A Review of the FBI's Handling:Chapter 5

❌ {{Main|A Review of the FBI's Handling]]

TWO SEPTEMBER 11 HIJACKERS: KHALID AL-MIHDHAR AND NAWAF AL-HAZMI I. Introduction In this chapter, we examine the FBI’s handling of intelligence information concerning two of the September 11 hijackers, Khalid al-Mihdhar and Nawaf al-Hazmi. Mihdhar, Hazmi, and three other terrorists hijacked and crashed American Airlines Flight 77 into the Pentagon. The FBI has asserted that it learned in late August 2001 that Mihdhar and Hazmi were al Qaeda operatives and that they had traveled to the United States in January 2000. In August 2001, the FBI also discovered that Mihdhar had entered the United States on July 4, 2001, purportedly for a month-long stay. In late August, the FBI initiated an investigation to determine whether Mihdhar was still in the country and to find him. The FBI was still searching for him at the time of the September 11 attacks. We examined the information that the Intelligence Community and the FBI had about Mihdhar and Hazmi prior to September 11. We found no evidence indicating the FBI or any other member of the Intelligence Community had specific intelligence regarding the September 11 plot. However, beginning in late 1999 and continuing through September 11, 2001, we found five junctures at which the FBI either learned of intelligence information about Mihdhar and Hazmi, could have learned of additional intelligence information about them, or could have developed additional information about their location and terrorist connections. These five junctures were: • In early January 2000, Mihdhar traveled to Kuala Lumpur, Malaysia, where he met with other al Qaeda operatives. Intelligence information developed by the CIA in early 2000 revealed that Mihdhar was a suspected al Qaeda operative, he traveled to Malaysia to meet with other al Qaeda operatives, and he had a multiple-entry U.S. visa. The CIA also discovered in March 2000 that Hazmi had traveled to Los Angeles in January 2000. 224 • In late January 2000, Mihdhar and Hazmi both traveled to Los Angeles and then moved to San Diego, where they associated with a former subject of an FBI investigation and also lived with a longtime FBI asset.156 • In late December 2000 and early January 2001, a reliable joint FBI/CIA source provided information related to the FBI’s ongoing investigation of the attack on the U.S.S. Cole. 157 The source’s information linked Hazmi and Mihdhar with the purported mastermind of the Cole attack. • In the summer of 2001, the CIA and the FBI had various interactions regarding the FBI’s investigation of the Cole attack. These interactions touched on the participants in the January 2000 Malaysia meetings and information developed by the CIA about the Malaysia meetings. • In August 2001, the FBI learned that Mihdhar had entered the United States on July 4 and began searching for him in early September 2001. It also learned that the purported mastermind of the Cole attack had met with Mihdhar and Hazmi in the Malaysia meetings. The FBI did not locate him before the September 11 attacks. Yet, despite these ongoing discussions and opportunities for the FBI to learn about and focus on Mihdhar and Hazmi, including their presence in the United States, the FBI was not made aware of and did not connect important details about them until late August 2001, a short time before they participated in the terrorist attacks. Even in August, the FBI’s search for Mihdhar and Hazmi was not given any urgency or priority, and was not close to locating them by the time of the attacks. 156 Hazmi had also traveled to and attended the January 2000 meetings in Kuala Lumpur, Malaysia. 157 As noted previously, on October 12, 2000, two terrorist operatives in an explosiveladen boat committed a suicide attack on the U.S.S. Cole naval destroyer during a brief refueling stop at the port in Aden, Yemen. Seventeen sailors were killed and 39 were wounded in the attack. 225 In this chapter, we describe each of these five opportunities in detail. We set forth the available intelligence information regarding Hazmi and Mihdhar that existed at the time, whether the information was made available to the FBI, and what additional information about Hazmi and Mihdhar the FBI could have developed. In the analysis section of this chapter, we evaluate the problems that impeded the FBI’s handling of the intelligence information about Hazmi and Mihdhar before September 11. II. Background A. OIG investigation To investigate the issues involving Hazmi and Mihdhar, the OIG asked for and reviewed all documents the FBI had regarding them before September 11. The FBI search for these documents included searches of its Automated Case Support system (ACS), Integrated Intelligence Information Application (IIIA) system,158 and CTLink.159 In addition, searches were conducted on archived FBI e-mail messages and the FBI Director’s briefing documents. These searches were initially conducted in response to a request by the Congressional Joint Intelligence Committee’s Inquiry Staff, which was conducting its own inquiry into this subject. The OIG also obtained direct access to ACS so that we could conduct our own searches for relevant documents. In addition, we reviewed hard copy case and informant files to search for documents relevant to Mihdhar and Hazmi. In addition to reviewing these documents, we conducted more than 70 interviews related to the Mihdhar and Hazmi matter. These included interviews of FBI IOSs, special agents, attorneys, and supervisors who had access to some of the relevant information or participated in meetings or 158 IIIA is a database designed to capture comprehensive amounts of information from counterintelligence, international, and domestic terrorism investigations. The system includes information ranging from biographical data on persons to profiles of terrorist groups. The FBI describes the system as “conducive to putting together information regardless of office of origin or case.” 159 CTLink is a shared database used for the dissemination of intelligence information among agencies within the Intelligence Community. 226 operations related to these hijackers. We also interviewed FBI employees detailed to the CIA and FBI agents who participated in debriefings of intelligence sources who had relevant information. Because much of the information discussed in this chapter of the report involves the FBI’s interactions with the CIA, we also obtained information directly from the CIA. The DOJ OIG does not have oversight authority over CIA operations or personnel, and we therefore did not make assessments of the performance of CIA personnel. That issue is the responsibility of the CIA OIG, which is conducting its own inquiry in response to the JICI report. We had to rely on the cooperation of the CIA in providing access to CIA witnesses and documents that were relevant to the OIG’s oversight of the FBI. We interviewed CIA staff operations officers, analysts, and supervisors, as well as CIA employees detailed to the FBI, including a CIA employee detailed to the FBI’s New York Field Office’s Joint Terrorism Task Force. (S) Initially, the CIA made available to the OIG for review various documents that the CIA’s “Director of Central Intelligence (DCI) Review Group”160 had identified as being related to our inquiry. The Review Group had gathered these and other documents during its review of the September 11 attacks and during additional searches conducted at the request of the JICI staff. We did not have independent access to CIA databases, and therefore we could not independently verify that all relevant documents had been provided to us. However, we had several lengthy sessions with members of the Review Group at which they identified the documents they used to support their conclusions regarding Hazmi and Mihdhar. The CIA permitted us to review but not have a copy of these documents. In addition, a member of the CIA General Counsel’s staff conducted additional searches for documents relevant to particular disputed issues. As a result of that review, copies of additional relevant documents were also made available for our review. 160 The CIA formed the DCI Review Group in late 2001 to assist the CIA in determining why it had not detected the September 11 plot. The group included former CIA case officers and CIA OIG personnel. 227 In response to the JICI report issued in December 2002, the CIA OIG initiated a review in February 2003 of the CIA actions related to the September 11 attacks. In July 2003 the CIA OIG review team informed us it had several more documents that were relevant to our review. These documents were made available to us to review, and redacted copies of the documents were provided to us in November 2003. The CIA OIG review team also provided additional relevant documents and information to us that it found during the course of its review. In February 2004, however, while we were reviewing a list of CIA documents that had been accessed by FBI employees assigned to the CIA, we noticed the title of a document that appeared to be relevant to this review and had not been previously disclosed to us. The CIA OIG had not previously obtained this document in connection with its review. We obtained this document, known as a Central Intelligence Report (CIR). This CIR was a draft document addressed to the FBI containing information about Mihdhar’s travel and possession of a U.S. visa. As a result of the discovery of this new document, a critical document that we later determined had not been sent to the FBI before the September 11 attacks (see Section III, A, 4 below), we had to re-interview several FBI and CIA employees and obtain additional documents from the CIA. The belated discovery of this CIA document delayed the completion of our review. B. Background on the CIA In this section of the chapter, we describe background information relevant to the interactions between the CIA and the FBI and the ways in which they exchanged intelligence. We begin with a discussion of the CIA’s authority and mission, organization, forms of communications, and ways in which the CIA passed intelligence to the FBI. We also discuss the role of the FBI’s employees who were “detailed” to work at the CIA. 1. CIA authority and mission As discussed in Chapter Two, the National Security Act of 1947 created the CIA and established it as the nation’s lead foreign intelligence agency of the United States. The CIA engages primarily in the clandestine collection of “foreign intelligence” information – information relating to the capabilities, intentions, and activities of foreign governments or organizations, including 228 information about their international terrorist activities. The CIA is charged with evaluating and disseminating the intelligence information it collects. The CIA reports directly to the President through the Director of Central Intelligence (DCI), who is the head of both the CIA and the Intelligence Community. The DCI is the primary advisor to the President and the National Security Council on national foreign intelligence matters. George Tenet was named to that position in 1997. 2. Organization of the CIA The work of the CIA is conducted primarily through three “directorates”: the Directorate of Operations, the Directorate of Intelligence, and the Directorate of Science and Technology. Each is led by a Deputy Director. Below we briefly describe the relevant structure and positions within each directorate. a. Directorate of Operations The Directorate of Operations is responsible for the clandestine collection of foreign intelligence. This takes place in field offices known as “stations.”161 Smaller cities may have “bases,” which are sub-offices of the stations. “Operations officers,” also known as “case officers,” are responsible for collecting intelligence through contacts with human sources and through the use of technology. Collection management officers, also known as “reports officers,” are responsible for taking raw intelligence reported by the operations officers and removing from it the information that reveals the source, method of collection, or other sensitive information. The reports officers publish intelligence information in a form that can be made available to the Intelligence Community. The head of a station or base is usually an operations officer and is known as a Chief of Station (COS) or Chief of Base (COB). Stations and bases 161 The CIA also has field offices within the United States that are part of the National Resources Division within the Directorate of Operations. They are responsible for the overt collection of foreign intelligence volunteered by individuals and organizations in the country. 229 are usually grouped by geographic division and report to the chief of the geographic division at CIA Headquarters. Within the geographic division at CIA Headquarters are “staff operations officers,” or “desk officers,” who provide operational research, advice, and other forms of case management support to the officers in the field. The CIA’s Counterterrorist Center (CTC), which is based in the Directorate of Operations but which draws on all CIA resources, is charged with preempting and disrupting international terrorism. The CTC is staffed by managers, analysts, operations officers, desk officers, and reports officers. The CTC collects and analyzes strategic intelligence on terrorist groups and state sponsors of terrorism to ascertain the capabilities, sources of support, and likely targets of terrorist elements, and to furnish detailed information on terrorist-related intelligence to the Intelligence Community. At the time of the events relevant to our review, the CTC operated a unit – that we call the “Bin Laden Unit” – that dealt exclusively with issues related to al Qaeda and Usama Bin Laden. The Bin Laden Unit was later merged into a larger group in the CTC. Although staffing levels fluctuated, approximately 40-50 people worked within the Bin Laden Unit before September 11, 2001. The Bin Laden Unit was known as a “virtual station” because it operated from within CIA Headquarters but collected and operated against a subject, much as stations in the field focus on a country. b. Directorate of Intelligence The Directorate of Intelligence, the analytical branch of the CIA, is responsible for the production and dissemination of timely, accurate, and objective intelligence analysis on foreign policy issues. It focuses analysis on key foreign countries, regional conflicts, and issues such as terrorism and narcotics trafficking. The Directorate of Intelligence is primarily composed of analysts who concentrate on particular areas of expertise. For example, intelligence analysts are assigned a particular geographic region to monitor the leadership, motivations, plans, and intentions of foreign governments in relation to U.S. national security interests. Additionally, counterterrorism analysts stationed in the CTC produce a range of long-term intelligence products about terrorist organizations and provide tactical analytic support to intelligence operations. 230 c. Directorate of Science and Technology The Directorate of Science and Technology is responsible for creating and applying technology in support of the intelligence collection mission. It employs a broad range of professionals, including computer programmers, engineers, scientists, and linguists. 3. The CIA’s collection and internal dissemination of information Official internal communications between entities within the CIA are normally conducted by an electronic communication known as a “cable.” Cables are addressed to the stations, offices, or units within an office from which some action is expected. Information acceptable for sharing with a foreign government service is put into a section of a cable called a “tear line.” 4. Passing of intelligence information by the CIA to the FBI The CIA shares intelligence with the rest of the Intelligence Community through a communication known as a “TD” (“Telegraphic Dissemination”). TDs can be sent to other Intelligence Community agencies, including the FBI, and are available to the Intelligence Community through the Intelink system. Another type of intelligence report used by the CIA when conducting business with other agencies is a CIR, or “Central Intelligence Report.” CIRs are used for disseminating information to a specific agency or group of agencies. CIRs to the FBI normally concern something occurring in the United States, involving a U.S. person or an ongoing FBI investigation. In addition to formal methods of communicating by the CIA to the FBI, much information can be shared with the FBI informally. CIA and FBI employees who have similar positions and expertise develop relationships and communicate informally while working together on related matters, either by secure telephones or in person. In addition, meetings are sometimes held to discuss a matter or a piece of intelligence that is of value to both agencies. According to the CIA employees we interviewed, when the CIA passed intelligence information or other kinds of information verbally or by another informal mechanism to the FBI, the information exchange normally would be documented through a TD or a CIR. However, they said that not every telephone call or conversation was documented. 231 C. FBI detailees to the CIA Counterterrorist Center In 1996, the FBI began detailing employees to work in the CIA’s CTC. During the time period relevant to this chapter of the report, five FBI employees were detailed to the CTC’s Usama Bin Laden Unit in four separate positions. Two of the positions were filled by personnel from the FBI’s Washington Field Office, and one position each was filled from the FBI’s New York Field Office and FBI Headquarters.162 1. FBI Headquarters detailees One of the FBI detailees assigned to Bin Laden Unit, who we call “Eric,” held a supervisory position as a deputy chief of the Bin Laden Unit.163 Eric, an FBI Headquarters supervisor in the Radical Fundamentalist Unit, was detailed to the CTC as a branch chief for a particular terrorist group in September 1997. In March 1999, FBI Headquarters transferred him from that part of the CTC to the deputy chief position in the Bin Laden Unit. According to Eric, he was told by FBI Assistant Director Neil Gallagher that there were a lot of problems between the FBI’s New York Field Office and the Bin Laden Unit and that he needed to mend the relationship.164 Eric stated that although he acted as a liaison between the CIA and the FBI, his primary job was to perform substantive work related to the Bin Laden Unit’s mission. Eric left the Bin Laden Unit in January 2000 and was replaced in July 2000 by an FBI employee who we call “Craig.”165 By this time, the Bin Laden Unit had been placed into a newly formed group, which was a much larger 162 Other FBI employees were also detailed to the CIA during this time. However, the FBI detailees to the CTC’s Bin Laden Unit were the only ones relevant to the issues in this review. 163 A CIA employee was the other deputy chief in the Bin Laden Unit. Both the FBI detailee and the CIA employee reported to the chief of the Bin Laden Unit, a CIA employee. 164 Eric told the OIG that when he arrived at Bin Laden Unit, he “walked into a buzz saw” and there was a great deal of animus from CIA employees toward the FBI detailees. Eric said this experience was vastly different from his tenure in another CTC section, where he was readily accepted and integrated into the CIA’s operations. 165 No one filled the deputy chief position between January 2000 and July 2000. 232 organization than the Bin Laden Unit. Craig was designated as a deputy chief in the new, larger group. He described his primary job as being a “referent” for law enforcement issues. He explained this role as involving coordination between the FBI and CIA when they wanted to conduct joint interviews or when the CIA requested assistance with a law enforcement matter. Eric and Craig had access via computers on their desks to the CIA’s internal cables. Eric said that while he was at the CIA, he attempted to read all incoming Bin Laden Unit cables. However, he said that the amount of cable traffic was overwhelming and was too much for one individual to read consistently. In contrast, Craig told the OIG that he did not believe his job was to read all the cable traffic and that he did not even attempt to do so. 2. Washington Field Office detailees Another FBI employee detailed to the Bin Laden Unit, an Intelligence Operations Specialist (IOS) who we call “Mary,” was assigned to CIA Headquarters from the FBI’s Washington Field Office in April 1998. Although she was assigned to work on issues of mutual interest to the FBI and the CIA, such as the East African embassy bombings,166 she also was assigned to work on unilateral CTC matters. She said that as a desk officer, she read and responded to cable traffic that was pertinent to the matters she was assigned. She nominally reported to a supervisor in the FBI’s Washington Field Office, but her work was assigned by her CTC supervisors at the Bin Laden Unit.167 The Washington Field Office also detailed to the CTC a special agent, who we call “Dwight.” His performance evaluations were done by the Washington Field Office, but his assignments came from CTC managers. He focused on the financial aspects of terrorism and obtained information through the CTC to help identify and investigate persons who were responsible for 166 On August 7, 1998, nearly simultaneous vehicle bombs were detonated at the U.S. embassies in Nairobi, Kenya, and Dar es Salaam, Tanzania, killing over 200 people and injuring over 4,000. 167 Her position was later transferred from the Washington Field Office to FBI Headquarters’ Usama Bin Laden Unit. 233 funding terrorism. He had access to CIA cables and reviewed them for potential leads or other information related to terrorist financing. 3. New York Field Office detailee An FBI New York Field Office agent from its Bin Laden squad, who we call “Malcolm,” was also detailed to the CIA’s Bin Laden Unit in early 1999 at the request of John O’Neill, the New York Field Office Special Agent in Charge for Counterterrorism at the time. Malcolm replaced another New York Field Office Bin Laden squad agent who had left the CIA’s Bin Laden Unit in August 1998. Malcolm told the OIG that he was not given instructions as to his specific duties at the CIA. He said he understood his job there was to be the “eyes and ears” of the New York Field Office and “to monitor” New York Field Office cases. He said his role was to “facilitate inquiries of mutual interest” and to act as a liaison for FBI offices around the country by following up on tracing requests and reporting on their status. He stated that he also spent a significant amount of time coordinating with the CTC in preparation for and during the trials that arose out of the FBI’s investigations into the East African Embassy bombings. He told the OIG that he did not review all cables; he reviewed only the cables that he thought were interesting, generally based solely on his review of the cable subject line. He said he reported to an SSA in the New York Field Office, not to anyone at the CIA. III. Factual chronology regarding Hazmi and Mihdhar In this section of the report, we discuss in detail the five junctures before September 11, 2001, during which the FBI had an opportunity to obtain or develop information about Mihdhar and Hazmi but did not. We describe in chronological order the sequence of events regarding these five opportunities, including the information that the FBI obtained or could have obtained about Hazmi and Mihdhar. Many of the witnesses told the OIG they did not have specific recollection of the events and conversations related to the Hazmi and Mihdhar matter. In addition, we found few notes and documents relating to these events and conversations. The following is our best reconstruction of the events based on the participants’ recollections and the existing documentary evidence. 234 We show a timeline of the Hazmi and Mihdhar events described in this chapter on the next two pages of the report. A. Identification in January 2000 of Hazmi and Mihdhar as al Qaeda operatives This section describes the initial development and dissemination of intelligence information concerning Hazmi and Mihdhar. This intelligence was obtained by the NSA in late 1999 and early 2000. The intelligence led to a surveillance operation in Malaysia in which it was discovered that Mihdhar had a valid multiple-entry U.S. visa and photographs of Mihdhar meeting with other al Qaeda operatives were taken. There were several ways the FBI could have acquired this information from the CIA – through a CIR from the CIA to the FBI, informally through conversations between a CIA employee and FBI Headquarters employees, and through the FBI employees detailed to the CIA reviewing the CIA cable traffic. We reviewed whether this information was in fact passed to the FBI by the CIA, and based on the evidence, concluded that while the CIA passed some of the information about Mihdhar to the FBI, it did not contemporaneously pass the information about Mihdhar’s U.S. visa to the FBI. We concluded it was not disclosed by the CIA until late August 2001, shortly before the September 11 terrorist attacks. We also reviewed whether FBI detailees to the CIA contemporaneously acquired this information and what action, if any, they took with respect to this information. Hazmi and Mihdhar Timeline – Part I 235 9/11/2001 Hazmi and Mihdhar and 17 other terrorists attack the United States. 8/29/2001 FBI New York opens an intelligence investigation to locate Mihdhar. 8/22/2001 CIA personnel inform FBI HQ analyst of Mihdhar's U.S. visa and July 4, 2001, entry in New York. 6/11/2001 FBI HQ analyst meets with New York FBI agents working on the Cole investigation. CIA personnel also attend the meeting. New York agents are not informed of identification of Khallad in photos. 5/15/2001 Some time in May, CIA personnel advise FBI HQ analyst about the Malaysian meetings and provide photos. FBI not informed of Mihdhar's U.S. visa or identification of Khallad in the photos. 1/4/2001 CIA shows joint source photos from Kuala Lumpur. Source identifies Khallad in photos. FBI ALAT is present for most of meeting with source but does not become aware of this identification. 12/16/2000 CIA shows joint source the Yemeni photo of Khallad. Source identifies him as mastermind of Cole attack. 10/12/2000 U.S.S. Cole is attacked in Aden, Yemen. Shortly thereafter, Yemeni officials provide FBI with photo of "Khallad," the purported mastermind of the attack. 6/10/2000 Mihdhar departs the United States. 5/31/2000 Hazmi and Mihdhar rent rooms in the residence of an FBI asset. 5/1/2000 Beginning in mid-2000, CIA and FBI begin debriefing joint source. Source provided significant information about Bin Laden and Al Qaeda. 5/1/2000 9/15/2001 7/1/2000 10/1/2000 1/1/2001 4/1/2001 7/1/2001 Hazmi and Mihdhar Timeline – Part II 236 237 In addition, the CIA learned in March 2000 that Hazmi had boarded a United Airlines flight in Bangkok, Thailand, bound for Los Angeles, California, on January 15, 2000.168 We also reviewed whether the FBI was informed of this information, and concluded that it did not learn about this information until August 2001. 1. Background In late 1999, the Intelligence Community developed significant intelligence information regarding Hazmi and Mihdhar. At this time, the Intelligence Community was on high alert because of concerns involving possible terrorist activity planned in conjunction with the coming of the new Millennium. In addition to concerns about attacks at New Year’s Eve celebrations, the Intelligence Community was concerned that a terrorist attack was planned for January 3, 2000, which in the Islamic calendar is considered a “night of destiny.”169 There were additional concerns about potential terrorist attacks coinciding with the end of Ramadan, around January 6, 2000.170 Several of these planned attacks were uncovered in December 1999. For example, on December 1, 1999, in Jordan, a plot to disrupt New Year activities with explosives designed to kill thousands of revelers, including U.S. citizens, was uncovered and thwarted with the arrest of 16 people. On December 14, 1999, Ahmad Ressam was stopped at the United States/Canadian border in Washington state as he attempted to enter the United States in a vehicle loaded with explosives. It was determined later that he had intended to detonate the explosives at the Los Angeles airport. To be prepared for possible terrorist activity at the end of 1999, the FBI activated its Strategic Information Operations Center (SIOC). The SIOC is 168 Mihdhar was also on the same flight, but that fact apparently was not known within the Intelligence Community until much later, in August 2001. 169 During the course of the Cole bombing investigation, it was learned that an attack also had been planned against the U.S.S. The Sullivans in Aden, Yemen, on the same date. That attack failed because the attack boat sank before reaching its target. 170 Ramadan is the ninth month of the Islamic calendar. Ramadan begins when authorities in Saudi Arabia sight the new moon of the ninth month. 238 located in a secure area within FBI Headquarters and contains several meeting rooms, conferencing equipment, communications equipment, computers, and other operational equipment. It allows the FBI to manage major investigations or other significant operations 24 hours a day, 7 days a week. During the Millennium period, the FBI operated its International Terrorism Operations Section from within the SIOC. In addition, the FBI detailed field supervisors with counterterrorism experience and other counterterrorism personnel to the SIOC for around-the-clock monitoring and response to possible terrorist activities. At the CIA, additional personnel were called in to work at the CTC and planned leave was canceled. In addition, personnel from the CIA and other Intelligence Community agencies were detailed to work in the FBI’s SIOC. During this period, personnel in the FBI’s SIOC prepared two daily briefings for the FBI Director and his executive staff, one at 7:30 a.m. and the other at 4:30 p.m. The daily briefings contained summaries of significant terrorism investigations and the latest intelligence related to counterterrorism. Accompanying the briefings were daily threat updates prepared each afternoon for the Director and his executive staff. The briefings and the threat updates were prepared by various people throughout the course of the day and night in the SIOC. 2. NSA provides intelligence regarding planned travel by al Qaeda operatives to Malaysia In the midst of the Millennium period concerns in late 1999, the NSA analyzed communications associated with a suspected terrorist facility in the Middle East linked to Al Qaeda activities directed against U.S. interests. The communications indicated that several members of an “operational cadre” were planning to travel to Kuala Lumpur, Malaysia, in early January 2000. Analysis of the communications revealed that persons named Nawaf, Khalid and Salem were involved. In early 2000, the NSA analyzed what appeared to be related communications concerning a “Khalid.”171 (continued) 171 The NSA had additional information in its database further identifying “Nawaf” as Nawaf al-Hazmi, a friend of Khalid. However, the NSA informed the OIG that it was not 239 The NSA’s reporting about these communications was sent, among other places, to FBI Headquarters, the FBI’s Washington and New York Field Offices, and the CIA’s CTC. At the FBI, this information appeared in the daily threat update to the Director on January 4, 2000. 3. Mihdhar’s travel and discovery of his U.S. visa A CIA desk officer working in the Bin Laden Unit who we call “Michelle” determined that there were links between these people and Al Qaeda as well as the 1998 East African embassy bombings. In addition, the CIA identified “Khalid” as Khalid al-Mihdhar. Mihdhar arrived in Kuala Lumpur, Malaysia, on January 5, 2000. Mihdhar was traveling on a Saudi passport. This passport contained a valid U.S. visa. Mihdhar’s passport was photocopied and sent to CIA Headquarters. Several CIA cables contemporaneously discussed Mihdhar’s travel and the discovery of his U.S. visa in his Saudi passport. CIA records show that a CIA employee, who we call “James”172 and who was detailed to FBI Headquarters during the Millennium period, accessed one of these cables approximately two hours after it was disseminated in the morning, and he accessed another of the cables about eight hours after it was disseminated on the next morning. James discussed some information about Mihdhar with two FBI Headquarters employees on the evening of January 5, which we detail in Section 7 below. 4. CIR is drafted to pass Mihdhar’s visa information to the FBI Dwight, the special agent detailed to the CIA’s Bin Laden Unit from the FBI’s Washington Field Office, also read the cables discussing Mihdhar’s U.S. visa within hours of each cable being disseminated. CIA records also show (continued) asked to conduct research on these individuals at that time, and it did not uncover that information on Hazmi. It was thought at the time that Salem might be Hazmi’s younger brother, and this was later confirmed. 172 The CIA has asked the OIG not to identify the true names of CIA employees for operational reasons. 240 that Dwight’s immediate supervisor in the Bin Laden Unit opened one of the cables soon after Dwight. Dwight opened one of the cables, which reported that Mihdhar’s visa application had been verified and that he had listed New York as his intended destination. Around 9:30 a.m. on the same morning, Dwight began drafting in the CIA’s computer system a CIR addressed to the UBL Unit Chief at FBI Headquarters and an SSA in the UBL Unit at FBI Headquarters who we call “Bob.” Dwight’s CIR also was addressed to the FBI’s New York Field Office. The CIR first described the NSA information that had been received about Mihdhar, including the planned travel to Kuala Lumpur, Malaysia in early January. The CIR also discussed the potential links between the suspected terrorist facility in the Middle East and the 1998 East Africa embassy bombings. The CIR stated that photographs of Mihdhar had been obtained and would be sent to the FBI under separate cover. The CIR detailed Mihdhar’s passport and visa information, including that Mihdhar had listed on his visa application his intended destination as New York and that he planned to stay three months. Dwight also wrote that the CTC was requesting “feedback” on “any intelligence uncovered in FBI’s investigation” resulting from the information in the CIR. Michelle, the Bin Laden Unit desk officer who originally had taken notice of the information about Mihdhar and his connections to Al Qaeda, accessed Dwight’s draft CIR less than an hour after Dwight drafted it at approximately 9:30 a.m. Around 4:00 p.m. on the same day, Michelle added a note to the CIR in the CIA’s computer system: “pls hold off on CIR for now per [the CIA Deputy Chief of Bin Laden Unit].” CIA records show that the same morning, the CIA Deputy Chief of Bin Laden Unit, who we will call “John,” also had read the cable indicating that Mihdhar’s visa was valid and that New York had been listed as his intended destination. Around 6:30 p.m. on the same day, John again accessed this cable and then another cable, the same two CIA cables about Hazmi and Mihdhar in 241 the CIA’s computer system that Dwight had used in drafting the CIR. CIA records do not indicate that John accessed Dwight’s draft CIR.173 CIA records show that the CIA employee detailed to FBI Headquarters who we call James and who discussed the Mihdhar information with two FBI Headquarters employees, also accessed the draft CIR on the day it was drafted. In addition, two other FBI detailees accessed the draft CIR: Eric, the other Deputy Chief of the Bin Laden Unit, accessed it two hours after Dwight began writing it, and Malcolm, the New York Field Office’s detailee to the Bin Laden Unit, accessed it two days later. CIA records show that as of eight days later the CIR had not been disseminated to the FBI. In an e-mail to John in mid-January, Dwight had attached the draft CIR and wrote, “Is this a no go or should I remake it in some way.” The CIA was unable to locate any response to this e-mail. By mid-February, the CIR had not been sent to the FBI and was still in draft form in the CIA’s computer system. CIA records show that Dwight emailed a CIA contractor who handled computer matters and asked him to delete several draft cables in the computer system unrelated to this matter, but to save the draft CIR concerning Mihdhar. The contractor accessed the draft cable in the system the next day. When we interviewed all of the individuals involved with the CIR, they asserted that they recalled nothing about it. Dwight told the OIG that he did not recall being aware of the information about Mihdhar, did not recall drafting the CIR, did not recall whether he drafted the CIR on his own initiative or at the direction of his supervisor, and did not recall any discussions about the reasons for delaying completion and dissemination of the CIR. Malcolm said he did not recall reviewing any of the cable traffic or any information regarding Hazmi and Mihdhar. Eric told the OIG that he did not recall the CIR. The CIA employees also stated that they did not recall the CIR. Although James, the CIA employee detailed to FBI Headquarters, declined to 173 According to John, once CIRs were drafted the CIA’s standard operating procedure was for the drafter to “coordinate” the CIR in the computer system, which notified the persons designated by the drafter that there was a CIR that required their attention. He said that it was not standard operating procedure to access CIRs in draft form. 242 be interviewed by us, he told the CIA OIG that he did not recall the CIR. John (the Deputy Chief of the Bin Laden Unit) and Michelle, the desk officer who was following this issue, also stated that they did not recall the CIR, any discussions about putting it on hold, or why it was not sent. 5. Mihdhar in Dubai On the same day that Dwight was drafting the CIR, the CIA reported in an internal cable additional information about Mihdhar. The cable stated that it appeared that, despite his multiple entry visa, Mihdhar had not yet traveled to the United States. The cable then stated that it was up to the CTC as to whether anyone should inquire with the INS to verify whether Mihdhar had traveled to the United States.174 The cable also reported additional information about Mihdhar while he was in Dubai. CIA records reveal that this cable also was read by FBI detailee Dwight. However, Dwight did not include in the draft CIR the additional information about the lack of any indication that Mihdhar had traveled to United States or the additional information about Mihdhar in Dubai.175 6. CIA cable stating that Mihdhar’s visa and passport information had been passed to FBI Also on the same day that Dwight was preparing the CIR, Michelle, the Bin Laden Unit desk officer who was following the issue of Mihdhar, prepared a lengthy cable to several stations summarizing the information that had been collected at that point on Mihdhar and three other individuals who also were possibly traveling to Malaysia. The cable began, “After following the various reports, some much more credible than others, regarding a possible [Bin 174 We did not determine whether the CIA actually contacted the INS pursuant to this suggestion. As we discuss below, we did determine INS records reflect that Mihdhar first entered the United States on January 15, 2000, and only entered again on July 4, 2001. 