U. S. Department of Justice

Office of the Inspector General

A Review of the FBI's Handlillg

of Intelligence Infbrmation Related

to the September 11 Attacks

OVERSIGHT *

Office of the Inspector General

November 2004

REDACTED AND UNCLASS IFIED

(RELEASED PUBLICLY JUNE 2005)
NOTE

This report is a redacted and unclassified version of the full report that the Office of the

Inspector General (OIG) completed in July 2004 and provided at that time to the Federal Bureau

of Investigation (FBI), the Department of Justice, the Congress, the Central Intelligence Agency,

........ the National Security Agency, an_a-th--_eNationalCommission on Terrorist Attacks Upon the

United States. The oIG's full report is classified at the Top Secret/SCI level.

At the request of members of Congress, after issuing the full report the OIG created an

unclassified 371-page version of the report. Because the unclassified report included

information about the FBI's investigation of Zacarias Moussaoui, and because of the pendency

of the prosecution of'Moussaoui in the United States District Court for the Eastern District of

Virginia and the rules of that Court, the OIG could not release the unclassified version of the

report without the Court's permission. On February 1, 2005, the OIG filed a motion in the

District Court requesting leave to release publicly the unclassified report, including the

information about Moussaoui. Moussaoui"s defense counsel objected to the release of any

information related to Moussoaui and certain other information. The Court denied the OIG's

motion on April 28, 12005.

Thereafter, the OIG redacted from the report the information requested by Moussaoui's

defense counsel. On June 7, 2005, the OIG filed a motion with the Court requesting leave to

release publicly the redacted, unclassified version of the re,port, and the Court granted the OIG's

motion.

This is the redacted, unclassified version of the report. In the future, when the Moussaoui

case is concluded and with the Court's penxfission, the Oil3 intends to release the full

unclassified report, including the information that was redacted from this version.
TABLE OF CONTENTS

TABLE OF CONTENTS ............................................................................... i

CHAPTER ONE: INTRODUCTION ....................................................... 1

I. Introduc,tion ................................................................................................ 1

II. OIG investigation ....................................................................................... 4

III. Organization of the OIG report .................................................................. 4

CHAPTER TWO: BACKGROUND ......................................... ............... 7

I. Introduc,tion ................................................................................................ 7

A. Introduction to international terrori,;m ................................................ 7

B. The FBI's role in protecting against international terrorism ............. 8

II. The FBI's organizational structure with :respect to international

terrorisra .................................................................................................... 12

A. Counterterrorism Program ................................................................ 12

1. Organization of the Counterterrorism Division ......... .............. 14

2. Management of counterterrorism cases at FBI Headquarters. 15

B. Field offices and counterterrorism investigations ........................... 19

C. The Department's Office of Intelligence Policy and Review ......... 20

III. The wall between intelligence and criminal terrorism investigations ..... 21

A. Introduction ....................................................................................... 21

1. The "primary purpose" standard ............................................... 22

2. Institutional divide between criminal and intelligence

investigations ......................................... _.................................. 25

3. The Ames case and concerns about the primary purpose

standard .................................................................................... :. 25

4. The 1995 Procedures ................................................................. 27

5. Additional restrictions on sharing intelligence information .... 30

6. Reports evaluating the impact of the 1995 Procedures. .......... 32

B. FISA Court's concern about accuracy of FISA applications .......... 36

1. Errors in FISA applications ...................................................... 36

2. FISA Court's new requirements regarding the wall ................ 37
3. Additional FISA errors and DOJ OPR's investigation ............ 39

C. Deputy Attorney General Thompson's .August 2001

memorandum 40

D. The impact of the wall ...................................................................... 41

E. Changes to the wall after September 11, 2001 ................................. 42

IV. The process for obtaining a FISA warrant ................................................ 44

A. Legal requirements for a FISA warrant ..................... ....................... 45

1. Agent of a foreign power .......................................................... 45

2. The application filed with the FISA Court ............................... 47

B. Assembling an application for submission to the FISA Court ........ 48

1. Investigation and LHM prepared by field office ..................... 49

2. Role of SSAs and IOSs at FBI Headquarters ............................ 49

3. Role of NSLU attorneys ........................................................... 51

4. Role of OIPR attorneys ............................................................ 52

5. Expedited FISA warrants ......................................................... 52

CHAPTER THREE: THE FBI'S HANDLING OF THE

PHOENIX ELECTRONIC COMMUNICATION AND

OTHER INFORMATION RELATING TO USE OF

AIRPLANES IN TERRORISTS ATTACKS ............................... 55

I. Introduction..: ............................................................................................ 55

II. The Phoenix EC ...:................................................................................... 56

A. Background ....................................................................................... 56

1. Assigning leads in the FBI ....................................................... 56

B. The Phoenix EC .......... :...................................................................... 60

1. Information on individuals ....................................................... 60

2. Recommendations in the Phoenix EC ...................................... 64

3. Acldressees on the Phoenix EC ................................................ 65

C. Williams' theory ............................................................................... 66

D. FBI Headquarters' handling of the Phoenix EC .............................. 68

1. Assignment to the RFU ............................................................ 69

2. Assignment to the UBLU ......................................................... 71

E. The New York Division's handling of the EC ................................ 77

III. GIG analysis ............................................................................................. 80

A. Systemic problems ........................................................................... 80

ii
1. Ineffective system for assigning and managing work. .......:.... 81

2. Lack of adequat e strategic analytical capabilities ................... 83

3. Resources and training for analysts ......................................... 87

4. Poor information flow and information sharing ...................... 88

5. General complaints about the difficulties of working in

ITOS .......................................................................................... 91

B. Individual performance .................................................................... 93

1. KennethWilliams .................................................................... 93

2. FBI Headquarters ..................................................................... 93

3. Lynn .......................................................................................... 95

4. Jay ............................................................................................. 95

5. FBI management ....................................................................... 96

C. Other pieces of intelligence concerning airplane,; as weapons ....... 96

D. Conclusion ....................................................................................... 99

CHA]WH_.11[]DIli_

" iii
•

. , X

iv
CHAPTER FIVE: TWO SEPTEMBER 11 HIJACKERS:

KHALID AL-MIHDHAR AND NAWAF AL-HAZMI .......... 215

I. Introduction .............................................................................................. 215

II. Background ............................................................................................. 217

A. OIG investigation ............................................................................ 217

B. Background on the CIA .................................................................. 219

1. CIA authority and mission .............................. ........................ 219

2. Organization oft]he CIA .......................................................... 220

3. The CIA's collection and internal dissemination of

information .............................................................................. 222

4. Passing of intelligence information by the CIA to the FBI ... 222

V
C. FBI detailees to the CIA Counterterrorist Center... 223

1. FBI Headquarters detailees ..................................................... 223

2. Washington Field Office detailees ....,,..................................... 224

3. New York Field Office detailee 225

III. Factual chronology regarding ttazmi and MJLhdhar................................ 225

A. Identification in January 2000 of Hazmi and Mihdhar as

al Qaeda operatives ......................................................................... 226

1. Background .............................................................................. 229

2. NSA provides intelligence regarding planned travel by

al Qaeda operatives to Malaysia ............................................. 230

3. Mihdhar's travel and discovery ofhis U.S. visa ..................... 231

4. CIR is drafted to pass Mihdhar's visa information to ,)

the FBI ........................................................... .......................... 231

5. Mihdhar in Dubai .................................................................... 234

6. CIA cable stating that Mihdhar's visa and passport

information had been passed to FBI ....................................... 234

7. The Malaysia meetings and surveillance of Mihdhar ............ 235

8. OIG findings regarding FBI's knowledge about

Mihdhar and the Malaysia meetings ....................................... 241

B. Hazmi and Mihdhar in San Diego ................................................ 2.248

1. Introduction ............................... .............................. ................. 248

2. Hazmi and Mihdhar's association with Bayoumi .................. 249

3. Hazmi and Mihdhar's communications .................................. 251

4. Hazmi and Mihdhar's association with an FBI asset

beginning in May 2000 .......................................................... 252

5. OIG conclusion .............................................................. ........ 254

C. Mihdhar's association with Khallad, the purported

masteannind of the Cole attack ....................................................... 254

1. Background.., ......................................................................... 255

2. Source's identification of Khallad ......................................... 256

3. OIG conclusions regarding whether the FBI was aware of

the source's identification of Khal]iad in the Kuala Lumpur

photograph .............................................................................. 268

D. FBI and CIA discussions about the Cole investigation in

May and June 2001 ........................................................................ 270

1. Background ............................................................................ 271

2. Discussions in May 2,001 ................................ ....................... 273

3. June 11, 2001, meeting ........................................................... 279

vi
4. OIG conclusions on May and June discussions ..................... 287

E. The FBI's efforts to locate Mihdhar in August and

September 2001 ............................................................................... 289

• . _0_,._ . i_.,_ ' .

1. Continuing review of the Malaysia:_meetmg.sin July and

August 2001 ................................................................ ........... 289

2. Discovery of Mihdhar's entry :intothe United States ............ 292

3. The FBI's intelligence investigation on Mihdhar .................. 295

4. The New York Field Office's investigation .......................... 301

5. OIG conclusions on the intelligence investigation ................ 304

F. Summary of the five opportunities :[orthe FBI to learn about

Mi]hdhar and Hazmi ........................................................................ 305

IV. OIG's analysis of the FBI's handling of the intelligence information

concerning Hazmi and Mihdhar ............................................................ 307

A. Systemic impediments that hindered the sharing of information

between the CIA and the FBI ........................................................ 308

1. Use ofdetailees ....................................................................... 308

2. FBI employees, lack of understanding of C][Areporting

process .......... .......................................................................... 315

3. Inadequate procedures for documenting receipt of CIA

information ............................................................................. 317

4. Lack of appropriate infrastructure in FBI field offices .......... 319

5. OIG conclusion on impediments to information sharing ...... 322

B. The actions of the San Diego FBI .......................................... ........ 322

1. The San Diego FBI's preliminary investigation of

Bayoumi ................................................................................. 323

2. The FBI's handling of the informational asset ...................... 327

3. San Diego FBI's failure to prioritize counterterrorism

investigations .......................................................................... 333

C. Events in the spring and summer of 2001 ..................................... 335

1. Restrictions on the flow of infbrmation within the FBI ........ 335

2. Problems at the June 11 meeting ........................................... 337

3. The FBI's investigation in August 2001 to find Mihdhar

and Hazmi ............................................................................... 341

D. Individual performance ................................................................... 347

1. Dwight ......... ............................................................................ 347

2. Malcolm .................................................................................. 348

3. Stan .......................................................................................... 349

4. Max ......................................................................................... 349

vii
5. Donna ...................................................................................... 350

6. Rob .......................................................................................... 351

7. Richard .................................................................................... 352

8. Mary ........................................................................................ 352

V. OIG conclu,;ions ...................................................................................... 353

CHAPTER SIX: RECOMMENDATIONS AND ,CONCLUSIONS. 355

I. Recommendations .................................................................................. 355

A. Recommendations related to the FBI's analytical program .......... 355

B. Recommendations related to the FISA process .............................. 358

C. Recommendations related to the FBI's :interactions with the

Intelligence Community .................................................................. 361

D. Other recommendations .................................................................. 365

II. Conclusions',............................................................................................. 368

Appendices"

Appendix No. 1" List of Acronyms

Appendix No. 2: Phoenix EC

Appendix No. 3" FBI Response to the Report

viii
CHAPTER ONE

INTRODUCTI[ON

I. Introduction

On September 11,2001, 19 terrorists hijacked 4 cormnercial airplanes as

part of a coordinated terrorist attack against the United States. Two of the

planes crashed into the World Trade Center Towers in New York City and one

hit the Pentagon near Washington, D.C. The tburth plane crashed in a field in

southwestern Pennsylvania. More than 3,000 persons were killed in these

terrorist attacks.

On February 14, 2002, the House of Representatives Permanent Select

Committee on Intelligence and the Senate Select Committee on Intelligence

began a joint inquiry to address questions related to the September 11 attacks,

such as "what the Intelligence Community knew prior to Se,ptember 11 about

the scope and nature of any possible terrorist attacks.., what was done with

that information" and "how and to what degree the elements of the Intelligence

Community have interacted with each other, as well as with other parts of the

federal, state, and local governments, with respect to identfl_,ing, tracking,

assessing, and coping with international terrorist threats. ''_ ['his review became

known as the Joint Intelligence Committee Inquiry or "the JrICI review."

One of the key questions arising after the attacks was what information

the Federal Bureau of Investigation (FBI) knew before September 11 that was

potentially related to the terrorist attacks. On ]May 21, 2002, Coleen Rowley,

the Chief Division Counsel in the FBI's Minneapolis Field Office, 2 wrote a 13-

page letter to FBI Director Robert Mueller in which she rai,;ed concerns about

how the FBI had handled certain information in its possession before the

attacks.

1The U.S. "Intelligence Community" is composed of 14 agencies responsible for

collecting intelligence information on behalf of the government and includes the Federal

Bureau of Investigation and the Central Intelligence Agency (CIA).

2The CDC ]provideslegal counsel and advice to field office management, supervisors,

and agents on administrative and operational matters.
In

addition, the Director asked the OIG to review the:issues in an Electronic

Communication (EC) written by an FBI Special Agent in Phoenix (known as

the Phoenix EC), as well as "any other matters relating to the FBI's handling of

information and/or intelligence before September 11,2001 that might relate in

some manner to the September 11,2001 attacks."

The Phoenix EC was a memorandum sent by an agent in the FBI's

Phoenix office in July 2001 to FBI Headquarters and to the FBI's New York

Field Office. 3 The Phoenix EC outlined the agent's theory that there was a

3This document has commonly been referred to as "the Phoenix memo" or "the

Phoenix EC." Throughout this report, we use the term "Phoenix EC" to refer to this

document.
coordinated effort by Usama Bin Laden to send students to the United States to

attend civil aviation universities and colleges for the purpose of obtaining jobs

in the civil aviation industry to conduct terrorist activity. The EC also

recommended that FBI Headquarters instruct field offices to obtain student

identification information from civil aviation schools, request the Department

of State to provide visa information about foreign students attending U.S. civil

aviation schools, and seek information from other intelligence agencies that

might relate to his theory. At the time of the September 11 attacks, little action

had been taken in response to the Phoenix EC.

The OIG agreed to conduct a review in response to the FBI Director's

request. In conducting our review, OIG investigators also learned that prior to

the September 11 attacks the Intelligence Colxmmnity had acquired a

significant amount of intelligence about two of the hijackers - Nawaf al Hazmi

and Khalid al Mihdhar. 4 Well before September 11,2001, 1theIntelligence

Community had discovered that Hazmi and Mihdhar had met with other al

Qaeda operatives in Malaysia in January 2000. The CIA also had discovered

that Mihdhar possessed a valid U.S visa and that Hazmi had traveled to the :

United States in January 2000. The FBI contended,,howew:r, that it was not

informed of Mihdhar's U.S. visa and Hazmi's travel to the United States until

August 2001, just before the September 11 attacks. At that time, the FBI had

initiated an investigation to locate Mihdhar and Hazmi, but the FBI was not

close to finding them at the time of the September 11 attacks. The OIG also

learned that Hazmi and Mihdhar had resided in the San Diego area in 2000,

where they interacted with a fornaer subject of an FBI investigation and lived

as boarders in the home of an FBI source. The OIG therefe,re decided to

include in its review an investigation of the intelligence information available

to the FBI about Hazmi and Mihdhar before September 11 and the FBI's

handling of that intelligence information.

In December 2002, the JICI released its :finalreport entitled, "Joint

Inquiry into Intelligence Community Activities before and after the Terrorist

Attacks of September 11,2001 ." One of the report's recolxmaendations was for

the Inspectors General at the Department of Justice (DOJ), CIA, Department of

4Mihdhar,Hazmi,andthreeothershijackedandcrashedAmericanAirlinesFlight77

intothe Pentagon.
Defense, and Department of State to determine whether and to what extent

personnel at those, agencies should be held accountable for any acts or

omissions with regard to the identification, prevemion, and disruption of the

September 11 terrorist attacks.

II. OIG investigation

The OIG's review focused on the FBI's handling of the Phoenix EC,

__i and the intelligence information about Mihdhar and

Hazmi. To review these issues, the OIG assembled a team of fi_ur attorneys,

three special agents, and two auditors. The team conducted 225 interviews of

personnel from the DOJ, FBI, CIA, and other agencies. For example, we

interviewed FBI personnel from FBI Headquarter,;; from FBI field offices in

Minneapolis, San Diego, New York, Phoenix, and. Oklahoma; and from FBI

offices overseas. We also interviewed employees from the CIA, the INS, the

National Security Agency (NSA), and the Federal Aviation Administration

(FAA). We reviewed over 14,000 pages of documents we obtained from the

FBI, the CIA, the NSA, and JICI.

Our review of the FBI's handling of the Hazmi and Mihdhar matter

required us to obtain a significant amount of information from the CIA

regarding its interactions with the FBI on that matter. To conduct our review,

we thus had to rely on the cooperation of the CIA in providing as access to

CIA witnesses and documents. We were able to obtain CIA documents and

interviewed CIA _vitnesses, but we did not have the same access to the CIA

that we had to DOJ information and employees. We also note that the CIA

OIG is conducting its own inquiry of the CIA's actions with regard to the

Mihdhar and Hazmi matter.

III. Organization of the OIG report

This report is organized into six chapters. Chapter One contains this

introduction. Chapter Two provides general background on the:issues

discussed in this report. For example, it contains descriptions of key

terminology, the FBI's organizational structure, the so-called "wall" that

separated'intelligence and criminal investigations in the FBI and the DOJ, the

process for obtaining a FISA warrant, and other legal background issues related

to how the FBI investigated terrorism and intelligence cases before September

11, 2001. Because the background chapter contains basic termiinology and
concepts, those with more extensive knowledge of these issues may not need to

read this chapter in full.

Chapter Three evaluates the FBI's handling of the Phoenix EC. As an

initial matter, we provide background on how "leads" were assigned in the FBI

before September 11,2001, and we summarize the contents of the Phoenix EC.

We then describe in detail how the Phoenix EC was handled within the FBI

before September 11. In the analysis section of Chapter Three, we examine

problems in how the Phoenix EC was handled, first focusing on the systemic

problems that affected the way the FBI treated the EC and then discussing the

performance of the individuals involved with the EC. At theeend of the chapter

we discuss several other pieces of information in the possession of the FBI

before September 11 that also noted connections of potential terrorists to the

aviation industry or the use of airplanes.

In Chapter Five, we examine the FBI's handling of intelligence

information concerning Hazmi and Mihdhar. We found that, beginning in late

1999 and continuing through September 11, 2(301,the FBI lhad at least five

opportunities to learn of intelligence information about Mihdhar and Hazmi

which could have led it to focus on them before the September 11 attacks. In

this chapter, we describe each of these five opportunities in detail. We

describe the intelligence information regarding Hazmi and Mihdhar that

existed at the time, whether the information was made avail!able to the FBI, and

what additional information about Hazmi and Mihdhar the FBI could have

developed on its own. In the analysis section ,ofthis chapter, we evaluate the

problems that impeded the FBI's handling of the information about Hazmi and

Mihdhar before September 11, and we also address the pertbrmance of the

individuals involved in the Hazmi and Mihdhar case.
In Chapter _'" olX, we set forth our recommendations for systemic

improvements in the FBI and we summarize our conclusions.

At that time, the OIG provided the report, which was classified at the

TOP SECRET/SCI level, to the National Commission on Terrorist Attacks

Upon the United States (9/11 Commission). The 9/11 Commission used

certain information from our report in its final report. In July 2004, we also

provided our classified report to certain congressional committees with

oversight of the Department of Justice, including the House of Representatives

and Senate Committees on the Judiciary, the Senate Select Committee on

Intelligence, and the House Permanent Select Committee on Imelligence.

At the request of the Senate Judiciary Committee, the OIG has created

this 370-page unclassified version of the report. To do so, we worked with the

FBI, the CIA, and! the NSA to delete classified information from our full report.

However, the substance of the report has not changed, and we believe that this

unclassified version fairly summarizes the findings of the full report.
CHAPTER TWO

BACKGROUND

I. _ntroduction

This chapter provides a description of key terminology, the FBI's

organizationa]Lstructure, and legal background related to an examination of

how the FBI investigated international terrorism matters before the

September 11 terrorist attacks. 5 It also provides a basic overview of the legal

issues and policies that affected how the FBI typically handled terrorism

investigations before September 11,2001. 6

A. Introduction to international terrorism

The FBI defines terrorism as the unlawful use or threatened use of

violence conunitted against persons or property to intimida_Leor coerce a

government, the civilian population, or any segment thereof, in furtherance of

political or social objectives. When such viohmt acts are carried out by a group

or individual based and operating entirely within the United States without

foreign direction, they are considered acts of domestic terrorism, such as the

April 1995 bombing of the Alfred P. Murrah t_deral building in Oklahoma

City, Oklahoraa. When such acts are committed by an individual or group

based or operating outside of the United States, they are considered acts of

international terrorism, such as the September 11,2001, attacks on the World

Trade Center and the Pentagon. See the FBI's National Foreign Intelligence

Program Manual, Section 2-1.1.

According to the FBI, there are three main categories of international

terrorist threa_Isto U.S. interests: formal, structured terrorist organizations; 7

5A listof acronymsusedin thisreportis attachedin the Appendix.

6Thosewhohavesuchknowledgemaynotneedto readthis chapterandcan godirectly

to the chaptersof thereportdetailingourinvestigationof the FBI's handlingof specific

matters,beginningwithChapterThree's discussionof the PhoenixEC.

7Formal,structuredterroristorganizationsare thosewiththeirownpersonnel,

infrastructures,financialarrangements;,andtrainingfacilities. Suchgroupsincludeal

Qaeda,the PalestinianHamas,the IrishRepublicanArmy,the EgyptiianA1-GamaA1-

(continued)
state sponsors of international terrorismS; and loosely affiliated Islamic

extremists. 9 According to Dale Watson, the former Executive Assistant

Director for Counterterrorism, the trend in international terroris'.m has been a

shift away from state sponsors of ten:orism and formalized terrorist

organizations towards loosely affiliated religious extremists who claim Islam

as their faith.

Among these Islamic extremists is Usama Bin Laden, who heads the al

Qaeda transnational terrorist network. A1 Qaeda leaders were harbored in

Afghanistan by the Taliban regime from 1996 until the U.S. military operations

there in 2001. In addition to the September 11 attacks, al Qaeda was

responsible for the bombing of the U.S.S. Cole in Yemen on October 12, 2000,

the bombings of tlhe U.S. Embassies in Kenya and Tanzania in August 1998,

and numerous other terrorist attacks.

B. The FBI's role in protecting against international 1Lerrorism

A critical part of the effort to prevent terrorism is the collection of timely

and accurate intelligence information about the activities, capabilities, plans

and intentions of terrorist organizations. The U.S. "Intelligence Community"

is composed of 14 U.S. agencies responsible for collecting intelligence

information on be:half of the government. 1°

(continued)

Islamiyya, and the Lebanese Hizbollah. Hizbollah, for example, carried e,utnumerous

attacks on Americans overseas, including the October 19813vehicle bombing of the U.S.

Marine barracks in I,ebanon and the June 1.996bombing of Khobar Towers in Saudi Arabia.

8According to tlheFBI, as of 2001 the primary state sponsors of terrorism were Iran,

Iraq, Sudan, and Libya.

9 This is sometimes referred to as the "Islamic Jihad Movement" or the "International

Jihad Movement."

l0These 14 agencies are: the CIA, FBI, Defense Intelligence Agency (DIA), National

Security Agency (NSA), U.S. Army Intelligence, U.S. Navy Intelligence, U.S. Air Force

Intelligence, U.S. Marine CorpsIntelligence, National Geospatial Agency (NGA), National

Reconnaissance Office (NRO), Department of the Treasury, Department of Energy,

Department of State, and the Coast Guard. The Director of Central Intelligence (the DCI)

oversees the Intelligence Community and also serves asthe principal advisor to the

President for intelligence matters and as the Director of the CIA.
The National Security Act of 1947 created the Central Intelligence

Agency (CIA) and established it as the United States' lead Jintelligence agency.

The CIA engages primarily in the collection of foreign inteitligence

information, which is information relating to tlhe capabilities, intentions, and

activities of foreign governments or organizations, including information about

their international terrorist activities. The Act prohibits the CIA from

exercising any "police, subpoena, law enforcement powers, or internal security

functions."

The FBI is the nation's lead agency for the collection of"foreign

counterintelligence information. ''11 According to the Attorney General

Guidelines in place at the time, which were called the Attorney General

Guidelines for Foreign Counterintelligence (FCI) Investigations, FCI is

information re,lating to espionage: and other intelligence actJivities,sabotage, or

assassinations conducted by, for, or on behalf of foreign governments or

organizations, as well as information relating to international terrorist

activities. Intelligence investigations include investigations of individuals who

are international terrorists, groups or organizations that are engaged in

espionage; or groups or organizations that are engaged in international

terrorism.

The FBI can initiate an intelligence investigation even if a crime has not

been committed. For example, the FBI may investigate and collect intelligence

information about an individual who is believed to be an inliemational terrorist

or a spy without showing that the individual has participated in any terrorist act

or actually committed espionage. Intelligence investigatiol_LSare

distinguishable from criminal investigations, such as bank robbery or drug

trafficking investigations, which attempt to determine who ,committed a crime

and to have those individuals criminally prosecuted. Prevention of future

terrorist acts rather than prosecution after the fact is the primary goal of the

intelligence investigations with respect to international terrorism matters.

li The authority for the FBI's broad mission to act as the nation's; lead domestic

intelligence agency is set forth most clearly in Presidential Executive Order 12333,

implemented on December 4, 1981.

t

9
International terrorism could be investigated[ as both an intelligence

investigation and as a criminal investigation. When a criminal act, such as the

bombing of a building, was determined to be an act of international terrorism,

the FBI could open a criminal investigation and investigate the crime, as it did

other criminal cases, with the goal of prosecuting the terrorist. 1:' At the same

time, the FBI could open an intelligence investigation of an individual or a

group to investigate the person's contacts, the group's other members, the

intentions of the individual or the group, or whether any future terrorist act was

planned. 13

One significant difference between an intelliigence investigation and a

criminal investigation is the legal framework that applies when a physical

search or electronic surveillance is initiated. TM In a criminal investigation that

implicates the privacy interests protected by the Fourth Amendment, the

general rule is that searches may not be conducted without a warrant issued by

a magistrate upon a finding that probable cause exists that evidence of a crime

will be uncovered. _5 When the FBI seeks to conduct electronic surveillance in

a criminal investigation, the FBI must obtain a warrant by complying with the

requirements of Title III of the Omnibus Crime Control and Safe Streets Act of

1968, 18 U.S.C. §.§ 2510-2522 (Title, III). When a physical search is sought in

12The FBI has been assigned "lead agency responsibilities" by the AlltorneyGeneral to

investigate "all crimes for which it has primary or concurrent jurisdiction and which involve

terrorist activities or acts in preparation of terrorist activities within the statutory jurisdiction

of the United States."' National Security Directive 207, issued in 1986,specifically assigned

responsibility to the FBI for response to terrorist attacks, stating: "The Lead Agency will

normally be designated as follows" The Department of Justice for terrorist incidents that

take place within U.S. territory. Unless otherwise specified by the Attorney General, the

FBI will be the Lead Agency within the Department of Ju,;tice for operational response to

such incidents."

13 After the attacks of September 11, 2001, the FBI significantly changed how it

investigates international terrorism cases. We discuss those changes throughout this report.

14Electronic surveillance includes wiretapping of telephones, installing microphones in

a house or building, and intercepting computer usage. Electronic surveillance is considered

a particular kind of search.

_5There are seweralexceptions to the warrant requirement that are not material to this

report.

10
a criminal investigation, the FBI also must comply with the requirements of

Rule 41 of the',Federal Rules of Criminal Procedure.

With respect to an intelligence investigation, however, criminal search

warrants issued by a magistrate are not required. The courts have long

recognized the Executive Branch's claim of inherent constitutional power to

conduct warr_mtless surveillance to protect national securi_r. _6 However,

because such authority was abused, Congress created procedures and judicial

oversight of the Executive Branch's exercise of this authority with the passage

of the Foreign Intelligence Surveillance Act of 1978 (FISA). 17 50 U.S.C.

§ 1801 et seq. FISA requires the FBI to obtain an order from the Foreign

Intelligence Surveillance Court (FISA Court)upon a showing of probable

cause to believe that the subject of the surveillance is a foreign government or

organization engaging in clandestine intelligence activities or international

terrorism, or is an individual engaging in clandestine intelligence activities or

international terrorism on behalf of a foreign government or organization. 18 In

addition, prior to September 11, 12001, the government had to submit a

certification to the FISA Court that "the purpose" of the surveillance or search

was collection of"foreign intelligence information. ''19 50 U.S.C.

§ 1804(a)(7)(E).

16The U.S. Constitution, Article II, Section 1, clause 7, supplies the President's

constitutional mandate to "preserve, protect and defend the Constitution of the United

States."

17Among the most notable examples of the ExecrativeBranch's abuse of this authority

was action taken in relation to the Watergate scandal.

18Prior to September 11,2001, the FISA Court consisted of seven federal district court

judges designated by the Chief Justice of the Supreme Court, at least one of whom was a

member of the federal district court in Washington, D.C. After September 11,2001, the

number of FISA Courtjudges was increased to 11. TJhegovernment presents applications

for a court order authorizing electronic:surveillance or a physical search to the judges in in

camera, exparte proceedings. FISA also created the Foreign Intelligence Surveillance

Court of Review, which hasjurisdiction to review the denial of FISA applications by the

FISA Court.

19The FISA statute provides that the FBI must show that "the target of the electronic

surveillance is a foreign power or an agent of a foreign power." 50 U.S.C. § 1804(a). These

terms and requirements are discussed JLnmore detail in Section IV, A below.

11
II. The FBI's'organizational structure with respect to international

terrorism

The FBI's Counterterrorism Program is responsible for supervising and

handling FBI terrorism matters. Before September 11,2001, the

Counterterrorism Program was housed in the Counterterrorism Division at FBI

Headquarters. 2° International terrorism and domestic terrorism were

subprograms within the Counterterrorism Program.

A. Counterterrorism Program

Although the FBI has had primary responsibility since 1986 for

investigating and preventing acts of terrorism co_u'nitted in the United States,

the FBI developed its formal Counterterrorism Program in the IL990s. For

much of the 1990s, terrorism matters were overseen at FBI Headquarters by

about 50 employees in the counterterrorism section within the FBI's National

Security Division (later called the Counterintelligence Division). The National

Security Division also managed the FBI's Foreign Counterintelligence

Program. According to Dale Watson, former Executive Assistant Director for

Counterterrorism, in the early 1990s counterterrorism was considered a "lowpriority program" in the FBI.

According t,oWatson's testimony before the Senate Select Committee on

Intelligence and the House Permanent Select Committee on Intelligence on

September 26, 2002, the first attack on the World Trade Center in February

1993 and the AprJil 1995 bombing of the Alfred P. Murrah Federal Building in

Oklahoma City, Oklahoma, were "confirmation" that terrorist acts could be

committed on U.S. soil. Watson testified that the World Trade Center bombing

in 1993 was a "wake-up call" and that prior to this', attack and the Oklahoma

City bombing "terrorism was perceived as an overseas problem."

In addition to the FBI's counterterrorism efforts, the CIA has for years

focused on international terrorism in general and Usama Bin Laden in

particular. In 1986, the CIA established a Counterterrorist Center (CTC) at

20The FBI has reorganized its Counterterrorism Program several times since

September 11, 2001. We provide in this section of the report the description of the

organization and positions that existed immediately prior to the September 11 attacks.

12
CIA Headquarters after a task force concluded that U.S. government agencies

had not aggressively operated to disrupt terrorist activities. The CTC's stated

mission is to preempt, disrupt, and defeat terrorists by implementing a

comprehensive counterterrorist operations program to collect intelligence on

and minimize the capabilities of international terrorist groups and state

sponsors of terrorism. The CTC attempts to exploit source intelligence to

produce in-depth analyses on potential terrorist threats and coordinate the

Intelligence Community's counterterrorist activities.

CIA Director George Tenet testified befi_re Congress that Usama Bin

Laden came to the attention of the CIA as "an emerging terrorist threat" during

• his stay in Sudan from 1991 to 1996. As early as 1993, the CIA began to

propose action to reduce his organization's capabilities. Tenet stated that the

Intelligence Community was taking action to stop Bin Lade,n by 1996, when he

left Sudan and moved to AfghanJistan.

In 1996, the CIA established a special unit, which we call the Bin Laden

Unit, to obtain more actionable intelligence on Bin Laden and his

organization. 2_ This effort was the beginning of an exchange program between

the FBI and the CIA in which senior personnel moved temporarily between the

two agencies.

Around the same time, in April 1996 the FBI created its own

Counterterrorism Center at FBI Iteadquarters. As part of the Counterterrorism

Center, the FBI established an exchange of working-level personnel and

managers with several government agencies, including the CIA, Immigration

and Naturalization Service (INS), the Federal Aviation Administration (FAA),

and others.

In May 1998, a task force of FBI officials created a 5-year strategic plan

for the FBI, based on a 3-tier system, setting investigative priorities that would

affect the allocation of FBI resources. Tier 1 included crimes or intelligence

problems that threatened national or economic security. Counterterrorism was

21The Bin Laden Unit was housed organizationally within the CTC during the time

period most relevant to this report. Around September 11, 2001, approximately 40-50

employees worked in the Bin Laden Unit. We discuss',the Bin Laden Unit in more detail in

Chapter Five.

13
designated a Tier 1 priority. Tier 2 involved criminal enterprises or those

offenses that adve,rsely affected public integrity, and Tier 3 incl!uded crimes

that affected individuals or property.

In November 1999, the FBI took the Counterterrorism Program out of the

National Security Division and created a separate Counterterrofism Division.

1. Organization of the Counterterrorism Division

The major components of the FBI's Counterterrorism Division prior to

September 11,2001, were the International Terrorism Operatie,ns Section

(ITOS), the Domestic Terrorism Operations Section (DTOS), tlhe National

Infrastructure Protection Center (NIPC), and the National Domestic

Preparedness Office (NDPO). 22

The issues in this report focus primarily on ITOS, which was responsible

for overseeing the FBI's international terrorism investigations, both criminal

and intelligence investigations. The mission of the ITOS was twofold: to

prevent terrorist acts before they occurred, and if they occurred to mount an

effective investigative response with the goal of prosecuting those responsible.

Prior to September 11,2001, approximately 90 employees worked in

ITOS at FBI Headquarters. ITOS was led by Section Chief Michael Rolince

during the time re,levant to this report.

ITOS was divided into several units. One of those units handled Bin Ladenrelated investigations, and was called the Usama Bin Laden Urdt or the UBLU.

Cases that could not be linked to a specific group and that involved radical

22The NIPC, created in February 1998,was originally called the Computer

Investigation and Infrastructure Threat Center. The NIPC's mission was to serve as the U.S.

government's focal point for threat assessment,warning, investigation, and response for

threats or attacks against the nhtion's critical infrastructures. These infrastructures include

telecommunications,,energy, banking and finance, water systems, government operations,

and emergency services. The NDPO was created in October 1998 to coordinate all federal

efforts to assist state and local law enforcement agencies with the planning, training, and

equipment needs necessary to respond to a conventional or non-conventional weapons of

mass destruction incident. The NIPC has since been mowedto the Depall:mentof Homeland

Security. The responsibilities for the NDPO were moved to the Federal Emergency

Management Agency before September 11, 2001.

14
extremist allegations were assigned to Radical[ Fundamentalist Unit or the

RFU. Before September 11, it had approximately ten employees.

2. Management ofcounterterrorism cases at FBI Headquarters

FBI Headquarters was more closely inw)lved in over,;eeing

counterterrorism investigations compared to criminal cases such as bank

robberies or white collar crime. In counterten:orism cases, FBI Headquarters

was responsible for, among other things, ensuring that intelligence information

received from:outside agencies was provided 1Lothe relevant field offices and

assisting field offices in preparing the paperwork necessary to apply for a FISA

order. For this reason, we discuss the duties of the relevant personnel at FBI

Headquarters with respect to counterterrorism investigations.

a. Supervisory Special Agents and Intel]ligence Operations

Specialists

Each of the five units within ITOS was staffed by several Supervisory

Special Agems (SSA), each of whom worked closely with Intelligence

Operations Specialists (IOS). The SSAs were FBI agents who had several

years of experience in the field and had been promoted to a supervisory

headquarters position. These SSAs generally worked in ITOS for

approximately two years before becoming supervisors in a field office or

elsewhere in FBI Headquarters. ITOS SSAs typically had at least some

experience in terrorism matters prior to coming to ITOS.

IOSs were non-agent, profi_ssional employees? 3 Some had advanced

degrees in terrorism or terrorism-related fields;. Others had no formal training

in analytical work but advanced to their IOS positions from clerical positions

within the FBI. Most IOSs were long-term employees who were expected to

have institutional knowledge about terrorism matters, such as the history of a

particular terrorist organization or the principal participants in a terrorist

organization.

23In October 2003, the FBI reclassified all FBI analysts under one position title -

Intelligence Analyst. IOSs now are called "Operations Specialists."
The responsibilities of each SSA and IOS depended on the unit in which

they worked. Some SSAs and IOSs oversaw all FBI investigations relating to a

particular terrorist group or a particular target. Other SSAs and IOSs were

responsible for overseeing terrorism investigations conducted in a particular

region of the country.

SSAs and IOSs were the first point of contact for agents and supervisors

in the field conducting counterterrorism investigations when approval, advice,

or information was needed. For example, if a field office's investigation

revealed connections between the subject of the investigation and a known

leader of a terrorist organization, the IOS was supposed to provide the field

office with the FBI's information on the leader of the terrorist organization. In

addition, SSAs and IOSs assisted field offices by ;assembling tl_Lenecessary

documentation to obtain court orders authorizing electronic surveillance

pursuant to FISA. This is discussed further in Sec,tion IV, B below.

SSAs and IOSs also were responsible for collecting and disseminating

intelligence and threat information. They received information from various

FBI field offices _md from other intelligence agencies that needed to be

analyzed and disseminated to the field. SSAs and IOSs also acted as liaisons

with other intelligence agencies. They also received information from these

agencies in response to name check requests or traces on telephLone numbers as

well as intelligence and threat information.

With respect to threat information, SSAs and IOSs worked with FBI field

offices or Legal Attach6 (Legat) offices to assess the threat and take any action

necessary to prevent terrorist acts from occurring. :'4 For example, an IOS

would conduct research on the names associated with the threats, arrange for

translators to translate any intercepts from electronic surveillance, request

information from other agencies about the persons associated with the threats,

and prepare comnmnications to the field office and Legat to ensure that

24Prior to September 11, 2001, the FBI had 44 Legat .officesaround the world. Legat

offices assist the FBI in its mission from outside of the United States by, tbr example,

coordinating with other government agencies to facilitate the extradition of terrorists wanted

for killing Americans. As of June 2004, the FBI had 45 Legat offices and four Legat suboffices.

16
updated information was provided to the necessary persons involved in the

investigation.

b. Intelligence Research Specialists and analysis within the

Counterterrorism Division

Prior to September 11,2001, Intelligence Research Specialists (IRSs)

also were a part of the FBI's Counterterrorism Program, although they were

housed in a separate division of the FBI from 1theSSAs and IOSs. Both IRSs

and IOSs performed an important function in the intelligence arena called

"analysis."

Analysis is the method by which pieces ,of intelligence information are

evaluated, integrated, and organized to indicate pattern and meaning. As

information is received, it must be examined in-depth and connected to other

pieces of info_a_nationto be most useful.

Analysis generally is considered to be either tactical or strategic. Tactical

analysis, which also is called operational analysis, directly supports

investigations or attempts to resolve specific t]_eats. It nol_rnally must be acted

upon quickly to make a difference with respect to an investigation or a threat.

An example of tactical analysis :is the review of the telephone records of

several subjects to determine who might be connected to whom in a certain

investigation or across several investigations. Another example of tactical

analysis is a review of case files to determine whether similar, suspicious

circumstances in two unrelated police reports exist in other cases and are

somehow connected to each other or to criminal or terrorist activity.

In contrast to tactical analysis, strategic analysis provides a broader view

of patterns of activity, either within or across terrorism programs. Strategic

analysis involves drawing conclusions from the available il_Ltelligence

information and making predictions about terrorist activity. It is not simply

descriptive but proactive in nature. A typical product of strategic analysis is a

report that includes program history, shifts in terrorist activity, and conclusions

about how the FBI should respond.

The FBI has acknowledged that prior to September 11,2001, its

Counterterrorism Division was primarily geared toward cortducting tactical

17
analysis in support of operational matters rather than strategic _malysis. 25

Tactical analysis generally was handled by IOSs within the operational units.

Prior to September 11, strategic analysis for the Counterterrorism

Division was pertbrmed by IRSs. Like IOSs, IRSs were non-agent,

professional employees who were expected to be '.subject matter experts about a

particular terrorism group, program, or target. All IRSs at the FBI had college

degrees, and some had advanced degrees. Like IOSs, IRSs were expectedto be

long-term FBI employees who possessed the "institutional knowledge" about a

particular program or target. 26

During the time period relevant to our review, IRSs who worked

counterterrorism matters were assigned to the Investigative Services Division

(ISD), a division separate from the Counterterrorism Division that contained all

IRSs in the FBI. IRSs were grouped in units and reported to a unit chief, who

reported to a section chief. The IRSs who were as;signed to the FBI's

Counterterrorism Program typically worked with the same SSAs and IOSs

assigned to a particular terrorist group or target. For example, an IRS who was

assigned to Bin Laden matters typically worked with IOSs and SSAs in the

UBLU in ITOS.

As we discuss in detail in Chapter Three, the number ofFBI IRSs

decreased significantly before September 11,2001, and the relatively few IRSs

were often used to perform functions; other than strategic analysis.

Many FBI analysts and supervisors noted to the OIG that the resources

devoted to the Counterterrorism Program and analysis were inadequate, and

that the amount of work in the Counterterrorism Program was overwhelming.

They also stated that they were hampered significantly by inadequate

technology. We discuss these issues in further detail in Chapter Three of the

report on the handling of the Phoenix EC. However, these difficult conditions

in the Counterterrorism Program apply equally to the issues in lihe other

chapters in our report.

25In Chapter Three, we discussin more detail the FBI's lack of strategic analysis

capabilities prior to September 11,2001.

26IRSs now are called "All Source Analysts."

18
B. Field offices and counterterrorism investigations

Prior to September 11,2001, FBI counterterrorism investigations,

whether intelligence or criminal, were opened and led by the FBI's 56 field

offices. In many field offices, counterterrorism investigations were handled by

a squad that fi_cused on terrorism cases only. Inthe New York Field Office

and other large offices, several squads were devoted solely to international

terrorism matters. In smaller fie]id offices, international ten:orism and domestic

terrorism inve,stigations often were assigned to the same squad. FBI agents

generally developed specialties within the terrorism field such as a particular

terrorist organization. Each squad was led by an SSA who reported to an

Assistant Special Agent in Charge (ASAC) who, in turn, reported to the

Special Agent in Charge (SAC). 27

As stated above, field offices opened international terrorism

investigations as either a criminal investigation or an intelligence investigation.

Attorney General Guidelines delineated the information or allegations that

were necessary to open a criminal investigation or an intelligence

investigation. ::8

For both criminal and intelligence cases, the Attorney General Guidelines

set forth the criteria for opening two levels of investigations- a "preliminary

inquiry" (PI)and a "full investigation" (also called a full field investigation or

FFI). The Guidelines also specified what investigative teclmiques could be

employed in preliminary inquiries or full investigations. Both sets of the

27In larger field offices such as New York, several SACsreport 1_oan Assistant Director

in Charge (ADIC).

28Separate .AttorneyGeneral Guidelines regulate the FBI's conduct in criminal

investigations, intelligence investigations, and the handling of informants, among other

issues. The Attorney General Guidelines that addressed criminal inw:stigations were called

"The Attorney General's Guidelines on General Crimes, Racketeering Enterprise and

Domestic Security/Terrorism Investigations" (hereinafter "criminal AG Guidelines"). The

Attorney General Guidelines in effect at the time that addressed intelligence investigations

were labeled "Attorney General Guidelines for FBI Foreign Intelligence Collectionand

Foreign Counterintelligence Investigations" (hereinafter "FCI AG Guidelines"). Revised

criminal Attorney General Guidelines were issued on May 30, 2002, and new FCI

Guidelines were issued on October 31.,2003.

19
Guidelines providked that preliminar3' inquiries were conducted to determine

kvhether a basis existed for a full inwestigation. However, preliminary inquiries

had to be closed when there was insufficient information after a certain period

of time to support opening a full fieh:l investigation.

With respect to intelligence ca,;es, agents could collect information by,

among other methods, questioning sources, finding new sources, checking FBI

and other agency databases, and reviewing intelligence information from other

intelligence agencies. Information was recorded in the form of Electronic

Communications (ECs) that became part of the case file. An E,C is the

standard form of communicationwithin the FBI.

Before September 11,2001, FBI international terrorism intelligence cases

contained the case identifier number 199. Letter or "alpha" des_ignations were

also used, along with the case identifier, to further identify inte]tligence

investigations. For example, intelligence investigations related to a particular

terrorist organization were designated as 199N investigations. International

terrorism intelligence investigations often are refe_rred to as "a It99." A

criminal international terrorism investigation had the FBI case identifier

number 265; these investigations were commonly referred to as. "a 265. ''29

C. The Department's Office of Intelligence Policy and Review

As mentioned above, when the FBI conduct,; intelligence investigations,

a significant tool for uncovering information is the FISA statute. The FBI

obtains an order firom the FISA Court authorizing electronic su_:veillance and

searches with the assistance of Department attorne, ys in the Office of

Intelligence Policy and Review (OIPR). OIPR is under the dire,ction of the

Counsel for Intelligence Policy. 3°

29Currently, the FBI uses only one designation for international terroJrism

investigations.

3oWe discuss in detail the process for obtaining FISA warrants and the role of FBI and

OIPRpersonnel in this process in Section IV, B.

20
III. The wall between intelligence and criminal terrorism investigations

A. Introduction

This section summarizes the creation of the "wall" separating criminal

and intelligence terrorism investigations in the',Department of Justice. The wall

began as a separation of intelligence investigators from contact with criminal

prosecutors, and evolved to include a separation of FBI investigators working

on intelligence investigations from investigators working on criminal

investigations.

As discussed above, FBI terrorism investigations cou][d be opened either

as an intelligence investigation in which information was collected for the

protection of national security, or as a criminal investigation to prevent a

criminal act fiom occurring or to determine wJhowas responsible for a

completed criminal act. In the course of an intelligence investigation,

information rrdght be developed from searches or electronic surveillance

obtained under FISA. That intelligence information also could be relevant to a

potential or completed criminal act. However, concerns were raised that if

intelligence investigators consulted with prosecutors about the intelligence

information or provided the information to criminal investigators, this

interaction could affect the prosecution by allowing defense counsel to argue

that the government had misused the FISA statute and it also could affect the

intelligence investigatiqn's ability to obtain or continue FISA searches or

surveillances. As a result, procedural restrictions- a wall- were created to

separate intelligence and criminal investigations. Although information could

be "passed over the wall"- i.e., shared with criminal investigators - this

occurred only subject to defined procedures.

The wall separating intelligence and criminal investigations affected

the Hazmi and Mihdhar case.

And[ as we discuss in

detail in Chapter Five, because of the wall- mad beliefs about what the wall

required- an FBI analyst did not share important intelligence information

about Hazmi _md Mihdhar with criminal investigators. In addition, also

21
because of the wall, in August 2001 when the New York FBI learned that

Hazmi and Mihdhar were in the United States, criminal investigators were not

allowed to participate in the search for them.

Because the wall between intelligence and criminal investigations

affected these two cases, we provide in this section a description of how the

wall was created and evolved in response to the 1!)78 FISA statute. We also

describe the unwritten policy separating criminal and intelligence

investigations in the 1980s and early 1990s, the 1!)95 Procedures that codified

the wall, the FISA Court procedures in 2000 that required written certification

that the Departme, nt had adhered to the wall between criminal _md intelligence

investigations, and the changes to the wall after the September 11 attacks.

1. The "primary purpose" standard

The FISA statute, enacted in 1!)78, authorizes the FISA C,ourt to grant an

application for an order approving electronic surveillance or a ,;earch warrant

to obtain foreign intelligence information if there is probable cause to believe

that the target of the surveillance or search warrant is a foreign power or an

agent of a foreign power. 50 U.S.C. § 1805(a)(3). The statute requires that the

government certit_ when seeking the warrant that "the purpose" of the FISA

search or surveillance is to obtain "foreign intelligence information." The

statute states that the certification must be made '"by the Assistant to the

President for National Security Affairs or an executive branch official or

officials designated by the President from among those executive officers

employed in the area of national security or defense and appointed by the

President with the advice and consent of the Senate." 50 USC § 1804(a)(7).

Within the Deparlment, the certification is usually signed by the FBI Director.

