence information relevant to the CIA, the FBI contacted the CIA for assistance with the source. The source was subsequently handled as a joint FBI/CIA source. Even though the FBI ALAT – who we call “Max” – was unable to directly communicate with the source due to the lack of a common language, he was designated as the FBI control agent for the source. Because the source had significant information about Bin Laden and his operatives and operations, the FBI New York Field Office – the office that was leading the investigations on the East African embassy bombings, the Cole attack, and other Bin Laden-related investigations – also became involved with the source. This joint handling of the source created concerns within the CIA. The CIA’s most significant concern was the FBI’s desire to use the source for the criminal investigations involving Bin Laden conducted by the FBI’s New York Field Office. The CIA believed that the source should not face possible exposure in criminal proceedings. CIA Headquarters was asked to work with FBI Headquarters to convert the source to purely an intelligence role, solely under CIA control. According to CIA documents, the CIA and the Legat had discussed the FBI’s “wall” whereby separate but concurrent intelligence and criminal investigations were conducted within the FBI, but the CIA expressed concerns about the CIA’s ability to continue clandestine handling of the source if the FBI was involved. Although the CIA acknowledged that the source had value to the FBI’s criminal case, the CIA argued that the source’s potential as an intelligence asset was more important then his potential assistance in the criminal case. Despite the CIA’s concerns, the source remained a joint FBI/CIA asset. b. Debriefings of the source Beginning in 2000, the CIA and FBI began to debrief the source on a regular basis. Over the course of several months, the source frequently was (continued) Legats, see the OIG report entitled, “Federal Bureau of Investigation Legal Attaché Program” (March 2004). 266 shown photographs and asked to identify people in them. Although Max was the source’s designated control agent, a CIA officer who spoke one of the source’s languages conducted the debriefings. Max was present for some of these debriefings, but not all. Some of the debriefings were unilateral CIA interviews. The time spent with the source was kept short because of issues of travel and security. According to Max, during the debriefings the CIA officer usually did not immediately translate the source’s statements for the benefit of Max. He said that the CIA case officer would only immediately translate something when Max had specific questions for the CIA officer to ask the source. The CIA case officer told the OIG he recalled translating for Max things that the source said, but he did this only when he recognized the significance of the information to Max or an FBI operation. In an effort not to duplicate the reporting of information received from the source, the CIA and the FBI agreed that the CIA would be responsible for reporting the information from the debriefings. However, in instances where the source was solely being shown FBI photographs or questioned based on an FBI lead, Max would document the source’s information, either in an EC or an FBI FD-302 form, and the CIA would not document the same information. After the debriefings, the CIA officer would write internal cables covering the debriefings and forward them to the CTC and other appropriate offices. These cables were internal CIA communications and were not provided to or shared with Max or other FBI personnel.202 Instead, Max and FBI Headquarters would be informed of the debriefings when the information was reported by the CIA in a TD. As previously discussed, TDs were prepared by CIA reports officers who reviewed the internal cables and determined what information needed to be disseminated and to which agencies. Based on our review of internal cables reporting the source’s debriefings and the TD reporting of the same interviews, it is clear the TDs often contained only a part of the information obtained during the source debriefings. As a result, either 202 As discussed above, FBI detailees to the CTC had access to these CIA cables, but the review and dissemination of source information to the FBI was not considered their responsibility. 267 through direct knowledge or through the TDs, Max had access to only some of the information obtained from the source during the debriefings. In addition to the debriefings of the source by the CIA case officer, FBI agents from the New York Field Office working Bin Laden-related criminal investigations also interviewed the source with the CIA case officer present. Max occasionally was present for these interviews. After each of these interviews, the New York agents documented the source’s information in detail in an FD-302 that was entered into ACS and retrievable by all FBI personnel working on the Bin Laden cases.203 These FD-302s were routinely shared with CIA personnel in the field and at the CTC. c. Source identifies Khallad from Yemeni-provided photograph Over a 3-month period in 2000, FBI New York Field Office personnel interviewed the source overseas four times. During one of these interviews, the source described an individual known as “Khallad” as a trusted senior Bin Laden operative with potential connections to the East African embassy bombings. As noted above, on October 12, 2000, two terrorists in a boat laden with explosives committed a suicide attack on the U.S.S. Cole, a U.S. naval destroyer, during its brief refueling stop in the port in Aden, Yemen. The FBI’s investigation into the attack was led by the FBI’s New York Field Office. After the attack on October 12, the Yemenis provided the FBI and the CIA with information on the Bin Laden operative known as “Khallad.” According to this information, Khallad had been described as the purported mastermind of the Cole attack. U.S. intelligence agencies had already 203 When a witness is interviewed as part of a criminal investigation, the FBI prepares an FD-302 to document what was said in the interview. When information is being obtained as part of an intelligence investigation, the FBI documents the information in an EC. There was often a significant lag time between the interview and the completion of the documentation due to a variety of factors, including the intensity of investigative activity, the agents’ extensive travel, and the required review of the documentation by FBI supervisors before dissemination. 268 connected Khallad to the East African embassy bombings. The Yemenis also identified “Khallad” as Tawfiq Muhammad Salih Bin Rashid al Atash. On November 22, 2000, the Yeminis provided the FBI with a photograph of Khallad (“the Yemeni-provided photograph”). Around this same time, the Yemenis provided the FBI with several photographs of other Cole suspects. The New York FBI agents investigating the Cole bombing wanted to determine whether the Khallad identified by the Yemenis was the same Khallad who had been previously described by the source. At the same time, a CIA internal cable to was sent to several CIA offices suggesting that the photographs of the Cole suspects that the FBI had obtained from the Yemenis, including the Khallad photograph, be shown to the source. Because the FBI did not have the technological capability to easily transmit the Khallad photograph from Yemen to the ALAT who was handling the source and who we call Max, the photograph was forwarded through CIA channels to the nearby CIA office in order to show the photograph to the source.204 CIA documents show that on December 16, 2000, the CIA officer conducted a debriefing of the source. Max was present for the debriefing. 205 During the debriefing, the CIA case officer showed the source many photos of Cole bombing suspects and other suspected Arab terrorists, including the Yemeni-provided photograph of Khallad. The source immediately identified the individual in the Yemeni-provided photograph as the same Khallad he had previously described as a trusted senior Bin Laden operative with potential connections to the East African embassy bombings. The CIA officer prepared a cable documenting the debriefing, which was addressed to several CIA offices. The CIA officer wrote in the cable that the source was shown the many photographs and “quickly” identified Khallad in 204 Max told the OIG that at the time he and the CIA case officer believed that this photograph had come from the FBI’s New York Field Office. Max added that it was not uncommon for him not to know the source of photographs that were shown to the source and that the source was shown hundreds of photographs. 205 Although FBI agents from New York had traveled overseas several times in 2000 to interview the source, in December 2000 the agents with the appropriate language abilities were tied up in Yemen after the Cole attack and were unable to travel to debrief the source. Therefore, the FBI relied on the CIA to conduct this debriefing. 269 the Yemeni-provided photograph. Notably, the CIA cable stated that the CIA officer had the source repeat the identification specifically for the benefit of Max. In addition, the cable stated that before the debriefing ended, the CIA officer again showed the photographs to the source and asked the source to verify the Khallad identification. Max acknowledged to the OIG that he was contemporaneously aware of the identification of Khallad in the Yemeni-provided photograph by the source on December 16. Max stated that he recalled specific circumstances of the debriefing and recounted them to us. Max told us that he recalled the source immediately identifying Khallad in the photograph. d. CIA suspects that Khallad may be Mihdhar in Kuala Lumpur surveillance photographs Around this same time, CIA personnel were beginning to connect Khallad with Mihdhar and the January 2000 Malaysia meetings. In a December 2000 cable, CIA personnel overseas asked for copies of the January 2000 Kuala Lumpur surveillance photographs of Mihdhar. The cable noted that further connections had been made between Mihdhar and Al Qaeda. As a result of these further connections, the CIA believed there might be a connection between Mihdhar and the Cole perpetrators. The CIA office reported in the December 2000 cable that the it had learned that Fahd al Quso, who was in Yemeni custody for his participation in the Cole attack, had received $7,000 from someone named Ibrahim, which Quso had taken to Bangkok, Thailand, on January 6, 2000, to deliver to “Khallad,” a friend of Ibrahim’s. It was noted in the cable that because Mihdhar had departed Kuala Lumpur around that same time to travel to Bangkok, the CIA suspected that the “Khallad” mentioned by Quso could actually be Khalid al Mihdhar or one of his associates.206 It was noted further that this information had “added significance” because Khallad had been 206 As previously discussed, the CIA had reported previously in an internal March 2000 cable that Mihdhar, Hazmi, and another individual had left Malaysia on January 8, 2000, and traveled together to Bangkok. 270 identified as a “key operative likely serving as an intermediary between Usama Bin Laden and the [Cole] perpetrators.” In another December 2000, cable the CTC concurred with the overseas CIA office’s theory and forwarded a Kuala Lumpur surveillance photo of Mihdhar to the CIA case officer to show to the source. According to the cable, the purpose was “to confirm/rule out this particular Khalid [Mihdhar] as a match for [Khallad].”207 The next day, the CIA officer received permission to show the Kuala Lumpur surveillance photographs to the source. Max told the OIG, however, that he was not aware of the CIA cables or the theory that Khallad was actually Mihdhar. We found no other evidence that Max knew about the information that Mihdhar was at the Malaysia meetings, or the CIA’s theory that Khallad was actually Mihdhar.208 e. Source identifies Khallad from Kuala Lumpur photograph The CIA case officer debriefed the source again in early January 2001. At some point, the CIA case officer showed the source photographs, including two of the surveillance photographs taken during the January 2000 Malaysia meetings. One of the photographs from the Malaysia meetings, which we call 207 The CIA cable referred to its forwarding of only one Kuala Lumpur surveillance photograph, although subsequent cables showed that the receiving office received two Kuala Lumpur photographs to show the source. It is unclear why the sending office sent only two of the photographs instead of all three of the Kuala Lumpur photographs it had. 208 In fact, CIA cables suggest this information was not shared with the FBI. We saw several CIA cables during this time that discussed working with the FBI in relation to the FBI’s investigation of the Cole attack. For example, we saw a December 2000 cable stating that the FBI had provided an update on its investigation of the location associated with telephone numbers the CIA had provided to the FBI in connection with an investigation, and the office that drafted the cable asked to be advised of whether the two offices to whom the cable was addressed were aware of additional information that could assist the FBI. However, we saw another December 2000 cable, which discusses Khallad and other information not related to Khallad, which specifically instructed two CIA offices to share with the FBI the other information in the cable that was not related to Khallad, but it did not instruct the offices to share the information regarding the possible connection of the Malaysia meetings and Khallad. 