175 This cable also was read by James, the CIA employee detailed to the FBI’s SIOC. As detailed below, he later discussed some of its contents with an FBI Headquarters employee. 243 Laden]-associated threat against U.S. interests in East Asia, we wish to note that there indeed appears to be a disturbing trend of [Bin Laden] associates traveling to Malaysia, perhaps not for benign reasons.” This cable then summarized the CIA’s information that indicated several individuals were planning to travel to Malaysia. In the paragraph describing Mihdhar, Michelle stated that Mihdhar’s travel documents, including a multiple entry U.S. visa, had been copied and passed “to the FBI for further investigation.” This cable –the fifth CIA cable to discuss Mihdhar’s U.S. visa – did not state by whom or to whom Mihdhar’s travel documents were passed. It also did not indicate how they had been passed, or provide any other reference to the passage of the documents. Because this cable was an internal, operational cable, it was not forwarded to or copied to the FBI. This cable was disseminated to various CIA stations approximately three hours after Michelle had noted in the cable system that Dwight was directed to hold off on sending his draft CIR to the FBI “for now per [the CIA Deputy Chief of the Bin Laden Unit].” When we interviewed Michelle, she stated that she had no recollection of who told her that Mihdhar’s travel documents had been passed to the FBI or how they had been passed. She said she would not have been the person responsible for passing the documents. According to Michelle, the language in the cable stating “[the documents] had been passed” suggested to her that someone else told her that they had already been passed, but she did not know who it was. The CIA Deputy Chief of the Bin Laden Unit also said he had no recollection of this cable, and he did not know whether the information had been passed to the FBI. Neither we nor the CIA OIG was able to locate any other witness who said they remembered anything about Mihdhar’s travel documents being passed to the FBI, or any other documents that corroborated the statement that the documents were in fact passed to the FBI. 7. The Malaysia meetings and surveillance of Mihdhar After he arrived in Malaysia, Mihdhar was followed and photographed in various locations meeting with several different people. These events are 244 referred to as “the Malaysia meetings.” CIA employees wrote several cables contemporaneously about the Malaysia meetings, which we discuss below. a. First cable regarding Mihdhar in Malaysia The CIA prepared an internal cable stating that Mihdhar had arrived in Kuala Lumpur on the evening of January 5. The cable also described his activities with other Arabs who were unidentified at the time. This cable, which we refer to as the “first Malaysia meetings cable,” did not contain any information regarding passports or visas. b. January 5 FBI threat update It appears that this first Malaysia meetings cable was provided to the FBI. Sometime before the daily FBI executive briefing that took place on January 6 at 7:30 a.m., the January 5 threat update information concerning Mihdhar was edited in the FBI’s SIOC. This January 5 threat update reflected an almost verbatim recitation of portions of the CIA’s first Malaysia meetings cable, including the same spelling mistake in reference to a particular place in Malaysia, which indicates that the CIA provided a copy of the first Malaysia meetings cable to the FBI. However, we were not able to determine who in the FBI received this information from the CIA or who edited the January 5 threat update. No one we interviewed at the FBI said they recalled handling information related to Mihdhar or the January 5 threat update. The threat update contained no reference to Mihdhar’s passport information or his U.S. multiple-entry visitor’s visa. The January 5 threat update also was made part of the January 6 7:30 a.m. executive briefing document. This briefing did not contain any additional information about Mihdhar. The January 5 threat update was the only official document from this period located by the FBI that referenced the Malaysia meetings that were discussed in the first CIA Malaysia meetings cable. 245 c. Discussion between CIA and FBI employees about Malaysia meetings As noted above, computer records show that James, the CTC employee detailed to the FBI’s SIOC, read the cables and the draft CIR indicating that Mihdhar had a U.S. visa. Contemporaneous e-mails show that James discussed the Malaysia meetings with two FBI Headquarters employees in the SIOC in the early morning hours of January 6. Below we detail the cables and the evidence about the discussions that took place between the CIA and FBI personnel in the SIOC about the Malaysia meetings. Contemporaneous e-mail messages among CIA employees show that during the night of January 5 James briefed the FBI SSA who we call Bob about Mihdhar’s travel. At the time, Bob was an SSA in the UBL Unit in FBI Headquarters, which was operating out of the SIOC during this period. James wrote an e-mail to several CIA employees in which he stated that he was detailing “exactly what [he] briefed [the FBI] on” in the event the FBI later complained that they were not provided with all of the information about Mihdhar.176 This e-mail did not discuss Mihdhar’s passport or U.S. visa. As previously mentioned, James told the CIA OIG that he had no recollection of these events. He declined to be interviewed by us. Bob told the OIG that he had no independent recollection of any briefing from a CIA employee regarding the Malaysia meetings. However, he was able to locate a scant contemporaneous note that confirmed he had been briefed regarding Mihdhar and his trip to Malaysia. This note contained no details as to the content of the briefing and no reference to Mihdhar’s U.S. visa. Bob told the OIG that he does not believe that he had been told in this conversation about Mihdhar’s U.S. visa. Bob stated to us that the presence of a 176 James wrote these e-mails in response to an e-mail from another CIA employee who was detailed to the FBI SIOC. That employee reported on the morning of January 6 that he had been asked by an FBI employee for the latest on Mihdhar. James responded in a series of e-mails that he had already briefed the FBI. The final e-mail by James sets forth the details of his briefings. 246 U.S. visa in Mihdhar’s passport would have been extremely important and would have triggered a more significant response than his minimal notes. Bob also told the OIG that he did not know why James chose to brief him about Mihdhar. Bob said that he was not a designated point of contact for the CIA while the SIOC was activated, although he also said that he did not know whether there was a designated point of contact in the SIOC. Bob said that he knew James because James had previously been detailed from the CTC to FBI Headquarters and had worked in ITOS with Bob. d. Second cable regarding Mihdhar and the Malaysia meetings The day after the CIA employee discussed the Malaysia meetings with the two FBI SIOC employees, the CIA sent another internal cable providing new information about the activities of Mihdhar. This cable, “the second Malaysia meetings cable,” provided information about Mihdhar’s activities once he left the Kuala Lumpur airport and his meetings with various individuals. e. Discussion between CTC officer and FBI employee about Malaysia meetings Shortly after 7:30 a.m. on January 6, James briefed another FBI SSA – who we call “Ted” – who was detailed to the SIOC from an FBI field office, about information contained in the second Malaysia meetings cable. Ted told the OIG he was working in the SIOC as an “assistant” to the day shift commander and the UBL Unit Chief, but that he had no specific duties. Because Bob had left FBI Headquarters on a trip to New York by this time, James briefed Ted to ensure that someone at FBI Headquarters had the latest information on Mihdhar. In the same e-mail in which he had detailed what he told Bob, James provided specifics of what he told Ted. The e-mail also stated that the CIA would “continue to run this down and keep the FBI in the loop.” The e-mail did not contain any reference to Mihdhar’s passport or U.S. visa. Based on this briefing by James, Ted prepared an update for the January 6 afternoon FBI executive briefing. Ted e-mailed the update to the ITOS Assistant Section Chief at 8:40 a.m. This update reflected the details of the 247 information Ted had received from James. It did not contain any reference to Mihdhar’s passport or U.S. visa. Like Bob, Ted told the OIG that he had no recollection of being briefed regarding the Malaysia meetings. Although he said he did not recall these events, Ted asserted he did not believe that he had received Mihdhar’s passport or U.S. visa information because if he had he would have unquestionably recognized their significance and documented such information in the update for the executive briefing. Ted told the OIG that he did not know why James briefed him about the Mihdhar information. Like Bob, Ted stated he was not a designated point of contact for the CIA while the SIOC was activated. Ted also knew James because of James’ previous detail to ITOS in FBI Headquarters when Ted served as an SSA in the RFU. f. Cables updating the Malaysia meetings information, including Mihdhar’s travel to Bangkok On January 8, the CIA reported in another internal cable that a new individual had joined Mihdhar and the others, and that additional surveillance photographs were taken. The cable did not state how many photographs were taken or what would be done with the photos. In another cable sent five hours later, the CIA reported in an internal cable that Mihdhar and two of the unidentified men – one of whom turned out to be Hazmi – departed Malaysia from Kuala Lumpur airport en route to Bangkok, Thailand. g. Cables regarding Hazmi’s travel to the United States On January 9, the CIA’s Bin Laden Unit prepared a cable asking that Mihdhar and his associates be identified while in Thailand. CIA records show that on January 13, the CIA was attempting to locate Mihdhar and his traveling companions. In addition, Mihdhar had been watchlisted at the airport in the event that he attempted to leave Thailand. Several weeks later, CIA officers in Kuala Lumpur followed up with their Bangkok counterparts for additional information about Mihdhar and his traveling companions. Approximately two weeks later, Bangkok reported that 248 there was a delay in responding due to difficulties in obtaining the requested information. In early March 2000, officials in Bangkok reported internally that it had identified one of Mihdhar’s traveling companions as Nawaf al-Hazmi. The cable reported that Hazmi had traveled to Bangkok on January 8 and had subsequently traveled on a United Airlines flight to Los Angeles, California on January 15. The cable also stated that Mihdhar had arrived in Bangkok on January 8 but that it was unknown if and when he had departed.177 In addition, the cable identified the third traveler as Salah Saeed Mohammed Bin Yousaf.178 CIA records show that none of the FBI detailees accessed this early March cable. The OIG found no documents or witnesses indicating that the information that Hazmi had traveled to Los Angeles on January 15, 2000, was shared with the FBI at this time. Rather, as we discuss below, this fact was not shared with the FBI until August 2001. We found no indication that CTC personnel took any action with regard to the important information that Hazmi had traveled to the United States. For example, he was not placed on any U.S. watchlists. The day after Bangkok Station reported about Hazmi’s travel to Los Angeles, one office that received the Bangkok cable sent a cable to the CTC stating the Bangkok cable regarding Hazmi’s travel had been read “with interest.” Yet, despite this effort to flag the significance of this information, the cable was not shared with the FBI and did not result in any specific action by the CIA. As we discuss below, it was not until August 2001 that FBI Headquarters personnel learned that on January 15, 2000, both Mihdhar and Hazmi had left Thailand and traveled to Los Angeles, California, where they were both 177 In fact, Mihdhar had traveled to the U.S. with Hazmi on January 15, 2000. This fact was not discovered by anyone in the Intelligence Community until August 2001. 178 Yousaf left Bangkok on January 20 for Karachi, Pakistan. Some time after September 11, Yousaf was determined to be Tawfiq Muhammad Salih Bin Rashid al Atash, a/k/a Khallad, the purported mastermind of the Cole attack. We discuss the FBI’s discovery of information about Khallad and the Cole attack, and the FBI’s opportunities to connect Khallad to the Malaysia meetings, in Section III, C below. 249 admitted into the United States on non-immigrant visas and authorized to remain until July 14, 2000. 8. OIG findings regarding FBI’s knowledge about Mihdhar and the Malaysia meetings We discuss here our findings regarding the FBI’s knowledge of information about Mihdhar and the January 2000 Malaysia meetings, including whether the intelligence information concerning Mihdhar’s valid multiple entry U.S. visa and Hazmi’s travel to the United States in January 2000 was passed to the FBI. Several witnesses told the OIG that Mihdhar’s possession of a U.S. visa provided a clear domestic nexus that should have triggered the passing of this information from the CIA to the FBI. At the outset, we note that the CIA has acknowledged that it obtained information that Mihdhar had a U.S. visa and that Hazmi had traveled to the United States, and that the CIA should have placed their names on U.S. watchlists, but that this did not occur.179 The CIA OIG is reviewing this matter to determine why this failure occurred and who is responsible for it. a. Formal passage of information from the CIA to the FBI As noted above, the formal method of communicating intelligence information between the CIA and the FBI was an intelligence report called a CIR. CIA records show that between July 1999 and September 10, 2001, the Bin Laden Unit disseminated over 1,000 CIRs, most of which were sent to the FBI. CTC employees as well as FBI detailees to Bin Laden Unit had authority to draft CIRs, and the detailees collectively drafted over 150 CIRs to the FBI during this period. However, CIRs could only be disseminated by persons with authority to “release” the CIRs.180 In the Bin Laden Unit, only supervisors, 179 Mihdhar and Hazmi were placed on watchlists by other countries, including Thailand. 180 Once a supervisor approved a CIR for release, it was electronically disseminated by a unit in the CIA known as the Policy Community Action Staff. 250 including John and Eric as the deputy chiefs of the station, had authority to release CIRs.181 Dwight drafted a CIR in which he summarized the information that had been disseminated by the NSA about Mihdhar. He also provided detailed information about Mihdhar’s passport, visa, and visa application indicating that New York had been his intended destination. According to CIA records, this CIR never was disseminated to the FBI. A desk officer’s note on the draft CIR indicated that the Deputy Chief of the Bin Laden Unit, John, had instructed the draft CIR be put on hold, and Dwight contacted him through an e-mail about the disposition of the CIR a week later. Despite this e-mail, the evidence clearly shows that the CIR never was disseminated to the FBI. The evidence shows, however, that Dwight acted in accordance with the system that was in place at the time by drafting the CIR to formally pass the visa information to the FBI. In accordance with Bin Laden Unit policy, Dwight was not permitted to pass the CIR to the FBI without permission. All of the witnesses stated, however, that they did not recall the CIR or any communications about it. Other than the note written by the desk officer, we found no documentary evidence about why the CIR was not disseminated. Thus, we were unable to determine why it was not sent. The information in the CIR, which was documented in the appropriate format for passage to the FBI, was potentially significant to the FBI and should have been passed to the FBI. We believe it was a significant failure for the CIR not to be sent to the FBI. b. Informal passage of information from CIA to FBI We also considered what information that James, a CIA detailee to the FBI, informally passed to FBI Headquarters and whether he informed anyone of the visa information about Mihdhar. Based on the contemporaneous e-mails in which James documented in detail what he told FBI SSAs Bob and Ted, we concluded that he reported to the FBI the information regarding Mihdhar’s 181 CIA records show that Eric released five CIRs during his tenure at the Bin Laden Unit. 251 transit through Dubai, his arrival in Kuala Lumpur, his activities after his arrival, and his meeting with other suspected al Qaeda operatives. It is far less clear, however, whether he provided Mihdhar’s passport and U.S. visa information to the FBI. We do not believe that James briefed either Bob or Ted on Mihdhar’s passport or U.S. visa information. First, nothing in Bob’s contemporaneous notes or Ted’s e-mail or briefing update referred to Mihdhar’s passport or visa information. Bob and Ted also stated forcefully and credibly to us that they would have recognized the significance of a U.S. visa in the hands of a suspected al Qaeda operative and at a minimum would have included such information in their notes or reports. Moreover, James wrote a detailed e-mail to document the contents of his conversations with Bob and Ted. Since the stated purpose of James’ e-mail was to prevent the FBI from later claiming he had failed to brief them on some important details, he had every incentive to include all relevant details in that email. At the time he wrote this e-mail, he had read three of the CIA cables indicating that Mihdhar had a U.S. visa, as well as the draft CIR. Yet, James’ e-mail contained no mention of Mihdhar’s passport or visa. We found only one piece of evidence suggesting that the FBI was made aware in January 2000 of Mihdhar’s U.S. visa – the early January cable by the desk officer who we call Michelle which stated that Mihdhar’s travel documents, including a multiple entry U.S. visa, had been copied and passed “to the FBI for further investigation.” We could not, however, find any evidence to corroborate that this information actually had been passed to the FBI. This cable did not state by whom or to whom the documents were passed or make any other reference to the passage of the documents. The cable was an internal cable, which means it would not have been forwarded to or accessible to the FBI. In addition, Michelle, the CIA desk officer who wrote the cable, had no recollection of who told her that the documents had been passed or how they had been passed. She said that she would not have been responsible for passing the information but instead would have been told by someone else that the documents had been passed. We were unable to locate any witness who said they remembered anything about the documents being passed to the FBI, as Michelle’s cable 252 asserted. Even if her cable was accurate, and she had been told by someone that the documents had been passed to the FBI, there is no evidence that such information was correct. The CIA and FBI witnesses we interviewed described this period as very hectic and said they were flooded with information. Several witnesses suggested that these hectic circumstances could have created an environment where unintentional misunderstandings might have occurred about whether information was actually passed to other Intelligence Community agencies. We also searched ACS for any FBI record of the travel documents having been provided to the FBI, since this cable indicated that a physical copy of the documents, not merely information about the documents, was passed. We found no reference to the documents. Aside from this cable, we found no other evidence that the information or documents about Mihdhar’s passport or visa information was in fact provided to the FBI during this time period. c. FBI detailees’ handling of information on Mihdhar As discussed above, five FBI employees were detailed to the CTC to work on Bin Laden matters during 2000 and 2001, and all had access at their desks to CIA internal cable traffic. Four of those employees – the supervisor who we call Eric, the IOS who we call Mary, and the agents who we call Dwight and Malcolm – were at the Bin Laden Unit in January 2000 when the Malaysia meetings occurred.182 We considered how each handled the intelligence information concerning Mihdhar during this period. After reading two of the cables indicating that Mihdhar had a U.S. visa, Dwight prepared a draft CIR to officially notify the FBI about that information, since the U.S. visa presented a nexus between Mihdhar and the United States. But the CIR was not provided to the FBI. However, we also examined whether any of the detailees took any other action to notify FBI Headquarters or, in Malcolm’s case, the New York Field Office, about the information concerning Mihdhar. 182 The fifth detailee – the manager who we call Craig – did not arrive at the CTC until July 2000. 253 The evidence shows that each FBI detailee reviewed some of the cables about Mihdhar’s U.S. visa. Dwight accessed several of the cables that indicated Mihdhar had a U.S. visa, such as the cables stating that Mihdhar had transited through Dubai and had a U.S. visa, the cable stating that Mihdhar’s visa application listed New York as his intended destination in May 1999, and the cable stating that based on a review of Mihdhar’s visa, it did not appear that he had actually traveled to the United States. Malcolm also accessed the cable stating that Mihdhar’s visa application listed New York as his intended destination in May 1999, and the cable stating that it did not appear that Mihdhar had actually traveled to the United States. Malcolm also accessed the two cables stating that Mihdhar had arrived in Kuala Lumpur and that surveillance photos showed him meeting with others in Malaysia. Malcolm also accessed Dwight’s draft CIR indicating passage of the visa information to the FBI, including the New York Field Office. Mary accessed the January cable stating that Mihdhar’s travel documents, including a multiple-entry U.S. visa, had been passed to the FBI, but she did not access the previous cables reflecting the visa information or Dwight’s CIR. She also accessed the two cables stating that Mihdhar had arrived in Kuala Lumpur and that surveillance photos showed him meeting with others in Malaysia. Eric did not access these cables, but he accessed Dwight’s draft CIR which detailed Mihdhar’s visa information and which summarized the NSA information. However, Dwight, Malcolm, Mary, and Eric all told the OIG that they did not recall anyone from the CIA bringing to their attention the fact that Mihdhar had a U.S. visa. In addition, despite the records of their access to the cable traffic or the CIR, they all told the OIG that they did not recall discovering at the time – such as by reading a cable – that Mihdhar had a U.S. visa.183 As discussed above, Dwight told the OIG that he did not even recall 183 The detailees also told the OIG that they did not necessarily read all of the cables they accessed. They explained that they often skimmed cables to determine if any action was required on their part or to find specific information in connection with a particular assignment or issue. 254 writing the CIR or even being aware of the Malaysia meetings or of the fact that Mihdhar had a U.S. visa. Eric told the OIG that his CIA counterpart – John, the CIA Bin Laden Unit Deputy Chief – mentioned the Malaysia meetings and that surveillance photos had been taken, but Eric did not recall ever hearing anything about Mihdhar having a U.S. visa. Mary told the OIG that she did not recall even being contemporaneously aware of the Malaysia meetings.184 Mary explained that she did not have reason to be made aware of the Malaysia meetings at the time because the matter had been assigned to another CIA desk officer – Michelle (the one who wrote the cable indicating that Mihdhar’s travel documents had been passed to the FBI). Malcolm said he was not aware of the fact that Mihdhar had a U.S. visa until after September 11. He stated that he recalled being shown the Kuala Lumpur photos, but he could not remember whether that was before or after September 11. He said that it was not until he was shown the Kuala Lumpur photos that he became aware of the Malaysia meetings. Yet, the evidence shows that all had accessed contemporaneously cables indicating that Mihdhar had a U.S. visa, which was important intelligence information that was never provided to FBI Headquarters. They did not violate any specific policy or procedure in their handling of the information, and they did not have the authority to unilaterally pass CTC information to the FBI without permission. This restriction included any informal passage of the information, such as by telephone call or in-person discussions. However, none of them, particularly Dwight, ensured that the information was provided to the FBI. Dwight drafted a CIR that would have provided the FBI with the important information about Mihdhar, but the CIR was not released by the CIA. Although Dwight followed up a few days later to ask whether the cable was going to be sent or whether he should remake it in some other way, there is no record of a response to his request, and no one could explain why the cable was not sent. We believe it was critical that the information be sent. We found no indication that this ever happened. 184 When we showed Mary copies of an e-mail written by the CTC officer who had briefed SSA Bob and Ted, which indicated that she was copied on the e-mail, she said that she did not recall having read the e-mail. 255 This failure to send the information to the FBI, in our view, was also attributable to problems in how the detailees were instructed and supervised, and that these problems significantly impeded the flow of information between the CIA and the FBI. We discuss these systemic problems in detail in our analysis section later in this chapter. d. OIG conclusion In sum, the evidence shows that in January and March 2000, the CIA uncovered important intelligence information about Mihdhar and Hazmi: • They were al Qaeda operatives who had traveled to Malaysia, where they were photographed meeting with other suspected al Qaeda operatives; • They traveled to Bangkok with a third person; • Mihdhar had a valid, multiple-entry U.S. visa; and • Hazmi had traveled to Los Angeles in January 2000. Yet, we found that the CIA did not share significant pieces of this information with the FBI – that Mihdhar had a U.S. visa and that Hazmi had traveled to Los Angeles. An FBI detailee at the CIA drafted a CIR to share this information with the FBI, but that information was not released by the CIA to the FBI. We were unable to determine why this did not occur. No one we interviewed said they remembered the CIR or why it was not sent to the FBI. We consider it a significant failure for this CIR not to be sent to the FBI. In addition, the evidence shows that the limited information that was provided to FBI Headquarters – that Mihdhar traveled to Malaysia and met with other suspected al Qaeda operatives – was never documented by the FBI in any system that was retrievable or searchable, thus limiting the usefulness of the information that was shared. The FBI’s only official record of having received this information was in the hard copies of the January 5 threat update, which was attached to the January 6 executive briefing, and Ted’s e-mail summarizing information from his discussion with the CIA employee. We discuss this and other systemic problems in our analysis section below. 256 B. Hazmi and Mihdhar in San Diego 1. Introduction The second set of events that may have led the FBI to discover Mihdhar and Hazmi’s presence in the United States related to their stay in San Diego. As noted above, on January 15, 2000, Mihdhar and Hazmi boarded a flight in Bangkok, Thailand, for Los Angeles. They were admitted to the United States on non-immigrant visitor visas and authorized to remain in the U.S. until July 14, 2000. Shortly after arriving in Los Angeles, they traveled to San Diego, California, where they were aided in finding a place to stay by Omar al-Bayoumi. Bayoumi had been the subject of an FBI preliminary intelligence investigation that had been closed. In late May 2000, Hazmi and Mihdhar rented a room in the residence of an FBI asset.185 Mihdhar remained in San Diego until June 10, 2000, when he left the United States.186 Hazmi remained in the San Diego area until approximately December 2000, when he moved to the Phoenix, Arizona area. In Phoenix, Hazmi lived for approximately three months with another September 11 hijacker, Hani Hanjour. In April 2001, Hazmi and Hanjour moved to New Jersey and remained on the East Coast until September 11. While residing in San Diego in 2000, Mihdhar and Hazmi did not act in an unusual manner that would draw attention, but they did not attempt to hide their identities. Using the same names contained in their travel documents and known to at least some in the Intelligence Community, they rented an apartment, obtained driver’s licenses from the state of California Department of Motor Vehicles, opened bank accounts and received bank credit cards, purchased a used vehicle and automotive insurance, took flying lessons at a local flying school, and obtained local phone service that included Hazmi’s listing in the local telephone directory. 185 This kind of individual is often referred to as an “informant” - the common vernacular for an individual providing information to an investigative agency. Within the FBI’s foreign intelligence program, they are known as assets. 186 Mihdhar departed from Los Angeles on Lufthansa Airlines. 257 Although Hazmi and Mihdhar were in San Diego for a significant period of time, the FBI did not learn of their presence there until after September 11, 2001. After September 11, much would be learned about Hazmi and Mihdhar’s time in San Diego and the Intelligence Community’s missed opportunities to find and investigate them before the terrorist attacks in which they participated. In this section, we describe the facts surrounding Hazmi and Mihdhar’s residence in San Diego, including their associations with two persons known to the FBI. 2. Hazmi and Mihdhar’s association with Bayoumi Omar al-Bayoumi is a Saudi Arabian national who came to the United States in 1993. In early 2000 he had been living with his wife and four children in San Diego for at least four years. Although he described himself to others in San Diego as a graduate student in business administration, he took classes intermittently and was not enrolled in a program of study. He did not work in the United States and received a monthly stipend of $4,000 plus “other allowances,” ranging from $465 to $3,800 each month, from Dallah/Avco, a Saudi contractor to the Presidency of Civil Aviation.187 Bayoumi was active in the San Diego Muslim community and was involved in the establishment of several mosques in the United States. In September 1998, the FBI’s San Diego Field Office opened a preliminary inquiry on Bayoumi based on allegations raised by the manager in the apartment complex where he was living at the time. The manager alleged that Bayoumi had received a suspicious package from the Middle East, and the maintenance worker for the apartment complex had noted strange wires in Bayoumi’s bathroom. In addition, the manager reported frequent gatherings of young Middle Eastern males at Bayoumi’s apartment on weekend nights. The FBI case agent conducted a limited investigation of Bayoumi, but the preliminary inquiry was closed in June 1999 and was not converted to a full 187 Bayoumi was employed by the Saudi Presidency of Civil Aviation from 1975 until 1995 and became a contractor for the organization beginning in 1995. 258 field investigation.188 As a result, the FBI was no longer investigating Bayoumi at the time that Hazmi and Mihdhar met Bayoumi in February 2000. However, the following paragraphs describe what was later learned about Bayoumi’s interactions with Hazmi and Mihdhar. On February 1, 2000, Bayoumi traveled by car from San Diego to Los Angeles, to resolve a visa issue at the Saudi consulate. Bayoumi invited an associate, Isamu Dyson, to accompany him.189 Dyson provided the following account to the FBI of the trip with Bayoumi.190 Dyson said that at the time of the invitation, Bayoumi mentioned a Los Angeles restaurant serving halal food where they could eat lunch after Bayoumi’s meeting at the consulate.191 After Bayoumi spent approximately one hour at the Saudi consulate, he and Dyson went to the restaurant but discovered it had been converted to a butcher shop. The butcher shop employees recommended another nearby halal restaurant, the “Mediterranean Gourmet.” Bayoumi and Dyson walked to that restaurant. While they were eating there, Hazmi and Mihdhar entered the restaurant and the four talked in Arabic. Although Dyson had limited Arabic language skills, he said that Bayoumi kept him apprised of the content of the conversation. Hazmi and Mihdhar told Bayoumi that they were in the United States to study English, but they did not like living in Los Angeles. Bayoumi invited the men to visit San Diego and offered to assist them. Bayoumi provided the men with his phone number. Bayoumi and Dyson left the restaurant, and after stopping at a nearby mosque for sunset prayers, returned to San Diego. Dyson asserted that the encounter with Hazmi and Mihdhar seemed to be a coincidental meeting. Within several days of the meeting, Hazmi and Mihdhar accepted Bayoumi’s invitation and traveled to San Diego. In San Diego, Bayoumi 188 In Section IV B 1 of this chapter, we examine the investigative steps taken by the FBI in this preliminary inquiry and assess the appropriateness of the decision to close the inquiry. 189 Dyson is an American Caucasian who converted to Islam. He has since changed his name to Caysan Bin Don. 190 Dyson provided the information to the FBI in an interview after September 11. 191 Halal is an Arabic word meaning “lawful” or “permitted.” 259 arranged for Hazmi and Mihdhar to rent an apartment on Mount Ada road in the same apartment complex where Bayoumi lived. Bayoumi also co-signed their lease. Shortly after Hazmi and Mihdhar moved into the apartment, Bayoumi hosted a party to introduce them to the local Muslim community. Within a few weeks of moving into the apartment, Hazmi and Mihdhar filed a 30-day notice to vacate the apartment, apparently to move to another apartment. However, they later rescinded the vacate notice and continued to lease the apartment until June 2, 2000.192 The apartment manager told the FBI that Bayoumi paid Hazmi and Mihdhar’s first month’s rent and security deposit because they had not yet established a local bank account and the apartment complex would not accept cash. A review of Bayoumi and Mihdhar’s financial records after September 11, 2001, indicate that Bayoumi was reimbursed for this expense on the same day it was paid.193 3. Hazmi and Mihdhar’s communications On March 20, 2000, a long distance telephone call was placed from Mihdhar and Hazmi’s Mount Ada apartment to a suspected terrorist facility in the Middle East linked to al Qaeda activities. (See section III, A, 2 above.) A record of the call was captured in the toll records. After the September 11 attacks, the call was identified through a record check. 192 Bayoumi left the United States for some of the time Hazmi and Mihdhar lived in the apartment. INS records do not indicate when Bayoumi left the country, but the records indicate that he obtained a United States visa in Jeddah on May 10, 2000, and returned to the United States on May 31, 2000. Bayoumi left the United States permanently in July 2001 and was living in England on September 11, 2001. 193 Bayoumi’s bank records show a cash deposit in the exact amount of the rent and security deposit ($1,558). Mihdhar’s financial records also indicate that he opened an account with a deposit of $9,900 in cash within seven minutes of Bayoumi’s cash deposit, which suggests that they were in the bank together. 260 4. Hazmi and Mihdhar’s association with an FBI asset beginning in May 2000 Sometime in May 2000, Hazmi and Mihdhar moved out of the apartment Bayoumi had found for them on Mount Ada Road and moved as boarders into the home of an asset of the FBI’s San Diego Field Office.194 Hazmi and Mihdhar met the asset at the mosque they attended.195 Mihdhar stayed at the asset’s residence until June 10, 2000, when he left the United States. Hazmi resided in the asset’s house until December 10, 2000, when he moved to Arizona. a. Background on the FBI asset In 1994, the asset was recruited by San Diego FBI Special Agent who we call “Stan.” The FBI had interviewed the asset in connection with a bombing investigation several years before. Stan remained the asset’s handling agent – or “control agent” – until Stan retired in February 2002.196 The asset was opened as an asset on May 14, 1994.197 He worked as an informational source, providing to the FBI information acquired in his normal daily routine. He normally was questioned about specific individuals who were under investigation by the FBI, although he occasionally volunteered information that he thought might be relevant. According to Stan, during some 194 The OIG was not able to interview the asset. The Joint Intelligence Committee Inquiry had attempted to interview the asset without success. The Committee then submitted interrogatories that the asset declined to answer, asserting his Fifth Amendment privilege. The asset indicated through his attorney that if subpoenaed by the Committee, he would not testify without a grant of immunity. 195 There is some dispute about whether Hazmi and Mihdhar actually responded to an advertisement for boarders posted by the asset or whether they were introduced to the asset. The OIG did not have access to the witnesses who could address this issue. 