While Conga'ess anticipated that evidence of criminal conduct uncovered

during FISA surveillance would be provided to criminal investiigators, the

circumstances under which such information could be furnished to criminal

investigators were not provided for in the statute.3_' Defendants in criminal

31The legislative history statesthat "surveillance to collect positive tbreign intelligence

may result in the incidental acquisition of information about crimes; but this is not its

objective." Further, it states, "Surveillance conducted under [FISA] need not stop once

conclusive evidence of a crime is obtained, but instead may be extended longer where

(continued)

22
cases can challenge the government's use of information collected under a

FISA warrant by arguing that the government's purpose in obtaining the

information pursuant tOFISA was not for collection of foreign intelligence, but

rather for use in a criminal prosecution. Such a purpose would violate the

Fourth Amendment's prohibition against warrantless searches, and could result

in evidence obtained under FISA being suppressed in the criminal case.

Alternatively, the FISA Court could reject an application for a FISA warrant

because of concerns that the government's pu_rposefor seeking the FISA

warrant was for use in a criminal case rather tlnan collecting foreign

intelligence.

As a result, in interpreting FISA courts applied "the lz,rimarypurpose"

test. This allowed the use of FISA information in a criminal case provided that

the "primary purpose" of the FISA surveillance or search was to collect foreign

intelligence information rather than to conduct a criminal investigation or

prosecution. 'The seminal court decision applying this standard to information

collected in intelligence cases was issued in 1!;)80. See United States v. Truong

Dinh Hung, 629 F.2d 908 (4thCir. 1980). In tlhis case, the Fourth CircuitCourt

of Appeals ruled the government did not have to obtain a criminal warrant

when "the object of the search or the surveillance is a foreign power, its agents

or collaborators," and "the surveillance is conducted 'primarily' for foreign

intelligence purposes." Id. at 915. However, the court ruled that the

government's primary purpose in conducting ;anintelligence investigation

could be called into question when prosecutors had begun to assemble a

prosecution and had led or taken on a central role in the investigation.

Although the Truong decision involved electronic surveillance conducted

before FISA's enactment in 1978, courts used its reasoning and applied the

primary purpose test in challenges in criminal cases to the use of information

gathered from searches or electronic surveillance conducted pursuant to FISA.

See, e.g., United States v. Johnson, 952 F.2d 5;65(1stCir. 1991), cert. denied,

113 S.Ct. 58 (1992) ("[a]lthough evidence obtained under FISA subsequently

may be used in criminal prosecutions, the investigation of criminal activity

(continued)

protective measures other than the arrest and prosecution are more appropriate." S. 1566,

95 th Congress, 2d Session, Report 95-701, March 14, 1978.

23
cannot be the primary purpose of the surveillance"); United States v. Pelton,

835 F.2d 1067 (4thCir. 1987), cert. denied, 486 U.S. 1010 (1988).

In the 1980s;,the Department also adopted the "primary purpose"

standard containecl in the Truong case. 32 It interpreted the FISA statute as

requiting prosecutors not to have control in intelligence investigations in which

information was being collected purs;uant to FISA. The concern was that too

much involvement by prosecutors in the investigation created t]herisk that a

court would rule that the FISA information could :notbe used in a criminal case

because the "primary purpose" of the search was not the gathering of foreign

intelligence.

As a result, during the 1980s madthrough the mid-1990s, the

Department's policy was that prosecutors within tlheDepartment's Criminal

Division- not attorneys in the local United States Attorneys' Offices (USAOs)

- had to be Consulted in connection with intelligence investigations in which

federal criminal activity was uncovered, or when legal advice was needed to

avoid investigative steps that might inadvertently jeopardize the option of

prosecution using information obtained from the intelligence investigation.

Criminal Division attorneys were briefed by the FBI about ongoing intelligence

investigations and[were expected to:provide advice geared toward preserving a

potential criminal case, but they were not allowed to exercise control over the

investigation. The Criminal Division and FBI Headquarters made the policy

decision about when to involve the USAO in the investigation, since consulting

with the USAO was viewed as a bright line signi_¢ing the transition from an

intelligence investigation to a criminal investigation. However., during this

time period, no formal written guidelines governed the contacts between the

FBI and the Criminal Division.

32The Foreign Intelligence Surveillance Court of Review later noted that while the

Department adopted this policy in the 1980s, "the exact moment is shrouded in historical

mist." See In Re Sealed Case, 310 F.3d 717, 727 (2002).

24
2. Institutional divide between criminal and intelligence

investigations

The effect on FISA warrants or the legal restrictions on sharing

intelligence information was not the only issue regarding sharing intelligence

information with criminal investigators. Agents conducting intelligence

investigations are generally wary about the impact of sharing intelligence

information with prosecutors and criminal investigators. T!hey expressed

concerns about potential harm that disclosure would have on intelligence

sources and methods, and the damage that such disclosure would have on

future collection of intelligence information. Intelligence collection is

dependent upon secrecy; investigators often re,ly upon clandestine sources or

surveillance techniques that are rendered useless if they are exposed. In

addition, most of the information collected is classified and cannot be made

public. In contrast, criminal investigations are usually intended to result in a

prosecution, which may require the disclosure of information about the source

of evidence re,lied upon by the government. Thus, intelligence investigators'

need to protec, t secret sources and methods may be at odds "with criminal

investigators' use of the information derived from those sources and methods.

3. The Ames case and concerns :about the priimary purpose

standard

In February 1994, CIA employee Aldrich Ames was arrested on various

espionage charges. The FBI pursued an investigation regarding Ames that

involved several certifications to the FISA Court that the purpose of electronic

surveillance was for intelligence purposes. At: the time of tiheninth

certification in the Ames case, Richard Scruggs, the new head of OIPR, was

concerned that no guidelines governed the contacts between the Criminal

Division and the FBI that were permitted in intelligence investigations.

Scruggs raised concerns with the Attorney General that the primary purpose

requirement and FISA statute had been violated by the extensive contacts

between the Criminal Division and the FBI in the Ames investigation.

To address these concerns about coordination between the Criminal

Division and the FBI in intelligence investigations, in 1994 Scmggs proposed

amending the Attorney General's FCI Guidelines to require that any questions

in intelligence investigations relating to criminal conduct or prosecutions had

to be raised first with OIPR, and that OIPR would decide whether and to what

25
extent to involve _LheCriminal Division and the USAO in the imelligence

investigation. Scruggs' proposal also prohibited tlheFBI from contacting the

Criminal Division or a USAO without permission from OIPR.

In one memorandum, Scruggs described this; separation of criminal and

intelligence investigations as a wall: "The simple legal respon,;e to parallel

investigations is a 'Chinese Wall' which divides tlhe attorneys as well as the

investigators." Scruggs' use of the term "Chinese wall" is the first reference

we found to the term "wall" in connection with separating intelligence and

criminal investigations. In another memorandum discussing his proposal,

Scruggs wrote that the goal of the changes was "not to prevent discussions with

the Criminal Division" but "to regulate them so as',to place the Department in

the best possible legal posture should prosecution be undertaken." In addition,

he wrote that the goal was to develop "a simple mechanism" to maintain the

legal distinction between criminal investigations and intelligence operations.

Scruggs' proposal generated considerable controversy within the

Department and the FBI. The Criminal Division and the FBI wrote position

papers opposing the proposal. Although the Criminal Division and the FBI

both agreed that some formal procedures were necessary to_guard against

abuses in the use of FISA and to rebut unwarranted claims of abuse, they

argued that allowing OIPR to decide when prosecutors could be consulted was

unnecessary and unduly burdensome,, and would cleter useful and productive

contacts between investigators and prosecutors. 33 The Crimina![Division also

argued that it was "imperative" for any procedures to "allow for potential

criminal prosecutions to be protected through early evaluation _mdguidance"

and advocated continuing the requirement that the Criminal Division had to be

advised any time the FBI uncovered evidence of federal criminal activity in the

course of an intelligence investigation.

Also in response to Scruggs' proposal, the Executive Office for National

Security, which was located in the Deputy Attorney General's Office, sought

an opinion from the Office of Legal Counsel (OLC) whether a search under

33The FBI agreed, however, that the role preventing contact with a United States

Attorney's Office without approval from the Criminal Division and OIPR should remain.

The FBI stated that "the requisite sensitivity to these concerns and experience with treading

this fine line will often be absent" in U.S. Attorney's Offices.

26
FISA could be approved "only when the collection of foreii_ intelligence

[was] the 'primary purpose' of the search or whether it suffic[ed] that the

collection of foreign intelligence [was] one of the purposes." In a

memorandum that was circulated in draft in mid-January 1995, OLC concluded

that while courts had adhered to- and were likely to continue to adhere to- the

"primary purl:lose" test with regard to FISA information, the courts had shown

great deference to the government in challenges to evidence gathered through

intelligence searches that was used in criminal prosecution,;. OLC opined that

some involvement of prosecutor,; could be permitted to be involved with the

FISA searches without running an "undue risk:" of having evidence suppressed,

but that there were "few bright line rules" for discerning when a "'primarily'

intelligence search becomes a 'primarily' crinfinal investigation search." OLC

wrote, "[I]t must be permissible for prosecutors to be involved in the searches

at least to the extent of ensuring that the possible criminal case not be

prejudiced." .Atthe end of its opinion, OLC recommended that "an appropriate

internal process be set up to insure that FISA certifications are consistent with

the 'primary purpose' test."

4. The 1995 Procedures

a. Creation of the 1995 Procedures

In late December 1994, at the direction of Deputy Attorney General

Jamie Gorelick, the Executive Office for National Security convened a

working group to resolve the dispute between OIPR and the FBI and the

Criminal Division concerning contacts between the FBI and the Criminal

Division. The Criminal Division, OIPR, the FBI, OLC, and the Executive

Office for National Security participated in the group. As a result of

discussions within the working group, on February 3, 1995, the Executive

Office for National Security circulated draft procedures for contacts between

the FBI and prosecutors. The draft procedures, "Procedures for Contacts

Between the FBI and the Criminal Division Concerning Foreign Intelligence

and Foreign Counterintelligence Investigations," were tran,;mittedon April 12,

1995, by the Executive Office for National Security througl_the Deputy

27
Attorney General to the Attorney General for approval and imlz,lementation. 34

The Attorney General signed and issued the procedures on July 19, 1995.

These procedures became known as "the 1995 Procedures."

b. Description of tile 1995 Procedures

In general, the 1995 Procedures rejected OIPR's original proposal of

giving it the sole authority to decide when FBI agents could consult with

Criminal Division prosecutors on an intelligence investigation. However, the

1995 Procedures gave OIPR formal oversight over contacts between the FBI

and the Criminal Division in intelligence cases, and the procedures formalized

restrictions on the extent that Criminal Division prosecutors could be involved

in intelligence investigations. The procedures applied to intelligence

34At the time these draft procedures were being discussed, the FBI's New York Field

Office was conducting at least two significant criminal ten:orism investigations involving the

World Trade Center bombing in 1993. Indictments had be,en returned in one of the cases.

During the criminal investigation of these two cases, significant counterintelligence

information was developed relating to foreign powers operating in the United States, and the

FBI initiated a full field counterintelligence investigation. In a memorandum written to the

FBI, the Southern District of New York (SDNY) USAO, OIPR, and the Criminal Division,

and filed with the FISA Court on March 4, 1995, Deputy Attorney General Gorelick

provided instruction,; for sharing information from these two terrorism investigations in the

FBI's New York Field Office with intelligence investigators, and for separating the

counterintelligence and criminal investigations. The memorandum stated that the

procedures were designed to prevent the risk of creating an unwarranted appearance that

FISA was being used to avoid the procedural safeguards that applied in criminal

investigations. The memorandum, which acknowledged that the procedures went "beyond

what [was] legally required," included having an Assistant United States Attorney (AUSA)

not involved in the criminal cases but who was familiar with them act as "the wall" as well

as ensure that information indicative of a crime obtained in the intelligence investigation

was passed to the criminal agents, the USAO, and the Criminal Division. The memorandum

also included several procedures to facilitate coordination and information sharing,

including requiring intelligence investigators who developed information that reasonably

indicated the commission of a crime to notify law enforcement agents and assigning an FBI

agent involved in the: criminal investigation to be assigned to the foreign counterintelligence

investigation.

28
investigations both in which a FISA search or surveillance was being

conducted and in which no FISA order had been issued. 35

The 1995 Procedures formalized the unwritten policy that had existed

since the 1980s requiring the Criminal Division, rather than the local USAO, to

be consulted about intelligence investigations when questions of criminal

activity or criminal prosecution arose. 36 The 1995 Procedtu;es required that the

FBI and OIPR notify the Criminal Division wl_en "facts or ,circumstances

[were] developed that reasonably indicate[d] tlhata signific_mt federal crime

[had] been, [was] being, or [might have been] committed."

In cases in which FISA surveillance was being conducted, the 1995

Procedures provided that OIPR as well as the Criminal Division had to approve

an FBI field office's request to take an investigation to the USAO. Guidance

35Part A of the 1995 Procedures applied to investigations in which a FISA order had

been issued, and. Part B applied to those investigations in which no F]SA order had been

issued.

36However..,there was an exception for the USA() in the Southern District of New York

(SDNY). While: the 1995 Procedures were being cons;idered in draft, Deputy Attorney

General Gorelick had recommended that they be revie.wed by U.S. Attorney for the SDNY

Mary Jo White. White responded that the USAOs should be on equa]Lfooting with the

Criminal Division, and she recommended changes to the 1995 Procedures to achieve this,

such as requiring in intelligence cases notifcation of a crime to both the Criminal Division

and to the USA(). White argued that "[a]s a legal matter, whenever i1:is permissible for the

Criminal Division to be in contact with the FBI, it is equally permissible for the FBI to be in

touch with the U.S. Attorneys' Offices." This suggestion was unanimously rejected by the

FBI, OIPR, the Criminal Division, and the Executive Office for National Security, and the

exception was not included in the 1995 Procedures. However, White continued to press this

issue. In a memorandum faxed to Gorelick on December 27, 1995, White argued that the

Department and the FBI were structured and operating in a way that (lid not make maximum

legitimate use of all law enforcement and intelligence avenues to prevent terrorism and

prosecute terrorist acts. She asserted that the 1995 Procedures were building "unnecessary

and counterproductive walls that inhibit rather than promote our ultimate objectives" and

that "we must face the reality that the way we are proceeding now is inherently and in

actuality very d_mgerous." Eventually, on August 29, 1997, the Attorney General issued a

memorandum creating a special exemption for the SDNY USAO in cases in which no FISA

techniques were being employed. In those cases, the FBI was permitl:ed to notify directly

the SDNY USAO of evidence of a crime, and the USAO then was required to involve the

Criminal Division and OIPR.

29
issued by the FBI Director that accompanied the 1995 Procedtn:es instructed

FBI field offices that any potential contact with prosecutors (either the

Criminal Division or requests to consult with the USAO) had to be coordinated

through FBI Headquarters.

In cases in which no FISA warrant had been issued, the 1995 Procedures

required that the Criminal Division decide when it was appropriate to involve

the USAO in the intelligence investigation, although notice of the decision had

to be given to OIPR. For example, as discussed in Chapter Four, the FBI

Minneapolis Field Office opened the Moussaoui investigation as an

intelligence investigation, but then wanted to seek a criminal search warrant

from the USAO. Since an intelligence investigation was opened but no FISA

Warrant had been issued, the Minneapolis FBI needed permission - which it

was required to obtain through FBI tleadquarters-- from the Criminal Division

in order to approach the USAO for a criminal search warrant.

Under the 1:995Procedures, the CriminalDivision was responsible for

notifying OIPR of, and giving OIPR an opportunil_j to participate in, all of the

Criminal Division's consultations with the FBI concerning intelligence

investigations in which a FISA warrant had been obtained. In intelligence

investigations where no FISA warrant had been obtained, the Criminal

Division had to provide notice to OIPR of its contacts with the FBI. In both

types of cases, the',FBI was required to maintain a log of all its ,contacts with

the Criminal Division.

The 1995 Procedures provided that in intelligence investigations the

Criminal Division couldgive advice to the FBI "aimed at preserving the option

of a criminal prosecution," but could not "instruct the FBI on the operation,

continuation, or expansion of FISA electronic surveillance or physical

searches." In addition, the FBI andthe Criminal Division were required to

ensure that the advice intended to preserve the prosecution did not

"inadvertently result in either the fact or the appearance of the Criminal

Division's directing or controlling [the investigation] toward law enforcement

objectives."

5. Additional restrictions on sharing intelligence information

In addition to the wall between FBI intelligence investigators and

criminal prosecutors, a wall within the FBI between criminal investigations and

30
intelligence investigations also was created. Although it is unclear exactly

when this wall within the FBI began, sometime between 19'95 and 1997 the

FBI began segregating intelligence investigations from criminal investigations

and restricting the flow of infommtion between agents who conducted

intelligence investigations and agents who conducted criminal investigations.

As discussed above, in a position paper prepared by OIPR when the

Department was considering the 1995 Procedures, OIPR recommended that the

FBI be required to open separate and parallel criminal and intelligence

investigations, and that the FBI place "a wall" between the two investigations

by staffing the criminal investigation with FB][agents who ,didnot have access

to the intelligence investigation. This wall was intended to ensure that

information from each investigation would be fully admissible in the other.

OIPR proposed certain procedures for sharing information ,developed in the

intelligence investigation that was relevant to the criminal investigation, a

process that was referred to as "passing infomaation over the wall."

The process for passing information from the intelligence investigation to

the criminal investigation was that an FBI employee - usually the SSA of an

international terrorism squad, the Chief Division Counsel of a field office, or

an FBI Headquarters employee--would be permitted to review raw FISA

intercepts or materials seized pursuant to a FISA and act as a screening

mechanism to decide what to "pass" to the criminal investigators or

prosecutors.

In March 1995, at the direction of the Department, the FBI established

special "wall'" procedures for the:New York Field Office's ihandling of the

criminal and intelligence investigations that arose out of the 1993 World Trade

Center bombing. It is unclear when similar procedures were employed

throughout the FBI. By 1997 OIPR was including a description of the

screening or "wall" procedures in all FISA applications that were filed with the

FISA Court when a criminal inw_stigation was; opened. 37 The particular

37Neither OIPR nor the FBI had any written policy requiring the inclusion of such

information in FISA applications until late 2000, after the discovery of several errors in

FISA applications related to information about criminal investigations and wall procedures

related to those criminal investigation,;. These errors are discussed below in Section III, B

of this chapter.

31
screening mechanism proposed by OIPR and approved by the Attorney

General depended on how far the criminal investigation had developed. 38 If the

case had recently been initiated, the SSA was usually the screener. In a case in

which the USAO already was involved, others could be the screener, such as

an attorney in the FBI's Office of General Counsel, OIPR, or the Attorney

General. According to James Baker,. the current OIPR Counsel[, 39in late 1999

the Department proposed the use of the FISA Court as "the wall." The purpose

of this proposal was to ensure that the FISA Court would approve FISA

applications related to threats involving the Millermium where there was a

substantial nexus with related criminal cases.

6. Reports evaluating the impact of the 1995 Procedures

Although the 1995 Procedures allowed for consultation between the FBI

and the Criminal Division about intelligence inve,;tigations, and in some

instances required contact by the FBI with the Criminal Division, the FBI

dramatically reduced its consultations with the Criminal Division after the

1995 Procedures were issued. The FBI came to understand from OIPR that

any consultation with Criminal Division attorneys could result in a FISA

surveillance being terminated or in OIPR not agreeing to pursue a FISA

warrant. As a result, the FBI sought prosecutor input only after it was prepared

to close an intelligence investigation and "go criminal."

Three reports- a July 1999 OIG report on the Department's campaign

finance investigation, a May 2000 Department report on the Wen Ho Lee case,

and a July 2001 General Accounting Office (GAO) report- discussed these

issues and the impact of the 1995 Procedures and the wall.

38According to OIPR Counsel Baker, Attorney GeneralJanet Reno directed the

termination of certain FISA surveillances in 1998based upon her determination that related

criminal investigative activities called into question the primary purpose of the surveillance

collection.

39Baker joined OIPR in October 1996 and became the Deputy Counsel in 1998. In

May 2001, he was named Acting Counsel, and in January 12002he became the Counsel.

32
a. The OIG's July 1999 report on the campaign finance

investigation

The first report was the OIG's July 1999 report entitled "The Handling of

FBI Intelligence Information Related to the Justice Department's Campaign

Finance Investigation" (the Campaign Finance Report). The OIG report

reviewed allegations that the FB][had failed to disclose certain intelligence

information to Congress, FBI Director Louis Freeh, and At_IorneyGeneral Janet

Reno. This inttelligence information related to,the FBI's Campaign Finance

Task Force, which had been created to investigate allegations of campaign

finance violations during the 1996 presidential campaign. ]inconnection with

this review, the OIG examined issues concerning the implementation of the

1995 Procedures and the sharing of intelligence information with prosecutors

and criminal investigators.

The OIG report found that the 1995 Procedures were largely

misunderstood and often misapplied, resulting in undue reluctance by

intelligence atgentsto provide information to criminal investigators and

prosecutors. The report stated that "the tumult that accompanied [the] creation

[of the 1995 Procedures] drastically altered the relationship between [the FBI]

and prosecutors." The report found that because of OIPR's criticism of the FBI

during the Ames investigation, FBI agents had become "gun shy" about

conversations with Criminal Division attorneys, and the FBI's General

Counsel's Office had recommended that FBI agents take a "cautious approach"

by initially conferring with OIPR attorneys rather than Criminal Division

attorneys. The report also noted that as a result of the FBI's concerns about

OIPR's criticisms, the FBI had been "needlessly chilled" from sharing

intelligence information with the Criminal Division. The report stated that the

1995 Procedttres were vaguely written and provided ineffec,tive guidance for

the FBI. The :report recommended that the Criminal Division, OIPR, and the

FBI resolve conflicting understandings about the 1995 Procedures, and the FBI

issue guidance to disabuse FBI personnel of"unwarranted concerns about

contact with prosecutors."

b. The report of the Attorney General's Review Team on

the Wen Ho Lee investigation

The second report addressing these issues was prepared by the Attorney

General's Review Team (AGRT), which the Department established to review

33
/

the handling of the Wen Ho Lee investigation. 4° A chapter of tl_e final AGRT

report, issued in May 2000, discussed the 1995 Procedures. The AGRT report

found that soon after the 1995 Procedures were implemented, OIPR prevented

the FBI from contacting the Criminal Division in contraventiol_ of the

requirements of the procedures. The report stated that FBI and Criminal

Division officials believed that OIPR was discouraging contact by the FBI with

the ,Criminal Division. Both FBI and Criminal Division officials believed that

such contact would jeopardize existing or future FISA coverage because OIPR

might not present the matter to the FISA Court or the FISA Court would deny

the request if such contact occurred. The report stated, "It is clear from

interviews that the AGRT has conducted that, in any investigation where FISA

is employed or even remotely hoped for (and FISA coverage is always hoped

for), the Criminal Division is considered radioactive by both the FBI and

OIPR."

The AGRT report noted that OIPR Counsel Scruggs made it clear to the

FBI that it was not permitted to contact prosecutors in FCI investigations

without thepermission of OIPR. The report stated that, as a result, former FBI

Deputy Director Robert Bryant communicated to FBI agents that violating this

rule was a "career stopper."

In October 1999, the AGRT made interim recommendations to the

Attorney General. For example, the AGRT reco_anended that the FBI provide

"regularly scheduled briefings" to the Criminal Division concerning FCI

investigations that had the potential tbr criminal prosecution.

In response, in January 2000 Attorney General Reno established the

"Core Group," which consisted of the FBI's Assistant Directors; for

counterterrorism _mdcounterintellige, nce, the Principal Associalle Deputy

Attorney General, and the Counsel for OIPR. The FBI was supposed to

provide monthly '"critical case briefings" to the Core Group, and the Core

Group was supposed to decide if the facts of the cases warranted notification to

the Criminal Division as provided for in the 1995 Procedures. ]Inaddition, the

J

4oThe team was led by Randy Bellows;, an AUSA from the Eastern District of Virginia

who was experienced in FCI cases. The AGRT report, which is entitled "Final Report of the

Attorney General's Review Team on the Handling of the Los Alamos National Laboratory

Investigation," is often called "the Bellows report."

34
Attorney General directed the FBI to provide 1theCriminal ]Division with copies

of foreign counterintelligence case memoranda summarizing espionage

investigations of U.S. citizens or lawful permanent residents.

In October 2000, the Core Group was disbanded because it was believed

that the briefings were duplicative of sensitive, case briefings that the FBI

provided to the Attorney General and the Deputy Attorney General on a

quarterly basis. Around the same time a working group that had been formed

months earlier in response to the interim recommendations of the AGRT report

developed two decision memoranda for the Attorney General's approval, one

in October 2000 and one in December 2000. The memoranda included several

options for addressing the FBI's lack of notification to the Crio_inal Division

: regarding evidence in intelligence investigations of significant federal crimes

and the lack of coordination with the Criminal Division, and they delineated

the type and e,xtent of advice 'the Criminal Division could provide the FBI. The

December 20130memorandum also described a strategy for presenting new

procedures for coordination between intelligence and law enforcement to the

FISA Court, _md it discussed the possibility of an appeal to the FISA Court of

Review if the FISA Court rejected the new coordination procedures. Although

the Criminal ]Division, OIPR, and the FBI reached an agreement on steps to

liberalize information sharing, the components could not agree on what kind of

advice by the Criminal Division to the FBI was permissible',. The Attorney

General never issued or signed either memorandum.

c. The GAO ,report

In the third report, the GAO reviewed the policies, procedures, and

processes for coordinating FBI intelligence investigations where criminal

activity was indicated. In its July 2001 report, the GAO found that the FBI had

little contact with the Criminal Division about: intelligence investigations

because of the FBI and OIPR's concern about the potential for "rejection of the

FISA application or the loss of a FISA renewal" or "suppression of evidence

gathered using FISA tools." See "FBI Intelligence Investigations:

Coordination within Justice on Counterintelligence Criminal Matters is

Limited," GAO-01-780, July 200 I. The GAO report recommended, among

other things, that the Attorney General establish a policy and guidance

clarifying the expectations regarding the FBI's notification of the Criminal

Division about potential criminal violations arising in intelligence

35
investigations. According to the GAO report, while there were some

improvements in the coordination between the FBI and the Criminal Division

after the remedial actions in response to the AGRT report were implemented;

coordination impediments remained.

B. FISA Court's concern about accuracy of FISA applications

1. Errors in FISA applications

Around the time of these two reviews on problems of co_,rdinating

criminal and intelligence information, the FISA Court imposed additional

restrictions on the passing of intelligence information to criminal investigators.

The FISA Court took this action after it learned in 2000 and 2001 of errors: in

approximately 100 FISA applications that had been filed with the Court. 41

Approximately 75;of the errors were contained in FISA applications relatingto

targets With connections to a particular terrorist organization, which we will _:

call "Terrorist Organization No. 1," and the other errors were contained in

FISA applications relating to a different terrorist erganization, which we Will

call ,'Terrorist Organization No. 2."

In the summer of 2000, OIPR first learned of the errors il_tseveral FISA

applications related to Terrorist Organization No. 1. OIPR verbally notified the

FISA Court of the',errors and, together with FBI Headquarters employees,

conducted a review of other FISA applications involving Terrorist

Organization No. 1 that had been submitted since July 1997. In September and

October 2000, OIPR filed two pleadings with the FISA Court advising of

errors in approximately 100 FISA applications related to Terrorist Organization

No. 1.

41As d_scussedin detail below, FISA applications were submitted by field offices to

FBI Headquarters for preparation of the documentation that would be presented to OIPR:for

finalization and submission to the FISA Court. The documentation prepared by FBI

Headquarters and finalized by OIPR often was reviewed or edited by different persons,

including an SSA, IOS, Unit Chief, and aNational Security LawUnit attorney. The

documentation included an affidavit signed by the SSA at FBI Headquarters containing the

facts in support of the FISA warrant. The en:ors arose in these SSA affidavits.

36
Many of these errors in the FISA applications involved omissions of

information or misrepresentations about criminal investigations on the FISA

targets. In applications where criminal investigations were identified,

inaccurate infi_rmation was presented in FISA applications about the "wall"

procedures toseparate the criminal investigation from the imelligence

investigation. For example, the description of the wallprocedures in the

majority of FISA applications involving Terrorist Organization No. 1 stated

that the FBI New York Field Office had separate teams of agents handling the

criminal and intelligence investigations. While different agents were assigned

to the criminal and intelligence investigations, they were not kept separate from

each other. Instead, the criminal agents worked on the inte]Lligence

investigation, and the intelligence agents worked on the criminal investigation.

This meant that, contrary to what had been represented to the FISA Court,

agents working on the criminal investigation had not been restricted from the

information obtained in the intelligence investigation.

2. FISA Court's new requirements regarding the wall

As a result of the FISA Court's concerns about the mistakes in the FISA

applications, the FISA Court began requiting in October 2000 anyone who

reviewed FISA-obtained materials orother intelligence acquired based on

FISA-obtained intelligence (called ',FISA-derived" intelligence 42)to sign a

certification acknowledging that the Court's approval was required for

dissemination to criminal investigators. The FBI came to understand that this

meant that only intelligence agents were permitted to review without FISA

Court approval all FISA intercepts and materials seized by a FISA warrant, as

well as any CIA and NSA intelligence provided to the FBI based on

information obtained by an FBI FISA search or intercept. 43

Because FISA-obtained infbrmation often was passed from the FBI to the •

NSA and the CIA, the Department asked the FISA Court Whether the FBI was

42FISA-obtained information was often passed to the NSA and CIA for further use,

which could result in "FISA-derived" information.

t

43AS stated above, in late 1999, the Court had become the screening mechanism or "the

wall" for all investigations involving FISA techniques on al Qaeda in which the FBI wanted

to pass intelligence information to a criminal investigation.

37
also required to obtain the newly required certifications from any NSA or CIA

employees who reviewed the FISA-obtained material. The Court exempted the

NSA.and CIA from the certification, but required that the two agencies note on

any intelligence slhared with the FBI if it was FISA-derived. According to the

NSA, when made aware of this requirement, it reported to the Department that,

in the interest of providing as much intelligence asquickly as possible to the

FBI, the NSA would place a caveat on all countex_Lerrorism-relatedintelligence

provided to the FBI. The caveat indicated that if the FBI wanted to pass NSA

intelligence to criminal investigators, it had to involve the NSA General

Counsel's Office, to determine whether the information was in t'act FISAderived. According to the NSA, the other alternative would have been to slow

the dissemination while the NSA checked whether the intelligence was derived

from a FISA. 44 ..

The caveat language used by the NSA stated: "Except for information

reflecting a direct threat to life, neither this product nor any infi)rmation

contained in this product may be disseminated to U,.S. criminal investigators or

prosecutors without prior approval of NSA. All subsequent product which

contains information obtained or derived from this product must bear this

caveat. Contactthe Office of General Counsel ofNSA for guiclance

concerning this caveat. ''45

44.This Was not the first caveat on dissemination of NSA information. In late 1999,

Attorney General Reno authorized a warrantless physical s',earchunder aul:hority granted to

the Attorney GeneralLby Section 2.5 of Executive Order 12333, unrelated to FISA. The

Attorney General directed that the fruits of'the physical search could not be disseminated to

any criminal prosecutors or investigators until copies of the information were provided to

OIPR and the approval of the Attorney General had been obtained. Questions were raised

about dissemination of NSA's information based upon the fruits of a Sectiion 2.5 search.

The NSA - after working with OIPR to determine what language to use - decided to put a

cav.eat on all of its Bin Laden related reporting to the FBI indicating that fi_rther

dissemination to law enforcement entities could not occur without approwal from OIPR.

45In Chapter Five, the chapter about Hazmi and Mihdhar, we discuss the separation of

criminal investigators from intelligence investigators and the requirement that NSA

information be reviewed by the NSA to determine whether it was FISA-derived or otherwise

subject to limited dissemination. We describe how these restrictions affected the FBI's

ability to share important intelligence information. For example, in early summer 2001 an

FBI Headquarters IOS met with New York criminal agent,; who were working on the FBI's

(continued)

38
3. Additional FISA errors and DOJ OPR's investigation

The Deputy Attorney General's Office referred to the: DOJ Office of

Professional Responsibility (OPR) a memorandum prepared by OIPR

regarding the errors in the approximately 75 Terrorist Organization No. 1-

related FISA applications that had been raised, to the FISA Court. In

November 2000, OPR opened an investigation todetermine whether any FBI

employees had committed misconduct in com_ection with tlhese errors.

In March 2001, OIPR also became aware of an error m a FISA

application related to Terrorist Organization No. 2. The en:or concerned the

description of the wall procedures in several FBI field offices. This description

also had been used in 14 other applications related to Terrorist Organization

No. 2. After the FISA Court learned of these errors, it stated that it would no

longer accept any FISA application in which the supporting affidavit was

signed by the SSA who had presented that Terrorist Organization No. 2 FISA

application to the Court.

:.

To address the issue of the accuracy of the information in the FISA

affidavits, FBI ITOS managers began requiring that FISA affidavits contain

certain information, such as the signature of the field office SSA and any

AUSA involved in the case indicating that they had read the affidavit and

agreed with the facts as they were written. In April 2001, the entire FBI

Counterterrorism Division was instructed to comply with these procedures. On

May 18, 2001, the Attorney General issued additional insmactions to improve

the accuracy of FISA affidavits, including requiring direct communication

between OIPR attorneys and the field office on whose behalf the FISA

application was being prepared and establishing a FISA training program at the

FBI's training academy in Quantico, Virginia. In addition, the Attorney

(continued)

Cole investigation. During this meeting, they discussed certain infol_cnationobtained from

the CIA about Mihdhar. Although the IOS had info_nation fromthe NSA about Mihdhar,

the IOS did not reveal this information to the FBI criminal agents at the meeting because it

had not yet been approved for dissemination by the NSA. In addition,in August 2001, once

the FBI opened an intellige_nceinvestigation to locate Mihdhar, the same IOS and a New

York criminal agent involved in the earlier meeting discussed and disagreed about whether a

criminal agent would be permitted to participate in the intelligence investigation trying to

locate Mihdhar or to participate in any interview with Mihdhar.

39
General asked OPR to expand its investigationto include a review of the errors

made in FISA applications related to Terrorist Organization Ne. 2.

OPR's report, which was issued on May 15, 2003, concluded that "none

of the errors in the [Terrorist Organization No. 1] and [Terrorist Organization

No. 2] related FISA applications were the result of professional misconduct 0r

poor judgment by the attorneys or agents who prepared or reviewed them."

The report concluded that "a majority of the error,; were the result of systemic

flaws in the process by which those FISA applications were prepared and

reviewed." These systemic flaws included, among other things,a lack of a

formal training Program for attorneys in OIPR or agents at the ]FBIto learn

about the FISA application process, a lack of policies or rules regarding the

required content of FISA applications, and a lack of resources tbr handling

FISA applications;.

C. Deputy Attorney General. Thompson's August 2001

memorandum

On August 6, 2001, Deputy Attorney General Larry Thompson issued a

memorandumto the Criminal Division, OIPR, and the FBI regarding the

Department's polJiciesgoverning intelligence sharing and establishing new

policy. It stated tlhatthe 1995 Proceduresand the additional 2000 procedures

remained in effect. The memorandum stated that "'the purpose of this

memorandum is to restate and clarify certain important requirements imposed

by the 1995 Procedures, and the [January 2000 meaSures issued in response to

the AGRT report], and to establish certain additional requirements."

The memorandum reiterated the requirement that the Criminal Division

had to be notified when there were facts or circumstances "that reasonably

indicate that a significant federal crime has been, is being or may be

committed." The memorandum emphasized the notification was mandatory

and that the "reasonable indication" standard was "substantially lower than

probable cause."

In addition, the memorandum stated that the FBI was required to have

monthly briefings with the Criminal Division on all investigations that met the

notification standards. The memorandum added tlhatthe Criminal Division

should identify the investigations about which it needed additional information,

•and the FBI was required to provide this information. The memorandum did

40
not address the issue of the type of advice thai: was permissible by Criminal

Division attorneys to the FBI.

D. The, impact of the wall

The actions of the Department, including OIPR, the implementation of

the 1995 Procedures, the additional requirements created by the FISA Court,

and the OPR investigation had several effects on the handling of intelligence

and criminal investigations. First, witnesses told the OIG tihatthe concerns of

the FISA Court, the banning of the SSA from the FISA Court, the OPR

investigation, and the additional requirements for sharing information imposed

by the FISA Court contributed to a climate of fear in ITOS at FBI

Headquarters. SSAs and IOSs at FBI Headquarters were concerned about

becoming the subject of an OPR investigation and the effect that any such

investigation 'wouldhave on their careers.

They said they were concerned not only about the accuracy of the

information they provided to the Court, but also about ensuring that

intelligence information was kept separate from criminal investigations. A

former ITOS Unit Chief and long-time FBI Headquarters SSA told the OIG

that the certification requirement was referred to as "a contempt letter." He

explained that FBI employees began fearing thatthey would lose their jobs if

any intelligence information was shared with criminal investigators.

Second, the restrictions imposed by the FISA Court- the requirement

that anyone who received intelligence signthe: certification and the screening

procedures applicable to both FISA-obtained and FISA-derived material:-

created administrative hurdles for the FBI in handling intelligence information.

For example, the new requirements were imposed in December 2000, just two

months after the bombing of the U.S.S. Cole, and during the time the FBI was:

actively pursuing its criminal investigation. Given the new requirements, the

FBI employed several IOSs on the Cole investigation just to track all of the

required certifications.

Consistent with the conclusions of the AGRT report, employees at FBI

Headquarters and in the Minneapolis Field Of:rice who we interviewed told us.

that before September 11,2001, there was a general percepllion withinthe FBI

that seeking prosecutor input or taking any criminal investigative step when an

intelligence investigation was open potentially harmed the FBI's ability to

?

41
obtain, maintain, or renew a FISA warrant. FBI Headquarters employees

described cases in which OIPR required that elect_ronicsurveillance obtained

under FISA be "shut down" and that the FBI "go criminal" because permission

had been requested to approach the USAO or bec_mse some other criminal step

had been taken. In addition, FBI attorneys told the OIG that, i_Ltheir

experience, OIPR would not consider applying•for a FISA wanant in a case in

which OIPR determined that there was "too much"' criminal activity.

OIPR Counsel Baker told the OIG that theprimary concern of the FISA

Court was the direction and control of the intelligence investigation by

prosecutorS, not s!haring of intelligence information with law enforcement

:agents. Baker statedthat the FISA Court had approved FISA applications in

_which there was extensive interaction between prosecutors and FBI agents,

provided that OIPR was present during the interactions, there was a separation

between the prosecutors and intelligence investigators, and that the FISA Court

was apprised oftheFBI's intended use of the FISA information.

: E. Changesto the wall after September 11,2001

Shortly after the September 11,200i, terrorist attacks, the Department

• proposed lowering the wall between criminal and intelligence information by

changing the language in the FISA statute from"tlae purpose" ofthe

surveillance or search (for the collection of foreign intelligence information) to

only "a purpose. ''46 In October 2001, the Uniting and Strengthening America

by Providing Appropriate Tools Required To Intercept and Obstruct Terrorism

Act (the USA PATRIOT Act or the Patriot Act) was enacted, which changed

the requirement from "the purpose" (for obtaining foreign inteli[igence) to "a

significant purpose." Pub. L. No. 107-56, 115 Stat. 272, Section 218. The

Patriot Act also specified that federal[ officers who conduct electronic

surveillance or searches to obtain foreign intelligence information may consult

46The Department had been considering seeking this change to FISA prior to

September 11. In August 2001, the Office of the Deputy Attorney General asked the •Office

of Legal Counsel (OLC)for advice on whether FISA could be amended by Congress to

require that the collection of foreign intelligence information be "a purpose" of a FISA

warrant rather than '"the purpose." That request was under review by OLC on September 11,

2001.

42
with federal law enforcement officers to coordinate their efforts to investigate

and protect against acmaIi_or_potentaalattacks, s_botage, or international "

terrorism. Id. at Section 504.

Although the Patriot Act amendments to,FISA expressly provided for the

consultation and coordination between prosecutors and FBIintelligence

!/avestigators; in November 2001 the FISA Court issued an order requiring that

the 1995 Procedures, as •revised by Attorney General Reno's January 20.00

changes and.tlhe August 2001 Thompson memorandum, be applied in all cases

before the FISA Court.

' In March 2002, the Attorney General issued new guidelines on

intelligence sharing procedures that superseded the 1995 Procedures. The

2002 Procedures effectively removed "the wall" between intelligence and

criminal investigations. The 2002 Procedures explained that since the Patriot

Act allowed FISA to be used for a "significant purpose" rather than the

primary purpose of obtaining foreign intelligence, FISA co_ald"be used_

primarily for a law enforcement purpose, as long as a significant foreign

intelligence purpose remain[ed]." (Emphasis :inoriginal.)

The 2002 Procedures also directed that the Criminal Division and OIPR.

shall have access to- and that the FBI shall provide - all information

developed in full field foreign intelligence and[counterintelligence

investigations, particularly information that is necessary to the ability of the

United States to investigate or protect against foreign attack, sabotage,

terrorism, and clandestine intelligence activities; and information that concerns

any crime which has been, is being, or is about to be committed. The 2002

Procedures provided that USAOs should receive information and engage in

consultations'to the same extent as that provided for the Cnminal Division.

, In addition to these information sharing requirements, the 2002

Procedures provided that intelligence and law enforcement officers may

exchange a "full range .ofinformation and advice" concerning foreign .

intelligence and foreign counterintelligence investigations, "including

information and advice designed to preserve or enhance the.,possibility of,a

criminal prosecution." The 2002,Procedures noted that this',extensive

coordination was permitted because the Patriot Act provided that such

coordination shall not preclude the government's certification of a significant

foreign intelligence purpose for the issuance of a warrant by the FISA Court.

43
The Department immediately tested the new 2002 Procedures with the

FISA Court. In an opinion issued on May 17, 2002, the FISA Court accepted

the information-sharing provisions of the new Procedures. However, the FISA

Court rejected the Department's position that criminal prosecutors should be

permitted to have a significant role in FISA surveillances and searches from

start to finish' See In Re All Matters Submitted to Foreign Intelligence

Surveillance Court, 218 F.Supp.2d 611 (2002). The Department appealed the

Court's ruiing to the Foreign Intelligence Surveillance Court of Review, the

appellate court' for the FISA Court. This was the first appeal ever to the FISA

Court of Review.

The Court of Review rejected the FISA Court's findings, as well as the

1995 Procedures Iand the "primary purpose standard" that had been applied

before thePatriot Act revision. See In Re Sealed Case, 310 F.3d 717 (2002):.

The Court of Review concluded that the restrictions of the wall imposed by the

•Department and the FISA Court were never required by FISA or the

Constitution. 47 Tile Court ruled that FISA permitted the use of intelligence in

criminal investigations, and that coordination between criminal prosecutorsand

intelligence investigators was necessary for the protection of national security.

The Court concluded that while the FBI had to certify that the purpose of the

FISA surveillance', wasto obtain foreign intelligence information, FISA did not

preclude or limit the use of intelligence information in a criminal prosecution.

The Court wrote, "[E]ffective counterintelligence, we have learned, requires

the wholehearted cooperation of all the government's personnel[ who can be

brought to :the task." Id. at 743.

IV. The process for obtaining a FISA warrant

In this section, we describe the legal and procedural requirements for

obtaining a FISA warrant prior to September 11,2001, focusing On the

requirement for a warrant to conduct a physical search like the warrant that the

47The Court of Review noted, "We certainly understand the 1995 Justice Department's

effort to avoid difficulty with the FISA court, or other courts; and we have no basis to

criticize any organization of the Justice Department that an Attorney General desires." Id_=. at

727 n. 14.

44
FBI's Minneapolis Field Office sought in the Moussaoui inLvestigation,which

we discuss indetail in Chapter Four.

A. Legal requirements fi)r a FISAwarrant

As noted above, FISA allows the FBI to conduct electronic surveillance

and physical ,;earches in connection with counterespionage and

counterterrorism investigations. Rather than showing that the subject of the

surveillance or the physical search is potentially connected to a crime, the FBI

must show that there is probable cause to believe that the subject of the

surveillance or search is an "agent" of a "foreJign power." With respect to a

warrant for a physical search, the FBI also must show that there is probable

cause to believe that the property to be searched is owned, used, possessed by,

or in transit to or from an "agent of a foreign power" or "a _['oreignpower."

50 U.S.C. § 1824(a)(3).

' 1. Agent of a foreign power

"Foreig_apower" as defined in the FISA statute has several meanings,

most of which pertain to the governance of a foreign nation, such as "a foreign

government or any component thereof, whether or not recognized by the

UnitedStates" and "an entity that is directed and controlled[ by a foreign_

government Orgovernments." 150 U.SIC. § 1801(a)(1) & (2),

With respect to terrorism, before September 11,2001, foreign

powers that were used in requests for FISA warrants to the FISA Court

included foreign governments as well as terrorist organizations not controlled

by any foreign government, such as al Qaeda and Hizbollah.

Whether a terrorist organization qualified as a "foreign power" under the

FISA statute depended upon the intelligence developed abc,ut the group and its

activities, and whether the FISA Court was convinced that l_hegovernment had

proven that the entity existed and was engaged in international terrorist

activities. In practice, once the FBI developed the necessary intelligence about

the existence of a terrorist organization, a particular subject was used as a "test

subject" for pleading to the FISA Court that the organization was a foreign

power. Although not dispositive, FISA applications might :reference the fact

45

!
that the State Department had designated an entity as a "foreign terrorist

organization" (FTO). 4s

An "agent" of a foreign power also has several definitions in the statute.

An agent can be a person who has an official connection to a foreign power,

such as an employee of a foreign government or an official member of a

terrorist organization. With respect to terrorism, an agent can be anyone who

engages in international terrorism (or in activities that are in preparation for

international terrorism) "for or on behalf of a foreign power." :50U.S.C.

§ 180 l(b)(2)(C).

Aside from stating that a person must be acting "for or on behalf of" a

foreign power, the FISA statute does not further define when a person is an

"agent." The legislative history of FISA states that there must be "a nexus

between the individual and the foreign power that suggests that the person is

likely to do thebidding of the foreign power," and that there must be a

"knowingconnection" between the individual and[the foreign power. H.R.

7308, 95thCongre, ss, 2d Session, Report 95-1283, Pt. 1, p. 49, ,q_4

(June 8, 1978). The legislative history also states that morethan evidence of

"mere sympathy for, identity of interest with, or vocal support l_'orthe goals" of

a terrorist organization is required to establish agency between the group and

the potential subject. Id. at p. 42. The Attorney General's FCI Guidelines in

effect in 2001 stated in the definition section that determining whether an

individual is acting "for or on behalf of a foreign power" is based on the extent

48FTOs are foreign entitiesthat are designated asterrorist organizations by the

Secretary of State in accordance with the Antiterrorism and Effective Death Penalty Act,

signed into law in April 1996. The criteria for this designation include: that the entity is a

foreign organization,..thatthe organization is engaged in terrorist activity, and that the

organization's terrorist activity must threaten the security of U.S. nationals or the national

security of the United States. FTO designations expire automatically after two years but

may be redesignated. It is unlawful for anyone to assist an FTO, representatives and

members of FTOs are not admissible into the United States, andU.S. financial institutions

that become aware of possession of funds of an FTO must report this info:rmationto the

government. The first 30 FTO designations were made in October 1997. As of March

2004, 37 FTOs were on the State Department list, including al Qaeda, Ansar al-Islam, and

the Revolutionary Armed Forces of Columbia.

46
to which the foreign power is involved in controlling, leading, fnancially

supporting, assigning or disciplining the individual.

2. The application filed with the FISA Court

To obtain an order from the FISA Court authorizing either electronic

surveillance or a physical search, the FBI - tkrough DOJ OIPR- submits to the

FISA Court an application containing three documents. The first document,

labeled "application," is a court pleading that contains the government's

specific reque,st for a FISA warrant and includes the required approval by the

Attorney General or the Deputy Attorney General. See 50 U.S.C. § 1804(a)

(electronic surveillance) and § 1823(a) (physical search). The second

document is a certification by the FBI Director or other Executive Branch

official that the information sought is foreign :intelligence information and that

the information cannot reasonably be obtained by normal investigative

techniques. | _, as discussed above,

the certification also had to contain a statement that the purpose of the search

or surveillance was to obtain foreign intelligence information. 49 See 50

U.S.C. § 1804(a)(7) (electronic surveillance) _md§ 1823(a)(7) (physical

search).

The third required document is an affidavit signed by an SSA from FBI

Headquarters, which satisfies the FISA statute's requirement that the

application be',made "by a Federal officer in writing upon oath or affirmation."

50 U.S.C. § 1804(a) (electronic surveillance) and § 1823(a)(physical search).

The affidavit must contain "a statement of the facts and circumstances relied

upon by the applicant to justify his belief' tha_Ithe foreign power identified in

the application is in fact a foreign power and that there are sufficient

connections between the foreign power and the individual targeted to establish

that the individual is acting as an agent of the :foreign power. Id. With respect

to a physical search, the affidavit also must show that the property to be

searched contains foreign intelligence information, and the property to be

49ASpreviouslydiscussed,thePatriotAct amendedthissectionof theFISAstatuteto

requirethatthe certificationstatethat "a significantpurpose"of the surveillanceorsearchis

to obtainforeignintelligenceinformation.