271 “Photo No. 1” included an unknown subject. The source identified one of the individuals in this photograph as Khallad. According to a January 2001, cable written by the CIA case officer, the source was asked if he was sure, and he replied that he was “ninety percent” certain.209 The second photograph from the Malaysia meetings, which we call “Photo No. 2,” contained a picture of the person the CIA knew to be Mihdhar. The source could not identify the person in the photograph.210 However, the source’s identification of Khallad in the first photograph was significant. First, the source previously provided information that Khallad was a Bin Laden operative who was connected to the Cole attack and the East African embassy bombings. Second, as a result of the identification, it was suspected that Khallad was at the Malaysia meetings along with other suspected al Qaeda operatives. From other information, it also was known that Mihdhar was at the meetings, and it was suspected that Hazmi was there also. Thus, the source’s identification of Khallad at the Malaysia meetings raised the question whether Mihdhar and Hazmi also were linked to the Cole attack. We tried to determine if the FBI’s ALAT learned of the source’s identification of Khallad in the photograph. Max told the OIG that he did not specifically recall the early January 2001 debriefing of the source. He stated he also did not recall being aware of any early January 2001 identification of Khallad from the Kuala Lumpur surveillance photographs. In addition, Max asserted he was not aware of the Malaysia meetings and the photographs until he was questioned about them by the JICI staff on June 27, 2002. The CIA case officer told the OIG that he had no independent recollection of any particular meeting with the source, including the meeting in early January 2001. 209 As noted above, information developed after September 11, 2001, revealed this was a misidentification, and the person identified as Khallad was actually Hazmi. 210 This failure to identify Khallad in the photograph known to be of Mihdhar should have ended the theory that Mihdhar and Khallad were the same person. 272 f. Documentation regarding the source’s identification of Khallad in the early January 2001 debriefing (1) CIA cables To examine whether the FBI learned of the source’s identification of Khallad in the Kuala Lumpur photographs, we reviewed the CIA documentation concerning the meeting with the source in early January 2001. In an internal cable written the day after the debriefing, the CIA case officer reported that the source had identified Khallad in one of the Kuala Lumpur photographs with a “ninety percent” certainty. However, unlike in the December 2000 CIA cable, which stated that the CIA officer had the source repeat the identification of Khallad in the Yemeni-provided photograph to Max, the January 2001 cable did not suggest the identification was repeated for Max or was brought to the attention of Max. The January 2001 cable did not provide any other details about the debriefing, such as where the meeting took place, when exactly during the debriefing the photographs were shown to the source, who was present when the photographs were shown to the source, or what other topics were discussed with the source. We also reviewed a detailed January 2001 CIA TD to the Intelligence Community regarding the early January 2001 debriefing. The TD reported specifics about what the source discussed and that he had provided a stack of documents to his CIA and FBI handlers. The TD made no mention of any photographs being shown to the source or any identification of Khallad.211 A few days later, the CIA case officer wrote another cable describing the logistics of the early January 2001 meeting with the source. In addition, the cable summarized what was discussed during the meeting. This cable also did not mention the photographs being shown to or discussed with the source, but the CIA case officer told the OIG that these kinds of cables were not always comprehensive with respect to the information obtained from the source. 211 Although no witness can recall the details of this particular debriefing, it is possible that Max, who lacked the appropriate language skills for a debriefing, either photocopied or hand wrote the information from the documents thus explaining his absence at the time that the photographs were shown to the source. 273 (2) FBI documents We also reviewed FBI documents from this period relating to the source. On January 9, 2001, a New York FBI agent who was the FBI’s lead case agent on the Cole investigation sent Max an e-mail stating that he and his co-case agent wanted to meet with the source to talk about some of the Cole suspects, including Khallad. The New York agent wrote that he was “specially [sic] interested in all [the source] knows about Khallad and his associates.” The agent noted that the source previously had given the agents important information regarding Khallad and the Cole attack. In a January 10 e-mail response, Max referred to the December 16 meeting with the source in which the source had been shown many photographs and had immediately identified the Yemeni-provided photograph as Khallad. Max also mentioned the early January 2001 meeting, summarizing specific information provided by the source in the debriefing. Max wrote that, due to the lack of technological capabilities in the Legat Office, he promised to make the CIA TD numbers relating to the source available to the case agent within a few days so the agent could read them before his trip to interview the source. However, Max made no mention of any identification of photographs by the source in the early January 2001 debriefing. Around the same time as this e-mail exchange, Max was criticized by the head of the FBI’s UBL Unit at Headquarters for insufficient reporting regarding the source’s information. The UBL Unit chief wanted to know from Max what information the source was providing. She also was concerned because Max was not producing any reports regarding the source. In response, on January 16, 2001, Max wrote a 34-page EC summarizing the source’s debriefings and other information obtained from the source since mid-2000, most of which was based on the information that had been disseminated in the TDs by the CIA. Max explained in the EC that he merely was repeating what the CIA had previously reported in TDs, which had already been forwarded to FBI Headquarters. He noted the agreement with the CIA that there would not be duplicative reporting on the source’s information. He explained the CIA was doing the primary reporting on the source debriefings Max noted that the interview was conducted in the foreign language, and he would read the CIA’s report of the interview (the TD) once it was completed. 274 Max then listed all of the CIA’s TDs that summarized what the source had said. On page 29 of this January 16 EC, Max summarized the CIA’s reporting of what had occurred at the December 16, 2000, meeting with the source. The EC stated the source was handed a stack of many photographs and immediately identified the top photograph as a photograph of Khallad, the person the source had previously implicated in the attack on the Cole. The EC stated, “At that time it was the clear impression of [the Legat] and [the CIA officer] that both FBIHQ CTD and NYO were receiving all of the reporting above from CIA liaison in the U.S., as soon as it was being filed.” In the next paragraph of the EC, Max summarized what the CIA had reported in the TD about the early January 2001 debriefing of the source. This summary is contained on pages 29 through 33 of the EC. Max reported at length about the source’s information, and the EC provided a lengthy description of the documents provided by the source. Again, there was no mention of any photographs from the Malaysia meetings or the identification of Khallad. Max discussed with the CIA case officer the complaint from FBI Headquarters about Max’s reporting on the source. As a result, the CIA case officer provided Max with a report of the next debriefing of the source in late January 2001. The day after this debriefing, Max prepared a lengthy EC summarizing this debriefing. He noted in the EC that the report was based on the CIA’s report of an interview conducted by a CIA officer and, although Max was present for the debriefing, he only became aware of what was said after the CIA officer provided the report.212 212 Around the same time, the CIA officer sent a cable to CIA Headquarters that described the FBI’s need for reporting directly through FBI channels, as opposed to CIA channels. The CIA office then asked permission to provide electronic copies of TDs to Max so that Max could send the same reporting through FBI channels. 275 g. New York FBI agents’ interview of source on February 1, 2001 Around the same time, Max was preparing for the arrival of the Cole case agent from the FBI’s New York Field Office. The Cole case agent was traveling to interview the source about Khallad, along with another FBI agent who spoke one of the languages of the source and was going to assist in the preparation of the FD-302 for the criminal investigation. Max had received a January 17 e-mail from one of the Cole agents stating that the information being provided by the source was very important to the FBI’s criminal investigation of the Cole attack and discussing the arrangements for the upcoming interview of the source by the Cole agents. The New York Cole agents also asked Max to prepare an FD-302 documenting Max’s personal knowledge of the source’s identification of Khallad from the Yemeni-provided photograph on December 16. On January 24, 2001, Max sent an EC to the New York Field Office and FBI Headquarters with an attached FD-302 regarding the source’s December 16, 2000, identification of Khallad. On February 1, 2001, the New York Cole case agent and another agent who spoke one of the source’s languages interviewed the source overseas.213 The CIA case officer who had shown the Kuala Lumpur photographs to the source in early January was also present at the interview. During the interview, they showed the source the Yemeni-provided photograph of Khallad, which previously had been shown to the source by the CIA officer on December 16, 2000. The source again identified Khallad in the photograph. As discussed above, the agents had received information indicating that Quso, who was in custody for his participation in the Cole attack, had traveled to Bangkok and met Khallad in January 2000. The New York agents were investigating the circumstances of that trip. The agents knew that Quso previously had claimed that he had intended to meet Khallad in Malaysia. The 213 In anticipation of the Cole agents’ interview of the source, the CIA case officer had sent a cable asking the Bin Laden Unit to touch base with FBI Headquarters regarding the case status and the planned trip of the New York FBI agents. The CIA case officer noted that the source was “currently of very high interest to our [FBI] colleagues.” 276 agents were concerned about Quso’s veracity and whether Quso, as well as Khallad, had actually traveled to Malaysia. Therefore, an identification of Khallad in Malaysia during this period would have been very significant to the agents. Both FBI agents who participated in the February 1 debriefing of the source told the OIG that they were not informed about surveillance photographs of the Malaysia meetings, that they did not know such photographs existed, and that they did not show any such Kuala Lumpur photographs to the source. They stated that they were not told that the source had identified Khallad from a Kuala Lumpur surveillance photograph in early January. They added that if they had been aware of any such identification of Khallad, they would have wanted to have the source repeat the identification for them since Khallad was a subject in the Cole criminal investigation.214 However, they stated that they were never informed of such an identification. 3. OIG conclusions regarding whether the FBI was aware of the source’s identification of Khallad in the Kuala Lumpur photograph We concluded that the evidence shows that the FBI was not made aware that during the early January 2001 debriefing the source identified Khallad in the photographs of the Malaysia meetings. Max insisted in his interviews with us that he was unaware of this identification of Khallad and that he was not even aware of the existence of the Kuala Lumpur surveillance photographs until after the September 11 attacks. Neither Max nor the CIA case officer specifically recalled the early January debriefing, but the documentary evidence supports this conclusion. In numerous CIA and FBI documents discussing the source and the early January debriefing, other important information from the source is described, but the source’s identification of Khallad in the Kuala Lumpur photograph is never mentioned. Given the importance of that identification and the other details reported in the 214 The CIA’s Review Group has also asserted that the FBI may have received the Kuala Lumpur photographs from another source. The CIA did not refer to any witnesses for this claim but instead referred to a series of CIA cables and FBI documents. Our review of the cables and other documentary evidence did not support this claim. 