196 Stan was interviewed twice by the JICI staff, and he testified before the Joint Intelligence Committee. After his retirement from the FBI, Stan declined repeated requests for an OIG interview. The OIG does not have authority to subpoena individuals and cannot compel former Department of Justice employees to submit to an interview. 197 Initially the asset was not paid. In July 2003, the asset was given a $100,000 payment and closed as an asset. 261 periods, he would talk to the asset several times per day, but there were periods in which he did not talk to him for several weeks or months. Stan said that many of their conversations were about family matters, the informational asset’s health, and other non-substantive issues. In 1996, the asset began renting out rooms in his home. Prior to September 11, 2001, he had 14 different boarders in his house, including Hazmi and Mihdhar. When Hazmi and Mihdhar rented rooms from the asset in 2000, two other persons also were renting rooms there. b. Information from asset on Hazmi and Mihdhar It is not clear what information the asset provided to the FBI about Hazmi and Mihdhar before the September 11 attacks. After the September 11 attacks, the FBI interviewed the asset and asked about the conduct and activities of Hazmi and Mihdhar while they were living with the asset. In those interviews, the asset described them as quiet tenants who paid their rent. He said they were good Muslims who regularly prayed at the mosque. The asset said that Hazmi and Mihdhar often would go outside when using their cellular telephones. The asset insisted that he noted no indicators of nefarious activity by Hazmi or Mihdhar that should have resulted in his reporting their identities to the FBI.198 The asset was asked what information he provided to Stan about Hazmi and Mihdhar before September 11. In these interviews, the asset provided conflicting accounts regarding the information on Hazmi and Mihdhar that he had disclosed to Stan. The agent who interviewed the asset - this agent had taken over as the asset’s control agent after Stan’s retirement from the FBI - told us that the asset said he told Stan about his boarders in general terms, although he had not fully identified Hazmi and Mihdhar. The control agent said that the asset later said that he had not told Stan about the boarders at all. 198 The FBI opened an investigation after September 11 to determine whether the asset was involved in the attack. The asset has consistently maintained after September 11 that he had no suspicions about Hazmi and Mihdhar. The results of a polygraph examination on his potential role were inconclusive. Based on its investigation, however, the San Diego FBI concluded that the informational asset had not been complicit in plotting the attacks. 262 Although Stan declined to be interviewed by the OIG, after September 11, his FBI supervisors had interviewed him about the asset. Stan also had discussed the asset with co-workers and was interviewed by, and subsequently testified in, a closed session before the Joint Intelligence Committee.199 Stan reported that the asset had told him contemporaneously that two Saudi national visitors were residing in a room at his residence. Stan said that the asset merely provided the first names of the boarders, Nawaf and Khalid. Stan contended that he had asked the asset for the boarders’ last names but never received them and did not follow up. He said that the asset told him that his boarders were in the U.S. on valid visitors’ visas, and they planned to visit and to study while they were in the country. In addition, Stan said that the asset told him that he believed that the two boarders were good Muslims because of the amount of time that they spent at the mosque. Stan stated that he did not recall the asset ever telling him that either of the boarders had moved out. According to Stan, the asset did not describe his boarders as suspicious or otherwise worthy of further scrutiny. Stan reported that he never obtained Hazmi and Mihdhar’s full identities from the asset and that he did not conduct any investigation of them. 5. OIG conclusion In sum, the FBI did not obtain information about Mihdhar’s and Hazmi’s time in San Diego, either as a result of the Bayoumi preliminary inquiry or from the asset. In the analysis section of this chapter, we evaluate Stan’s actions with regard to Hazmi and Mihdhar and whether he should have pursued additional information about who was living with one of his assets. C. Mihdhar’s association with Khallad, the purported mastermind of the Cole attack The third potential opportunity for the FBI to acquire information about Hazmi and Mihdhar occurred in January 2001, when a joint FBI/CIA source identified an al Qaeda operative in photographs of the January 2000 Malaysia meetings that Hazmi and Mihdhar had attended. However, the FBI has 199 The OIG was permitted to review the transcripts of Stan’s testimony before the Joint Intelligence Committee’s Inquiry. 263 asserted that it did not learn of the source’s identification of the al Qaeda operative at the Malaysia meetings until much later in 2001, just before the September 11 attacks. This section of the report describes the events surrounding this third opportunity for the FBI to focus on Hazmi and Mihdhar. 1. Background In 2000, the CIA and the FBI began debriefing a source who provided significant information on operatives and operations related to Usama Bin Laden. The source gave the CIA and the FBI information about an al Qaeda operative known as “Khallad” and described him as being involved with the East African embassy bombings in August 1998. Shortly after the U.S.S. Cole was attacked in October 2000, the CIA and the FBI received a photograph and information that a man named “Khallad” was the purported mastermind behind the attack on the Cole. In December 2000, the CIA and the FBI showed the source the photograph of Khallad, and the source identified the person in the photograph as the same Khallad he had described as involved with the East African bombings. As part of the Cole investigation, the FBI sought to find Khallad. In January 2001, the source was shown photographs from the Malaysia meetings in an effort to determine whether Khallad was in the photographs. The source identified Khallad in one of the photographs, thus connecting the purported mastermind of the attack on the Cole with the Malaysia meetings known to have been attended by Mihdhar and others.200 FBI officials told the OIG, however, that the FBI was not aware of the identification of Khallad in the Kuala Lumpur photographs. The FBI officials said that if they had known that Khallad – the purported mastermind of the Cole attack who they were seeking to find – was identified in the Kuala Lumpur photographs, they would have aggressively pursued information on the circumstances of the Malaysia meetings and the other participants, including Mihdhar. As a result, they said, they may have uncovered earlier the CIA’s 200 Information developed after September 11, 2001, revealed this was a misidentification, and the person identified as Khallad was actually Hazmi. We discuss this misidentification in detail below. 264 information about Mihdhar and Hazmi and found them in the United States well before the summer of 2001. On the other hand, the CIA has contended the FBI in fact was aware in January 2001 of the source’s identification of Khallad from the Kuala Lumpur surveillance photographs. For example, on September 26, 2002, Cofer Black, who served as Director of the CIA’s CTC from 1999 until May 2002, testified before the Joint Intelligence Committee: FBI agents and analysts had full access to information [the CIA] acquired about the Cole attack. For example, we ran a joint operation with the FBI to determine if a Cole suspect was in a Kuala Lumpur surveillance photo. I want to repeat – it was a joint operation. The FBI had access to that information from the beginning. More specifically, our records establish that the Special Agents from the FBI’s New York Field Office who were investigating the USS Cole attack reviewed the information about the Kuala Lumpur photo in late January 2001. We therefore examine in detail the evidence relating to whether the FBI was aware of the identification of Khallad in the photographs of the Malaysia meetings. 2. Source’s identification of Khallad a. The source In mid-2000, Drug Enforcement Administration (DEA) personnel arranged for FBI Legal Attaché (Legat) Office personnel overseas to meet a source who had substantial information on Bin Laden and his operatives and operations. This particular FBI Legat office was staffed by the Legal Attaché (the “Legat”) and the Assistant Legal Attaché (the ALAT), who were FBI Special Agents.201 (continued) 201 The primary mission of FBI Legat Offices is to establish liaison with foreign law enforcement agencies to support the FBI’s investigative activities overseas. While Legat staff may become involved in specific investigations, they have no law enforcement authority in foreign countries. For a description of the role and responsibilities of FBI 265 Because of the FBI Legat personnel’s inability to converse in any of the source’s languages, limits on the FBI’s authority to conduct unilateral intelligence activities overseas, and the source’s potential value as a source of intelligence information relevant to the CIA, the FBI contacted the CIA for assistance with the source. The source was subsequently handled as a joint FBI/CIA source. Even though the FBI ALAT – who we call “Max” – was unable to directly communicate with the source due to the lack of a common language, he was designated as the FBI control agent for the source. Because the source had significant information about Bin Laden and his operatives and operations, the FBI New York Field Office – the office that was leading the investigations on the East African embassy bombings, the Cole attack, and other Bin Laden-related investigations – also became involved with the source. This joint handling of the source created concerns within the CIA. The CIA’s most significant concern was the FBI’s desire to use the source for the criminal investigations involving Bin Laden conducted by the FBI’s New York Field Office. The CIA believed that the source should not face possible exposure in criminal proceedings. CIA Headquarters was asked to work with FBI Headquarters to convert the source to purely an intelligence role, solely under CIA control. According to CIA documents, the CIA and the Legat had discussed the FBI’s “wall” whereby separate but concurrent intelligence and criminal investigations were conducted within the FBI, but the CIA expressed concerns about the CIA’s ability to continue clandestine handling of the source if the FBI was involved. Although the CIA acknowledged that the source had value to the FBI’s criminal case, the CIA argued that the source’s potential as an intelligence asset was more important then his potential assistance in the criminal case. Despite the CIA’s concerns, the source remained a joint FBI/CIA asset. b. Debriefings of the source Beginning in 2000, the CIA and FBI began to debrief the source on a regular basis. Over the course of several months, the source frequently was (continued) Legats, see the OIG report entitled, “Federal Bureau of Investigation Legal Attaché Program” (March 2004). 266 shown photographs and asked to identify people in them. Although Max was the source’s designated control agent, a CIA officer who spoke one of the source’s languages conducted the debriefings. Max was present for some of these debriefings, but not all. Some of the debriefings were unilateral CIA interviews. The time spent with the source was kept short because of issues of travel and security. According to Max, during the debriefings the CIA officer usually did not immediately translate the source’s statements for the benefit of Max. He said that the CIA case officer would only immediately translate something when Max had specific questions for the CIA officer to ask the source. The CIA case officer told the OIG he recalled translating for Max things that the source said, but he did this only when he recognized the significance of the information to Max or an FBI operation. In an effort not to duplicate the reporting of information received from the source, the CIA and the FBI agreed that the CIA would be responsible for reporting the information from the debriefings. However, in instances where the source was solely being shown FBI photographs or questioned based on an FBI lead, Max would document the source’s information, either in an EC or an FBI FD-302 form, and the CIA would not document the same information. After the debriefings, the CIA officer would write internal cables covering the debriefings and forward them to the CTC and other appropriate offices. These cables were internal CIA communications and were not provided to or shared with Max or other FBI personnel.202 Instead, Max and FBI Headquarters would be informed of the debriefings when the information was reported by the CIA in a TD. As previously discussed, TDs were prepared by CIA reports officers who reviewed the internal cables and determined what information needed to be disseminated and to which agencies. Based on our review of internal cables reporting the source’s debriefings and the TD reporting of the same interviews, it is clear the TDs often contained only a part of the information obtained during the source debriefings. As a result, either 202 As discussed above, FBI detailees to the CTC had access to these CIA cables, but the review and dissemination of source information to the FBI was not considered their responsibility. 267 through direct knowledge or through the TDs, Max had access to only some of the information obtained from the source during the debriefings. In addition to the debriefings of the source by the CIA case officer, FBI agents from the New York Field Office working Bin Laden-related criminal investigations also interviewed the source with the CIA case officer present. Max occasionally was present for these interviews. After each of these interviews, the New York agents documented the source’s information in detail in an FD-302 that was entered into ACS and retrievable by all FBI personnel working on the Bin Laden cases.203 These FD-302s were routinely shared with CIA personnel in the field and at the CTC. c. Source identifies Khallad from Yemeni-provided photograph Over a 3-month period in 2000, FBI New York Field Office personnel interviewed the source overseas four times. During one of these interviews, the source described an individual known as “Khallad” as a trusted senior Bin Laden operative with potential connections to the East African embassy bombings. As noted above, on October 12, 2000, two terrorists in a boat laden with explosives committed a suicide attack on the U.S.S. Cole, a U.S. naval destroyer, during its brief refueling stop in the port in Aden, Yemen. The FBI’s investigation into the attack was led by the FBI’s New York Field Office. After the attack on October 12, the Yemenis provided the FBI and the CIA with information on the Bin Laden operative known as “Khallad.” According to this information, Khallad had been described as the purported mastermind of the Cole attack. U.S. intelligence agencies had already 203 When a witness is interviewed as part of a criminal investigation, the FBI prepares an FD-302 to document what was said in the interview. When information is being obtained as part of an intelligence investigation, the FBI documents the information in an EC. There was often a significant lag time between the interview and the completion of the documentation due to a variety of factors, including the intensity of investigative activity, the agents’ extensive travel, and the required review of the documentation by FBI supervisors before dissemination. 268 connected Khallad to the East African embassy bombings. The Yemenis also identified “Khallad” as Tawfiq Muhammad Salih Bin Rashid al Atash. On November 22, 2000, the Yeminis provided the FBI with a photograph of Khallad (“the Yemeni-provided photograph”). Around this same time, the Yemenis provided the FBI with several photographs of other Cole suspects. The New York FBI agents investigating the Cole bombing wanted to determine whether the Khallad identified by the Yemenis was the same Khallad who had been previously described by the source. At the same time, a CIA internal cable to was sent to several CIA offices suggesting that the photographs of the Cole suspects that the FBI had obtained from the Yemenis, including the Khallad photograph, be shown to the source. Because the FBI did not have the technological capability to easily transmit the Khallad photograph from Yemen to the ALAT who was handling the source and who we call Max, the photograph was forwarded through CIA channels to the nearby CIA office in order to show the photograph to the source.204 CIA documents show that on December 16, 2000, the CIA officer conducted a debriefing of the source. Max was present for the debriefing. 205 During the debriefing, the CIA case officer showed the source many photos of Cole bombing suspects and other suspected Arab terrorists, including the Yemeni-provided photograph of Khallad. The source immediately identified the individual in the Yemeni-provided photograph as the same Khallad he had previously described as a trusted senior Bin Laden operative with potential connections to the East African embassy bombings. The CIA officer prepared a cable documenting the debriefing, which was addressed to several CIA offices. The CIA officer wrote in the cable that the source was shown the many photographs and “quickly” identified Khallad in 204 Max told the OIG that at the time he and the CIA case officer believed that this photograph had come from the FBI’s New York Field Office. Max added that it was not uncommon for him not to know the source of photographs that were shown to the source and that the source was shown hundreds of photographs. 205 Although FBI agents from New York had traveled overseas several times in 2000 to interview the source, in December 2000 the agents with the appropriate language abilities were tied up in Yemen after the Cole attack and were unable to travel to debrief the source. Therefore, the FBI relied on the CIA to conduct this debriefing. 269 the Yemeni-provided photograph. Notably, the CIA cable stated that the CIA officer had the source repeat the identification specifically for the benefit of Max. In addition, the cable stated that before the debriefing ended, the CIA officer again showed the photographs to the source and asked the source to verify the Khallad identification. Max acknowledged to the OIG that he was contemporaneously aware of the identification of Khallad in the Yemeni-provided photograph by the source on December 16. Max stated that he recalled specific circumstances of the debriefing and recounted them to us. Max told us that he recalled the source immediately identifying Khallad in the photograph. d. CIA suspects that Khallad may be Mihdhar in Kuala Lumpur surveillance photographs Around this same time, CIA personnel were beginning to connect Khallad with Mihdhar and the January 2000 Malaysia meetings. In a December 2000 cable, CIA personnel overseas asked for copies of the January 2000 Kuala Lumpur surveillance photographs of Mihdhar. The cable noted that further connections had been made between Mihdhar and Al Qaeda. As a result of these further connections, the CIA believed there might be a connection between Mihdhar and the Cole perpetrators. The CIA office reported in the December 2000 cable that the it had learned that Fahd al Quso, who was in Yemeni custody for his participation in the Cole attack, had received $7,000 from someone named Ibrahim, which Quso had taken to Bangkok, Thailand, on January 6, 2000, to deliver to “Khallad,” a friend of Ibrahim’s. It was noted in the cable that because Mihdhar had departed Kuala Lumpur around that same time to travel to Bangkok, the CIA suspected that the “Khallad” mentioned by Quso could actually be Khalid al Mihdhar or one of his associates.206 It was noted further that this information had “added significance” because Khallad had been 206 As previously discussed, the CIA had reported previously in an internal March 2000 cable that Mihdhar, Hazmi, and another individual had left Malaysia on January 8, 2000, and traveled together to Bangkok. 270 identified as a “key operative likely serving as an intermediary between Usama Bin Laden and the [Cole] perpetrators.” In another December 2000, cable the CTC concurred with the overseas CIA office’s theory and forwarded a Kuala Lumpur surveillance photo of Mihdhar to the CIA case officer to show to the source. According to the cable, the purpose was “to confirm/rule out this particular Khalid [Mihdhar] as a match for [Khallad].”207 The next day, the CIA officer received permission to show the Kuala Lumpur surveillance photographs to the source. Max told the OIG, however, that he was not aware of the CIA cables or the theory that Khallad was actually Mihdhar. We found no other evidence that Max knew about the information that Mihdhar was at the Malaysia meetings, or the CIA’s theory that Khallad was actually Mihdhar.208 e. Source identifies Khallad from Kuala Lumpur photograph The CIA case officer debriefed the source again in early January 2001. At some point, the CIA case officer showed the source photographs, including two of the surveillance photographs taken during the January 2000 Malaysia meetings. One of the photographs from the Malaysia meetings, which we call 207 The CIA cable referred to its forwarding of only one Kuala Lumpur surveillance photograph, although subsequent cables showed that the receiving office received two Kuala Lumpur photographs to show the source. It is unclear why the sending office sent only two of the photographs instead of all three of the Kuala Lumpur photographs it had. 208 In fact, CIA cables suggest this information was not shared with the FBI. We saw several CIA cables during this time that discussed working with the FBI in relation to the FBI’s investigation of the Cole attack. For example, we saw a December 2000 cable stating that the FBI had provided an update on its investigation of the location associated with telephone numbers the CIA had provided to the FBI in connection with an investigation, and the office that drafted the cable asked to be advised of whether the two offices to whom the cable was addressed were aware of additional information that could assist the FBI. However, we saw another December 2000 cable, which discusses Khallad and other information not related to Khallad, which specifically instructed two CIA offices to share with the FBI the other information in the cable that was not related to Khallad, but it did not instruct the offices to share the information regarding the possible connection of the Malaysia meetings and Khallad. 271 “Photo No. 1” included an unknown subject. The source identified one of the individuals in this photograph as Khallad. According to a January 2001, cable written by the CIA case officer, the source was asked if he was sure, and he replied that he was “ninety percent” certain.209 The second photograph from the Malaysia meetings, which we call “Photo No. 2,” contained a picture of the person the CIA knew to be Mihdhar. The source could not identify the person in the photograph.210 However, the source’s identification of Khallad in the first photograph was significant. First, the source previously provided information that Khallad was a Bin Laden operative who was connected to the Cole attack and the East African embassy bombings. Second, as a result of the identification, it was suspected that Khallad was at the Malaysia meetings along with other suspected al Qaeda operatives. From other information, it also was known that Mihdhar was at the meetings, and it was suspected that Hazmi was there also. Thus, the source’s identification of Khallad at the Malaysia meetings raised the question whether Mihdhar and Hazmi also were linked to the Cole attack. We tried to determine if the FBI’s ALAT learned of the source’s identification of Khallad in the photograph. Max told the OIG that he did not specifically recall the early January 2001 debriefing of the source. He stated he also did not recall being aware of any early January 2001 identification of Khallad from the Kuala Lumpur surveillance photographs. In addition, Max asserted he was not aware of the Malaysia meetings and the photographs until he was questioned about them by the JICI staff on June 27, 2002. The CIA case officer told the OIG that he had no independent recollection of any particular meeting with the source, including the meeting in early January 2001. 209 As noted above, information developed after September 11, 2001, revealed this was a misidentification, and the person identified as Khallad was actually Hazmi. 210 This failure to identify Khallad in the photograph known to be of Mihdhar should have ended the theory that Mihdhar and Khallad were the same person. 272 f. Documentation regarding the source’s identification of Khallad in the early January 2001 debriefing (1) CIA cables To examine whether the FBI learned of the source’s identification of Khallad in the Kuala Lumpur photographs, we reviewed the CIA documentation concerning the meeting with the source in early January 2001. In an internal cable written the day after the debriefing, the CIA case officer reported that the source had identified Khallad in one of the Kuala Lumpur photographs with a “ninety percent” certainty. However, unlike in the December 2000 CIA cable, which stated that the CIA officer had the source repeat the identification of Khallad in the Yemeni-provided photograph to Max, the January 2001 cable did not suggest the identification was repeated for Max or was brought to the attention of Max. The January 2001 cable did not provide any other details about the debriefing, such as where the meeting took place, when exactly during the debriefing the photographs were shown to the source, who was present when the photographs were shown to the source, or what other topics were discussed with the source. We also reviewed a detailed January 2001 CIA TD to the Intelligence Community regarding the early January 2001 debriefing. The TD reported specifics about what the source discussed and that he had provided a stack of documents to his CIA and FBI handlers. The TD made no mention of any photographs being shown to the source or any identification of Khallad.211 A few days later, the CIA case officer wrote another cable describing the logistics of the early January 2001 meeting with the source. In addition, the cable summarized what was discussed during the meeting. This cable also did not mention the photographs being shown to or discussed with the source, but the CIA case officer told the OIG that these kinds of cables were not always comprehensive with respect to the information obtained from the source. 211 Although no witness can recall the details of this particular debriefing, it is possible that Max, who lacked the appropriate language skills for a debriefing, either photocopied or hand wrote the information from the documents thus explaining his absence at the time that the photographs were shown to the source. 273 (2) FBI documents We also reviewed FBI documents from this period relating to the source. On January 9, 2001, a New York FBI agent who was the FBI’s lead case agent on the Cole investigation sent Max an e-mail stating that he and his co-case agent wanted to meet with the source to talk about some of the Cole suspects, including Khallad. The New York agent wrote that he was “specially [sic] interested in all [the source] knows about Khallad and his associates.” The agent noted that the source previously had given the agents important information regarding Khallad and the Cole attack. In a January 10 e-mail response, Max referred to the December 16 meeting with the source in which the source had been shown many photographs and had immediately identified the Yemeni-provided photograph as Khallad. Max also mentioned the early January 2001 meeting, summarizing specific information provided by the source in the debriefing. Max wrote that, due to the lack of technological capabilities in the Legat Office, he promised to make the CIA TD numbers relating to the source available to the case agent within a few days so the agent could read them before his trip to interview the source. However, Max made no mention of any identification of photographs by the source in the early January 2001 debriefing. Around the same time as this e-mail exchange, Max was criticized by the head of the FBI’s UBL Unit at Headquarters for insufficient reporting regarding the source’s information. The UBL Unit chief wanted to know from Max what information the source was providing. She also was concerned because Max was not producing any reports regarding the source. In response, on January 16, 2001, Max wrote a 34-page EC summarizing the source’s debriefings and other information obtained from the source since mid-2000, most of which was based on the information that had been disseminated in the TDs by the CIA. Max explained in the EC that he merely was repeating what the CIA had previously reported in TDs, which had already been forwarded to FBI Headquarters. He noted the agreement with the CIA that there would not be duplicative reporting on the source’s information. He explained the CIA was doing the primary reporting on the source debriefings Max noted that the interview was conducted in the foreign language, and he would read the CIA’s report of the interview (the TD) once it was completed. 274 Max then listed all of the CIA’s TDs that summarized what the source had said. On page 29 of this January 16 EC, Max summarized the CIA’s reporting of what had occurred at the December 16, 2000, meeting with the source. The EC stated the source was handed a stack of many photographs and immediately identified the top photograph as a photograph of Khallad, the person the source had previously implicated in the attack on the Cole. The EC stated, “At that time it was the clear impression of [the Legat] and [the CIA officer] that both FBIHQ CTD and NYO were receiving all of the reporting above from CIA liaison in the U.S., as soon as it was being filed.” In the next paragraph of the EC, Max summarized what the CIA had reported in the TD about the early January 2001 debriefing of the source. This summary is contained on pages 29 through 33 of the EC. Max reported at length about the source’s information, and the EC provided a lengthy description of the documents provided by the source. Again, there was no mention of any photographs from the Malaysia meetings or the identification of Khallad. Max discussed with the CIA case officer the complaint from FBI Headquarters about Max’s reporting on the source. As a result, the CIA case officer provided Max with a report of the next debriefing of the source in late January 2001. The day after this debriefing, Max prepared a lengthy EC summarizing this debriefing. He noted in the EC that the report was based on the CIA’s report of an interview conducted by a CIA officer and, although Max was present for the debriefing, he only became aware of what was said after the CIA officer provided the report.212 212 Around the same time, the CIA officer sent a cable to CIA Headquarters that described the FBI’s need for reporting directly through FBI channels, as opposed to CIA channels. The CIA office then asked permission to provide electronic copies of TDs to Max so that Max could send the same reporting through FBI channels. 275 g. New York FBI agents’ interview of source on February 1, 2001 Around the same time, Max was preparing for the arrival of the Cole case agent from the FBI’s New York Field Office. The Cole case agent was traveling to interview the source about Khallad, along with another FBI agent who spoke one of the languages of the source and was going to assist in the preparation of the FD-302 for the criminal investigation. Max had received a January 17 e-mail from one of the Cole agents stating that the information being provided by the source was very important to the FBI’s criminal investigation of the Cole attack and discussing the arrangements for the upcoming interview of the source by the Cole agents. The New York Cole agents also asked Max to prepare an FD-302 documenting Max’s personal knowledge of the source’s identification of Khallad from the Yemeni-provided photograph on December 16. On January 24, 2001, Max sent an EC to the New York Field Office and FBI Headquarters with an attached FD-302 regarding the source’s December 16, 2000, identification of Khallad. On February 1, 2001, the New York Cole case agent and another agent who spoke one of the source’s languages interviewed the source overseas.213 The CIA case officer who had shown the Kuala Lumpur photographs to the source in early January was also present at the interview. During the interview, they showed the source the Yemeni-provided photograph of Khallad, which previously had been shown to the source by the CIA officer on December 16, 2000. The source again identified Khallad in the photograph. As discussed above, the agents had received information indicating that Quso, who was in custody for his participation in the Cole attack, had traveled to Bangkok and met Khallad in January 2000. The New York agents were investigating the circumstances of that trip. The agents knew that Quso previously had claimed that he had intended to meet Khallad in Malaysia. The 213 In anticipation of the Cole agents’ interview of the source, the CIA case officer had sent a cable asking the Bin Laden Unit to touch base with FBI Headquarters regarding the case status and the planned trip of the New York FBI agents. The CIA case officer noted that the source was “currently of very high interest to our [FBI] colleagues.” 276 agents were concerned about Quso’s veracity and whether Quso, as well as Khallad, had actually traveled to Malaysia. Therefore, an identification of Khallad in Malaysia during this period would have been very significant to the agents. Both FBI agents who participated in the February 1 debriefing of the source told the OIG that they were not informed about surveillance photographs of the Malaysia meetings, that they did not know such photographs existed, and that they did not show any such Kuala Lumpur photographs to the source. They stated that they were not told that the source had identified Khallad from a Kuala Lumpur surveillance photograph in early January. They added that if they had been aware of any such identification of Khallad, they would have wanted to have the source repeat the identification for them since Khallad was a subject in the Cole criminal investigation.214 However, they stated that they were never informed of such an identification. 3. OIG conclusions regarding whether the FBI was aware of the source’s identification of Khallad in the Kuala Lumpur photograph We concluded that the evidence shows that the FBI was not made aware that during the early January 2001 debriefing the source identified Khallad in the photographs of the Malaysia meetings. Max insisted in his interviews with us that he was unaware of this identification of Khallad and that he was not even aware of the existence of the Kuala Lumpur surveillance photographs until after the September 11 attacks. Neither Max nor the CIA case officer specifically recalled the early January debriefing, but the documentary evidence supports this conclusion. In numerous CIA and FBI documents discussing the source and the early January debriefing, other important information from the source is described, but the source’s identification of Khallad in the Kuala Lumpur photograph is never mentioned. Given the importance of that identification and the other details reported in the 214 The CIA’s Review Group has also asserted that the FBI may have received the Kuala Lumpur photographs from another source. The CIA did not refer to any witnesses for this claim but instead referred to a series of CIA cables and FBI documents. Our review of the cables and other documentary evidence did not support this claim. 277 documents, we believe such information would have been included had the FBI been made aware of the identification. For example, as described above, in the CIA case officer’s cable reporting the December 16 debriefing of the source during which the source had identified Khallad in the Yemeni photograph, the CIA officer specifically noted that ALAT heard the identification and that the identification was repeated for the benefit of him. Max said he recalled this debriefing and the identification of Khallad being brought to his attention by the CIA case officer. By contrast, in his cable reporting the early January source debriefing, the CIA case officer did not state that he brought to the attention of Max the identification of Khallad in the Kuala Lumpur photographs. Likewise in his cable describing the logistics of the debriefing, the CIA case officer provided a description of what was discussed with the source and stated that Max was present for a significant portion of the meeting with the source, but did not mention any Kuala Lumpur photographs or that the CIA case officer had brought the identification of Khallad to the attention of Max. The documents prepared at the time by Max about the early January debriefing also suggest that Max was not aware of the identification of Khallad in the Kuala Lumpur photographs. For example, in response to the Cole case agent’s January 9 e-mail specifically requesting “all [the source] knows about Khallad,” Max did not include any information about the Khallad identification from the Kuala Lumpur photographs. This was shortly after the early January debriefing, and the case agent had specifically indicated his interest in any information about Khallad. Max’s January 16 EC to FBI Headquarters in which he described at length what the source had reported in the early January meeting also did not mention the identification of Khallad or that any Kuala Lumpur photographs were shown to the source. In addition, Max prepared an FD-302 to document the source’s identification of Khallad from the Yemeni photograph to provide documentation for the criminal investigation. We believe that if Max had known of the source’s identification of Khallad in the Kuala Lumpur photos, he likely would have prepared a similar FD-302 of that identification as well. We also found that the New York Field Office agents who interviewed the source overseas in February 2001 were not made aware of the early January identification of Khallad. The agents insisted that they were completely 278 unaware that any Kuala Lumpur surveillance photographs had been shown to the source or that the source had identified Khallad in any photographs other than the Yemeni-provided photograph. In addition, we found no documentary evidence that the New York FBI agents were even aware of the Malaysia meetings or the resulting surveillance photographs at the time they interviewed the source. Because the agents were keenly interested in Khallad and had asked the source to confirm his identification of Khallad from the Yemeni photograph, we believe the agents would have noted, remembered, and acted upon any information regarding another Khallad identification. We also believe that had the FBI known about the identification of Khallad in the Kuala Lumpur photographs, they would likely have sought information about the other participants in the meeting, including Mihdhar and Hazmi, which could have increased the FBI’s chances of locating them before the September 11 attacks. Due to the OIG’s lack of complete access to CIA employees and documents, we were unable to fully examine why the CIA did not inform Max or the New York agents that the source had identified Khallad in the Kuala Lumpur photographs at the early January debriefing. We believe the FBI should have been made aware that the joint FBI/CIA source had provided such significant information about the person purported to be the mastermind behind the Cole attack. This failure demonstrated significant problems in communication between the FBI and the CIA. However, the FBI employees’ inaccurate belief that CIA reporting in TDs was comprehensive contributed to the FBI’s failure to obtain this critical piece of information. We discuss this and other systemic problems that this case revealed in the analysis section of this chapter. D. FBI and CIA discussions about the Cole investigation in May and June 2001 The fourth opportunity for the FBI to have acquired intelligence information about Hazmi and Mihdhar – including Mihdhar’s possession of a U.S. visa, Hazmi’s travel to the United States, and the source’s identification of Khallad from the Kuala Lumpur photographs – occurred in May and June 2001 when the CIA and FBI Headquarters discussed the status of their information concerning the Cole attack. Once again, these discussions could have caused the FBI and the CIA to focus on the other persons attending the Malaysia 279 meetings with Khallad, and thereby led the FBI to search for Mihdhar and Hazmi earlier than it did. But, as we describe below, the FBI did not obtain the critical information about the identification of Khallad at the Malaysia meetings, despite several interactions in May and June 2001 between the FBI and the CIA about Khallad. 