47
searched is owned, used, possessed by, or is in transit to or from a foreign

power or an agent of a foreign power. 50 U.S.C..§ 1823(a)(4). :_°

The FISA statute also provides that in order for a judge to issue an order

approving the FISA application, the judge must findthat "on the basis of the

facts submitted by the applicant there is probable cause to believe that the

target of the electronic surveillance is a foreign power or an agent of a foreign

power." 50 U.S.C. § 1805(3).

B. Assembl.ing an application for submission to the FISA Court

Prior to September 11,2001, the FISA application process involved

several layers of review and approval at FBI Headquarters and at OIPR before

presentation to the FISA Court. The process began when the field office

submitted an EC or letterhead memorandum (LHM) to FBI Headquarters

setting forth the supporting evidence for the FISA warrant. 51 An SSA and IOS

in FI3I Headquarters worked with the field office in reviewing, editing, and

finalizing the LHM. An NSLU attorney reviewed., edited, and :approved the

•LHM, then obtained several ITOS management approvals before sending the

request to OIPR for consideration. Using the information provided in the

LHM, an OIPR attorney drafted the FISA application and other required

documents, which were reviewed in draft by the OIPR attorney's supervisor.

The documentation drafted by OIPR was provided to the SSA, lOS, and NSLU

attorney for their :review before being finalized by the OIPR attorney and filed

with the FISA Court. This process normally took several months to complete,

although we were told a FISA warrant could be obtained in a matter of several

hours or a few days if needed.

We describe below in more detail each step :inthe proces% with special

attention to the role of each person involved in the',process.

50OIPR also submits to the FISA Cou_ a draft order or orders for the FISA judge's

completion and signature.

51An LHM is a :memorandum on FBI letterhead static,new that is used to communicate

to the Attorney General, other Department officials, or persons or agencies outside the FBI.

48
1. Investigation and LHM prepared by field office

An application for a FISA warrant normally originated from the

investigative work conducted by a field office. During the investigation, the

field office typically developed information about the subject of the

investigation by checking FBI indices and files, reviewing publicly available

records, and inquiring with domestic and foreign law enforcement and

intelligence agencies- such as the CIA and NSA- about the subject. In

addition, the field office could conduct other investigative activities. The field

office also could obtain the subject's records of telephone calls, computer

transactions, zmd financial information through National Security Letters

(NSLs). 52 This phase of collecting information can last anywhere from several

days to several months.

If a field office wanted to :obtain a FISA warrant and thought it had

sufficient information to support a FISA warr_mt, the field office prepared an

LHM setting fortti as specifically as possible the supporting information, i The

LHM was sent to the appropriate: unit at FBI Headquarters, where it was

assigned to a particular SSA for lhandling.

2. Role of SSAs and[ IOSs at FBI Headquarters

• ;I _Ionce the

LHM Was received in FBI Headquarters by the appropriate SSA, that SSA was

responsible for ensuring that the FISA request was adequately supported and

complete before it was presented to OIPR. To, do this, the SSA- working in

conjunction with the assigned IOS- reviewed the documentation to assess

whether it contained sufficient information for a FISA or whether there were

questions that would have to be answered before the request could be

52NSLs are issued in intelligence investigationsto obtain telephone and electronic

communications',records from telephone companies and internet service providers (pursuant

to the Electronic:Communications Privacy Act, or ECPA, 18 U.S.C. !i2709), records from

financial institutions (pursuant to the Right to Financial Privacy Act, 12 U.S.C.

§ 3414(a)(5)), and information from credit bureaus (pursuant to the Fair Credit Reporting

Act, 15 U.S.C. §.§1681u and 1681v). They do not require approval of a court before

issuance by the FBI. Prior to September 11,the process for issuing NSLs could take several

months. We discussthis issue in Chapter Four of the report.

49
completed. The SSA also assessed whether the appropriate foreign power was

being pled and whether there was sufficient information connecting the subject

to the foreign power.

The SSA and the IOS communicated with the field office directly about

any problems or f0r additional information. In problematic cases, the SSA

would consult with an NSLU attorney for advice and suggestions.

The SSA and the IOS used the documentation submitted by the field

office and often edited the document. In some instances, the FISA request was

completely rewritten, and in other instances few changes were lnade.

Withrespect to the information supporting tlhe existence of the foreign

power, the SSA or IOS typically inserted language used in other FISA

applications involving the same foreign power. If' the SSA or DOSacquired

additional information to support the application, ,such as information

indicating connections between the subject and the foreign power, that

information was also included in the.... LHM.

:_ _ • LheSSA would normally

review the edited version of the LHM with the field office to ensure the factual

accuracy of the L][-IM.53 Once the field office and the SSA agreed on the final

version of the LHM, the SSA sought review and approval by an NSLU

attorney and finally obtained the appropriate sign_Ltureswithin 3FBI

Headquarters management, such as the signatures of the Unit and Section

Chiefs. This editing process could last from several days to several months.

/

53Such consultations with the field orifice about edits arose primarily because of the

problems the FBI had encountered with the FISA Court in the fall of 2000 and spring of

2001 over inaccuracies in the affidavits signed by SSAs and filed with the,,FISA Court. In

March 2001, the FBI adopted procedures requiring the SSA at FBI Headquarters handling a

FISA request to review OIPR's draft affidavit with the field office to ensure the factual

accuracy of the affidavit before it was filed,with the FISA Court. Because of these

requirements and other concerns about the accuracy of the affidavits, SSAs spent more time

than they had in the past discussing drafts of FISA documents with field offices.

5O
3. Role of NSLU attorneys

/ /two attorneys

in the National Security Law Unit (NSLU) of the FBI's Office of the General

Counsel were assigned full-time to countertelTorism matters. 54 No attorney

was assigned responsibility for a particular FISA request from beginning to

end.

The two NSLU attorneys assigned to counterterrorism matters had two

functions with respect to FISA requests submitted by field offices. First, they

functioned in an advisory capacity. The SSA would consult with an NSLU

attorney if a question or problem, arose or if the SSA needed legal advice.

NSLU attorneys also were consulted when there was a disagreement between

the field office and FBI Headquarters about a particular issue, such as whether

there was sufficient support for a FISA warrant. SSAs often discussed with

NSLU attorneys whether the threshold of probable cause had been met for

supporting that a subject was an agent of a foreign power. The former head of

the NSLU told the OIG, however, that in "slmn dunk" cases, FBI Headquarters

would deal directly with OIPR without consulting an NSLU attorney.

The second function of NSLU attorneys with respect to FISA requests

was to review the LHM once it was finalized and to advise whether they

believed OIPR would accept the LHM as, having sufficient evidence to obtain a

FISA warrant. If the NSLU attorney did not believe that the LHM contained

sufficient evidence, the NSLU attorney would, advise the SSA what additional

information was needed and make suggestions about how the additional

information could be acquired. Once the LHM was finalized and approved by

the NSLU attorney, the signatures of the Unit Chief and the Section Chief were

obtained, and the LHM was sent to OIPR.

The NSLU attorney and the SSA also could make recommendations to

the field office about how to acquire any additional information that was

needed. If the field office provide d additional information to support the FISA

request, the LHM was revised and the FISA request was reviewed again. This

process would continue until the NSLU attorney was satisfied that the

54OtherNSLU attorneysprimarily worked counterintelligence matters, although some

of them assisted with counterterrorism matters when necessary.

51
standards for obtaining the FISA win'rant were met. This step in the process

also could last from several days to several months.

4. Role of OIPR attorneys

Once the SSA obtained the necessary FBI Headquarters approvals, the

LHM and its supporting documents were providect to OIPR for preparation of

the required pleadings. An OIPR attorney would review the LItM and

determine whether there was sufficient evidence to obtain a FISA warrant. The

OIPR attorney would consult with the FBI Headquarters SSA about any

questions and would sometimes prepare a list of questions for the SSA to

answer in writing. The SSA often consulted with the field office to obtain the

information requested by the OIPR attorney and sometimes asked the field

office to conduct additional investigation. This process also could take

anywhere from several days to several months.

Once the OIPR attorney was satisfied that there was sufficient evidence

to support the FISA application, an OIPR attorney"prepared the draft pleadings.

A supervisory attorney in OIPR would review the draft pleadings and make

recommendations and revisions. The final draft was provided to the SSA and

the NSLU attorney for review. After finalizing the pleadings and obtaining the

signatures of the FBI Headquarters SSA who signed the affidavit, the Attorney

General, and the FBI Director, the OIPR attorney filed the pleadings with the

FISA Court, along with a draft order for the judge's signature. The FISA Court

would then schedule a heating, which was attended by the OIPR attorney and

the SSA.

If the FISA Court approved the warrant, it issued an order authorizing the

surveillance or search. Orders authorizing surveillance were for a specific

period, beginning and ending on a certain day and time. The order was

transmitted to the field office responsible for conducting the surveillance or

search.

5. Expedited FISAwarrants

In the Moussaoui investigation, the Minneapolis Field Office requested

an "emergency FISA," which was a FISA that could be obtained in an

52
expedited mmmer. 55 The SSAs and NSLU attorneys we interviewed told us

that what rose to the level of "expedited" depended on what the field office and

ITOS management deemed to be an immediate priority. According to these

witnesses, in the summer of 2001 expedited FISA requests normally involved

reports of a suspected imminent attack or other imminent danger.

Although the normal processing time for a FISA application was several

weeks or months, FBI Headquarters working With an NSLU attorney and OIPR

could prepare an expedited FISA application tbr presentation to the FISA

Court in a matter of several hours or days, depending on the circumstances

giving rise to the expedited request.

55Although expedited FISA requests were commonly referred to as "emergency

FISAs," the statute provided for an "emergency FISA" that was different from an expedited

FISA. The statute stated that an emergency FISA allowed the Attorney General - without

prior approval of the FISA Court - to authorize the execution of a search warrant or

electronic surveillance if the Attorney General determined that "an emergency situation

exists" and there was a "the factual basis for issuance of an order" in accordance with the

statute. See 50 U.S.C. § 1805(e) (electronic surveillmlce) & § 1824(e,) (physical search

warrant). The government was required to present an application to the FISA Court with

respect to any such warrantless search or electronic surveillance within 24 hours of the

execution of the search or surveillance. 50 U.S.C. § 1805(e) (electronic surveillance) &

§ 1824(e) (physical search warrant). This type of emergency FISA rarely was used before

September 11, 2001.

53
54
CHAPTER THREE

THE FBI'S HANDLING OF THE PHOENIX ELECTRONIC

COMMUNICATION AND OTHER INFORMATION

RELATING TO USE OF A_RPLANES IN TERRORISTS

ATTACKS;

I. Introduction

In this chapter of the report, we examine allegations that the FBI failed to

act prior to September 11,2001, on intelligence information that warned of

potential terrorists training in aviation-related fields of study in the United

States. The focus of these allegations concerned an Electronic Communication

(EC) dated July 10, 2001, that was written by Kenneth Williams, a special

agent in the FBI's Phoenix Division. In his EC, Williams wrote that he :

believed that 'therewas a coordinated effort by Usama Bin Laden to send

students to the United States to attend civil aviation univer,:ities and colleges.

He suggested that the purpose of these students would be to one day work in

the civil aviation industry around the world to conduct terrorist activity against

civil aviation targets. Williams wrote that he was providing the information in

the EC for analysis and comments. Williams addressed the EC to several

people in FBI Headquarters and in the FBI's New York Division. 56

After September 11,2001, the FBI has acknowledged several problems

in how the Phoenix EC was handled. The FBI stated that the information

raised in the EC should have been analyzed by the FBI, but that such analysis

did not occur before September 11. In additic,n,the FBI acknowledged that the

Phoenix EC should have been disseminated to other intelligence agencies and

to the FBI's field offices for their consideration, but it was not disseminated

before September 11.s7

56A redacted copy of this document is attached in the Appendix.

57Director Mueller's written statement for his October 17, 2002. testimony before the

Joint Intelligence Committee Inquiry (JICI) stated: '"We have heard, and we acknowledge,

the valid criticisms, many of which have been reiterated by this Committee. For example,

the Phoenix memo should have been disseminated to all field offices and to our sister

agencies." Former ITOS Section Chief Michael Rolince testified betbre Congress that the

(continued)

55
In this chapter we analyze the ]FBI's handling of the Phoenix EC. We

first provide background on how leads were communicated and assigned in the

FBI before September 11,2001. We then summarize the contents of the EC.

Next, we describe in detail how the Phoenix EC was handled within the FBI

before September 11. In the analysis section, we examine problems in how the

Phoenix EC was handled, first focusing on the systemic problems that affected

the way the FBI treated the EC and then on the performance of the individuals

involved with the EC. Finally, at the end of the chapter we discuss several

other pieces of information in the possession of the FBI before September 11

that also noted connections of potential terrorists to flight schools or the use of

airplanes.

II. The Phoenix EC

A. Background

In this section, we first provide the key terminology and a description of

FBI processes that are relevant to the handling of _LhePhoenix EC.

1. Assigningleads in the FB[

When an FBI field office needs assistance or information from another

office or from FBI Headquarters, it "sets a le_id" fbr the assistance. Leads are

initially written out in ECs; hard copies of which are mailed to the appropriate

offices. In addition, when the EC is "uploaded" to the FBI's Automated Case

Support (ACS) system, leads associated with the EC are "set" electronically in

ACS system: We describe both processes below.

a. The manual process

The specific action requested in an EC is stated in the lead section, which

is at the end of the document. In the "To:" section of the EC, the author

specifies the offices to which the EC is addressed. In the "Attention:" section,

(continued)

Phoenix EC should have been provided to the personnel assigned to FBI Headquarters from

other agencies, such ;asthe INS, the CIA, the FAA, and others, for their assessment.

/

56
the author spe,cifies the persons who the author believes should receive a copy

of the EC.

ECs have a line marked "Precedence." There are three options on the

precedence line: "Immediate," "Priority," and "Routine." The FBI's

investigative manual states that "immediate" precedence should be used "when

the addressee(s) must take prompt action or have an urgent need for the

information." The manual states that "priority" precedence: should be used

when information is needed within 24 hours, _md"routine" precedence should

be used when information is needed within the normal course of business. The

time frame for responding to "routine" requests is not specified.

The office preparing an EC that sets a lead normally sends a hard copy of

the EC to the offices with leads mentioned in the EC. The ]paperEC is

normally sent through "Bureau mail," which is the FBI's interoffice mail

delivery system.

The distribution of the hard copy EC in the receiving office varies from ,

office to office. In most offices, the EC is routed to an administrative

employee assigned to the substantive program that is the subject of the EC,

such as the squad secretary for the counterterrorism squad if counterterrorism

is discussed in the EC. The administrative employee decides who should

receive the hard copy EC, whether copies will be made, and for whom. All

individuals listed on the attention line of a hardcopy EC do not necessarily

receive a copy of the EC through the manual distribution process.

b. The electronic process

Leads contained in ECs also are set electronically in ACS when the EC is

completed and is "uploaded" to ACS. The office requesting the lead can enter

in ACS a deadline for handling the lead. If no deadline is set, the default

deadline in ACS for action is 60 days.

ACS contains an "electronic routing tab][e" for each office that receives

leads electronically through ACS. FBI offices; set up the electronic routing

table to assign leads to a particular person's "lead bucket" based onthe case

number provided in the "Case ID #" field of the EC. For example, a field

office may program its electronic routing table to direct all leads associated

with cases having international terrorism identifiers to the secretary for the

international terrorism squad. The secretary would then be responsible for

57
checking the "lead bucket" and determining to whom to assign the lead

electronically.

FBI employees are responsible for checking: ACS periodically and

accessing their lead bucket to see if any leads have been assigned to them.

ACS does not notify users when leads are assigned to them. Only persons who

are assigned a lead will see a notification of an EC associated with the lead

when they check their lead buckets. All other persons listed orLthe attention

line of the EC must search ACS for their names by conducting text searches

and other kinds of searches to determine if there are any ECs containing their

names.

In ACS, leads may be "reassigned" or may be "closed." When leads are

closed, the person closing the lead fills in the field labeled "disposition" to

indicate what action was taken with respect to the lead. However, ACS does

not require this field to be completed in order to close the lead.

c. Persons responsible for assigning leads

At FBI Headquarters, the Radical Fundamentalist Unit (R_FU)and the

Usama Bin Laden Unit (UBLU) were the two units in the International

Terrorism Operations Section (ITOS) involved in the handling of the Phoenix

EC. Within the B_U and UBLU, Intelligence Assistants, called IAs, were

responsible for many duties, including distributing hard copy ECs to the

appropriatepersons in the units, assigning leads in ACS, conducting name

checks in ACS, madpreparing ECs. In addition, before September 11,2001, an

IA assigned to an administrative unit in ITOS was.responsible as a collateral

duty for assigning leads_that had been routed to ITOS' general lead bucket in

ACS. During the time period relevant to our investigation, this IA could assign

leads from ACS directly to analysts in,the section., called Intelligence

Operations Specialists (IOSs). The IA also could route ECs directly to IOSs

without any supervisor's input or knowledge.

IAs within the RFU and the UBLU normally determined to whom to

assign a lead based on the case identifier, which is'.one of the required fields on

an EC. For example, 199M matters, called "IT-Other," were il_Lvestigations

related to terrorist groups that were not associated with one of the FBI's 17

other specific case identifiers. 199M or IT-Other matters normally were

58
assigned to the RFU. The case identifier associated with the Phoenix EC was

199M, which fell under the RFU.

Within a particular unit, the specific case number wo_aldalso be used to

determine whether an IOS or Supervisory Special Agent (SSA) was working

on the designated case and therefore would be,responsible :forthe lead.

d. "Read and clear"

A common type of lead is a "read and clear" lead. According to FBI

procedures, "read and clear" leads are for infermational purposes and do not

require any action, other than "clearing" the lead in ACS by closing the lead.

Witnesses tolcl the OIG that setting a "read and clear" lead is similar to sending

a "cc:" copy of a document to someone to read for their information.

e. Persons responsible for conducting analysis in the FBI

As discussed in Chapter Two, analysis of counterterrorism information

normally was conducted in two places in the FBI.: Operational or case-related

analysis was performed primarily by IOSs who worked in ITOS, located in the

Counterterrorism Division. Broader, strategic analysis was performed by

Intelligence Research Specialists (IRSs) who at the time worked in the FBI's

Investigative Services Division (ISD), a separate division from the

Counterterrorism Division. 58

As discussed in more detail below, the F'hoenix EC was addressed to

several SSAs and IOSs in ITOS. It was not addressed to any IRSs or anyone in

the Investigative Services Division.

58ISD was created in November 1999 and housed the FBI's analytical resources, such

as the IRSs who handled counterintelligence matters, organized crime and white-collar

crime matters, and domestic and international terrorism matters. In addition, ISD included

an Intelligence _mdOperations Support Section that was responsible for administering the

field's analytical program and training; and automation requirements. ISD was eliminated in

the beginning ot"2002.

59
B. The Phoenix EC

Kenneth Williams, the special agent who wrote the Phoenix EC, joined

the FBI in 1990, and was assigned to.the Phoenix Division. He worked his

first year and a half on white-collar matters. Since then, he wa,; assigned to

work on international terrorism matters. Williams. told the OIG that while

working on international terrorism matters, he spent almost all of his time on a

terrorist organization that was not connected to A1 Qaeda or Bin Laden. At

FBI Headquarters, responsibility for this terrorist organization fell under the

jurisdiction of a unit in ITOS other than the Usama Bin Laden Unit (UBLU).

Williams said thai:he had not had any contact with the UBL un:it. At the time

of the EC, Williams reported to an SSA who we call "Bob,, who was

responsible for the Phoenix counterterrorism squad.

The Phoenix EC was dated July 10, 2001, and was addressed to the

Counterterrofism Division at FBI Headquarters and to the New York Division.

The precedence line on ,the EC was marked "routine." : .

• The EC stated

that there was an inordinate number of individuals; of investigative interest who

were attending or had attended civiiaviation uniw_rsities and colleges in

Arizona.

1. Information on individuals

As the basis for his concerns, Williams summarized in the EC the results

of four Phoenix intelligence investigations of four subjects who we will call

"Subject No. 1," "Subject No. 2," "Subject No. 3," and "Subject No. 4. "59 The

59Williams was responsible for the Subject No. 1 investigation,whiclhwas summarized

in the EC. The other three investigations were international terrorism intelligence cases

(continued)

60
other persons of investigative interest were described as seven "associates" of

Subject No. 1. The Phoenix Division had opened a "prelil_finary inquiry" for

an intelligence investigation about each of these persons but had not yet

developed sufficient information to open a full investigation.

Williams identified the connections of these individuals to aviation as

follows" (1) Subject No. 1 was an aeronautical engineering student at EmbryRiddle Aeronautical University (ERAU) in Prescott, Arizona; 6°(2) Subject No.

2 took classes', at Cochise College, located in Douglas, Arizona, in the late

1990s to obtain an FAA certificate in airframe', and power plant operations; 61

and (3)Subject No. 3 and Subject No. 4 were known to associate with a person

we will call Subject No. 5, whose telephone number was associated with a

known supporter of an African Muslim terrorist organizaticm and who

reportedly left the United States in the late 1990s after graduating from

Westwind Aviation in Phoenix, Arizona. 62

(continued)

handled by other agents on Williams' squad and another squad in the Phoenix Division.

Subject No. 2 also had been the subject of a separate investigation in an FBI field office in

the western part of the United States before he moved to Arizona in the late 1990s. This

field office's investigation of Subject No. 2 was closed at the time the Phoenix EC was

written.

6oWilliams stated in the EC that Subject No. 1 was enrolled in aeronautical engineering.

ERAU offers a degree in aerospace engineering with a concentration in aeronautical

engineering. Aeronautical engineering is the study of'aircraft design.

61A certificate in airframe and power plant operations allows an individual to become

an aviation maintenance mechanic. The courses for this certificate deal largely with

maintaining aircraft in airworthy condition.

/

62The Phoenix EC does not state what courses Subject No. 5 took at Westwind

Aviation. The F'hoenixEC also does not state whether the FBI had an investigation open on

Subject No. 5 at the time; however, according to Williams, the FBI dJidnot have any

investigation open on Subject No. 5 at the time because he was not in the United States.

Subject No. 5's name had surfaced in another FBI investigation involving the same African

Muslim terrorist organization that Subject No. 5 was believed to be connected to. After

September 11, Subject No. 5 was arrested on terrorism charges relateclto the September 11

attacks, but he was released when a court found that the prosecutors lacked any evidence

connecting SubjectNo. 5 to the events of September 11.

61
With respect to the seven associates of Subject No. 1, Williams wrote

that three were em:olled in pilot training at ERAU, and three were enrolled in

an aeronautical engineering program at ERAU. For the seventlh, Williams had

no record of classes taken. 63

Williams also reported in the EC the connections of Subject No. 1,

Subject No. 2, Subject No. 3, and Subject No. 4 to Bin Laden and to each

other, which we describe below.

Subject No. 1- The Subject No. 1 investigation was designated by

Williams as a 199M or "IT-Other" matter. 64 WillJiams told the OIG that he had

opened the Subject No. 1 case under this designation .. after obtaining material in

Subject No. 1's garbage relating to Ibn Khattab, who Williams believed had a

connectionlO Bin Laden. As discussed in more detail in Chapter Four, Ibn

Khattab was a Jordanian-born, Islamic extremist who was. the leader of a large

group of Chechen rebels that had many successes in clashes with Russian

forces .65

In summarizing his investigation of Subject No. 1, Williams wrote in the

EC that Subject No. 1 came to the United States-inthe late 1990s, and that in

April2000 0ne of Williams' sources reported thatSUbject No. 1 was a

supporter of Bin Laden. In addition, the EC statedthat the source told

Williams that Subject No. 1 was involved in the A1-MuhjirounP 6 a Muslim

fundamentalist organization that Williams described as "dedicated to the

overthrow of Western society" andas "an ardent s;upporter of [Bin Laden]." As

further support for a connection between these persons and civil aviation,

63We asked Witliams to confirm the courses these individuals took. Afterreviewing

their files, Williams told the OIG that only two of the individuals were enrolled in pilot

training and the other four were enrolled in aeronautical engineering.

64An EC requires a case number field to be completed. Williams used the Subject No. 1

case number in the case number field of the Phoenix EC.

65Chechnya is a republic of the former Soviet Union. Since the collapse of the Soviet

Union in 1991,Chechen separatists- both Islamic and non-Islamic -haw: sought

independence from Russia.

66We observed several spellings for this organization in FBI documents, including A1-

Muhajiroun and A1-Mouhajiroun.

62
Williams noted that the spiritual leader of the A1-Muhjiroml had issued a

religious degree (or "fatwa") in February 1998 in which he declared a "jihad"

or "holy war" against the United States and British govemraent, armies,

interests, and airports." (Emphasis in original..)

Williams wrote in the EC that he had interviewed Subject No. 1 in the

spring of 2000 and that during these interviews, which were conducted in_

Subject No. l's apartment, Williams observed photographs on the walls of Bin

Laden, Ibn Khattab, and wounded Muslim separatists from Chechnya.

Williams wrote that Subject No. 1 admitted during these inlierviews to being

involved in the A1-Muhjiroun, and that he considered the U.S. government and

miiitaryforce:s to be "legitimate military targets of Islam." Williams noted in

the EC that his investigation of Subject No. 1 was continuing.

Subject No. 2: Williams reported in the',EC that Subject No. 2 was

known to have contact with Bin Laden lieutenant Abu Zubaida. Williams

wrote that Subject No. 2 had moved to Arizona in 1998, but had left the United

States in October 1999. 67

Williams also wrote that two persons arrested in June 2001 in Bahrain

had admitted to being members of al Qaeda and had been planning an

operation to bomb the U.S. embassy and military forces in Saudi Arabia. At

the time Of their arrest, they had in their possession a passport of a man,who

was believed to be a relative of Subject No. 2. Williams wrote that the man

who was believed to be a relative of Subject No. 2 previously had entered:the

United States in 1998 with this passport and was associated with an address

known to be tlhat of Subject No. 2. Williams wrote that he had not been able to

establish a connection between Subject No. 1 and Subject No. 2.68

Subject No. 3 and Subject No. 4: Williams reported in the EC that

investigations of Subject No. 3 and Subject No. 4 had been opened based on

67The FBI :fieldoffice that had been investigating Subject No. 2 had closed its

investigation of Subject No. 2 at the time the Phoenix EC was written.

68Williams wrote in the EC that Subject No. 1 arrived in the United Statesin August

1999 and that Subject No. 2 left the United States in October 1999. Williams also wrote that

"Subject No. 2 had departed the U.S. prior to Subject No. 1's arrival." Williams told the

OIG that this last statement was in error.

63
information from foreign governments demonstrating that they were both

involved with African Islamic extremist/terror activity and had associated with

individuals who had associated with Ahmed Ressam. Ressam was arrested on

December 14, 1999, attempting to cross the border from Canada into the

United States with chemicals and detonator materMs in his car. 69

Williams wrote that Subject No, 3 and Subje,ct No. 4 were friends with

Subject No; 5, whose telephone number had been associated with a known

supporter of an African Islamic terrorist organization. Williams noted that

Subject No. 3, Subject No. 4, and Subject No. 5 had not been linked to Subject

No. 1 or 'Subject No. 2. The EC did not state whether the FBI had an :

investigation open on SubjectNo. 5 or provide any further details on him. The

EC reported that Subject No. 5 had left the counWy'in November 1997 after

graduating from Westwind Aviation. The EC did not describe the connections

between the African Islamic terrorist organization and Bin Laden or al Qaeda.

2. Recommendations in the Phoenix EC

The Phoenix EC made four recommendations"

• "FBI field Offices with these types of schools in their area should

establish appropriate liaison" with the schools;

• "[FBI Headquarters] should discuss this matter with other elements of

the U.S. intelligence community and task the community for any

information that supports Phoenix's suspicions"; and

• "[FBI Headquarters] should consider seeking the neces,;ary authority to

obtain visa information from the [Department of State] on individuals

obtaining visas to attend these types of schools and notify the

appropriate FBI field office when these individuals are scheduled to

arrive in their area of responsibility."

69The Phoenix EC did not state Ressam's affiliation with Bin Laden or al Qaeda.

64
In the lead section of the EC, Williams wrote that he was requesting that

FBI Headquarters consider implementing the suggested actions. The New

York Division lead was designated as a "read and clear" lead. At the end of

the EC, Williams wrote that the information was "being provided to receiving

offices for information, analysis and comments."

3. Addressees on the Phoenix EC

The atte,ntion line of the EC contained the names the unit chief of the

RFU, who we call "Don"; an IOS in the RFU who we call ':'Ellen"; the acting

unit chief of the UBLU, who we call "Rob"; and UBLU IOSs who we call

"Jane," "Matthew," and "Frank. ''7° The RFU and the UBL:U were the two units

with program responsibility for the two primary organizations discussed in the

EC: A1-Muhjiroun and Bin Laden/al Qaeda.

The attention line also contained the names of two Special Agents who

worked on two different international terrorism squads in the New York

Division: an agent who worked on the New York FBI's Bin Laden squad who

we call "Jay".. and an agent who we call "Mark" and who worked on a New

York squad that handled investigations that fell under the RFU.

, ,

Williams told the OIG that his prior experience did not involve Bin

Laden or A1 Qaeda and instead centered on another terrorist organization

which was managed by a unit other than the Bin Laden UnJit at FBI

Headquarters.. He said that he was therefore not familiar with the personnel in

the other units within ITOS, except for one long-time RFU IOS, who we call

Frank. Williams said that he called Frank to obtain the names of the persons

working in the RFU and the UBLU, and that he put in the attention line of the

EC the names he had obtained by calling Frank.

Frank told the OIG that he recalled talking to Williams about the EC and

recommending several potential points of contact. Frank said that based on his

understanding of what Williams was writing about, several people needed to

7oWilliams mistakenly identified the IOSs as IRSs in the Phoenix EC. In addition, at

that time Matthew and Frank worked in the RFU, not the UBLU. At the request of the FBI,

wehave omitted the true names of most of the agents and the analysts who are discussed in

this report.

65
/

see the EC because more than one program was involved. He ,;aid that because

the New York Field Office was the primary field office that handled the FBI's

Bin Laden,related investigations, he likely recon_nended that Williams also

address the EC to a point of contact in New York.

When asked why he did not recommend including any IRSs on the

attention line, Frank told the OIG that the Investigative Services Division was

"on its last legs,' at the time and that there were very few IRSs in the ISD still

working on analysis. He explained that any work of the IRSs would have to be

coordinated through an IOS, so it made sense to route the EC through an IOS

in the first instanc,e.

Williams also told the OIG that at the time he was familiar by name with

Ellen because, prior to writing the Phoenix EC, he had accessed in ACS an EC

she had written on the A1-Muhjiroun in 1999. Ellen told the O]EGthat Williams

called her on July 9, 2001, to tell her that he had used her paper in writing his

EC and that he had included her name on the attention line. She said that he

also asked her if she recommended anyone to include on the attention line and

that she gave him the name of Mark, one of theNew York Division agents who

had been the case agent for the FBI's investigation of the A1-Muhjiroun.

C. Williams' theory

Hesaid that he was basingthe theory on his almost ten years of

experience in international terrorism cases and his knowledge t]hatal Qaeda

had a presence in Arizona. He said that he had learned in squad meetings

about Subject No. 2, and he thought it was "unusual" that Subject No. 2 would

come across the world to study aircraft maintenance in the United States.

Williams said that at the time, he also was working the investigation of Subject

No. 1 and he began thinking that he should look to see how many other

investigations were being handled in Arizona that involved individuals with

Islamic militant viewpoints •___

_. He said that after he did and learned about several others of

interest to the FBI, he decided to put his thoughts and recommendations on

paper.

66
Williams explained that he was,not focused on flight schools, but instead

focused on colleges and universities where individuals could earn degrees in

aviation-related subjects and then obtain jobs in the civil aviation industry in

this country.

Rather, he believed that there could be

an effort unde,r way to develop expertise about where to put an explosive

device on an airplane or how to mechanically alter an airplane in order to cause

it to crash. Williams told the OIG that he did not have information of a

specific threat or pending attack, which is why he marked the EC's precedence

as "routine."

Williams told the OIG that he did not know at the time whether Subject

Nos. 3 and 4 discussed in the EC or the African Islamic ten:orist organizations

were connected to Bin Laden or al Qaeda. Williams said that he was trying to

"paint a picture of people associated with radical Islam" who were also

associated with aviation. Williams said he wanted FBI Headquarters to look at

his EC and answer the question:

He stated'that 'he did not expect an

immediate response and believed that it would take at least a couple of months

for FBI Headquarters to review the EC, because he knew that resources for this

kind of analytical project at FBI Headquarters were limited. In addition, he

said that he wanted FBI Headquarters to share his theory with other elements

of the Intelligence Community to see if anybody else had any information to

corroborate his theory. 7_

7_In the summer of 2003, the OIG received new allegations front a formerFBI

confidential informant whose control agent had been 'Williams. The :formerinformant.

alleged that he had informed Williams in October 1996 that he was concerned that a terrorist

could use crop duster airplanes as weapons and that one of the subjects of the Phoenix .EC

and other Middle Easterners were attending flight schoolsin Arizona. The former informant

also said that he believed Williams had written the Phoenix EC beca_tsein May 2001 the

informant had raised complaints with the Phoenix FBi[about how it handled him as an

informant and why he,was closed as an informant in 1999. The fomLerinformant also

alleged that a reporter had called Williams in June or July 2001 about the former informant's

information concerning Middle Eastern matters.

(continued)

67
Williams stated that he also knew that there were some "inherent legal

issues" with the recommendations in.the EC because he beliew_d that concerns

about racialprofiling would have tobe addressed. Moreover, he said that he

was not aware at the time whether the FBI had the,'authority to review the visa

information of thousands of people applying to civil aviation universities and

colleges in the United States, as he had recommended in the EC.

After the Phoenix EC was completed and sent, Williams did not contact

anyone at FBI Headquarters or in New York to discuss its contents or check the

status of the leads in ACS.

D. FBI Headquarters' handling of the Phoenix EC

Although the EC is dated July 10, the Phoenix Division did not upload

the EC into:ACS until the afternoon of Friday, July 27, 2001. The Phoenix

FBI also mailed the paper copy to FBI Headquarters around July 27.

ACS records show that, because of the case designation lJistedon the

Phoenix EC, the lead for FBI Headquarters was initially routed electronically

through the ITOS .electronic routing table to a general ITOS lead bucket that

was handled by m_ITOS administrative unit. The lead was not directly routed

to the RFUor the UBLU. 72 An IA in the administrative unit in ITOS was

responsible for checking the ITOS general lead bucket regularly and

•electronically assigning these kinds of leads to the appropriate person within

ITOS.

(continued)

In addition, Williams said that he never spoke to the reporter

who the former informant said had called Williams, and that he was not prompted to write

the Phoenix EC because of a phone call from any such reporter.

72At the time, the electronic routing table in ACS for the Counterterrorism Division

was set up to automatically route leads associated with cases with the type,,of case number

designated on the Phoenix EC to an administrative unit in ITOS rather than to a particular

operational unit.

68
1. Assignment to the RFU

On the morning of Monday, July 30, 2001, the ITOS ![Aaccessed in ACS

the text of the Phoenix EC. ACS shows that on that same day the ITOS IA

assigned the lead in ACS to Eilen, an IOS in the RFU who 'waslisted second

on the attention line of the EC.

The ITOS IA told the OIG that he did not recall the Phoenix EC or

assigning the lead, but that his practice was to review the text of the lead and

the person or persons listed on the attention line to determine to whom to

assign the lead. The EC indicated that it related to an "IT-Other" matter and

these cases felL1under the RFU. The ITOS IA said that he sometimes consulted

with his unit c,hief if he was unsure to whom to assign the lead, but he said he

did not recall whether he did so in this case.

Ellen told the OIG that she pulled the Phoenix EC up in ACS, printed a

copy, and read it. 73 She said that, after reading it, shethought that the EC

should be reviewed by the UBLU, not by her unit, because the EC discusSed

Bin Laden and al Qaeda, which were the responsibility of the UBLU.

Ellen therefore discussed the EC with one of the IOSs;who worked in the

UBLU, Who we call Jane. Ellen said she reca][led asking Jane if she shoUld

transfer the le_idto Jane, and that Jane stated tlhatshe did not have time to look

at it then. Ellen said that Jane asked if she could get back to Ellen in a week.

Ellen said that she therefore consulted with Jane about a week later. ACS

records show that Jane downloaded the Phoenix EC from ACS on August 7,

2001. According to Ellen, she and Jane discussed the tremendous effort that

they thought would be needed to implement tile recommendations in the EC.

Ellen said that Jane agreed that Jane should handle the Phoenix EC.

Ellen told the OIG that she remembered Jane ,,sayingshe w_mted to do more

73Ellen told the OIG that she never received a hard copy of the Phoenix EC.

69
research on FBI investigations to determine what .other connections might exist

between Bin Laden, al Qaeda, _mlllll, and then, depending upon the

results of that research, perhaps disseminate it. Ellen said that .lane also told

her that she also wanted to speak with her supervisor and decide what action to

take on the Phoenix EC.

Ellen said that, after talking with Jane, she closed the lead in ACS on

August 7, 2001, indicating in ACS that Jane was planning to conduct additional

research before proceeding. ACS shows that Ellen wrote in the',"disposition"

field for the lead thatthe lead Was "covered-consulted with UBLU, no action at

this time, wi!1rec.onvene on this issue." Ellen said that after she and Jane

discussed the issue, they agreed to "revisit" the issue later once Jane had done

some research an(] had a better idea of how to proceed. Ellen also said that she

closed the lead rather than asking an IA to reassign the lead to Jane because she

knew that it Would take some time for the necessary research to be done, and

that the RFU unit chief- Don- had instructed RFU employees that leads had to

be closed in a timely manner.

Ellen told the OIG that she thought that the theory presented in the EC

was "interesting,'" but that she, like Jane, believed that further research needed .

to be conducted before any action was taken on the Phoenix EC. Ellen also

asserted, "It was a theory that certainly needed to be explored more fully before

disseminating it to the [Intelligence Community] as fact or not.:" In addition,

Ellen said that she believed that attorneys in the FBI's National Security Law

Unit (NSLU) would have had to review the Phoenix EC before any action

could be taken on it because the lssu,, " _ of racial profiling was "hot."

I

Whenwe asked Ellen whether she considere,d referring the Phoenix EC

to the ISD to research and analyze, she stated that the RFU did not have an ISD

analyst assigned to itat the time. Ellen acknowledged that it would have been

possible for the I_,D' to assign an IRS analyst to do strategic research regarding

the EC, but she believed the EC should first be ret_rred to the UBLU, since the

EC's focus was al Qaeda and it was the UBLU's prerogative to decide how to

proceed on it.

Ellen told the OIG that she did not recall consulting with :hersupervisor

in the RFU, an SS',Awho we call "Chris," about how to handle the Phoenix EC,

or showing it to him. She said that s]hemight have mentioned it in passing to

Chris, but it was common for IOSs to close leads without supervisory input.

70
Chris was an SSA assigned to the RFU fi-omthe SUltrier of 2000 until

September 10, 2001, when he left FBI Headquarters. Chris told the OIG that

he never saw ,ordiscussed the Phoenix EC with anyone prior to September 11.

Don was the unit chief of the RFU at this time. He joined the FBI in

1987 and was assigned to the RFU in May 20(31. Don said that he first learned

of the Phoenix EC only after the September 11 attacks. He indicated that

neither Ellen nor anyone else mentioned the EC to him before September 11.

He said that on average he reviewed 30 to 45 ECs a day that were assigned to

the RFU, and because of the vast amount of imelligence data that had to be

' analyzed by tile seven IOSs in the RFU, the RFU had to rely on their judgment

., to accurately prioritize the information. Don stated that if he had seen the

Phoenix EC before September 11, he would have discussed its

recommendations with his UBL counterpart, then forwarded the EC to the

ITOS Section Chief, Michael Rolince, for a decision on the course of action to

take on the EC.

2. Assignment to the UBLU

a. Jane's handling of the EC

As noted above, Ellen reassigned the Phoenix EC to Jane, an IOS inthe

UBLU. In addition, the hard copy version of the EC, which Phoenix had

_ mailed to FBI Headquarters, also was assigned to Jane. According to Jane, on

or about July 30, an IA in the RFU delivered the hard copy of the Phoenix EC

to Jane. Jane provided the OIG with the copy that she received from the IA,

which Jane had initialed to indicate receipt.

Jane told the OIG that she also recalled discussing the EC with Ellen.

Jane said that after she read the EC, she told Ellen that she agreed that it made

more sense for the UBLU, rather than RFU, to handle it because of the

•

references to ]BinLaden.

Jane told the OIG that she did not believe that there was a sufficient

"factual predicate" to justify taking any immediate action on the EC, such.as

disseminating it to the Intelligence Community. Jane assel_:edthat based on

what was in the EC she did not believe that Subject No. 1 had a strong

connection to Bin Laden. She said that the investigation of Subject No. 1 was

opened as an Islamic Army of the Caucuses/Ibn Khattab matter, and, according

71
to Jane, "Ibn Khattab has never taken operational directions frem Usama Bin

Laden." She said that, according tothe EC, the primary evidenLceof the

connection was that Subject No. 1 was a member of A1-Muhjiroun and had a

picture of Bin Laden on his wall. She stated that ,;he confirmed with Ellen that

while A1-Muhjiroun verbally supported Bin Laden, the FBI had not developed

any evidence that A1-Muhjiroun had provided any operational ,;upport to Bin

Laden. TM

In addition, Jane told the OIG 1Lhatshe recalled concluding that the

factual predicate was weak because many of the individuals whowere listed in

the EC as associated with Subject No. 1 were the subjects of only preliminary

inquiries, not full investigations. Jane said that based on what she saw in the

EC and knew about Bin Laden, shedid not see the connection between Bin

Laden and Subject No. 1 or the other subjects of tlheEC. She stated that she t

did not feel "comfortable at this stage going forward with the theory that we

think these individuals from these countries are coming here sent by UBL,

when the preponderance of evidence indicates that these people; are aligned

with A1-Muhajiroun and Ibn Khattab." She said that being associated with Ibn

Khattab "did not equate" with being associated with Bin Laden.

Jane said that the fact that the Phoenix EC reported that a large number of

Middle Eastern men were training in U.S aviation-related schools did not

strike her as significant because it was well known that Middle Eastern men

have historically trained in U.S. flight schools because they are cheaper and

better than other tlight schools around the world. She suggested that before

September 11, ewen someone of inve,stigative interest training in a U.S. school

in an aviation-related field did notnecessarily raise a red flag.

Jane said that she told Ellen that she needed to do some research before

she took any action on the EC. According to Jane, she initially thought of a

handful of steps slhewanted to take based on her knowledge of ongoing cases

within the FBI. Jane said that she wrote a "to do" list on a yellow post-it note

and attached it to her copy of the EC. She said she thought thai: there were at

74Mark, who had been the case agent in New York on the FBI's investigation of the A1-

Muhjiroun, told the OIG that the New York Division had closed its case on A1-Muhjiroun

long before September 11 because the FBI was not able to establish that A1-Muhjiron had

engaged in terrorist activities or supported terrorist activities.

72
least four items on the list, but she could not specifically remember all of

them. 75 However, she said she recalled that one of the items on the list was to

review the FBI's information on Essam A1 Ridi, a former personal pilot for Bin

Laden who testified for the government in the trials against the persons

responsible for bombing the U.S.. embassies in East Africa !inAugust 1998, to

see if al Qaeda had undertaken may similar initiatives as these discussed in the

Phoenix EC.

Because: the EC included information about Subject No. 2, who had

previously lived and studied in the United States and had ties to suspected

terrorists arrested a few weeks prior, Jane said that she immediately thought of

an issue being researched by an IRS in an FBI field office. We call the IRS

"Lynn. ''76 Lynn hadbeen involved with the field office's intelligence

investigation of Subject No. 2 when he lived in the area. As noted in the EC,

two al-Qaeda operatives were arrested in Babxain at the end of June 2001 who

had been planning an operation to bomb the U.S embassy and military forces

in Saudi Arabia. At the time of their arrest, they were in possession of a

passport containing the name of a person belie, ved to be a relative of Subject

No. 2.

In June 12001,Jane had asked Lynn to review her field office's case file

on Subject No. 2 to try to find connections between SubjeclLNo. 2 and his

associates in the state where the field office was located and the two al Qaeda

operatives arrested in Bahrain. Jane told the OIG that she was familiar with

this field office's investigation of Subject No. 2 and several of his associates

who were living in the area.

75In November 2001, Jane was interviewed about the EC by an OIG Special Agent who

conducted a prelliminaryreview regarding the Phoenix EC. Jane said that she gave the EC

with the post-it note on it to the OIG Special Agent. The Special Agent confirmed that Jane

gave him the EC along with the note, but he was not able to locate the post-it note when he

retrieved the original EC several months later.

76Lynn had been an IRS with the FBI for approximately two years at the time of the

Phoenix EC. She handled all counterterrorism-related analytical work for the FBI field

office in which ,;hewas employed.

73
_l She said that she thought that Lynn :might be aware

of something in what she was researching about Subject No. 2's contacts in the

area of the field office that could support the theo]u in the Phoenix EC.

As a result of the arrest of the two al Qaeda operatives in Bahrain, Jane

also was dealing with Williams' supervisor who we call "Bob," and with

agents in the Phoenix Division other than Williams on Phoenix's Subject No. 2

investigation, which was closed at the time. She stated that the FBI Phoenix

Division had been asked to follow up on matters in the Subject No. 2

investigation that had been left unfinished, such as documents that had been

collected from several sources but never read or analyzed. In addition, Jane

stated that she had been in contact with the Phoenix Division about locating a

source who previously had been married to a woman who was married to a

family member of Subject No. 2.

However, Jane told the OIG that she did not have any contact with

Williams about the Phoenix EC and that her only contact with Bob about the

_ EC was via e-mail. On August 6, 2:001,Jane sent an e-mail to :Bob asking if he

had any objection to her sending the Phoenix EC to Lynn. Bob replied via email the same day that he did not have any objectJ[on.

The next day, Jane sent the Phoenix EC to Lynn. In an e..mail message

attached tothe EC, Jane stated: "I thought it would be interesting to you

consideringsome of the stuff you were coming up with in [your field office].

Let me know if anything strikes you." Jane told tlheOIG that she wanted to

know if Lynn saw any similar patterns between the associates of Subject No. 2

that she was researching in her area and the individuals discussed in the:

Phoenix EC. However, Jane did not assign a lead to Lynn, nor did she call

Lynn about the P]hoenix EC either before or after she e-mailed it to her.

b. Lynn's response

Lynntold the OIG that she received the Phoenix EC and Jane's e-mail,

and she read them. Lynn stated that she believed that Jane sent her the EC

because Jane was aware of her field office's earlier investigation of Subject

No. 2 and several of his associates. Lynn said that in these "lnv_stlgat ._ " lons, " the

FBI observed some trends, such as t]aat all of the subjects were of Saudi

descent, were employed by Saudi aMines, and we,re involved vAth aircraft

maintenance or had pilots' licenses, and that the Saudi airline company was

(

74
paying for their training. Lynn said that the investigation also had revealed that

the subjects were calling various gun dealers and gun shops. She said that the

FBI personnel involved in the investigation questioned whether the subjects

were using Saudi airlines to transport weapons, but that nothing further had

developed in the investigations to support this theory and that the field office

investigation was-closed. According to Lynn, by the time the name of Subject

No. 2 resurfaced in June 2001 based on the arrest of the two al Qaeda

operatives in Bahrain, he had not been in her area for appr,oximately three

years.

Lynn said that, although she did:not recall speaking with Jane about the

EC, she believed that Jane was passing the EC to her for informational

purposes. Lynn said that she was interested in whether there was any

information in the EC that would inform the work that she was doing on

Subject No. 2 at the time, but that after reading the EC, she concluded that it

did not affect her investigation. She said she considered it :good information to

know and that itwas a "piece of the puzzle."

She stated that it was

"no big secret:" that Arab nationals received aviation training in the United

States. She said that for these reasons, she did not respond to Jane's e-mail.

c. UBLU

Jane said that, in addition to sending the EC to Lynn, she talked to the

SSA with whom she worked inthe UBLU who we call Rob, and told him

briefly about the EC. Jane told the OIG that She could not recall whether she

provided a copy of the EC to him. 77 She said llhatshe explained to Rob that she

believed that she should do some research before deciding to act on the EC.

According to Jane, Rob concurred with her course of action.

77Jane later informed the OIG that she handed the Phoenix EC to Rob, that he skimmed

the synopsis, and that he listened to her summary of the document and proposed course of

action.

75
Rob was Jane's SSA and also the Acting Unit Chief of the UBLU at the

time. Rob, an FBI agent since 1990, had been assigned to the UBLU since

1999. He was the Acting Unit Chief of the UBLU from June 2:8,2001, until

September 10, 2001. He told the OIG that he routinely reviewed dozens of

ECs on any given day, and he often relied on the judgment of Jane and other

IOSs concerning intelligence decisions.

Rob said that he remembered Jane coming to him in the second week of

August 2001 and telling him briefly about the Pheenix EC. He said that he

also recalled her saying that she believed some preliminary research needed to

be done before proceeding. He said that he did not see a copy of the EC, but

based on Jane's description, concurred with her decision to conduct some

initial, research before taking any other steps. Rob,said he did not discuss the

Phoenix EC with anyone else.