277 documents, we believe such information would have been included had the FBI been made aware of the identification. For example, as described above, in the CIA case officer’s cable reporting the December 16 debriefing of the source during which the source had identified Khallad in the Yemeni photograph, the CIA officer specifically noted that ALAT heard the identification and that the identification was repeated for the benefit of him. Max said he recalled this debriefing and the identification of Khallad being brought to his attention by the CIA case officer. By contrast, in his cable reporting the early January source debriefing, the CIA case officer did not state that he brought to the attention of Max the identification of Khallad in the Kuala Lumpur photographs. Likewise in his cable describing the logistics of the debriefing, the CIA case officer provided a description of what was discussed with the source and stated that Max was present for a significant portion of the meeting with the source, but did not mention any Kuala Lumpur photographs or that the CIA case officer had brought the identification of Khallad to the attention of Max. The documents prepared at the time by Max about the early January debriefing also suggest that Max was not aware of the identification of Khallad in the Kuala Lumpur photographs. For example, in response to the Cole case agent’s January 9 e-mail specifically requesting “all [the source] knows about Khallad,” Max did not include any information about the Khallad identification from the Kuala Lumpur photographs. This was shortly after the early January debriefing, and the case agent had specifically indicated his interest in any information about Khallad. Max’s January 16 EC to FBI Headquarters in which he described at length what the source had reported in the early January meeting also did not mention the identification of Khallad or that any Kuala Lumpur photographs were shown to the source. In addition, Max prepared an FD-302 to document the source’s identification of Khallad from the Yemeni photograph to provide documentation for the criminal investigation. We believe that if Max had known of the source’s identification of Khallad in the Kuala Lumpur photos, he likely would have prepared a similar FD-302 of that identification as well. We also found that the New York Field Office agents who interviewed the source overseas in February 2001 were not made aware of the early January identification of Khallad. The agents insisted that they were completely 278 unaware that any Kuala Lumpur surveillance photographs had been shown to the source or that the source had identified Khallad in any photographs other than the Yemeni-provided photograph. In addition, we found no documentary evidence that the New York FBI agents were even aware of the Malaysia meetings or the resulting surveillance photographs at the time they interviewed the source. Because the agents were keenly interested in Khallad and had asked the source to confirm his identification of Khallad from the Yemeni photograph, we believe the agents would have noted, remembered, and acted upon any information regarding another Khallad identification. We also believe that had the FBI known about the identification of Khallad in the Kuala Lumpur photographs, they would likely have sought information about the other participants in the meeting, including Mihdhar and Hazmi, which could have increased the FBI’s chances of locating them before the September 11 attacks. Due to the OIG’s lack of complete access to CIA employees and documents, we were unable to fully examine why the CIA did not inform Max or the New York agents that the source had identified Khallad in the Kuala Lumpur photographs at the early January debriefing. We believe the FBI should have been made aware that the joint FBI/CIA source had provided such significant information about the person purported to be the mastermind behind the Cole attack. This failure demonstrated significant problems in communication between the FBI and the CIA. However, the FBI employees’ inaccurate belief that CIA reporting in TDs was comprehensive contributed to the FBI’s failure to obtain this critical piece of information. We discuss this and other systemic problems that this case revealed in the analysis section of this chapter. D. FBI and CIA discussions about the Cole investigation in May and June 2001 The fourth opportunity for the FBI to have acquired intelligence information about Hazmi and Mihdhar – including Mihdhar’s possession of a U.S. visa, Hazmi’s travel to the United States, and the source’s identification of Khallad from the Kuala Lumpur photographs – occurred in May and June 2001 when the CIA and FBI Headquarters discussed the status of their information concerning the Cole attack. Once again, these discussions could have caused the FBI and the CIA to focus on the other persons attending the Malaysia 279 meetings with Khallad, and thereby led the FBI to search for Mihdhar and Hazmi earlier than it did. But, as we describe below, the FBI did not obtain the critical information about the identification of Khallad at the Malaysia meetings, despite several interactions in May and June 2001 between the FBI and the CIA about Khallad. 1. Background a. The Cole investigation As discussed above, the FBI’s investigation on the Cole attack was led by the FBI’s New York Field Office.215 One of the case agents investigating the Cole attack was an agent who we call “Scott,” and who was assigned to the New York FBI’s counterterrorism squad that handled only al Qaeda investigations (the “Bin Laden squad”).216 After serving eight years in the U.S. Navy as a fighter pilot, in April 1996 Scott became a special agent in the FBI’s New York Office. In July 1996 he was assigned to the TWA Flight 800 investigation because of his experience as a military pilot. Shortly after the East African embassy bombings in August 1998, he was transferred to the New York’s Bin Laden squad to assist with the embassy bombings investigation, and then was assigned as one of the case agents on the investigation the Cole attack. The New York FBI was assisted on the Cole investigation by several Intelligence Operations Specialists (IOS) assigned to the UBL Unit and the Radical Fundamentalist Unit (RFU) at FBI Headquarters. One of the primary IOSs who worked on the Cole investigation was an IOS who we call “Donna.” She had joined the FBI in 1988 as a clerk while she completed her college education. After graduating from college in 1995, she entered the FBI’s language training program and became a Russian language 215 Through their work on the 1993 attack on the World Trade Center and the subsequent discovery of the terrorist plot to attack New York landmarks, the New York FBI became the primary office for the investigation of al Qaeda, eventually leading to the indictment of Bin Laden in the Southern District of New York in November 1998. 216 The other primary case agent on the Cole investigation was out of the country during the events discussed in this section of the report. 280 specialist working on foreign counterintelligence matters. In November 1997, she became an Intelligence Research Specialist (IRS), and a year later was assigned to assist the RFU on the East African embassy bombings investigation. In 2000 she was permanently assigned as an IOS in the UBL Unit and was assigned to work on the Cole investigation in October 2000. With regard to Donna’s work on the Cole investigation, she stated that she and the other UBL Unit IOSs conducted the investigation as directed by the New York Field Office, sent out requests for information to other law enforcement and intelligence agencies, obtained budget enhancements to support the investigation, and performed other duties in support of the investigation. She and the other UBL IOSs often traveled to New York where they met with the Cole agents and worked on the investigation. b. The wall and the caveat on NSA information The information relevant to this section of the report includes NSA information disseminated about Mihdhar in late 1999 and early 2000. As noted in Chapter Two, by the summer of 2001 NSA counterterrorism intelligence information could not be disseminated within the FBI without adhering to certain procedures and protocols. At this time, the FBI was required by the Department and the FISA Court to keep criminal investigations separate from intelligence investigations, a policy which was commonly referred to as “the wall.” Information obtained from FISA intercepts and search warrants had to be screened by someone not involved in the criminal investigation and then “passed over the wall” from the intelligence investigation to the criminal investigation. The FISA Court became the screening mechanism for FISA information obtained from al Qaeda intelligence investigations that the FBI wanted to pass to criminal investigators. As described in Chapter Two, in response to notification that there had been many errors in FISA applications approved by the FISA Court, the Court imposed additional restrictions before information could be shared. First, based on the FISA Court’s concerns about the errors in the FISA applications, the FBI directed that only intelligence agents were permitted to review FISA intercepts and materials seized pursuant to a FISA warrant (called “FISAobtained material”) or any CIA and NSA intelligence provided to the FBI based on information obtained through FISA search or intercept (called “FISAderived” material) without further Court approval. The Court required anyone 281 who reviewed the FISA-obtained or FISA-derived intelligence to sign a certification acknowledging that the Court’s approval was required for dissemination to criminal investigators. Because FISA-obtained information often was passed from the FBI to the NSA and the CIA, the question was raised to the FISA Court whether the FBI was required to obtain certifications from all NSA or CIA employees who reviewed the FISA-obtained material. The Court exempted the NSA and CIA from the certification but required that the two agencies note on any intelligence shared with the FBI if it was FISA-derived. This was referred to as “a caveat.” When made aware of this requirement, the NSA reported to the Department of Justice that for the NSA to determine in real-time which counterterrorism intelligence that it had acquired was FISA-derived would delay dissemination of the information. As a result, the NSA decided to indicate on all its counterterrorism intelligence provided to the FBI as being FISA-derived so that it could not be disseminated to criminal agents or prosecutors without approval from the NSA.217 Therefore, when the FBI wanted to pass this NSA intelligence to criminal investigators, it had to contact the NSA General Counsel’s Office to determine whether the information was in fact FISA-derived before it could be passed.218 2. Discussions in May 2001 In May 2001, the potential connection of Khallad to the Malaysia meetings was again discussed by CIA personnel. FBI personnel also discussed Khallad in reference to his nexus to the Cole attack. There were also 217 According to the NSA, its average response time to FBI requests for approval to pass information to criminal investigators was one to five business days. 218 The NSA information concerning Hazmi and Mihdhar was from late 1999 and early 2000, and contained the initial caveat stating that information could not be disseminated to law enforcement officials without approval from OIPR. By the time FBI Headquarters was dealing with this information in the summer of 2001, the new caveat was being placed on NSA reporting, and FBI Headquarters was operating under the understanding that the NSA General Counsel had to approve dissemination of NSA counterterrorism information to criminal investigators. 282 discussions between the CIA and FBI in reference to the Kuala Lumpur photographs. But, as described below, the identification of Khallad in the Kuala Lumpur photographs and Khallad’s connection to other suspects, such as Hazmi and Mihdhar, were not addressed during these May discussions between the FBI and the CIA. a. John’s inquiries about Khallad Between the early January 2001 debriefing of the source and May 2001, the CIA’s focus on whether Khallad, the suspected mastermind behind the Cole attack, had attended the Malaysia meetings appears to have subsided. In May 2001, John, a former Deputy Chief of the Bin Laden Unit, who by that time was detailed to ITOS in FBI Headquarters, had continuing concerns about the Malaysia meetings, especially whether they had any nexus to the Cole attack.219 John also noted to the OIG that during this period there were heightened concerns in the Intelligence Community about the threat of an imminent terrorist attack in Southeast Asia. CIA records show that on May 15, 2001, John accessed the March 2000 cable stating that Mihdhar, Hazmi, and another person had traveled to Bangkok from Malaysia on January 8, 2000. The cable also stated that Hazmi had left Bangkok on January 15, 2000, flying from Bangkok to Hong Kong and then to Los Angeles. Around this same time in May, John began inquiring about the Malaysia meetings with a CTC analyst, who we call “Peter,” at CIA Headquarters. John said he knew that Peter had been “down in the weeds” and knew the “nuts and bolts” of the Cole investigation because Peter had been assigned to prepare a CTC report on who was responsible for the Cole attack. Peter told the OIG that his area of expertise and focus since August 1999 was the Arabian Peninsula. He said that because the Cole attack took place in Yemen, he was assigned to develop an intelligence report on who was 219 John told the OIG that in this detail to the FBI he acted as the CIA’s chief intelligence representative to ITOS Section Chief Michael Rolince. John stated that he did not have line authority over anyone at the FBI and that his primary role was to assist the FBI in exploiting information for intelligence purposes. 283 responsible for the Cole attack. He completed his report in January 2001, finding that UBL/al Qaeda was circumstantially tied to the attack.220 Peter stated that while working on the Cole report he regularly interacted with the IOSs in the FBI’s UBL Unit. By the spring 2001, he was no longer working directly on the Cole attack, and had moved on to potential threats in Saudi Arabia and Yemen. However, Peter said he had a continued interest in the Cole information and continued to gather information on an ad hoc basis. According to John, he and Peter discussed the Malaysia meetings, and Peter provided him with a copy of the timeline of events related to the Cole investigation that Peter had compiled as part of his work on the Cole attack.221 In addition, John said they discussed Quso, a Cole perpetrator in Yemeni custody, and any connections Quso may have had with the individuals in Malaysia. John and Peter were aware that Quso had stated that he was supposed to take money to a person named “Khallad” in Malaysia but had met him in Bangkok instead in January 2000. John told the OIG that Peter had posited that perhaps Quso had gone to Malaysia and met with the others who had been observed there in January 2000, and therefore Quso might have been in one of the Kuala Lumpur photographs. In an e-mail to Peter in mid-May 2001, John noted that Mihdhar had arranged his travel to Malaysia and was associated with “[another terrorist organization] courier travel at the same time.” John also noted in the e-mail that Quso, who was believed to be a courier since he had stated he had traveled to take money to Khallad, had traveled a few days earlier than Mihdhar.222 In addition, John wrote that he was interested because Mihdhar was traveling with two “companions” who had left Malaysia and gone to Bangkok, Los Angeles, and Hong Kong and “also were couriers of a sort.” John noted in the e-mail 220 The report did not mention Mihdhar’s visa, Hazmi’s travel to the United States or the Khallad identification from the Kuala Lumpur photographs. 