1. Background a. The Cole investigation As discussed above, the FBI’s investigation on the Cole attack was led by the FBI’s New York Field Office.215 One of the case agents investigating the Cole attack was an agent who we call “Scott,” and who was assigned to the New York FBI’s counterterrorism squad that handled only al Qaeda investigations (the “Bin Laden squad”).216 After serving eight years in the U.S. Navy as a fighter pilot, in April 1996 Scott became a special agent in the FBI’s New York Office. In July 1996 he was assigned to the TWA Flight 800 investigation because of his experience as a military pilot. Shortly after the East African embassy bombings in August 1998, he was transferred to the New York’s Bin Laden squad to assist with the embassy bombings investigation, and then was assigned as one of the case agents on the investigation the Cole attack. The New York FBI was assisted on the Cole investigation by several Intelligence Operations Specialists (IOS) assigned to the UBL Unit and the Radical Fundamentalist Unit (RFU) at FBI Headquarters. One of the primary IOSs who worked on the Cole investigation was an IOS who we call “Donna.” She had joined the FBI in 1988 as a clerk while she completed her college education. After graduating from college in 1995, she entered the FBI’s language training program and became a Russian language 215 Through their work on the 1993 attack on the World Trade Center and the subsequent discovery of the terrorist plot to attack New York landmarks, the New York FBI became the primary office for the investigation of al Qaeda, eventually leading to the indictment of Bin Laden in the Southern District of New York in November 1998. 216 The other primary case agent on the Cole investigation was out of the country during the events discussed in this section of the report. 280 specialist working on foreign counterintelligence matters. In November 1997, she became an Intelligence Research Specialist (IRS), and a year later was assigned to assist the RFU on the East African embassy bombings investigation. In 2000 she was permanently assigned as an IOS in the UBL Unit and was assigned to work on the Cole investigation in October 2000. With regard to Donna’s work on the Cole investigation, she stated that she and the other UBL Unit IOSs conducted the investigation as directed by the New York Field Office, sent out requests for information to other law enforcement and intelligence agencies, obtained budget enhancements to support the investigation, and performed other duties in support of the investigation. She and the other UBL IOSs often traveled to New York where they met with the Cole agents and worked on the investigation. b. The wall and the caveat on NSA information The information relevant to this section of the report includes NSA information disseminated about Mihdhar in late 1999 and early 2000. As noted in Chapter Two, by the summer of 2001 NSA counterterrorism intelligence information could not be disseminated within the FBI without adhering to certain procedures and protocols. At this time, the FBI was required by the Department and the FISA Court to keep criminal investigations separate from intelligence investigations, a policy which was commonly referred to as “the wall.” Information obtained from FISA intercepts and search warrants had to be screened by someone not involved in the criminal investigation and then “passed over the wall” from the intelligence investigation to the criminal investigation. The FISA Court became the screening mechanism for FISA information obtained from al Qaeda intelligence investigations that the FBI wanted to pass to criminal investigators. As described in Chapter Two, in response to notification that there had been many errors in FISA applications approved by the FISA Court, the Court imposed additional restrictions before information could be shared. First, based on the FISA Court’s concerns about the errors in the FISA applications, the FBI directed that only intelligence agents were permitted to review FISA intercepts and materials seized pursuant to a FISA warrant (called “FISAobtained material”) or any CIA and NSA intelligence provided to the FBI based on information obtained through FISA search or intercept (called “FISAderived” material) without further Court approval. The Court required anyone 281 who reviewed the FISA-obtained or FISA-derived intelligence to sign a certification acknowledging that the Court’s approval was required for dissemination to criminal investigators. Because FISA-obtained information often was passed from the FBI to the NSA and the CIA, the question was raised to the FISA Court whether the FBI was required to obtain certifications from all NSA or CIA employees who reviewed the FISA-obtained material. The Court exempted the NSA and CIA from the certification but required that the two agencies note on any intelligence shared with the FBI if it was FISA-derived. This was referred to as “a caveat.” When made aware of this requirement, the NSA reported to the Department of Justice that for the NSA to determine in real-time which counterterrorism intelligence that it had acquired was FISA-derived would delay dissemination of the information. As a result, the NSA decided to indicate on all its counterterrorism intelligence provided to the FBI as being FISA-derived so that it could not be disseminated to criminal agents or prosecutors without approval from the NSA.217 Therefore, when the FBI wanted to pass this NSA intelligence to criminal investigators, it had to contact the NSA General Counsel’s Office to determine whether the information was in fact FISA-derived before it could be passed.218 2. Discussions in May 2001 In May 2001, the potential connection of Khallad to the Malaysia meetings was again discussed by CIA personnel. FBI personnel also discussed Khallad in reference to his nexus to the Cole attack. There were also 217 According to the NSA, its average response time to FBI requests for approval to pass information to criminal investigators was one to five business days. 218 The NSA information concerning Hazmi and Mihdhar was from late 1999 and early 2000, and contained the initial caveat stating that information could not be disseminated to law enforcement officials without approval from OIPR. By the time FBI Headquarters was dealing with this information in the summer of 2001, the new caveat was being placed on NSA reporting, and FBI Headquarters was operating under the understanding that the NSA General Counsel had to approve dissemination of NSA counterterrorism information to criminal investigators. 282 discussions between the CIA and FBI in reference to the Kuala Lumpur photographs. But, as described below, the identification of Khallad in the Kuala Lumpur photographs and Khallad’s connection to other suspects, such as Hazmi and Mihdhar, were not addressed during these May discussions between the FBI and the CIA. a. John’s inquiries about Khallad Between the early January 2001 debriefing of the source and May 2001, the CIA’s focus on whether Khallad, the suspected mastermind behind the Cole attack, had attended the Malaysia meetings appears to have subsided. In May 2001, John, a former Deputy Chief of the Bin Laden Unit, who by that time was detailed to ITOS in FBI Headquarters, had continuing concerns about the Malaysia meetings, especially whether they had any nexus to the Cole attack.219 John also noted to the OIG that during this period there were heightened concerns in the Intelligence Community about the threat of an imminent terrorist attack in Southeast Asia. CIA records show that on May 15, 2001, John accessed the March 2000 cable stating that Mihdhar, Hazmi, and another person had traveled to Bangkok from Malaysia on January 8, 2000. The cable also stated that Hazmi had left Bangkok on January 15, 2000, flying from Bangkok to Hong Kong and then to Los Angeles. Around this same time in May, John began inquiring about the Malaysia meetings with a CTC analyst, who we call “Peter,” at CIA Headquarters. John said he knew that Peter had been “down in the weeds” and knew the “nuts and bolts” of the Cole investigation because Peter had been assigned to prepare a CTC report on who was responsible for the Cole attack. Peter told the OIG that his area of expertise and focus since August 1999 was the Arabian Peninsula. He said that because the Cole attack took place in Yemen, he was assigned to develop an intelligence report on who was 219 John told the OIG that in this detail to the FBI he acted as the CIA’s chief intelligence representative to ITOS Section Chief Michael Rolince. John stated that he did not have line authority over anyone at the FBI and that his primary role was to assist the FBI in exploiting information for intelligence purposes. 283 responsible for the Cole attack. He completed his report in January 2001, finding that UBL/al Qaeda was circumstantially tied to the attack.220 Peter stated that while working on the Cole report he regularly interacted with the IOSs in the FBI’s UBL Unit. By the spring 2001, he was no longer working directly on the Cole attack, and had moved on to potential threats in Saudi Arabia and Yemen. However, Peter said he had a continued interest in the Cole information and continued to gather information on an ad hoc basis. According to John, he and Peter discussed the Malaysia meetings, and Peter provided him with a copy of the timeline of events related to the Cole investigation that Peter had compiled as part of his work on the Cole attack.221 In addition, John said they discussed Quso, a Cole perpetrator in Yemeni custody, and any connections Quso may have had with the individuals in Malaysia. John and Peter were aware that Quso had stated that he was supposed to take money to a person named “Khallad” in Malaysia but had met him in Bangkok instead in January 2000. John told the OIG that Peter had posited that perhaps Quso had gone to Malaysia and met with the others who had been observed there in January 2000, and therefore Quso might have been in one of the Kuala Lumpur photographs. In an e-mail to Peter in mid-May 2001, John noted that Mihdhar had arranged his travel to Malaysia and was associated with “[another terrorist organization] courier travel at the same time.” John also noted in the e-mail that Quso, who was believed to be a courier since he had stated he had traveled to take money to Khallad, had traveled a few days earlier than Mihdhar.222 In addition, John wrote that he was interested because Mihdhar was traveling with two “companions” who had left Malaysia and gone to Bangkok, Los Angeles, and Hong Kong and “also were couriers of a sort.” John noted in the e-mail 220 The report did not mention Mihdhar’s visa, Hazmi’s travel to the United States or the Khallad identification from the Kuala Lumpur photographs. 221 The timeline did not mention the Kuala Lumpur photographs, Mihdhar’s U.S. visa, or Hazmi’s subsequent travel to the United States. 222 As previously discussed, after Quso was detained in Yemen, he acknowledged that he had received $7,000 from someone named Ibrahim, which Quso asserted he took to Bangkok, Thailand on January 6, 2000, to deliver to “Khallad,” a friend of Ibrahim’s. Mihdhar had traveled to Bangkok on January 8. 284 that “something bad was definitely up.” Peter replied in an e-mail dated May 18, “My head is spinning over this East Asia travel. Do you know if anyone in [the CIA’s Bin Laden Unit] or FBI mapped this?” b. Discussions among FBI and CIA employees Around this same time, FBI IOS Donna and other FBI IOSs working on the Cole investigation were focusing on Quso’s connection to Bangkok and his trip to deliver money to Khallad. The FBI, like the CIA, was aware that in January 2000 Quso had planned to travel to Malaysia to take money to Khallad. According to an FBI document drafted by Donna in May 2001, Quso had claimed that on January 6, 2000, he and Ibrahim Al-Nibras went to Bangkok first but were unable to travel on to Kuala Lumpur because of problems with their travel documents, and Khallad had traveled to Bangkok to meet them there instead. The FBI began researching telephone numbers that appeared to be connected to Quso’s trip and requested that several Legat Offices contact local law enforcement authorities to obtain subscriber information. Donna told the OIG that she and others were tracking the information related to the telephone numbers associated with Quso in an attempt to determine the truth of his statements. In addition, she said that she was focused on the identity and whereabouts of Khallad, since he was the purported mastermind of the Cole attack. At some point before the end of May 2001, John discussed with Donna the East Asian travel of Quso. In response to Peter’s May 18 e-mail that asked whether anyone had “mapped” the East Asia travel, John replied in an undated e-mail that “key travel still needs to be mapped” and stated “[Donna] sounds really interested in comparing notes in a small forum expert to expert so both sides can shake this thing and see what gaps are common.” In addition to reviewing the East Asia travel of several Bin Laden operatives in January 2000, John also began looking in CIA records for the Kuala Lumpur photographs. John obtained three of them. John told the OIG that he had not read the cable stating that the joint source had identified Khallad in the photographs, but he was aware that an identification of Khallad in the photographs had been made. At the end of his e-mail to Peter, John stated that he had obtained three surveillance photographs of Mihdhar in 285 Malaysia, but he did not see “Khallad” in any of the photographs, and he believed he was “missing something” or “someone saw something that wasn’t there.” John also questioned whether there was a cable somewhere that documented the identification of Khallad.223 In response to John’s e-mail, Peter wrote in an e-mail dated May 24 that he had thought one of the Kuala Lumpur photos was of Khallad. Peter added that Donna and another FBI IOS in the UBL Unit, who we call “Kathy,” were meeting with Peter on May 29 to discuss the Cole investigation. Peter suggested that he could raise the issue of the Kuala Lumpur photographs and the possible identification of Khallad with the FBI IOSs. Peter told the OIG that he had learned about the source’s identification of Khallad in the Kuala Lumpur photographs when it had occurred, but by May of 2001 it had been several months since he had worked on the Cole matter and he could not recall whether Khallad had been identified in the photographs. On May 24, Donna sent John an e-mail stating that a meeting with Peter and others was “tentatively scheduled” for May 29 for “an in depth discussion about the Cole.” We were unable to determine with certainty whether a meeting with Peter, Donna, and Kathy actually took place on May 29. None of the witnesses had notes of any such meeting, nor were there any e-mails discussing the meeting after it would have taken place. The witnesses told the OIG that they could not recall whether a meeting took place on May 29. For example, when asked whether she knew Peter, Kathy told the OIG that his name sounded familiar and that she may have met him, but she did not recall a meeting on May 29, 2001, about the Cole investigation. A May 29 e-mail from Peter to Mary indicates that he met with Mary earlier in the day, but it does not identify the other participants or what was discussed. 223 As noted above, John was correct – Khallad was not in any of these three photographs. After September 11 it was learned that the person the source had identified as Khallad was actually Hazmi. It was also learned after September 11, however, that Khallad was in another Kuala Lumpur surveillance photograph that had not been shown to the source. 286 However, it is clear that at some point before the end of May 2001, Donna became aware of the existence of the Kuala Lumpur photographs in January 2000. Donna told the OIG that she recalled John printing one of the CIA photographs on the printer in his office at FBI Headquarters, and Donna acknowledged that she obtained two other Kuala Lumpur photographs from him. According to Donna, Peter had raised the photographs in a discussion with her prior to her obtaining the photographs from John, although she said that she did not recall the details of their discussion about the photographs. Donna said she did recall that, at the time, Peter had posited that one of the photographs could relate to Quso, which if true would contradict Quso’s statements about going only to Bangkok and not going to Malaysia. According to Donna, the FBI was attempting to determine the veracity of Quso’s information, so the photographs potentially were connected to the Cole investigation. She stated, however, that outside of this potential connection, the photographs were “another piece of a thousand things coming in” at the time. She said that if Quso were determined to be in the photographs, then the photographs would have become significant to the Cole investigation. Donna also told the OIG that she did not recall a “substantive conversation” with John about the photographs or the Malaysia meetings. Donna told the OIG that she wrote on the back of the photographs what John told her about the photographs, which included that “Khalid Al-Midar” traveled from Sana, Yemen, via Dubai, to Kuala Lumpur on January 5, 2000, and he was in Kuala Lumpur between January 6 and 8. She also wrote Khalid Mihdhar’s name on the back of the photograph in which he had been identified. According to Donna, neither John nor Peter discussed with her the fact that Khallad had been identified in these photographs. Donna told the OIG that she believes she would have noted being told that Khallad was in the photographs because she was interested in identifying Khallad and because it would have meant that the photographs had a definite connection to the Cole investigation. Donna also said that no one told her that Mihdhar had a U.S. visa or that Hazmi had traveled to the United States. John told the OIG that he did not recall anything about his discussion with Donna when he printed the Kuala Lumpur photographs for her. John said he recalled that at the time the FBI was trying to “nail down Quso’s story.” He said that he did not recall ever discussing the Khallad identification from the Kuala Lumpur photographs with Donna or anyone else at the FBI. 287 John emphasized that the FBI was focused on the Cole investigation, not the Malaysia meetings. He stated that while he had begun to theorize that Khallad had been in Malaysia, it was only “speculative” and he had not confirmed any of the information about a source identifying Khallad in the Kuala Lumpur photographs. Therefore, according to John, he would not have discussed the identification of Khallad with Donna. John emphasized that a significant impetus for the CIA’s interest in Khallad’s activities revolved around concerns that Khallad was planning a future terrorist operation in Malaysia. Peter told the OIG that he recalled talking to FBI IOSs, including Donna, about mapping the telephone number information based on information provided by Quso. But he said that he did not recall discussions with Donna about the Kuala Lumpur photographs or the Khallad identification. 3. June 11, 2001, meeting a. Planning for the meeting Around the same time that Donna was discussing Quso and the Cole investigation with Peter and John, she also was planning a meeting at the New York FBI Office to discuss the Cole investigation. The planned participants for the New York meeting included personnel from FBI Headquarters, the CIA’s CTC, and the New York FBI agents working on the Cole investigation. FBI documents show that Donna began organizing the meeting as early as May 24. There was no record of an agenda for the meeting, and no supervisors were involved in the preparation for this meeting or were consulted regarding what should be accomplished at the meeting. Donna told the OIG that she organized the meeting in an effort to consolidate information and determine what further action was warranted on the Cole investigation. She stated that the purpose of the meeting at the New York FBI Office was to address unresolved issues and produce additional leads or other activities focusing on 288 the Cole investigation. According to a May 24 e-mail by Donna, the meeting was “to discuss our direction, particularly as it relates to Nashiri.”224 Donna stated that she planned to take the Kuala Lumpur photographs with her to New York to find out whether the New York FBI Cole agents, who had met and debriefed Quso, could identify him in the photographs. She said that if Quso was in the photographs, the FBI would have reason to question Quso’s statement that he had not gone to Malaysia but had met Khallad in Bangkok instead. Sometime after obtaining the Kuala Lumpur photographs from John, Donna queried CTLink for the name Khalid al-Midhar [sic], which John had provided to her and which she had noted on the back of one of the photographs.225 In CTLink she discovered the NSA information from late 1999 and early 2000 referencing Mihdhar’s planned travel to Malaysia and Mihdhar’s association with a suspected terrorist facility in the Middle East linked to al Qaeda activities. She also queried ACS about Mihdhar but did not obtain any additional information about him. Mary, an FBI detailee to the Bin Laden Unit who worked as a CTC desk officer, also attended the June 11 meeting, as did Peter, the CTC analyst. According to Mary, Donna invited her to the meeting and told her the meeting was intended for information sharing and as a “brainstorming session” concerning the Cole investigation. Mary told the OIG she had recently been given the assignment by CTC management of “getting up to speed” in her spare time on the Malaysia meetings and determining any potential connections between the Malaysia meetings and the Cole attack. Mary said that she had not yet begun reviewing the Malaysia meetings at the time of Donna’s invitation. 224 Abdul Rahim al-Nashiri was al Qaeda’s chief of operations in the Persian Gulf and was suspected to have been involved in the attack on the Cole. According to Donna, at the time he was believed to be the “on-scene commander” for the Cole attack, and the IOSs had been assigned the task of trying to locate him based on the intelligence reporting on him. He has since been arrested outside the United States. 225 CTLink is a database administered by the CIA and used to disseminate information within the Intelligence Community. 289 According to Peter, the meeting was also described to him as an “information sharing and brainstorming session” to determine whether any further leads should be pursued. Peter said that he heard about the meeting from Mary and contacted Donna about attending because he was interested in learning what the New York FBI agents had uncovered in their investigation of the Cole attack. According to FBI personnel in New York, Donna told them that FBI Headquarters and CIA personnel had indicated they had “information to share” regarding the Cole investigation. The FBI New York personnel anticipated the meeting would be a mutual exchange of information. Scott, one of the New York case agents on the Cole investigation, said he was told that the CIA representatives who would be attending the meeting wanted a briefing on the Cole investigation. On his own initiative, Scott arranged for David Kelley, an AUSA from the SDNY who was assigned to the Cole matter, to discuss with the CIA representatives other issues related to the Cole investigation, one of which was the impact on the prosecution if some of the targets of the Cole investigation were captured or detained outside the United States. b. The June 11 meeting On June 11, the meeting was held in a conference room at the FBI’s New York Field Office. We could not determine with certainty all the participants at the meeting. There was no list of attendees, and the witnesses could not recall exactly who was there. However, we confirmed that Donna, Mary, Peter, Scott, and another New York agent assigned to the Cole investigation who we call “Randall,” attended. AUSA Kelley attended for part of the meeting. Although it was unclear exactly how long the meeting lasted, the witnesses said it lasted between two and four hours. In interviews with the OIG, the attendees said they did not recall the specifics of what was discussed at the meeting. The only contemporaneous notes from the meeting that we were able to obtain were Donna’s. Her notes indicate that the latest developments in the Cole investigation were discussed. The second page of the notes is labeled “to do” and referenced several items. Randall said he recalled that at the beginning of the meeting, Scott gave an update of the results and status of the investigation. Mary said she recalled that the attendees “brainstormed” various issues, but she did not recall any 290 significant ideas being developed during the meeting. Peter said he recalled that the New York agents “railed” about the U.S. Ambassador to Yemen and the lack of cooperation they believed they were receiving from the Yemeni government. At some point during the meeting, AUSA Kelley discussed the feasibility of prosecution in the Cole case. Toward the end of the meeting, Donna produced the three Kuala Lumpur surveillance photographs and asked the agents if they recognized Quso in any of the photographs. Donna said she told the agents that the photographs had been taken in Malaysia around the Millennium. Donna said she provided Khalid al Mihdhar’s name to at least some of the agents present. A New York agent tentatively identified one of the pictured individuals as Quso, but he could not make a definitive identification.226 The witnesses’ accounts of what happened next differ. Scott told the OIG that after reviewing the Kuala Lumpur photographs, the FBI agents began to ask questions, such as whether there were additional photographs or information concerning the background on the photographs, including questions about Mihdhar, who was in the photographs. According to Scott, he pressed Donna and Peter for details of the Malaysia meetings. Scott told the OIG he was interested in the fact that the photographs were from Malaysia because from the Quso’s debriefings he knew that Khallad had planned to meet Quso in Malaysia, and any information linking Khallad to Malaysia was “directly related” to the Cole investigation. Scott contended that Donna “refused” to provide any further information about the photographs or the Malaysia meetings due to “the wall.” Scott told the OIG that he previously had numerous conversations about the wall with Donna, which had been an issue between them. He stated that during this June 11 meeting, he disputed that the wall was applicable to the information at hand because the photographs had not been obtained as the result of a FISA Court order, and he continued to press Donna for more information. Scott said the meeting degenerated into an argument about the wall. 226 Only a limited number of New York agents had actually met Quso. The others had only seen photographs of him. 291 In his initial OIG interview, Scott described the meeting as very contentious and combative.227 In a second OIG interview, although Scott did not characterize the meeting as having the same level of combativeness, he contended that he pressed Donna for more information but none was forthcoming. Scott stated he had heated telephone conversations and e-mail exchanges with Donna over this issue after the June 11 meeting. Donna, Mary, and Peter described the showing of the Kuala Lumpur photographs as a sidebar to the main meeting and generally inconsequential. All three asserted that neither the display of the surveillance photographs nor the meeting overall was contentious. Although Donna agreed that the FBI agents asked further questions regarding the origin of the photographs and asked for additional information regarding the Malaysia meetings, she contended that she responded simply by saying she did not know anything further. She told the OIG that these questions made sense to her when they were asked, but she did not know the answers. She stated that someone asked what kind of passport Mihdhar was traveling on, and Peter responded that it was a Saudi passport.228 According to Donna, she had not known this information prior to Peter stating it. Donna told us that this was the only information volunteered by Peter, and she believed he would have provided additional information if he knew it. Peter told the OIG that he was not asked any questions at the June 11 meeting, he had no formal role, and he did not brief anyone on anything at the June 11 meeting. Peter explained that it is not within his purview or authority as an analyst to share CIA information. He said he did not recall the meeting becoming heated or contentious. He said he did not recall any time during the 227 When we asked Scott whether an intelligence-designated agent could have been provided the information outside the presence of the criminal agents, Scott agreed that could have been done, but he did not think of it at the time and no one else suggested it. During his subsequent testimony before the Joint Intelligence Committee, however, Scott said that the wall must not have been at issue because the criminal agents could have just left the room and any information could have been related to an intelligence agent. 228 Donna’s contemporaneous notes reflect this information. It appears as the last entry on the notes, indicating that this was discussed at the end of the meeting. 292 meeting where Donna said, “I can’t answer that question” or directly refused to answer a question.229 Mary stated that she had not been “up to speed” on the case at this time, so she was not in a position to provide information at the meeting. She stated that she and Peter were not asked any questions during the meeting. She said that she did not recall any serious disagreements arising during the meeting. According to Donna, she remained in New York after the meeting, without Peter and Mary, and she continued the discussions with the New York agents regarding the photographs after the meeting. She said that these subsequent conversations became fairly “heated,” as the agents pressed her with questions such as whether there were additional photographs and any documentation about the photographs.230 Donna told the OIG she had provided to the agents all the information she had received from the CIA regarding the photographs. She told us that all she knew was that these three photographs were taken in Malaysia around the Millennium, and one of the persons in the photographs was someone named Khalid al Mihdhar. Donna stated she advised the agents of this and told them that efforts would be made to obtain the requested information. She said she was not aware that there would have been additional information to provide. She added that she recalled having the impression that the agents did not believe her when she said that she did not have the information about the photographs that the agents were requesting. As discussed earlier, however, Donna had additional NSA information about Mihdhar that she had discovered through her CTLink query. The information related to the planned travel to Malaysia of several members of an “operational cadre” and Mihdhar’s association with a suspected terrorist facility in the Middle East linked to al Qaeda activities. Donna told us that she 229 As described earlier, Peter and John had exchanged several e-mails about the Malaysia meetings and the photographs. However, it is unclear based upon the information available to us exactly what Peter knew at this point. He said he was unable to remember exactly what additional information he had on June 11, 2001. 230 We believe it likely that the agents were confusing the post-meeting discussions with the showing of the photographs at the meeting. 293 could not provide this information directly to the agents working the Cole criminal investigation due to the caveat, which prevented all NSA counterterrorism-related intelligence information from being provided to FBI criminal agents without approval from the NSA.231 Donna told us that the New York FBI primarily worked criminal terrorism investigations and the sharing of intelligence information with the criminal agents was often an issue. She said that some of the New York agents had become “overly sensitive” about a perceived lack of information sharing. Donna emphasized that any information could be shared but often a process had to be followed before certain intelligence information could be shared with agents working criminal investigations. She added that it was not her job to keep information from the agents but instead to ensure they had the tools necessary to do their job. According to Donna, the only issue regarding the Kuala Lumpur photographs would have been obtaining permission from the CIA to allow individuals outside of the FBI to see the photographs in furtherance of the Cole investigation, such as in interviews conducted in Yemen.232 Donna said at some point while she was in New York, she and the agents discussed providing the photographs to the agents working in Yemen in order to get a positive identification of Quso in the photographs and to conduct further investigation.233 She stated that she told the agents that she would attempt to obtain the requisite permission to provide the photographs to the agents working the Cole investigation in Yemen. 231 It is important to note, however, that this NSA information originally had been routed not only to FBI Headquarters but also to the New York FBI Office in late 1999 and early 2000. 232 A policy in the Intelligence Community, which is designed to protect intelligence sources and methods, is that the originator of intelligence information controls the further dissemination of the information. This policy is described as originator controlled, or “ORCON.” Dissemination of ORCON information requires permission from the originating agency to further disseminate the information outside the receiving agency. 233 Apparently unbeknownst to the involved FBI and CIA personnel, the Yemeni authorities already had been given the photographs on January 3, 2001, six months before anyone at the FBI received the photographs. 294 Although she had no explicit discussion with John regarding the use of the photographs, Donna stated she understood that the photographs were “not formally passed” to the FBI when John gave them to her, but only provided for limited use in the meeting. Therefore, Donna said she did not believe that she could leave the photographs with the New York agents until the requisite permission to show the photographs outside of the FBI had been obtained. However, John told the OIG that that since the photographs had been given to Donna, an FBI employee, they could be further distributed within the FBI. John agreed that the photographs could not be used by the FBI in any manner where they would be disclosed to a foreign government. For example, he said that without approval from the CIA, the FBI agents could not keep the photographs and show them to Quso, who was in Yemeni custody, because Yemeni officials also would see the photographs. c. Follow-up after the June 11 meeting We looked for evidence as to whether Donna or the New York agents conducted any follow-up efforts about the Kuala Lumpur photographs or obtaining permission from the NSA to pass the intelligence information to the New York agents. Donna said that she “probably” had follow-up conversations with John, Peter, and Mary about the photographs, but she did not specifically recall the conversations or obtaining additional information. Mary told the OIG that she recalled conversations with Donna about obtaining permission for the FBI to use the photographs of the Malaysia meetings in their investigation. Donna stated she was not contacted by Scott after the meeting, although she was working with another agent on the squad, who we call “Glenn,” in connection with tracking telephone toll records. Those records related to the Cole participants, the travel of Quso to Bangkok, and Quso’s potential travel to Malaysia. According to Scott, over the course of the summer, he had several more conversations with FBI Headquarters asking about any additional information on the Kuala Lumpur photographs, but he was not provided any additional information. He stated that he did not seek assistance from any supervisor in obtaining additional information. He told us that he and the rest of the New York Field Office had been fighting a battle with FBI Headquarters over 295 information sharing for months, and he was “dumbfounded” that he could not obtain the information about the Kuala Lumpur photographs. He stated that in hindsight he probably should have sought the intervention of a supervisor. Documentary evidence shows that, as a result of the June 11 meeting, Donna and the New York agents discussed the Kuala Lumpur photographs in several follow-up conversations. In an e-mail dated August 22 from Donna to Glenn, she wrote that there were additional photographs of the Malaysia meetings and that the reason that Mihdhar was of interest at the time was because of some threat information that led to the CIA looking at all persons named “Khalid.” In addition, she wrote that she had received assurances that the FBI would be able to use the Kuala Lumpur photographs outside the FBI. We discuss this e-mail in further detail in the next section. Documents also show that on August 27 Donna requested permission from the NSA to provide the intelligence information about Mihdhar to the New York Cole criminal agents. However, this request came after the FBI had discovered on August 22 that Mihdhar might be in the United States and had opened an investigation to determine whether he was in the country. We discuss the events that led to that investigation and the investigative efforts of the FBI in the next section of the report. 