According to Jane, she intended to address tlhePhoenix EC as time

permitted. However, she sfiid that she believed it would take a significant

amount of time to do the research necessary to determine an appropriate

response to the ECI She said that she was not able to return to liheEC between

August 7 and September 11 because of her heavy workload at the time. In

addition tothe work generated by the al Qaeda operatives arrested in earlier in

the summer in Bahrain; she said that other matters at the time were of a higher

priority thanthe Phoenix EC, such as another would-be al Qaeda "bomber"

who was arrested in a foreign country., analysis of information received from a

number of sources on the brother of a key Bin Laden lieutenant:, and several al

Qaeda-related threats of imminent attack. She stated that the entire UBLU was

flooded with leads and requests concerning Bin Laden and also was handling

"dozens" of leads on a daily basis associated with the attack on the U.S.S. Cole

that had occurred in Yemen in October 2000.

When we asked Jane why she did not refer tlhePhoenix EC to the ISD for

analysis, she said she did not recall ever thinking that she should refer the EC

to the analytical unit within the ISD. Jane noted that at the time the Phoenix

EC was sent to FBI Headquarters, no IRS was assigned to the UBLU from the

ISD. The last _' IR_, assigned to the UBLU had arrived in February 2001, but

had transferred in early July 2001 to another unit. The ISD had not replaced

her.

76
Jane, who had been an IRS for approximately six months before

becoming an IOS, told the OIG that she had planned to conduct the necessary

analysis with respect to the theory presented by Williams because she didnot

believe there was anyone in the ISD to do this kind of research and analysis.

When asked if she could have made a request of the ISD for assistance despite

no one being specifically assigned to UBL matters, Jane responded that in

other instances where her unit had asked for research from the ISD, it was not

able to provide the support requested because it lacked adequate personnel to

do so.

Jane said that she did not recall seeing the Phoenix EC again until after

September 11.

-

• The two other individuals JLnthe UBLU who were listed on the attention

line of the EC- Frank and Matthew- told the:OIG that they did not see the

Phoenix EC before September 11. ACS records also show that they did not

access the Phoenix EC before September 11. ACS records also show that no

other FBI Headquarters employees accessed t]hePhoenix EC before

September 11.

E. The New York Division's handling of the EC

The Phoenix EC also was routed by hard copy and through ACS to the

FBI's New York Division. Williams told the OIG that he sent the EC to the

New York Division because it was the focal point for Bin Laden matters in the

FBI. At the time, the New York Division was;working several criminal and

intelligence cases related to Bin Laden's terrorist activities.

Williams told the OIG that, by sending the EC to the New York office, he

was seeking the expertise and knowledge of the office, not simply informing it

of his theory. Williams said that he was anticipating an analysis of his theory

from those inthe FBI with more expertise and experience with Bin Laden

matters, including the New York Division.

The "attention" field of the EC contained the names of two New York

FBI agents, who we call Jay and Mark, and the lead was designated as "read

and clear." As discussed above, within the FBI read and clear leads are

considered for informational purposes and do not require any specific action.

2

77
Based on the electronic routing table in ACS, in New York the lead was

initially routed to the Assistant Special Agent in Charge (ASAC) for the New

York FBI's Counterterrorism Program. The ASAC' s secretary was responsible

for assigning leads routed to the ASAC. On July 30, 2001, she assigned the

lead to a New York international terrorism squad based on the case number.

According towitnesses we interviewed in New York, the volume of read

and clear leads received each day by the New York office was enormous. TM

Squad secretaries were usually responsible for assigning "read and clear" leads

directed to their squads. Leads were, assigned to specific agents based on the

.names listed in the "attention" section of the EC, 1!hecase number, or the

content of the EC. The Phoenix EC lead, however, was never assigned in ACS

to a particular agent. The secretary of the New York international terrorism

squad that had been assigned the lead closed the lead in March 2002. 79

The New York office's hard copy of the Phoenix EC was routed to the

international terrorism squad that handled Bin Laden investigations, where.it

was provided to Jay, the first New Yorkagent listed on the EC.. Jay had been a

special agent with the FBI since 1976 and had worked on international

terrorism matters since 1984. Since 1996, he was assigned to the squadthat

handled Bin Lade,n-related investigations, working primarily criminal

investigations. 8°

Jay told theOIG that the Phoenix EC was routed to his mail folder by the

squad secretary. He said he recalled reading it in August 2001. He said thathe

did not know Williams and never spoke to him either before or after Williams

wrote the EC. Jay said he assumed that Williams listed his name on the EC

because he was one of the agents who worked on the Bin Laden squad in New

York.

78We were told that in 2003 the squad that handled Bin Laden matters received

approximately 3,300 leads.

79We were told that "read and clear" leads often were not closed in ACS for several

months due to the lack of clerical support.

8°The Phoenix EC addressed Jay as the SSA of the squad. He was one of two "relief"

supervisors who filled in for the SSA when he was not in the office. At the time, the SSA

was out of the office on extended medical leave.

78
Jay told the OIG that he did not believe that Williams',' theory was based

in fact. He asserted that a "glaring deficiency"' was the implication that Bin

Laden had a support network in .Arizona. He asserted that there had been a

terrorist cell tlhatwas active in Arizona, but that this was in the 1980s before al

Qaeda existed. He said that based on what was written in the EC about Subject

No. l's conne,ctions to Bin Laden- that Williams was basing the connection on

what Subject No. 1 had said in two interviews- Jay believed that Subject No.

l's connection to Bin Laden was',"tenuous, at best." Jay stated that if it had

been his responsibility to address the Phoenix EC, he would have "taken issue"

with it and would have written back that he believed that the theory and _

conclusions were "faulty." He added that the FBI was well aware that_

__ Middle . _. . ,

Easterners commonly received flight training in the United States. He said he

was not aware of anything that supported the theory espoused in the EC. -_

lay said that he reviewed the recommendations and saw that the

requested actions in the EC were,,for FBI Headquarters to address. He said that

he believes he:may have discussed the EC with some of his:colleagues and that

they agreed that the recommendations were something for ]?BIHeadquarters to

address. Jay told the OIG that he did not contact Williams or anyone else in

Phoenix to discuss the EC.

Mark, the other agent listed on the attention line on the Phoenix EC, was

assigned to the international terrorism squad tlhat handled cases that were

managed by t]heRFU. Mark told the OIG that he did not see the PhoenixEC

until after September 11,2001. ACS records ,confirm that he did not access the

Phoenix EC until after September 11.

. .

Except for an analyst and an auditor in New York who reviewed the

Phoenix EC in connection with searches unrelated to the Phoenix EC, and the

secretary who, accessed the EC to assign the le,ad, we found no evidence that

anyone else in New York read the Phoenix EC or did anything with regard to

, it.8t

81ACS shows that an auditor and an IRS on a squad not related to Bin Laden cases

accessed the Phoenix EC during this time period. They both said the EC did not relate to

what they were :researching, and they did not do anything with it.

79
III. OIG analysis

This section analyzes the handling of the Phoenix EC by the FBI. We

believe, and the FBI has acknowledged, that the Phoenix EC did not receive

the sufficient ortimely analysis that it deserved, and it was not disseminated, as

it should have been, for consideration and input by others in the FBI and the

Intelligence Community.

While :the FBI analysts who reviewed the EC did not giw_ it timely

attention, we do riot believe their individual failings were the main source of

the problem with the handling of the EC. Rather, the deficiencies in its

handling were creased in greater part by critical systemic failings in the way

that intelligence information and requests for assistance were handled by the k

FBI prior to September 11. In this section, we discuss these systemic problems

before evaluating the actions of the individual employees who came in contact

with the EC.

A. Systemic problems

Beforediscussing the systemic failings evidenced by the handling of the

Phoenix EC, it is important to note what the Phoenix EC was not. It was not an

immediate warning about aterrorist plot, and it didnot reveal information

about the September 11 attacks or those who committed the attacks. 82 The EC

itself was worded to convey that Williams was proposing a theory rather than a

warning or a threat. Williams designated it as "routine" because he did not

have any information of a specific threat or pending attack. He: said that he

was putting' forth "an investigative theory" or "hunch," and he 'was seeking an

analytical produclf or feedback in response to his theory. He did not expect that

to happen immediately.

Yet, even though it did not contain an immediate warning and was

marked routine, Williams' information and theory warranted strategic analysis

from the FBI, which it did not receive, and timely distribution, which it did not

82In prepared remarks for congressional testimony on May 8, 2002, former ITOS

SectionChief Michael Rolince noted that "it should be stressed that none of the individuals

identified by Phoenix were connected to the 9/11 attacks,nor did the leads stemming from

that EC uncover the impending attacks." (Emphasis in original.)

80
receive. While we cannot say that better handling of the Phoenix EC would

have uncovered the September 11 plot, the EC should have been handled

differently.

1. Ineffective system for assigning and managing work

The lead from the Phoenix EC was assi_ed by an administrative

employee directly to an IOS in the RFU, Ellen, who discussed the matter with

another IOS in the appropriate unit, Jane. They decided that Jane would handle

the Phoenix EC. Thereafter, Ellen closed the lead in ACS _mdnoted that she

and Jane would discuss the matter further in the future. Although Jane briefly

mentioned the Phoenix EC to her supervisor, the IOSs made independent

judgments about what needed to be done to address the requests in the Phoenix

EC and who to notify about it. Jane also decided when she would work Onthe

Phoenix EC. We found that neither Ellen's direct supervisor(Chris) nor Jane's

supervisor (Rob) ever received or reviewed the Phoenix EC. Nor did any other

supervisor in FBI Headquarters. And as of September 11, Jane had not

completed any work on the Phoenix EC.

" .

We fomad that the assignment of the lead from the Phoenix EC, the

handling of the Phoenix EC independently by an lOS, and even the closing of

the lead did not violate any FBI policies or practices at the time. In instances

where IOSs received leads or intelligence information directly, they were not

required to seek any supervisory input on the information that they were

handling. Witnesses stated that more significant threat information or leads

related to important cases usually were discussed with the SSAs, but that this

did not occur with every lead or assignment, _mdit was not required.

For example, Rob, the acting unit chief of the UBLU at the time, told the

OIG that he often relied on the judgment of IOSs in how they handled their

work. As a result, IOSs regularly handled most intelligence information and

other assignments without supervisory input or knowledge.

Much also was left to the IOS's discretion in deciding what was a priority

and which projects to focus on. Don, the unit chief of the RFU, said that at the

time, managers relied on IOSs to exercise their judgment in how to prioritize

their work. _ItaeIOSs we interviewed stated t]hatthe priorities were determined

bythe nature of the work. For example, they said they gave a threat of a

terrorist attack or an emergency FISA request the highest priority. In addition,

81
if information was requested by higher level FBI officials or a Section Chief,

that assignment was given priority. IOSs explained that, because of the crush

of immediate projects, they were operating with a "triage" approach to their

workload in which they dealt with crises or problems as they arose and

thereafter dealt with routine matters. As with how they handled their leads and

other assignments, we found that IOSs consulted with their supervisors about

prioritizing their work only when they deemed it necessary.

We believe that although the assigning of the lead and handling of the

Phoenix EC Was in accord with UBLU and RFU practices at the time, these

practices were significantly flawed. Assigning work directly to IOSs with no

requirement of supervisory input or review resulted in a lack of accountability

for addressing leads and intelligence information. Without supervisory:

involvement, IOSs were permitted to determinewhat was a priority, and even

when and whether work would be completed. As a result, there often was no

check on the decisions being made by IOSs and no way to ensure that work or

intelligence that was deemed of a lesser priority - such as the Phoenix EC -

was ever addressed. This system was one in which important information

could easily "fall through the cracks," not receive timely attentJ!on, or not be

brought tothe attention of those insideand outside the FBI who had a reason

and a need to know the information.

The lack of accountability andsupervisory involvement was compounded

by the fact that the FBI's computer system, ACS, wasnot set up to ensure that

all addressees on an EC were even made aware of the EC. Only individuals

assigned leads ass;ociated with the EC would be notified electronically of the

document's existence. This meant that when the EC and leads were uploaded,

the EC would not be seen by a supervisor, even if the supervisor was an

addressee on the attention line, unless the supervis;or searched ACS for the

document. Nor was there any assurance that the persons listed on the attention

line of the EC would ever receive notification about it. Since FBI employees

did not search ACS on a regular basis for documents that might be addressed to

them, they did not learn about leads or other intelligence infornlation assigned

to them.

As a result, we found that none of the supervisors listed on the Phoenix

EC saw it before September 11. Important judgments were made about:how to

handle the Phoenix EC - which IOS would address the Phoenix EC, closing the

lead instead of reassigning it, sending the EC to only one person for review, not

82
conducting any research on the recommendations suggested in the EC while

other matters were being handled- none of w]aich involved, any supervisory

input. This, in our view, is not an appropriate system for h_mdling such

important information.

The FBI recognized this problem after September 11 and changed the

way it handled such information. Rolince told the OIG that once he became

aware of the Phoenix EC after September 11 and learned how it had been

handled, he instructed that leads in ITOS had 1:obe assigned to supervisors and

could not be assigned only to IOSs.

In addition to deficiencies in the supervisory process, we also believe that

the FBI's practice and policies regarding closing of leads were faulty. As

evidenced by the handling of the Phoenix EC, leads could tie closed without

any work being done on them, other than reassignment to someone else.

A contributing factor to the',ineffective management of the work

assignments m ITOS was the FBI practice of rotating supervisors through FBI

Headquarters on a relatively short basis. We tbund that supervisors typically

stay in FBI Headquarters for two,years or tess:, and SSA positions and unit

chief positions often remain unfilled for months at a time. By contrast, IOSs

remain in ITOS on a permanent basis and are therefore relied upon for their

expertise and institutional knowledge about counterterrorism programs,

intelligence on FBI targets, relationships with other intelligence agencies, and

how FBI Heaclquarters works. As a result, IOSs sometimes manage

themselves. While we believe that many IOS,; are capable :anddedicated FBI

employees, the turnover of managers in FBI leaves a gap in IOSs' supervision,

in addition to making it difficult for managers to be effective and

knowledgeable about their subject areas before they are sent tO a new

assignment.

2. Lack of adequate strategic analytical capabilities

We believe the Phoenix EC warranted strategic analysis. It never was

subjected to any such analysis before September 11. Ellen and Jane agreed that

Jane would handle the Phoenix FiC,but Jane did not refer it to the entity at the

FBI that was assigned to conduct strategic analysis, the ISD. She said she

decided not to,refer it to the ISD for analysis andinstead keep it for herself to

work on when she had time. She believed that the ISD did not have sufficient

83
capability to perform timely analysis. At the time., the FBI had no IRS in the

ISD specifically assigned to handle matters involving Bin Laden, despite the

importance of that assignment. As ,arediscuss in more detail below, while the

handful of analysts who worked in the ISD were supposed to perform strategic

analytical functions, most of their time was spent assisting on case-related

matters.

This was a significant failing. A critical component of the work of the

FBI's Counterterrorism Division is analysis. Although case-related analysis -

also called "tactical" or "operational" analysis- is',crucial to bringing criminal

cases to the point of arrest and prosecution and to determining through

intelligence information whether a particular targe,t or group may be planning

an imminent terrorist act, strategic analysis is equally important to the FBI's

counterterrorism mission. Strategic analysis involves drawing ,conclusions and

predictions about terrorist organizations and likely methods of attack based on

all sources of information. It is critical to the FBI's ability to be proactive _

instead of reactive as well as to set investigative priorities. It is:also critical for

identifying intelligence gaps in information about a terrorist group or target:

•

Since September 11, the FBIhas acknowledged that it lacked an effective

strategic analysis program for international terrorism prior to September 11. In

congressional testimony, Director Mueller acknowledged the FBI's analytical

capabilities prior to September 11 were "inadequate." He stated that the FBI's

analytical capability "[was] not where it should be',." Since then, the FBI has

focused attention on improving its analytical func_Lions.83

Prior to September 11, the FBI's strategic analytical capabilities were

extremely limited. The FBI did not regularly prepare analytical products that

predicted trends, explained patterns, or identified national secu_dty

vulnerabilities with respect to international terrorism. 84

83The OIG is in the process of completing a comprehensive review of FBI's analyst

program and it is tentatively scheduled to be completed in September 2004.

84A striking example of the FBI's failing in this regard is documented in a September

2002 OIG audit report which found that the FBI had not performed a comprehensive

national-level assessment of the threat and risk of terrorist attack, despite having promised

Congress that it would do so following a September 1999 General Accounting Office

(GAO) report. As of September 11, 2001, the FBI had developed a draft of a report that was

(continued)

84
This lack of strategic analytical capabilil_ undoubtedly affected how the

Phoenix EC .was handled. Instead of being able to send the EC to a unit that

had sufficient expertise and resourcesto assess the theory laid out by Williams,

Jane kept it to herself, hoping to find the time to turn to it amid the crush of

other duties. She was not able to do so before September 11.

Part of the problem was that, in the past, the FBI did not adequately value

or support an analytical program. This problem was aptly described by one

CIA official -one of several CIA managers enlisted by the FBI after

September 11 to help turn around the FBI's analytical program- as "a lack of a

culture of analysis." The FBI was composed predominantly of agents who

performed criminal investigative work andwho did not appreciate the value of

strategic analysis. This was particularly acute in the FBI's Counterterrorism

Program. As a result, FBI counterterrorism IOSs, SSAs, and managers had a

tendency to rely on their own experience and professional judgment rather than

seeking strategic analysis, and the Counterterrorism Program focused on

immediate, short-term operational priorities rather than strategic analysis:

' Strategic analysis was viewed as a support function rather than its own

discipline. IOSs and agents employed IRSs wimarily to conduct research and

analysisprojects in support of on-going investigations or prosecutions. While

this research _md analysis often involved complex and time-consuming work,

such as reviewing information collectedas a result of a FISA warrant or

establishing the connections between targets in a case based on a review of

telephone records, it was normally in furtherance of a specific investigation.

Furthermore, several IRS employees we interviewed told the OIG that

IRSs often were used to perform the work that IOSs did not like to do, such as

conducting name searches in ACS or performing research on the Internet. A

(continued)

purportedly the threat assessment. The OIGreviewed a draft of the report in May 2002. We

concluded that it was not a threat assessment because it did not describethe nature o£the

terrorist threat, identify critical intelligencerequireme,nts, or make recommendations to any

level of FBI management. See "A Review of the Federal Bureau of ]investigation's

CounterterrorismProgram: Threat Assessment, Strategic Planning, and Resource

Management" (May 2002). In January 2003, the FBI issued an intelligence assessment

entitled "The Terrorist Threat to the U.S. Homeland: An FBI Assessment," which

responded to the recommendations in our September 2002 audit report.

85
CIA manager detailed to the FBI told the OIG that IRSs were considered

"second class citizens" at the FBI. This view of analysts reduced the ability of

the FBI to conduct the strategic analysis that was :needed on projects such as

the Phoenix EC.

Another example of how the strategic analytical function was subordinate

to the operational function in the FBI's Countertela'orism Program is evident in

the fact that 5 IRSs were absorbed into an operational unit in late 2000, when _

there were fewer than 20 IRSs devoted to international terrorism at the time.

These IRSs were assigned in late 1998 to the UBLU to conduct research and

complete other ta'sks in support of the investigation and prosecutions stemming

from the embassy bombings in East Africa. These were important assignments

that needed to be done, but they made it more unlJikely that strategic analysis,_

such as the kind warranted by the Phoenix EC, would be accomplished.

In addition' the primacy of the operational units was further demonstrated .

by the fact that the judgments and conclusions of IRSs set forth in analytical

products could be:overruled or blocked from dissemination by the managers in

the operational units or the ITOS section chief. Witnesses told the OIG that

operational personnel were permitted to prevent dissemination of analytical _

' products. For example, IRSs told the OIG that a proposal for an analytical

report that .would have discussed signs that al Qaeda was planning a terrorist:

attack was stopped by a New York Field Office supervisor because of concerns

that the information could be subject: to discovery in a prosecution.

Witnesses also told the OIG that operational, units' ability' to override the

conclusions of the IRSs was demoralizing to the analytical component. :CIA

analysts detailed 1:othe FBI after September 11 to revamp its analytical

program asserted to the OIG that operational personnel, whose expertise is '

case-oriented and therefore tactically based, should be involved in checking the

facts presented in the analytical product but should not be able to alter or block

the dissemination-of analytical results.

While there are legitimate tensions between operational and analytical

personnel, the FBI had no process before September 11 for addressing conflicts

that arose out of this tension.

86
3. Resources and training for analysts

The FB]['s strategic analytical function also was unde:r-resourced. This

was demonstrated by the shortage of IRSs andthe lack of tT:ainingoffered to

them. We interviewed former IRS managers about the resources of the ISD

prior to September 11. The FBI acknowledged that the number of IRSs

working on counterterr0rism matters had dwindled prior to September 11, and

that the few remaining IRSs were not sufficient to address the analytical needs

ofthe ISD.

In 1996, the FBI had hired 36 IRSs in an effort to bolster its international

terrorism analytical program. According to witnesses, witl_n a year

approximately half of the IRSs had left the program. By mid-1999, there were

only approximately 15 international terrorism IRSs, and by mid-2000 there

were only 10 IRgs devoted to counterterrorism analysis. 85 Former IRS

managers confirmed to us that only one IRS was assigned to UBL matters in

2001, but she transferred to another unit in July 2001. Thu:_, in the summer of

2001 when the Phoenix EC was received, no IRS was assigned to workon Bin

Laden matter,;. Jane pointed to this void as one reason she did not seek

analysis of the Phoenix EC.

In addition, we found that training for analysts at the FBI was ad hoc and

untimely. While special agents were sent to Quantico to the FBI Training

Academy for a 16-week course, IRSs did not receive equiwalent training at

Quantico or elsewhere. IRSs received mostly on-the'job training until they

could attend a CIA or Defense Intelligence Agency course on international

terrorism. For some IRSs, this did not occur _mtil they had been working for a

year or more. In addition, IRSs told us they had to seek training on their own,

and if they changed program areas they also had to find appropriate training in

the new :subject matter. 86

85Some " IR_s left the FBI, while others transferred to other positions within the FBI.

FBI documents show that 10IRSs became IOSs in ITOS, 8 moved te.other positions within

the FBI, and 13 left the FBI. In addition, as discussed above five of the IRSs who became

IOSs were administratively transferred to the UBLU after working on a task force in support

of the embassy bombings case.

86While this section of the report primarily focuses on resource _mdtraining issues for

IRSs, IOSs also were not provided with adequate resources and training.

87
Counterterrorism IRSs also lacked a clear career path. They usually were

supervised and managed by agents, who were not trained about the IRS

position, mission, or work product. Moreover, CIA managers detailed to the

FBI to improve its strategic analytical capabilities told the OIG that in order for

analysts to be taken seriously, they had to hold positions of authority. As an

example, they stated that in the CIA one of the Deputy Directors was an

analyst. 87 According to another CIA manager, the lack of a career path for

IRSs was a clear indication that IRSs were not valued by the FBI.

The result of these deficiencies was a weak and underutiliized analytical

:.. function, which in our view contributed to the lack of attention that the Phoenix

• EC received when it was sent to FBI Headquarter,_.

4, Poor information flow and information sharing

The FBI also has acknowledged that the Phoenix EC contained

information that should have been disseminated and reviewed by other parts of

the FBI and the Intelligence Community. While tlhePhoenix EC did not

contain information that constituted an imminent threat or warning of a

terrorist attack, the FBI should have obtained input from withinLand.outside the

FBI to properly analyze Williams' theory. However, before September 11 the

Phoenix EC was not disseminated widely within or outside of tlheFBI.

..

When Jane received the EC, she decided not:to disseminate it

immediately. She:believed it lacked sufficient factual support to warrant

immediate dissemination, and she said she decided to conduct some initial

: research before deciding whether to invest additional resources on the EC.

Because of her ot]herwork, she did not begin the research prior to

September 11.

Her actions were consistent with the FBI's policies and procedures at the

time. As noted above, IOSs were permitted to exercise discretion in handling

their assignments,, including determining what infi_rmation to s]aare both within

and outside the FBI, without supervisory approval. The FBI provided them no

guidance or requirements on what type of information should be shared, either

87Within the Counterintelligence Program, the highest position held by an analyst was

Section Chief.

88
inside or outside the FBI. This left tothe discretion of the individual analyst

decisions about what to do with intelligence information, such as the Phoenix

EC.

We believe exercise of such significant discretion resulted in a failure to

share important information such as the Phoenix EC. Fundamental to the

effectiveness ,of an intelligence operation is its',ability to co][lectand

disseminate irfformation within and outside the agency. Such information is

needed by operational personnel to inform their investigations or other

operational goals. Moreover, in the analytical process, the more information

that is available about a terrorist organization or a target, the better informed

conclusions and predictions about the likely actions of the person or

organization. Information shouh:l be reviewed, among other things, to

determine what would be useful in other FBI investigations, what other

personnel or offices within the agency should be provided with the

information, what would be useful for other government agencies, what would

be useful and appropriate to disseminate to foreign governraents, and what can

be declassified for use in public alerts.

But information sharing within and outside the FBI's Counterterrorism

Program prior to September 11 was piecemeal and ad hoc rather than

systematic. Several of the CIA managers detailed to the FBI told the OIG that

there was no "information flow" within the FBI. The FBI',; process for

disseminating informationwas to route information primarily to IOSs, who

then used their own judgment and experience todecide what needed to be

disseminated and to whom. As discussed above, IOSs were operating with a

"triage" approach to their workload. They had to identify what information

was the most significant and deal with the crises or problems as they arose. As

a result, information that did not demand immediate attention or did not relate

to a crisis tool.(significant time to be addressed, if it was addressed at all.

The CIA managers we interviewed asserted that an intelligence agency

must set priorities to identify what its information needs and intelligence gaps

are. They said that once priorities and intelligence gaps are:identified,

decisions can be made about what information should be collected and who

should receiw: the information. They explained that these decisions should

I;1_ " ,._ ,, then be communicated throughout the agency as requlrem,_nts.

89
Several of tlae CIA managers also noted that:the FBI lacked any priorities

or requirements for the dissemination of information once it was collected. For

example, there was no guidance concerning what types of infoirnation were

required to be disseminated or included in reports to other intelligence

agencies. Moreover, there were no requirements that certain types of

information be routed to analysts or that analysts be copied on particular kinds

of communications. IOSs simply shared or disseminated the il_Lformationthey

believed needed to be shared based primarily on tlaeir prior experience, ss

IOSs we interviewed told the OIG that they spent a majority of their time

preparing documentation for requests for FISAwarrants. They also were

responsible for providing advice and assistance to the field offices in

connection with ongoing investigations and with responding to threats of -

terrorist acts. They also had to obtain resources to support investigations, such

as arranging for translators or preparing documentation for re-allocation of

money. They nee,ded to respond to requests to check telephone', numbers,

names, and other identifying information about targets of investigations in FBI

and CIA databases. While the IOSs acknowledged that collectiion and

dissemination of].ntelligence information was one of their responsibilities, they

stated that as a job function it was not a priority before September 11.

Several lOSs stated thatit was impossible for IOSs to be aware of and

.disseminate every piece of information generated by every lead because of the

demands of the other responsibilities of their jobs. As a result, they said that

they hadto focus on the most significant information that was generated from

•important cases or credible threats. Jane, other IOSs, and special agents told us

that the type of intelligence information that received immediate attention was

that generated from explicit threats of an attack or other terrori,;t act,

information that a terrorist who was in custody was being brought to the United

States, or intellig(mce intercepts by another agency that led to a.name and

phone number in the United States of a target. Other information was handled

if there was time.

88We also discuss the FBI's lack of policies and procedures for information sharing in

our December 2003 OIG audit report, "The Federal Bureau of Investigation's Efforts to

Improve the sharing of Intelligence and Other Information" (December 2003) at 19-20.

90
By contrast, according to tlheCIA personnel, the dissemination of

intelligence information requires full-time personnel trained solely for that

' purpose. In the CIA, dissemination of intelligence information is handled by

"reports officers" who are professional employees trained in analysis and

information collection and dissemination.

It also was clear in our review of the Phoenix EC that the FBI's

procedures for disseminating information internally were cumbersome. At the

FBI, many layers of review were required to distribute an EC to multiple:field

offices. Disseminating an EC to all FBI field offices required approval from

several supervisors and managers, including the FBI Director. Several _

witnesses stated that the review and approval process normally took several

weeks to complete. The CIA employees detailed to the FBI to improve the

analytical program who we interviewed told the OIG that they found the'_

process for completing an EC was "difficult" and "hard." _

We believe that the Phoenix EC should 7havebeen shared with the

Intelligence Community or parts of the Intelligence Community for their input

and analysis. While Williams had advanced only a theory, and there needed to

be more analysis of the recommendations before they were adopted, the EC

should have beenpresented to others in the FBI and the Intelligence .

Community fi?rtheir information and analyse,;. The fact that it was not

disseminated :reflected the longstanding problem within the FBI of information

sharing being ad hoc and piecemeal. Rather than relying on the judgment of

IOSs about What information should be disseminated as'they juggle their other

job duties, the FBI should have a system in place to guide, iidentify, and

prioritize the ]kindsof information that needto be shared.

5. General complaints about the difficulties of working in ITOS

We also heard consistently from witnesses in ITOS that working there

before September 11 was extremely chaotic and difficult. 'They complained

that all aspects of their jobs - from putting FISA packages l:ogether to

disseminating intelligence to sending out ECs to the field- were hampered by

the lack of resources and poor technology.

IOSs, agents, and managers uniformly told the OIG that IOSs did not

have sufficient time to handle the workload in ITOS, and that because of the

lack of resources in ITOS and the demands of operational matters in the

91
section, they worked extremely long hours on a regular basis, including nights

and weekends. They described being overwhelmed with work, including

intelligence information that needed to be disseminated. For example, they

said that hundreds of leads could be generated by any one case.. They stated

that the demands of a particular case or aparticular threat sometimes consumed

all of their time and attention for several days or even weeks. As previously

discussed, they were operating with a "triage" approach to their workload in

which they dealt with crises or priority problems as they arose. We found that

as a result,-issues that they considered to be non-priority matters, such as the

Phoenix EC, often were placed on the backburner.

FBI and CIA witnesses also uniformly complained that the FBI's _

computer system- ACS - impeded the flow of information. As we have i

discussed in several other OIG reports, ACS is a very cumbersome and non- ....

user, friendly system that discourages its use. s9 To disseminate information . .

within the FBI was not simply a matter of forwarding an electronic document .

in a point and click e-mail environment. Rather, an IOS would have to prepare,

an EC, which required accessing several different screens in ACS to complete

and then upload tlhe gc. 9° In addition, witnesses complained that ACS

especially hampered the flow of information because it was not a system

designed to "push" information out to the user. Instead, the user laad to know

that information , , e,xisted in order to find it. As discussed above, this resulted in

the Phoenix EC not being reviewed by the appropriate individuals, even when

their names were on the attention line.

89See, e.g., OIG reports entitled, "The Federal Bureau of Investigation's

Implementation of Information Technology Recommendations," (September 2003); "FBI's

Management of Information Technology Investments" (December 2002); "An Investigation

of the Belated Production of Documents in the Oklahoma City Bombing Case" (March

2002); and "The Handling of FBI Intelligence Information Related to the Justice

Department's Campaign Finance Investigation" (July 1999).

9oAlso, as stated above, ECs that were addressed to all field officesrequired several

layers of management approval, which also slowed down llhe process.

92
B. Indiividual performance

We now mm to the actions of the individuals who were involved with the

Phoenix EC. While the systemic problems hampered FBI employees in

handling information such as the Phoenix EC, and explained to some extent the

reasons that FBI employees did not adequately respond to it, these systemic

problems do not explain all the deficiencies we found in the handling of the

Phoenix EC. While we do not believe that anyone involvect with the Phoenix

EC at FBI Headquarters committed misconduct, we believe that some of them

made errdrs in judgment with respect to some of their actions on the Phoenix

EC.

1. Kenneth Williams

First, we believe that Williams should be commended for his initiative

and for his attempts to apply broad analytical thinking to his casework. _He

prepared the Phoenix EC based on his experience, intuition, and expertise, and

he sought assistance through the proper channels at FBI Headquarters in

pursuing his theory. It was FBI ]Headquarters" responsibility- not a field

office's responsibility- to decide what strategic analysis was needed to address

the issues Williams raised and to ensure that appropriate attention was directed

to the analysis of those issues. Williams deserves praise for, in the midst of

handling cases in the field, discerning a pattern that he thought warranted

review and seeking to bring that to the attention of others in the FBI.

2. FBI Headquarters

a. Jane

Jane's decision not to refer the Phoenix EC to the IS[) and instead to

conduct the necessary research herself did not violate any FBI policies and

procedures at the time. Leads could be assigned and handled without

supervisory input, and much was left to IOSs' discretion and judgment about

how assignments were handled and prioritized.

However, we question Jane's decision not to refer the.,Phoenix EC to the

ISD for analysis. While the FBI's strategic analytical capabilities were

extremely limited, as we have described abow_ in detail, and no IRS was

specifically assigned to Bin Laden matters, Jane could have, and should have,

referred the Phoenix EC to the ISD for analys!is. By all accounts, Jane was

93
hard working and conscientious. But the press of other work prevented her

from addressing t:hePhoenix EC sufficiently. While she said that she did not

think that the ISD could do what was necessary to analyze the Phoenix EC

because noIRS was specifically assigned to Bin Laden matters, she could have

raised the problem to her supervisor's attention in an attempt to have resources

assigned to analyze the Phoenix EC. Instead, she kept the Phoenix EC to

herself, hoping to get to it when time allowed. But she did not have time for it.

We believe that, even if she intended to conduct research on it when time

permitted, she should have provided it to members of the Intelligence

Community for their input on the theories and recommendations it advanced.

b. Ellen

Ellen recognized that the Phoenix EC pertained more to t]heUBLU than _

the RFU, and she appropriately discussed it with Jane and had the matter

reassigned to her. She also noted in the disposition field of ACS how the lead

was being handled. Ellen closed the lead, but rather than closing the lead, she

should have reassignedthe lead to Jane. While this was not inconsistent with

how leads were handled in ITOS, given the pressm-e to close leads in the

system, it misrepresented the status of the lead since the necessary research had

not yet been completed.

c. Rob

We believe that Jane's supervisor- Rob- should have recognized that

t,._

the requests in the Phoenix EC were not typical requests for op_ratlonal

support in the field and should have directed the matter to the ISD. Although

we recognize that the FBI left much to the discretion and judgment of IOSs

about how they handled their work, it was Rob's responsibility as a supervisor

to ensure that Jane was handling requests appropriately. Jane briefly

mentioned the Phoenix EC to Rob, but said he did not review it, and we do not

believe he sought to ensure that it received adequate attention. We believe that

Rob should have been more actively involved in Jane's handling of the

Phoenix EC. If he had decided that resources did not exist to address the EC

for several months, we believe that he should have brought the matter to the

attention of his section chief.

94
3 o Lynn _

Jane sent the EC to Lynn, the IRS who works counterterrorism matters in

a field office that had had an inw:stigation of Subject No. 2, witha note that

read, "I thought it would be interesting to you considering some of the stuff

you were coming up with in [your field office]. Let me know ifanything

strikes you." Jane did not call Lynn to discuss the Phoenix EC prior to sending

Lynn the e-mail, and Lynn was not assigned a lead with respect to the Phoenix

EC. Lynn read the Phoenix EC, but did not respond to Jane's e-mail, and Jane

did not otherwise contact her about the Phoenix EC.

As discussed above, Lynn ]hadseveral years earlier worked on an

investigation in which Subject No. 2 had been central, and Subject No. 2's

name had resurfaced in June of 2,001when two individuals were detained in

Bahrain who admitted to being al Qaeda operatives and pos_sesseda passport

containing the',same last name as Subject No. :2and a previous address of

Subject No. 2. Lynn told the OIG that after Subject No. 2's name resurfaced,

atthe request of Jane she researched their associates from when they had lived

nearbyl Lynn told the OIG thatshe believed Jane had sent iherthe Phoenix EC

because Subject No. 2 was mentioned in the EC. Lynn explained that because

the information inthe EC about Subject No. 2 did not impact what she was

working on and because she was not aware of any information that supported

Williams' theory, she did not respond to the e-mail.

Lynn was not required to respond to the e-mail by any formal FBI policy.

Her actions were consistent with others in the FBI, who did not address an

issue unless a lead was assigned to them. But webelieve that Jane's request

for Lynn to let her know if anything struck her warranted some response, even

if the response was that Lynn hat] nothing to support the theory espoused in the

Phoenix EC. Instead, Lynn did nothing in response to the e-mail. A response

from Lynn may have caused Jane to takesome other step, to seek further input

from someone else, or to alert Phoenix of the status. Instead, Lynn did not

communicate with Jane, and the Phoenix EC languished.

4. Jay

Jay, an agent on the Bin Laden squad in the FBI's New York Field

Office, received and read the Phoenix EC. He told the OIG that he was not

aware of any reformation that supported the theory in the EC, and he therefore

95
did not respond to it, either in writing or by contacting anyone JLnthe Phoenix

office. He also stated that he would ihave "taken 1._sue ,_ " with the conclusions if

he had responded.. Jay was not required to respond to the Phoenix EC, and he

did not violate any FBI policies and procedures by not respondiLng.

Yet, although Jay was not required to respond to the lead set for the New

York Field Office in the Phoenix EC, Williams had asked for analysis and

comments on his !proposal in the text of the EC. Since Jay told us he felt

strongly that the tlheory in the Phoenix EC was noelsupported b7 the facts, we

believe he should have contacted Williams or someone in FBI Headquarters to

discuss the EC to provide his view, given the expertise of the New York office

on issues involving Bin Laden. But given the disorganization and convoluted

way.that leads were assigned, and the prevailing practice not to respond to

leadS that were not specifically assigned to an agent, it is not surprising that Jay

did not respond.

.... 5' FBI management

Finally, we believe it important to state that the failings in this case go

well beyond any failings of those individuals who came in contact with the

Phoenix EC. In our view, the failings were caused in much larger part by the

FBI's inadequateand inefficient system for analyzing intelligence information,

and the lack of attention paid by many levels of FBI managers 1:ostrategic

analysis. This was the responsibility of many FBI managers and employees,

from the top down, over many years. We believe that the FBI's lack of focus

on strategic analysis and its failure to provide sufficient resources and priority

to analysis were problems attributable to the FBI and many FB][senior

managers. While some of the individuals who handled the Phoenix EC did not

do all they should have to address it in a timely way, the larger and more

important failure was the way the FBI handled intelligence ana][ysisfor many

years before the September 11 attacks.

C. Other pieces of intelligence concerning airplanes as weapons

96
The FBI

conducted searches in its computer systems for references to "flight schools,"

"airplanes," "hijackings" and other related terms in an attempt to collect

information that the Joint Inquiry Committee Staffhad indicated it was

interested in reviewing but had not specifically requested. The FBI collected

the document,; retrieved in its electronic searches and provided them to the

Joint Inquiry Committee Staff and also to the OIG.

We reviewed the information provided by the FBI that referenced a

connection between airplanes or flight schools', and persons of interest to.the

FBI. The information was from as early as 1983, although most of it was,from

1998 and 199!;). Below we briefly describe four of the pieces of information

that are repres, entative of the kinds of information contained in FBI filesabout

airplanes and flight schools at the time the Phoenix EC was received at FBI

Headquarters: .-

• The FBI received an intelligence repor"c in mid-1999 stating that the

leadership of a terrorist organization other than A1 Qaeda had met and

_-planned to use students in theUnited States to gather intelligence on

, infrastructure facilities and public places frequented by Jews. It was

also reported that students also would be selected to participate in ,

terrorist training camps

. • ..

It was reported further that the

leadership of the terrorist organization viewed this requirement as

being "particularly important" and were believed to have approved an

open-ended amount of ftmding to ensure its success. 91

- In August 1998, an intelligence agency advised the FBI's New York

Division of an alleged plan by unidentified Arabs to fly an explosive

91The FBI ]latersaid that in 2002, in connection with the JICI Review, it researched this

issue and concluded that the information reported was.likely a fabrication.

97 J
laden aircraft from Libya into the World Trade Center. The New York

Division sent out leads in an attempt to obtain more infbrmation about

the source of the reporting.

• On May 18, 1998, a Special Agent on theFBI's Oklahoma City

Division's counterterrorism squad prepared an EC documenting his

contact with an agent from that Division's; surveillance squad, who also

wasthe Division's chief pilot. In the EC, the agent noted that the

Division pilot had observed "large numbers of Middle Eastern males

receiving flight training at Oklahoma airports in recent months." The

agent also reported that the pilot speculated that light planes would be

an ideal means of spreading chemical or biological agents.

• In January 1995, Philippine authorities responded to a small fire and

several explosions in an apartment in Manila. Inside the apartment,

authorities discovered bomb-making equipment and telxorist literature.

The resulting investigation revealed a plot to place explosive devices in

12 American passenger aircraft. As a result of the FBI's investigation

into this matter, Abdul Murad, Wali Shah, and Ramzi Yousef were

subsequently indicted and convicted in the United States for their

involvement in the conspiracy. Yousef later was convicted on

Novembe,r 13, 1997, for his involvement Jinthe bombil_Lgof the World

Trade Center on February 23, 1993.

During investigative interviews, Murad described general

conversations with Yousef in which they .discussed the potential use of

aircraft to commit terrorist acts. According to Murad, he discussed

with Yousef the ease with which a pilot could conduct a suicide attack

by crashing an explosive-laden aircraft into a building. Murad

mentioned CIA Headquarters as a potential target. Murad contended in

investigative interviews that there was no specific planning in relation

to any of these acts. Murad also described other general conversations

with Yousef concerning potential non-aircraft related terrorist acts,

such as bombing a nuclear facility, utilizing poison gas, and bombing

the World Trade Center a second time.

As discussed above, the FBI conducted little strategic analysis before

September 11, and it never attempted to connect _myof these disparate pieces

of information. For this reason, these pieces of information and all of the other

98
information in the FBI's possession that might have been used to analyze the

use of airplanes and civil _tviation for terrorist purposes was; never considered

systematically or analytically.

D. Conclusion

In sum, our examination of the FBI's handling of the Phoenix EC found

that the individuals who handled it did not violate FBI policies and practices at

the time, but they did not do all they could have, and should have, to respond to

it or the recommendations in it. They should have sought input from others in

the FBI, assured that the EC received the necessary analysis, and also sought

input from the,Intelligence Community about the theories and suggestions

contained in it.

But we believe that their actions were not surprising, :giventhat the

policies and practices under which they operated were extremely flawed. We

found that IOSs were not properly managed and that supervisors should have

been more actively involved in the work assigned to IOSs. In addition, as an

institution, the FBI was focused on its operational priorities at the expense of

conducting strategic analysis. Furthermore, the FBItacked a systematic

approach to information sharing and lacked adequate tools _Iofacilitate such

•information sharing both within and outside the FBI. As a result of these

systemic failures, the FBI did not give the Phoenix EC the consideration that it

deserved.

We cannot know for certain what the FBI would have: concluded prior to

September 11 if the FBI had applied strategic analysis to the theory posed by

the Phoenix EC or what information may have,'been uncovered in support of

•the theory if the Phoenix EC had been shared 'with the Intelligence Community

or within the FBI. We also cannot know what role, if any, the pieces of other

information described above would have played in the analysis of this question.

What we do know is that the FBI was not adequately analyzing information for

the purpose of drawing conclusions and making predictions. This was a

significant intelligence failure, which hindered the chances of the FBI being

able to detect and prevent the September 11 attacks.

99

J

Chapter Four has been redacted.

(Pages 101-214)
CHAPTER FIVE

TWO SEPTEMBER 11 HIJACKERS: KHALID

AL-MIHDHAR AND NAWAF AL-HAZMI

I. _ntroduction

In this chapter, we examine the FBI's handling of intelligence

information concerning two of the September 11 hijackers, Khalid al-Mihdhar

and Nawaf al-Hazmi. Mihdhar, Hazmi, and three other terrorists hijacked and

crashed American Airlines Flight 77 into the Pentagon.

The FBI has asserted that it learned in late August 2001 that Mihdhar and

Hazmi were al Qaeda operatives and that they had traveled to the United States

in January 2000. In August 2001, the FBI also discovered that Mihdhar had

entered the United States on July 4, 2001, puq_ortedly for a month-long stay.

In late August, the FBI initiated an investigation to determine whether Mihdhar

was still in the country and to find him. The FBI was still searching for him at

the time of the September 11 attacks.

We examined the information that the Intelligence Community and the

FBI had aboulLMihdhar andHazmi prior to September 11. We found no

evidence indicating the FBI or any other member of the Intelligence

Community had specific intelligence regarding the September 11 plot.

However, beginning in late 1999 and continuing through September 11,2001,

we found five junctures at which the FBI eithe,r learned of intelligence

information about Mihdhar and ttazmi, could have learned of additional

intelligence information about them, or could ihave developed additional

information about their location and terrorist connections. These five junctures

were"

)

Q.

The CIA also discovered in March 2000

that Hazmi had traveled to Los Angeles in January 2000.

215
• In late January 2000, Mihdhar and Hazmi both trave,led to Los

Angeles and then moved to San Diego, where they associated with a

former' subject of an FBI investigation and also lived with a longtime FBI asset. TM

_In late December 2000 and early January 2001, a reliable joint

FBI/CIA source provided information related to the FBI's ongoing

investigation of the attack on the U.S.X Cole. 152

• In the ,summer of 2001, the CIA and the FBI had various

interactions regarding the FBI's investJigation of the Cole attack.

These interactions touched on the participants in the January 2000

Malaysia meetings and information developed by the CIA about the

Malaysia meetings.

• In August 2001, the FBI learned that Mihdhar had entered the

United States on July 4 and began searching for him in early

September 2001.

The FBI did not locate him before the September 11

attacks.

Yet, despite these ongoing discussions and opportunities for the FBI to

learn about and focus on Mihdhar and Hazmi, including their presence in the

United States, the: FBI was not made aware of and did not conntect important

details about them until late August 2001, a short time before they participated

in the terrorist attacks. Even in August, the FBI's search for Mihdhar and

Hazmi was not given any urgency or priority, and was not close to locating

them by the time of the attacks.

.

15_Hazmi had also traveled to and attended the January 2000 meetings in Kuala

Lumpur, Malaysia.

152As noted previously, on October 12, 2000, two terrorist operative,;in an explosiveladen boat committed a suicide attack on the U.S.S. Cole naval destroyer ,:lutinga brief

refueling stop at the port in Aden, Yemen. Seventeen sailors were killed and 39 were

wounded in the attack.

216
In this chapter, we describe each of these five oppommities in detail. We

set forth the available intelligence information regarding Hazmi and Mihdhar

that existed at the time, whether the information was made .available to the FBI,

and what additional information about Hazmi and Mihdhar the FBI could have

deyeloped. In the analysis section of this chapter, we evaluate the problems

that impeded the FBI's handling of the intelligence information about Hazmi

and Mihdhar before September_ 11.

II. Background

A. OIG investigation

To investigate the issues involving Hazmi and Mihdhar, the OIG asked

for and reviewed all documents the FBI had regarding them before

September 11. The FBI search for these documents included searches of its

Automated Case Support system (ACS), Integrated Intelligence Information

Application (IliA) system, 153and. CTLink. _54 In addition, searches were

conducted on archived FBI e-mail messages and the FBI Director's briefing

documents. These searches were initially conducted in response to a request

by the Congressional Joint Intelligence Committee's Inquiry Staff, which, was

conducting its',own inquiry into this subject. The OIG also obtained direct

access to ACS so that we could conduct our own searches tor relevant

documents. In addition, we reviewed hard copy case and informant files to

search for documents relevant to Mihdhar and Hazmi.

In addition to reviewing 'these documents, we conducted more than 70

interviews related to the Mihdhar and Hazmi matter. These, included

interviews of FBI lOSs, special agents, attorneys, and supervisors who had

access to some of the relevant information or participated in meetings or

153IIIA is a database designed to capture comprehensive amounts of information from

counterintelligence, international, and domestic terrorism investigations. The system

includes information ranging from biographical data on persons to profiles of terrorist

groups. The FBI describes the system as "conducive to putting together information

regardless of office of origin or case."

154CTLink is a shared database used for the dissemination of intelligence information

among agencies within the Intelligence Community.

217
operations related[ to these hijackers. We also interviewed FBI employees

detailed to the CIA and FBI agents who participated in debriefings of

intelligence sources who had relevant information.

Because mulch of the information discussed in this chapter of the report

involves the FBI's interactions with the CIA, we also obtained information

directly from the CIA. The DOJ OIG does not have oversight authority over

CIA operations or personnel, and we therefore did not make assessments of the

performance of CIA personnel. That issue is the responsibility of the CIA

OIG, which is conducting its own inquiry in response to the JICI report. We

had to rely on the cooperation of the CIA in providing access to CIA wimesses

and documents that were relevant to the OIG's oversight of the FBI.

..... We interviewed CIA staff operations officers, analysts, and supervisors,

as well as CIA employees detailed to the FBI, inc][uding a CIA employee

detailed to the FBI's New York Field Office's Joint Terrorism Task Force. (S)

Initially, the CIA made available to the OIG for review warious

documents that the CIA's "Director of Central Intelligence (DCI) Review

• Group' '_55.had identified as being relatedto our 'inquiry. The Review Group

had gathered:these and other documents during its;review of the September 11

attacks and during additional searches conducted at the request of the JICI

• staff. We did not have independent access to CIA databases, and therefore we

could not independently verify that all relevant documents had been provided

to us. However, we had several lengthy sessions with members of the Review,,

Group at which they identified the documents they used to support their

conclusions regarding Hazmi and Mihdhar. The CIApermitted usto review

but not have a copy of these documents.