221 The timeline did not mention the Kuala Lumpur photographs, Mihdhar’s U.S. visa, or Hazmi’s subsequent travel to the United States. 222 As previously discussed, after Quso was detained in Yemen, he acknowledged that he had received $7,000 from someone named Ibrahim, which Quso asserted he took to Bangkok, Thailand on January 6, 2000, to deliver to “Khallad,” a friend of Ibrahim’s. Mihdhar had traveled to Bangkok on January 8. 284 that “something bad was definitely up.” Peter replied in an e-mail dated May 18, “My head is spinning over this East Asia travel. Do you know if anyone in [the CIA’s Bin Laden Unit] or FBI mapped this?” b. Discussions among FBI and CIA employees Around this same time, FBI IOS Donna and other FBI IOSs working on the Cole investigation were focusing on Quso’s connection to Bangkok and his trip to deliver money to Khallad. The FBI, like the CIA, was aware that in January 2000 Quso had planned to travel to Malaysia to take money to Khallad. According to an FBI document drafted by Donna in May 2001, Quso had claimed that on January 6, 2000, he and Ibrahim Al-Nibras went to Bangkok first but were unable to travel on to Kuala Lumpur because of problems with their travel documents, and Khallad had traveled to Bangkok to meet them there instead. The FBI began researching telephone numbers that appeared to be connected to Quso’s trip and requested that several Legat Offices contact local law enforcement authorities to obtain subscriber information. Donna told the OIG that she and others were tracking the information related to the telephone numbers associated with Quso in an attempt to determine the truth of his statements. In addition, she said that she was focused on the identity and whereabouts of Khallad, since he was the purported mastermind of the Cole attack. At some point before the end of May 2001, John discussed with Donna the East Asian travel of Quso. In response to Peter’s May 18 e-mail that asked whether anyone had “mapped” the East Asia travel, John replied in an undated e-mail that “key travel still needs to be mapped” and stated “[Donna] sounds really interested in comparing notes in a small forum expert to expert so both sides can shake this thing and see what gaps are common.” In addition to reviewing the East Asia travel of several Bin Laden operatives in January 2000, John also began looking in CIA records for the Kuala Lumpur photographs. John obtained three of them. John told the OIG that he had not read the cable stating that the joint source had identified Khallad in the photographs, but he was aware that an identification of Khallad in the photographs had been made. At the end of his e-mail to Peter, John stated that he had obtained three surveillance photographs of Mihdhar in 285 Malaysia, but he did not see “Khallad” in any of the photographs, and he believed he was “missing something” or “someone saw something that wasn’t there.” John also questioned whether there was a cable somewhere that documented the identification of Khallad.223 In response to John’s e-mail, Peter wrote in an e-mail dated May 24 that he had thought one of the Kuala Lumpur photos was of Khallad. Peter added that Donna and another FBI IOS in the UBL Unit, who we call “Kathy,” were meeting with Peter on May 29 to discuss the Cole investigation. Peter suggested that he could raise the issue of the Kuala Lumpur photographs and the possible identification of Khallad with the FBI IOSs. Peter told the OIG that he had learned about the source’s identification of Khallad in the Kuala Lumpur photographs when it had occurred, but by May of 2001 it had been several months since he had worked on the Cole matter and he could not recall whether Khallad had been identified in the photographs. On May 24, Donna sent John an e-mail stating that a meeting with Peter and others was “tentatively scheduled” for May 29 for “an in depth discussion about the Cole.” We were unable to determine with certainty whether a meeting with Peter, Donna, and Kathy actually took place on May 29. None of the witnesses had notes of any such meeting, nor were there any e-mails discussing the meeting after it would have taken place. The witnesses told the OIG that they could not recall whether a meeting took place on May 29. For example, when asked whether she knew Peter, Kathy told the OIG that his name sounded familiar and that she may have met him, but she did not recall a meeting on May 29, 2001, about the Cole investigation. A May 29 e-mail from Peter to Mary indicates that he met with Mary earlier in the day, but it does not identify the other participants or what was discussed. 223 As noted above, John was correct – Khallad was not in any of these three photographs. After September 11 it was learned that the person the source had identified as Khallad was actually Hazmi. It was also learned after September 11, however, that Khallad was in another Kuala Lumpur surveillance photograph that had not been shown to the source. 286 However, it is clear that at some point before the end of May 2001, Donna became aware of the existence of the Kuala Lumpur photographs in January 2000. Donna told the OIG that she recalled John printing one of the CIA photographs on the printer in his office at FBI Headquarters, and Donna acknowledged that she obtained two other Kuala Lumpur photographs from him. According to Donna, Peter had raised the photographs in a discussion with her prior to her obtaining the photographs from John, although she said that she did not recall the details of their discussion about the photographs. Donna said she did recall that, at the time, Peter had posited that one of the photographs could relate to Quso, which if true would contradict Quso’s statements about going only to Bangkok and not going to Malaysia. According to Donna, the FBI was attempting to determine the veracity of Quso’s information, so the photographs potentially were connected to the Cole investigation. She stated, however, that outside of this potential connection, the photographs were “another piece of a thousand things coming in” at the time. She said that if Quso were determined to be in the photographs, then the photographs would have become significant to the Cole investigation. Donna also told the OIG that she did not recall a “substantive conversation” with John about the photographs or the Malaysia meetings. Donna told the OIG that she wrote on the back of the photographs what John told her about the photographs, which included that “Khalid Al-Midar” traveled from Sana, Yemen, via Dubai, to Kuala Lumpur on January 5, 2000, and he was in Kuala Lumpur between January 6 and 8. She also wrote Khalid Mihdhar’s name on the back of the photograph in which he had been identified. According to Donna, neither John nor Peter discussed with her the fact that Khallad had been identified in these photographs. Donna told the OIG that she believes she would have noted being told that Khallad was in the photographs because she was interested in identifying Khallad and because it would have meant that the photographs had a definite connection to the Cole investigation. Donna also said that no one told her that Mihdhar had a U.S. visa or that Hazmi had traveled to the United States. John told the OIG that he did not recall anything about his discussion with Donna when he printed the Kuala Lumpur photographs for her. John said he recalled that at the time the FBI was trying to “nail down Quso’s story.” He said that he did not recall ever discussing the Khallad identification from the Kuala Lumpur photographs with Donna or anyone else at the FBI. 287 John emphasized that the FBI was focused on the Cole investigation, not the Malaysia meetings. He stated that while he had begun to theorize that Khallad had been in Malaysia, it was only “speculative” and he had not confirmed any of the information about a source identifying Khallad in the Kuala Lumpur photographs. Therefore, according to John, he would not have discussed the identification of Khallad with Donna. John emphasized that a significant impetus for the CIA’s interest in Khallad’s activities revolved around concerns that Khallad was planning a future terrorist operation in Malaysia. Peter told the OIG that he recalled talking to FBI IOSs, including Donna, about mapping the telephone number information based on information provided by Quso. But he said that he did not recall discussions with Donna about the Kuala Lumpur photographs or the Khallad identification. 3. June 11, 2001, meeting a. Planning for the meeting Around the same time that Donna was discussing Quso and the Cole investigation with Peter and John, she also was planning a meeting at the New York FBI Office to discuss the Cole investigation. The planned participants for the New York meeting included personnel from FBI Headquarters, the CIA’s CTC, and the New York FBI agents working on the Cole investigation. FBI documents show that Donna began organizing the meeting as early as May 24. There was no record of an agenda for the meeting, and no supervisors were involved in the preparation for this meeting or were consulted regarding what should be accomplished at the meeting. Donna told the OIG that she organized the meeting in an effort to consolidate information and determine what further action was warranted on the Cole investigation. She stated that the purpose of the meeting at the New York FBI Office was to address unresolved issues and produce additional leads or other activities focusing on 288 the Cole investigation. According to a May 24 e-mail by Donna, the meeting was “to discuss our direction, particularly as it relates to Nashiri.”224 Donna stated that she planned to take the Kuala Lumpur photographs with her to New York to find out whether the New York FBI Cole agents, who had met and debriefed Quso, could identify him in the photographs. She said that if Quso was in the photographs, the FBI would have reason to question Quso’s statement that he had not gone to Malaysia but had met Khallad in Bangkok instead. Sometime after obtaining the Kuala Lumpur photographs from John, Donna queried CTLink for the name Khalid al-Midhar [sic], which John had provided to her and which she had noted on the back of one of the photographs.225 In CTLink she discovered the NSA information from late 1999 and early 2000 referencing Mihdhar’s planned travel to Malaysia and Mihdhar’s association with a suspected terrorist facility in the Middle East linked to al Qaeda activities. She also queried ACS about Mihdhar but did not obtain any additional information about him. Mary, an FBI detailee to the Bin Laden Unit who worked as a CTC desk officer, also attended the June 11 meeting, as did Peter, the CTC analyst. According to Mary, Donna invited her to the meeting and told her the meeting was intended for information sharing and as a “brainstorming session” concerning the Cole investigation. Mary told the OIG she had recently been given the assignment by CTC management of “getting up to speed” in her spare time on the Malaysia meetings and determining any potential connections between the Malaysia meetings and the Cole attack. Mary said that she had not yet begun reviewing the Malaysia meetings at the time of Donna’s invitation. 224 Abdul Rahim al-Nashiri was al Qaeda’s chief of operations in the Persian Gulf and was suspected to have been involved in the attack on the Cole. According to Donna, at the time he was believed to be the “on-scene commander” for the Cole attack, and the IOSs had been assigned the task of trying to locate him based on the intelligence reporting on him. He has since been arrested outside the United States. 225 CTLink is a database administered by the CIA and used to disseminate information within the Intelligence Community. 289 According to Peter, the meeting was also described to him as an “information sharing and brainstorming session” to determine whether any further leads should be pursued. Peter said that he heard about the meeting from Mary and contacted Donna about attending because he was interested in learning what the New York FBI agents had uncovered in their investigation of the Cole attack. According to FBI personnel in New York, Donna told them that FBI Headquarters and CIA personnel had indicated they had “information to share” regarding the Cole investigation. The FBI New York personnel anticipated the meeting would be a mutual exchange of information. Scott, one of the New York case agents on the Cole investigation, said he was told that the CIA representatives who would be attending the meeting wanted a briefing on the Cole investigation. On his own initiative, Scott arranged for David Kelley, an AUSA from the SDNY who was assigned to the Cole matter, to discuss with the CIA representatives other issues related to the Cole investigation, one of which was the impact on the prosecution if some of the targets of the Cole investigation were captured or detained outside the United States. b. The June 11 meeting On June 11, the meeting was held in a conference room at the FBI’s New York Field Office. We could not determine with certainty all the participants at the meeting. There was no list of attendees, and the witnesses could not recall exactly who was there. However, we confirmed that Donna, Mary, Peter, Scott, and another New York agent assigned to the Cole investigation who we call “Randall,” attended. AUSA Kelley attended for part of the meeting. Although it was unclear exactly how long the meeting lasted, the witnesses said it lasted between two and four hours. In interviews with the OIG, the attendees said they did not recall the specifics of what was discussed at the meeting. The only contemporaneous notes from the meeting that we were able to obtain were Donna’s. Her notes indicate that the latest developments in the Cole investigation were discussed. The second page of the notes is labeled “to do” and referenced several items. Randall said he recalled that at the beginning of the meeting, Scott gave an update of the results and status of the investigation. Mary said she recalled that the attendees “brainstormed” various issues, but she did not recall any 290 significant ideas being developed during the meeting. Peter said he recalled that the New York agents “railed” about the U.S. Ambassador to Yemen and the lack of cooperation