4. OIG conclusions on May and June discussions While there were several interactions between FBI and CIA personnel in May and June 2001 that could have resulted in the FBI learning more about the Kuala Lumpur photographs and Mihdhar, the FBI personnel did not become aware of significant intelligence information about Mihdhar and Mihdhar’s connections to Khallad. The fact that Mihdhar had possessed a United States visa was not disclosed at this time by the CIA to Donna or the FBI. The fact that Hazmi had been at the Malaysia meeting and then traveled to Los Angeles also was not disclosed by the CIA. In addition, the fact that the source had identified Khallad, the purported mastermind of the Cole bombing, from the Kuala Lumpur surveillance photographs was not disclosed during these interactions. Although Donna knew about the Kuala Lumpur surveillance photographs, we do not believe that she was informed that Mihdhar had a U.S. visa or that Khallad had been identified in the photographs. Donna’s 296 contemporaneous notes on the back of the Kuala Lumpur photographs reflect the limited information that she had obtained about the photographs and the Malaysia meetings. The notes do not mention anything about Mihdhar’s possession of a U.S. visa. In addition, Donna stated that she was aware of the significance of Khallad to the Cole investigation, but the notes on the photographs also do not mention Khallad. Moreover, John, who provided the photographs to Donna, told the OIG he did not recall discussing the Kuala Lumpur photographs with her, and he did not believe that he would have discussed with Donna that Khallad had been identified in the photographs, because at the time he was not sure that this was true and he thought the information was “speculative.” Although an e-mail message indicated that Peter was planning to discuss the Khallad identification with Donna in a meeting on May 29, we were unable to determine that this meeting actually occurred. It was impossible for us to determine exactly what happened at the June 11 meeting with respect to the Kuala Lumpur photographs because the witnesses cannot recall the specifics of the discussions and there is little documentary evidence. It is clear, however, that the information regarding Mihdhar’s U.S. visa and the fact that Khallad had been identified in the Kuala Lumpur photographs was not discussed at the June 11 meeting. Donna told the agents about the photographs and provided them limited information that she had obtained from the CIA about the photographs. Most of the questioning about the photographs took place after the meeting, when Peter and Mary had left. We believe those interactions after the meeting became very contentious, with the New York FBI wanting more information. Donna did not provide the New York agents with the NSA intelligence information about the Mihdhar’s association with a suspected terrorist facility in the Middle East linked with al Qaeda activities, which she obtained through her research. She said she did not because of the restrictions placed on sharing such NSA information. As we discuss further in the next section, Donna subsequently contacted the NSA in reference to having the NSA information passed to the agents, but this did not occur until much later, on August 27, 2001. We found little attempt by either the FBI agents or Donna after June 11 to follow up on the information about the photographs that was discussed at the meeting. There is little evidence of follow-up until some time in August 2001, 297 when, as we discuss in the next section, the FBI learned that Mihdhar had recently entered the United States, and the FBI opened an investigation to locate him. The interaction between the CIA and the FBI in May and June 2001 was another failed opportunity for the FBI to obtain the critical information about Mihdhar and Khallad. The failure of the FBI to learn about Mihdhar, his connection to Khallad, and his travel to the United States at that time demonstrated significant problems in the flow of information between the CIA and the FBI. We discuss these deficiencies in the analysis section of this chapter. E. The FBI’s efforts to locate Mihdhar in August and September 2001 The fifth and final opportunity for the FBI to locate Mihdhar and Hazmi occurred in late August 2001, when it was informed that Mihdhar and Hazmi had traveled to the United States. The FBI learned in August 2001 that Mihdhar had entered the United States in July 2001 and that Mihdhar and Hazmi had previously traveled together to the United States in January 2000. On August 29, the FBI began an investigation to locate Mihdhar, but it did not assign great urgency or priority to the investigation. The New York FBI criminal agents who wanted to participate in the investigation were specifically prohibited from doing so because of concerns about the wall and the procedures to keep criminal and intelligence investigations separate. The FBI did not locate Mihdhar before the September 11 attacks. We review the facts surrounding the FBI’s discovery of this information about Mihdhar and Hazmi and what the FBI did with this information in August. We also examine the FBI’s unsuccessful efforts to locate Mihdhar before the September 11 attacks. 1. Continuing review of the Malaysia meetings in July and August 2001 As discussed above, John, the CIA Bin Laden Unit Deputy Chief, was detailed to the FBI’s ITOS in May 2001. Shortly before assuming his duties at the FBI, John had asked CTC management to assign a CTC desk officer with “getting up to speed” on the Malaysia meetings and determining any potential 298 connections between the Malaysia meetings and the Cole attack. This assignment was given to Mary. She told the OIG that “getting up to speed” meant she would have to research and read the pertinent cable traffic as her schedule permitted. She emphasized that her priority assignment during this period was the credible threats of an imminent attack on U.S. personnel in Yemen, and she said that she worked the Malaysia meetings connections to the Cole attack whenever she had an opportunity. In early July 2001, based on recent intelligence information, the CIA had concerns about the possibility of a terrorist attack in Southeast Asia. On July 5, 2001, John sent an e-mail to managers at the CTC’s Bin Laden Unit noting “how bad things look in Malaysia.” He wrote that there was a potential connection between the recent threat information and information developed about the Malaysia meetings in January 2000. In addition, he noted that in January 2000 when Mihdhar was traveling to Malaysia, key figures in the failed attack against the U.S.S. The Sullivans and the subsequent successful attack against the U.S.S. Cole also were attempting to meet in Malaysia, and that one or more of these persons could have been in Malaysia at that time. Therefore, he recommended that the Cole and Malaysia meetings be reexamined for potential connections to the current threat information involving Malaysia. He wrote, “I know your resources are strained, but if we can prevent something in SE Asia, this would seem to be a productive place to start.” He ended the e-mail by stating that “all the indicators are of a massively bad infrastructure being readily completed with just one purpose in mind.” On July 13, John wrote another e-mail to CTC managers stating that he had discovered the CIA cable relating to the source’s identification of “Khallad” from the Kuala Lumpur surveillance photographs in early January 2001. John began the e-mail by announcing “OK. This is important.” He then described Khallad as a “major league killer who orchestrated the Cole attack and possibly the Africa bombings.” The e-mail recommended revisiting the Malaysia meetings, especially in relation to any potential information on Khallad. Significantly, John ended the e-mail asking, “can this [information] be sent via CIR to [the FBI]?” Despite John’s recommendation that this information be forwarded to the FBI in a CIR, we found no evidence indicating that the CIA provided this information to the FBI until August 30, 2001, which, as we describe below, was after the FBI learned about Mihdhar’s presence in the United States. 299 In a response e-mail dated July 13, 2001, a CTC Bin Laden Unit supervisor stated that Mary had been assigned to handle the request for additional information on the Malaysia meetings. In addition, the e-mail stated that another FBI detailee to the CTC, Dwight, who was out of the office at the time, would be assigned to assist Mary upon his return. Later in July, Mary drafted a cable to another CIA office requesting follow-up information about the Malaysia meetings. The cable included a reference to the source’s identification of Khallad in one of the Kuala Lumpur photographs and that Khallad and Mihdhar had been in Malaysia at the same time, possibly together. A week later, the CTC supervisor forwarded the cable to John for his review prior to release, and the cable was sent to the office to which it was addressed three days after that. On the same day she drafted the cable referencing the source’s identification of Khallad, Mary located one of the CIA cables referencing Mihdhar’s possession of a U.S. visa. On the same date, Mary also reviewed the CIA cable that stated this visa information had been passed to the FBI in January 2000.234 In early August, Mary and Donna continued to discuss the Kuala Lumpur photographs. In an e-mail on August 7 from Donna to Mary, Donna requested a copy of the flight manifest for Mihdhar’s January 2000 trip to Malaysia in order to determine whether Quso had traveled with Mihdhar. She also asked, “if we could get the pictures cleared to show Al-Quso.” 235 She continued, “the reasoning behind this would be that first, we do not have a concensous [sic] that the individual with Midhar [sic] is in fact Al-Quso. . . [second] to determine if Al-Quso can identify Midher by an other [sic] name.” Donna then discussed her continuing efforts to track telephone number information developed in the investigation. At the close of the e-mail, Donna wrote, “I plan to write something up, but perhaps we should schedule another sit down to compare notes on both sides. Let me know.” 234 As discussed above, we found no evidence that this information had, in fact, been provided to the FBI. 235 Apparently the desk officer was unaware that clearance had been received and that the photographs had been shared with Yemeni officials. 300 In a response e-mail on the same date, Mary wrote, “okay, all sounds good.” Mary also wrote that she thought Donna had Mihdhar’s flight manifest because John had mentioned it, but Mary indicated she would find the manifest. She wrote, “I think we will be able to clear the pictures, they are for passage to Quso, right?” Mary also asked whether the FBI would be able to meet with Quso again. Mary ended the e-mail, “I think a sit down again would be great” and mentioned the potential logistics of arranging the meeting. In another e-mail exchange on August 7, Donna thanked Mary and advised her that the FBI would again have access to Quso. Donna continued by stating that the Kuala Lumpur photographs also would be passed to a foreign government because Quso was currently in its custody. She stated that John could call if he had any questions. Donna tentatively scheduled a meeting with Mary at FBI Headquarters on August 15, 2001. However, it appears that the meeting did not take place.236 2. Discovery of Mihdhar’s entry into the United States On August 21, Mary located the CIA cables referencing Hazmi’s travel to the United States on January 15, 2000.237 Mary checked with a U.S. Customs Service representative to the CTC about Hazmi’s and Mihdhar’s travel. She discovered that Mihdhar had entered the United States on July 4, 2001, and had not departed. In addition, she confirmed that Hazmi had traveled to the United States in January 2000. Mary immediately relayed to Donna in a voicemail message on August 21 that Mary had something important to discuss with her. Donna was on annual leave on August 21. Mary told the OIG she did not have an 236 Mary told the OIG that she took a week of annual leave during August, which she thought was during that week, and she thought that the meeting therefore had not occurred. Although the e-mail references a meeting, Mary and Donna both told us that they had no recollection of any meeting on August 15 or any one prior to August 22. 237 Mary was copied on an e-mail from John to Peter in mid-May, 2001, in which John discussed the travel of Mihdhar and others who appeared to be “couriers on a sort.” In this e-mail John stated, among other things, that “Nawaf” [Hazmi] had traveled with someone from Bangkok to Los Angeles to Hong Kong. Mary stated to the OIG that she received this e-mail before she was “up to speed” on the Malaysia meetings. 301 opportunity to focus on the Malaysia meetings until August, but upon discovering on August 21 that Hazmi had traveled to the United States “it [the importance of the information] all clicks for me.” On August 22, Mary met with Donna at FBI Headquarters and informed her of Mihdhar’s July 4 entry and Hazmi’s travel to the United States in March 2000.238 Donna verified in INS indices Mihdhar’s recent entry. She also learned that both Mihdhar and Hazmi had entered the United States on January 15, 2000, and that they were allegedly destined for the Sheraton Hotel in Los Angeles, California. The INS records showed Mihdhar had departed the United States from Los Angeles on June 10, 2000, on Lufthansa Airlines. No departure record could be located for Hazmi. An INS representative advised Donna that departure information often was not captured in INS indices.239 Therefore, she incorrectly surmised Hazmi had also departed on June 10, 2000.240 Further INS indices checks confirmed Mihdhar had re-entered the U.S. on July 4, 2001, at the JFK Airport in New York, allegedly destined for the “Marriott hotel” in New York City. By the terms of his entry, Mihdhar was authorized to remain in the United States until October 3, 2001. The INS had no record indicating Mihdhar had departed the United States as of August 22, 2001. Mary and Donna met with John on August 22 in his office at FBI Headquarters to discuss their discovery that Mihdhar recently had entered the United States and there was no record of his departure. All of them said they could not recall the specifics of the conversation, but all agreed that they 238 There is some discrepancy in witness statements on whether this meeting occurred on August 22 or August 23. Although it is unclear on which date this meeting occurred, we believe the meeting occurred on August 22, 2001. 239 The problem of INS departure records not being complete or accurate is described in an August 2001 OIG report entitled “The Immigration and Naturalization Service’s Automated I-94 System.” 240 Investigation conducted after September 11 found that Hazmi had remained in the United States. 302 realized it was important to initiate an investigation to determine whether Mihdhar was still in the United States and locate him if he was. On August 22, 2001, Donna sent an e-mail to the New York FBI Special Agent who we call “Glenn.” He was one of the agents assigned to the Cole investigation. In the e-mail, Donna advised Glenn that she had obtained Mihdhar’s flight manifest. Donna also wrote, “the reason they [the intelligence community] were looking at Midhar [sic] is relatively general – basically they were looking at all individuals using the name Khalid because of some threat information.” Significantly, the e-mail also advised that the CIA had additional surveillance photographs beyond those she had taken to New York, and the source had identified one of the individuals in these additional photographs as Khallad. Donna said that she was “requesting the details on that [Khallad’s identification].” Donna also stated in her e-mail that the clearance to show the Kuala Lumpur surveillance photographs to Quso should not be a problem.241 This e-mail was the first reference we identified that the FBI had been informed of additional Kuala Lumpur surveillance photographs in the CIA’s possession. It is also the first reference in any FBI document to the identification of Khallad in the Kuala Lumpur photographs. After her meeting with Donna on August 22, 2001, Mary asked another CTC officer to draft a CIR to the State Department, INS, U.S. Customs Service, and FBI requesting the placement of Mihdhar and his travel companions, Hazmi and Salah Saeed Muhammed bin Yousaf, on U.S. watchlists.242 The CIR briefly outlined Mihdhar’s attendance at the Malaysia meetings and his subsequent travel to the U.S. in January 2000 and July 2001. On August 24, the State Department placed Mihdhar and his travel companions 241 Donna was unable to recall how she first discovered the information on the Khallad identification. We were unable to find any documents or other evidence clarifying this issue. 242 At this time, several agencies maintained separate watchlists. The State Department watchlist was the VISA/VIPER system. Within VISA/VIPER, the TIPOFF system focused on suspected terrorists. The INS maintained the LOOKOUT system, which was also available to the Customs Service through TECS. 303 on its terrorism watchlist. This is the first record of the placement of Mihdhar or Hazmi on any U.S. watchlist. On August 23, 2001, Donna contacted the State Department and requested a copy of Mihdhar’s most recent visa application from the U.S. Consulate in Jeddah, Saudi Arabia. 3. The FBI’s intelligence investigation on Mihdhar a. Steps to open the investigation On August 23, Donna contacted her supervisor, an SSA who we call “Rob,” regarding the information about Mihdhar’s travel to the United States. As discussed in Chapter Three, Rob was the acting Unit Chief of the UBLU at the time.243 After reviewing the information, Rob concurred with Donna that the appropriate course of action would be to open an intelligence investigation in New York, Mihdhar’s last known destination in the United States, to locate Mihdhar. To expedite the investigative process and provide a “heads up [alert]” to the New York Field Office that the information was coming, on August 23 Donna telephoned an agent on the Bin Laden squad in the New York Field Office who we call “Chad.” To comply with the wall, the New York Field Office had designated agents as either “criminal” or “intelligence,” and Chad was an intelligence agent. Donna discussed with Chad Mihdhar’s most recent entry into the United States and FBI Headquarters’ request for the New York office to open a full field intelligence investigation to locate Mihdhar. Donna told the OIG that she did not normally telephonically contact the field on these types of issues, but there was some urgency to her request because the FBI did not want to lose the opportunity to locate Mihdhar before he left the United States. She told us, however, that Mihdhar’s significance continued to be his potential connection to Khallad and the Cole attack – not that he was operational in the U.S. 243 He was the acting Unit Chief of the UBL from June 28, 2001, until September 10, 2001. 304 Chad told the OIG that although he routinely worked with Donna, this was the first time that Donna had relayed a need for urgency in an intelligence investigation. Chad told us, however, that he questioned both the urgency and the need for a separate intelligence investigation. Chad explained that the attempt to locate Mihdhar seemed to relate to the criminal investigation of the Cole attack, and efforts to locate an individual normally would be handled through a sub-file to the main investigation and not as a separate full field investigation. Nevertheless, he told Donna that New York would open an intelligence investigation. On August 23, Donna sent an e-mail to John concerning her telephone conversation with Chad. She advised in the e-mail that “[Chad] will open an intel[ligence] case.” In the e-mail she also discussed a connection that had been made between Mihdhar in Malaysia to another suspect in the Cole attack. She wrote, “I am still looking at intel, but I think we have more of a definitive connection to the Cole here than we thought.” She ended by stating that she was working on the EC requesting a full field investigation, but doubted that it would be completed that day. On August 27, Donna requested permission through the NSA representative to the FBI to pass to the FBI agents working on the Cole investigation the information associating Mihdhar with a suspected terrorist facility in the Middle East linked to al Qaeda activities. Donna told the OIG that she thought that the NSA information on Mihdhar could be useful to the Cole criminal investigators, even if the Mihdhar search remained an intelligence investigation. On the morning of August 28, Donna sent Chad a draft copy of an EC requesting the intelligence investigation to locate Mihdhar. In the cover email, Donna stated, “here is a draft” and that the EC had not been uploaded due to some tear line information that was not yet approved for passage.244 She concluded, “I do want to get this going as soon as possible.” The EC, entitled “Khalid M. Al-Mihdhar” with various aliases, stated in the synopsis, “Request to open an intelligence investigation.” The EC outlined Mihdhar’s travel to the United States in July 2001, his previous travel to the 244 According to the NSA, the request was approved later that same day. 305 United States with Hazmi in January 2000, the background on and his attendance at the Malaysia meetings, his association with a suspected terrorist facility in the Middle East linked to al Qaeda activities, and similarities between Mihdhar’s travel and that of Cole suspects Quso, Ibrahim Nibras, and Khallad. As to the identification of Khallad in the Kuala Lumpur photographs by the source, Donna told the OIG that she did not include this information because it had not yet been officially passed to the FBI, although she had requested the passage from a CTC Representative to the FBI.245 While Donna had relayed urgency to opening the investigation in her telephone conversation with Chad and in her cover e-mail, she designated the EC precedence as “routine,” the lowest precedence level.246 She explained this by saying this case was “no bigger” than any other intelligence case. She also told us, however, that there was a time consideration because Mihdhar could be leaving the United States at any time and that is why she had personally contacted Chad. b. The FBI opens the intelligence investigation On August 28, Chad forwarded Donna’s draft EC to his immediate supervisor, a Supervisory Special Agent who we call “Jason.” Jason became a supervisor on the JTTF in the New York Field Office in 1996. He had been on the New York JTTF since 1985. At approximately 2:00 p.m. on August 28, Jason forwarded the EC to various agents on the Bin Laden squad, including the Cole criminal case agent who we call “Scott.” In the cover e-mail, Jason directed the Relief Supervisor, who we call “Jay,” to open an intelligence investigation and assign it to a Special Agent who we call “Richard.” Jason also directed another agent to 245 This information officially was passed to the FBI in a CIR on August 30, 2001. 246 As discussed in Chapter Three, ECs are marked with a precedence level based on an escalating scale beginning at “routine;” “priority,” connoting some urgency; and “immediate,” connoting the highest level of urgency. 306 check on an investigative lead related to Mihdhar while the agent was in Malaysia.247 Scott received the EC on August 28. Scott, who had been at the June 11 meeting and had discussions with Donna about the Kuala Lumpur photographs, contacted Donna to discuss the appropriateness of opening an intelligence investigation as opposed to a criminal investigation. Donna told the OIG that when she realized that the EC had been disseminated to Scott, she asked Scott to delete it because it contained NSA information and therefore required approval for review by criminal agents. Scott told the OIG that he deleted the EC as she requested. Shortly thereafter, Scott, Donna, and Rob engaged in a conference call to discuss whether the case should be opened as a criminal instead of an intelligence investigation. Scott told the OIG that he argued that the investigation should be opened as a criminal investigation due to the nexus to the Cole investigation and the greater investigative resources that could be brought to bear in a criminal investigation. Scott explained that more agents could be assigned to a criminal investigation due to the squad designations. He also asserted that criminal investigation tools, such as grand jury subpoenas, were far quicker and easier to obtain than the tools available in an intelligence investigation, such as a national security letter. Donna told the OIG that the information on Mihdhar was received through intelligence channels and, because of restrictions on using intelligence information, could not be provided directly to the criminal agents working the Cole investigation. The only information that could be provided directly to them was the limited INS information. She stated that without the intelligence information on Mihdhar, there would have been no potential nexus to the Cole investigation and no basis for a criminal investigation. Rob told the OIG he had concurred with Donna’s assessment that the matter should be an intelligence investigation. He added that there was also a process through 247 Jason told the OIG that he did not specifically recall this e-mail. He said he was out of the office the majority of the time from June until September 11, 2001, due to a serious medical condition, and he did not return to work full-time until September 11, 2001. 307 which the information could potentially be shared with the criminal agents in the future.248 Scott was not satisfied with that response, and he asked for a legal opinion from the FBI’s National Security Law Unit (NSLU) whether the investigation should be opened as a criminal matter relating to the Cole criminal investigation. Additionally, Scott wanted a legal opinion on whether a criminal agent could accompany an intelligence agent to interview Mihdhar if he was located. According to Donna, she subsequently contacted the NSLU attorney who we call “Susan” on August 28, and she and Rob discussed the issue with Susan. It is unclear how she presented the matter to Susan because there were no documents about the conversation and she and Susan had little or no recollection of the specific conversation. Donna told the OIG that she provided the EC to Susan. According to Donna, Susan agreed with her that the matter should be opened as an intelligence investigation. Donna said Susan also advised that a criminal agent should not be present for an interview of Mihdhar if he was located. During an OIG interview, Susan said she could not specifically recall this matter or the advice she gave. Rob told the OIG that he did not recall the specifics of this consultation, but he stated that the NSLU opinion was supportive of FBI Headquarters’ determination that the case should be opened as an intelligence investigation. At approximately 7:30 a.m. on August 29, Donna sent an e-mail to Jason, which stated: I think I might have caused some unnecessary confusion. I sent the EC on Al-Midhar [sic] to [Chad] via email marking it as DRAFT so he could read it before he went on vacation. There is material in the EC…which is not cleared for criminal investigators. [Scott] called and [Rob] and I spoke with him and tried to explain why this case had to stay on the intel. side of the house…In order to be confident…for this case to be a 199, 248 Rob told the OIG that the squad’s Supervisory Special Agent acted as “the wall” between intelligence and criminal investigations during this period, and Jason could subsequently open a criminal investigation if warranted. 308 and to answer some questions that [Scott] had, [Rob] and I spoke with the NSLU yesterday afternoon249…The opinion is as follows: Al-Mihdar [sic] can be opened directly as a FFI [Full Field Investigation]…The EC is still not cleared for criminal investigators…Per NSLU, if Al-Mihdar [sic] is located the interview must be conducted by an intel agent. A criminal agent CAN NOT be present at the interview. This case, in its entirety, is based on intel. If…information is developed indicating the existence of a substantial federal crime, that information will be passed over the wall according to the proper procedures and turned over for follow-up criminal investigation.250 Approximately 15 minutes after sending the e-mail to Jason, Donna sent an e-mail to Scott with the same language advising that the NSLU agreed the investigation should be an intelligence investigation and a criminal agent could not attend the interview if Mihdhar was located. That same morning, Scott responded in an e-mail to Donna stating: …where is the wall defined? Isn’t it dealing with FISA information? I think everyone is still confusing this issue…someday someone will die – and wall or not – the public will not understand why we were not more effective and throwing every resource we had at certain ‘problems.’ Let’s hope the National Security Law Unit will stand by their decisions then, especially since the biggest threat to us now, UBL, is getting the most ‘protection’. Later that morning, Donna replied in an e-mail: I don’t think you understand that we (FBIHQ) are all frustrated with this issue. I don’t know what to tell you. I don’t know how many other ways I can tell this to you. These are the rules. 249 Rob told the OIG that he could not recall whether he had talked to anyone from the NSLU about this issue. 250 Rob told the OIG that the New York Field Office technically could have ignored Headquarters’ recommendation and opened a criminal investigation. However as a practical matter, the field would not normally ignore Headquarters’ decision. 309 NSLU does not make them up and neither does UBLU. They are in the MIOG251 and ordered by the [FISA] Court and every office of the FBI is required to follow them including FBINY… 4. The New York Field Office’s investigation On August 29, 2001, the FBI’s New York Field Office opened a full field intelligence investigation to locate Mihdhar. The investigation was assigned to a Special Agent who we call “Richard.” Richard was a relatively inexperienced agent, who had recently been transferred to the Bin Laden squad.252 This was Richard’s first intelligence investigation. On August 29, Donna received Mihdhar’s visa application from the U.S. Consulate in Jeddah. The application indicated that Mihdhar planned to travel as a tourist to the United States on July 1, 2001, for a purported month long stay. On the application, Mihdhar falsely claimed that he had not previously applied for a U.S. non-immigrant visa or been in the United States.253 On August 30, 2001, Donna sent an e-mail to Richard. After a paragraph introducing herself, Donna advised she was attaching Mihdhar’s visa application form, which included Mihdhar’s photograph, and that she would be faxing the remaining documents. Donna stated she would send a couple of pages from the Attorney General Guidelines “which apply to your case” and then she would mail the documents. Richard told the OIG that on August 30, he received a telephone call from Donna in reference to the investigation. He said that Donna said the goal of the intelligence investigation was to locate and identify Mihdhar for a 251 The MIOG is the FBI operational manual - Manual of Investigative Operations and Guidelines. Donna asserted this reference actually related to the Attorney General’s FCI Guidelines that are contained in the MIOG. 252 Richard began working in the New York Field Office after graduating from the FBI Academy in June 2000. After serving briefly on an applicant squad, a drug squad, and a surveillance squad, Richard was assigned to the UBL squad in July 2001. 253 Donna said she did not notice this discrepancy. As we discuss below, neither did the New York FBI. 310 potential interview. According to Richard, Donna did not indicate the investigation was an emergency or identify any other exigent circumstance. On August 30, 2001, the CIA sent a CIR to the FBI outlining the identification of “Khallad” from one of the Kuala Lumpur surveillance photographs in January 2001 by the source. The first line of the text stated the information should be passed to Rob. The CIA cable stated the FBI should advise the CIA if the FBI did not have the Kuala Lumpur photographs so they may be provided. This is the first record documenting that the source’s identification of Khallad in the Kuala Lumpur photographs was provided by the CIA to the FBI. Richard told the OIG that he began to work on locating Mihdhar on September 4. He stated that he had received the assignment on Thursday, August 30, but he worked all weekend and Monday on another exigent investigative matter involving a Canadian hijacking. As a result, he said he did not have the opportunity to begin work on the Mihdhar investigation until Tuesday, September 4. On September 4, Richard completed a lookout request for the INS, identifying Mihdhar as a potential witness in a terrorist investigation. Due to his unfamiliarity with completing the lookout form, Richard contacted an INS Special Agent who was assigned to the FBI’s JTTF in New York. We call this Special Agent “Patrick.” The INS lookout form has a box indicating whether the individual was wanted for “security/terrorism” reasons. Richard did not check this box. He said that he thought Patrick told him to identify the subject on the form as a witness, not a potential terrorist, to prevent overzealous immigration officials from overreacting. By contrast, Patrick, who was assigned to the JTTF since September 1996, told us that he did not provide this advice to Richard and he always checked the security/terrorism box whenever he completed the lookout form for a potential witness in a terrorism investigation. However, Richard asked Patrick to review the lookout request form for completeness, and Patrick sent the form to INS Inspections for inclusion in the 311 INS lookout system, without making any changes.254 During his initial interview with the OIG, Richard asserted that he also asked Patrick to review and explain Mihdhar’s travel documents, including the INS indices printouts and the visa application. In a follow-up interview, Richard said he could not definitively recall whether he had actually provided the predicating materials to Patrick or whether he merely had Patrick review the INS lookout request form. Patrick told the OIG that he recalled this request because it was the first one from Richard and because of Mihdhar’s subsequent involvement in the September 11 attacks. Patrick stated that he had not reviewed the predicating materials, but had only checked the request form for completeness. He added that if he had been shown any of the predicating materials on Mihdhar’s travel, the review would only have been cursory. Patrick and Richard both acknowledged that they did not notice the false statements on Mihdhar’s visa application. Richard also contacted a U.S. Customs Service representative assigned to the JTTF and verified that a TECS lookout was in place for Mihdhar. Richard conducted other administrative tasks such as uploading the initial information about Mihdhar into ACS. On September 4, Richard requested a local criminal history check on Mihdhar through the New York City Police Department. Richard told the OIG that he initially focused on Mihdhar, since he was captioned as the subject of the investigation in the predicating EC. After reviewing the EC several times, Richard noted the connection to Hazmi, so he conducted the same record checks on Hazmi as he had on Mihdhar. On September 5, Richard requested an NCIC criminal history check, credit checks, and motor vehicle records be searched in reference to Mihdhar and Hazmi. On September 5, Richard and another JTTF agent contacted the loss prevention personnel for the New York area Marriott hotels, since Mihdhar had indicated when he entered the United States in July 2001 that his destination 254 Patrick explained that agents often provided just the information and he completed the lookout form, but “new” agents often completed the form themselves. Patrick estimated he received approximately 10 lookout requests each month. 312 was the Marriott hotel in New York. Richard learned that Mihdhar had not registered as a guest at six New York City Marriotts. Richard stated he also conducted Choicepoint™ searches on Hazmi and Mihdhar.255 Richard said he recalled he had another JTTF officer assist him with the searches because he was not familiar with the system. Richard did not locate any records on either Hazmi or Mihdhar in Choicepoint™.256 Richard told the OIG that it was not uncommon not to find a record because of variations in spelling of names or other identifying information. Hazmi and Mihdhar had traveled to Los Angeles, California on January 1, 2000, via United Airlines, and INS records indicated that they claimed to be destined for a “Sheraton hotel” in Los Angeles. Therefore, on September 10, 2001, Richard drafted an investigative lead for the FBI Los Angeles Field Office. He asked that office to request a search of the Sheraton hotel records concerning any stays by Mihdhar and Hazmi in early 2000. He also requested that the Los Angeles office check United Airlines and Lufthansa Airlines records for any payment or other information concerning Mihdhar and Hazmi. However, the lead was not transmitted to Los Angeles until the next day, September 11, 2001. By the morning of September 11, when the American Airlines flight 77 that Mihdhar and Hazmi hijacked and crashed into the Pentagon, Richard had not uncovered any information regarding Mihdhar’s or Hazmi’s location in the United States. 