• In addition, a member of the CIA General Counsel's staff conducted

additional searches for documents relevant to particular disputed issues. As a

result of that review, copies of additional relevant documents were also made

available for our review.

155The CIA formed the DCI Review Group in late 2001 to assist the CIA in"

determining why it had not detected the September 11 plot. The group included former CIA

case officers and CIA OIG personnel.

218
In response to the JICI report issued in December 2002, the CIA OIG

initiated a review in February 2003 of the CIA actions related to the

September 11 attacks. In July 2003 the CIA OIG review team informed us it

had several more documents that were relevant to our review. These

documents were made available to us to review, and redacted copies of the

documents were provided to us in November 2003. The CIA OIG review team

also provided additional relevant documents and information to usthat it found

during the course of its review.

In February 2004, however', while we were reviewing, a list of CIA

documents that had been accessed by FBI employees assigned to the CIA, we

noticed the title of a document that appeared to be relevant to this review and

had not been previously disclosed to us. The CIA OIG had not previously

obtained this document in connection with its review. We obtained this __

document, known as a Central Intelligence Report (CIR). This CIR was a draft

document addressed to the FBI containing infi)rmation about Mihdhar's travel

and possession of a U.S. visa. As a result of the discovery of this new

document, a critical document that we later determined had not been sent to the

FBI before the September 11 attacks (see Section III, A, 4 below), we had to

re-interview several FBI and CIA employees _mdobtain additional documents

from the CIA. The belated discovery of this CIA document delayed the

completion of our review.

B, Background on theCIA

In this section of the chapter, we describe background information

relevant to the interactions between the CIA and the FBI and the ways in which

they exchanged intelligence. We begin with a discussion of the CIA's

authority and mission, organization, forms of communications, and ways in

which the CIA passed intelligence to the FBI. We also discuss the role of the

FBI's employees who were "detailed" to work at the CIA.

i. CIAauthority and mission

As discussed in Chapter Two, the National Security Act of 1947 created

the CIA and established it as the nation's lead foreign intelligence agency of

the United States. The CIA engages primarily in the clandestine collection of

"foreign intelligence" information- information relating to the capabilities,

intentions, and activities of foreit_ governments or organizations, including

, 219
information about their international terrorist activities. The CIA is charged

with evaluating and disseminating the intelligence information it collects.

The CIA reports directly to the: President through the Director of Central

Intelligence (DCI), who is the head of both the CIA and the Intelligence

Community. The DCI is the primary advisor to tile President and the National

Security Council on national foreign intelligence matters. George Tenet was

named to that position in 1997.

2. Organization of the CIA

The work of the CIA is conducted primarily through three "directorates":

the Direct0rate of Operations, the Directorate of Intelligence, and the

Directorate of Science and Technology. Each is lied by a Deputy Director.

Below webriefly describe the relevant structure and positions within each

directorate.

a. Directorate of Operations

The Directorate of Operations is responsible for the clandestine

collection Of foreign intelligence. Tlhis takes place in field offices known as

',stations. ''_56Smaller cities may have "bases," whicti are sub-offices of the

stations, "Operations officers," also known as "case officers," are responsible

for collecting intelligence through contacts with human sources and through

the use of technology. Collection management officers, also known as "reports

officers," are responsible for taking raw intelligence reported by the operations

officers and removing from it the information that reveals the source, method

of collection, orother sensitive information. The reports office,rs publish

intelligence information in a form that can be made available to the Intelligence

Community.

The head of a station or base is usually an operations officer and is

knownas a Chief of Station (COS) or Chief of Base (COB). Stations and bases

156The CIA also has field offices within the United Statesthat arepart of the National

Resources Division within the Directorate of Operations. They are responsible for the overt

collection of foreign intelligence vohmteered by individuals and organizations in the

country.

220
are usually grouped by geographic division and report to the chief of the

geographic division at CIA Headquarters. Within the geographic division at

CIA Headquarters are "staff operations officers," or "desk officers," who

provide operational research, advice, and other forms of case management

support to the officers in the field.

The CIA's Counterterrorist Center (CTC), which is based in the

Directorate of Operations but which draws on all CIA resources, is charged

with preempting and disrupting international terrorism. The CTC is staffed by

managers, analysts, operations officers, desk officers, and reports officers. The

CTC collects and analyzes strategic intelligence on terrorist groups and state

- sponsors of terrorism to ascertain the capabilities, sources of support, and

likely targets of terrorist elements, and to furnish detailed information on

terrorist-related intelligence to the Intelligence Community.

At the time of the events relevant to our review, the C,TC operated a unit

- that we call the "Bin Laden Unit" - that dealt exclusively with issues related

to al Qaeda and Usama Bin Laden. The Bin Laden Unit was later merged into

a larger group in the CTC. Although staffing levels fluctuated, approximately ,

. 40-50 people worked within the Bin Laden Unit before September 11,2001.

The.Bin Laden Unit was known as a "virtual station" because it operated from

within CIA Headquarters but collected and operated against a subject, much as

stations in the:field focus on a country.

b. Directorate of Intelligence

• The Directorate of Intelligence, the analytical branch of the CIA, is

responsible for the production and dissemination of timely, accurate, and

• objective intelligence analysis on foreign policy issues. It focuses analysis on

key foreign countries, regional conflicts, and issues such as terrorism and

narcotics trafficking.

The Directorate of Intelligence is primarily composed of analysts who

concentrate on particular areas of expertise. F'or example, intelligence analysts

are assigned a particular geographic region to monitor the leadership,

motivations, plans, and intentions of foreign governments in relation to U.S.

national-security interests. Additionally, counterterrorism analysts stationed in

the CTC produce a range of long-term intelligence products about terrorist

organizations and provide tactical analytic support to intelligence operations.

221
c. Directorate of Science and l_echnology

The Directorate of Science and Technology is responsible for creating

and applying technology in support of the intelligence collection mission. It

employs a broad range of professionals, including computer programmers,

engineers, scientists, and linguists.

3. The CIA's collection and internal dissemination of

information

Official inte,rnal communications between entities within the CIA are

normally conducted by an electronic communication known as a "cable."

Cables areaddressed to the stations, offices, or units within an office from

which some action is expected. Information acceptable for sharing with a

foreign government service is put into a section of a cable called a "tear line."

4. Passing of intelligence informatie, n by the CIA to the FBI

The CIA shares intelligence with the rest of the Intelligel_LCeCommunity

through a communication known as a "TD" ("Telegraphic Dissemination").

TDs can be sent to other Intelligence, Community agencies, including the FBI,

and are available to .the Intelligence Community through the Intelink system.

AnotherJtype of intelligence report used by the CIA when conducting

business with other agencies is a CIR, or "Central Intelligence Report." CIRs

are used for disseminating information to a specific agency or group of

agencies. CIRs tothe FBI normally concern something occurring in the United

States, involving a U.S. person or an ongoing FBI investigation.

In addition lloformal methods of communicating by the CIA to the FBI,

much information can be shared with the FBI informallyl CIA and FBI

employees who have similar positions and expertise develop relationships and

communicate informally while working together on related mal:ters, either by

secure telephones or in person. In addition, meetings are somellimes held to

discuss a matter or a piece of intelligence that is of value to both agencies.

According to the CIA employees we interviewed, when the CIA passed

intelligence infonnation or other kinds of information verbally or by another

informal mechanism to the FBI, the information exchange no_aally would be

documented through a TD or a CIR. However, they said that not every

telephone call or conversation was documented.

222
C. FBI detailees to the CIA CounterterroristCenter

In 1996, the FBI began detailing employees to work in the CIA's CTC.

During the time period relevant to this chapter of the report, five FBI

employees were detailed to the CTC's Usama Bin Laden Unit in four separate

positions. Two of the positions were filled by personnel from the FBI's

Washington Field Office, and one position each was filled :from the FBI's New

York Field Office and FBI Headquarters. 157

/

1. FBI Headquarters detailees

One of the FBI detailees assigned to Bin Laden Unit, who we call "Eric,"

held a supervisory position as a deputy chief of the Bin Laden Unit. 158Eric, an

FBI Headqual_ers supervisor in the Radical Fundamentalist Unit, was detailed

to the CTC as a branch chief for a particular terrorist group in September 1997.

In March 1999, FBI Headquarters transferred him from that part of the CTC to

the deputy chief position in the Bin Laden Unit. According to Eric, he was told

by FBI Assistant Director Neil Gallagher that there were a lot of problems

between the FBI's New York Field Office and the Bin Laden Unit and that he

needed to mend the relationship. 159Eric stated that althOugh he acted as a

liaison between the CIA and the FBI, his primaryjob was to perform

substantive work related to the Bin Laden Unit's mission.

Eric left: the Bin Laden Unit in January 2000 and was replaced in July

2000 by an FBI employee who we call "Craig. ''16° By this time, the Bin Laden

Unit had been placed into a newly formed group, which was a much larger

157Other FBI employees were also detailed to the'CIA during this time. However, the

FBI detailees to the CTC's Bin Laden Unit were the only ones relevant to the issues in this

review.

_58A CIA employee was the other deputy chief in the Bin Laden Unit. Both the FBI

detailee and the CIA employee reported to the chief of the Bin Laden Unit, a CIA employee.

159Eric told.the OIGthat when he arrived at Bin Laden Unit, he "walked into a buzz

saw" and there was a great deal of animusfrom CIA employees toward the FBI detailees.

Eric said this experience was vastly different from his tenure in another CTC section, where

he was readily accepted and integrated into the CIA's operations.

160No one filled the deputy chief position between January 2000 and July 2000.

223
organization than the Bin Laden Unit. Craig was designated as a deputy chief

in the new, larger group. He described his primary job as being a "referent" for

law enforcement :issues. He explained this role as involving coordination

between the FBI and CIA when they wanted to c-onduct joint interviews or

when the CIA requested assistance with a law enforcement ma_Lter.

Eric and Craig had access via computers,on their desks to the CIA's

internal cables. Eric said that while he was at the CIA, he attempted to read all

incoming Bin Laden Unit cables. However, he said that the amount of cable

traffic was overwhelming and was too much for one individual to read

consistently. In contrast, Craig told the OIG that lhe did not believe his job was

to read all the cable traffic and that he did not even attempt to do so. ., . ,

•2. Washington Field Office detailees

Another FBI employee detailed to the Bin Laden Unit, an Intelligence

Operations Specialist (IOS) who we call "Mary," wasassigned to CIA

Headquarters from the FBI's Washington Field Office in April 1998. Although

she was assigned to work on issues of mutual interest to the FBI and the CIA,

such:as the East African embassy bombings, 161she also was assigned to work

on unilateral CTC matters. She said that as a desk officer, she read and

responded to cable traffic that was pertinent to the matters she 'was assigned.

She nominally reported to a supervisor in the FBI's Washington Field Office,

but her work was assigned by her CTC supervisors at the Bin Laden Unit.! 62

The Washington Field Office also detailed to the CTC a ,;pecial agent,

who we call "Dwight." His performance evaluations were done by the

Washington Field Office, but his assignments came from CTC managers. He

focused on the financial aspects of terrorism and obtained infon'nation through

the CTC to help identify and investigate persons who were responsible for

161On August 7, 1998, nearly simultaneous vehicle bombs were detonated at the U.S.

embassies in Nairobi, Kenya, and Dares Salaam, Tanzania, killing over 2:00people and

injuring over 4,000.

162Her position was later transferred from the Washington Field Office to FBI

Headquarters' Usama Bin Laden Unit.

224

t
funding terrorism. He had access to CIA cables and reviewed them for

potential leads or other iriformation related to terrorist financing.

3. New York Field Office detailee

An FBI New York Field Office agent from its Bin Laden squad, who we

call "Malcolm," was also detailed to the CIA's Bin Laden Unit in early 1999 at

the request of"John O'Neill, the New York FMd Office Special Agent in

Charge for Counterterrorism at the time. Malcolm replace(] another New York

Field Office Bin Laden squad agent who had left the CIA's Bin Laden Unit in

August 1998. Malcolm told the OIG that he was not given instructions as to

_ his specific duties at the CIA. He said he understood his jeb there was to be

the "eyes and ears" of the New York Field Office and "to monitor" New York

Field Office cases. He said his role was to "facilitate inquiries of mutual

interest" and to act as a liaison for FBI offices',around the country by following

up on tracing requests and reporting on their status' He stated that he also

, spent a significant amount of time coordinating with the CTC in preparation for

and during the trials that arose out of the FBI's investigations into the East

African Embassy bombings. He told the OIG that he did not review all cables;

he reviewed only the cables that he thought Were interesting, generally based

solely on his review of the cable subject line. He said he reported to an SSA in

the New York Field Office, not to anyone at tlheCIA.

llI, Factual chronology regarding Hazmi _tndMihdhar

In this section of the report, we discuss iindetail the f_ivejunctures before

September 11,2001, during which the FBI had an opportunity to obtain or

develop information about Mihdhar and Hazmi but did not. We describe in

chronological order the sequence of events regarding these five opportunities,

including the information that the FBI obtained or could have obtained about

Hazmi and Mihdhar.

Many of the witnesses told the OIG they did not have:specific

recollection of the events and conversations related to the Itazmi and Mihdhar

matter. In addition, we found few notes and documents relating to these events

and conversations. The following is our best reconstruction of the events based

on the participants' recollections', and the existing documentary evidence.

225
We show a timeline of the Hazmi and Mihdhar events described in this

chapter on the next two pageg Of the report.

A. Identification in January 2000 of Hazmi and Mihdhar as al

Qaeda operatives

This section describes the initial development and dissemination of

intelligence information concerning Hazmi and Mihdhar. lill_

__ The intelligence led to a

surveillance operation in Malaysia in which it was discovered that Mihdhar,had

a valid multiple-entry U.S. visa and photographs of Mihdhar meeting with

other al Qaeda operatives were taken.

There were several ways the FBI could have acquired this information

from the CIA - through a CIR from the CIA to the FBI, informally through

conversations between a CIA employee and FBI Headquarters employees, and

through the FBI employees detailed to the CIA reviewing the CIA cable traffic.

We reviewed whei_her this information was in fact passed tothe FBI by the

CIA, and based on the evidence, concluded that while the CIA passed some of

the information about Mihdhar to the FBI, it did not contemporaneously pass

the information about Mihdhar's U.S. visa to the FBI. We con,zluded it was

not disclosed by the CIA until late August 2001, shortly before the September

11 terrorist attacks. We also reviewed whether FBI detailees to the CIA

contemporaneously acquired this infbrmation and what action, if any, they took

with respect to this information.

226

/


i

In addition, the CIA learned in March 2000 that Hazmi had boarded a

United Airlines flight in Bangkok, Thailand, bound for Los Angeles,

California, on January 15, 2000.163 We also re,viewed whet!her the FBI was

informed of this information, and concluded that it did not learn about this

information until August 2001.

1. Background

In late 1999, the Intelligence Communi_ developed significant

intelligence information regarding Hazmi and Mihdhar. At this time, the

Intelligence Community was on high alert because of concerns involving

possible terrorist activity planned in conjunction with the coming of the new

Millennium. In addition to concerns about attacks at New "gear's Eve

celebrations, the Intelligence Community was concerned that a terrorist attack

was planned fbr January 3, 2000, which in the_Islamic calendar is considered a

"night of destiny. ''_64There were additional concerns about potential terrorist

attacks coinciding with the end of Ramadan, around January 6, 2000.165

Several of these planned attacks were uncovered in December 1999. For

example, on December 1, 1999, in Jordan, a pilot to disrupt New Year activities

with explosives designed to kill thousands of revelers, including U.S. citizens,

was uncovered and thwarted with the arrest of"16 people. On December 14,

1999, Ahmad Ressam was stopped at the United States/Canadian border in

Washington state as he attempted to enter the United States in a vehicle loaded

with explosiw_s. It was determined later that he had intended to detonate the

explosives at the Los Angeles airport.

To be prepared for possible terrorist activity at the end of 1999, the FBI

activated its Strategic Information Operations Center (SIOC). The SIOC is

J

163Mihdhar was also on the same flight, but that :fact apparently was not known within

the Intelligence Community until much later, in August 2001. t164During the course of the Cole bombing investigation, it was learned that an attack

also had been planned against the U.S.S. The Sullivans in Aden, Yemen, on the same date.

That attack failed because the attack boat sank before reaching its target.

165Ramadan is the ninth month of the Islamic calendar. Ramadan begins when

authorities in Saudi Arabia sight the new moon of the ninth month.

/

229
located in a secure area within FBI Headquarters _mdcontains ,;everal meeting

rooms, conferencing equipment, communications equipment, computers, and

other operational equipment. It allows the FBI to manage major investigations

or other significant operations 24 hours a day, 7 days a week.

During the Millennium period, the FBI operated its International

Terrorism Operations Section from within the SIOC. In addition, the FBI

detailed field supervisors with counterterrorism experience and other

counterterrorism personnel to the SIOC for around-the-clock monitoring and

response to possible terrorist activities.

At the CIA, additional personnel were called in to work at the CTC and

planned leave was canceled. In addition, personnel from the CIA and other

Intelligence Corrrmunity agencies were detailed to work in the FBI's SIOC.

During this period, personnel in the FBI's SIOC prepared two daily

briefings for the FBI Director and his executive staff, one at 7:130a.m. and the

other at 4:30 p.m. The daily briefings contained summaries of significant

terrorism investigations and the latest intelligence related to counterterrorism.

Accompanying the briefings were daily threat updates prepared each afternoon

for the Director and his executive staff. The briefings and the threat updates

were prepared by various people throughout the course of the day andnight in

the SIOC.

2. NSA provides intelligence regarding planned travel by al

Qaeda operatives to Malaysia

_l_le

communications indicated that several members of an "operationalcadre" were

planning to trave]l to Kuala Lumpur, Malaysia, in early January 2000. Analysis

of the communications revealed that persons named Nawaf, Khalid and Salem

were involved. In early 2000, the NSA analyzed what appeared to be related

communications concerning a "Khalid. ''166

166The NSA had additional information in its database further identifying "Nawaf' as

Nawaf al-Hazmi, a friend of Khalid. However, the NSA informed the OIG that it was not

(continued)

230
The NSA's reporting about: these communications was sent, among other

places, to FBI Headquarters, the FBI's Washington and New York Field

Offices, and the CIA's CTC. At the FBI, this information appeared in the daily

threat update 1:othe Director on January 4, 2000.

3. Mihdhar's travel and discovery of his U.S,, visa

A CIA desk officer working in the Bin [,aden Unit who we call

"Michelle" determined that there were links between these people and A1

Qaeda as well as the 1998 East African embassy bombings. In addition, the

CIA identified "Khalid" as Khalid al-Mihdhar.

..

Mihdhar arrived __, on January 5, 2000.

Mihdhar was traveling on a Saudi passport. This passport contained a valid

U.S. visa. Mihdhar's passport was photocopied and sent to CIA Headquarters.

• SeVeral _CIA cables contemporaneously .discussed Mfhdhar's travel and

the discovery of his U.S. visa in his Saudi passport. CIA records show that a

CIA employee, who we call "James ''167and wlho was detailed to FBI

Headquarters during the Millennium period, accessed one of these cables

approximately two hours after it was disseminated in the morning, and he

accessed another of the cables about eight hours after it was disseminated on

the next morning. James discussed some information about Mihdhar with two

FBI Headquarters employees on the evening of January 5, which we detail in

Section 7 below.

4. CIR is drafted to pass Mihdhar's visa information to the FBI

Dwight., the special agent detailed to the CIA's Bin Laden Unit from the

FBI's Washington Field Office, also read the ,cables discus:_ing Mihdhar's U.S.

visa within hours of each cable being disseminated. CIA records also show

(continued)

asked to conduct research on these individuals at that time, and it did not uncover that

information on Hazmi. It was thought at the time that Salem might be Hazmi's younger

brother, and this was later confirmed.

_67The CIA has asked the OIGnot to identify the true names of CIA employees for

operational reasons.

231
that Dwight's immediate supervisor in the Bin Laden Unit opened one of the

cables soon after Dwight.

Dwight opened one of the cables, which reported that Mihdhar's visa

application had been verified and that he had listed New York as his intended

destination.

Around 9:30 a.m. on the same morning, Dwight began drafting in the

CIA's computer system a CIR addressed to the UBL Unit Chief at FBI

Headquarters and an SSA in the UBL Unit at FBI Headquarters who we call

"Bob." Dwight's CIR also was addressed to the FBI's NewYork Field Office.

The CIR first described the NSA information that had been received about

Mihdhar, including the planned travel to Kuala Lumpur, Malaysia in early

January. The CIR also discussed the potential links between the suspected

terrorist facility in the Middle East and the 1998 East Africa embassy

bombings. The CIR stated that photographs of Mihdhar had been obtained and

wouldbe sent to the FBI under separate cover. The CIR detailed Mihdhar's

passport and visa information, including that Mihclhar had listed on his visa

application his intended destination as New York and that he planned to stay

three months. Dwight also wrote that the CTC was requesting "feedback" on

"any intelligence uncovered in FBI's investigation" resulting from the

information in the CIR.

Michelle, the Bin Laden Unit desk officer who originally had taken

notice of the infomaation about Mihdhar and his connections to A1 Qaeda,

accessed Dwight's draft CIR less than an hour after Dwight drafted it at

approximately 9:!30a.m. Around 4:00 p.m. on the same day, Michelle added a

note to the CIR in the CIA's computer system: "pls hold off on CIR for now

per [the CIA Deputy Chief of Bin Laden Unit]."

CIA records show that the same morning, the CIA Deputy Chief of Bin

Laden Unit, who we will call "John," also had read the cable indicating that

Mihdhar!s visa was valid and that New York had been listed as his intended

destination. Around 6:30 p.m. on the same day, J,ohn again accessed this cable

and then another ,cable, the same two CIA cables about Hazmi :andMihdhar in

232
the CIA's computer system that Dwight had used in drafting the CIR. CIA

records do nolLindicate that John accessed Dwight's draft CIR. 168

CIA records show that the CIA employee detailed to FBI Headquarters

who we call James and who discussed the Mihdhar information with two FBI

Headquarters employees, also accessed the draft CIR on the day it was drafted.

In addition, two other FBI detailees accessed the draft CIR: Eric, the other

Deputy Chief of the Bin Laden Unit, accessed it two hours after Dwight began

writing it, and. Malcolm, the New York Field Office's detailee to the Bin Laden

Unit, accessed it two days later.

..

CIA records show that as of eight days later the CIR had not been

. disseminated to the FBI. In an e-mail to John in mid-January, Dwight had

attached the draft CIR and wrote, "Is this a no go or should I remake it in some

way." The CIA was unable to locate any response to this e-mail.

By mid-February, the CIR had not been sent to the FBI and was still in

draft form in the CIA's computer system. CIA records show that Dwight e-

.. mailed a CIA contractor who handled computer matters and asked him to

delete several draft cables in the computer system unrelated to this matter, but

to save the draft CIR concerning Mihdhar. The contractor accessed the draft

cable in the system the next day.

When we interviewed all of the individuals involved with the CIR, they

. asserted that they recalled nothing about it. Dwight told the OIG that he did

not recall being aware of the information about Mihdhar, did not recall drafting

the cIR, did not recall whether he drafted the CIR on his own initiative or at

the direction of his supervisor, and did not recall any discussions about the

reasons for delaying Completion and dissemination of the CIR. Malcolm said

he did not recall reviewing anyof the cable traffic or any information regarding

Hazmi and Mihdhar. Eric told the OIG that he did not recall the CIR.

The CIA employees also stated that they did not recall the CIR.

Although James, the CIA employee detailed to FBI Headquarters, declined to

168According to John, once CIRs were drafted the CIA's standard operating procedure

was for the drafl:erto "coordinate" the CIRin the computer system, which notified the

persons designalledby the drafter that there was a CIR.that required their attention. He said

that it was not standard operating procedure to access CIRs in draft form.

233
be interviewed by us, he told the CIA OIG that he did not recall the CIR. John

(the Deputy Chief of the Bin Laden Unit) and Michelle, the desk officer who

was following this issue, also stated that they did not recall the CIR, any

discussions about putting it on hold, or why it was',not sent.

5. Mihdhar in Dubai

On the same day that Dwight was drafting the CIR, the CIA reported in

an internal cable additional information about Mihdhar. The cable Stated that it

appeared that, despite his multiple entry visa, Mihdhar had not yet traveled to

the United States. The cable then stated that it was up to the CTC as to

whether anyone slhould inquire with the INS to verify whether Mihdhar had

traveled to the United States. _69

The cable al[so reported additional information about Mihdhar while he

was in Dubai.

CIA records reveal that this cable also was read by FBI d,etailee Dwight.

However, Dwight did not include in the draft CIR the additional information

about the lack of any indication that Mihdhar had traveled to United States or

the additional information about Mihdhar in Dubai. 17°

6. CIA cable stating that Mihdhar's visa and passport

information had been passed to FBI

Also on the same day that Dwight was preparing the CIR, Michelle, the

Bin Laden Unit desk officer who was following the issue of Miihdhar, prepared

a lengthy cable to,several stations summarizing the information that had been

collected at that point on Mihdhar and three other individuals who also were

possibly traveling to Malaysia. The cable began, "After following the various

reports, some much more credible than others, regarding a possible [Bin

_69We did not determine whether the CIA actually contactedthe INS pursuant to this

suggestion. As we discuss below, we did determine INS records reflect that Mihdhar first

entered the United States on January 15, 2000, and only entered again on July 4, 2001.

170This cable also was read by James, the CIA employee detailed to the FBI's SIOC.

As detailed below, he later discussed some of its contents with an FBI Headquarters

employee.

234
Laden]-associated threat against U.S. interests',in East

This cable then summarized the CIA's information that indicated several

individuals were planning to travel to Malaysia. In the paragraph describing

Mihdhar, Michelle stated that Mihdhar's trave,1documents, including a

multiple entry U.S. visa, had been copied and passed "to the FBI for further

investigation."

This cable -the fifth CIA cable to discuss Mihdhar's U.S. visa- did not

state by whom or to whom Mihdhar's travel documents were passed. It also

did not indicate how they had been passed, or provide any other reference to

the passage of the documents. Because this cable was an internal, operational

cable, it was not forwarde d to or copied to the, FBI.

This cable was disseminated to various CIA stations approximately three

hours after Michelle had noted in the cable system that Dwight was directed to

hold off on sending his draft CIR to the FBI ":fornow per [the CIA Deputy

Chief of the Bin Laden Unit]."

When we interviewed Michelle, she stated that she had no recollection of

who told her that Mihdhar's travel documents had been pa,;sed to the FBI or

how they had been passed. She said she would not have been the person

responsible for passing the documents. According to Michelle, the language in

the cable stating "[the documents] had been passed" suggested to her that

someone else told her that they had already been passed, but she did not know

who it was. The CIA Deputy Chief of the Bin Laden Unit also said he had no

recollection of this cable, and he did not know whether the information had

been passed to the FBI.

Neither we nor the CIA OIG was able to locate any other witness who

said they remembered anything about Mihdhar's travel documents being

passed to the FBI, or any other documents that corroborated the statement that

the documents were in fact passed to the FBI.

7. The Malaysia meetings and surveillance efMihdhar

After he arrived in Malaysia, Mihdhar was followed :andphotographed in

various locations meeting with several different people. These events are

235
referred to as "the',Malaysia meetings." CIA employees wrote several cables

contemporaneously about the Malaysia meetings, which we discuss below.

a. First cable regarding Mihdhar in Malaysia

The CIA prepared an internal cable stating that Mihdhar had arrived in

Kuala Lumpur on the evening of January 5. The cable also described his

activities with other Arabs who were unidentified at the time. This cable,

which we refer to as the "first Malaysia meetings cable," did not contain any

information regarding passports or visas.

b. January 5 FBI threat update

It appearsthat this first Malaysia meetings cable was provided to the FBI.

Sometime before the daily FBI executive briefing that took place on January 6

at 7:30 a.m., the January 5 threat update information concerning Mihdhar was

edited inthe FBI's SIOC.

.... ,.

This January 5 threat update reflected an alraost verbatim recitation of

portions of the C1A's first Malaysia meetings cable, including the same

spelling mistake in reference to a particular place in Malaysia, which indicates

that the CIA provided a copy of the first Malaysia meetings cable to the FBI.

However, we were not able to determine who in the FBI received this

information from the CIA or who edited the January 5 threat update. No one

we interviewed at the FBI said they recalled handling information related to

Mihdhar or the January 5 threat update. The threat update contained no

reference to Mihdhar's passport information or his U.S. multiple-entry visitor's

visa.

The Januar3r 5 threat update also was made part of the January 6

7:30 a.m. executive briefing document. This briefing did not contain any

additional information about Mihdhar. The January 5 threat update was the

only official document from this period located by the FBI that referenced the

Malaysia meetings that were discussed in the first CIA Malaysia meetings

cable.

236
c. Discussion between CIA and FBI employees about

Malaysia meetings _J

As noted above, computer records show that James, the CTC employee

detailed to the FBI's SIOC, read the cables and the draft CIR indicating that

Mihdhar had a U.S. visa. Contemporaneous e-mails show that James discussed

the Malaysia meetings with two FBI Headquarters employees in the SIOC in

the early monaing hours of January 6. Below we detail the cables and the

evidence about the discussions that took place: between the CIA and FBI

personnel in the SIOC about the Malaysia meetings.

Contemporaneous e-mail messages among CIA employees show that

during the night of January 5 James briefed the FBI SSA who we call Bob

about Mihdhar's travel. At the time, Bob was an SSA in the UBL Unit in FBI

Headquarters:, which was operating out of the SIOC during this period.

James wrote an e-mail to several CIA employees in which he stated that

he was detailing "exactly what [he] briefed [the FBI] on" m the event the FBI

later complained that they were not provided with all of the information about

Mihdhar. 17_This e-mail did not discuss Mihd]har's passpor, Lor U.S. visa.

As previously mentioned, James told the CIA OIG that he had no

recollection of these events. He declined to be interviewed by us.

Bob told the OIG that he had no independent recollection of any briefing

from a CIA employee regarding the Malaysia meetings. However, he was able

totocate a scant contemporaneous note that confirmed he had been briefed

regarding Mihdhar and his trip to Malaysia. This note contained no details as

to the content of the briefing and no reference to Mihdhar's: U.S. visa.

Bob told the OIG that he does not believe that he had been told in this

conversation about Mihdhar's U.S. visa. Bob stated to us t!hatthe presence of a

171James wrote these e-mailsin response to an e-mail from anotherCIA employee who

was detailed to the FB'ISIOC. That employee reported on the morning ofJanuary 6 that he

had been asked by an FBI employee for the latest on Mihdhar. James responded in a series

of e-mails that he had already briefed the FBI. The final e-mail by James sets forth the

details of his briefings.

237
U.S. visa in Mihdhar's passport would have been extremely important and

would have triggered a more significant response than his minimal notes.

Bob also told the OIG that he did not know why James chose to brief him

about Mihdhar. Bob said that he was not a designated point of contact for the

CIA while the SIOC was activated, although he also said that he did not know

whether there was a designated point of contact in the SIOC. Bob said that he

knew James because James had previously been detailed from the CTC to FBI

Headquarters and had worked in ITOS with Bob.

d. Second cable regarding Mihdhar and the, Malaysia

meetings

The day after the CIA employee discussed tlhe Malaysia meetings with

the two FBI SIOC employees, the CIA sent another internal cable providing

new information about the activities of Mihdhar. This cable, "the second

Malaysia meetings cable," provided information about Mihdhar's activities

once he left the Kuala Lumpur airport and his meetings with various

individuals.

e. Discussion between CTC officer and FBI employee

about Malaysia meetings

Shortly after 7:30 a.m. on January 6, James briefed another FBI SSAwho we call "Ted:"- who was detailed to the SIOC from an FB.I field office,

about information contained in the second Malaysia meetings cable. Ted told

the OIG he was working in the SIOC as an "assistant" to the day shift

commander and the UBL Unit Chief, but that he had no specific duties.

Because Bob had left FBI Headquarters on a trip to New York by this time,

James briefed Ted to ensure that someone at FBI Headquarters had the latest

information on Mihdhar.

In the same e-mail in which he: had detailed What he told Bob, James

provided specifics of what he told Ted. The e-mail also stated that the CIA

would "continue to run this down and keep the FBI in the loop.,' The e-mail

did not contain any reference to Mihdhar's passport or U.S. visa.

Based on this briefing by James, Ted prepared an update for the January

6 afternoon FBI executive briefing. Ted e-mailed the update to the ITOS

Assistant Section Chief at 8:40 a.m. This update reflected the details of the

238
information Ted had received from James. It did not contain any reference to

Mihdhar's pa,;sport or U.S. visa.

Like Bob, Ted told the OIG that he had no recollection ofbeing briefed

regarding the Malaysia meetings. Although he said he did not recall these

events, Ted asserted hedid not believe that he had received Mihdhar's passport

or U.S. visa information because if he had he would have unquestionably

recognized their significance and documented such information in the update

for the executive briefing.

Ted told the OIG that he did not know why James briefed him about the

Mihdhar information. Like Bob, Ted stated he was not a designated point of

contact for the CIA while the SIOC was activated. Ted also knew James

because of James' previous detail to ITOS in FBI Headquarters when Ted

served as an SSA in the RFU.

f. Cables updating the Malaysia meetings information,

including Mihdhar's travel to Bangkok

On January 8, the CIA reported in another internal cable that a new

individual had joined Mihdhar and the others, and that additional surveillance

photographs were taken. The cable did not state how many'photographs were

taken or what would be done with the photos.

In another cable sent five hours later, the CIA reported in an internal

cable that Mihdhar and two of the unidentified men- one of whom turned out

to be Hazmi - departed Malaysia from Kuala Lumpur airport en route to

Bangkok, Thailand.

g. Cables regarding Hazmi's travel to the United States

On January 9, the CIA's Bin Laden Unit prepared a cable asking that

Mihdhar and his associates be identified while in Thailand. CIA records show

that on January 13, the CIA was attempting te locate Mihdhar and his traveling

companions. In addition, Mihdhar had been watchlisted at the airport in the

event that he attempted to leave Thailand.

Several weeks later, CIA officers in Kuala Lumpur followed up with

their Bangkok counterparts for additional information about Mihdhar and his

traveling companions. Approximately two weeks later, Bangkok reported that

239
there was a delay in responding due to difficulties in obtaining the requested

information.

In early Mm:ch 2000, officials in Bangkok reported internally that it had

identified one of Mihdhar's traveling companions as Nawaf al-Hazmi. The

cable reported that Hazmi had traveled to Bangkok on January 8 and had

subsequently traveled on a United Airlines flight to Los Angeles, California on

January 15. The cable also stated that Mihdhar had arrived in Bangkok on

January 8 but that:it was unknown if and when he had departed. 172In addition,

the cable identified the third traveler as Salah Saeed Mohammed Bin Yousaf.173

CIA records; show that none of'the FBI detailees accessed this early

March cable. The OIG found no documents or witnesses indicating that the

information that ttazmi had traveled to Los Angeles on January 15, 2000, was

shared with the FBI at this time. Rather, as we discuss below, this fact was not

shared with the FBI until August 2001.

We found no indication that CTC personnel took any action with regard

to the important information that Hazmi had traveled to the Un:ited States. For

example, he was not placed on any U.S. watchlists. The day after Bangkok

reported about Hazmi's travel to Los Angeles, one office that i'eceived the

Bangkok cable sent a cable to the CTC stating the Bangkok cable regarding

Hazmi's travel had been read "with interest." Yet, despite this effort to flag the

significance of this information, the cable was not shared with llheFBI and did

not result in any specific action by the CIA.

As we discuss below, it was not until August 2001 that FBI Headquarters

personnel learned that on January 15, 2000, both Mihdhar and ![-Iazmihad left

Thailand and traveled to Los Angeles, California, where they were both

172In fact, Mihdhar had traveled to the U.S. with Hazmi on January 15, 2000. This fact

was not discovered by anyone in the Intelligence Community until August 2001.

_73Yousaf left Bangkok on January 20 for Karachi, Pakistan. Some time after

September 11, Yousafwas determined to be Tawfiq Muhammad Salih Bin Rashid al Atash,

a/k/a Khallad, the purported mastermind of the Cole attack. We discuss t]heFBI's discovery

of information about Khallad and the Cole attack, and the FBI's opportunities to connect

Khallad to the Malaysia meetings, in Section III, C below.

240
admitted into the United States on non-immigrant visas and. authorized to

remain until July 14, 2000.

8. OIG findings regarding FBI's knowledge about Mihdhar

and the Malaysia meetings

We discuss here our findings regarding the FBI's knowledge of

information about Mihdhar and the January 2(100 Malaysia meetings, including

whether the intelligence information concerning Mihdhar's valid multiple entry

U.S. visa and Hazmi's travel to the United States in Januaw 2000 was passed

to the FBI. Several witnesses told the OIG that Mihdhar's possession of a U.S.

visa provided a clear domestic nexus that should have triggered the passing of

this information from the CIA to the FBI.

At the outset, we note that the CIA has acknowledged that it obtained

information that Mihdhar had a U.S. visa and that Hazmi had traveled to the

United States, and that the CIA should hiave pl[aced their names on U.S.

watchlists, but that this didnot occur. 174 The CIA OIG is reviewing this matter

to determine why this failure occurred and who is responsible for it.

a. Formal passage of information from the CIA to the FBI

..

As noted above, the formal method of communicating intelligence

information between the CIA and the FBI was. an intelligence report called a

CIR. CIA records show that between July 1999 and September 10, 2001, the

Bin Laden Unit disseminated over 1,000 CIRs, most of which were sent to the

FBI CTC employees as well as FBI detailees to Bin Laden Unit had authority

to draft CIRs, and the detailees collectively drafted over 150 CIRs to the FBI

during this period. However, CIRs could only be disseminated by persons with

authority to "release" the CIRs. _75In the Bin Laden Unit, only supervisors,

174Mihdhar and Hazmi were placed on watchlists by other countries, including

Thailand.

175Once a supervisor approved a CIR for release, it was electronically disseminated by

a unit in the CIA known as the Policy Community Action Staff.

241
including John and Eric asthe deputy chiefs of the station, had authority to

release CIRs. 176

Dwight drafted a CIR in which he summarized the information that had

been disseminated by the NSA about Mihdhar. He also provided detailed

information about Mihdhar's passport, visa, and visa application indicating that

New York had been his intended destination. According to CIA records, this

CIR never was di,sseminated to the FBI. A desk officer's note on the draft CIR

indicated that the Deputy Chief of the Bin Laden Unit, John, had instructed the

draft CIRbe put on hold, and Dwight contacted him through an e-mail about

the disposition of the CIR a week later. Despite this e-mail, the evidence

clearly shows thalLthe CIR never was disseminated to the FBI.

The evidence shows, however, that Dwight acted in accordance with the

system that was in place at the time by drafting the CIR to formally pass the

visa information to the FBI. In accordance with Bin Laden Unit policy,

Dwight was not permitted to pass the CIR to the FBI without permission.

All0f the witnesses stated, however, that they did not recall the CIR or

any communications about it. Other than the note.,written by the desk officer,

we found no documentary evidence about why the CIR was not disseminated.

Thus, we were unable to determine why it was not sent.

The information in the CIR, whichwas documented in the appropriate

format for passage to the FBI, was potentially significant to the FBI and should

have beenpassed to the FBI. We believe it was a significant failure for the

CIR not to be sent to the FBI.

b. Informal passage of information from CIA to FBI

Wealso considered what information that James, a CIA detailee to the

FBI, informally passed to FBI Headquarters and whether he inl!'ormedanyone

of the visa information about Mihdhar. Based on the contemporaneous e-mails

in which James documented in detail what he told FBI SSAs Bob and Ted, we

concluded that he,reported to the FBI the information regarding Mihdhar's

176CIA records show that Eric released five CIRs during his tenure at the Bin Laden

Unit.

242
transit through Dubai, his arrival in Kuala Lumpur, his activities after his

arrival, and his meeting with other suspected al Qaeda operatives. It is far less

clear, however, whether he provided Mihdhar's passport aa_LdU.S. visa

information to the FBI.

We do not believe that James briefed either Bob or Ted on Mihdhar's

passport or U..S. visa information. First, nothing in Bob's contemporaneous

notes or Ted's e-mail or briefing update referred to Mihdhar's passport or visa

information.

Moreover, James wrote a detailed e-mail to document the contents of his

conversations, with Bob and Ted. Since the stated purpose of James' e-mail

wasto prevent the FBI from later claiming he had failed to brief them on some

important details, he had every incentive to include all relevant details in that email. At the time he wrote this e-mail, he had read three of the CIA cables

indicatingthat Mihdhar had a U.S. visa, as well as the draft:CIR. Yet, James'

e-mail contained no mention of Mihdhar's passport or visa..

We found only one piece of evidence suggesting that the FBI was made

aware in January 2000 of Mihdhar's U.S. visa- the early January cable by the

desk officer who we call Michelle which state,d that Mihdhar's travel

documents, including a multiple entry U.S. visa, had been copied and passed

"to the FBI for further investigation." We could not, however, find any

evidence to corroborate that this information actually had been passed to the

FBI.

This cable did not state by whom or to whom the documents were passed

or make any other reference to the passage of the documents. The cable was an

internal cable.,,which means it would not have.'been forwarded to or accessible

tOthe FBI. In addition, Michelle, the CIA desk officer who wrote the cable,

had no recollection of who told ]herthat the documents had been passed or how

they had been passed. She said that she would not have been responsible for

passing the information but instead would have been told by someone else that

the documents had been passed.

We were unable to locate any witness who said they remembered

anything about the documents being passed to the FBI, as Michelle's cable

243
asserted. Even if her cable was accurate, and she ihadbeen told by someone

that the documents had been passed to the FBI, there is no evidence that such

information was correct. The CIA madFBI witnesses we intelwiewed described

this period as vepy hectic and said they were flooded with information. Several

witnesses suggested that these hectic circumstances could have created an

environment where unintentional misunderstandings might have occurred

about whether information was actually passed to other Intelligence

Community agencies.

We also searched ACS for any FBI record of the travel documents having

been provided to the FBI, since this cable indicated that a physiical copy of the

documents, not merely information about the documents, was passed. We

found no reference to the documents.

Aside•-from this cable, we found no other evidence that the information or

documents about Mihdhar's passport or visa information was in fact provided

to the FBI during this time period.

c. FBI detailees' handling of information on Mihdhar

As discussed above, five FBI employees were detailed to the CTC to

work on Bin Laden matters during 2000 and 2001, and all had access at their

desks to CIA internal cable traffic. Four of those employees- the supervisor

whowe call Eric, the IOS who we call Mary, and the agents who we call

Dwight and Malcolm- were at the Bin Laden Unit in January 2000 when the

Malaysia meetings occurred. 177 We considered how each handled the

intelligence infonmation concerning Mihdhar during this period.

After reading two of the cables indicating that Mihdhar had a U.S. visa,

Dwight prepared a draft CIR to officially notify the FBI about _Ihatinformation,

since the U.S. visa presented a nexus between MiMhar and the United States.

But the CIR was not provided to the FBI. However, we also examined whether

any of the detailees took any other action to notify FBI Headquarters or, in

Malcolm's case, the New York Field Office, about the information concerning

Mihdhar.

177The fifth detailee - the manager who we call Craig - did not arrive at the CTC until

July 2000.

244
The evidence shows that each FBI detai][eereviewed some of the cables

about Mihdhar's U.S. visa. Dwight accessed several of thecables that

indicated Mihdhar had a U.S. visa, such as the:cables stating that Mihdhar had

transited through Dubai and had a U.S. visa, the cable stating that Mihdhar's

visa application listed New York as his intended destination in May 1999, and

the cable stating that based on a review of Mihdhar's visa, Jitdid not appear that

he had actually traveled to the United States.

Malcolm also accessed the cable stating that Mihdhar's visa application

listed New York as his intended destination in May 1999, and the cable stating

that it did not appear that Mihdhar had actually traveled to _LheUnited States.

Malcolm also accessed the two cables stating that Mihdhar had arrived in •

Kuala Lumpur and that surveillance photos showed him meeting with others in

Malaysia. Malcolm also accessed Dwight's draft CIR indicating passage of the

visa informati0n to the FBI, including the New York Field 'Office.

Mary accessed the January cable stating that Mihdhar's travel documents,

including a multiple-entry U.S. visa, had been passed to the:FBI, but she did

not access the,previous cables reflecting the visa information or Dwight's CIR.

She also accessed the two cables stating that Mihdhar had arrived in Kuala

Lumpur and that surveillance photos showed him meeting with others in

Malaysia.

Eric did not access these cables, but he accessed Dwight's draft CIR

which detailecl Mihdhar's visa information and which SUlmnarized the NSA

information.

However, Dwight, Malcolm, Mary, and Eric all told the OIG that they

did not recall anyone from the CIA bringing to their attention the fact that

Mihdhar had a U.S. visa. In addition, despite the records of their access to the

cable traffic or the CIR, they all told the OIG that they did not recall

discovering allthe time - such as by reading a cable- that Mihdhar had a U.S.

visa. 178 As discussed above, Dwight told the OIG that he dJid not even recall

178The detailees also told the OIG that they did not necessarily read all of the cables

they accessed. They explained that they often skimmed cables to determine if any action

was required on their part or to find specific information in connectien with a particular

assignment or issue.

245
writing the CIR or even being aware of the Malaysia meetings or of the fact

that Mihdhar had a U.S. visa. Eric told the OIG that his CIA counterpartJohn, the CIA Bin Laden Unit Deputy Chief- mentioned the Malaysia

meetings and that surveillance photos had been taken, but Eric did not recall

ever hearing anyt]hing about Mihdhar having a U.S. visa. Mary told the OIG

that she did not recall even being contemporaneously aware of the Malaysia

meetings. 179Mar.Vexplained that she did not have',reason to be made aware of

the Malaysia meetings at the time because the malLterhad been assigned to

another CIA desk officer- Michelle (the one whowrote the cable indicating

that Mihdhar's travel documents had been passed to the FBI). , :

Malcolm said he was not aware of the fact that Mihdhar had a U.S. visa

until after September 11. He stated that he recalle,d being shown the Kuala

Lumpur photos, but he could not remember whether that was before or after

September 11. He said that it was not until he was shown the Kuala Lumpur

photos that he became aware ofthe Malaysia meetings.

Yet, the evidence shows that all had accessed contempor_meously cables

indicating that MJihdhar had a U.S. visa, which was important intelligence

information that was never provided to FBI Headquarters. They did not violate

_ any specific policy or procedure in t]heirhandling of the information, and they

did not have the authority to unilaterally pass CTC information to the FBI

without permission. This restriction included any informal passage of the

information, such as by telephone call or in-person discussions. However,

none of them, particularly Dwight, ensured that the information was provided

to the FBI. Dwight drafted a CIR that would haw_ provided the FBI with the

important information about Mihdhar, but the CIR was not released by the

CIA. Although Dwight followed up a few days later to ask whether the cable

was going to be sent or whether he should remake',it in some other way, there is

no record of a response to his request, find no one could explain why the cable

was not sent. We:believe it was critical that the information be:sent. We found

no indication that this ever happened.

179When we showed Mary copies of an e-mail written by the CTC officer who had

briefed SSA Bob and Ted, which indicated that she was copied on the e-mail, she said that

she did not recall haring read the e-mail.

246
This failure to send the information to the FBI, in our view, was also

attributable to problems in how the detailees were instructed and supervised,

and that these problems significantly impeded the flow of information between

the CIA and the FBI. We discuss these systemic problems in detail in our

analysis section later in this chapter.

d. OIG conclusion

In sum, the evidence shows that in January and Marctl 2000, the CIA

uncovered important intelligence information about Mihdhar and Hazmi:

t

® They lxaveled to Bangkok with a third person;

® Mihdhar had a valid, multiple-entry U.S. visa; and

® Hazmi had traveled to Los Angeles in January 2000.

Yet, we found that the CIA did not share significant pieces of this

information with the FBI - that Mihdhar had a U.S. visa and that Hazmi had

traveledto Les Angeles. An FBI detailee at the CIA drafted a CIR to share this

information with the FBI, but that information was not released by the CIA to

the FBI. We 'were unable to determine why this did not occur. No one we

interviewed said they remembered the CIR or why it was not sent to the FBI.

We consider it a significant failure for this CIR not to be sent to the FBI.

In addition, the evidence shows that the limited information that was

provided to FBI Headquarters - that Mihdhar traveled __

__ was never documented by the FBI

in any system that was retrievable or searchable, thus limiting the usefulness of

the information that was shared. The FBI's only official record of having

received this information was in the hard copies of the January 5 threat update,

which was attached to the January 6 executive, briefing, and Ted's e-mail

summarizing information from his discussion with the CIA employee. We

discuss this madother systemic problems in our analysis section below.

247
B. Hazmi ;and Mihdhar in San Diego

1. Introduction

The second set of events that may have led the FBI to diScover Mihdhar

and Hazmi's presence in the United States related to their stay J[nSan Diego.

As noted above, on January 15, 2000, Mihdhar and Hazmi boarded a flight in

Bangkok, Thailand, for Los Angeles. They were ;admitted to the United States

on non-immigrant visitor visas and authorized to remain in the U.S. until

July 14, 2000. Shortly after arriving in Los Angelles, they traveled to San

Diego, California, where they were aided in finding a place to ,;tay by Omar

al-Bayoumi. Bayoumi had been the subject of an FBI preliminary intelligence

investigation that had been closed.