they believed they were receiving from the Yemeni government. At some point during the meeting, AUSA Kelley discussed the feasibility of prosecution in the Cole case. Toward the end of the meeting, Donna produced the three Kuala Lumpur surveillance photographs and asked the agents if they recognized Quso in any of the photographs. Donna said she told the agents that the photographs had been taken in Malaysia around the Millennium. Donna said she provided Khalid al Mihdhar’s name to at least some of the agents present. A New York agent tentatively identified one of the pictured individuals as Quso, but he could not make a definitive identification.226 The witnesses’ accounts of what happened next differ. Scott told the OIG that after reviewing the Kuala Lumpur photographs, the FBI agents began to ask questions, such as whether there were additional photographs or information concerning the background on the photographs, including questions about Mihdhar, who was in the photographs. According to Scott, he pressed Donna and Peter for details of the Malaysia meetings. Scott told the OIG he was interested in the fact that the photographs were from Malaysia because from the Quso’s debriefings he knew that Khallad had planned to meet Quso in Malaysia, and any information linking Khallad to Malaysia was “directly related” to the Cole investigation. Scott contended that Donna “refused” to provide any further information about the photographs or the Malaysia meetings due to “the wall.” Scott told the OIG that he previously had numerous conversations about the wall with Donna, which had been an issue between them. He stated that during this June 11 meeting, he disputed that the wall was applicable to the information at hand because the photographs had not been obtained as the result of a FISA Court order, and he continued to press Donna for more information. Scott said the meeting degenerated into an argument about the wall. 226 Only a limited number of New York agents had actually met Quso. The others had only seen photographs of him. 291 In his initial OIG interview, Scott described the meeting as very contentious and combative.227 In a second OIG interview, although Scott did not characterize the meeting as having the same level of combativeness, he contended that he pressed Donna for more information but none was forthcoming. Scott stated he had heated telephone conversations and e-mail exchanges with Donna over this issue after the June 11 meeting. Donna, Mary, and Peter described the showing of the Kuala Lumpur photographs as a sidebar to the main meeting and generally inconsequential. All three asserted that neither the display of the surveillance photographs nor the meeting overall was contentious. Although Donna agreed that the FBI agents asked further questions regarding the origin of the photographs and asked for additional information regarding the Malaysia meetings, she contended that she responded simply by saying she did not know anything further. She told the OIG that these questions made sense to her when they were asked, but she did not know the answers. She stated that someone asked what kind of passport Mihdhar was traveling on, and Peter responded that it was a Saudi passport.228 According to Donna, she had not known this information prior to Peter stating it. Donna told us that this was the only information volunteered by Peter, and she believed he would have provided additional information if he knew it. Peter told the OIG that he was not asked any questions at the June 11 meeting, he had no formal role, and he did not brief anyone on anything at the June 11 meeting. Peter explained that it is not within his purview or authority as an analyst to share CIA information. He said he did not recall the meeting becoming heated or contentious. He said he did not recall any time during the 227 When we asked Scott whether an intelligence-designated agent could have been provided the information outside the presence of the criminal agents, Scott agreed that could have been done, but he did not think of it at the time and no one else suggested it. During his subsequent testimony before the Joint Intelligence Committee, however, Scott said that the wall must not have been at issue because the criminal agents could have just left the room and any information could have been related to an intelligence agent. 228 Donna’s contemporaneous notes reflect this information. It appears as the last entry on the notes, indicating that this was discussed at the end of the meeting. 292 meeting where Donna said, “I can’t answer that question” or directly refused to answer a question.229 Mary stated that she had not been “up to speed” on the case at this time, so she was not in a position to provide information at the meeting. She stated that she and Peter were not asked any questions during the meeting. She said that she did not recall any serious disagreements arising during the meeting. According to Donna, she remained in New York after the meeting, without Peter and Mary, and she continued the discussions with the New York agents regarding the photographs after the meeting. She said that these subsequent conversations became fairly “heated,” as the agents pressed her with questions such as whether there were additional photographs and any documentation about the photographs.230 Donna told the OIG she had provided to the agents all the information she had received from the CIA regarding the photographs. She told us that all she knew was that these three photographs were taken in Malaysia around the Millennium, and one of the persons in the photographs was someone named Khalid al Mihdhar. Donna stated she advised the agents of this and told them that efforts would be made to obtain the requested information. She said she was not aware that there would have been additional information to provide. She added that she recalled having the impression that the agents did not believe her when she said that she did not have the information about the photographs that the agents were requesting. As discussed earlier, however, Donna had additional NSA information about Mihdhar that she had discovered through her CTLink query. The information related to the planned travel to Malaysia of several members of an “operational cadre” and Mihdhar’s association with a suspected terrorist facility in the Middle East linked to al Qaeda activities. Donna told us that she 229 As described earlier, Peter and John had exchanged several e-mails about the Malaysia meetings and the photographs. However, it is unclear based upon the information available to us exactly what Peter knew at this point. He said he was unable to remember exactly what additional information he had on June 11, 2001. 230 We believe it likely that the agents were confusing the post-meeting discussions with the showing of the photographs at the meeting. 293 could not provide this information directly to the agents working the Cole criminal investigation due to the caveat, which prevented all NSA counterterrorism-related intelligence information from being provided to FBI criminal agents without approval from the NSA.231 Donna told us that the New York FBI primarily worked criminal terrorism investigations and the sharing of intelligence information with the criminal agents was often an issue. She said that some of the New York agents had become “overly sensitive” about a perceived lack of information sharing. Donna emphasized that any information could be shared but often a process had to be followed before certain intelligence information could be shared with agents working criminal investigations. She added that it was not her job to keep information from the agents but instead to ensure they had the tools necessary to do their job. According to Donna, the only issue regarding the Kuala Lumpur photographs would have been obtaining permission from the CIA to allow individuals outside of the FBI to see the photographs in furtherance of the Cole investigation, such as in interviews conducted in Yemen.232 Donna said at some point while she was in New York, she and the agents discussed providing the photographs to the agents working in Yemen in order to get a positive identification of Quso in the photographs and to conduct further investigation.233 She stated that she told the agents that she would attempt to obtain the requisite permission to provide the photographs to the agents working the Cole investigation in Yemen. 231 It is important to note, however, that this NSA information originally had been routed not only to FBI Headquarters but also to the New York FBI Office in late 1999 and early 2000. 232 A policy in the Intelligence Community, which is designed to protect intelligence sources and methods, is that the originator of intelligence information controls the further dissemination of the information. This policy is described as originator controlled, or “ORCON.” Dissemination of ORCON information requires permission from the originating agency to further disseminate the information outside the receiving agency. 233 Apparently unbeknownst to the involved FBI and CIA personnel, the Yemeni authorities already had been given the photographs on January 3, 2001, six months before anyone at the FBI received the photographs. 294 Although she had no explicit discussion with John regarding the use of the photographs, Donna stated she understood that the photographs were “not formally passed” to the FBI when John gave them to her, but only provided for limited use in the meeting. Therefore, Donna said she did not believe that she could leave the photographs with the New York agents until the requisite permission to show the photographs outside of the FBI had been obtained. However, John told the OIG that that since the photographs had been given to Donna, an FBI employee, they could be further distributed within the FBI. John agreed that the photographs could not be used by the FBI in any manner where they would be disclosed to a foreign government. For example, he said that without approval from the CIA, the FBI agents could not keep the photographs and show them to Quso, who was in Yemeni custody, because Yemeni officials also would see the photographs. c. Follow-up after the June 11 meeting We looked for evidence as to whether Donna or the New York agents conducted any follow-up efforts about the Kuala Lumpur photographs or obtaining permission from the NSA to pass the intelligence information to the New York agents. Donna said that she “probably” had follow-up conversations with John, Peter, and Mary about the photographs, but she did not specifically recall the conversations or obtaining additional information. Mary told the OIG that she recalled conversations with Donna about obtaining permission for the FBI to use the photographs of the Malaysia meetings in their investigation. Donna stated she was not contacted by Scott after the meeting, although she was working with another agent on the squad, who we call “Glenn,” in connection with tracking telephone toll records. Those records related to the Cole participants, the travel of Quso to Bangkok, and Quso’s potential travel to Malaysia. According to Scott, over the course of the summer, he had several more conversations with FBI Headquarters asking about any additional information on the Kuala Lumpur photographs, but he was not provided any additional information. He stated that he did not seek assistance from any supervisor in obtaining additional information. He told us that he and the rest of the New York Field Office had been fighting a battle with FBI Headquarters over 295 information sharing for months, and he was “dumbfounded” that he could not obtain the information about the Kuala Lumpur photographs. He stated that in hindsight he probably should have sought the intervention of a supervisor. Documentary evidence shows that, as a result of the June 11 meeting, Donna and the New York agents discussed the Kuala Lumpur photographs in several follow-up conversations. In an e-mail dated August 22 from Donna to Glenn, she wrote that there were additional photographs of the Malaysia meetings and that the reason that Mihdhar was of interest at the time was because of some threat information that led to the CIA looking at all persons named “Khalid.” In addition, she wrote that she had received assurances that the FBI would be able to use the Kuala Lumpur photographs outside the FBI. We discuss this e-mail in further detail in the next section. Documents also show that on August 27 Donna requested permission from the NSA to provide the intelligence information about Mihdhar to the New York Cole criminal agents. However, this request came after the FBI had discovered on August 22 that Mihdhar might be in the United States and had opened an investigation to determine whether he was in the country. We discuss the events that led to that investigation and the investigative efforts of the FBI in the next section of the report. 