5. OIG conclusions on the intelligence investigation Although FBI and CIA personnel had many discussions throughout July and August 2001 about the Cole attacks and the Malaysia meetings, the CIA 255 Choicepoint™ is a commercial service that mines information such as names, addresses, phone numbers, and other identifying information from public sources (such as telephone directories, local taxing authorities, and court records), as well as purchase information from merchants or other companies. The information is then consolidated into a large database and is accessible to law enforcement and other subscribers for a fee. 256 After September 11, however, the FBI located records on Hazmi in this commercial database. 313 did not provide and the FBI did not become aware of the significant intelligence information about Mihdhar’s U.S. visa, the Malaysian matter, and the identification of Khallad in the Kuala Lumpur photographs until August 22, 2001. In May 2001, one detailee to the CTC was assigned to “get up to speed” on the Malaysian matter in her spare time but said she had been unable to focus on the matter until August 2001. On July 13, even after John had suggested in an e-mail to the CTC that the Khallad identification from the Kuala Lumpur photographs be passed to the FBI via CIR, this was not done for several weeks. The CIR was not sent to the FBI until August 30, after the FBI learned of Mihdhar’s presence in the United States. The CIA also did not provide to the FBI the information about Hazmi’s travel to the United States in January 2000 until August 22. Donna stated that she did not receive this information until August 22, and her actions upon receipt of the information clearly indicate that she understood the significance of this information when she received it. She took immediate steps to open an intelligence investigation when she learned of this information. On August 22, once the FBI was aware of the intelligence information about Mihdhar and that he was in the United States, the FBI took steps to open an intelligence investigation to locate him. Yet, the FBI did not pursue this as an urgent matter or assign many resources to it. It was given to a single, inexperienced agent without any particular priority. Moreover, the dispute within the FBI about whether to allow a criminal investigation to be opened again demonstrated the problems with the wall between criminal and intelligence investigations. The FBI was not close to locating Mihdhar or Hazmi when they participated in the terrorist attacks on September 11, 2001. In the analysis section of this chapter, we address in more detail the FBI’s decision to open the matter as an intelligence investigation instead of a criminal investigation, and the inadequacy of the FBI’s efforts to investigate Mihdhar in late August and early September 2001. F. Summary of the five opportunities for the FBI to learn about Mihdhar and Hazmi In summary, there were at least five opportunities for the FBI to have learned about Mihdhar and Hazmi, including their connection to the purported mastermind of the Cole attack and their presence in the United States, well before the September 11 attacks. First, in early 2000, the FBI received the 314 NSA information about Mihdhar’s planned travel to Malaysia. Although the CIA informed the FBI of the Malaysia meetings in January 2000, the existence of Mihdhar’s U.S. visa and the surveillance photographs was not disclosed to the FBI. FBI detailees at the CTC read the pertinent CIA cable traffic with this information and drafted a CIR to pass this information to the FBI. But the CIR was not released to the FBI, purportedly at the direction of a CIA supervisor, and the FBI did not learn of this critical information until August 2001. In addition, in March 2000 a CIA office discovered that Hazmi had traveled to the United States in January 2000, but no one from the CIA shared this information with the FBI. Second, in February 2000, Mihdhar and Hazmi moved to San Diego, where they were aided in finding a place to live by the former subject of an FBI preliminary inquiry. In May 2000, Hazmi and Mihdhar moved in with an FBI asset in San Diego, California. However, the FBI did not learn of this information until after the September 11 attacks. Third, in early January 2001, the CIA showed the Kuala Lumpur surveillance photographs to a joint CIA/FBI source, and the source stated that “Khallad” was in one of the photographs. This identification could have led the FBI to focus on who else was at the Malaysia meetings with Khallad, the purported mastermind of the Cole attacks, which could have led the FBI to identify and locate Mihdhar. However, we concluded that, despite the CIA’s assertions, the source’s identification of Khallad in these photographs was not known by the FBI. Fourth, in May and June 2001, due to concerns about possible terrorist activities, CIA employees were again examining the Kuala Lumpur photographs, Hazmi’s and Mihdhar’s travel (including Hazmi’s travel to Los Angeles), and the identification of Khallad in the Kuala Lumpur photographs. At the same time, these CIA employees were discussing with FBI employees the Cole investigation and the Kuala Lumpur photographs. Yet, despite these interactions between the two agencies on the telephone, in e-mails, and in a June 11 meeting in New York, the FBI never was informed of the critical intelligence information that Khallad was identified in the Kuala Lumpur photographs with Mihdhar, and that Hazmi had traveled to the United States. Again, this information could have led the FBI to initiate a search for Hazmi and Mihdhar earlier than it eventually did. 315 Fifth, in July 2001 a former Bin Laden Unit Deputy Chief who was working in ITOS in FBI Headquarters confirmed that Khallad had been identified in the Kuala Lumpur photographs and wrote in an e-mail to CTC managers that this information needed to be sent in a CIR to the FBI. However, this information was not sent in a CIR to the FBI until several weeks later. On August 22, an FBI employee detailed to the CTC notified the FBI that Mihdhar had entered the United States on July 4, 2001. The FBI began an intelligence investigation to locate Mihdhar and Hazmi. However, the FBI assigned few resources to the investigation and little urgency was given to the investigation. The FBI was not close to locating Mihdhar and Hazmi before they participated in the September 11 attacks. IV. OIG’s analysis of the FBI’s handling of the intelligence information concerning Hazmi and Mihdhar We found systemic and individual failings in the FBI’s handling of the Hazmi and Mihdhar matter. As a result of these failings, there were at least five opportunities for the FBI to connect information that could have led to an earlier investigation of Hazmi and Mihdhar and their activities in the United States. In this analysis section, we first discuss the systemic problems involving the breakdowns in the gathering or passing of information about Hazmi and Mihdhar between the FBI and CIA. We then turn to the problems in handling intelligence information within the FBI. Finally, we discuss the actions of individual FBI employees in handling information about Hazmi and Mihdhar information. In this section, we do not make recommendations regarding the actions of the CIA and its employees. We believe the CIA shares a significant responsibility for the breakdowns in the Hazmi and Mihdhar case, and that several of its employees did not provide the intelligence information to the FBI as they should have. We leave it to the CIA OIG, the entity with oversight jurisdiction over the CIA and its employees, to reach conclusions and make recommendations on the actions of the CIA and its employees. 316 A. Systemic impediments that hindered the sharing of information between the CIA and the FBI The most critical breakdown in the Hazmi and Mihdhar case was the failure of the FBI to learn from the CIA critical information about them; their travel to the United States; and their association with Khallad, the purported mastermind of the Cole attack. These breakdowns reflected serious problems in the process before the September 11 attacks for sharing information between the FBI and the CIA. The FBI failed to receive from the CIA three critical pieces of intelligence about Mihdhar and Hazmi in a timely manner: • Mihdhar’s possession of a valid, multiple-entry U.S. visa; • Hazmi’s travel to the United States; and • The identification of Khallad in a surveillance photograph of the Malaysia meetings attended by Hazmi and Mihdhar and other al Qaeda operatives in January 2000. The CIA became aware of these three pieces of intelligence in January 2000, March 2000, and January 2001. Despite claims to the contrary, we found that none of this information was passed from the CIA to the FBI until August 2001. Although the CIA failed to timely pass this information to the FBI, there were several opportunities for the FBI to have obtained this information in other ways. But significant systemic problems, which we describe below, hindered the flow of information between the CIA and the FBI. 1. Use of detailees One of the most significant opportunities for the FBI to have obtained the intelligence information relating to Hazmi and Mihdhar was through the FBI detailees at the CTC. As discussed above, the FBI detailees to the CTC had access to CIA cable traffic and could read the cables that discussed Mihdhar’s U.S. visa, the surveillance of the meetings of al Qaeda operatives in Malaysia, Hazmi’s subsequent travel to the United States, and the Khallad identification from the Kuala Lumpur photographs. Several of the FBI detailees accessed and read some of these cables. Significantly, in January 2000, one detailee, Dwight, prepared a draft CIR to pass to the FBI the information about Mihdhar’s visa, his al Qaeda connections, and his travel to Malaysia. The FBI 317 should have been informed of this information because of its clear domestic nexus. However, the CIR was never sent to the FBI. According to a note on the CIR, John, a Deputy Chief of the Bin Laden Unit, directed that the CIR be placed on hold, and FBI detailees did not have authority to disseminate CTC information without approval from the CIA. Eight days later, Dwight inquired about the disposition of the CIR through an e-mail to John asking whether anything needed to be changed on the cable. However, this e-mail failed to prompt further action on this CIR. The witnesses we interviewed had no recollection of the CIR and why it was not sent. We found no further record that anything was done with regard to the CIR. In our view, the CIA should have sent the CIR to the FBI because of the important information it contained, and the FBI detailee should have followed up to ensure that it was sent. While we found evidence that Dwight inquired about its status at least once, there is no evidence that he took any other action to ensure that the information was sent to the FBI, including inquiring with other CTC supervisors about the need to send the cable to the FBI. In reviewing the actions of the detailees, we found that the FBI lacked clear guidance on the role and responsibilities of FBI detailees to the CTC’s Bin Laden Unit. This led to inconsistent expectations about what they were supposed to be doing at the CTC. Our review of the documents and interviews with the five FBI detailees to the CTC’s Bin Laden Unit found that none of them had defined duties that were clearly understood, either by them or FBI managers. Nor were there any memoranda of understanding (MOU) between the FBI and the CIA setting out the job duties and responsibilities of any of the detailees.257 Moreover, we asked the FBI for the performance appraisals for all five of the detailees to the Bin Laden Unit during this period, and we received 257 We asked both the FBI and the CIA for any memoranda of understanding between the agencies specifying the job duties of any of the detailees. The only MOUs we received, which were provided by the CIA, related to the administrative nature of the details, such as time and attendance reports, travel and training expenses, security clearances, and medical coverage. The MOUs did not address their substantive duties or responsibilities. 318 appraisals for three of them. They revealed that the FBI detailees were evaluated based on the elements for their positions at the FBI, not based on whatever they were supposed to be doing while working at the CTC.258 The FBI was unable to provide any other documents defining or outlining the roles or responsibilities of these detailees. We also interviewed the detailees about their understanding of their roles and responsibilities at the CTC. They stated that they were not given any specific instructions about their job duties. They described their details at the CTC as ill-defined and with little direction. As a result, each detailee defined the job at the CIA as he or she determined it to be, and there was significant variation in their conceptions of the job. For example, Dwight told the OIG that he focused on leads that were related to financial components of terrorism, which he developed from various sources, such as from reviewing cable traffic, from his supervisors at the CTC, and from referrals from CIA officers at the CTC. By contrast, Malcolm told the OIG that he thought he was the “eyes and ears” of the New York Field Office, and that his role was “to monitor” cases being worked jointly by the CIA and the New York Field Office, such as the East African embassy bombings investigation. He said that he also would follow up on requests for information from the FBI to the CIA. Moreover, Mary said she was not given any specific instructions about her role at the CIA, but she was eventually trained to be a CTC desk officer and that was how she operated – like other CTC desk officers with specific assignments or “accounts.” Eric, who was a Bin Laden Unit Deputy Chief, said that he was told “to fix” the relationship between the Bin Laden Unit and the FBI, but he was not given any specific instructions about how to go about accomplishing this objective. He said that he assisted in the running of the Bin Laden Unit by directly overseeing CTC operations and that he also functioned in a liaison role between the CIA and the FBI. He supervised the FBI detailees like he did other Bin Laden Unit employees. He was not given any other supervisory 258 For a fourth detailee, Mary, the FBI produced only a performance plan but no appraisal reports. The performance plan was related to her duties as an FBI IOS. Mary told the OIG that she was directed by CTC management based on her work as a CIA desk officer and was not evaluated by FBI personnel. 319 oversight particular to the detailees. He said that on his own initiative he tried to stay abreast of matters that might be of interest to the FBI by reading the CTC cable traffic. However, he explained that determining what might be of interest to the FBI was very subjective because there were no criteria defining what should be brought to the attention of the FBI. We also interviewed the highest-ranking FBI employee detailed to the CTC, who was a Deputy Chief of the CTC from 1999 through 2002. We call him “Evan.” Evan believed that one of the FBI detailees’ functions would have been to review CIA cable traffic for information of potential relevance to the FBI. Yet, the detailees told the OIG that while reviewing CIA cable traffic was part of their jobs, it was not their function to review cable traffic for items of interest to the FBI, and they did not review all of the cable traffic on a daily basis. They said they did not think they were acting as backstops to ensure that anything that might be relevant to the FBI was brought to the FBI’s attention.259 The detailees asserted emphatically that their function did not entail scouring CIA cable traffic for the FBI, and their efficacy would be limited if they were perceived by CIA personnel merely as moles for the FBI.260 They also explained that even if this had been their role, it would have been difficult to do because of the volume of cables, especially during the chaotic Millennium period. The two FBI employees who held similar supervisory positions – one as a deputy chief in the Bin Laden Unit and the other as a deputy chief in another unit that later housed the Bin Laden Unit – also had differing views on their responsibility for reviewing cable traffic. Both agreed that their role was not merely to review cable traffic for items of interest to the FBI. Eric told the 259 We also interviewed the first FBI employee detailed in March 1996 to Bin Laden Unit soon after it was created. This detailee was an agent from the FBI’s New York Field Office, and he remained at the CTC until August 1998. He said that he did not attempt to review all of the cable traffic. He indicated, however, that when he did locate information of interest to the FBI, he did not encounter problems obtaining the CIA’s permission to share this information with the FBI. 260 Some CIA employees we interviewed stated that they, by contrast, believed that this was the function of the New York Field Office detailee. We discuss this further in the next section. 320 OIG that while he tried to review the traffic in order to stay abreast of the information in the CTC, it was too much for one person to manage effectively. By contrast, Craig, who followed Eric as a manager detailed to the CTC, told the OIG that he did not even attempt to review the cable traffic but only focused on those cables that required action on his part. In addition to failing to clearly define the roles and responsibilities of the detailees, the FBI did not provide oversight of the detailees. Eric acted as one of two deputy chiefs within the Bin Laden Unit. After Eric left the CTC, Craig was a deputy chief in a much larger unit that included the Bin Laden Unit. Both said that they performed day-to-day supervision of the detailees in the same manner in which they supervised the other CTC employees assigned to their groups.261 According to Eric and Craig, they did not focus specifically on the role of FBI detailees. Evan told the OIG that he did not supervise any of the detailees, and he had no authority to oversee their duties or direct their activities, except by virtue of his position as a senior manager within the FBI. He said that they were evaluated by their chain of command in the FBI office from which they had been assigned, which is supported by the limited documents we reviewed. We found that there was no oversight by the FBI of the detailees based on their function as detailees. The FBI’s failure to adequately oversee the detailees is illustrated by the role of Mary, the only FBI analyst detailed to the Bin Laden Unit. She has been detailed to the CIA since 1998. Mary had the opportunity to learn valuable analyst skills by working alongside CTC personnel and then use those skills at the FBI. Additionally, the detail provided an opportunity to learn about the CIA infrastructure and establish liaison contacts at the CIA. Mary told us that she operated as a full-fledged CIA desk officer, and that she has worked with FBI personnel during her detail but from the position of a CIA employee, not an FBI employee. We believe there needs to be a review of the duration of these details to ensure the value of these details is maximized. 261 Eric left the CTC in mid-January 2000, and Craig did not arrive at the CTC until July 2000. Thus, between mid-January and July 2000 the FBI had no supervisory presence for the FBI employees detailed to work Bin Laden matters at the CTC. 321 At a time when the FBI is concerned about the shortage of qualified analysts to do the work it has, a 5-year detail of an FBI analyst working as a CTC employee warrants review by the FBI.262 The same lack of oversight and direction was evident regarding the work of Malcolm, the FBI New York Field office detailee to the CTC. He had been traveling to the CTC from New York on a weekly basis for four years, until January 2003. On Mondays he traveled from New York to the CTC, stopping by FBI Headquarters. On Fridays he stopped by FBI Headquarters on his way back to New York. After the bombing of the Cole, he spent at least half of his days in Washington, D.C. at FBI Headquarters. Thus, he was frequently away from the CTC and not in a position to maximize his potential for obtaining information at the CTC. This also left the perception with other CTC employees that he was not fully integrated into the CTC. We found that that the FBI lacked a systematic approach to its use of detailees at CTC’s Bin Laden Unit. The detailees could have functioned in one of three ways – as fully integrated members of the CTC working unilaterally on CTC matters, as backstops ensuring all pertinent CTC information was forwarded to the FBI, or in some combination thereof. While there are potential benefits to using the detailees in any of these functions, the potential benefits were not maximized because there was no clear understanding of the detailees’ roles and no system to ensure that any objectives were met. The lack of oversight over FBI detailees to the CTC resulted in squandering critical opportunities for information sharing between the CIA and FBI. We also found significant misunderstandings between employees of these two agencies regarding their respective responsibilities for information sharing. First, as noted above, we found that some CIA employees believed that FBI detailees had more responsibility for reviewing the CIA cable traffic than the FBI detailees believed that they had. One CIA Bin Laden Unit employee told the OIG that the CIA was not going to “spoon feed” information to the FBI and that the FBI personnel at the Bin Laden Unit had access to all of the CIA cable traffic. She stated that while the CTC provided to the FBI intelligence 262 The OIG is in the process of completing a comprehensive review of FBI’s analyst program. 322 information that contained a domestic nexus, she did not believe it was the CIA’s responsibility to provide all of the predicating material, since the FBI detailees also had access to the same cables. In addition, CIA personnel described FBI detailee Malcolm as a “mole” for the FBI’s New York Office, suggesting they thought he was reading CIA cables for the express purpose of reporting back to the New York Field Office on what he found. In addition, we found that a similar misunderstanding existed among FBI employees in New York with respect to the role of the CIA employee detailed to the FBI’s New York Field Office. A CIA employee assigned to the JTTF in the New York Field Office had a desk in that office’s sensitive compartmented information facility (SCIF).263 FBI agents in the New York Field Office asserted to the OIG that this individual was knowledgeable regarding their investigations and that he was responsible for reviewing CIA traffic, finding items of interest to the FBI, and bringing this information to the attention of appropriate New York agents. The CIA employee, however, denied that this was his role. He told the OIG that he had been sent to the New York Office to “improve the relationship between the CIA and the FBI” and that he provided the FBI with CIA intelligence that was designated for the FBI New York Field Office’s review. He stated, however, his job was not to “spoon feed” information but only to make it accessible to the agents in New York. This meant that he would print information obtained from CIA databases that was of potential interest to the FBI New York Field Office and make that information available for review in the SCIF if FBI agents decided to come and review it. But, apparently unknown to many New York FBI agents, he believed the onus was on FBI personnel to come into the SCIF and see if any new, relevant information had arrived, rather than to alert them to that information. He also said that while he generally knows what the various FBI squads are investigating, the New York JTTF has over 300 members and he could not reasonably be expected to have knowledge of all their investigative interests. He said that if he spent his time 263 The FBI agents do not routinely work in a SCIF area. The computers on which they access ACS do not contain sensitive compartmented information or materials classified above Secret. Because a high percentage of CIA traffic contains this information, the CIA detailee must work in a separate area. 323 solely looking for information of interest to the FBI, he would never get any work done. As a result, FBI agents in New York believed they were receiving from this CIA employee assigned to the JTTF all of the CIA information of interest to the FBI, when in fact they were not. Therefore, the New York agents could have received information on Hazmi and Mihdhar directly through their own CIA employee, but they misunderstood the process. 2. FBI employees’ lack of understanding of CIA reporting process These gaps in the information sharing process were exacerbated by FBI personnel’s lack of understanding of the CIA’s reporting process. This problem is clearly illustrated by the failure of the FBI to obtain the information on the identification in January 2001 of Khallad in the Kuala Lumpur photographs by the joint FBI/CIA joint source. As detailed above, we concluded that the FBI’s ALAT was not made aware of the source’s identification of Khallad in the Malaysia meetings photographs. Although the ALAT attended the debriefing of the source, the ALAT did not immediately receive the information that the source had identified Khallad. We were unable to ascertain the reasons for this significant omission. However, our review found that there were later opportunities for the ALAT to have obtained information about the identification from CIA documents. In addition, we found that the New York FBI agents working the Cole attack investigation did not learn of this significant information, despite interviewing the source on several occasions. We believe this was due in part to the fact that the FBI personnel were not familiar with the CIA’s process for reporting intelligence information. As discussed previously, the CIA primarily relies on cable traffic to share intelligence among its personnel who are stationed around the world. None of these cables are available for FBI review, except by the limited number of FBI personnel with direct access to CIA computer systems, such as the detailees at the CTC. The CIA uses a certain type of cable called a TD to disseminate CIA information outside of the CIA to other U.S. government agencies. These cables are created by CIA reports officers based on their review of the internal 324 CIA cable traffic. The reports officers were described to us as “editors” who remove references to sources and methods contained in the cables and determine what information should be further disseminated in the TDs. As a result, TDs did not necessarily include all the substantive information contained in the internal cable traffic. Our review found the ALAT did not understand that the TDs did not necessarily contain all of the intelligence gathered by the CIA from a particular source or on a particular event. The ALAT had been keenly aware of the significance of Khallad to the FBI, and contemporaneous FBI documents outline his efforts in mid-January 2001 to try to ensure that all the information obtained from the joint source was provided to the UBL Unit at FBI Headquarters and the Bin Laden Squad in the New York Field Office. However, he relied on the TDs concerning the source’s reporting to ensure the completeness of the information that he had provided to his FBI colleagues. The ALAT erroneously believed he had obtained all the source reporting through the TDs. This was not the case. The January 2001 Khallad identification was only reported in an internal CIA cable and was never included in a TD. In addition to the ALAT, New York FBI agents working on the Cole investigation told us that when they read a TD regarding a particular subject (which they could access through CTLink), they mistakenly believed that it contained all relevant information from the source debriefings. The primary Cole case agent told us that he believed that the CIA operational cables dealt with techniques and methods, but he did not know that these cables also contained the details of debriefings. He said that he had “assumed” all the substantive reporting would be contained in the TDs, so he never asked the CIA to allow him to review the underlying cable traffic. If these FBI employees had a more thorough knowledge of the information flow within the CIA, they could have ensured that they received all the relevant information from the joint source. This was especially significant in the case of Hazmi and Mihdhar because the CIA and FBI had decided the majority of the joint source’s reporting would be handled through CIA channels, and the ALAT did not independently report in FBI documents most of the source’s information. For example, in this case, the FBI could have requested to review the CIA’s internal cables or asked the interviewing CIA officer to review the TDs and the FBI documentation to ensure all the 325 information had been captured. However, the lack of understanding by FBI personnel of the CIA reporting process and its procedures for sharing intelligence contributed to the FBI not learning of significant information in CIA cables about Khallad – which would have tied an al Qaeda operative to the Malaysia meetings attended by Mihdhar and potentially resulted in the FBI focusing on Mihdhar much earlier. 3. Inadequate procedures for documenting receipt of CIA information We also found that the FBI lacked consistent policies or procedures for the receipt and documentation of intelligence information received from the CIA. In addition, structural impediments within the FBI undermined the appropriate documentation of information received from the CIA. As we detailed above, the information concerning the surveillance of suspected al Qaeda operatives at the Malaysia meetings, including Mihdhar, was verbally conveyed in January 2000 by a CIA officer to two FBI employees who were working in the FBI’s Strategic Information Operations Center (SIOC). But this important information was not documented in any retrievable form at the FBI. The FBI was able to provide only three documents regarding the briefing on this information. First, one FBI e-mail message was recovered through a painstaking review of messages on an FBI server that the FBI searched in connection with a request from the JICI. Although this written record survived from that time, no analyst or agent would have had access to the information, learned of its existence, or been able to conduct the type of search that led to the discovery of this document. Second, information regarding the briefing was also located in one of the FBI Director’s daily briefing documents prepared in response to the Millennium threats. These briefing documents, however, were not electronically archived in a searchable database that analysts or agents in the field could access. Third, a brief handwritten note about the information he received from the CIA was contained in the personal daily calendar of one of the FBI employees briefed by the CIA officer in the SIOC. We found there were no clear procedures for documenting intelligence communicated by the CIA to the FBI in an informal manner, such as the verbal 326 briefings on Mihdhar in the SIOC. Although the SIOC had been activated during the Millennium for the express purpose of handling threat information from various sources, FBI personnel assigned to the SIOC during this period told us that there were no procedures for the receipt and handling of interagency information communicated informally unless it related to an ongoing FBI investigation. Although one witness suggested that some type of log might have existed to record incoming physical information, such as documents, the FBI found no such log. Moreover, FBI witnesses told us that the log would not have been used to document verbal briefings. Therefore, any documentation of information received informally would have been at the discretion of the recipient. We are not suggesting that every informal communication from the CIA to the FBI should be documented. We also recognize it is difficult to know the significance of any individual piece of information when it is received. Yet, we believe that the FBI should attempt to establish criteria or guidance for determining what information from informal briefings should be documented, and how it should be documented. The information received in the SIOC on Mihdhar was recorded only in a briefing provided to the Director and executive staff, which is not available to others throughout the FBI. Clearly, the authors of the Director’s daily briefing believed there was some import to this information. Because the Mihdhar information was never documented in an accessible format, only those individuals personally informed about the CIA’s information on the Malaysia meetings or those present for the Director’s briefings were made aware of the Mihdhar information. In effect, it was lost to everyone else because no analysts or field agents would be able to search for or locate this information. An effective analytical program requires that analysts have access to all available information, and that pertinent information is not contained solely in the personal memories of selected individuals. This was particularly significant because the information on Mihdhar initially did not appear to be important. But it subsequently became very significant. In the summer of 2001, FBI personnel eventually recognized the significance of the Malaysia meetings. At this time, the e-mail and the information from the Director’s briefing in January 2000 were not available to the FBI personnel. Without mechanisms to maintain information in which the significance is not immediately apparent, the FBI will not be able to fully connect and analyze disparate pieces of information for their significance. 327 In addition, even if the agents who received the information in the SIOC had wanted to document it in a form that was available throughout the FBI, the FBI lacks an information technology system capable of adequately handling this type of information. As discussed previously, the FBI’s primary electronic information storage system is the Automated Case Support (ACS) System. ACS is a case management system designed to capture information related to specific investigations and not for this type of general intelligence information. There was no FBI system that would allow this type of information to have been maintained so that it would be available for directed searches or other subsequent data mining. It is also important to note that ACS is not approved for storage of information classified above the Secret level and is not approved for storage of any sensitive compartmented information. Thus, it is not available for storage of the majority of the relevant Intelligence Community information, including the information on Hazmi and Mihdhar. In the absence of effective methods for recording and retrieving information obtained from other intelligence agencies, the benefits of increased information sharing among the agencies will remain of limited use. Based on the system in effect during this period, the value of the information was minimal, unless the information was relayed to an individual who could immediately use the information or the information related to an ongoing FBI investigation. When, as here, subsequent additional information increases the significance of the prior information, the absence of an effective information retrieval system effectively precludes any meaningful effort by the FBI to analyze the disparate pieces of information over time. In sum, despite the fact that some personnel at the FBI were aware in January 2000 that Mihdhar was possibly linked to al Qaeda operations and traveled to Malaysia to meet with other suspected al Qaeda operatives, this information was unavailable for further analysis or use once the SIOC closed down in late January or early February 2000. Because no one was assigned to document, follow up, or track the information on Mihdhar, the FBI’s opportunity to discover Mihdhar’s valid U.S. visa during this period and therefore try to locate him was lost. 4. Lack of appropriate infrastructure in FBI field offices Information sharing with the FBI also was impeded by the inadequate facilities for the handling of intelligence information in the two field offices 328 most directly involved in the Hazmi/Mihdhar matter. Intelligence information from the CIA is often classified at a high level. As a result, safeguards must be taken in handling the information, while still allowing appropriate FBI employees the ability to access and use the information. Unfortunately, the FBI’s field offices generally lacked both the necessary physical infrastructure and information technology to readily use this type of information. Without the appropriate physical infrastructure, the FBI will not be able to handle sensitive information in an effective manner. To handle SCI classified material, employees must store and review such information in a SCIF. Access to the SCIF is limited to individuals with the appropriate clearance level and the need to know the information in the SCIF. Adequate security measures must be implemented to prevent unauthorized individuals from gaining access to the spaces containing such materials. The type of equipment that may be brought into the space is also strictly limited. For example, cellular telephones, two-way pagers, and other unsecured communication devices are prohibited. Telephones in SCIFs must be designated for secure transmissions. Computer networks also must be secured for transmission of information. During our review, we observed the workspaces in the FBI New York and San Diego Field Offices and found that they were not set up to adequately handle the type of information involved in the Hazmi and Mihdhar cases. These workspaces were not adequately secured to permit FBI personnel to handle CIA and NSA information at their own desks, even if they had been given the information. Nor were the SCIFs suitable to permit agents to regularly access or handle such information. In the New York Field Office, for example, the SCIF we were shown was extremely small. The CIA detailee to the JTTF worked in this SCIF, but there was little room for any other personnel to enter, let alone use it as a workspace. In the San Diego Field Office, a small SCIF was used as a secure communications center for the entire office. The San Diego office lacked a separate SCIF for the JTTF,264 including the CIA 264 We were informed that a separate SCIF for the JTTF is under construction in the San Diego Field Office. However, this SCIF will only be large enough to accommodate three or four employees at any one time. 329 representative assigned to the task force. As a result, the San Diego agents were hampered in their ability to access CIA information. We also found that New York and San Diego FBI agents did not have sufficient access to secure telephones, known as Secure Telephone Unit third generation or STU III telephones. The limited STU III phones available had to be shared among numerous agents. Again, this made communications involving classified material within the FBI or with other members of the Intelligence Community more difficult. An entire squad comprising as many as 25 individuals shared one or two STU III phones. In addition, as noted above, the FBI agents did not have access to computer systems that could store much of the information received from the CIA. The computers at each agent’s desk in the New York and San Diego Field Offices only provided access to ACS. This system does not permit storage or access to any information classified above the Secret level or any information deemed sensitive compartmented information. Therefore, even if the FBI recipients of the CIA information regarding Hazmi and Mihdhar had wanted to document and store such information in a retrievable fashion, they could not have stored it on the system that FBI agents use. The FBI had no internal system in New York and San Diego that allowed them to use the type of information involved in the Hazmi and Mihdhar case. In addition, most FBI agents in the field did not have direct access to CTLink, the shared Intelligence Community database that did contain some of the information on Hazmi and Mihdhar, such as the NSA information. Field agents could not access, let alone conduct research, on this system. As a result, even if the New York and San Diego agents wanted to search for relevant information about Hazmi and Mihdhar, any sensitive or highly classified information obtained from the NSA and CIA could not be stored in the one system that they used. In contrast, we observed that the CIA’s workspaces permitted their employees to access highly classified information on computers in their personal workstations. Each CIA employee had their own secure computer on which they could receive and research highly classified material. They had several secure telephones that could be used to discuss Top Secret information with others. The difference in CIA and FBI workspaces was particularly stark in the FBI’s San Diego Field Office where, due to the lack of access to an 330 appropriate SCIF, the CIA employee co-located with the FBI’s San Diego Field Office could not access CIA systems. To access CIA systems, he had to travel to a domestic CIA station. 