In late May 2000, Hazmi and Mihdhar rented a room in tl_e residence of

an FBI asset. 18° Mihdhar remained in San Diego until June 10, 2000, when he

left the United States. TM Hazmi remained in the San Diego area until

approximately December 2000, when he moved to the Phoenix, Arizona area.

In Phoenix, Hazmi lived for approximately three months with another

September 11 hijacker, Hani Hanjour. In April 2001, Hazmi and Hanjour

moved to New Jersey and remained on the East Coast until September 11.

Whileresiding in San Diego in 2000, Mihdhar and Hazmi did not act in

an unusual manner that would draw attention, but they did not attempt to hide

their identities. Using the same names contained in their travel documents and

known toat least some inthe Intelligence Community, they rented an

apartment, obtained driver's licenses from the state of California Department

of Motor Vehicles, opened bank accounts and received bank credit cards,

• purchased a used vehicle and automotive insurance, took flying lessons at a

local ilying school, and obtained local phone service that included Hazmi's

listing in the local telephone directory.

180This kind of individual is often referred to as an "informant" - the common

vernacular for an individual providing information to an investigative agency. Within the

FBI's foreign intelligence program, they are known as assets.

181Mihdhar departed from Los Angeles on Lufthansa Airlines.

248
Although Hazmi and Mihdhar were in San Diego for a significant period

of time, the FBI did not learn of their presence there until after September 11,

2001. After September 11, much would be learned about Hazmi and

Mihdhar's time in San Diego and the Intelligence Community's missed

opportunities to find and investigate them befi)re the terrorist attacks in which

they participated. In this section, we describe the facts surrounding Hazmi and

Mihdhar's residence in San Diego, including their associations with two

persons known to the FBI.

2. Hazmi and Mihdhar's association with B_tyoumi

_ Omar al-Bayoumi is a Saudi Arabian national who came to the United

States in 1993. In early 2000 he had been living with his wife and four

children in Sa_ Diego for at least four years. Although he described himself to

others in San Diego as a graduate student in business administration, he took

classes interrnittently and was not enrolled in a program of study. He did not

work in the United States and received a momhly stipend of $4,000 plus "other

allowances," ranging from $465 to $3,800 each month, from Dallah/Avco, a

Saudi contractor to the Presidency of Civil Aviation. _82Bayoumi was active in

the San Diego Muslim community and was involved in the establishment of

several mosques in the United States.

In September 1998, the FBI's San Diego Field Office:opened a

preliminary inquiry on Bayoumi based on allegations raised by the manager in

the apartment complex where he was living at the time. The manager alleged

that Bayoumi had received a suspicious package from the Middle East, and the

maintenance 'worker for the apartment comple,x had noted strange wires in

Bayoumi's bathroom. In addition, the manager reported frequent gatherings of

young Middle Eastern males at Bayoumi's apartment on weekend nights.

The FBI case agent conducted a limited investigation of Bayoumi, but the

preliminary inquiry was closed in June 1999 and was not converted to a full

182Bayoumi was employed by the Saudi Presidency of Civil Aviiation from 1975 until

1995 and became a contractor for the organization beginning in 1995.

249
field investigation. _83As a result, the FBI was no longer investigating Bayoumi

at the time that Hazmi and Mihdhar met Bayoumi in February 12000. However,

the following paragraphs describe what was later learned about Bayoumi's

interactions with Hazmi and Mihdhar.

On February 1, 2000, Bayoumi traveled by car from San Diego to Los

Angeles, to resolve a visa issue at the Saudi consulate. Bayoumi invited an

associate, Isamu Dyson, to accompany him. TM Dyson provided the following

account to the Ft3I of the trip with Bayoumi. _85

Dyson said that at the time of the invitation, Bayoumi mentioned a Los

Angeles restaurant serving halal food where they could eat lunch after .

Bayoumi's meeting at the consulate. 186After Bayoumi spent approximately

onehour at the Saudi consulate, he and Dyson went to the rest_mrant but

discovered it had been converted to a butcher shop. The butcher shop

employees recommended another nearby halal restaurant, the "Mediterranean

Gourmet." Bayoumi and Dyson walked to that restaurant. W_.ile they were

eating there, Hazmi and Mihdhar entered the restaurant and the',four talked in

Arabic. Although Dyson had limited Arabic language skills, he said that

Bayoumi kepthim apprised of the content of the conversation. Hazmi and

Mihdhar told Bayoumi that they were in the United States to study English, but

they did not like living in Los Angeles. Bayoumi invited the men to visit San

Diego and offered to assist them. Bayoumi provided the men with his phone

number. Bayoumi and Dyson left the restaurant, and after stopping at a nearby

mosque forsunset prayers, returned to San Diego.. Dyson asserted that the

encounter with Hazmi and Mihdhar seemed to be a coincidental meeting.

..

: Within several days of the meeting, Hazmi and Mihdhar accepted

Bayoumi's invitation and traveled to San Diego. In San Diego, Bayoumi

• . \

183In Section IV B 1 of this chapter, we examine the :investigative steps taken by the

FBI in this preliminary inquiry and assess the appropriateness of the deci,;ion to close the

inquiry.

184Dyson is an .American Caucasian who converted to Islam. He has',since changed his

name to Caysan Bin Don.

_85Dyson provided the information to the FBI in an interview after September 11.

186Halal is an Arabic word meaning "lawful" or "penxfitted."

25O
arranged for Hazmi and Mihdhar to rent an apartment on Mount Ada road in

the same apartment complex where Bayoumi lived. Bayoumi also co-signed

their lease. Shortly after Hazmi and Mihdhar :moved into fl_e apartment,

Bayoumi hosted a party to introduce them to the local MusJlimcommunity.

Within a few weeks of moving into the apartment, Hazmi and Mihdhar

filed a 30-day notice to vacate the apartment, apparently to move to another

apartment. However, they later rescinded the vacate notice and continued to

lease the apal_Lmentuntil June 2, 2000.187

The apartment manager told the FBI that Bayoumi paid Hazmi and

Mihdhar's first month's rent and security deposit because they had not yet

established a local bank account and the apartment complex would not accept

cash. A review of Bayoumi and Mihdhar's financial records after September

11,2001, indicate that Bayoumi was reimbursed for this expense on the same

day it was paid. is+

3. Hazmi and Mihdhar's communications

On March 20, 2000, a long distance telephone call was placed from

Mihdhar and Hazmi's Mount Ada apartmentto a suspected terrorist facility in

the Middle East linked to al Qaeda activities. (See section III; A, 2 above.) A

record of the call was captured in the toll records. After the September 11

attacks, the call was identified through a record check.

187Bayoumi left the United States for some of the time Hazmi and Mihdhar lived in the

apartment. INS records do not indicate when Bayoumi left the country, but the records

indicate that he obtained a United States visa in Jeddah on May 10, 2000, and returned to the

United States or.tMay 31, 2000. Bayoumi left the United States permanently in July 2001

and was living in England on September 11,2001.

t88Bayoumi's bank records show a cash deposit in the exact amount of the rent and

security deposit ($1,558). Mihdhar's financial records also indicate that he opened an

account with a deposit of $9,900 in cash within seven minutes of Bayoumi's cash deposit,

which suggests that they were in the bank together.

251
4. Hazmi and Mihdhar's association with an FBI asset

beginning in May 2000

Sometime in May 2000, Hazmi and Mihdhar moved out of the apartment

Bayoumi had found for them on Mount Ada Road and moved as boarders into

the home of an asset of the FBI's San Diego Field Office. 189Hazmi and

Mihdhar met the asset at the mosque they attended. 19° Mihdhar stayed at the

asset,s residence until June 10, 2000, when he left: the United States. Hazmi

resided in the asset's house until December 10, 20,00, when he moved to

Arizona.

. !

a. Background on the FBI asset

In 1994, the asset was recruited by San Diego FBI Special Agent who we

call "Stan" The FBI had interviewed the asset in connection with a bombing

investigation seve,ral years before. Stan remained the asset's h_mdling agentor "control agent"- until Stan retired in February 2002.191

The asset was opened as an asset on May 14, 1994.192 He: worked as an

informational source, providing to the FBI information acquired in his normal

daily routine. He normally was questioned about specific individuals who

were under investigation by the FBI, although he occasionally volunteered

information that he thought might be relevant. According to Stan, during some

189The OIG wa,;not able to interview the asset. The Joint Intelligence Committee

Inquiry had attempted to interview the asset without success. The Committee then

submitted interrogatoriesthat the asset declined to answer:,asserting his Fifth Amendment

privilege. The asset indicated through his attorney that if,;ubpoenaed by _iheCommittee, he

would not testify without d grant of immunity.

_90There is some dispute about whether Hazmi andMihdhar actually responded to an '

advertisement for boarders posted by the asset or whether they were introduced to the asset.

The OIG did not have access to the witnesses who could address this issue.

191Stan was interviewed twice by the JICI staff, and he testified before the Joint

Intelligence Committee. After his retirement from the FBI, Stan declined repeated requests

for an OIG interview. The OIG does not have authority to.subpoena individuals and cannot

compel former Department of Justice employeesto submit to an interview.

192Initially the asset was not paid. In July 2003, the asset was given a $100,000

payment and closed as an asset.

252
periods, he would talk to the asset several times per day, but there were periods

in which he diidnot talk to him for several weeks or months'.. Stan said that

many of their conversations were about family matters, the informational

asset's health, and other non-substantive issues.

In 1996.,the asset began renting out rooms in his home. Prior to

September 11,2001, he had 14 different boarders in his house, including

Hazmi and Mihdhar. When Hazmi and Mihdhar rented rooms from the asset in

2000, two other persons also were renting rooms there.

b. Information from asset on Hazmi and Mihdhar

It is not clear what information the asset provided to the FBI about

Hazmi and Mihdhar before theSeptember 11 attacks.

After the September 11 attacks, the FBI interviewed the asset and asked

about the conduct and activities of Hazmi and Mihdhar while they were living

with the asset. In those interviews, the asset described them as quiet tenants

who paid their rent. He said they were good Muslims who regularly prayed at

the mosque. The asset said that Hazmi and Mihdhar oftel_twould go outside

when using their cellular telephones. The asset insisted that he noted no

indicators of nefarious activity by Hazmi or Mihdhar that s]houldhave resulted

in his reporting their identities to the FBI.! 93

The asset was asked what information he provided to Stan about Hazmi

and Mihdhar before September 11. In these interviews, the asset provided

conflicting accounts regarding the information on Hazmi and Mihdhar that he

had disclosed to Stan. The agent who interviewed the asset- this agent had

taken over as the asset's control agent after Stan's retirement from the FBI -

told us that the asset said he told Stan about his boarders in general terms,

although he had not fully identified Hazmi and Mihdhar. The control agent

said that the asset later said that he had not told Stan about the boarders at all.

193TheFBI openedan investigationafterSeptember11to determinewhethertheasset

wasinvolvedin the attack. The assethas consistentlymaintainedafterSeptember11thathe

had no suspicionsaboutHazmiandMihdhar.The res.ultsof apolygraphexaminationonhis

potentialrolewereinconclusive.Basedon itsinvestigation,however,the SanDiegoFBI

concludedthat theinformationalassethadnot beencomplicitin plottingthe attacks.

253
Although Stan declined to be interviewed by the OIG, after

September 11, his',FBI supervisors had interviewed him about the asset. Stan

also had discussed the asset with co-workers and was interviewed by, and

subsequently testified in, a closed session before the Joint Intelligence

Committee. 194Stan reported that the asset had told him contemporaneously

that two Saudi national visitors were residing in a room at his r,esidence. Stan

said that the asset merely provided the first names of the boarders, Nawaf and

Khalid. Stan conlLendedthat he had asked the asset for the boarders' last names

but never received them and did not follow up. He said that the asset told him

that his boarders were in the U.S. on valid visitors.' visas, and they planned to

visit and to study while they were in the country. In addition, Stan said that the

asset told him that he believed that the two boarde,rs were good Muslims

because of the amount of time that they spent at tile mosque. Stan stated that

he did not recall tlhe asset ever telling him that either of the boarders had

moved out. According to Stan, the asset did not describe his boarders as

suspicious or otherwise worthy of further scrutiny. Stan reported that he never

obtained Hazmi and Mihdhar's full identities from the asset and that he did not

conduct any inve,;tigation of them.

5. OIG conclusion

In sum, the FBI did not obtain information about Mihdhar's and Hazmi's

time in San Diego, either as a result of the Bayoumi preliminary inquiry or

from the asset. In the analysis section of this chapter, we evaluate Stan's

actions with regard to Hazmi and Mihdhar and whether he should have pursued

additional information about who was living with one of his assets.

C. Mihdhar's association with Khallad, the purportedmastermind

of the Cole attack

The third potential opportunity for the FBI to acquire information about

Hazmi and Mihdhar occurred in January 2001

However, the FBI has

194The OIG was permitted to review the transcripts of Stan's testimony before the Joint

Intelligence Committee's Inquiry.

254
asserted that it did not learn of the source's identification or"the al Qaeda

operative at the Malaysia meetings until much later in 2001, just before the

September 11 attacks. This section of the report describes the events

surrounding this third opportunity for the FBI to focus on Hazmi and Mihdhar.

- 1. Background

In 2000, the CIA and the FBI began debriefing a source who provided

significant infbrmation on operatives and operations related[ to Usama Bin

Laden. The source gave the CIA and the FBI information about an al Qaeda

operative known as "Khallad" and described him as being involved with the

East African embassy bombings in August 1998. Shortly after the U.S.S. Cole

was attacked JinOctober 2000, the CIA and the FBI received a photograph and

information that a man named "Khallad" was the purported mastermind behind

the attack on the Cole. In December 2000, the CIA and the FBI showed the

source the photograph of Khallad, and the source identified the person inthephotograph as the same Khallad he had described as involved with the East

African bombings. As part of the Cole investigation, the FBI sought to find

Khallad.

In January 2001, the source Was shown photographs ii'om the Malaysia

.. meetings in an effort to determine whether Khallad Wasin the photographs.

195

As a result, they Said, they may have uncovered earlier the CIA's

\

195Information developed after September 11, 2001, revealed this was a

misidentification, and the person identified as Khallad was actu_illy Hazmi. We discuss this

misidentification in detail below.

255
information about Mihdhar and Hazmi and found them in the United States

well before the summer of 2001. _

For example, on September 26, 2002, Cofer Black,

who served as Director of the CIA's CTC from 1o99 until May 2002, testified

before the Joint Intelligence Committee:

FBI agents and analysts had full access to information [the

CIA] acquired about the Cole attack. For example, We ran a

joint operation with the FBI to determine if a Cole suspect was

in a__]l surveillance photo. I want to repeat- it was

a joint operation. The FBI had access to that information from

the beginning. More specifically, our records establish that the

Special Agents from the FBI's New York Field Office who were

investigating the USS Cole attack reviewed the information

about the __ photo in late January 2001,

We therefore examine in detail the evidence relating to whether the FBI

was aware of the identification of Khallad in the photographs of the Malaysia

meetings.

2. Source's identification of Khallad

a. The source

In mid-2000, Drug Enforcement Administration (DEA) personnel

arranged for FBI Legal Attach4 (Legat) Office personnel overseas to meet a

source who had substantial information on Bin Laden an d his eperatives and

operations. This particular FBI Legat office was staffed by the Legal Attach4

(the "Legat") and the Assistant Legal Attach4 (the',ALAT), who were FBI

Special Agents. _96

_96The primary mission ofFBI Legat Offices isto establish liaison with foreign law

enforcement agencie,s to support the FBI's investigative activities overseas. While Legat

staff may become involved in specific investigations, they have no flawenforcement

authority in foreign countries. For a description of the role and responsibilities of FBI

(continued)

256
Because', of the FBI Legat personnel's inability to converse in any of the

source's languages, limits onthe FBI's authority to conduct unilateral

intelligence activities overseas, and the source:'s potential value as a source of

intelligence information relevant to the CIA, tlheFBI contacted the CIA for

assistance with the source. The source was subsequently handled as a joint

FBI/CIA source. Even though the FBI ALAT- who we call "Max"- was

unable to directly communicate with the source due to the lack of a common

language, he was designated as the FBI control agent for the source.

Because: the source had significant information about Bin Laden and his

operatives and operations, the FBI New York Field Office-- the office that was

leading the investigations on the East African embassy bolnbings, the Cole

attack, and other Bin Laden-related investigations - also became involved with

the source. This joint handling of the source created concerns within the CIA.

- The CIA's most significant concern was the FBI's desire to use the source for

the criminal investigations involving Bin Laden conducted by the FBI's New

York Field Office. The CIA believed thatthe source shouM not face possible

exposure in criminal proceeding,;.

CIA Headquarters was asked to work with FBI Headquarters to convert

the source to purely an intelligence role, solely under CIA control. According

to CIA documents, the CIA and the Legat had discussed the FBI's "wall"

whereby separate but concurrent intelligence _mdcriminal investigations were

conducted within the FBI, but the CIA expressed concerns :about the CIA's

ability to continue clandestine handling of the source if the FBI was involved.

Although the CIA acknowledged that the source had value to the FBI's

criminal case, the CIA argued that the source's potential as an intelligence

asset was more important then his potential assistance in the criminal case.

Despite the CIA's concerns, the source remained a joint FBI/CIA asset.

b, Debriefings of the source

Beginning in 2000, the CIA and FBI began to debrief the source on a

regular basis. Over the course of several months, the source frequently was

(continued)

Legats,seethe OIGreportentitled,"FederalBureauof InvestigationLegalAttach6

Program"(March2004).

257
shown photographs and asked to identify people in them. Although Max was

the source's designated control agent, aCIA officer who spoke one of the

source's language,s conducted the debriefings. Max was present for some of

these debriefings, but not all. Some of the debriefings were unilateral CIA

interviews. The time spent with the source was kept short because of issues of

travel and security.

According to Max, during the debriefings the CIA officer usually did not

immediately translate the source's statements for 1Lhebenefit of Max. He said

that the CIA case officer would only immediately translate something when

Max had specific questions for the CIA officer to ask the source. The CIA case

officer told the O][Ghe recalled translating for Max things that the source said,

but he did this only when he recognized the significance of the information to

Max or an FBI operation.

In an effort not to duplicate the reporting of information received from

the source, the CIA and the FBI agreed that the C][A would be responsible for

reporting the information from the debriefings. However; in instances where

the source was solely being shown FBI photographs or questioned based on an

FBI lead, Max would document the source's information, either in an EC or an

FBI FD-302 form, and the CIA wou][dnot document the same information.

After the debriefings, the CIA officer would write internal cables

covering the debriefings and forward them to the CTC and other appropriate

offices. These cables were internal CIA communications and were not

provided to or shared with Max or other FBI personnel. _97Instead, Max and

FBI Headquarters'. would be informed of the debriefings when the information

was reported by t]heCIA in a TD. As previously discussed, TDs were prepared

by CIA reports officers who reviewed the internal cables and determined what

information needed to be disseminated and to which agencies. Based on our

review of internal cables reporting the source's debriefings and the TD

reporting of the same interviews, it is clear the TDs often contained only a part

of the information obtained during the source deb]riefings. As a result, either

197As discussed above, FBI detailees to the CTC had access to these CIA cables, but the

review and dissemination of source information to the FBI was not considered their

responsibility.

258
through direct knowledge or through the TDs, Max had access to only some of

the information obtained from the source during the debriefings.

In addition to the debriefings of the source by the CIA case officer, FBI

agents from the New York Field Office working Bin Ladel_L-related criminal

investigations also interviewed the source with the CIA case officer present.

Max occasionally was present for these interviews. After each of these

interviews, the New York agents documented the source's J[nformation in detail

in an FD-302 that was entered into ACS and retrievable by all FBI personnel

working on the Bin Laden cases. _98These FD-302s were routinely shared with

CIA personnel in the field and at the CTC.

c. Source identifies Khallad from Yemeni-provided

photograph

Over a 3-month period in 2,000, FBI New York Field Office personnel

interviewed tile source overseas four times. During one of these interviews, the

source described an individual known as "Khallad" as a trusted senior Bin

Laden operative with potential connections to the East African embassy

bombings.

As noted above, on October 12, 2000, two terrorists in a boat laden with

explosives committed a suicide attack on the U.S.S. Cole, a U.S. naval

destroyer, during its brief refueling stop in the port in Aden, Yemen. The

FBI's investigation into the attack was led by the FBI's New York Field

Office.

After the attack on October 12, the Yemenis provided[ the FBI and the

CIA with information onthe Bin Laden operative known a,; "Khallad."

According to this information, Khallad had been described as the purported

mastermind of the Cole attack. U.S. intelligence agencies had already

198When a witness is interviewed as part of a criminal investigation, the FBI prepares

an FD-302 todocument what was said in the interview. When information is being obtained

as part of an intelligence investigation, the FBI documents the information in an EC. There

was often a significant lag time between the interview and the completion of the

documentation due to a variety of factors, including the intensity of investigative activity,

the agents' extensive travel, and the required review of the document:ationby FBI

supervisors before dissemination.

259
connected Khallad to the East African embassy bombings. The Yemenis also

identified "Khallad" as Tawfiq Muhammad Salih Bin Rashid allAtash. On

November 22, 20,00, the Yeminis provided the FBI with a photograph of

Khallad ("the Yemeni-provided photograph"). Around this same time, the

Yemenis provided the FBI with several photographs of other Cole suspects.

r

The New York FBI agents investigating the Cole bombing wanted to

determine whether the Khallad identified by the Yemenis was the same

Khalladwho had been previously described by the source. At llhe same time, a

CIAinternal cable to was sent to several CIA offices suggesting that the

photographs of the Cole suspects that the FBI had obtained from the Yemenis,

including the Khallad photograph, be shown to the source. Because the FBI

did not have the technological capability to easily transmit the Khallad

photograph from Yemen to the ALAT who was handling the source and who

we call Max, the ]photograph was forwarded through CIA cha_aels to the

nearby CIA office in order to show the photograph to the source. 199

CIA documents show that on December 16, 2000, the CIA officer

conducted a debriefing of the source. Max was present for the debriefing. 200

During the debriefing, the CIA case officer showed the source :many photos of

Cole bombing suspects and other suspected Arab terrorists, including the

Yemeni-provided photograph of Khallad. The source immediately identified

the individual in the Yemeni-provided photograph as the same Khallad he had

previously described as a trusted senior Bin Laden operative with potential

connections to the East African embassy bombings.

The CIA officer prepared a cable documenting the debriefing, which was

addressed to several CIA offices. The CIA officer wrote in the cable that the

source was shown the many photographs and "quickly" identified Khallad in

199Max told the OIG that at the time he and the CIA case officer believed that this

photograph had come from the FBI's New York Field Office. Max added that it was not

uncommon for him not to know the source of photographs that were shown to the source

and that the source was shown hundreds of photographs.

2ooAlthough FBI agents from New York had traveled overseas several times in 2000 to

interview the source, in December 2000 the agents with the appropriate language abilities

were tied up in Yemen after the Cole attack and were unable to travel to debrief the source.

Therefore, the FBI relied on the CIA to conduct this debriefing.

260
the Yemeni-provided photograph. Notably, file CIA cable ..stated that the CIA

officer had the source repeat the identification specifically for the benefit of

Max. In addition, the cable stated that before the debriefing ended, the CIA

officer again showed the photographs to the source and asked the source to

verify the Khallad identification.

Max acknowledged to the OIG that he was contemporaneously aware of

the identification of Khallad in the Yemeni-provided photograph by the source

on December 16. Max stated that he recalled specific circumstances of the

debriefing and recounted them to us. Max told us that he recalled the source

immediately identifying Khallad in the photo[vaph.

d. CIA suspects that Khallad may be Miihdhar in Kuala

Lumpur surveillance photographs

Around this same time; CIA personnel were beginning to connect

Khallad with Mihdhar _l__lll. In a

December 2000 cable, CIA personnel overseas asked for copies of the January

2000 Kuala Lumpur surveillance photographs of Mihdhar. The cable noted

that further connections had been made between Mihdhar and A1 Qaeda. As a

result of these further connections, the CIA be.lieved there might be a

connection be,tween Mihdhar and the Cole perpetrators.

The CIA office reported in the December 2000 cable that the it had

learned that Fahd al Quso, who was in Yemeni custody for his participation in

the Cole attack, had received $7,000 from someone named Ibrahim, which

Quso had taken to Bangkok, Thailand, on January 6, 2000, to deliver to

• ',Khallad," a IYiend of Ibrahim's. It was noted in the cable that because

Mihdhar had .departed Kuala Lumpur around that same time to travel to

Bangkok, the CIA suspected that the "Khallad[" mentioned by Quso could

actually be Khalid al Mihdhar or one of his associates) °_ It:was noted further

that this information had "added significance" because KhaLllad had been

201As previously discussed, the CIA had reported previously in an internal March 2000

cable that Mihdlhar,Hazmi, and another individual had left Malaysia on January 8, 2000,

and traveled together to Bangkok.

261
identified as a "key operative likely serving as an intermediary between Usama

Bin Laden and the [Cole] perpetrators."

In another December 2000, cable the CTC concurred with the overseas

CIA office's theory and forwarded a Kuala Lumpur surveillance photo of

Mihdhar to the CIA case officer to show to the source. According to the cable,

the purpose was "to confirm/rule out this particular Khalid [Mi:hdhar] as a

match for [Khallad]. ''2°2 The next day, the CIA officer received permission to

show the Kuala Lumpur surveillance photographs to the source.

Max told the OIG, however, that he was not aware of the CIA cables or

the theory that Khallad was actually Mihdhar. We found no other evidence

that Max knew about the information that Mihdhar was at the Malaysia

meetings, or the CIA's theory that Khallad was actually Mihdhar. 2°s

e. Source identifies Khallad from Kuala Lumpur

photograph

The CIA case officer debriefed the source again in early January 2001.

At some point, the CIA case officer showed the source photographs, including

two of the surveillance photographs taken during 1LheJanuary 2000 Malaysia

meetings. One of the photographs from the Malaysia meetings, which we call

2°2The CIA cable referred to its forwarding of only one Kuala Lumpur surveillance

photograph,; although subsequent cables showed that the receiving office received two Kuala

Lumpur photograph,; to show the source. It is unclear why the sending office sent only two

of the photographs instead of all three of the Kuala Lumpur photographs it had.

2o3In fact, CIA cables suggest this information was not shared with tlm FBI. We saw

several CIA cables during this time that discussed working with the FBI in relation to the

FBI's investigation of the Cole attack. For example, we saw a December 2000 cable stating

that the FBI had provided an update on its investigation of the location associated with

telephone numbers tlae CIA had provided to the FBI in cormection with an investigation, and

the office that drafted the cable asked to be advised of whether the two offices to whom the

cable was addressed were aware of additional information that could assist the FBI.

However, we saw another December 2000 cable, which discusses Khallad and other

information not related to Khaliad, which specifically instructed two CIA offices to share

with the FBI the other information in the cable that was not related to Khallad, but it did not

instruct the offices to share the information regarding the possible connection of the

Malaysia meetings and Khallad.

262
) f

.!.

"Photo No. 1'" included an unknown subject. 1__

__ According to a January 2001, cable

written by the CIA case officer, the source was askedifhe was sure, and he

replied that he',was "ninety percent" certain. TM

, The second photograph from the Malaysia meetings, which we call

"Photo No. 2," contained a picture of the person the CIA knew to be Mihdhar.

The source could not identify the person in the,"photograph. :2°5

1

First, the source previously provided information that Khallad

was a Bin Laden operative who was connected to the ."Cole;attack and the East

African embassy bombings.

Thus, the som'ce's identification of Khallad atthe Malaysia meetings raised the

question whether Mihdhar and Hazmi also were linked to the Cole attack.

We tried to determine if the FBI's ALAT learned of tlhe source's

identification of Khallad in the photograph. Max told the OIG that he did not

specifiCally re,call the early January 2001 debriefing Qf the source.

The CIA case officer told the O!G that he had no independent

recollection of any particular meeting with the',source, including the meeting in

early January 2001.

204As noted above, information developed after September 11, 2001, revealed this was

a misidentification, and the person identified as Khallad was actually Hazmi.

205This failure to identify Khallad in the photograph known to be of Mihdhar should

have ended the theory that Mihdhar and Khallad were the same person.

263
,i

f. Documentation regarding the source's identification of

Khallad in the early January 2001 debriefing

(1) CIA cables

To examine whether the FBI learned of the ,;ource's identification of

_ , we reviewed the CIA

documentation concerning the meeting with the source in early January 2001.

In an internal cabi[e written the day after the debriefing, the CIA case officer

reported that the source had identified I__ll__ll_

with a "ninety percent" certainty. HOwever, unlike in the

December:2000 CIA cable, which stated that the CIA officer had the source

repeat the identification of Khallad in the Yemeni.-provided photograph to

Max, the January 2001 cable did not suggest the identification was repeated for

Max or was brought to the attentiOn of Max. The January 2001 cable did not _ :

provide any other details about the debriefing, such as where the meeting took

place, when exactly during the debriefing the photographs were shown to the

source, who was present when the photographs were shown to :Lhesource, or

what other topics were discussed with the source.

We also reviewed a detailed January 2001 CIA TD to the Intelligence

Community regarding the early January 2001 debriefing. The TD reported

specifics about w]hat the source discussed and that he had provided a stack of

documents to his CIA and FBI handlers. The TD made no mention of any

photographs being shown to the source __ll_l_1.2°6

A few days later, the CIA case officer wrote another cable describing the

logistics of the early January 2001 meeting with the source. In addition, the

cable summarizecl what was discussed during the meeting. This cable also did

not mention the photographs being shown to or discussed with the source, but

the CIA case officer told the OIG that these kinds of cables were not always

comprehensive with respect to the information obtained from the source.

206Although no witness can recall the details of this particular debriefing, it is possible

that Max, who lackeclthe appropriate language skills for a debriefing, either photocopied or

hand wrote the information from the documents thus explaining his absence at the time that

the photographs were shown to the source.

264
(2) FBI documents

We also reviewed FBI documents from this period relating to the source.

On January 9, 2001, a New York FBI agent Who was the FBI's lead case agent

on the Cole investigation sent Max an e-mail stating that he, and his co-case

agent wanted to meet with the source to talk about some of the Cole suspects,

including Khallad. The New York agent wrote that he Was "specially [sic]

interested in all [the source] knows about Khallad and his associates." The

agent noted that the source previously had given the agents important

information regarding Khallad and the Cole attack.

In a January 10 e-mail response, Max referred to the December 16

meeting with the source in which the source had been shown many

photographs and had immediately identified tile Yemeni-provided photograph

as Khallad. Max also mentioned the early January 2001 meeting, summarizing

specific 'information provided by the source in the debriefing. Max wrote that,

due to the lack of technological capabilities in the Legat Office, he promised to

make the CIA TD numbers relating to the source available _Lothe case agent

within a few Claysso the agent could read them before his nip to interview the

source. However, Max made no mention of any identificatiion of photographs

by the source in the early January. 2001 debriefing.

Around the same time as this e-mail exclhange, Max was criticized by the

head:of the FBI'sUBL Unit at Headquarters for insufficient reporting

regarding the source's information. The UBL Unit chief wanted toknow from

Max what infi_rmation the source was providing. She also was concerned

because Max was not producing any repOrts regarding the source.

. ,, In response, on January 16, 2001, Max wrote a 34-page EC summarizing

the source's debriefings and other information obtained from the source since

mid-2000, most of which was based on the information tha had been

disseminated in the TDs by the CIA. Max explained in the EC that he merely

was repeating what the CIA had previously reported in TDs, which had already

been forwarded to FBI Headquarters. He noted the agreement with the CIA

that there would not be duplicative reporting on the source's information. He

explained the CIA was doing the primary reporting on the source debriefings

Max noted that the interview was conducted in the foreign ]tanguage, and he

would read the CIA's report of the interview (the TD) once it was completed.

265
Max then listed all of the CIA's TDs that summarized what the source had

said.

On page 29 of this January 16 EC, Max summarized the CIA's reporting

of what had occmxed at the December 16, 2000, meeting with the source. The

EC stated the source was handed a stack ofmany photographs and immediately

identified thetop photograph as a photograph of _allad, the person the source

had previously implicated in the attack on the Cole. The EC stated, "At that

time it was the clear impression of [the Legat] and [the CIA officer] that both

FBIHQ CTD and NYO were receiving all of the reporting above from CIA

liaison in the U.S., as soon as it was being filed."

In the next paragraph of the EC, Max summarized what tlhe CIA had

reported in the TD about the early January 2001 debriefing of the source. This

summary is contained on pages 29 through 33 of the EC. Max reported at

length about the source's information, and the EC provided a lengthy

description ofthe documents provided by the source.

Max discussed with the CIA case officer the',complaint from FBI

Headquarters about Max's reporting on the source. As a result:, the CIA case

officer provided Max with a report of the next debriefing of the',source in late

January 2001. Tile day after this debriefing, Max prepared a lengthy EC

summarizingthis debriefing. He noted in the EC that the report was based on

the CIA's report of an interview conducted by a CIA officer and, although Max

was present for the debriefing, he only became aware of what was said after the

CIA officer provided the report. 2°7

2o7Around the same time, the CIA officer sent a cable to CIA Headquartersthat

described the FBI's need for reporting directly through FBI channels, as opposed to CIA

channels. The CIA office then asked permission to provide electronic copies of TDs to Max

so that Max could se,nd the same reporting through FBI channels.

266
g. New York FBI agents' interview of source on February

1, 2001

Around the same time, Max was preparing for the arrival of the Cole case

' agent from the FBI's New York Field Office. The Cole case agent was

traveling to interview the source about Khallad, along with another FBI agent:

who spoke one of the languages of the source and was going to assist in the

preparation of the FD-302 for the criminal• investigation. Max had received a

January 17 e-mail from one of the Cole agents', stating that the information

being provided by the source was very important to the FB]Z's criminal

investigation of the Cole attack and discussing the arrangements for the

upcoming interview of the source by the Cole agents.

• The New York Cole agents also asked Max to prepare an FD-302

documenting Max's personal knowledge of the source's identification of

Khallad from the Yemeni-provided photograph on December 16. On January

24, 2001, Max sent an EC to the New York Field Office and FBI Headquarters

with an attached FD-302 regarding the source's December 16, 2000,

identification of Khallad.

On February 1,2001, the New York Cole case agent _md another agent

who spoke one of the source's languages interviewed the source overseas. 2°8

The CIA case officer who had shown the Kua]ta Lumpur photographs to the

source in early January was also present at the interview. During the interview,

.they showed the source the Yemeni-providedphotograph of Khallad, which

previously had been shown to the source by the CIA officer on December 16,

2000. The source again identified Khallad in the photograph.

As discussed above, the agents had received information indicating that

Quso, who was in custody for his participation in the Cole attack, had traveled

to Bangkok and met Khallad in January 2000. The New York agents were

investigating llhe circumstances of that trip. The agents knew that Quso

previously had claimed that he had intended to meet Khallad in Malaysia. The

208In anticipation of the Cole agents' interview of the source, the CIA case officer had

sent a cable asking theBin Laden Unit to touch base with FBI Headquarters regarding the

case status and the planned trip of the New York FBI agents. The CIA case officer noted

that the source was "currently of very :highinterest to our [FBI] colleagues."

267
agents were concerned about Quso' s veracity and_

3. OIG conclusions regarding whether the FBI was aware of

the source's identification of Khallad in the Kuala Lumpur

photograph

Neither Max nor the CIA case officer

specifically recalled the early January debriefing, butthe documentary

evidence supports this conclusion. In numerous CIA and FBI documents

discussing the source and-the early January debriefing, other important

informationfromthe source is described,

,Given the

importance of that identification and the other details reported Jn the

\

268
documents, we believe such information would have been included had the FBI

been made aware of the identification. _

For example, as described above, in the CIA case officer's cable

reporting the ]December 16 debriefing of the source during which the source

had identified Khallad in the Yemeni photograph, the CIA officer specifically

noted that ALAT heard the identification and that the identification was

repeated for the benefit of him. lVlaxsaid he recalled this debriefing and the

identification of Khallad being brought to his ;attention by tlheCIA case officer.

By contrast, in his cable reporting the early January source debriefing,

the CIA case officer did notstate that he brought to the attention of Max the '

identification of__. Likewise in his

cable describing the logistics of the debriefing:, the CIA case officer provided a

description of what was discussed with the source and stated that Max was

present for a significant portion of the meeting with the source,

The documents prepared at the time by Max about the early January

debriefing also suggest that Max was not aware of the identification of Khallad

in the Kuala Lumpur photographs. For example, in response to the Colecase

agent's January 9 e-mail specific:ally requesting "all [the source] knows about

Khallad," Max did not include any information about the Khallad identification

from the Kuala Lumpur photographs. This was shortly after the early January

debriefing, and the case agent had specifically indicated his. interest in any

information about Khallad.

Max's January 16 EC to FBI Headquarters in which he described at

length what the source had reported in the early January meeting also did not

mention the identification of Khallad or that any __

were shown to the source. In addition, Max prepared an FD-302 to document

the source's identification of Khallad from the:Yemeni photograph to provide

documentation for the criminal investigation. We believe tlhatif Max had

known of the source's identification ofm[[mn__,

he likely would have prepared a similar FD-302 of that identification as well.

We also found that the New York Field Office agent's who interviewed

the source ow:rseas in February 2001 were not made aware of the early January

identification of Khallad. The agents insisted that they were completely

269
other

than the Yemeni-provided photograph. In addition, we found no documentary

evidence that the New York FBI agents were even aware

i Because the agents were keenly interested in Khallad and had

asked the source to confirm his identification of Khallad from the Yemeni

photograph, we believe the agents would have noted, remembered, and acted

upon any information regarding another Khallad identification. We also

believe that had the FBI known about the identification of

. .

, which could

have increased the FBI's chances oflocating them before the September 11

attacks.

Due to the OIG's lack of complete access to CIA employees and

documents, we were unable to fully examine why the CIA did not inform Max

or the New York agents that the source had identi:fied 1_

"_ i We believe the FBI

should have been made aware that the joint FBI/CIA source had provided such

significant inforrnation about the personpurported to be the mastermind behind

the Cole attack. This failure demonstrated significant problems in

communication between the FBI and the CIA. However, the FBI employees'

inaccurate belief that CIA reporting in TDs was comprehensive contributed to

the FBI's failure to obtain this critical piece of information. We discuss this

and other systemic problems that this case revealed in the analysis section of

this chapter.

D. FBI and CIA discussions about the Cole investigation in May and

June 2001

The fourth opportunity for the FBI to have acquired intelligence

information about Hazmi and Mihdhar- including Mihdhar's possession of a

U.S. visa, Hazmi's travel to the United States, and the source's identification of

__- oc,curred in May and June 2001

when the CIA and FBI Headquarters. discussed the stares of their information

concerning the Cole attack. Once again, these discussions could have caused

the FBI and the CIA to focus on the other persons attending Ill

270
_l, and there,by led the FBI to search for Mihdhar and

Hazmi earlier than it did. But, as we describe below, the FBI did not obtain the

critical inforrnation about the identification ofl__ll[

! despite several interactions in May and June 2001 between the FBI

and the CIA about Khallad.

1. Background

a. The Cole investigation

As discussed above, the FBI's investigation on the Cole attack was led by

the FBI's New York Field Office. 21°One of the case agents investigating the

Cole attack was an agent who we call "Scott," and who was assigned to the

New York FBI's counterterrorism squad that handled only al Qaeda

investigations (the "Bin Laden squad"). TM After serving eight years in the U.S.

Navy as a fighter pilot, in April 1996 Scott became a special agent in the FBI's

New York Office. In July 1996 he wasassigned to the TWA Flight 800

investigation because of his experience as a military pilot. Shortly after the

East African embassy bombings in August 19'98, he was trzmsferred to the New

York's Bin Laden squad to assist with the embassy bombings investigation,

and then was assigned as one of the case agents on the investigation the Cole

attack.

The New York FBI was assisted on the Cole investigation by several

Intelligence C}perations Specialists (IOS) assigmed to the UBL Unit and the

Radical Fundamentalist Unit (RFU)at FBI He,adquarters.

One of the primary IOSs who worked on the Cole investigation was an

IOS who we call "Donna." She had joined the FBI in 1988 as a clerk while she

completed her college education. After graduating from college in 1995, she

entered the FBI's language training program and became a Russian language

2_0Through. their work on the 1993 attack on the World Trade Center and the

subsequent discovery of the terrorist plot to attack New York landmarks, the New York FBI

became the primary office for the investigation of al Qaeda, eventually leading to the

indictment of Bin Laden in the Southern District of New York in November 1998.

211The other primary case agent on the Cole investigation was o_atof the country during

the events discussed in this section of the report.

271
specialist working on foreign counterintelligence :matters. In November 1997,

she became an InlMligence Research Specialist (IRS), and a year later was J

assigned to assist the RFU on the East African embassy bombings

investigation. In 2000 she was permanently assigned as an IOS in the UBL

Unit and was assigned to work on the Cole investigation in October 2000.

With regard to Donna's work on the Cole investigation, she stated that

she and the other UBL Unit IOSs conducted the investigation as directed by the

New York Field Office, sent out requests for information to other law

enforcement and intelligence agencies, obtained budget enhancements to

support the investigation, and perfor_med other duties in support of the

investigation. She and the other UBL IOSs often traveled to New York where:

they met with the Cole agents and worked on the investigation.

b. The wall and the caveat on NSA information

The information relevant to this section of the report includes NSA

information disseminated about Mihdhar in late 1!;)99and early 2000. As noted

in Chapter Two, bY the summer of 2001 NSA counterterrorism intelligence

information could[not be disseminated within the FBI without adhering to

certain procedures and protocols. At this time, the FBI was required by the

Department and t]heFISA Court to keep criminal: investigations, separate from

intelligence investigations, a policy which was commonly referred to as "the

wall." Information obtained from FISA intercepts; and search warrants had to

be screened by someone not involved in the criminal investigation and then

"passed over the wall" from the intelligence investigation to the criminal

investigation. The FISA Court became the screening mechanism for FISA

information obtained from al Qaeda intelligence investigations that the FBI

wanted to pass to criminal investigators.

As described in Chapter Two, in response to notification lihat there had

been many errors in FISA applications approved by the FISA Court, the Court

imposed additional restrictions before information could be shared. First,

based on the FISA Court's concerns about the errors in the FISA applications,

the FBI directed tlhat only intelligence agents were,'permitted to review FISA

intercepts and materials seized pursuant to a FISA warrant (called "FISAobtained material"') or any CIA and NSA intelligence provided to the FBI

based on information obtained through FISA search or intercept (called "FISAderived" material) without further Court approval. The Court required anyone

272
who reviewed the FISA-obtained or FISA-derived intelligence to sign a

certification acknowledging that the Court's approval was required for

dissemination to criminal investigators.

Because,,FISA-obtained information ofte,n was passed from the FBI to the

NSA and the CIA, the question was raised to the FISA Court whether the FBI

was required 1:oobtain certifications from all NSA or CIA employees who

reviewed the FISA-obtained material. The Court exempted the NSA and CIA

from the certification but required that the two agencies note on any

intelligence shared with the FBI if it was FISA-derived. This was referred to

as "a caveat."

When made aware of this requirement, the NSA reported to the

Department of Justice that for the NSA to determine in real-time which

counterterrorism intelligence that it had acquired was FISA-derived would

delay dissemination of the information. As a result, the NSA decided to

indicate on all[ its counterterrorism intelligence provided to the FBI as being

FISA-derived so that it could not be disseminated to criminal agents or

prosecutors without approval from the NSA. 212Therefore, when the FBI

, wanted to pass this NSA intelligence to criminal investigators, it had to contact

the NSA General Counsel's Office to determine whether the information was

in fact FISA-derived before it could be passed. 213

2. Discussions in May 2001

In May 2001, the potential connection o:f__

was again discussed by CIA persormel. FBI personnel also discussed

Khallad in reference to his nexus to the Cole attack. There were also

212According to the NSA, its average response time to FBI requests for approval to pass

information to criminal investigators was one to five business days.

213The NSA information concerning Hazmi and Mihdhar was from late 1999 and early

2000, and contained the initial caveat stating that information could not be disseminated to

law enforcement officials without approval from OIPR. By the time FBI Headquarters was

dealing with this information in the summer of 2001, the new caveat was being placed on

NSA reporting, and FBI Headquarters was operating under the understanding that the NSA

General Counsel had to approve dissemination of NSA counterterrorJ sm information .to

criminal investigators.

273
discussions betwe, en the CIA and FBI in reference., to the

such as

Hazmi and Mihdhar, were not addressed during tktese May discussions between

the FBI and the CIA.

a. John's inquiries about Khallad

Between the early January 2001 debriefing of the source and May 2001,

the CIA's focus on whether Khallad, the suspected mastermind behind the Cole

attack, had attended _ appears to have subsided. In May

2001, John, a former Deputy Chief of the Bin Laden Unit, who by that time

was detailed to ITOS in FBI Headquarters, had continuing concerns about I1

especially whether they had any nexus to tile Cole

attack. John also noted to the OIG that during this period the,re were

heightened concerns in the Intelligence Community about the tJflreat of an

imminent terrorist attack in Southeast Asia.

CIA records show that on May 15,2001, Jolm accessed the March 2000

cablestating that Mihdhar, Hazmi, and another person had traveled to Bangkok

from Malaysia on January 8, 2000. The cable also stated that Hazmi hadleft

Bangkok on January 15, 2000, flying from Bangkok to Hong Kong and then to

Los Angeles.

Around this same time in May.. John began inquiring about the Malaysia

meetings with a CTC analyst, who we call "Peter," at CIA Headquarters. John

said he knew that Peter had been "down in the weeds" and knew the "nuts and

bolts" of the Cole investigation because Peter had been assigned to prepare a

CTC report on who was responsible for the Cole attack.

Pete r told the OIG that his area of expertise and focus since August 1999

was the AraNan Peninsula. He said that because the Cole attack took place in

Yemen, he was assigned to develop an intelligence report on who was

2!4John told the OIG that in this detail to the FBI he acted as the CIA's chief

intelligence representative to ITOS Section Chief Michael Rolince. John stated that he did

not have line authority over anyone at the FBI and that his primary role was to assist the FBI

in exploiting information for intelligence purposes.

274
responsible for the Cole attack. He completed, his report in January 2001,

finding that UBL/al Qaeda was circumstantially tied to the .attack. 215Peter

stated that while working on the Cole report he regularly interacted with the

IOSs in the FBI's UBL Unit. By the spring 2001, he was no longer working

directly on the Cole attack, and had moved on to potential threats in Saudi

Arabia and Yemen. However, Peter said he had a continued interest in the

Cole information and continued to gather information on an ad hoc basis.

According to John, he and Peter discussed __1_, and

Peter provided him with a copy of the timeline of events related to the Cole

investigation that Peter had compiled as part of his work on. the Cole attack._.

In addition, John saidthey discussed

John and Peter were awarethat Quso had •stated that he was

supposed to take money to a person named "Kha!lad" [mlll_ but had met

him in Bangkok instead in January 2000. Jol-m told the OIG that Peter had

posited that perhaps

In an e-mail to Peter in mid-May 2001, John noted that Mihdhar had

•arranged his travel to Malaysia and was associatedwith

.217 In

addition, John wrote that he was interested because Mihdh_x was traveling with

two "companions" who had left Malaysia and gone to Bangkok, Los Angeles,

and Hong Kong and "also were couriers of a sort." John noted in the e-mail

• 215 The report did not mention Mihdhar's visa, H_;tzmi'stravel to the United States n

217ASpreviously discussed, after Quso was detained in Yemen, he acknowledged that

he had received $7,000 from someone named Ibrahim, which Quso asserted he took to

Bangkok, Thaikmd on January 6, 2000, to deliver to "Khallad," a friend of Ibrahim's.

Mihdhar had traveled to Bangkok on January 8.

275
that "something bad was definitely up." Peter replied in an e-mail dated May

18, "My head is spinning over this East Asia travel. Do you _tow if anyone in

[the CIA's Bin Laden Unit] or FBI mapped this?"

b. Discussions among FBI and CIA employees

Around this same time, FBI IOS Donna and other FBI IOSs working on

the Cole investigation were focusing on Quso's connection to Bangkok and his

trip to deliver money to Khallad. The FBI, like the CIA, was aware that in

January 2000 1 l_/_l/

:l According to an FBI document drafted by Donna in May 2001, Quso

had claimed that on January 6, 2000,.he and Ibrahim A1-Nibras went to

Bangkok first but were unable to travel on to Kuala Lumpur because of

problems with their travel documents, and Khallaclhad travelecltoBangkok to

meet them there instead. The FBI began researching telephone numbers that

appeared to be connected to Qus0's trip and requested that several Legat

Offices contact local law enforcement authorities to obtain subscriber

information.

Donna told the OIG that she and others were tracking the information

related to the telephone numbers associated with Quso in an attempt to

determine the truth of his statements. In addition, she said that she was focused

on the identity and whereabouts of Khallad, since he was the purported

mastermind of the Cole attack.

At somepoiint before the end of May 2001, John discussed with Donna

the East Asian travel of Quso. In response to Pete,r's May 18 e-mail that asked

whether anyonehad "mapped" the East Asia travel, John replied in anundated

e-mail that "key travel still needs to be mapped" and stated "[D,onna] sounds

really interested in comparing notes in a small forum expert to .expertso both

sides can shake this thing and see what gaps are common."