4. OIG conclusions on May and June discussions While there were several interactions between FBI and CIA personnel in May and June 2001 that could have resulted in the FBI learning more about the Kuala Lumpur photographs and Mihdhar, the FBI personnel did not become aware of significant intelligence information about Mihdhar and Mihdhar’s connections to Khallad. The fact that Mihdhar had possessed a United States visa was not disclosed at this time by the CIA to Donna or the FBI. The fact that Hazmi had been at the Malaysia meeting and then traveled to Los Angeles also was not disclosed by the CIA. In addition, the fact that the source had identified Khallad, the purported mastermind of the Cole bombing, from the Kuala Lumpur surveillance photographs was not disclosed during these interactions. Although Donna knew about the Kuala Lumpur surveillance photographs, we do not believe that she was informed that Mihdhar had a U.S. visa or that Khallad had been identified in the photographs. Donna’s 296 contemporaneous notes on the back of the Kuala Lumpur photographs reflect the limited information that she had obtained about the photographs and the Malaysia meetings. The notes do not mention anything about Mihdhar’s possession of a U.S. visa. In addition, Donna stated that she was aware of the significance of Khallad to the Cole investigation, but the notes on the photographs also do not mention Khallad. Moreover, John, who provided the photographs to Donna, told the OIG he did not recall discussing the Kuala Lumpur photographs with her, and he did not believe that he would have discussed with Donna that Khallad had been identified in the photographs, because at the time he was not sure that this was true and he thought the information was “speculative.” Although an e-mail message indicated that Peter was planning to discuss the Khallad identification with Donna in a meeting on May 29, we were unable to determine that this meeting actually occurred. It was impossible for us to determine exactly what happened at the June 11 meeting with respect to the Kuala Lumpur photographs because the witnesses cannot recall the specifics of the discussions and there is little documentary evidence. It is clear, however, that the information regarding Mihdhar’s U.S. visa and the fact that Khallad had been identified in the Kuala Lumpur photographs was not discussed at the June 11 meeting. Donna told the agents about the photographs and provided them limited information that she had obtained from the CIA about the photographs. Most of the questioning about the photographs took place after the meeting, when Peter and Mary had left. We believe those interactions after the meeting became very contentious, with the New York FBI wanting more information. Donna did not provide the New York agents with the NSA intelligence information about the Mihdhar’s association with a suspected terrorist facility in the Middle East linked with al Qaeda activities, which she obtained through her research. She said she did not because of the restrictions placed on sharing such NSA information. As we discuss further in the next section, Donna subsequently contacted the NSA in reference to having the NSA information passed to the agents, but this did not occur until much later, on August 27, 2001. We found little attempt by either the FBI agents or Donna after June 11 to follow up on the information about the photographs that was discussed at the meeting. There is little evidence of follow-up until some time in August 2001, 297 when, as we discuss in the next section, the FBI learned that Mihdhar had recently entered the United States, and the FBI opened an investigation to locate him. The interaction between the CIA and the FBI in May and June 2001 was another failed opportunity for the FBI to obtain the critical information about Mihdhar and Khallad. The failure of the FBI to learn about Mihdhar, his connection to Khallad, and his travel to the United States at that time demonstrated significant problems in the flow of information between the CIA and the FBI. We discuss these deficiencies in the analysis section of this chapter. E. The FBI’s efforts to locate Mihdhar in August and September 2001 The fifth and final opportunity for the FBI to locate Mihdhar and Hazmi occurred in late August 2001, when it was informed that Mihdhar and Hazmi had traveled to the United States. The FBI learned in August 2001 that Mihdhar had entered the United States in July 2001 and that Mihdhar and Hazmi had previously traveled together to the United States in January 2000. On August 29, the FBI began an investigation to locate Mihdhar, but it did not assign great urgency or priority to the investigation. The New York FBI criminal agents who wanted to participate in the investigation were specifically prohibited from doing so because of concerns about the wall and the procedures to keep criminal and intelligence investigations separate. The FBI did not locate Mihdhar before the September 11 attacks. We review the facts surrounding the FBI’s discovery of this information about Mihdhar and Hazmi and what the FBI did with this information in August. We also examine the FBI’s unsuccessful efforts to locate Mihdhar before the September 11 attacks. 1. Continuing review of the Malaysia meetings in July and August 2001 As discussed above, John, the CIA Bin Laden Unit Deputy Chief, was detailed to the FBI’s ITOS in May 2001. Shortly before assuming his duties at the FBI, John had asked CTC management to assign a CTC desk officer with “getting up to speed” on the Malaysia meetings and determining any potential 298 connections between the Malaysia meetings and the Cole attack. This assignment was given to Mary. She told the OIG that “getting up to speed” meant she would have to research and read the pertinent cable traffic as her schedule permitted. She emphasized that her priority assignment during this period was the credible threats of an imminent attack on U.S. personnel in Yemen, and she said that she worked the Malaysia meetings connections to the Cole attack whenever she had an opportunity. In early July 2001, based on recent intelligence information, the CIA had concerns about the possibility of a terrorist attack in Southeast Asia. On July 5, 2001, John sent an e-mail to managers at the CTC’s Bin Laden Unit noting “how bad things look in Malaysia.” He wrote that there was a potential connection between the recent threat information and information developed about the Malaysia meetings in January 2000. In addition, he noted that in January 2000 when Mihdhar was traveling to Malaysia, key figures in the failed attack against the U.S.S. The Sullivans and the subsequent successful attack against the U.S.S. Cole also were attempting to meet in Malaysia, and that one or more of these persons could have been in Malaysia at that time. Therefore, he recommended that the Cole and Malaysia meetings be reexamined for potential connections to the current threat information involving Malaysia. He wrote, “I know your resources are strained, but if we can prevent something in SE Asia, this would seem to be a productive place to start.” He ended the e-mail by stating that “all the indicators are of a massively bad infrastructure being readily completed with just one purpose in mind.” On July 13, John wrote another e-mail to CTC managers stating that he had discovered the CIA cable relating to the source’s identification of “Khallad” from the Kuala Lumpur surveillance photographs in early January 2001. John began the e-mail by announcing “OK. This is important.” He then described Khallad as a “major league killer who orchestrated the Cole attack and possibly the Africa bombings.” The e-mail recommended revisiting the Malaysia meetings, especially in relation to any potential information on Khallad. Significantly, John ended the e-mail asking, “can this [information] be sent via CIR to [the FBI]?” Despite John’s recommendation that this information be forwarded to the FBI in a CIR, we found no evidence indicating that the CIA provided this information to the FBI until August 30, 2001, which, as we describe below, was after the FBI learned about Mihdhar’s presence in the United States. 299 In a response e-mail dated July 13, 2001, a CTC Bin Laden Unit supervisor stated that Mary had been assigned to handle the request for additional information on the Malaysia meetings. In addition, the e-mail stated that another FBI detailee to the CTC, Dwight, who was out of the office at the time, would be assigned to assist Mary upon his return. Later in July, Mary drafted a cable to another CIA office requesting follow-up information about the Malaysia meetings. The cable included a reference to the source’s identification of Khallad in one of the Kuala Lumpur photographs and that Khallad and Mihdhar had been in Malaysia at the same time, possibly together. A week later, the CTC supervisor forwarded the cable to John for his review prior to release, and the cable was sent to the office to which it was addressed three days after that. On the same day she drafted the cable referencing the source’s identification of Khallad, Mary located one of the CIA cables referencing Mihdhar’s possession of a U.S. visa. On the same date, Mary also reviewed the CIA cable that stated this visa information had been passed to the FBI in January 2000.234 In early August, Mary and Donna continued to discuss the Kuala Lumpur photographs. In an e-mail on August 7 from Donna to Mary, Donna requested a copy of the flight manifest for Mihdhar’s January 2000 trip to Malaysia in order to determine whether Quso had traveled with Mihdhar. She also asked, “if we could get the pictures cleared to show Al-Quso.” 235 She continued, “the reasoning behind this would be that first, we do not have a concensous [sic] that the individual with Midhar [sic] is in fact Al-Quso. . . [second] to determine if Al-Quso can identify Midher by an other [sic] name.” Donna then discussed her continuing efforts to track telephone number information developed in the investigation. At the close of the e-mail, Donna wrote, “I plan to write something up, but perhaps we should schedule another sit down to compare notes on both sides. Let me know.” 234 As discussed above, we found no evidence that this information had, in fact, been provided to the FBI. 235 Apparently the desk officer was unaware that clearance had been received and that the photographs had been shared with Yemeni officials. 300 In a response e-mail on the same date, Mary wrote, “okay, all sounds good.” Mary also wrote that she thought Donna had Mihdhar’s flight manifest because John had mentioned it, but Mary indicated she would find the manifest. She wrote, “I think we will be able to clear the pictures, they are for passage to Quso, right?” Mary also asked whether the FBI would be able to meet with Quso again. Mary ended the e-mail, “I think a sit down again would be great” and mentioned the potential logistics of arranging the meeting. In another e-mail exchange on August 7, Donna thanked Mary and advised her that the FBI would again have access to Quso. Donna continued by stating that the Kuala Lumpur photographs also would be passed to a foreign government because Quso was currently in its custody. She stated that John could call if he had any questions. Donna tentatively scheduled a meeting with Mary at FBI Headquarters on August 15, 2001. However, it appears that the meeting did not take place.236 2. Discovery of Mihdhar’s entry into the United States On August 21, Mary located the CIA cables referencing Hazmi’s travel to the United States on January 15, 2000.237 Mary checked with a U.S. Customs Service representative to the CTC about Hazmi’s and Mihdhar’s travel. She discovered that Mihdhar had entered the United States on July 4, 2001, and had not departed. In addition, she confirmed that Hazmi had traveled to the United States in January 2000. Mary immediately relayed to Donna in a voicemail message on August 21 that Mary had something important to discuss with her. Donna was on annual leave on August 21. Mary told the OIG she did not have an 236 Mary told the OIG that she took a week of annual leave during August, which she thought was during that week, and she thought that the meeting therefore had not occurred. Although the e-mail references a meeting, Mary and Donna both told us that they had no recollection of any meeting on August 15 or any one prior to August 22. 237 Mary was copied on an e-mail from John to Peter in mid-May, 2001, in which John discussed the travel of Mihdhar and others who appeared to be “couriers on a sort.” In this e-mail John stated, among other things, that “Nawaf” [Hazmi] had traveled with someone from Bangkok to Los Angeles to Hong Kong. Mary stated to the OIG that she received this e-mail before she was “up to speed” on the Malaysia meetings. 301 opportunity to focus on the Malaysia meetings until August, but upon discovering on August 21 that Hazmi had traveled to the United States “it [the importance of the information] all clicks for me.” On August 22, Mary met with Donna at FBI Headquarters and informed her of Mihdhar’s July 4 entry and Hazmi’s travel to the United States in March 2000.238 Donna verified in INS indices Mihdhar’s recent entry. She also learned that both Mihdhar and Hazmi had entered the United States on January 15, 2000, and that they were allegedly destined for the Sheraton Hotel in Los Angeles, California. The INS records showed Mihdhar had departed the United States from Los Angeles on June 10, 2000, on Lufthansa Airlines. No departure record could be located for Hazmi. An INS representative advised Donna that departure information often was not captured in INS indices.239 Therefore, she incorrectly surmised Hazmi had also departed on June 10, 2000.240 Further INS indices checks confirmed Mihdhar had re-entered the U.S. on July 4, 2001, at the JFK Airport in New York, allegedly destined for the “Marriott hotel” in New York City. By the terms of his entry, Mihdhar was authorized to remain in the United States until October 3, 2001. The INS had no record indicating Mihdhar had departed the United States as of August 22, 2001. Mary and Donna met with John on August 22 in his office at FBI Headquarters to discuss their discovery that Mihdhar recently had entered the United States and there was no record of his departure. All of them said they could not recall the specifics of the conversation, but all agreed that they 238 There is some discrepancy in witness statements on whether this meeting occurred on August 22 or August 23. Although it is unclear on which date this meeting occurred, we believe the meeting occurred on August 22, 2001. 239 The problem of INS departure records not being complete or accurate is described in an August 2001 OIG report entitled “The Immigration and Naturalization Service’s Automated I-94 System.” 240 Investigation conducted after September 11 found that Hazmi had remained in the United States. 