5. OIG conclusion on impediments to information sharing In sum, significant and systemic problems that were evident in the FBI’s handling of the Hazmi and Mihdhar case inhibited information sharing between the FBI and CIA. The FBI failed to define the roles and responsibilities of the FBI detailees to the CTC’s Bin Laden Unit. The FBI failed to ensure effective oversight of the detailees at the CTC. The FBI and the CIA failed to develop a clear understanding of the function of detailees from each other’s agencies. The FBI failed to understand the CIA’s reporting process. The FBI lacked an adequate computer system and appropriate infrastructure for handling intelligence information not directly related to a specific investigation. Although these systemic problems affected the flow of information between the FBI and CIA, we do not believe they fully explain the FBI’s failure to obtain the critical information on Hazmi and Mihdhar. Employees at both the CIA and the FBI failed to provide or seek important information about Hazmi and Mihdhar, despite numerous interactions between them on issues related to Hazmi and Mihdhar from January 2000 through August 2001. We found these interactions were substantive and that much of the information about Mihdhar and Hazmi was exchanged through these ongoing efforts. Unfortunately, the critical pieces of information relating to Hazmi and Mihdhar did not become known to the FBI until shortly prior to September 11. As a former CTC Bin Laden Unit Deputy Chief aptly summarized it to us, “information that should have been shared was not, repeatedly.” B. The actions of the San Diego FBI In addition to issues that affected information sharing between the FBI and the CIA, the FBI had other opportunities to find information about Hazmi and Mihdhar before the September 11 attacks. The time that Hazmi and Mihdhar spent in San Diego was an opportunity during which the FBI could have obtained information about them but did not. As discussed above, Hazmi and Mihdhar entered the United States in January 2000 and moved to San Diego in February 2000, where they resided unbeknownst to the FBI. While in San Diego, Hazmi and Mihdhar associated with Omar al-Bayoumi, a person 331 whom the FBI had previously investigated, and they also lived with an active, FBI informational asset. Yet, the FBI did not become aware of their presence in San Diego until after September 11, 2001. Because Bayoumi spent a significant amount of time with Hazmi and Mihdhar in early 2000, it is possible that – had a full field investigation of Bayoumi been open at the time – the FBI could have discovered Mihdhar and Hazmi’s presence in San Diego and also uncovered the CIA information about their attendance at the Malaysia meetings. Because Hazmi and Mihdhar lived with an FBI asset, it is also possible that if the FBI had documented their presence in San Diego, it would have provided additional investigative leads that could have aided the New York FBI in locating them in August 2001. We therefore evaluated the San Diego FBI’s investigation of Bayoumi and the decision to close its preliminary inquiry on him in June 1999. We also examined the San Diego FBI control agent’s decision not to obtain or document information from his information asset about Hazmi and Mihdhar, who were boarders in the asset’s house. In examining the San Diego Field Office’s handling of the Bayoumi investigation and the informational asset, we also found that, despite the fact that FBI Headquarters had established counterterrorism as a top priority of the FBI in 1998, the San Diego Field Office was continuing to pursue drug trafficking as its top priority in 2001. While the FBI made counterterrorism its top priority on paper, the FBI took few steps to ensure that field offices complied with this directive. We discuss this issue at the end of this section. 1. The San Diego FBI’s preliminary investigation of Bayoumi As discussed above, Bayoumi is a Saudi national who in January 2000 had been living in the United States for approximately six years, was well-paid by a Saudi company that contracted with the Saudi government, and was involved in setting up mosques in the San Diego area. Hazmi and Mihdhar met Bayoumi in Los Angeles approximately two weeks after entering the United States in January 2000. A few days later they moved to San Diego, where Bayoumi assisted them in obtaining an apartment in the complex where he lived. They lived in this complex for four months. Bayoumi’s name had first surfaced at the FBI in 1995 in connection with other investigations. Bayoumi’s name resurfaced at the FBI on August 31, 332 1998, when his apartment manager contacted the FBI to report her suspicions regarding Bayoumi’s activities. The manager reported that she had been notified by the U.S. Postal Inspection Service in March 1998 that Bayoumi had been sent a “suspicious” package from the Middle East. According to the manager, the package had broken open and had a number of wires protruding from it. She reported further that the apartment complex maintenance man had noticed a number of wires protruding beneath the bathroom sink in Bayoumi’s master bedroom. She reported that there had been large meetings of men, who based upon their dress appeared to be Middle Eastern, gathering in Bayoumi’s apartment on weekend evenings. She also complained that several parking spots were being illegally used by the people gathering at Bayoumi’s apartment. On September 8, 1998, the San Diego FBI opened a preliminary inquiry on Bayoumi.265 The assigned agent checked FBI indices for further information regarding Bayoumi and conducted other investigative steps. The agent contacted the U.S. Postal Inspection Service in reference to the alleged “suspicious” package sent to Bayoumi. A postal inspector advised the FBI agent that “suspicious” did not necessarily mean “nefarious,” and the vast majority of suspicious packages were benign. The postal inspector reviewed the report relating to the Bayoumi package and told the agent that the package had been deemed “suspicious” because it had no customs papers or appropriate postage and originated in Saudi Arabia. According to the report, there was no record of any wires protruding from the package, Bayoumi had retrieved the package, and it was no longer called a “suspect parcel.” According to the FBI agent, the apartment manager agreed to record the license plate numbers of the meeting participants. However, the manager later advised the agent that meetings had dwindled to a few participants and then stopped all together. 265 In accordance with the Attorney General’s Foreign Counterintelligence Guidelines, a preliminary inquiry could be opened when there was information or allegations indicating that an individual is or may have been an international terrorist or a recruitment target of an international terrorist organization. Preliminary inquiries were permitted to remain open for 120 days and had to be closed unless the FBI obtained sufficient evidence to open a full field investigation. 333 The agent asked fellow FBI agents to ask their “logical sources” for information regarding Bayoumi. The sources related the following concerning Bayoumi: • Bayoumi was married with small children and had recently completed a master’s degree program and he was looking for a Ph. D. program, but his test scores were too low. He was approximately 30 years old and unemployed. • Bayoumi was a Saudi who regularly attended the ICSD (Islamic Center of San Diego). He was married with children and was working on a master’s or other advanced degree. • Bayoumi reportedly delivered $400,000 to the Islamic Kurdish community in El Cajon, California in order to build a mosque. Source opined Bayoumi “must be an agent of a foreign power or an agent of Saudi Arabia.” • Bayoumi was in the U.S. on a student visa but was applying for a green card. Bayoumi claimed to have a master’s degree and was working on a Ph. D. His father was sending him $3,000 a month for support while he was in school. The FBI agent also contacted the INS in reference to Bayoumi’s immigration status. An INS special agent advised that Bayoumi was in the U.S. on an F-1 student visa, but his work visa had expired. However, the INS reported that his visa could be renewed. The FBI agent received no further substantive information in response to various information checks. According to the agent, the only remaining option was to conduct an interview of Bayoumi. After her supervisor consulted with fellow FBI agents who were working on a large, sensitive counterterrorism investigation involving an alleged terrorist organization, the supervisor instructed the agent not to conduct the subject interview of Bayoumi.266 The agent told the OIG that she did not believe the decision was inappropriate 266 The file indicates that the decision not to conduct an interview was due to an investigation that included a proposed proactive element. The FBI believed that the benefits of interviewing Bayoumi did not justify the risk to the proposed operation. 334 based on the potential effect of such an interview on the other sensitive investigation. On June 7, 1999, the FBI closed its preliminary inquiry on Bayoumi, and he was no longer actively under investigation by the FBI. The FBI case agent told the OIG that she had no concrete information linking Bayoumi to any terrorist activities. She stated that the allegations that gave rise to the preliminary investigation were not substantiated. With respect to the source reporting that Bayoumi had received large sums of money from overseas, the case agent explained it was not unusual for foreign students, especially from Saudi Arabia, to regularly receive money, even large sums of money. Therefore, the case agent did not consider this to be inherently suspicious. The agent’s squad supervisor at the time and other agents on the squad also told the OIG that it was not unusual or suspicious for Saudi students to have received large sums of money from Saudi Arabia. As stated above, one source had provided unverified information that Bayoumi could potentially be a Saudi intelligence operative or source. According to the agent, Bayoumi was allegedly very involved and interested in Saudi affairs in San Diego, and this probably led to the suspicions about Bayoumi’s connection to the Saudi government. However, the agent told the OIG that Saudi Arabia was not listed as a threat country and the Saudis were considered allies of the United States. 267 Therefore, Bayoumi’s potential involvement with the Saudi Arabian government would not have affected the FBI’s decision to close the preliminary inquiry. The squad supervisor at the time of our investigation, who had been an agent on the squad for several years, told the OIG that before September 11, the Saudi Arabian government was considered an ally of the United States and that a report of an individual being an agent of the Saudi government would not have been considered a priority. Other agents on the squad also said that a source reporting that an individual was an agent of the Saudi government 267 Country threats are defined by the FBI as foreign governments or entities whose intelligence activities are so hostile, or of such concern, to the national security of the United States that counterintelligence or monitoring activities directed against such countries are warranted. 335 would not have been cause for concern because the Saudi government was considered an ally of the United States. In addition, the case agent explained that more intrusive investigative techniques could not be conducted because of the restrictions of the Attorney General FCI Guidelines in effect at the time. No meaningful surveillance could be conducted, no bank records or other financial records could be sought, and very little investigative activity beyond fully identifying the individual could be done. In sum, we do not believe that the FBI’s actions with regard to Bayoumi and its decision to close the preliminary inquiry were inappropriate. The agent conducted logical investigative steps that were permitted under the Attorney General Guidelines in effect at the time, such as checking FBI records for information, asking other intelligence agencies for information about the subject, and asking agents to query their sources about the subject, but the agent did not uncover any information to support the allegations. The Guidelines did not permit the case agent to engage in more intrusive investigative techniques, such as a clandestine search of Bayoumi’s property, obtaining his telephone or financial records, or secretly recording his conversations. Although the Attorney General Guidelines would have permitted a subject interview of Bayoumi prior to closing the preliminary inquiry, the decision not to conduct an interview appeared warranted, given its possible effect on an ongoing significant investigation. 2. The FBI’s handling of the informational asset As described above, in May 2000 Hazmi and Mihdhar began renting a room in the home of an FBI informational asset. An FBI San Diego Special Agent who we call “Stan” was the asset’s control agent since the asset was opened in 1994. The asset had provided the FBI with significant information over the years and was considered a reliable source. He was well known in the Muslim community. He often rented rooms in his house to Muslim men in the community who needed temporary housing. At the time that Hazmi and Mihdhar moved in with him, he had two other individuals renting rooms in his house. Mihdhar lived with the asset until June 10, 2000, when he left the 336 United States, and Hazmi remained as a boarder at the asset’s home until December 2000. According to Stan, the asset told Stan that two young Saudis who had recently come to the United States to visit and study had moved in as boarders. The asset described them as good Muslims who often went to the mosque and prayed. The asset provided Stan with their first names but little other identifying information. Stan did not obtain any additional information from the asset about the boarders, such as their last names, and he did not conduct any investigation of them. Had Stan pursued information about Hazmi and Mihdhar, he might have uncovered the CIA information about them. In addition, he might have created a record in FBI computer systems about Hazmi and Mihdhar’s presence in San Diego, which would have provided the FBI with additional information and avenues of investigation when it began to search for them in August 2001. For these reasons, we examined Stan’s actions with regard to the asset. In interviews with the JICI staff and in congressional testimony, Stan stated that the informational asset primarily provided information about the activities and identities of persons in the Muslim community in San Diego who were the subjects of FBI preliminary inquiries or full field investigations. 268 Stan said that the asset volunteered some information about other individuals as well. He said he thought that the asset had good judgment about which individuals might pose a threat and that his reporting had been “consistent” over the years. We reviewed the asset’s file and noted the asset provided information on a regular basis on a variety of different individuals and topics. Although we could not evaluate the asset’s judgment from the file, we consider Stan’s description of the asset’s reporting to be apt. Stan also stated that he was aware that the asset had boarders in his house over the years, and the fact that two new boarders had moved in with the asset did not arouse suspicion. He noted that the asset volunteered that the two boarders were living with him soon after they moved in, but the asset provided the information about his boarders as part of a personal conversation and not 268 As noted above, Stan has retired from the FBI and declined to be interviewed by the OIG. 337 because the asset believed that it had any significance. Stan stated the information provided from the asset was that the two boarders were from Saudi Arabia, which, according to Stan, was not a country that the United States had placed on the list as a threat to national security. Stan said that the asset did not describe his boarders as suspicious or otherwise worthy of further scrutiny. He also asserted that he was prohibited from further pursuing the information about Hazmi and Mihdhar, including documenting the information that he had obtained, because of the Attorney General Guidelines in effect at the time. In examining Stan’s actions, we first considered whether the Attorney General’s FCI Guidelines were applicable to the situation involving Hazmi and Mihdhar. As suggested by Stan, the Attorney General’s FCI Guidelines were designed to ensure that the FBI opened preliminary inquiries and conducted investigations only if the required predicating information was present. Because there were no allegations or information provided to Stan that Hazmi and Mihdhar were terrorists or agents of a foreign power, we agree that Stan did not have sufficient information to open a preliminary inquiry and actively investigate Hazmi and Mihdhar. We also considered whether, at a minimum, Stan could have attempted to obtain additional information about people who were living with his informational asset, such as their full names, and whether he was required to document the information on Hazmi and Mihdhar that he had received from his asset. First, we reviewed FBI policies and procedures for handling assets. Those policies did not require Stan to obtain information from an informational asset about people living in the asset’s house or to conduct record checks to obtain this information. In addition, the policies do not appear to require Stan to have documented information received from the asset about anyone living with him, or to even document their full identities if he had obtained that information. We also interviewed several FBI agents who were on Stan’s counterterrorism squad and asked them whether it would have been their practice to seek additional information about boarders living with an informational asset and what, if anything, they would have done with this information. We found no consensus among them about whether information on boarders like Hazmi and Mihdhar who lived with an informational asset should have been obtained and documented. Some agents stated that they would have pursued more information about boarders living with an 338 informational asset, while others stated that they would not have. Some of the agents stated that they would have noted the fact of the informational asset having boarders in his file. Some agents stated that they would have documented the identities of the roommates in an EC that would have been uploaded to ACS. However, former San Diego Division Special Agent in Charge William Gore told the OIG that he “did not believe anything had been done wrong” in the handling of the informational asset and he did not fault Stan for not obtaining the information. While we recognize that no FBI policy addressed this issue and there was a lack of consensus on what should have been done in a situation like this, we believe that it would have been a better practice for Stan to have questioned the informational asset about his boarders and obtained their full identities. Stan was aware that Hazmi and Mihdhar were relative strangers to the informational asset, and that they were not friends, family, or long-time associates of the asset. Stan also was aware that the asset had no direct knowledge of Hazmi and Mihdhar’s backgrounds and could not vouch for their character. Moreover, the boarders in the asset’s home were in a position to put the asset and the information he supplied to the FBI in jeopardy. Therefore, prudence and operational security would suggest that information about persons living with the asset should have been sought, at least to the extent of learning and documenting their names, and perhaps running a records check on them. If Stan had asked more questions about the asset’s boarders, he also may have acquired enough information to pursue further inquiry. For example, the asset has stated after the September 11 attacks that Hazmi and Mihdhar did not make telephone calls from his house, and that in retrospect he found this behavior to be suspicious. The asset also stated after September 11 that he had told Hazmi to stay away from Bayoumi because of his alleged association with the Saudi government. Therefore, if Stan had asked the asset a few more questions about Hazmi and Mihdhar and acquired this kind of information, it may have led Stan to conduct further inquiries, particularly since Bayoumi had been the subject of an FBI investigation. Moreover, while no specific FBI policy required agents to obtain information about persons living in a house with an informational asset, FBI policies required control agents to continuously evaluate the credibility of their informational assets. Before informational assets are approved, they are required to undergo a background investigation to assess their suitability, 339 credibility, and “bona fides.”269 Certain minimum checks were required, such as a check of FBI indices, local criminal checks, and CIA traces. The policy provided that additional checks “may be deemed necessary,” such as querying other assets and running indices checks on immediate family members. In addition, FBI policy provided that an asset’s bona fides “should be continually addressed,” even after the initial assessment was completed. More specifically, the FBI field office is required to conduct a yearly evaluation of each informational asset and provide the evaluation report to FBI Headquarters. This report is required to contain, among other things, the FBI’s number of contacts with the informational asset during the reporting period, a summary of the most significant information furnished by the informational asset, the number of preliminary inquiries and full investigations that were opened based on information provided by the informational asset, and “steps that have been taken to establish asset bona fides since last evaluation.” Although Stan would not have been required to obtain additional information about his informational asset’s boarders to complete this report, the FBI’s policy of continually vetting the credibility of its assets permitted Stan to seek more information about Hazmi and Mihdhar and the other boarders from his asset and run indices checks on any persons living with his informational asset. We reviewed the informational asset’s file, Stan’s yearly evaluation of the asset, and Stan’s reporting on the bona fides checks conducted on the informational asset. Based on our review, we were concerned by the lack of information included in the file in support of the bona fides checks conducted by Stan each year. In each of the documents provided to FBI Headquarters about the informational asset that we reviewed, Stan wrote the following perfunctory paragraph: “Asset bona fides have been established through independently received reliable asset reporting, [redacted] and physical surveillance.” Stan maintained no predicating information in the file on these bona fides checks. The file did not disclose which checks or surveillance had been 269 The FBI defines “bona fides” to mean that the asset or informational asset “is who he/she says he/she is;” that the asset “has the position or access the asset claims to have;” and that the asset “is not working for or reporting to a foreign intelligence service or international terrorist organization without the knowledge of the FBI.” 340 conducted, by whom, when, or the results. Without that material, the informational asset’s bona fides were merely verified through the attestation of Stan. It is possible that Stan conducted numerous indices checks and conducted an exhaustive bona fides check on the informational asset each year. It also is possible that he conducted minimal or no checks and merely attested to the informational asset’s credibility based on their personal history and relationship. Because we were unable to interview Stan, we could not determine which was more likely. However, no FBI policy described the level of detail to be contained in an asset file. We believe the policy should require an asset file to contain at least minimal information to allow a reviewer to independently verify that an adequate background check has been conducted. This information is necessary to allow FBI managers to determine whether the control agent is continuing to assess each informational asset’s credibility. This information would also help ensure that the control agent has not become too comfortable with the informational asset and thus vulnerable to being misled or failing to obtain adequate information about the asset. We also were concerned by the lack of policy or practice specifying what information from the asset must be documented. The Hazmi and Mihdhar case clearly demonstrates that information must be documented to be useful. Even if Stan had obtained the full names of Hazmi and Mihdhar from the informational asset, he would not have been required to document it in any retrievable format. Without the requirement to document such information, the information would not have been accessible to other FBI personnel. For information to be useful, it must be documented in a retrievable form and it must be available for consideration and analysis. In sum, we believe that Hazmi and Mihdhar’s presence in San Diego should have drawn some scrutiny from the FBI. Although unknown at the time, documenting their presence in San Diego in a searchable and retrievable manner would have provided an opportunity for the FBI to connect information in the future. If Hazmi and Mihdhar’s presence in San Diego in 2000 had been documented, an FBI indices record check in August 2001, when the FBI received information from the CIA that Hazmi and Mihdhar had entered the 341 United States, might have led the FBI to the San Diego information. This connection would have provided substantive leads for the New York FBI’s effort to locate Mihdhar in August 2001.270 3. San Diego FBI’s failure to prioritize counterterrorism investigations As discussed in Chapter Two, in 1998 the FBI adopted a 5-year strategic plan that established the FBI investigative priorities in a 3-tier system. Tier I priorities were “foreign intelligence, terrorist, and criminal activities that directly threaten the National or Economic Security of the United States.” Tier II priorities were “crimes that affect the public safety or undermine the integrity of American society: drugs, organized crime, civil rights, and public corruption.” Tier III priorities were “crimes that affect individuals and property such as violent crime, car theft, and telemarketing scams…” On March 15, 1999, shortly after Director of Central Intelligence George Tenet asserted the U.S. Intelligence Community was declaring war on Usama Bin Laden and al Qaeda, FBI Headquarters established national level priorities within its Counterterrorism Program. Bin Laden and al Qaeda, along with the Bin Laden-allied Egyptian Islamic Jihad (EIJ) and al Gama’at al Islamiyya (IG), were designated as “priority group one” for the FBI’s counterterrorism efforts. Our review of the Hazmi/Mihdhar chronology revealed no appreciable shift in resources by the FBI’s San Diego Field Office in response to these changed priorities. We found that prior to September 11, 2001, the actual investigative priority for the San Diego Field Office was drug trafficking. According to former San Diego Special Agent in Charge William Gore, the highest concentration of FBI agents and resources in San Diego was directed at combating drug trafficking based on the FBI’s process and procedures used each year to set priorities in its field offices. He said that white-collar crime was the office’s second priority, and violent crime was its third priority. 270 As noted, Mihdhar and Hazmi used their own names to open bank accounts, conduct financial transactions, obtain state identification cards, purchase a vehicle, obtain telephone service, take flying lessons, and rent an apartment while residing in San Diego. 342 Counterterrorism was only the fourth priority for the San Diego FBI office. The counterterrorism efforts in San Diego were directed primarily at another terrorist organization and related groups not connected to Al Qaeda, and the majority of San Diego’s counterterrorism investigations targeted activities related to the indirect support of terrorism conducted by those groups. We found that the San Diego FBI focused little to no investigative activity on al Qaeda prior to September 11. San Diego FBI personnel stated to us that they had believed there was no significant al Qaeda activity in San Diego based on information from their sources and investigative activities. The former supervisor of the San Diego counterterrorism squad explained their job at the field office level was to “shake the tree and see what fell out” in relation to potential terrorism activities in their area. Although San Diego agents assigned to counterterrorism conceded they had received little to no specific training concerning Bin Laden or al Qaeda, they asserted that al Qaeda did not have a significant presence in San Diego prior to September 11. Yet, al Qaeda was present in San Diego, unbeknownst to the FBI. Hazmi and Mihdhar resided in San Diego. Unfortunately, the San Diego agents were not focusing on al Qaeda. Even though FBI Headquarters had designated al Qaeda as the number one counterterrorism priority, the San Diego FBI was not attempting to identify individuals that were associated with al Qaeda. Since September 11, many San Diego agents have been moved from other squads and assigned to counterterrorism. Significantly, the San Diego office opened a large number of intelligence investigations on potential al Qaeda subjects immediately after September 11. Obviously, the focus and priorities dramatically changed after September 11. But there is no reason to believe the al Qaeda presence in San Diego began only after September 11. If San Diego’s focus on counterterrorism and al Qaeda had occurred earlier in San Diego, there would have been a greater possibility, though no guarantee, that Hazmi’s and Mihdhar’s presence in San Diego may have come to the attention of the FBI before September 11. However, it is important to note that San Diego’s allocation of resources before September 11 and the lower priority it gave to the Counterterrorism Program were not atypical of FBI field offices before September 11. In an OIG September 2002 audit report entitled “A Review of the Federal Bureau of Investigation’s Counterterrorism Program: Threat Assessment, Strategic 343 Planning, and Resource Management,” we found that “Although the FBI has developed an elaborate, multi-layered strategic planning system over the past decade, the system has not adequately established priorities or effectively allocated resources to the Counterterrorism Program.” Furthermore, the OIG report found that resources were not allocated consistent with the FBI’s priorities – particularly at the field office level – because of the lack of “management controls” in the FBI’s “complicated and paper-intensive strategic planning process.” Instead of allocating resources based on FBI priorities, field offices allocated resources primarily based on previous caseloads in the field office. According to the report, prior to September 11, “the Bureau devoted significantly more special agent resources to traditional law enforcement activities such as white collar crime, organized crime, drug, and violent crime investigations than to domestic and international terrorism investigations.” For example, in 2000 twice as many FBI agents were assigned to drug enforcement than to counterterrorism. Thus, the San Diego’s office allocation of resources was not different from many other FBI field offices, despite the stated priorities of the FBI. C. Events in the spring and summer of 2001 As described in the factual chronology, the FBI had several opportunities in the spring and summer of 2001 to obtain critical intelligence about Mihdhar and Hazmi. Although the FBI and the CIA were discussing Mihdhar, Khallad, and the Cole investigation throughout the spring and summer of 2001, the FBI did not become aware of the critical intelligence involving Mihdhar’s U.S. visa and subsequent travel to the U.S. until late August 2001. As we discussed above, we believe that systemic problems regarding information sharing between the two agencies contributed to the FBI’s failure to obtain this information earlier. But restrictions within the FBI also contributed to the FBI’s failure to acquire critical information about Hazmi and Mihdhar before September 11. In this section, we discuss those problems. 1. Restrictions on the flow of information within the FBI By the summer of 2001, the effect of the various restrictions within the FBI on information sharing – commonly referred to as “the wall” – had resulted in a nearly complete separation of intelligence and criminal investigations within the FBI. This separation greatly hampered the flow of 344 information between FBI personnel working criminal and intelligence investigations, including information concerning Hazmi and Mihdhar in the summer of 2001. As discussed in Chapter Two, in late 1999 the FISA Court had become the “wall” for purposes of passing FISA information on targets of a particular terrorist organization from FBI intelligence investigations to criminal investigations. Any information that intelligence agents wanted to give to criminal agents had to be provided to the FBI’s NSLU, which then provided it to OIPR, which then provided it to the FISA Court, which then had to approve the passage of the information to criminal agents. In addition, after the FISA Court was notified in the fall 2000 about errors in approximately 100 FISA applications, a significant portion of which related to the FBI’s representations about the “wall” procedures in al Qaeda cases, the FISA Court imposed new restrictions on the FBI’s handling of FISA information. The FISA Court required a certification from all individuals who received FISA information stating that they understood this requirement. The FISA Court exempted CIA and NSA personnel, who often received FISA information from the FBI, from this certification requirement. But the FISA Court required that the CIA and NSA indicate on the information they provided to the FBI whether the information had been obtained based on FISA information previously provided to them by the FBI (called “FISA-derived information”). In response, the NSA decided that it was more efficient not to delay dissemination of intelligence while checking to see if it was derived from FISA, and it therefore placed a caveat on all NSA counterterrorism reports to the FBI stating that before information could be considered for dissemination to criminal personnel, the FBI had to check with the NSA General Counsel about whether the intelligence was FISA-derived. Once the NSA determined whether the information was FISA-derived, the FBI had to comply with the wall procedures for passing FISA-derived information to criminal agents or prosecutors. If the information was not FISA-derived, it could be passed directly. FBI Headquarters personnel became wary that any involvement of criminal agents in intelligence investigations could present problems for the FBI with the FISA Court. A former ITOS unit chief described the FISA Court’s certification requirement as a “contempt letter” and said that it “shut down” the flow of information in the FBI. He further stated that FBI 345 Headquarters employees became worried that any misstep in handling FISA information could result in harm to their careers because an FBI agent was banned from appearing before the FISA Court and OPR began an investigation on him. These three factors – the Court had become the screener in al Qaeda cases, the certification requirement imposed by the FISA Court, and concerns about violating the Court’s rules – combined to stifle the flow of intelligence information within the FBI. FBI employees described this to the OIG as the walls within the FBI becoming “higher” over time. New York FBI agents told the OIG that the walls were viewed as a “maze” that no one really understood or could easily navigate. As we discuss below, these walls affected the FBI personnel’s discussions about the Mihdhar information at the June 11, 2001, meeting in New York and the FBI’s decision to open an investigation to locate Mihdhar in August 2001. 