In addition to reviewing the East Asia travel of several Bin Laden

operatives in January 2000, ___1_

John obtained three of them. John told the OIG

that he had not read the cable stating that the joint source had identified

Khallad in the photographs, but he was aware that an identification of Khallad

in the photographs had been made. At the end oflhis e-mail to Peter, John

stated that he had obtained three surveillance photographs of Mihdhar in

276
Malaysia, but he did not see "Khallad" in any of the photographs,

218

In response to John's e-mail, Peter wrote in an e-mail dated May 24 that

he had thought one of the ___. Peter added

that Donna and another FBI IOS in the UBL Unit, who we call "Kathy," were

meeting with Peter on May 29 to discuss the Cole investigation.

_ On May" 24, Donna sent John an e-mail ..stating that a :meeting with Peter

and others was "tentatively scheduled" for May 29 for "an :in depth discussion

about the Cole."

We were unable to determine with certainty whether a meeting with

Peter, Donna, and Kathy actually took place on May 29. None of the witnesses

had notes of any such meeting, nor were there any e-mails discussing the

meeting after it would have taken place. The witnesses told the OIG that they

could not recall whether a meeting took place on May 29. For example, when

asked whether she knew Peter, Kathy told the OIG that his name sounded

familiar and tlhat she may have met him, but s]he did not recall a meeting on

May 29, 2001, about the Cole investigation. A May 29 e-mail from Peter to

Mary indicates that he met with Mary earlier in the day, bu_ it does not identify

the other participants or what was discussed.

2_8As noted above, John was correct- Khallad was not in any or"these three

photographs. After September 11 it was learned'that the person the sourcehad identified as

Khallad was actually Hazmi.

277
However, it is clear that at some point before the end of May 2001,

Donna became aware of the existence of the Kuala Lumpur photographs in

January 2000. Donna told the OIG that she recalled John printJing one of the

CIA photographs on the printer in his office at FBI Headquarters, and Donna

acknowledged that she obtained two other Kuala Lumpur photographs from

him. According to Donna, Peter had raised the photographs in a discussion

with her prior to her obtaining the photographs from John, although she said

that she did not recall the details of their discussion about the photographs.

Donna said she did recall that, at the time, Peter had posited that one of the

photographs could relate to Quso, which if true would contradict Quso's

statements about going only to Bangkok and not going to Malaysia. According

to Donna, the FB][was attempting to determine the veracity of Quso's

information, so the photographs potentially were connected to the Cole

investigation. She stated, however, that outside of this potential connection,

the photographs were "another piece of a thousancl things coming in" at the

time. She said that if Quso were determined to be,in the photog-raphs, then the

photographs wou]td have become significant to the Cole investigation.

Donna also told the OIG that she did not recall a "substantive

conversation" with John about the photographs or the Malaysia meetings.

Donna told the OIG that she wrote on the back of the photographs what John

told her about the photographs, which included that "Khalid A1-Midar"

traveledfr0m Sana, Yemen, via Dubai, to Kuala Lumpur on Jmluary 5, 2000,

and he :wasin Kuala Lumpur between January 6 and 8. She also wrote Khalid

Mihdhar'S_name on the back of the photograph in which hehad been identified.

Donna also said that no one told her that Mihdhar had a U.S.

visa or that Hazmi had traveled to the United States.

John told the OIG that he did not recall anything about his discussion

with Donna when he printed the Kuala Lumpur photographs for her. John said

he recalled that at the time the FBI wastrying to "nail down Quso's story,"

278
John emphasized that the FBI was focused on the Cole investigation, not

the Malaysia meetings.

Peter toJ[dthe OIG that he recalled talkingto FBI IOSs, including Donna,

about mapping the telephone number information based on information

provided by Quso.

.. : . .

..

3. June 11, 2001, meeting

a. Planning for the meeting

Around the same time that Donna was discussing Quso and the Cole

investigation 'withPeter and John, she alsowas planning a meeting at theNew

York FBI Office to discuss the Cole investigation. The planned participants

for the New York meeting included personnel from FBI Headquarters, the

•CIA's CTC, and the New York FBI agents working on the ,Cole investigation.

FBI documents show that Donna began organizing the meeting as early as

May 24.

There was no record of an agenda for the meeting, and no supervisors

were involved in the preparation for this meeting or were consulted regarding

what should be accomplished at the meeting. Donna told the OIG that she

organized the meeting in an effort to consolidate information and determine

what further action was warranted on the Cole investigation. She stated that

the purpose of the meeting at the New York FBI Office was to address

unresolved is,;ues and produce additional leads or other activities focusing on

279
the Cole investigation. According to a May 24 e-mail by Donna, the meeting

was "to discuss our direction, particularly as it relates to Nashifi. ''219

Donna stated that she planned to take the Kuala Lumpur photographs

with her to New York to find out whether the New York FBI Cole agents, who

had met and debriefed Quso, could identify him in the photographs. She said

that if Quso was in the photographs, the FBI would have reason to question

Quso's statement that he had not gone to Malaysia but had met Khallad in

Bangkok instead.

Sometime after obtaining the Kuala Lumpur photographs from John, _

Donna queried CTLink for the name Khalid al-Midhar [sic], which John had

provided to her and which she had noted on the back of one of the

photographs. 22°In CTLink she discovered the NSA information from late 1999

and early 2000 referencing Mihdhar's planned travel to Malaysia and

She also queried ACS about Mihdhar but did

not obtain any additional information about him.

Mary, an FBI detailee to the Bin Laden Unit who worked as a CTC desk

officer, also attended the June 11 meeting, as did Peter, the CTC analyst.

According to Mary, Donna invited her to the meeting and told her the meeting

was intended for information sharing and as a "brainstorming session"

concerning the Cole investigation. Mary told the OIG she had :recently been

given the assignment by CTC management of',getting up to speed" in her

spare time on the

Mary said that she had not

yet begun reviewing the Malaysia meetings at the time of Do_La's invitation.

219Abdul Rahim al-Nashiri was al Qaeda's chief of operations in the Persian Gulf and

was suspected to have been involved in the attack on the Cole. According to Donna, at the

time he was believed[ to be the "on-scene commander" for the Cole attack:, and the IOSs had

been assigned the tas;k of trying to locate him based on the intelligence reporting on him. He

has since been arrested outside the United States.

22oCTLink is a database administered by the CIA and used to disseminate information

within the Intelligence Community.

280
According to Peter, the meeting was also described to,him as an

"information sharing and brainstorming session" to determine whether any

further leads should be pursued. Peter said that he heard about the meeting

from Mary and contacted Donna about attending because he was interested in

learning what the New York FBI agents had uncovered in tlheirinvestigation of

the Cole attack.

According to FBI personne,1 in New York, Donna told them that FBI

Headquarters and CIA personnel had indicated they had "information to share"

regarding the Cole investigation. The FBI New York pers_z,nnelanticipated the

meeting would be a mutual exchange of information. Scott, one of the New

Yorkcase age,nts on the Cole investigation, said he was told that the CIA

representatives who would be attending the meeting wanted a briefing on the

Cole investigation. On his own initiative, Scott arranged for David Kelley, an

AUSA from t]heSDNY who was assigned to tlheCole matter, to discuss with

the CIA representatives other issues related to the Cole investigation, one of

which was the impact on the prosecution if some of the targets of the Cole

investigation 'were captured or detained outside the United States.

b. The June 11 meeting

On June:11, the meeting was heldin a conference room at the FBI's New

York Field Ot'fice. We could not determine with certainty :tll the participants

at the meeting. There was no list of attendees.,and the witnesses could not

recall exactly who was there. However, we confirmed that Donna, Mary,

Peter, Scott, and another New York agent assigned to the Cole investigation

who we call "Randall," attended. AUSA Kelley attended %r part of the

meeting. Although it was unclear exactly how long the meeting lasted, the

witnesses said it lasted between two and four hours.

In inteawiews with the OIG, the attendees said they did not recall the

specifics of what was discussed at the meeting. The only contemporaneous

notes from the meeting that we were able to obtain were Donna's. Her notes

indicate that the latest developments in the Cole investigation were discussed.

The second page of the notes is labeled "to do" and referenced several items.

Randall said he recalled that at the beginning of the meeting, Scott gave

an update of the results and status of the investigation. Mary said she recalled

that the attendees "brainstormed" various issues, but she did not recall any

281
significant ideas being developed during the meeting. Peter said he recalled

that the New York agents "railed" about the U.S. Ambassador 1:oYemen and

the lack of cooperation they believed they were receiving from the Yemeni

government. At some point during the meeting, AUSA Kelley discussed the

feasibility of prosecution in the Cole case.

Toward the end of the meeting, Donna produced the three Kuala Lumpur

surveillance photographs and asked the agents if tlhey recognized Quso in any

of thephotographs. Donna said she told the agents that the photographs had

been taken in Malaysia around the Millennium. Donna said she provided

Khalid al Mihdhar's name to at least some ofthe agents present.

'.21 The witnesses' accounts of what

happened next differ.

_'

Scott told the OIG that after reviewing the Kuala Lumpur photographs, • ,

the FBI agents began to ask questions, such as whether there were additional

photographs or information concerning the backgn'ound on the photographs,

including questions about Mihdhar, who was in the photographs. According to

Scott, he pressed Donna and Peter for details of the Malaysia meetings.

Scoit contended that Donna "refused _' to provide any furt]her information

about the photographs or the Malaysia meetings due to "the wall." Scott told

the OIG that he previously had numerous conversations about the wall with

Donna, which had been an issue between them. Hie stated that ,:luring this June

11 meeting, he disputed that the wall was applicable to the information at hand

because the photographs had not been obtained as the result of a FISA Court

order, and he continued to press Donna for more information. Scott said the

meeting degenerated into an argument about the wall.

221Only a limited number of New York agents had actually met Quso. The others

had only seen photographs of him.

282
In his initial OIG interview, Scott described the meeting as very

contentious and combative. 222In a second OIG interview, although Scott did

not characterize the meeting as having the same level of combativeness, he

contended that he pressed Donna for more intbrmation but none was

forthcoming. Scott stated he had heated telep]hone conversations and e-mail

exchanges with Donna over this issue after the June 11 meeting.

Donna, Mary, and Peter described the showing of the Kuala Lumpur

photographs as a sidebar to the main meeting and generally inconsequential.

All three asserted that neither the display of the surveillance photographs nor

the meeting overall was contentious. Although Donna agreed that the FBI

agents asked further questions regarding the origin of the p]hotographs and

asked for addiitional information regarding the Malaysia me,etings, she '

c_ontendedthat she responded simply by saying she did not know anything

further. She told the OIG that these questions made sense to her when they

Were asked, but she did not know the answers.i She stated that someone asked

what kind of passport Mihdhar was traveling on, and Peter responded that it

was a Saudi passport. 223According to Donna, she had not lmown this

information prior to Peter stating it. Donna told us that this.was the only

information volunteered by Peter, and she believed he woulLdhave provided

additional infi_rmation if he knew it.

Peter told the OIG that he was not asked any questiol_Sat the June 11

meeting, he had no formal role, and he did not brief anyone on anything at the

June 11meeting. Peter explained that it is not within his purview or authority

as an analyst 1:0share CIA information. He said he did not recall the meeting

becoming heated or contentious. He said he did not recall _mytime during the

222When we asked Scott whether an intelligence-designated agent could have been

provided the infc)rmation outside the presence of the criminal agents, Scott agreed that could

have been done, but he did not think of it at the time and no one else suggested it. During

his subsequent testimony before the Joint Intelligence Committee, however, Scott said that

the wall must not have been at issue because the criminal agents could have just left the

room and any information could have been related to an intelligence agent.

223Donna's contemporaneous notes reflect this information. It appears as the last entry

on the notes, indicating that this was discussed at the end of the meetiing.

283
meeting where Donna said, "I can't answer that question" or directly refused to

answer a questiorlL. 224

Mary stated that she had not been "up to speed" on the case at this time,

so she was not in a position to provide information at the meeting. She stated

that She and Peter were not asked any questions during the meeting. She said

that she did not re,call any serious disagreements arising during the meeting.

According to Donna, she remained in New :fork after the meeting,

without Peter and Mary, and she continued the discussions with the New York

agents regarding the photographs after the meeting. She said that these

subsequent conversations became fairly "heated," as the agents pressed her

with questions such as whether there were additional photographs and any.

documentation about the photographs. 225

Donna told the OIG she had provided to the agents all the information

she had received :fromthe CIA regarding the photographs. She told us that all

she knew was that these three photographs were taken in Malaysia around the

Millennium, and one of the persons iinthe photogn,aphs was someone named

Khalid al Mihdhar. Donna stated she advised the agents of this: and told them

that efforts would be made to obtain the requested[ information. She said she

was not aware that there would have been additional information to provide.

She added that she recalled having the impression that the agenLtsdid not

believe her when she said that she did not have the information about the

photographs that the agents were requesting.

As discussed earlier, however, Donna had aclditional NSA information

about Mihdhar that she had discovered through her CTLink query.

Donna told us that she

224AS described earlier, Peter and John had exchanged several e-mails about the

Malaysia meetings and the photographs. However, it is unclear based upon the information

available to us exactly what Peter knew at this point. He said he was unable to remember

exactly what additional information he had on June 11, 2001.

225We believe it likely that the agents were confusing: the post-meeting discussions with

the showing of the photographs at the meeting.

284
could not provide this information directly to llheagents werking the Cole

criminal inve,;tigation due to the caveat, which prevented all1NSA

counterterrorism-related intelligence information from being provided to FBI

criminal agents without approval from the NSA. 226

Donna told us that the New York FBI primarily worked criminal

terrorism investigations and the sharing of intelligence information with the

criminal agents was' often an issue. She said tlhatsome of the New York agents

had become "overly sensitive" about a perceived lack of information sharing.

Donna emphasized that any information could be shared but often a process

had to be followed before certain intelligence information could be shared with

agents working criminal investigations. She added that it was not her job to

keep:information from the agents but instead to ensure they had the tools

necessary to do their job.

According to Donna, the only issue regarding the Illlm_

photographs would have been obtaining pernxission from the CIA to allow

individuals outside of the FBI to see the photographs in furtherance of the Cole

investigation, such as in interviews conducted in Yemen. 227Donna said at

some point wlhile she was in New York, she and the agents discussed providing

the photographs to the agents workingin Yemen in order to get a positive

identification of Quso in the photographs and to conduct further

investigation. 228She stated that ,;hetold the agents that she would attempt to

obtain the requisite permission to provide the photographs li0the agents

working the Cole investigation in Yemen.

226It is important to note, however, that this NSA information originally had been

routed not only to FBI Headquarters but also to the New York FBI Office in late 1999 and

early 2000.

227A policy in the Intelligence Community, which is designed to,protect intelligence

sources and methods, is that the originator of intelligence information controls the further

dissemination of the information. This policy is described as origina_Iorcontrolled, or

"ORCON." Dissemination of ORCON information requires permission from the originating

agency to further disseminate the information outside the receiving agency.

228Apparently unbeknownst to the involved FBI and CIA persormel, the Yemeni

authorities already had been given the photographs on January 3,2001, six months before

anyone at the FBI received the photographs.

285
Although she had no explicit discussion witla John regarding the use of

the photographs, ]Donna stated she understood that the photographs were "not

formally passed" to the FBI when John gave them. to her, but only provided for

limited use in the meeting. Therefore, Donna said she did not believe that she

could leave the photographs with the,,New York agents until the requisite

permission to show the photographs outside of the,FBI had been obtained.

However, John told the DIG that that since the photographs had been

given to Donna, an FBI employee, they could be thrther distributedwithin the

FBI. John agreed that the photographs could not be used by the FBI in any

manner where they would be disclosed to a foreign government. For example,

he said that without approval from the CIA, the FBI agents could not keep the

photographs and ,;how them to Quso, who was in Yemeni custody, because

Yemeni officials also would see the ]photographs.

c. Follow-up after the June 11 meeting

We looked for evidence as to whether Donna or the New York agents

conducted any follow-up efforts about the,llll I photographs or

obtaining permission from the NSA to pass the intelligence information to the

New York agents. Donna said that she "probably" had follow-up

conversations with John, Peter, and Maryabout the photographs, but she did

not specifically recall the conversations or obtaining additional information.

Mary told the DIG that she recalled conversations with Donna about obtaining

permission for the FBI to use the photographs of the Malaysia meetings in their

investigation.

Donna stated she was not contacted by Scott after the meeting, although

she was working ,with another agent on the squad, who we call "Glenn," in

connection with tracking telephone toll records. Those records related to the

Cole participants, the travel of Quso to Bangkok, and Quso's potential travel to

According to Scott, over the course of the summer, he had several more

conversations witlhFBI Headquarters asking about any additional information

on the __, but he wasnot provided any additional

information. He stated that he did not seek assistance from any supervisor in

obtaining additional information. He told us that he and the rest of the New

York Field Office,,had been fighting a battle with FBI Headquarters over

286
information sharing for months, and he was "dumbfounded" that he could not

obtain the information about the __|. He stated that in

hindsight he probably should have sought the intervention of a supervisor.

Documentary evidence shows that, as a result of the June•11 meeting,

Donna and the New York agents discussed the__ in

several follow-up conversations. In an e-mail dated August 22 from Donna to

Glenn, she wrote that there were additional photographs of the Malaysia

meetings and that the reason that:Mihdhar was of interest at the time was

because of some threat information that led to the CIA looking at all persons

named "Khalid." In addition, she wrote that Shehad received assurances that

the FBI would be able to use the __| outside the FBI,

We discuss this e-mail in further detail in the next section.

Documents also show that on August 27 Donna requested permission

from the NSA to provide the intelligence infol_ation about Mihdhar to the

New York Cole criminal agents. However, this request came after the FBI had

discovered on August 22 that Mihdhar might be in the United States and had

opened an investigation to determine whether he was in the country. We

discuss the events that led to that investigation and the investigative efforts of

the FBI in the nextsection of the report.

4. OIG conclusions on May and June discussions

While there were several interactions between FBI and CIA personnel in

May and June',2001 that could have resulted in theFBI learning more about the (

__i and Mihdhar, the FBI personnel did not become

aware of signiificant intelligence information about Mihdhar and _

_1. The fact that Mihdhar had possesseda United States

visa was not disclosed at this tirne by the CIA to Donna or l_heFBI. The fact

that Hazmi had been at the Malaysia meeting and then traw:led to Los Angeles

also was not disclosed by the CIA. In addition, the fact that the source had

identified Khallad, thepurported mastermind of the Cole bombing, from the

__ was not disclosed during these

interactions.

Although Donna knew about the nl/m__

we do not believe that she was informed that Mihdhar had a U.S.

visa or that Donna's

287
contemporaneous notes on the back of the mimm__ reflect

the limited information that she had obtained about the photographs and the

Malaysia meetings. The notes do not mention anything about ]Vlihdhar's

possession of a U.S. visa. In addition, Donna stated that she was aware of the

significance of IZdhalladto the Cole investigation, but the notes on the

photographs also do not mention Khallad. Moreover, John£ who provided the

photographs to Donna, told the OIG he did not recall discussing the i

_n withher, and he did not believe that he would have

discussed with Donna that-___,

because at the tirne he was not sure that this was true and he thought the

information was "speculative." Although an e-mail message indicated that

..

Peter was planning to discuss the Khallad identification with Donna in a

meeting on May 29, we were unable to determine that this meeting actually

occurred.

It was impossible for us to determine exactly what happened at the

June 11 meeting with respect to the __1 because the

witnesses cannot recall the specifics of.the discussions and there is little

documentary evidence. It is clear, however, that the information regarding

Mihdhar's U.Si visa and the fact that ___

was not discussed at the June 1l meeting..

Donna told the agents about the photographs and provided them limited

information that she had obtained from the CIA about'the photographs. Most

of the questioning about the photographs took place after the meeting, when

Peter and Mary had left. We believe those interactions after the meeting

became very contentious, with the New York FBI wanting more information.

Donna did notprovide the New York agents with the NSA intelligence

information about the Mihdhar's

which she obtained through

her research. She,said she did not because of the restrictions placed on sharing

such NSA information. As we discuss further in the next section, Donna

subsequently contacted the NSA in reference to having the NSA information

passed to the agents, but this did not occur until much later, on August 27,

2001.

We found little attempt by either the FBI agents or Donna after June 11

to follow up on the information about the photographs that was discussed at the

meeting. There is little evidence of follow-up until some time iinAugust 2001,

288
when, as we discuss in the next section, the FBI learned that Mihdhar had

recently entered the United States, and theFBI opened an investigation to

locate him.

The interaction between the CIA and the FBI in May and June 2001 was

another failed opportunity for the FBI to obtain the critical information about

Mihdhar and Khallad. The failure of the FBI to learn about Mihdhar, ll[

_l_l, and his travel to the United States at that time

demonstrated significant problems in the flow of information between the CIA

and the FBI. We discuss these deficiencies in the analysis section of this

chapter.

p

E. The, FBI's efforts to locate Mihdhar in August and September

20011

The fifth and final opportunity for the FBI to locate -Mihdhar and Hazmi

occurred in late August 2001, when it was infi)rrned that Mihdhar and Hazmi

had traveled to the United States. The FBI learned in August 2001 that

Mihdhar had entered the United States in July 2001 and that Mihdhar and

Hazmi had previously traveled together to the United States in January 2000.

On August 29, the FBI began an investigation to locate Mihdhar, but it did not

assign great urgency or pri0rity to the investigation. The New York FBI

criminal agentswho wanted to participate in t]he investigationwere specifically

prohibited from doing so because of concerns about the wail1and the

procedures to keep criminal and intelligence investigations separate. The FBI

did not locate Mihdhar before the September ]L1 attacks.

We review the facts surrounding the FBI's discovery of this information

about Mihdhar and Hazmi and what the FBI did with this information in

August. We also examine the FBI's unsuccessful efforts to locate Mihdhar

before the September 11 attacks.

1. Continuing review of the Malaysia meetings in July and

August 2001

As discussed above, John, the CIA Bin Laden Unit Deputy Chief, was

detailed to the,,FBI's ITOS in May 2001. SholXly before assuming his duties at

the FBI, John had asked CTC management to assign a CTC desk officer with

"getting up to speed" on the Malaysia meetings and determJining any potential

289
_ ___1|. This

assignment wasgiven to Mary. She told the OIG that "getting up to speed"

meant she would have to research and read the pertinent cable lxaffic as her

schedule permitted. She emphasized that her priority assignment during this

period was the credible threats of an imminent attack on U.S. personnel in

Yemen, and she said that she worked the Malaysia meetings connections to the

Cole attack whenever she had an opportunity.

In early July 2001, based on recent intelligence information, the CIA had

concerns about the possibility of a terrorist attack in Southeast Asia. On July 5,

2001, John sent an e-mail to managers at the CTC's Bin Laden Unit noting

"how bad things look in Malaysia." He wrote that there was a potential

connection between the recent threat information and information developed

about the __. In addition, he noted that in

January2000 when Mihdhar was traveling to Malaysia,

Therefore, he recommended that the Cole and be reexamined for potential connections to the current :threat information involving

_. He wrote, "I know your resources are strained, but if we can prevent

something in SE Asia, this Would seem to be a productive place to start." He

ended the e-mail bystating that "all the indicators are of a mass;ively bad

infrastructure being readily completed with just one purpose in mind."

On July 13, John wrote another e,mail to CTC managers ..statingthat he

had discovered the CIA cable relating to the source,s identification of

Jolmbegan the e-mail by announcing "OK.' This is important." He then

described Khallad as a "major league killer who orchestrated tl_eCole attack

and possibly the Africa bombings." The e-mail recommended revisiting the

especially in relation to any potential information on

Significantly, John ended the e-mail asking, "can this [information]

be sent via CIR to [the FBI]?"

Despite John's recommendation that this infbrmation be forwarded to the

FBI in a CIR, we found no evidence indicating that the CIA provided this

information to the:FBI until August 30, 2001, which, as we describe below,

was after the FBI learned about Mihdhar's presence in the United States.

290
In a response e-mail dated .July 13,2001, a CTC Bin ]Laden Unit

supervisor stated that Mary had been assigned to handle the,request for

additional information on the Malaysia meetings. In addition, the e-mail stated

that another FBI detailee to the CTC, Dwight, who was out of the office at the

time, would be assigned to assist Mary upon his return.

Later in July, Mary drafted a cable to another CIA office requesting

follow-up inf0rmationabout the Malaysia me_;tings.

A week later, the CTC supervisor :forwarded the cable

to John for his review prior to release, and the cable was sent to the office to

which it was addressed three days after that.

On the same day she drafted the cable re,ferencing the,source's

identification of Khallad, Mary located one of' the CIA cables referencing

Mihdhar's possession of a U.S. visa. On the same date, Mary also reviewed

the CIA cable: that stated this visa information had been passed to the FBI in

January 2000..229

_ August, In an e-mail MaryonandAugust Donna7 from continued Donnatotodiscuss Mary,theDonna requested

a copy of the flight manifest for Mihdhar's January 2000 _[p to Malaysia in

order to determine whether ]]mm[had traveled with Mihdhar. She also asked,

"if we could get the pictures cleared to show |_]]m." 230She continued, "the

reasoning behind this would be that first, we do not have a concensous [sic]

that the individual with Midhar [sic] is in fact:_... [second] to

determine if|_]l can identify Midher by an other [sic] name." Donna then

discussed her continuing efforts to track telephone number information

developed in the investigation. At the close of the e-mail, Donna wrote, "I plan

to write something Up, but perhaps we should schedule another sit down to

compare notes on both sides. Let me l_now."

229As discussed above, we found no evidence that this information had, in fact, been

provided to the FBI.

23oApparently the desk officer was unaware that clearance had been received and that

the photographs had been shared with Yemeni officials.

291
In a response e-mail on the same date, Mary wrote, "okay, all sounds

good." Mary also wrote that she thought Donna had Mihdhar's flight manifest

because John had mentioned it, but Mary indicated she would tind the

manifest. She wrote, "I think we will be able to c]Learthe pictta'es, they are for

passage to Quso, :right?" Mary also asked whether the FBI would be able to

meet with Quso again. Mary ended the e-mail, "I think a sit down again would

be great" and mentioned the potential logistics of arranging the meeting.

In another e-mail exchange on August 7, Derma thanked Mary and

advised her that the FBI would again have access to Quso. Dolma continued

by stating that :the:_ alsowould be passed to a

foreign government because Quso was currently in its custody. She stated that

John could call if he had any questions. Donna tentatively scheduled a meeting

with Mary at FBI Headquarters on August 15,2001. However, it appears that

the meeting did not take place. TM

2. Discovery of Mihdh_r's entry into the United States

On August :21,Mary located the CIA cables referencing ttazmi's travel

to the United States on January 15, 2000. 232Mary checked with a U.S.

Customs Service :representative to the CTC about Hazmi's and Mihdhar's

travel. She discovered that Mihdhar had entered the United States on July 4,

2001, and had not departed. In addition, she confirmed that Hazmi had

traveled to the United States in January 2000.

Mary immediately relayed to Donna in a voicemail message on _

August 21 that Mary had something important to discuss with her. Donnawas

on annual leave on August 2i. Mary told the OIG shedid not have an

/

231Mary told the OIG that she took a week of annual ]leaveduring August, which she

thought was during that week, and she thought that the meeting therefore ihadnot occurred.

Although the e-mail references a meeting, Mary and Donna both told us that they had no

recollection of any meeting on August 15 or any one prior to August 22.

232Mary was copied on an e-mail from John to Peter in mid-May, 2001, in which John

discussed the travel of Mihdhar and others who appeared to be "couriers on a sort." In this

e-mail John stated, among other things, that "Nawaf' [Hazmi] had traveled with someone ..

from Bangkok to Los Angeles to Hong Kong. Mary stated to the OIG that she received this

e-mail before she was "up to speed" on the Malaysia meetings.

292
opportunity to focus on the Malaysia meeting,; until August, but upon

discovering on August 21 that Hazmi had traveled to the United States "it [the

importance of the information] all clicks for me."

On August 22, Mary met with Donna at FBI Headquarters and informed

her ofMihdhar's July 4 entry and Hazmi's travel to the United States in March

2000. 233 Donna verified in INS indices Mihdhar's recent entry. She also

learned that both Mihdhar and Hazmi had entered the United States on January

15, 2000, and that they were allegedly destined for the Sheraton Hotel inLos

Angeles, California. The INS records showed Mihdhar had departed the

United States from Los Angeles on June 10, 2000, on Lufthansa Airlines. No

: departure record could be located for Hazmi. An INS representative advised

Donna that de,parture information often was not captured in INS indices. TM

Therefore, she incorrectly surmised Hazmi had also departed on June 10,

2000. 235

Further INS indices checks; confirmed Mihdhar had re-entered the U.S.

on July 4, 2001, at the JFK Airport in New York, allegedly destined for the

"Marriott hotel" in New York City. By the terms of his entry, Mihdhar was

authorized to remain in the United States until October 3,2001. The INS had

no record indicating Mihdhar hacl departed the United State,s as of August 22,

200I.

Mary and Donna met with John on August 22 in his office at FBI

Headquarters to discuss their discovery that Mihdhar recenl_ly had entered the

United States and there was no record of his departure. All of them said they

could not recall the specifics of the conversation, but all agreed that they

233There is some discrepancy in witness statements on whether this meeting occurred

on August 22 or August 23. Although it is unclear on which date this;meeting occurred, we

believe the meeting occurred on August 22, 2001.

234The problem of INS departure records not being complete or :accurateis described in

an August 2001 OIG report entitled "The Immigration and Naturalization Service's

Automated 1-94System."

235Investigation conducted after September 11 found that Hazmi had remained in the

United States.

293
realized it was important to initiate an investigation to determine whether

Mihdhar was still in the UnitedStates and locate him if he was,

On August 22, 2001, Donna sent an e-mail to the New York FBI Special

Agent who we call "Glenn." He'was one of the agents assigned to the Cole

investigation.: In the e-mail, Donna advised Gleml that she had obtained

Mihdhar's flight manifest. Donna also wrote, "the reason they [the intelligence

community] were looking at Midhar [sic] is relatively general -- basically they

were looking at all individuals using the name Khalid because of some threat

information." Sigqaificantly, the e-mail also advised that the CIA had

addifionalsurveillance photographs beyond those she had taken to New York,

andthe source had identified one of the individuals in these additional

photographs as Khallad. Donna said that she was "requesting the details on

that [Khallad's identification]." Donna also stated in her e-mail that the

clearance to show" the ___ should

not be a problem. 236

This e-mail was the first reference we identified that the FBI had been

informed of additional

After her meeting with Donna on August 22, 2001, Mary asked another

CTC officer to draft a CIR to the State Department, INS, U.S. Customs

Service, and FBI requesting the placement of Mihdhar and his 1:ravel

companions, Hazmi and Salah Saeed Muhammed bin Yousaf, on U.S.

watchlistsY 7 The',CIR briefly outlined Mihdhar's attendance at the Malaysia

meetings and his ,.subsequent travel to the U.S. in January 2000 and July 2001.

On August 24, the State Department placed Mihdhar and his travel companions

236Donna was unable to recall how she first discovered the information on the Khallad

identification. We were unable to find any documents or other evidence clarifying , this

issue.

237At this time, several agencies maintained separate watchlists. The State Department ,

watchlist was the VISA/VIPER system. Within VISA/VIPER, the TIPOFF systemfocused

on suspected terrorists. The INS maintained the LOOKOUT system,which was also

available to the Customs Service through TECS.

294
on its terrorism watchlist. This is the first record of the placement of Mihdhar

or Hazmi on _myU.S. watchlist.

On August 23,2001, Donna contacted the State Department and

requested a copy of Mihdhar's most recent visa application from the U.S.

Consulate in Jeddah, Saudi Arabia.

3. The FBI's intelligence investigation on Mihdhar

a. Steps to open the investigation

On August 23, Donna contacted her supervisor, an SSA who we call

"Rob," regarding the information about Mihd]har's travel te the United States.

As discussed in Chapter Three, Rob was the acting Unit Chief of the UBLU at

the time. 238

After reviewing the information, Rob concurred with Donna that the

appropriate course of action would be toopcn an intelligence investigation in

New, York, Mihdhar's last known destination in the United States, to locate

Mihdhar.

To expedite the investigative process and provide a "heads up [alert]" to

the New York Field Office that the informatien was coming, on August 23

Donna telephoned an agent on the Bin Laden squad in the New York Field

Office who we call "Chad." To comply with th_ wall, the New York Field

Office had designated agents as either "criminal" or "intelligence," and Chad

was an intelligence agent. Donna discussed with Chad Mihdhar's most recent

entry into the United States and FBI Headqum_ers' request for the New York

office to open a full field intelligenc e investigation to locate Mihdhar. Donna

told the OIG that she did not normally telephonically contact the field on these

types of issues, but there was some urgency to her request because the FBI did

not want to lose the opportunity to locate Mihdhar before he left the United

States.

z38He wasthe acting Unit Chief of the UBL from June 28, 2001. until September 10,

2001.

295
Chad told the OIG that although he routinely worked with Donna, this

was the first time that Donna had relayed a need for urgency in an intelligence

investigation. Chad told us, however, that he questioned both the urgency and

the need for a separate intelligence investigation. Chad explained that the

attempt to locate Mihdhar seemed to relate to the criminal investigation of the

Cole attack, and efforts to locate an individual normally would be handled

through a sub-file to the main investigation and not as a separalle full field

investigation. Nevertheless, he told Donna that New York would open an

intelligence investigation.

On August ;23,Donna sent an e-mail to Jobxi concerning her telephone

conversation with Chad. She advised in the e-maJ.L1that [Chad] will open an

inte l[ligence] case ."

She wrote; "I am still looking at intel, but I think we have more of a definitive

connection to the Cole here than we thought." She ended by stating that she

was Working on tTheEC requesting a full field inw_stigation, bull doubted that it

wouldbe completed that day.

On August ;27,Donna requested permission through the NSA

representative to the FBI to pass to the FBI agents,working on l_.heCole

investigation the information

Donna told the OIG

that she thought t]hatthe NSA inforrnation on Mihdhar could be useful to the

Cole criminal investigators, even if the Mihdhar search remained an

intelligence investigation.

On the monaing of August 28, Donna sent Chad a draft copy of an EC ,

requesting the intelligence investigation to locate Mihdhar. In _Ihecover email, Donna stated, "here is a draft" and that the EC had not been uploaded due

to some tear line reformation that was not yet approved for passage. 239 She

concluded, "I do want to get this going as soon as possible."

The EC, entitled "Khalid M. A1-Mihdhar" with various aliases, stated in

the synopsis, "Request to open an intelligence investigation." The EC outlined

Mihdhar's travel to the United States; in July 2001, his previous travel to the

239According to, the NSA, the request was approved later that same day.

296
United States with Hazmi in January 2000, the background on and his

attendance at the Malaysia meetings,

to the identification of Khallad in the

by the source,. Donna told the OIG that she did not include this information

because it had not yet been officially passed to the FBI, although she had

requested the passage from a CTC Representative to the FI:II. 24° /_

While Donna had relayed urgency to opening the inw_stigation in her

telephone conversation with Chad and in her cover e-mail, she designated the

EC pre_dence as "routine," the lowest precedence level. 241She explained this

by saying this case was "no bigger" than any other intelligence case. She also

told us, however, that there was a time consideration because Mihdhar couldbe

leaving the United States at any time and that is why she had personally

contacted Chad.

b. The FBI opens the intelligence investigation

On August 28, Chad forwarded Donna's draft EC to his immediate

supervisor, a Supervisory Special Agent who we call "Jason." Jason became a

_ supervisor on the JTTF in the New York Field Office in 19'96. He had been on

the New York JTTF since 1985.

At approximately 2:00 p.m. on August 28, Jason forwarded the EC to

various agents on the Bin Laden squad, including the Cole criminal case agent

who we call "Scott." In the cover e-mail, Jason directed the Relief Supervisor,

who we call "Jay," to open an intelligence investigation and assign it to a

Special Agent who we call "Richard." Jason also directed another agent to

24oThis information officially was passed to the FBI in a CIR on August 30, 2001.

241As discussed in Chapter Three, ECs are marked with a precedence level based on an

escalating scale beginning at "routine;" "priority," cormoting some urgency; and

"immediate," connoting the highest level of urgency.

297
check on an investigative lead related to Mihdhar while the agent was in

Malaysia. 242

Scott received the EC on August 28. Scott, who had been at the June 11

meeting and had discussions with Donna about the __,

contacted Donna to discuss the appropriateness of opening an intelligence

investigation as opposed to a criminal investigatic,n. Donna told the OIG that

when she realized that the EC had been disseminated to Scott, she asked Scott

to delete it becau,;e it contained NSA information and therefore',required

approval for review by criminal agents. Scott told the OIG tha_Lhe deleted the

EC as she requested.

shortly thereafter, Scott, Donna, and Rob engaged in a conference call to

discuss whether tlhe case should be opened as a Criminal instead of an

intelligence investigation. Scott told the OIG that he argued that the

investigation should be opened as a criminal inve,;tigation due _Lothe nexus to

the Cole investigation and the greater investigative resources that could be

brought to bear in a criminal investigation. Scott .explained that more agents

could be assigned to a criminal investigation due to the squad designations. He

also asserted that criminal investigation tools, suc]has grand jut), subpoenas,

were far quicker and easier to obtain than the tools available in an intelligence

investigation, such as a national security letter.

Donna told the OIG that the information on Mihdhar was received

through intelligence channels and, because of restrictions on using intelligence

information, could not be provided directly to the criminal agents working the

Cole investigation. The only information that could be provided directly to

them was the limited INS information. She stated that without the intelligence

information on Mihdhar, there would have been no potential nexus to the Cole

investigation and no basis for a criminal investigation. Rob told the OIG he

had concurred with Donna's assessment that the matter should be an

intelligence investigation. He added that there was also a process through

242Jason told the OIG that he did not specifically recall this e-mail, tte said he was out

of the office the majority of the time from June until September 11, 2001, due to a serious

medical condition, and he did not return to work full-time until September 11, 2001.

298
which the information could potentially be shared with the criminal agents in

the future. 243

Scott was not satisfied with that response, and he asked for a legal

opinion from the FBI's National Security Law Unit (NSLU) whether the

investigation should be opened as a criminal matter relating to the Cole

• criminal investigation. Additionally, Scott wanted a legal opinion on whether a

criminal agent could accompany an intelligence agent to interview Mihdhar if

he was located.

According to Donna, she subsequently contacted the NSLU attorney who

we call "Susan" on August 28, and she and Rob discussed the issue with Susan.

It is unclear how she presented the matter to Susan because there were no

documents about the conversation and she and Susan had little or no

recollection of the specific conversation. Donna told the OIG that she provided

the EC to Susan. According to Donna, Susan agreed with her that the matter

should be opened as an intelligence investigation. Donna said Susan also

advised that a criminal agent should not be present for an interview of Mihdhar '

if he was located. During an OIG interview, _.,usansaid she could not

specifically re,call this matter or the advice she,,gave. Rob told the OIG that he

did not recall the specifics of this consultation, but he stated that the NSLU

opinion was supportive of FBI Headquarters' determination that the case

should be opened as an intelligence investigation.

At approximately 7:30 a.m. on August 29, Donna sent an e-mail to Jason,

which stated:

I think I might have caused some unnecessary confusion. I sent

the EC on A1-Midhar [sic] to[Chad] via email marking it as

DRAFT' so he could read it before he went on vacation. There •is

material in the EC...which is not cleared for criminal

investigators. [Scott] called and [Rob] and I spoke with him

and tried to explain why this case had to stay on the intel, side of

the hous;e...In order to be confident...for this case to be a 199,

243Rob told the OIG that the squad's Supervisor)' Special Agent acted as "the wall"

between intelligence and criminal investigations during this period, and Jason could

subsequently open a criminal investigation if warranted.

299
and to answer some questions that [Scott] had, [Rob] and I

spoke with the NSLU yesterday afternoon244...The opinion is as

follows" A1-Mihdar [sic] can be opened directly as a FFI EFull

Field Investigation] ....The EC is still not cleared for criminal

investigators...Per NSLU, if A1-Mihdar [sic] is located the

interview must be conducted by an intel agent. A criminal agent

CAN NOT be present at the interview. This. case, in its entirety,

is based on intel. If...information is developed indicating the

existence of'a substantial federal crime, that information will be

passed overthe wall according to the proper procedures and

turned over for follow-up criminal investigation. 245

Approximately 15 minutes after sending the e-mail to Jason, Donna sent

an e-mail to Scott with the same language advising that the NSLU agreed the

investigation should be an intelligence investigation and a criminal agent could

not attend the inte,rview if Mihdhar was located. That same morning, Scott

responded in an e-mail to Donna stating:

...where is the wall defined? Isn't it dealing with FISA

information? I think everyone is still confusing this

issue...someday someone will die - and wall or not- the public

will not understand why we were not more effective and

throwing every resource we had at certain 'problems.' Let's

hope the National Security Law Unit will st_mdby their

decisions then, especially since the biggest threat to us now,

UBL, is getting the most 'protection'.

Later that morning, Donna replied in an e-mail:

I don't think you understand that we (FBIHQ) are all frustrated

with this issue. I don't know what to tell you. I don't know

how many other ways I can tell this to you. These are the,,rules.

244Rob told the OIG that he could not recall whether he had talked to anyone from the

NSLU about this issue.

245Rob told the OIG that the New York Field Office technically couM have ignored

Headquarters' recommendation and opened a criminal investigation. However as a practical

matter, the field would not normally ignore Headquarters' decision.

300
NSLU does not make them up and neither does UBLU. They

are in the MIOG 246and ordered by the [FISA] Court emd every

office of the FBI is required to follow them including FBINY...

4. The New York Fie]ld Office's investigation

On August 29, 2001, the FBI's New York Field Office opened a full field

intelligence investigation to locate Mihdhar. The investigation was assigned to

a Special Agentwho we call "Richard." Richard was a relatively

inexperienced agent, who had recently been transferred to the Bin Laden

squad. 247 This was Richard's first intelligence: investigation.

On August 29, Donna received Mihdhar's visa application from the U.S.

Consulate in Jeddah. The application indicated that Mihdhar planned to travel

as a tourist to the United States on July 1,2001, for a purported month long

stay. On the application, Mihdhar falsely claimed that he had not previously

applied for a U.S. non-immigrant visa or been in the United States. 248

On August 30, 2001, Donna sent an e-mail to Richard. After a paragraph

introducing herself, Donna advised she was attaching Mihdhar's visa

application form, which included Mihdhar's photograph, and that she would be

faxing the remaining documents. Donna stated she would ,;end a couple of

pages from the Attorney General Guidelines "which apply 1Loyour case" and

then she would mail the documents.

Richard told the OIG that on August 30, he received a telephone call

from Donna in reference to the investigation. He said that Donna said the goal

of the intelligence investigation was to locate and identify Mihdhar for a

246The MIOG isthe FBI operational manual - Manual of Investigative Operations and

Guidelines. Donna asserted this reference actually related to the Attorney General's FCI

Guidelines that :arecontained in the MIOG.

247Richard began working in the New York Field Office after graduating from the FBI

Academy in June 2000. After serving briefly on an applicant squad, a drug squad, and a

surveillance squad, Richard was assigned to the UBL squad in July 2001.

248Donna said she did not notice this discrepancy. As we discuss below, neither did the

New York FBI.

]

301
potential interview. According to Richard, Donna did not indicate the

investigation was an emergency or identify any other exigent circumstance.

On August !30,2001, the CIA sent a CIR to the FBI outlining the

identification of"Khallad" from one of the_llllmm_m

in January 2001 by the source. The first line of the text stated the

information should be passed to Rob. The CIA cable stated the.,FBI should

advise the CIA if the FBI did not have the.lmllmm_m so they

may be provided. This is the first record documenting that the .source's

identification of I_Jaalladin the _m was;provided by

the CIA to the FBI.

Richard told the OIG that he began to work .onlocating Mihdhar on

September 4. He stated that he had received theassignment on Thursday,

August 30, but he worked all weekend and Monday on another exigent

investigative matter involving a Canadian hijacking. As a resuh, he said he did

not have the opportunity to begin work on the Mihdhar investigation until

Tuesday, September 4.

• On September 4, Richard completed a lookout request for the INS,

identifying Mihdhar as a potential witness in a ten:orist investigation. Due to

his unfamiliarity with completing the lookout form, Richard contacted an INS

Special Agent who was assigned to the FBI's JTTF in New York. We call this

Special Agent "Patrick." The INS lookout form has a box indicating whether

the individual was wanted for "security/terrorism'" reasons. Richard did not

check this box. I-liesaid that he thought Patrick told him to identify the subject

on the form as a witness, not a potential terrorist, to prevent ow_rzealous

immigration officials from overreacting. By contrast, Patrick, who was

assigned to the JTTF since September 1996, told us that he did not provide this

advice to Richard and he always checked the security/terrorism box whenever

he completed the lookout form for a potential witness in a terrorism

investigation.

However, Richard asked Patrick to review the lookout request form for

completeness, and Patrick sent the form to INS Inspections for inclusion in the

302
INS lookout system, without making any changes. 249 During his initial

interview with the OIG, Richard asserted that he also asked Patrick to review

and explain Mihdhar's travel documents, including the INS indices printouts

and the visa application. In a follow-up inter-v'iew, Richard said he could not

definitively recall whether he had actually provided the predicating materials to

Patrick or whether he merely had Patrick review the INS lookout request form.

Patrick told the OIG that he recalled this',request because it was the first

one from Richard and because of Mihdhar's subsequent involvement in the

September 11 attacks. Patrick stated that he had not reviewed the predicating

materials, but had only checked the request form for completeness. He added

that if he had been shown any of the predicating materials on Mihdhar's travel,

the review would only have been cursory. Patrick and Richard both

acknowledged that they did not notice the false statements on Mihdhar's visa

application.

Richard also contacted a U.S. Customs Service repres;entative assigned to

the JTTF and verified that a TECS lookout was in place for Mihdhar. Richard

conducted other administrative tasks such as uploading the initial information

about Mihdhar into ACS.

On September 4, Richard requested a local criminal history check on

Mihdhar through the New York City Police Department. Richard told the OIG

that he initially focused on Mihdhar, since he was captioned as the subject of

the investigation in the predicating EC. After reviewing the EC several times,

Richard noted the connection to Hazmi, so he conducted the same record

checks on Hazmi as he had on Mihdhar. On September 5, ]Richard requested

an NCIC crirninal history check, credit checks, and motor vehicle records be

searched in reference to Mihdhm: and Hazmi.

On September 5, Richard and another JTTF agent contacted the loss

prevention personnel for the New York area Marriott hotels, since Mihdhar had

indicated when he entered the United States in July 2001 that his destination

249Patrick explained that agents often provided just the information and he completed

the lookout form, but "new" agents often completed the form themselves. Patrick estimated

he received approximately 10 lookout requests each month.

303
was the Marriott hotel in New York. Richard learned that Mihdhar had not

registered as a guest at six New York City Marriotts.

Richard stated he also conducted Choicepoint TM searches on Hazmi and

Mihdhar. 25°Richard said he recalled he had another JTTF officer assist him

withthe searches because he was not familiar with the system. Richard did not

locate any record,; on either Hazmi or Mihdhar in ChoicepointTM.TM Richard

told the OIG that it was not uncommon not to find a record because of

variations in spelling of names or other identifying information.

Hazmi and Mihdhar had traveled to Los Angeles, California on January

1, 2000, via United Airlines, and INS records indicated that they claimed to be

destined for a "Sheraton hotel" in Los Angeles. Therefore, on September 10,

2001, Richard drafted an investigative lead for the FBI Los Angeles Field

Office. He asked that office to request a search of the Sheraton hotel records

concerning any stays by Mihdhar and Hazmi in early 2000. He:also requested

that the Los Angeles office check United Airlines and Lufthansa Airlines

records for any payment or other information concerning Mihdhar and Hazmi.

However, the lead was not transmitted to Los Angeles until the next day,

September 11, 20,01.

By the morning of September 11, when the American AMines flight 77

that Mihdhar and Hazmi hijacked and crashed into the Pentagon, Richard had

not uncovered any information regarding Mihdhar's or Hazmi'.s location in the

United States.

• 5. OIG conclusions on the intelligence investigation

Although FBI and CIA persormel had manydiscussions tlhroughoutJuly

and August 2001 about the Cole attacks ll_ll_l_ll, the CIA

25oChoicepointT Mis a commercial service that mines information such as names,

addresses, phone numbers, and other identifying information from public sources (such as

telephone directories., local taxing authorities, and court records), as well as purchase

information from merchants or other companies. The information is then consolidated into a

large database and is accessible to law enforcement and otlher subscribers for a fee.

251After September 11, however, the FBI located records on Hazmi in this commercial

database.

304
did not provide and the FBI did not become aware of the significant

intelligence information about Mihdhar's U.S. visa, the Malaysian matter, and

the_ __ until August 22,

2001. In May 2001, one detailee to the CTC was assigned to "get up to speed"

on tile Malaysian matter in her spare time but said she had been unable to focus

on the matter until August 2001. On July 13, even after Jolm had suggested in

an e-mail to tile CTC that the ___

be passed to the FBI via CIR, this was not done for several weeks.