302 realized it was important to initiate an investigation to determine whether Mihdhar was still in the United States and locate him if he was. On August 22, 2001, Donna sent an e-mail to the New York FBI Special Agent who we call “Glenn.” He was one of the agents assigned to the Cole investigation. In the e-mail, Donna advised Glenn that she had obtained Mihdhar’s flight manifest. Donna also wrote, “the reason they [the intelligence community] were looking at Midhar [sic] is relatively general – basically they were looking at all individuals using the name Khalid because of some threat information.” Significantly, the e-mail also advised that the CIA had additional surveillance photographs beyond those she had taken to New York, and the source had identified one of the individuals in these additional photographs as Khallad. Donna said that she was “requesting the details on that [Khallad’s identification].” Donna also stated in her e-mail that the clearance to show the Kuala Lumpur surveillance photographs to Quso should not be a problem.241 This e-mail was the first reference we identified that the FBI had been informed of additional Kuala Lumpur surveillance photographs in the CIA’s possession. It is also the first reference in any FBI document to the identification of Khallad in the Kuala Lumpur photographs. After her meeting with Donna on August 22, 2001, Mary asked another CTC officer to draft a CIR to the State Department, INS, U.S. Customs Service, and FBI requesting the placement of Mihdhar and his travel companions, Hazmi and Salah Saeed Muhammed bin Yousaf, on U.S. watchlists.242 The CIR briefly outlined Mihdhar’s attendance at the Malaysia meetings and his subsequent travel to the U.S. in January 2000 and July 2001. On August 24, the State Department placed Mihdhar and his travel companions 241 Donna was unable to recall how she first discovered the information on the Khallad identification. We were unable to find any documents or other evidence clarifying this issue. 242 At this time, several agencies maintained separate watchlists. The State Department watchlist was the VISA/VIPER system. Within VISA/VIPER, the TIPOFF system focused on suspected terrorists. The INS maintained the LOOKOUT system, which was also available to the Customs Service through TECS. 303 on its terrorism watchlist. This is the first record of the placement of Mihdhar or Hazmi on any U.S. watchlist. On August 23, 2001, Donna contacted the State Department and requested a copy of Mihdhar’s most recent visa application from the U.S. Consulate in Jeddah, Saudi Arabia. 3. The FBI’s intelligence investigation on Mihdhar a. Steps to open the investigation On August 23, Donna contacted her supervisor, an SSA who we call “Rob,” regarding the information about Mihdhar’s travel to the United States. As discussed in Chapter Three, Rob was the acting Unit Chief of the UBLU at the time.243 After reviewing the information, Rob concurred with Donna that the appropriate course of action would be to open an intelligence investigation in New York, Mihdhar’s last known destination in the United States, to locate Mihdhar. To expedite the investigative process and provide a “heads up [alert]” to the New York Field Office that the information was coming, on August 23 Donna telephoned an agent on the Bin Laden squad in the New York Field Office who we call “Chad.” To comply with the wall, the New York Field Office had designated agents as either “criminal” or “intelligence,” and Chad was an intelligence agent. Donna discussed with Chad Mihdhar’s most recent entry into the United States and FBI Headquarters’ request for the New York office to open a full field intelligence investigation to locate Mihdhar. Donna told the OIG that she did not normally telephonically contact the field on these types of issues, but there was some urgency to her request because the FBI did not want to lose the opportunity to locate Mihdhar before he left the United States. She told us, however, that Mihdhar’s significance continued to be his potential connection to Khallad and the Cole attack – not that he was operational in the U.S. 243 He was the acting Unit Chief of the UBL from June 28, 2001, until September 10, 2001. 304 Chad told the OIG that although he routinely worked with Donna, this was the first time that Donna had relayed a need for urgency in an intelligence investigation. Chad told us, however, that he questioned both the urgency and the need for a separate intelligence investigation. Chad explained that the attempt to locate Mihdhar seemed to relate to the criminal investigation of the Cole attack, and efforts to locate an individual normally would be handled through a sub-file to the main investigation and not as a separate full field investigation. Nevertheless, he told Donna that New York would open an intelligence investigation. On August 23, Donna sent an e-mail to John concerning her telephone conversation with Chad. She advised in the e-mail that “[Chad] will open an intel[ligence] case.” In the e-mail she also discussed a connection that had been made between Mihdhar in Malaysia to another suspect in the Cole attack. She wrote, “I am still looking at intel, but I think we have more of a definitive connection to the Cole here than we thought.” She ended by stating that she was working on the EC requesting a full field investigation, but doubted that it would be completed that day. On August 27, Donna requested permission through the NSA representative to the FBI to pass to the FBI agents working on the Cole investigation the information associating Mihdhar with a suspected terrorist facility in the Middle East linked to al Qaeda activities. Donna told the OIG that she thought that the NSA information on Mihdhar could be useful to the Cole criminal investigators, even if the Mihdhar search remained an intelligence investigation. On the morning of August 28, Donna sent Chad a draft copy of an EC requesting the intelligence investigation to locate Mihdhar. In the cover email, Donna stated, “here is a draft” and that the EC had not been uploaded due to some tear line information that was not yet approved for passage.244 She concluded, “I do want to get this going as soon as possible.” The EC, entitled “Khalid M. Al-Mihdhar” with various aliases, stated in the synopsis, “Request to open an intelligence investigation.” The EC outlined Mihdhar’s travel to the United States in July 2001, his previous travel to the 244 According to the NSA, the request was approved later that same day. 305 United States with Hazmi in January 2000, the background on and his attendance at the Malaysia meetings, his association with a suspected terrorist facility in the Middle East linked to al Qaeda activities, and similarities between Mihdhar’s travel and that of Cole suspects Quso, Ibrahim Nibras, and Khallad. As to the identification of Khallad in the Kuala Lumpur photographs by the source, Donna told the OIG that she did not include this information because it had not yet been officially passed to the FBI, although she had requested the passage from a CTC Representative to the FBI.245 While Donna had relayed urgency to opening the investigation in her telephone conversation with Chad and in her cover e-mail, she designated the EC precedence as “routine,” the lowest precedence level.246 She explained this by saying this case was “no bigger” than any other intelligence case. She also told us, however, that there was a time consideration because Mihdhar could be leaving the United States at any time and that is why she had personally contacted Chad. b. The FBI opens the intelligence investigation On August 28, Chad forwarded Donna’s draft EC to his immediate supervisor, a Supervisory Special Agent who we call “Jason.” Jason became a supervisor on the JTTF in the New York Field Office in 1996. He had been on the New York JTTF since 1985. At approximately 2:00 p.m. on August 28, Jason forwarded the EC to various agents on the Bin Laden squad, including the Cole criminal case agent who we call “Scott.” In the cover e-mail, Jason directed the Relief Supervisor, who we call “Jay,” to open an intelligence investigation and assign it to a Special Agent who we call “Richard.” Jason also directed another agent to 245 This information officially was passed to the FBI in a CIR on August 30, 2001. 246 As discussed in Chapter Three, ECs are marked with a precedence level based on an escalating scale beginning at “routine;” “priority,” connoting some urgency; and “immediate,” connoting the highest level of urgency. 306 check on an investigative lead related to Mihdhar while the agent was in Malaysia.247 Scott received the EC on August 28. Scott, who had been at the June 11 meeting and had discussions with Donna about the Kuala Lumpur photographs, contacted Donna to discuss the appropriateness of opening an intelligence investigation as opposed to a criminal investigation. Donna told the OIG that when she realized that the EC had been disseminated to Scott, she asked Scott to delete it because it contained NSA information and therefore required approval for review by criminal agents. Scott told the OIG that he deleted the EC as she requested. Shortly thereafter, Scott, Donna, and Rob engaged in a conference call to discuss whether the case should be opened as a criminal instead of an intelligence investigation. Scott told the OIG that he argued that the investigation should be opened as a criminal investigation due to the nexus to the Cole investigation and the greater investigative resources that could be brought to bear in a criminal investigation. Scott explained that more agents could be assigned to a criminal investigation due to the squad designations. He also asserted that criminal investigation tools, such as grand jury subpoenas, were far quicker and easier to obtain than the tools available in an intelligence investigation, such as a national security letter. Donna told the OIG that the information on Mihdhar was received through intelligence channels and, because of restrictions on using intelligence information, could not be provided directly to the criminal agents working the Cole investigation. The only information that could be provided directly to them was the limited INS information. She stated that without the intelligence information on Mihdhar, there would have been no potential nexus to the Cole investigation and no basis for a criminal investigation. Rob told the OIG he had concurred with Donna’s assessment that the matter should be an intelligence investigation. He added that there was also a process through 247 Jason told the OIG that he did not specifically recall this e-mail. He said he was out of the office the majority of the time from June until September 11, 2001, due to a serious medical condition, and he did not return to work full-time until September 11, 2001. 307 which the information could potentially be shared with the criminal agents in the future.248 Scott was not satisfied with that response, and he asked for a legal opinion from the FBI’s National Security Law Unit (NSLU) whether the investigation should be opened as a criminal matter relating to the Cole criminal investigation. Additionally, Scott wanted a legal opinion on whether a criminal agent could accompany an intelligence agent to interview Mihdhar if he was located. According to Donna, she subsequently contacted the NSLU attorney who we call “Susan” on August 28, and she and Rob discussed the issue with Susan. It is unclear how she presented the matter to Susan because there were no documents about the conversation and she and Susan had little or no recollection of the specific conversation. Donna told the OIG that she provided the EC to Susan. According to Donna, Susan agreed with her that the matter should be opened as an intelligence investigation. Donna said Susan also advised that a criminal agent should not be present for an interview of Mihdhar if he was located. During an OIG interview, Susan said she could not specifically recall this matter or the advice she gave. Rob told the OIG that he did not recall the specifics of this consultation, but he stated that the NSLU opinion was supportive of FBI Headquarters’ determination that the case should be opened as an intelligence investigation. At approximately 7:30 a.m. on August 29, Donna sent an e-mail to Jason, which stated: I think I might have caused some unnecessary confusion. I sent the EC on Al-Midhar [sic] to [Chad] via email marking it as DRAFT so he could read it before he went on vacation. There is material in the EC…which is not cleared for criminal investigators. [Scott] called and [Rob] and I spoke with him and tried to explain why this case had to stay on the intel. side of the house…In order to be confident…for this case to be a 199, 248 Rob told the OIG that the squad’s Supervisory Special Agent acted as “the wall” between intelligence and criminal investigations during this period, and Jason could subsequently open a criminal investigation if warranted. 308 and to answer some questions that [Scott] had, [Rob] and I spoke with the NSLU yesterday afternoon249…The opinion is as follows: Al-Mihdar [sic] can be opened directly as a FFI [Full Field Investigation]…The EC is still not cleared for criminal investigators…Per NSLU, if Al-Mihdar [sic] is located the interview must be conducted by an intel agent. A criminal agent CAN NOT be present at the interview. This case, in its entirety, is based on intel. If…information is developed indicating the existence of a substantial federal crime, that information will be passed over the wall according to the proper procedures and turned over for follow-up criminal investigation.250 Approximately 15 minutes after sending the e-mail to Jason, Donna sent an e-mail to Scott with the same language advising that the NSLU agreed the investigation should be an intelligence investigation and a criminal agent could not attend the interview if Mihdhar was located. That same morning, Scott responded in an e-mail to Donna stating: …where is the wall defined? Isn’t it dealing with FISA information? I think everyone is still confusing this issue…someday someone will die – and wall or not – the public will not understand why we were not more effective and throwing every resource we had at certain ‘problems.’ Let’s hope the National Security Law Unit will stand by their decisions then, especially since the biggest threat to us now, UBL, is getting the most ‘protection’. Later that morning, Donna replied in an e-mail: I don’t think you understand that we (FBIHQ) are all frustrated with this issue. I don’t know what to tell you. I don’t know how many other ways I can tell this to you. These are the rules. 249 Rob told the OIG that he could not recall whether he had talked to anyone from the NSLU about this issue. 250 Rob told the OIG that the New York Field Office technically could have ignored Headquarters’ recommendation and opened a criminal investigation. However as a practical matter, the field would not normally ignore Headquarters’ decision. 