2. Problems at the June 11 meeting At the June 11, 2001, meeting, FBI Headquarters and CIA CTC personnel discussed with New York FBI investigators issues relating to the Cole investigation. At the time of this meeting, the FBI analyst who we call Donna had received information from the CIA concerning travel in January 2000 of an al Qaeda operative named Khalid al-Mihdhar to Malaysia through Dubai. Donna also had received surveillance photographs from the CIA showing Mihdhar meeting with other unidentified al Qaeda operatives in Malaysia.271 After receiving the information from the CIA, Donna had conducted her own record check on Mihdhar in CTLink and discovered the NSA information from late 1999 and early 2000 associating Mihdhar with a suspected terrorist facility in the Middle East linked to al Qaeda activities and his plans to travel to Malaysia in January 2000. 271 Although not shared with Donna or known to anyone else in the FBI, the CIA also knew in June 2001 that Mihdhar had a U.S. visa, that Mihdhar’s associate -- Hazmi -- had traveled to the United States in January 2000, and that the Cole mastermind Khallad had been identified in one of the Kuala Lumpur surveillance photographs. 346 This NSA intelligence about Mihdhar would have been important to the FBI agents conducting a criminal investigation of the Cole attacks. However, Donna did not share this information with the criminal agents at the June 11 meeting because of concerns about the wall. By this time, the FBI was operating under the requirement that all NSA counterterrorism information had to be reviewed by the NSA’s General Counsel’s Office for a determination of whether it was FISA-derived before it could be considered for dissemination to criminal agents. Because she had not yet asked the NSA whether the information could be passed, Donna did not provide the New York agents with any of the NSA information. That information would have been important to the New York agents who were working the Cole investigation because they specialized in al Qaeda operations and at the June 11 meeting showed great interest in the Malaysia meetings and Mihdhar. That information may also have provided the criminal agents with additional leads and could have led to the information that Mihdhar and Hazmi had traveled to the United States in January 2000. We recognize that the caveat on sharing any NSA counterterrorism information did not mean that the criminal agents were prohibited from ever obtaining access to the NSA information on Mihdhar. But if the information was FISA-derived, the caveat created a delay in the criminal agents receiving the information because of the lengthy procedures that had to be followed to share the information with them. With respect to the information Donna had received from the CIA about the Malaysia meetings, Donna showed the photographs to New York agents and asked whether they could identify Cole participant Fahd al Quso in the photographs. After one of the agents made a tentative identification, the agents asked questions about Mihdhar and the photographs. The agents continued to ask Donna questions about Mihdhar, the Malaysia meetings, and the photographs on June 11 after the meeting. As we discussed above, it is unclear how much questioning occurred during the actual meeting and how much occurred after the meeting. Donna was unable to answer most of the agents’ questions because she had not obtained the information from the CIA. This, in our view, was not because of the wall, but was because of Donna’s failure to plan the meeting adequately or ask sufficient questions from the CIA in advance of the meeting. 347 First, we believe the planning for the June 11 meeting was flawed. Although Donna and other IOSs frequently traveled to New York to work on the Cole investigation, she told the OIG that this was the first time that she had arranged for a meeting involving CTC personnel in New York. Yet, according to what the meeting participants told the OIG, the purpose and the agenda of the meeting were not clear. The participants agreed that they knew there was going to be a discussion of the investigative results on the Cole attack. The New York agents believed that the CTC and FBI Headquarters had information to share with New York. Donna and the CTC participants, however, described the meeting as a “brainstorming” session to determine what new leads could be pursued and what FBI Headquarters could do to assist New York. No agenda was prepared and no supervisors were consulted for their input about the meeting. Even though Donna said that she called the meeting to explore further leads or avenues of investigation in the Cole case, she apparently did not ask the CTC participants to be prepared to present information or answer questions. Mary and Peter told the OIG they were not in a position to discuss the Cole investigation. Mary said she was not up to speed about the Cole investigation or the Malaysia meetings. Peter told the OIG that as an analyst at the CIA, he did not have authority to discuss CIA information at the meeting and he was merely “tagging along.” Donna told the OIG that she considered Mary to be another FBI employee at the meeting, and for this reason did not provide her with any specific instructions in preparation for the meeting. Donna also said that she had not invited Peter and because she was not in his chain of command, she did not ask him to be prepared. However, the New York agents we interviewed told the OIG that they believed that CTC personnel were coming to the meeting in part to share information with them. The fact that all the participants we interviewed described the meeting as unproductive and a “waste of time” highlighted that a more useful exchange of information could have occurred. With respect to the Kuala Lumpur photographs, Donna had obtained only limited information from CIA employee John about the photos when she received them. She did not ask general background questions such as whether anyone else in the photographs had been identified, or what else was known from the Malaysia meetings. Donna told the OIG that because she believed the CIA provided her with everything she was entitled to know, she did not have 348 an in-depth discussion about the photographs. John said he did not recall anything about his discussions with Donna regarding the Kuala Lumpur photographs. Donna told the OIG that when the New York agents asked her questions about Mihdhar, the Malaysia meetings, and the photographs, she thought that they were reasonable questions, but she did not know the answers. She stated that at the time she obtained the Kuala Lumpur photographs from the CIA, she believed that they were only potentially related to Quso and their significance to the Cole would hinge on whether Quso was in the photographs. We believe Donna should have asked the CIA additional questions about the photographs. She had reason to believe Quso, a key individual in the Cole investigation, may have attended the Malaysia meetings. Given her interest in whether Quso had attended the meetings, she should have wanted to ascertain, and asked the CIA, what, if anything, was known about the purpose of the Malaysia meetings, who were the other participants at the meetings, what was known about the participants, and any other available information. Donna also did not ask the CIA whether there were additional photos or documentation. Donna told the OIG she was unaware that there could have been additional photographs or other relevant information available. We believe that someone in her position should have known or at least asked for additional information about the subject of the photographs in preparation for the meeting. We also were troubled by Donna’s inadequate efforts to obtain additional information after the June 11 meeting, particularly information about the Malaysia meetings, since it had been the subject of a dispute between Donna and Scott. Although Donna told the New York agents that she would check with the CIA about additional information regarding the photographs and the Malaysia meetings, Donna made little effort to obtain this information until two months later, in August 2001. Donna told the OIG that she believes that she made some unsuccessful follow-up phone calls to Peter and John about the photographs. It is not clear from the documentary evidence how much Donna did before August to obtain the information, but she did not provide additional information to the New York agents about the photographs for at least two months. We recognize that FBI analysts were overwhelmed with assignments and had to juggle many responsibilities, however, given the possible 349 connections of this information to the Cole investigation, we believe Donna should have made more aggressive and timely efforts to obtain this information soon after the June 11 meeting and to keep the New York agents informed about what her follow-up efforts were. By the same token, Scott, the New York Cole case agent, did little to follow up after the June 11 meeting to obtain information he requested about the Malaysia meeting. Scott told the OIG he “often” asked Donna about the status of the information, but he was not provided any such information. Donna contended that Scott did not follow up on his June 11 requests. We found no evidence such as e-mails or other documents to support Scott’s claim that he raised the issue often with Donna. We believe that neither Donna nor Scott made significant efforts after the meeting to obtain the information. 3. The FBI’s investigation in August 2001 to find Mihdhar and Hazmi As discussed above, on August 22, 2001, the FBI learned that Mihdhar and Hazmi had entered the United States in January 2000, that Mihdhar had again flown to New York on July 4, 2001, and that there was no record of either of them leaving the country. The FBI also learned that Khallad had been identified in the Kuala Lumpur photographs. Upon discovery of this information, the FBI opened an intelligence investigation in New York in an effort to locate Mihdhar. Once again, however, the separation between intelligence and criminal information affected who could receive access to the information about Hazmi and Mihdhar. This interpretation of the wall also hampered the ability of the FBI New York agents working on the Cole investigation to participate in the search for Hazmi and Mihdhar. In addition, we found that the FBI’s efforts to locate Hazmi and Mihdhar were not extensive. We do not fault the case agent assigned to locate them. He was new and not instructed to give the case any priority. Rather, we found that the FBI New York did not pursue this as an urgent matter or assign many resources to it. 350 a. The effect of the wall on the FBI’s attempts to locate Mihdhar As discussed above, Donna drafted an EC to the New York FBI requesting it open an investigation to locate Mihdhar. She also called Chad, the FBI New York agent who primarily handled intelligence investigations for the Bin Laden squad, to give him a “heads up” about the matter, and she subsequently sent the EC to him. She wrote in the e-mail that she wanted to get the intelligence investigation going and the EC could not be shared with any of the agents working the Cole criminal case. Chad forwarded the EC to his squad supervisor, Jason, who nevertheless disseminated the EC via e-mail within the Bin Laden squad, including to the criminal agents assigned to the Cole investigation. Scott read the EC and contacted Donna regarding it. Donna informed Scott that he was not supposed to have read the EC because it contained NSA information that had not been cleared to be passed to criminal agents. Donna told Scott that he needed to destroy his copy. Scott responded that the effort to locate Mihdhar should be part of the Cole criminal investigation, and he argued with Donna regarding the designation of the investigation as an intelligence matter. Donna asserted that, because of the wall, criminal agents were not yet entitled to the underlying intelligence provided by the NSA, and without that predicating material, the FBI could not establish any connection between Mihdhar and the Cole criminal investigation. Scott, Donna, and acting UBL Unit Chief Rob then spoke via conference call. Scott argued that the investigation should be opened as a criminal investigation and that more resources and agents could be assigned to a criminal investigation by New York. He also argued that criminal investigative tools, such as grand jury subpoenas, were far quicker in obtaining information than the tools available in intelligence investigations. Donna consulted with an NSLU attorney, Susan. According to Donna, Susan concurred that the matter should be handled as an intelligence investigation and that because of the wall, a criminal agent could not 351 participate in the search for or any interview of Mihdhar.272 When Donna advised Scott of Susan’s opinion in an e-mail message, Scott responded by email that he believed the wall was inapplicable. Scott ended his message by suggesting that because of the NSLU’s position, people were going to die and that he hoped that NSLU would stand by its position then. The way that FBI Headquarters handled the Mihdhar information reflected its interpretation of the requirements of the wall prior to September 11. First, because the predication for the search for Mihdhar originated from the NSA reports, this information could not be immediately shared with criminal agents. Instead, it first had to be cleared for dissemination by the NSA, which would determine whether the intelligence was based on FISA information. If so, the information had to be cleared for passage to the criminal agents – the information had to be provided to the NSLU, which then provided the information to OIPR, which then provided it to the FISA Court, which then had to approve the passage of this information to criminal agents. In fact, the limited INS information concerning Mihdhar’s and Hazmi’s entries into the United States was the only unrestricted information in the EC immediately available to the criminal investigators. As in the Moussaoui case, the decision to open an intelligence investigation resulted in certain restrictions. FBI Headquarters employees understood that they needed to ensure that they avoided any activities that the FISA Court or OIPR could later deem “too criminal” and could use as a basis to deny a FISA application. This included preventing a criminal agent from participating in a subject interview in an intelligence investigation. While Scott was correct that the wall had been created to deal with the handling of only FISA information and that there was no legal barrier to a criminal agent being present for an interview with Mihdhar if it occurred in the intelligence investigation, FBI Headquarters and NSLU believed that the original wall had been extended by the FISA Court and OIPR to cover such an interview. Scott’s frustration over the wall was similar to Henry’s in the Moussaoui investigation, when Henry was told by Don that seeking prosecutor 272 As discussed above, Susan told the OIG that she did not recall this discussion with Donna. 352 involvement prematurely could potentially harm any FISA request. Scott, like Henry, wanted to pursue a criminal investigation and became frustrated when he was advised by FBI Headquarters that he could not proceed in the manner he deemed appropriate. Scott’s perception was that FBI Headquarters had misconstrued “the wall” and the wall had been inappropriately expanded. He told the OIG that he believed the wall should only relate to FISA or FISAderived information. Like the Minneapolis FBI, Scott believed that he was being “handcuffed” in the performance of his job and that FBI Headquarters “erred on the side of caution” in its approach to intelligence information. FBI Headquarters, on the other hand, acted in accordance with its experience with OIPR and the FISA Court. FBI Headquarters believed that OIPR and the FISA Court required strict adherence to the procedures for the passage of intelligence information to criminal investigations and required separating criminal and intelligence investigations. Donna explained that the FISA Court’s mandates resulted in the need for the FBI to create a near complete separation between intelligence and criminal investigations in order to effectively use intelligence information. Rob also told the OIG that there were “land mines” in dealing with intelligence versus criminal information, and it was difficult to appropriately straddle the two sides. Our review of this case showed that the wall had been expanded to create a system that was complex and had made it increasingly difficult to effectively use intelligence information within the FBI. The wall – or “maze of walls” as one witness described it – significantly slowed the flow of intelligence information to criminal investigations. The unintended consequence of the wall was to hamper the FBI’s ability to conduct effective counterterrorism investigations because the FBI’s efforts were sharply divided in two, and only one side had immediate and complete access to the available information. The wall was not, however, the only impediment in the FBI’s handling of the investigation to find Mihdhar and Hazmi. We found there were also other problems in how the search for Mihdhar and Hazmi was handled. b. Allocation of investigative resources We found that prior to the September 11 attacks, the New York Field Office focused its al Qaeda counterterrorism efforts on criminal investigations, but it did not expend a similar effort on intelligence investigations or the 353 development of intelligence information. New York agents told the OIG they believed that criminal prosecution was the most effective tool in combating terrorism. They asserted that criminal investigations are also a preventive activity and the FBI had always focused on preventing terrorism, even before September 11. They pointed to the TERRSTOP investigation in 1993, an investigation to uncover a terrorist plot to attack New York City landmarks, and the criminal investigation into the East African embassy bombings. Prosecutors also argued that criminal investigations and prosecutions are an effective preventive measure against terrorism. Testifying before the Joint Intelligence Committee, Mary Jo White, the former U.S. Attorney for the Southern District of New York (SDNY), stated, “[W]e viewed the terrorist investigations and prosecutions we did from 1993-2002 as a prevention tool.” Patrick Fitzgerald, currently the U.S. Attorney for the Northern District of Illinois and formerly an Assistant U.S. Attorney in the SDNY, told us that it is a misconception that there has to be a difference between prosecution and gathering intelligence. He added that the SDNY prosecutions produced a “treasure trove of [intelligence] information.” However, prosecutors also realized criminal investigation and prosecution were not the only means of countering terrorism. White stated, “the counterterrorism strategy of our country in the 1990s was not, as I have read in the media, criminal prosecutions.” She further stated, “none of us considered prosecutions to be the country’s counterterrorism strategy, or even a major part of it.” As Fitzgerald told us, “in order to connect the dots, you need people to gather the dots.” Although we agree criminal investigations are a highly effective counterterrorism tool, intelligence investigations were not given nearly the same level of resources and attention in the FBI’s New York Field Office before September 11, 2001. This criminal focus was clear in the assignment of personnel on the New York Bin Laden squad. From October 2000 to June 2001, only one agent on the Bin Laden squad was designated as the “intelligence” agent – the agent we call “Chad.” The remainder were designated as “criminal” agents.273 Chad told us that he was inundated with 273 One criminal agent worked on intelligence matters on a part-time basis. 354 intelligence investigations and information, and he rarely had enough time even to review all the incoming Bin Laden intelligence information, let alone to digest, analyze, or initiate the procedures to pass the information to the criminal agents where applicable. Chad also told us that the “intelligence” agent designation was “not a desirable position” within the Bin Laden squad. He described himself as the “leper” on the squad due to “the wall.” Furthermore, Chad stated that the intelligence side of the squad received far less and lower quality resources. The handling of the investigation to locate Mihdhar provides a clear indication of the primacy of the criminal over intelligence investigations in the New York office. On August 28, 2001, the New York Field Office opened an intelligence investigation to locate Mihdhar based upon Donna’s EC. Donna told the OIG that she believed there was some urgency to the Mihdhar investigation, not because of any evidence that he was operational, but because he could leave the United States at any time and the opportunity to find out as much as possible about him would be lost. She said she therefore called Chad about the EC in advance, which she did not normally do. However, when she sent the EC to New York, she assigned the matter “routine” precedence, the lowest precedence level. When asked about this discrepancy, Donna told the OIG that the Mihdhar investigation was “no bigger” than any other intelligence investigation that the FBI was pursuing at the time. The New York Bin Laden squad relief supervisors, who we call “Jay” and “David,” told the OIG that they recognized that there was some urgency to the Mihdhar investigation. Yet, the FBI in New York did not treat it like an urgent matter. The investigation was given to an inexperienced agent – ”Richard” – who had only recently been assigned to the Bin Laden squad. This was his first intelligence investigation. As one of the largest field offices in the FBI, with over 300 agents assigned to the JTTF, the New York Field Office could have assigned additional or more experienced agents who were not involved in the Cole criminal investigation to assist Richard. However, the New York Field Office Bin Laden Squad was focused on criminal investigations. As a result, the designation of the Mihdhar matter as an intelligence investigation, as opposed to a criminal investigation, undermined the priority of any effort to locate Mihdhar. 355 Finally, we also noted that there was a clear predicate for a criminal investigation that no one appeared to notice at the time. In her EC, Donna noted that Mihdhar had previously traveled to the United States, according to information she had obtained from the INS. After the FBI’s intelligence investigation was opened, she obtained and forwarded to Richard a copy of Mihdhar’s June 2001 visa application on which he stated that he had not previously been issued a visa and had never traveled to the United States. Thus, there was a clear basis to charge Mihdhar criminally with false statements or visa fraud. Significantly, this information had been provided to the FBI without the restrictive caveats placed on NSA reports and other intelligence information. As a result, if Mihdhar had been found, he could have been arrested and charged with a criminal violation based on the false statements on his visa application. However, the FBI did not seem to notice this when deciding whether to use criminal or intelligence resources to locate Mihdhar. D. Individual performance This section summarizes the performance of individual FBI employees in the Hazmi and Mihdhar matter. While none of them committed misconduct, we believe that several FBI employees did not perform their duties as well as they could have and should have. We address in turn the FBI employees involved in each of the five lost opportunities. In this section, we do not discuss the performance of individual CIA employees. However, we believe that a significant cause of the failures in the sharing of information regarding the Hazmi and Mihdhar case is attributable to the actions of the CIA employees. It is the responsibility of the CIA OIG to assess the accountability of the actions of CIA employees. 1. Dwight In January 2000, intelligence information was developed about Hazmi, Mihdhar, and other al Qaeda operatives meeting in Malaysia. Dwight, an FBI detailee to the CTC’s Bin Laden Unit, read the CIA cables about the Malaysia meeting. The cables indicated that Mihdhar had a U.S. visa and that he listed New York on the visa application as his intended destination. Dwight recognized the significance of this information to the FBI and drafted a CIR to pass this information to the FBI. 356 Unfortunately, his draft CIR was never sent. A notation added to the CIR suggested that it was held at the request of the CIA’s Deputy Chief of the Bin Laden Unit. Several FBI detailees accessed the CIR, and Dwight inquired about it again five days later, asking the Deputy Chief in an e-mail whether it was going to be sent or whether he needed to “remake” it in some way. We found no response to his e-mail, and none of the participants, including Dwight and the Deputy Chief, said they remembered this CIR at all. We believe the primary responsibility for the failure to pass this information rests with the CIA. The evidence indicates that the CIA did not provide permission for the CIR to be sent.274 However, we also believe that Dwight should have followed up as much as necessary to ensure that the information was sent to the FBI. Although we found evidence that he inquired once about the disposition of the CIR, we found no additional evidence that he continued to follow up to ensure that the information was sent. If Dwight was stymied in his attempt to learn about the disposition of the cable, or if the CIA gave no reasonable explanation for why the information was not being sent, he could have brought this issue to the attention of another supervisor in the CTC. In our view, Dwight took the commendable initiative to draft the CIR to share the information with the FBI, but did not follow through adequately to ensure that it was sent, and the information in the CIR was not provided to the FBI until shortly before the September 11 attacks. 2. Malcolm Malcolm was a New York FBI agent detailed for several years to the CTC. He told the OIG that he understood his role at the CTC was, among other things, to be the “eyes and ears” of the New York Field Office. We do not believe that he performed this role sufficiently. He acknowledged to the OIG that one of his duties was “to monitor” New York Field Office cases, but he said he read only the cables that he thought were “interesting,” generally 274 The CIA has asserted that the information in the CIR was sent to the FBI through another cable, which may be why the CIR was not sent. A CIA cable stated that Mihdhar’s travel documents, including a multiple entry U.S. visa, had been copied and passed “to the FBI for further investigation.” As discussed above, however, we found no evidence that this cable was correct and that this information had actually been provided to the FBI. 357 based solely on his review of the cable subject line. In addition, while he said his role was to “facilitate inquiries of mutual interest,” the only example he could provide was his acting as a liaison for FBI offices around the country by following up on tracing requests and reporting on their status. This was not very onerous or substantive. We believe that FBI management is primarily responsible for failing to provide the FBI detailees to the CTC, including Malcolm, with clear duties, direction, and supervision. But we believe Malcolm should have done more and taken more initiative in performing his duties at the CTC. 3. Stan For several months in 2000, Hazmi and Mihdhar lived as boarders in the house of an FBI informational asset. The asset briefly mentioned the two boarders to his FBI control agent, who we call “Stan.” Stan did not document this information, seek to learn the boarders’ full identities, or conduct any checks on them. No FBI policy required Stan to seek or document this type of information from the asset, and we found differences among the other FBI agents who we interviewed about whether they would have sought such information from an asset. While Stan did not violate any specific FBI policy, we believe it would have been a better and more prudent practice for him to have sought at least minimal information from his asset about the boarders living with him. The asset knew little about the boarders, and the boarders could have compromised information provided by the asset to the FBI. Moreover, FBI policy required Stan to continually evaluate the asset’s credibility and provide a yearly evaluation report on the asset. Stan’s yearly report on this asset was minimal, with a bare attestation of the asset’s bona fides. It contained no indication of what evidence Stan had used to make these attestations. While we do not suggest that Stan had to conduct extensive reviews of everyone living with the asset, Stan’s actions in following up on this information were not particularly thorough or aggressive. 4. Max In January 2001, a joint FBI/CIA source identified Khallad in photographs of the Malaysia meetings. Because the FBI ALAT who was 358 involved in the handling of the source, Max, was unable to speak any of the joint source’s languages, a CIA employee conducted the debriefings of the source, including the debriefing in which the source identified Khallad. We concluded that Max was not informed of the source’s identification of Khallad from the Kuala Lumpur surveillance photograph, either at the time of the identification or afterwards. Although CIA cables covering the debriefing described the identification of Khallad, these were not shared with Max. Instead, he saw CIA TDs that did not contain the information about the identification. CIA documents do not indicate that the ALAT was informed of the identification, and no other evidence indicates that the ALAT knew. We found that the ALAT included detailed descriptions in his reports of other information from the source, which indicates he was not provided the information about the identification of Khallad. We also found that the New York FBI agents who interviewed the source in February 2001 were not informed of the identification of Khallad. In sum, we believe the ALAT did not learn about the source’s identification, not that he knew about identification but failed to share this information with others. We believe that, as the ALAT, Max should have been more familiar with the CIA’s reporting process. He was not aware that the CIA’s TDs contained only a part of the information obtained during the source debriefings. Although our review revealed that many FBI employees operated with misunderstandings about the ways the CIA recorded and reported intelligence information, a significant function of the ALAT position is to interact with the CIA. Had he recognized that he could not rely on TDs for full reporting about the source’s information, he could have asked his CIA counterpart directly for any additional information from the source, and the ALAT may have learned about the identification of Khallad. In addition, given Max’s concern that he provide FBI Headquarters with all of the information reported by the source, it would have been prudent for him to consult with the CIA case officer and ask sufficient questions to ensure that he had received all of the information. We found no indication that he did so. 5. Donna Donna, the FBI analyst who worked on the investigation of the Cole attacks, planned a June 11, 2001, meeting with the Cole investigators and CIA 359 employees to discuss information relating to the Cole investigation. She deserves credit for organizing this meeting and seeking to share intelligence information with the Cole investigators. However, we fault her performance in two respects. First, we found that the meeting was poorly planned, and Donna did not clearly communicate the purpose of the meeting to the participants. Donna also failed to obtain significant information prior to the meeting that could have been shared with the investigators about the Malaysia meetings. After the meeting, although Donna devoted a significant amount of time to the Cole investigations, she did little specific follow-up to provide answers to the investigators about their logical questions regarding the Malaysia meetings. We believe she did not do all she could have to acquire that information for the New York agents, even though she had said that she would as a result of their discussion at the June 11 meeting. As a result, the FBI missed another opportunity to focus on Mihdhar and Hazmi earlier than it did. When Donna finally learned from Mary on August 22, 2001, that Hazmi and Mihdhar were in the United States, Donna quickly and appropriately took steps to have the FBI open an investigation to locate them. She personally called the New York Bin Laden intelligence agent and told him about the matter. This was an unusual step to call the agent directly, and it suggested that the investigation should be given some priority. However, when she sent the EC to New York, she designated the EC as having a routine precedence. Donna’s actions indicated some urgency in the need for the investigation yet the subsequent EC did not convey any urgency. The New York Field Office assigned the case immediately, and the agent began working on the case within two business days of the assignment. If the EC had conveyed urgency, the FBI New York Field Office might have assigned additional or more experienced agents to locate Mihdhar and Hazmi and initiated the search sooner. 6. Rob We believe that Rob, as Donna’s supervisor, is also responsible for Donna’s failures. While the FBI at the time permitted IOSs to make significant decisions, often with little supervisory input, we believe that as a supervisor, he should have ensured that she was handling the June 11 meeting appropriately and, if necessary, become involved with the planning or execution of the meeting. Although Donna often traveled to New York to work on the Cole investigation, the June 11 meeting involved the CIA and an AUSA, which 360 should have led to more supervisory involvement in the purpose, agenda, and outcome of the meeting. But Rob had little supervisory involvement with it, either before or after the meeting. In addition, although Donna drafted the EC requesting the investigation of Mihdhar, the EC was ultimately approved and sent by Rob. Therefore, we believe he also bears some responsibility for failing to ensure that the appropriate precedence level was used on the EC. 7. Richard We do not fault Richard for his limited investigation, which was still in the nascent stages by the time of the September 11 attacks. As we described above, Richard took logical steps to try to locate Mihdhar and Hazmi, such as completing a lookout for Mihdhar with the INS, requesting local criminal history checks, checking with New York hotels about Hazmi and Mihdhar, and conducting commercial database checks on them. However, there were many more investigative steps that could have been pursued, in New York and elsewhere, had the investigation been assigned greater priority and had the FBI provided more resources to this investigation. The FBI was not close to locating Hazmi and Mihdhar when they participated in the September 11 attacks. We believe that the FBI in New York should have assigned the matter more priority than it did. 8. Mary Mary was assigned by her CIA managers in May 2001 with finding and reviewing the CIA cables relating to the Malaysia meetings and their potential connection to the Cole attack. Mary did not find the relevant CIA cable traffic until late July and mid-August 2001. She told the OIG that she did not have time to focus on this assignment until then. Upon discovering on August 21 that Hazmi and Mihdhar had traveled to the United States, she immediately passed this information to the FBI. We recognize that the disparate pieces of information about the Malaysia meetings were not easy to connect and that the task of developing patterns from seemingly unrelated information was complex. Yet we question the amount of time that elapsed between Mary’s assignment and her discovery of the important information. As we discussed previously, however, Mary’s assignments were directed and controlled by her managers in the CTC. We, therefore, leave this issue to the CIA OIG for its consideration. 361 V. OIG conclusions In sum, we found individual and systemic failings in the FBI’s handling of information regarding the Hazmi and Mihdhar matter. The FBI had at least five opportunities to learn about their presence in the United States and to seek to find them before September 11, 2001. Much of the cause for these lost opportunities involved systemic problems. We found information sharing problems between the CIA and the FBI and systemic problems within the FBI related to counterterrorism investigations. The systemic problems included inadequate oversight and guidance provided to FBI detailees at the CIA, the FBI employees’ lack of understanding of CIA procedures, the inconsistent documentation of intelligence information received informally by the FBI, the lack of priority given to counterterrorism investigations by the FBI before September 11, and the effect of the wall on FBI criminal investigations. Our review also found that the CIA did not provide information to the FBI about Hazmi and Mihdhar when it should have and we believe the CIA shares significant responsibility for the breakdown in the Hazmi and Mihdhar case. However, the FBI also failed to fully exploit the information that was made available to them. In addition, the FBI did not assign sufficient priority to the investigation when it learned in August 2001 that Hazmi and Mihdhar were in the in the United States. While we do not know what would have happened had the FBI learned sooner or pursued its investigation more aggressively, the FBI lost several important opportunities to find Hazmi and Mihdhar before the September 11 attacks. 362 363