309 NSLU does not make them up and neither does UBLU. They are in the MIOG251 and ordered by the [FISA] Court and every office of the FBI is required to follow them including FBINY… 4. The New York Field Office’s investigation On August 29, 2001, the FBI’s New York Field Office opened a full field intelligence investigation to locate Mihdhar. The investigation was assigned to a Special Agent who we call “Richard.” Richard was a relatively inexperienced agent, who had recently been transferred to the Bin Laden squad.252 This was Richard’s first intelligence investigation. On August 29, Donna received Mihdhar’s visa application from the U.S. Consulate in Jeddah. The application indicated that Mihdhar planned to travel as a tourist to the United States on July 1, 2001, for a purported month long stay. On the application, Mihdhar falsely claimed that he had not previously applied for a U.S. non-immigrant visa or been in the United States.253 On August 30, 2001, Donna sent an e-mail to Richard. After a paragraph introducing herself, Donna advised she was attaching Mihdhar’s visa application form, which included Mihdhar’s photograph, and that she would be faxing the remaining documents. Donna stated she would send a couple of pages from the Attorney General Guidelines “which apply to your case” and then she would mail the documents. Richard told the OIG that on August 30, he received a telephone call from Donna in reference to the investigation. He said that Donna said the goal of the intelligence investigation was to locate and identify Mihdhar for a 251 The MIOG is the FBI operational manual - Manual of Investigative Operations and Guidelines. Donna asserted this reference actually related to the Attorney General’s FCI Guidelines that are contained in the MIOG. 252 Richard began working in the New York Field Office after graduating from the FBI Academy in June 2000. After serving briefly on an applicant squad, a drug squad, and a surveillance squad, Richard was assigned to the UBL squad in July 2001. 253 Donna said she did not notice this discrepancy. As we discuss below, neither did the New York FBI. 310 potential interview. According to Richard, Donna did not indicate the investigation was an emergency or identify any other exigent circumstance. On August 30, 2001, the CIA sent a CIR to the FBI outlining the identification of “Khallad” from one of the Kuala Lumpur surveillance photographs in January 2001 by the source. The first line of the text stated the information should be passed to Rob. The CIA cable stated the FBI should advise the CIA if the FBI did not have the Kuala Lumpur photographs so they may be provided. This is the first record documenting that the source’s identification of Khallad in the Kuala Lumpur photographs was provided by the CIA to the FBI. Richard told the OIG that he began to work on locating Mihdhar on September 4. He stated that he had received the assignment on Thursday, August 30, but he worked all weekend and Monday on another exigent investigative matter involving a Canadian hijacking. As a result, he said he did not have the opportunity to begin work on the Mihdhar investigation until Tuesday, September 4. On September 4, Richard completed a lookout request for the INS, identifying Mihdhar as a potential witness in a terrorist investigation. Due to his unfamiliarity with completing the lookout form, Richard contacted an INS Special Agent who was assigned to the FBI’s JTTF in New York. We call this Special Agent “Patrick.” The INS lookout form has a box indicating whether the individual was wanted for “security/terrorism” reasons. Richard did not check this box. He said that he thought Patrick told him to identify the subject on the form as a witness, not a potential terrorist, to prevent overzealous immigration officials from overreacting. By contrast, Patrick, who was assigned to the JTTF since September 1996, told us that he did not provide this advice to Richard and he always checked the security/terrorism box whenever he completed the lookout form for a potential witness in a terrorism investigation. However, Richard asked Patrick to review the lookout request form for completeness, and Patrick sent the form to INS Inspections for inclusion in the 311 INS lookout system, without making any changes.254 During his initial interview with the OIG, Richard asserted that he also asked Patrick to review and explain Mihdhar’s travel documents, including the INS indices printouts and the visa application. In a follow-up interview, Richard said he could not definitively recall whether he had actually provided the predicating materials to Patrick or whether he merely had Patrick review the INS lookout request form. Patrick told the OIG that he recalled this request because it was the first one from Richard and because of Mihdhar’s subsequent involvement in the September 11 attacks. Patrick stated that he had not reviewed the predicating materials, but had only checked the request form for completeness. He added that if he had been shown any of the predicating materials on Mihdhar’s travel, the review would only have been cursory. Patrick and Richard both acknowledged that they did not notice the false statements on Mihdhar’s visa application. Richard also contacted a U.S. Customs Service representative assigned to the JTTF and verified that a TECS lookout was in place for Mihdhar. Richard conducted other administrative tasks such as uploading the initial information about Mihdhar into ACS. On September 4, Richard requested a local criminal history check on Mihdhar through the New York City Police Department. Richard told the OIG that he initially focused on Mihdhar, since he was captioned as the subject of the investigation in the predicating EC. After reviewing the EC several times, Richard noted the connection to Hazmi, so he conducted the same record checks on Hazmi as he had on Mihdhar. On September 5, Richard requested an NCIC criminal history check, credit checks, and motor vehicle records be searched in reference to Mihdhar and Hazmi. On September 5, Richard and another JTTF agent contacted the loss prevention personnel for the New York area Marriott hotels, since Mihdhar had indicated when he entered the United States in July 2001 that his destination 254 Patrick explained that agents often provided just the information and he completed the lookout form, but “new” agents often completed the form themselves. Patrick estimated he received approximately 10 lookout requests each month. 312 was the Marriott hotel in New York. Richard learned that Mihdhar had not registered as a guest at six New York City Marriotts. Richard stated he also conducted Choicepoint™ searches on Hazmi and Mihdhar.255 Richard said he recalled he had another JTTF officer assist him with the searches because he was not familiar with the system. Richard did not locate any records on either Hazmi or Mihdhar in Choicepoint™.256 Richard told the OIG that it was not uncommon not to find a record because of variations in spelling of names or other identifying information. Hazmi and Mihdhar had traveled to Los Angeles, California on January 1, 2000, via United Airlines, and INS records indicated that they claimed to be destined for a “Sheraton hotel” in Los Angeles. Therefore, on September 10, 2001, Richard drafted an investigative lead for the FBI Los Angeles Field Office. He asked that office to request a search of the Sheraton hotel records concerning any stays by Mihdhar and Hazmi in early 2000. He also requested that the Los Angeles office check United Airlines and Lufthansa Airlines records for any payment or other information concerning Mihdhar and Hazmi. However, the lead was not transmitted to Los Angeles until the next day, September 11, 2001. By the morning of September 11, when the American Airlines flight 77 that Mihdhar and Hazmi hijacked and crashed into the Pentagon, Richard had not uncovered any information regarding Mihdhar’s or Hazmi’s location in the United States. 5. OIG conclusions on the intelligence investigation Although FBI and CIA personnel had many discussions throughout July and August 2001 about the Cole attacks and the Malaysia meetings, the CIA 255 Choicepoint™ is a commercial service that mines information such as names, addresses, phone numbers, and other identifying information from public sources (such as telephone directories, local taxing authorities, and court records), as well as purchase information from merchants or other companies. The information is then consolidated into a large database and is accessible to law enforcement and other subscribers for a fee. 256 After September 11, however, the FBI located records on Hazmi in this commercial database. 313 did not provide and the FBI did not become aware of the significant intelligence information about Mihdhar’s U.S. visa, the Malaysian matter, and the identification of Khallad in the Kuala Lumpur photographs until August 22, 2001. In May 2001, one detailee to the CTC was assigned to “get up to speed” on the Malaysian matter in her spare time but said she had been unable to focus on the matter until August 2001. On July 13, even after John had suggested in an e-mail to the CTC that the Khallad identification from the Kuala Lumpur photographs be passed to the FBI via CIR, this was not done for several weeks. The CIR was not sent to the FBI until August 30, after the FBI learned of Mihdhar’s presence in the United States. The CIA also did not provide to the FBI the information about Hazmi’s travel to the United States in January 2000 until August 22. Donna stated that she did not receive this information until August 22, and her actions upon receipt of the information clearly indicate that she understood the significance of this information when she received it. She took immediate steps to open an intelligence investigation when she learned of this information. On August 22, once the FBI was aware of the intelligence information about Mihdhar and that he was in the United States, the FBI took steps to open an intelligence investigation to locate him. Yet, the FBI did not pursue this as an urgent matter or assign many resources to it. It was given to a single, inexperienced agent without any particular priority. Moreover, the dispute within the FBI about whether to allow a criminal investigation to be opened again demonstrated the problems with the wall between criminal and intelligence investigations. The FBI was not close to locating Mihdhar or Hazmi when they participated in the terrorist attacks on September 11, 2001. In the analysis section of this chapter, we address in more detail the FBI’s decision to open the matter as an intelligence investigation instead of a criminal investigation, and the inadequacy of the FBI’s efforts to investigate Mihdhar in late August and early September 2001. F. Summary of the five opportunities for the FBI to learn about Mihdhar and Hazmi In summary, there were at least five opportunities for the FBI to have learned about Mihdhar and Hazmi, including their connection to the purported mastermind of the Cole attack and their presence in the United States, well before the September 11 attacks. First, in early 2000, the FBI received the 314 NSA information about Mihdhar’s planned travel to Malaysia. Although the CIA informed the FBI of the Malaysia meetings in January 2000, the existence of Mihdhar’s U.S. visa and the surveillance photographs was not disclosed to the FBI. FBI detailees at the CTC read the pertinent CIA cable traffic with this information and drafted a CIR to pass this information to the FBI. But the CIR was not released to the FBI, purportedly at the direction of a CIA supervisor, and the FBI did not learn of this critical information until August 2001. In addition, in March 2000 a CIA office discovered that Hazmi had traveled to the United States in January 2000, but no one from the CIA shared this information with the FBI. Second, in February 2000, Mihdhar and Hazmi moved to San Diego, where they were aided in finding a place to live by the former subject of an FBI preliminary inquiry. In May 2000, Hazmi and Mihdhar moved in with an FBI asset in San Diego, California. However, the FBI did not learn of this information until after the September 11 attacks. Third, in early January 2001, the CIA showed the Kuala Lumpur surveillance photographs to a joint CIA/FBI source, and the source stated that “Khallad” was in one of the photographs. This identification could have led the FBI to focus on who else was at the Malaysia meetings with Khallad, the purported mastermind of the Cole attacks, which could have led the FBI to identify and locate Mihdhar. However, we concluded that, despite the CIA’s assertions, the source’s identification of Khallad in these photographs was not known by the FBI. Fourth, in May and June 2001, due to concerns about possible terrorist activities, CIA employees were again examining the Kuala Lumpur photographs, Hazmi’s and Mihdhar’s travel (including Hazmi’s travel to Los Angeles), and the identification of Khallad in the Kuala Lumpur photographs. At the same time, these CIA employees were discussing with FBI employees the Cole investigation and the Kuala Lumpur photographs. Yet, despite these interactions between the two agencies on the telephone, in e-mails, and in a June 11 meeting in New York, the FBI never was informed of the critical intelligence information that Khallad was identified in the Kuala Lumpur photographs with Mihdhar, and that Hazmi had traveled to the United States. Again, this information could have led the FBI to initiate a search for Hazmi and Mihdhar earlier than it eventually did. 315 Fifth, in July 2001 a former Bin Laden Unit Deputy Chief who was working in ITOS in FBI Headquarters confirmed that Khallad had been identified in the Kuala Lumpur photographs and wrote in an e-mail to CTC managers that this information needed to be sent in a CIR to the FBI. However, this information was not sent in a CIR to the FBI until several weeks later. On August 22, an FBI employee detailed to the CTC notified the FBI that Mihdhar had entered the United States on July 4, 2001. The FBI began an intelligence investigation to locate Mihdhar and Hazmi. However, the FBI assigned few resources to the investigation and little urgency was given to the investigation. The FBI was not close to locating Mihdhar and Hazmi before they participated in the September 11 attacks.