The CIR was not sent to the FBI until August 30, after the FBI learned of

Mihdhar's presence in the United States. \

The CIA also did not provide to the FBI the information about Hazmi's

travel to the United States in January 2000 until August 22. Donna stated that

she did not receive this information until August 22, and her actions upon

receipt of the information clearly indicate that she understood the significance

of this information when she received it. She took immediate steps to open an

intelligence investigation when she learned of this information.

On August 22, once the FBI was aware of the intelligence information

about Mihdhar and that he was in the United States, the FBI took steps to open

an intelligence investigation to locate him. Yet, the FBI did not pursue this as

an urgent matter or assign many resources to it. It was given to a single,

inexperienced agent without any particular priority. Moreover, the dispute

within the FBI about whether to allow a criminal investigation to be opened

again demonstrated the problems with the wall between criminal and

intelligence investigations. The FBI was not close to locating Mihdhar or

Hazmi when they participated in the terrorist attacks on September 11,2001.

In the analysis section of this chapter, we address in more detail the FBI's

decision to open the matter as an intelligence investigation instead of a criminal

investigation, and the inadequacy of the FBI's efforts to investigate Mihdhar in

late August and early September 2001.

F. Summary of the five opportunities for the FBI to learn about

Mihdhar and Hazmi

In summary, there were at least five opportunities for the FBI to have

learned about Mihdhar and Hazmi, __ll_i_l_

__ and their presence in the United States, well

before the September 11 attacks. First, in early 2000, the FBI received the

305
NSA information about Mihdhar's planned travel to Malaysia. Although the

CIA informed the FBI of the Malaysia meetings in January 2000, the existence

of Mihdhar's U.S. visa and the surveillance photographs was not disclosed to

the FBI. FBI detailees at the CTC read the pertinent CIA cable traffic with this

information and drafted a CIR to pass this information to the FBI. But the CIR

was not .released to the FBI, purportedly at the direction of a CIA supervisor,

and the\FBI did not learn of this critical information until August 2001. In

addition, in Marcia 2000 a CIA office discovered that Hazmi had traveled to the

United States in January 2000, but no one from the CIA shared this information

with the FBI.

• Second, in.February 2000, Mihdhar and Hazmi moved to San Diego,

where they were aided in finding a place to live by the former subject of an FBI

preliminary inquiry. In May 2000, Hazmi and Mihdhar moved in with an FBI

asset in San Diego, California. However, the FBI did not learn of this

information until after the September 11 attacks.

f

Third, in early January 2001, the CIA showed __

to a jointCIA/FBI source, andthe source stated that

This identification could have led

the FBI to.focus on who else was.

which could have led the FBI to

identify andlocate Mihdhar. However, we concluded that, despite the CIA's

assertions, i_ __ was not

known.,by the FBI.

Fourth, in Mayand June 2001, due to concerns about possible terrorist

activities,iCIA employees were again examining the __

._, Hazmi's and Mihdhar's travel (including Hazmi',; travel to Los

Angeles), and_ __

At the same time, these CIA employees were discussing with FBI employees

the Cole investigation and the __. Yet, despite these

interactions between the two agencie,s on the telephone, in e-mails, and in a

June 11meeting in New York, the FBI never was informed of the critical

intelligence information that ___

_ with Mihdhar, and that Hazmi had traveled to the United States.

Again, this infom_ation could have led the FBI to initiate a search for Hazmi

and Mihdhar earlier than it eventually did.

306
Fifth, in July 2001 a former Bin Laden Unit Deputy Chief who was

working in ITOS in FBI Headquarters confimled that [mm[l_

:__ and wrote in an e-mail to CTC

managers thai:this information needed to be sent in a CIR to the FBI.

However, this;information was not sent in a CIR to the FBI until severalweeks

later. On August 22, an FBI employee detailed to the CTC notified the FBI

/

that Mihdhar ihad entered the United States on July 4, 2001. The FBI began an

intelligence investigation to locate Mihdhar and Hazmi. However, the FBI

assigned few :resources to the investigation and little urgency was given to the

investigation. The FBI was not close to locating Mihdhar and Hazmi before

they participated in the September 11 attacks.

IV. OIG's analysis of the FBI'shandling of the intelligence information

concerning Hazmi and Mihdhar

We found systemic and individual failings in the FBI:'s handling of the

Hazmi and Mihdhar matter. As a result of these failings, there were at least

five opportunities for the FBI to connect information that could have led to an

earlier investigation of Hazmi and Mihdhar and their activities in the United

States.

In this analysis section, we first discuss the systemic problems involving

the breakdowns in the gathering or passing of information about Hazmi and

Mihdhar between the FBI and CI[A. We then turn to the problems in handling

intelligence information within tlheFBI. Finally, we discuss theactions of

individual FBI employees in handling information about Hazmi and Mihdhar

information.

In this section, we do not make recommendations regarding the actions of

the CIA and its employees. We believe the C][Ashares a significant

responsibility for the breakdowns in the Hazmi and Mihdhar case, and that

several of its employees did not provide the intelligence information to the FBI

as they should have. We leave it:to the CIA OIG, the entity with oversight

jurisdiction over the CIA and its employees, to reach conclusions and make

recommendations on the actions of the CIA and its employees.

307
A. Systemic impediments that hindered the sharing of information

between the CIA and the FBI

The most critical breakdown in the Hazmi and Mihdhar case was the

failure•of the FBI to learn from the CIA critical information about them; their

travel to the United States;

These breakdowns reflected serious problems

in the process befbre the September 11 attacks for sharing infolxnation between

the FBI and the CIA.

The FBI failed to receive from the CIA three critical pieces of

intelligence about Mihdhar and Hazmi in a timely manner:

• Mihdhar's possession of a valid, multiple-entry U.S. visa;

• Hazmi's travel to the United States; and

The CIA became aware of these three piece,; of intelligence in January

2000, March 2000, and January 2001. Despite claims to the contrary, we

found that none of this information was passed from the CIA to the FBI until

August 2001. Although the CIA failed to timely pass this infoimation to the

FBI, there were several opportunities for the FBI 1:ohave obtained this

information in other ways. But significant systemic problems, which we

describe below, hindered the flow of information between the CIA and the FBI.

1. Use ofdetailees

One of the most significant opportunities for the FBI to have obtained the

intelligence information relating to Hazmi and Mihdhar was through the FBI

detailees at the CTC. As discussed above, the FBI detailees to the CTC had

access to CIA cable traffic and could read the canes that discu,;sed Mihdhar's

U.S Hazmi's visa,subseqUent the surveillance travel ofto the the meetings United States, Umllmand__l___in the Malaysia,

__. Several of the FBI detailees accessed

and read some of these cables. Significantly, in J_muary 2000, one detailee,

Dwight, prepared a draft CIR to pass to the FBI the information about

Mihdhar's visa, |_, and his travel to Malaysia. The FBI

308
should have been informed of this information because of its clear domestic

nexus.

However, the CIR was never sent to the FBI. According to a note on the

CIR, John, a Deputy Chief of the Bin Laden Unit, directed that the CIR be

placed on hold, and FBI detailees did not have authority to disseminate CTC

information without approval from the CIA. Eight days later, Dwight inquired

about the disposition of the CIR through an e-mail to John asking whether

anything needed to be changed on the cable. However, this e-mail failed to

prompt further action on this CIR. The witnesses we interviewed had no

recollection of the CIR and why it was not sent. We found no further record

that anything was done with regard to the CIR..

In our view, the CIA should have sent the CIR to the FBI because of the

important information it contained, and the FBI detailee should have followed

up to ensure tlhatit was sent. While we found evidence thall Dwight inquired

about its status at least once, there is no evidence that he took any other action

to ensure that the information was sent to the FBI, including inquiring with

other CTC supervisors about the need to send the cable to the FBI.

In reviewing the actions of the detailees, we found that the FBI lacked

clear guidance on the role and responsibilities of FBI detailees to the CTC's

Bin Laden Unit. This led to inconsistent expectations about what they were

supposed to be doing at the CTC. Our review of the documents and interviews

with the five FBI detailees to the CTC's Bin [,aden Unit found that none of

them had defined duties that were clearly understood, either by them or FBI

managers. Nor were there any memoranda of understanding (MOU) between

the FBI and the CIA setting out the job duties and responsibilities of any of the

detaileesY 2

Moreover, we asked the FBI for the pertbrmance appraisals for all five of

the detailees to the Bin Laden Unit during this. period, and we received

252We asked both the FBI and the CIA for any memoranda of urLderstanding between

the agencies specifying the job duties of any of the detailees. The only MOUs we received,

which were provided by the CIA, related to the administrative nature of the details, such as

time and attendance reports, travel and training expenses, security clearances, and medical

coverage. The MOUs did not address their substantive duties or responsibilities.

309
appraisals for three of them. They revealed that the FBI detailees were

evaluated based on the elements for their positions at the FBI, not based on

whatever they were supposed to be doing while working at the eTC. 253 The

FBI was unable to provide any other documents defining or oulLlining the roles

or responsibilities', of these detailees.

We also interviewed the detailees about their understanding of their roles

andresponsibilities at the CTC. They stated that they were not given any

specific instructions about their job duties. They described theJir details at the

CTC as ill-defined and with little direction. As a result, each detailee defined

the job at the CIA as he or she determined it to be., and there was significant

variation in their conceptions of the job.

For-e×ample, Dwight told the OIG that he focused on leads that were

related to financial components of terrorism, which he developed from various

sources, such as fromreviewing cane traffic, from his supervisors at the CTC,

and from referrals from CIA officers at the CTC. By contrast, Malcolm told

the OIG thathe thought he was the "eyesand ears" of the New York Field

Office, and that his role was "to monitor" cases being worked jointlyby the

CIA and the New York Field Office, such as the Fiast African embassy

bombings investigation. He said that he also would follow up on requests for

information from the FBI to the CIA. Moreover, Mary said she was not given

any specific instructions about her role at the CIA, but she was eventually

trained to be a CTC desk officer and that was how she operated[- like other

CTC desk officers with specific assignments or "accounts."

Eric, who.was a Bin Laden Unit Deputy Chief, said_that he was told "to

fix" the relationship between the Bin Laden Unit and the FBI, but he was not

given any specific instructions about how to go about accomplishing this

objective. He said that he assisted in the running of the Bin Laden Unit by

directly overseeing CTC operations and that he also functioned in a liaison role

between the CIA and the FBI. He supervised the FBI detailees like he did

other Bin Laden Unit employees. He was not giw_n any other supervisory

253For a fourth detailee, Mary, the FBI produced only a performance plan but no

appraisal reports. The performance plan was related to her duties as an FBI IOS. Mary told.

the OIGthat she was;directed by CTC management based on her work as a CIA desk officer

and was not evaluated by FBI personnel.

310
oversight particular to the detailees. He said tlhat on his own initiative he tried

to stay abreast of matters that might be of interest to the FBI by reading the

CTC cable traffic. However, he explained that determining what might be of

interest to the FBI was very subjective because there were no criteria defining

what should be brought to the attention of the FBI.

We also interviewed the highest-ranking FBI employee detailed to the

CTC, who was a Deputy Chief of the CTC from 1999 through 2002. We call

him '_Evan." Evan believed that one of the FFII detailees' functions would

have been to review CIA cable traffic for infon'nation of potential relevance to

the FBI. Yet, the detailees told the OIG that while reviewing CIA cable traffic

was part of their jobs, it was not their function to review cable traffic for items

of interest to the FBI, and they did not review all of the cable traffic on a daily

basis. They said they did not think they were acting as backstops to ensure that

anything that :might be relevant to the FBI was;brought to the FBI's attention. TM

The detailees asserted emphatically that their function did not entail scouring

CIA cable traffic for the FBI, and their efficacy would be limited if they were

•perceived by CIA personnel merely as moles for the FBI.25:'They also

explained that even if this had been their role, it would haw: been difficult to do

because of the;volume of cables, especially during the chaotic Millennium

period.

The two FBI employees who held similar supervisory positions - one as

a deputy chief in the Bin Laden Unit and the other as a deputy chief in another

unit that later housed the Bin Laden Unit- also had differing views on their

responsibility for reviewing cable traffic. Botih agreed that their role was not

merely to review cable traffic for items of interest to the FBI. Eric told the

254We also interviewed the first FBI employee detailed in March 1996 to Bin Laden

Unit soon after it was created. This detailee was an a_gentfrom the FBI's New York Field

Office, and he remained at the CTC until August 1998. He said that he did not attempt to

review all of the cable traffic. He indicated, however, that when he did locate information of

interest to the FBI, he did not encounter problems obtaining the CIA's permission to share

this information with the FBI.

255Some CLA employees we interviewed stated that they, by contrast, believed that this

was the functionLof the New York Field Office detailee. We discuss this further in the next

section.

311
OIG that while he tried to review the traffic in order to stay abreast of the

information in the CTC, it was too much for one person to manage effectively.

By contrast, Craig, who followed Eric as a manager detailed to the CTC, told

the OIG that he did not even attempt to review the cable traffic but only

focused on those ,cablesthat required action on his part.

In addition to failing to clearly define the roles and responsibilities of the

detailees, the FBI did not provide oversight of the detailees. Eric acted as one

of two deputy chiefs within the Bin Laden Unit. After Eric left the CTC, Craig

was a deputy chie,f in a much larger unit that included the Bin Laden Unit.

Bothsaid that,they performed day-to-day supervi,;ion of the detailees in the

same manner in,which they supervised the other CTC employees assigned to

their groups. 256 According to Eric and Craig, they did not focus specifically on

the role of FBI de,tailees.

Evan told the OIG that he did not supervise any of the detailees, and he

had no authority to oversee their duties or direct their activities, except by

virtue of his position as a senior manager within tlheFBI. He said that they

were evaluated by their chain of command in the FBI office from which they

had been assigned, which is supported by the limited documents we reviewed.

We found that there was no oversight by the FBI of the detailees based on their

function as detailees.

• The FBI's .. f_tilure to adequately oversee the detailees is ililustrated by the

role of Mary, the only FBI analyst detailed to the Bin Laden Unit. She has

been detailed to the CIA since 1998. Mary had the opportunity to learn

valuable analyst skills by working alongside CTC personnel and then use those

skills at the FBI. Additionally, the detail provided an opportunity to learn

about the CIA infi'astructure and establish liaison contacts at the CIA.

Mary told us that she operated as a full-fledged CIA desk officer, and that

•she has worked with FBI personnel (luring her detail but from the position of a

CIA employee, not an FBI employee. We believe: there needs to be a review of

the duration of these details to ensure the value of' these details is maximized.

256Eric left the CTC in mid-January 2000, and Craig ,didnot arrive at the CTC until July

2000. Thus, between mid-January and July 2000 the FBI ihadno supervisory presence for

the FBI employees detailed to work Bin Laden matters at the CTC.

312
At a time when the FBI is concerned about the shortage of qualified analysts to

do the work it has, a 5-year detail of an FBI mlalyst working as a CTC

employee wan'ants review by the FBI. 2s7

The same lack of oversight and direction was evident regarding the work

of Malcolm, the FBI New York Field office detailee to the CTC. He had been

traveling to the CTC from New York on a weekly basis for four years, unti.1

January 2003.. On Mondays he traveled from New York to the CTC, stopping

by FBI Headquarters:. On Fridays he stopped by FBI Headquarters on his way

back to New York. After the bombing of the .Cole, he spent at least half ofhis

days in Washington, D.C. at FBI Headquarters. Thus, he was frequently away

from the CTC, and not in a position to maximize his potential for obtaining

information at the CTC. This also left the perception with other CTC

employees that he was not fully integrated into the CTC.

We found that that the FBI lacked a systematic approach to its use of

detailees at CTC's Bin Laden Unit. The detailees could have functioned in one

of three ways - as fully integrated members of the CTC working unilaterally

on CTC matters, as backstops ensuring all pertinent CTC information was

forwarded to the FBI, or in some combination thereof. While there are

potential benefits to using the detailees in any of these functions, the potential

benefits were not maximized because there was no clear understanding of the

detailees' roles and no system to ensure that any objectives were met. The lack

of oversight over FBI detailees to the CTC resulted in squandering critical

opportunities for informationsharing between the CIA and FBI.

We also, found significant misunderstandings between employees of these

two agencies regarding their respective responsibilities for information sharing.

First, as noted above, we found that some CIA employees believed that FBI

detailees had more responsibility for reviewing the CIA cable traffic than the

FBI detailees believed that they had. One CIA Bin Laden Unit employee told

the OIG that the CIA was not going to "spoon feed" information to the FBI and

that the FBi personnel at the Bin Laden Unit had access to all of the CIA cable

traffic. She stated that while the CTC provided to the FBI intelligence

257The OIG is in the process of completing a comprehensive review of FBI's analyst

program.

313
information that contained a domestic nexus, she ,:lidnot believe it was the

CIA's responsibility to provide all of the predicating material, since the FBI

detailees also had access to the same cables. In addition, CIA personnel

described FBI detailee Malcolm as a "mole" for the FBI's New York Office,

suggesting they thought he was reading CIA cables for the exwess purpose of

reporting back to the New York Field Office on what he found._ _:,

In addition, we found that a similar misunde,rstanding existed among FBI

employees in New York with respect to the role of the CIA employee detailed

to.the FBI's New York Field Office. A ClA employee assigned to the JTTF in

the New York Field Office had a desk in that office's sensitive compartmented

information facility (SCIF). 258 FBI agents in the New York Field Office

asserted to the OIG that this individual was knowledgeable regardingtheir

investigations and that he was responsible for reviewing CIA traffic, finding

items of interest t,othe FBI, and bringing this information to the attention of

appropriate New York agents.

The CIA employee, however, denied that this was his role. He told the

OIG that he .had been sent to the New York Office to "improve the relationship

between the CIA and the FBI" and that he provided the FBI with CIA

intelligence that was designated for the FBI New York Field Office's review.

He stated, however,j his job was not to "spoon feecl" information but only to

make it accessible to the agents in New York. This meant that he would print

information obtained from CIA databases that was of potential interest to the

FBI New York Field Office and make that information available for review in

the SCIF if FBI agents decided to come and review it. But, apparently

unknown to many New York FBI agents, he believed the onus was on FBI

personnel to come into the SCIF and see if any new, relevant information had

arrived, rather than to alert them to that information. He also said that while he

generally knOWSwhat the various FEll squads are investigating, the New York

JTTF has over 300 members and he could not reasonably be expected to have

knowledge of all their investigative interests. He ,saidthat if he:spent his time

258The FBI agents do not routinely work in a SCIF area. The computers on which they

access ACS do not contain sensitive compartmented information or materials classified

above Secret. Because a high percentage of CIA traffic contains this infomaation, the CIA

detailee must work in a separate area.

314
solely looking for information of interest to the FBI, he would never get any

work done.

As a result, FBI agents in New York believed they were receiving from

this CIA employee assigned to the JTTF all of the CIA information of interest

to the FBI, when in fact they were not. Therefore, the New York agents could

have received information on Hazmi and Mihdhar directly through their own

CIA employee, but they misunde, rstood the process.

2. FBI employees' lack of understanding of CIA reporting

•process

These gaps in the information sharing process were exacerbated by FBI

rpers0nnel's lack of understanding of the CIA',s reporting process. This

problem is cle,arly illustrated by the failure of the FBI to obtain the information

on

by the joint FBI/CIA joint source.

..... As detailed above, we concluded that the FBI's ALAT was not made

aware of

:Although the ALAT attended the debriefing of the source, the

ALAT did not immediately receive the information that the source had

identified Khallad. We were unable to ascertain the reasons-for this significant

omission. However, our review found that there were later opportunities for

the ALAT to ]have obtained information about the identification from CIA

documents. In addition, we found that the New York FBI agents working the

Cole attack investigation did not learn of this ,;ignificant information, despite

interviewing the source on several occasions. We believe this was due in part

to the fact that the FBI personnel were not familiar with the CIA's process for

reportingintelligence information.

As discussed previously, the CIA primarily relies on cable traffic to share

intelligence among its personnel who are stationed around the world. None of

these cables are available for FBI review, except by the limited number of FBI

personnel wit]h direct access to CIA computer systems, such as the detailees at

the CTC.

The CIA uses a certain type of cable called a TD to disseminate CIA

information outside of the CIA to other U.S. government agencies. These

cables are created by CIA reports officers based on their review of the internal

315
CIA cable traffic. The reports officers were described to us as :'editors" who

remove references to sources and methods contained in the cables and

determine what information should be further disseminated in the TDs. As a

result, TDs did not necessarily include all the substantive information

contained in the internal cable traffic',.

Our review found the ALAT did not understand that the TDs did not

necessarily contain _illof the intelligence gathered by the CIA from a particular

source or on a pm_ticular event. The ALAT had been keenly aware of the

significance of Khallad to the FBI, and contemporaneous FBI documents

outline his efforts in mid-January 2001 to try to ensure that all the information

obtained from the joint source was provided to the UBL Unit al_FBI

Headquarters and the Bin Laden Squad in the New York Field ,Office.

However, he relied on the TDs concerning the source's reporting to ensure the

completeness of tlhe information that he had provided to his FBI colleagues.

The ALAT erroneously believed he 1hadobtained all the source reporting

through the TDs. This was not the case. ___

was only reported in an internal CIA cable and was never

included in a TD.

In addition 1:othe ALAT, New York FBI agents working on the Cole

investigation told us that when they read a TD regarding a particular subject

(which they could access through CTLink), they mistakenly bei[ieved that it

contained allrelevant information from the source debriefings. The primary

Cole case agent told us that he believed that the CIA operationaL1cables dealt

with techniques and methods, but he did not know that these cables also

contained the details of debriefings. He said that he had "assunaed" all the

substantive reporting would be contained in the TDs, so he nev,er asked the

CIA to allow him to review the underlying cable traffic.

If these FBI employees had a more thorough knowledge of the

information flow within the CIA, they could have ensured that they received all

the relevantinfonnation from the joint source. This was especially significant

in the case of Hazmi and Mihdhar because the CIA and FBI had decided the

majority of the joint source's reporting would be handled through CIA

channels, and the ALAT did not independently report in FBI documents most

of the source's information. For example, in this case, the FBI could have

requested to review the CIA's internal cables or asked the inter¢iewing CIA

officer to review the TDs and the FBI documentation to ensure all the

316
information had been captured. However, the lack of understanding by FBI

personnel of the CIA reporting process and its procedures fbr sharing

intelligence contributed to the FBI not learning of significant information in

CIA cables about Khallad3. Inadequate procedures for documenting receipt of CIA

information

We also found that the FBI lacked consistent policies or procedures for

the receipt and documentation of intelligence :information r,eceived from the

CIA. In addition, structural impediments within the FBI undermined the

appropriate documentation of information received from the CIA.

":As we detailed above, the information c0ncerningthe: surveillance of

was verbally conveyed in January 2000 by a CIA officer to two FBI employees

who were working in the FBI's Strategic Information Operations Center

(SIOC). But this important information was not documented in any retrievable

form at the FBI.

The FB][was able to provide only three documents regarding the briefing

on this information. First, one FBI e-mail message was recovered through a

painstaking re,view of messages on an FBI server that the FBI searched in

connection wJitha request from the JICI. Although this written record survived

from that time, no analyst or agent would have had access to the information,

learned of its existence, or been able to conduct the type of search that led to

the discovery of this document. Second, information regarding the briefing

was also located in one of the FBI Director's daily briefing documents

prepared in response to the Millennium threats. These briefing documents,

however, were not electronically archived in a searchable database that

analysts or agents in the field could access. Third, abrief handwritten note

about the information he received from the CIA was contained in the personal

daily calendm of one of the FBI employees briefed by the CIA officer in the

SIOC.

We found there were no clear procedures for documenting intelligence

communicatecl by the CIA to the FBI in an informal manner, such as the verbal

317
briefings on Mihdhar in the SIOC. Although the SIOC had been activated

during the Millennium for the express purpose of handling threat information

from various sources, FBI personnel assigned to tlheSIOC during this period

told us that there were no procedures for the receipt and handling of

interagency infon_ation communicated informally unless it related to an

ongoing FBI investigation. Although one witness suggested that some type of

log might have existed to record incoming physical information, such as

documents, the FBI found no such log. Moreover, FBI witnesses told us that

the log would not have been used to document verbal briefings. Therefore, any

documentation of'information received informally would have been at the

discretion of the recipient.

We are not ,.suggesting that every informal communication from the CIA

to the FBI should be documented. We also recognize it is difficult to know the

significance of any individual piece of information when it is received. Yet,

we believe that the FBI should attempt to establish criteria or guidance for

determining what information from informal briefings should be documented,

and how it should be documented. The information received in the SIOC on

Mihdhar was recorded only in a briefing provided to the Director and executive

staff, which is not available to others throughout the FBI. Clearly, the authors

of the Director's daily briefing believed there was some import to this

information. Because the Mihdhar information was never documented in an

accessible format., only those individuals personally informed about the CIA's

information on the Malaysia meetings or those present for the Director's

briefings were made aware of the Mihdhar information. In effect, it was lost to

every0neelse because no analysts or field agents would be able',to search for or

locate this information. An effective analytical program requires that analysts

have access to all available information, and that pertinent information is not

contained solely in the personal memories of selected individuals.

This was particularly significant because the:information on Mihdhar

initially did not appear to be important. But it sub,sequently became very

significant.

At this time, the e-mail and the

information from the Director's briefing in January 2000 were not available to

the FBI personnel. Without mechanisms to maintain information in which the

significance is not immediately apparent, the FBI will not be able to fully

connect and analyze disparate pieces of information for their significance.

318
In addition, even if the agents who received the information in the SIOC

had wanted to document it in a form that was available throughout the FBI, the

FBI lacks an information technology system capable of adequately handling

this type of information. As discussed previously, the FBI's primary electronic

information storage system is the Automated Case Support (ACS) System.

ACS is a case management system designed to capture information related to

specific investigations and not for this type of general intelligence information.

There was no FBI system that would allow this type of information to have

been maintained so that it would be available for directed searches or other

subsequent data mining. It is also important to note that ACS is not approved

for storage of information classified above the,,Secret level and is not approved

for storage of any sensitive compartmented information. Thus, it is not

available for storage of the majority of the relevant Intelligence Community

information, including the information on Hazmi and Mihdhar.

In the absence of effective methods for recording and retrieving

information obtained from other intelligence agencies, the benefits of increased

information sharing among the agencies will remain of limited use. Based on

the system in effect during this period, the value of the information was

minimal, unless the information was relayed to an individual who could

immediately use the information or the information related to an ongoing FBI

investigation. When, as here, subsequent additional information increases the

significance of the prior information, the absence of an effective information

retrieval system effectively precludes any me_mingful effort by the FBI to

analyze the disparate pieces of information over time.

in sum, despite the fact that some persormel at the FBI were aware in

January 2000 that Mihdhar

this

information was unavailable for further analysis or use once the SIOC closed

down in late January or early February 2000. Because no one was assigned to

document, follow up, or track the information on Mihdhar, the FBI's

opportunity to discover Mihdhar's valid U.S. visa during this period and

therefore try to locate him was lost.

4. Lack of appropriate infrastructure in FBI field offices

Information sharing with the FBI also was impeded by the inadequate

facilities for the handling of intelligence information in thejjtwo field offices

319
most directly involved in the HazlTii/Mihdhar matter. Intelligence information

from the CIA is often classified at a :highlevel. As a result, safeguards must be

taken in handling the information, while still allowing appropriate FBI

employees the ability to access and use the information. Unfortunately, the

FBI's field offices generally lacked both the necessary physical[ infrastructure

and information technology to readily use this type of information. Without

the appropriate physical infrastructure, the FBI will not be able to handle

sensitive information in an effective manner.

I "J " * ' TOhandle SCI classified material, employee,s must store and review such

information in a _,CIF. Access to the SCIF is limited to individuals with the

appropriate clear,race level and the need to know the information in the SCIF.

Adequate security measures must be implemented to prevent unauthorized

individuals from gaining access to the spaces containing such materials. The

type of equipment that may be brought into the space is also strictly limited.

For example, cellular telephones, two-way pagers, and other unsecured

communication devices are prohibited: Telephones in SCIFs rrmst be

designated for secure transmissions. Computer networks also must be secured

for transmission of information.

During our :review, we observed the workspaces in the FBI New York

and San Diego Field Offices and found that they were not set u:pto adequately

. handle the type of information involved in the Hazmi and Mihdhar cases.

These workspaces were not adequately secured to permit FBI personnel to

handle CIA and NSA information at their own des;ks, even if they had been

given the information. Nor were the SCIFs suitable to permit agents to

regularly access or handle such information. In the New York Field Office, for

example, the SCIF we were shown was extremely small. The CIA detailee to

the JTTF worked in this SCIF, but there was little room for any other personnel

to enter, let alone use it as a workspace. In the San Diego Field Office, a small

SCIF was used as a secure communications center for the entire office. The

San Diego office lacked a separate SCIF for the JTTF, 259including the CIA

_q 259Wewere informedthat a separate__,CIFforthe JTTFis undercon,;tructionin the San

DiegoFieldOffice. However,this SCIFwill onlybe large.enough ' to accommodatethreeor

fouremployeesat anyonetime.

320
representative: assigned to the task force. As a result, the San Diego agents

were hampered in their ability to access CIA information.

We also found that New York and San Diego FBI agents did not have

sufficient access to secure telephones, known as Secure Telephone Unit third

generation or STU III telephones. The limited STU III phones available had to

be shared among numerousagents. Again, this made communications

involving classified material within the FBI or with other members of the

Intelligence Community more difficult. An entire squad cemprising as many

as 25 individuals shared one or two STU III phones.

_.

In.addition, as noted above, the FBI agents did not have access to

computer systems that could store much of the information received from the

CIA. The computers at each agent's desk in the New York and San Diego

Field Offices only provided access to ACS. This system does not permit

storage or access to any information classified above the Secret level or any

information deemed sensitive compartmented information. Therefore, even if

the FBI recipients of the CIA information regarding Hazmi and Mihdhar had

wanted to document and store such information in a retrievable fashion, they

could not have stored it on the system that FBI agents use. The FBI had no

internal system in New York and San Diego that allowed them to use the type

of information involved in the Hazmi and Mihdhar case.

In addition, most FBI agents in the field did not have direct access to

CTLink, the shared Intelligence Community database that did contain some of

the information on Hazmi and Mihdhar, such as the NSA information. Field

agents could not access, let alone conduct research, on this system. As a result,

even if the New York and San Diego agents wanted to search foi relevant

information about Hazmi and Mihdhar, any sensitive or highly classified

information obtained from the NSA and CIA could not be stored in the one

system that they used.

In contrast; we observed that the CIA's workspaces permitted their

employees to access highly classified information on computers in their

personal workstations. Each CIA employee had their own .,securecomputer on

which they could receive and research highly ,classified ma_Ierial. They had

several secure: telephones that could be used to discuss Top Secret information

with others. The difference in CIA and FBI workspaces was particularly stark

in the FBI's San Diego Field Office where, due to the lack ,of access to an

321
appropriate SCIF.. the CIA employee co-located with the FBI's San Diego

Field Office could not access CIA systems. To access CIA systems, he had to

travel to a domestic CIA station.

5. OIG conclusion on impediments to information sharing

In sum, significant and systemic problems that were evident in the FBI's

handling of the Hazmi and Mihdhar case inhibited information sharing between

the FBI and CIA. The FBI failed to define the roles and respovLsibilities of the

FBI detailees to the CTC's Bin Laden Unit. TheFBI failed to ensure effective

oversight of the detailees at the CTC. The FBI and the CIA failed to develop a

clear understanding of the function of detailees from each other's agencies.

The FBI failed to understand the CIA's reporting process. The FBI lacked an

adequate computer system and appropriate infrastructure for handling

intelligence information not directly related to a specific investigation.

Although these systemic problems affected the flow of information

between the FBI and CIA, we do not believe they fully explain the FBI's

failure to obtain the critical information on Hazmi and Mihdhar. Employees at

both the CIA and the FBI failed to provide or seek important information about

Hazmi and Mihdhar, despite numerous interactions between them on issues

related to Hazmi and Mihdhar from January 2000 through August 2001. We

found these interactions were substantive and that much of the :information

about Mihdhar and Hazmi was exchanged through these ongoing efforts.

Unfortunately, the critical pieces of information relating to Hazmi and Mihdhar

did not become kaaownto the FBI until shortly prior to September 11. As a

former CTC Bin Laden Unit Deputy Chief aptly summarized it to us,

"information that should have been shared was not, repeatedly."

B. The actions of the San Diego FBI

In addition to issues that affected information sharing between the FBI

and the CIA, the !FBI had other opportunities to find information about Hazmi

and Mihdhar before the September 11 attacks. The time that Hazmi and

Mihdhar spent in San Diego was an opportunity daring which the FBI could

have obtained infi)rmation about them but did not. As discussed above, Hazmi

and Mihdhar entered the United States in January 2000 and moved to San

Diego in February 2000, where they resided unbeknownst to the FBI. While in

San Diego, Hazmi and Mihdhar associated with O,mar al-Bayoumi, a person

322
whom the FBI had previously investigated, and they also lived with an active,

FBI informational asset. Yet, the FBI did not become aware of their presence

in San Diego until after September 11,2001.

Because.,Bayoumi spent a significant amount of time with Hazmi and .

Mihdhar in early 2000, it is possible that- had a full field investigation of

Bayoumi been open at the time--the FBI could have discovered Mihdhar and

Hazmi's presence in San Diego and also uncovered the CIA information about

their attendance at the Malaysia meetings. Because Hazmi and Mihdhar lived

with an FBI asset, it is also possible that if the FBI had documented their

presence in S_mDiego, it would have provided additional investigative leads

:that could have aided the New York FBI in locating them in August 2001. We

therefore evaluated the San Diego FBi's investigation of Bayoumi and the

decision to close its preliminary inquiry on him in June 199'9. We also.

examined the San Diego FBI control agent's decision not to obtain or

document information from his information as;set about Hazmi and Mihdhar,

who were boarders in the asset's house.

In examining the San Diego Field Office's handling of the Bayoumi

investigation and the informational asset, we also found that, despite the fact

that FBI Headquarters had established countet_errorism as a top priority of the

' FBI in1998, the San Diego Field Office was continuing to pursue drug

trafficking as its top priority in 2001 While the FBI made counterterrorism its

top priority on paper, the FBI took few steps to ensure that field offices

complied with this directive. We discuss this issue at the end of this section.

1. The San Diego FBI's preliminary investigation of Bayoumi

As discussed above, Bayoumi is a Saudi national who in January 2000

had been living in the United States for approximately six years, was well,paid

by a Saudi company that contracted with the Saudi government, and was

involved in setting up mosques in the San Diego area. Hazmi and Mihdhar met

Bayoumi in Los Angeles approximately two weeks after entering the United

States in January 2000. A few days later they moved to San Diego, where

Bayoumi assisted them in obtaining an apartment in the complex where he

lived. They lived in this complex for four months.

Bayoumi's name had first surfaced at the FBI in 1995 in connection with

other investigations. Bayoumi's name resurfaced at the FBI on August 31,

323
1998, when his apartment manager contacted the FBI to report her suspicions

regarding Bayoumi's activities. The manager reported that she had been

notified by the U.S. Postal Inspection Service in March 1998 that Bayoumi had

been sent a ,'suspicious" package from the Middle',East. According to the

manager, the package had broken open and had a number of wires protruding

from it. She reported further that the apartment complex maintenance man had

noticed a number of wires protruding beneath the bathroom sink in Bayoumi's

master bedroom. She reported that there had been large meetings of men, who

based upon their dress appeared to be Middle Eastern, gathering in Bayoumi's

apartment onweekend evenings. She also complained that several parking

spots were being :illegally used by the people gathering at Bayoumi's

•apartment.

• On September 8, 1998, the San Diego FBI opened a preliminary inquiry

on Bayoumi. 26°The assigned agent checked FBI indices for further

information regarding Bayoumi and conducted other investigative steps.

The agent contacted the U.S. Postal Inspection Service in reference to the

alleged "suspicious" package sentto Bayoumi. A postal inspector advised the

FBI agent that"suspicious" did not necessarily mean "nefarious," and the vast

majority of suspicious packages were benign. The postal inspector reviewed

the report relating to the Bayoumi package and told the agent that the package

had been deemed "suspicious" because it had no customs papers or appropriate

postage and originated in Saudi Arabia. According to the report, there was no

record of any wires protruding from the package, Bayoumi had retrieved the

package, and it was no longer called a "suspect parcel."

According to the FBI agent, the apartment manager agreed to record the

license plate numbers of the meeting participants. However, the manager later

advised the agent that meetings had dwindled to a few particip_mts and then

stopped all together.

26oIn accordance with the Attorney General's Foreign Counterintelligence Guidelines, a

preliminary inquiry could be opened when there was information or allegations indicating

that an individual is or may have been an international terrorist or a recruitment target of an

international terrorist organization. Preliminary inquiries were permitted to remain open for

120 days and had to be closed unless the FBI obtained sufficient evidence to open a full field

investigation.

324
The agent asked fellow FBI agents to ask their "logical sources" for

information regarding Bayoumi. The sources related the following concerning

Bayoumi:

• Bayoumi was married with small children and had recently

,completed a master's degree program and he was looking for a

Ph.D. program, but his test scores were too low. He was

approximately 30 years old and unemployed.

• Bayoumi was a Saudi who regularly attended the ICSD (Islamic

,Center of San Diego). He was married with children and was

working on a master's or other advanced degree.

• Bayoumi reportedly delivered $400,000 to the Islamic Kurdish

,community in E1Cajon, California in order to build a mosque.

Source opined Bayoumi "must be an agent of a foreign power or

an agent of Saudi Arabia."

• Bayoumi was in the U.S. on a sVadentvisa but was applying for a

green card. Bayoumi claimed to, have a master's degree and was

working on a Ph. D His father was sending him $3,000 a month

for support while he was in school.

The FBI agent also contacted the INS in reference to Bay0umi's

immigration status. An INS special agent advised that Bayoumi was in the

U.S. on an F-1 student visa, but his work visa had expired. However, the INS

reported that 1hisvisa could be renewed.

The FBI agent received no further substantive information in response to

various information checks. According to the agent, the only remaining option

was to conduct an interview of Bayoumi. After her supervisor consulted with

fellow FBI agents who were working on a large, sensitive counterterrorism

investigation :involving an alleged terrorist organization, the supervisor

instructed the agent not to conduct the subject interview of Bayoumi. 26_The

agent told the OIG that she did not believe the:decision was;inappropriate

261 The file indicatesthatthe decisionnotto conductan interviewwas dueto an

investigationthat includeda proposedproactiveelement. TheFBIbelievedthatthe benefits

of interviewingBayoumididnotjustify the riskto the proposedoperation.

325
based on the potential effect of such an interview ,on the other sensitive

investigation.

On June 7, 1999, the FBI closed its preliminary inquiry on Bayoumi, and

he was no longer actively under investigation by tlheFBI.

The FBI case agent told the OIG that she had no concrete information

linking Bayoumi to any terrorist activities. She stated that the allegations that

gave rise to the preliminary investigation were nolLsubstantiated. With respect

to the source reporting that Bayoumi had received large sums of money from

overseas, the case: agent explained it was not unusual for foreign smdeiats,

especially from Saudi Arabia, to regularly receive money, even large sums of

money. Therefore, the case agent did not consider this to be inherently

suspicious.' The agent's squad supervisor at the time and other agents onthe

squad also told the OIG that it was not unusual or suspicious for Saudi students

to have received large sums of money from Saudi Arabia.

As stated above, one source had provided unverified infomaation that

Bayoumi could potentially be a Saudi intelligence operative or source.

Accordingto the agent, Bayoumi was allegedly very involved and interested in

Saudi affairs in San Diego, andthis probably led to the suspicions about

Bayoumi's connection to the Saudi government. ]However, the agent told the

OIG that Saudi Arabia was not listed[ as a threat country and the Saudis were

considered allies of the United States. 262Therefore, Bayoumi's; potential

involvement with the Saudi Arabian government would not have affected the

FBI's decisionto close the preliminary inquiry.

The squad supervisor at the time of our investigation, who had been an

agent on the squad for several years, told the OIG that before September 11,

the Saudi Arabian government was considered an ally of the United States and

that a report of an individual being an agent of the Saudi government would not

have been considered a priority. Other agents on llhe squad also said that a

source reporting that an individual was an agent of the Saudi government

262Country threats are defined by the FBI as foreign governments or entities whose

intelligence activities are so hostile, or of such concern, to the national security of the united

States that counterintelligence or monitoring activities directed against such countries are

warranted.

326
/

would not have been cause for concern because the Saudi government was

considered an ally of the United States.

In addition, the case agent explained that more intrusive investigative

techniques could not be conducted because of the restrictions of the Attorney

General FCI Guidelines in effect at the time. No meaningt_l surveillance

could be conducted, no bank records or other financial records could be sought,

and very little investigative activity beyond fully identifying the individual

could be done',.

In sum, we do not believe that the FBI's actions with regard to Bayoumi

and its decision to close the preliminary inquiry were inappropriate. The agent

conducted logical investigative steps that were;permitted under the Attorney

General Guidelines in effect at the time, such as checking FBI records for

information, asking other intelligence agencies for information about the

subject, and asking agents to query their sources about the ,;ubject, but the

agent did not uncover any information to support the allegations. The

Guidelines did not permit the case agent to engage in more intrusive

investigative techniques, such as a clandestine search of Bayoumi's property,

obtaining his telephone or financial records, or secretly recording his

conversations.

Although the Attorney General Guidelines would have permitted a

subject interview of Bayoumi prior to closing the preliminary inquiry, the

decision not to conduct an interview appeared warranted, given its possible

effect on an ongoing significant investigation.

2. The FBI's handling of the informational asset

As described above, in May 2000 Hazmi and Mihdhar began renting a

room in the home of an FBI informational asset. An FBI San Diego Special

Agent who we call "Stan" was the asset's control agent since the asset was

opened in 1994. The asset had provided the FBI with significant information

over the years',and was considered a reliable source. He was well known in the

Muslim community. He often rented rooms in his house to Muslim men in the

community who needed temporary housing. At the time that Hazmi and

Mihdhar moved in with him, he lhadtwo other individuals renting rooms in his

house. Mihdhar lived with the asset until June 10, 2000, wihenhe left the

J

327
United States, and Hazmi remained as a boarder at the asset's home until

December 2000.

According to Stan, the asset told Stan that two young Saudis who had

recently come to theUnited States to visit and study had moved in as boarders.

The asset described them as good Muslims who oftenwent to the mosque and

prayed. The asset provided Stan with their first names but little other

identifying information. Stan did not obtain any additional information from

the asset about the boarders, such as their last names, and he did not conduct

any investigation of them.

Had Stanpursued information about Hazmi and Mihdhar:, he might have

uncovered the:CIA information about them. In addition, he might have created

a record inFB! computer systems about Hazmi and Mihdhar's presence in San

Diego, which would have provided the FBI with additional information and

avenues of investigation when it began to search tbr them in August 2001. For

these reasons, we examined Stan's actions with regard to the asset.

In interviews with the JICI staff and in congressional testimony, Stan

stated that the infi_rmational asset primarily provided information about the

activities and identities of persons in the Muslim community in San Diego who

were the subjects of FBI preliminary inquiries or Jhll field investigations. 263

Stan said that the asset volunteered some information about other individuals

as well. He said he thought that the asset had good judgment aibout which

individuals might pose a threat and that his reporting had been ':'consistent"

over the years. We reviewed the asset's file and noted the asset provided

information on a regular basis on a variety of different individuals and topics.

Although we coul[d not evaluate the asset's judgment from the :file, we consider

Stan's description of the asset's reporting to be apt.

Stan also stated that he was aware that the asset had boarders in his house

over the years, and the fact that two new boarders had moved in with the asset

did not arouse suspicion. He noted that the asset volunteered that the two

boarders were liwing with him soon after they moved in, but the asset provided

the information about his boarders as part of a personal conver,;ation and not

263As noted above, Stan has retired from the FBI and declined to be interviewed by the

OIG.

328
because the asset believed that it hadany significance. Stan stated the

information provided from the asset was that the two boarders were from Saudi

Arabia, which, according to Stall.,was not a country that the United States had

placed on the list as a threat to national securitT. Stan said that the asset did not

•describe his boarders as suspicious or otherwise worthy of fiarther scrutiny. He

also asserted that he was prohibited from further pursuing tlheinformation

about Hazmi and Mihdhar, including documenting the information that he had

obtained, because of the Attorney General Guidelines in effect at the time.

In examining Stan's actions, we first considered whether the Attorney

General's FCI Guidelines were applicable to the situation involving Hazmi and

Mihdhar. As suggested by Stan, the Attorney General's FCI Guidelines were

designed to ensure that the FBI opened preliminary inquiries and conducted

investigations only if the required predicating information was present.

Because there were no allegations or information provided to Stan that Hazmi

and Mihdhar 'were terrorists or agents of a foreign power, we agree that Stan

did not have sufficient information to open a preliminary inquiry and actively

investigate Hazmi and Mihdhar.

We also. considered whether, at a minimtam, Stan could have attempted to

obtain additional information about people who were living with his

informational asset, such as their full names, and .whether he was required to

document the information on Hazmi and Mihdhar that he had received from his

asset. First, we reviewed FBI policies and procedures for handling assets.

Those policies did not require Stan to obtain information from an informational

asset about pe,ople living in the asset's house or to conduct record checks to

obtain this intbrmation. In addition, the policies do not appear to require Stan

to have documented information received from the asset about anyone living

with him, or to even document their full identities if he had obtained that

information.

/ We also,interviewed several FBI agents who were on Stan's

counterterrorism squad and asked them whether it wouldhave been their

practice to seek additional information about boarders living with an

informational asset and what, if anything, they would have done with this

information. We found no consensus among them about whether information

on boarders like Hazmi and Mihdhar who lived with an in%rmational asset

should have been obtained and documented, o_ome agents stated that they

would have pursued more information about boarders living with an

329
informational asset, while others stated that they would not have. Some of the

agents stated that they would have noted the fact of the informational asset

having boarders in his file. Some agents statedthat they would have

documented the identities of the roommates in an EC that would have been

uploaded to ACS. However, former San Diego Division Special Agent in

Charge William Gore told the OIG that he "did not believe anything had been

done wrong" in the handling of the informational .asset and he did not fault

Stan for not obtaining the information.

While we re,cognize that no FBI policy addressed this issue and there was

a lack of consensus on what should have been done in a situation like this, we

believe that it would have been abetter practice for Stan to have questioned the

informational asset about his boarders and obtaine,d their full identities. Stan

was aware that Hazmi and Mihdhar were relative strangers to the informational ..

asset, and that they were not friends, family, or long-time associates of the

asset. Stan also was aware that the asset had no direct knowledge of Hazmi

and Mihdhar's backgrounds and could not vouch :['ortheir character.

Moreover, the boarders in the asset's home were in a position to put the asset

and the information he supplied to the FBI in jeopardy. Therefore, prudence

and operational security would suggest that information about persons living

with the asset should have been sought, at least to the extent of learning and

documenting their names, and perhaps running a records check on them.

If Stan had asked more questions about the asset's boarders, he also may

have acquired enough information to pursue further inquiry. For example, the

asset has stated after the September 11 attacks that Ha_zmiand Mihdhar did not

make telephone calls from his house, and that in retrospect he found this ,.

behavior to be suspicious. The asset also stated after September 11 that he had

told Hazmi to stay away from Bayoumi because of his alleged association with

the Saudi govermnent. Therefore, if Start had asked the asset a few more

questions about Hazmi and Mihdhar and acquired this kind of information, it

may have led Stan to conduct further inquiries, particularly since Bayoumi had

been the Subject of an FBI investigation.

Moreover, while no specific FBI policy required agents to obtain

information aboullpersons living in a house with an informational asset, FBI

policies required control agents to continuously evaluate the credibility of their

informational assets. Before informational assets are approved, they are

required to undergo a background investigation to assess their suitability,

330
credibility, and "bona fides. ''264 Certain minimum checks were required, such

as a check of FBI indices, local criminal checks, and CIA traces. The policy

provided-that additional checks "may be deemed necessary," such as querying

other assets and running indices checks on in, mediate family members. In

addition, FBI policy provided that an asset's bona tides "should be continually

addressed," even after the initial assessment was completed.

More specifically, the FBI field office is required to conduct a yearly

evaluation of each informational asset and provide the eval_aation report to FBI

Headquarters. This report is required to contain, among other things, the FBI's

number of contacts with the informational asset during the reporting period, a

summary of the most significant information t'urnished by the informational

asset; :the number of preliminary inquiries and full investigations that were

opened based on information provided by the informational[ asset, and "steps

that have been taken to establish asset bona tides since last evaluation."

Although Stmawould not have been required to obtain additional information

about his informational asset's boarders to complete this report, the FBI's

policy of continually vetting the credibility of its assets penv_itted Stan to seek

more information about Hazmi and Mihdhar and the other boarders from his

asset and run indices checks on any persons 1Mng with his informational asset.

We reviewed the informational asset's t_ile,Stan's yearly evaluation of

the asset, and Stan's reporting on the bona tides checks con_ductedon the

informational asset. Based on our review, we were concerned by the lack of

information included in the file in support of the bona tides checks conducted

by Stan each year. In each of the documents provided to FBI Headquarters

about the informational asset that we reviewed, Stan wrote the following

perfunctory paragraph: "Asset bona tides have been estaNished through

independently received reliable asset reporting, [redacted] _mdphysical

surveillance."

Stan maintained no predicating information in the file on these bona tides

checks. The file did not disclose which checks orsurveillance had been

264The FBI defines "bona tides" to mean that the asset or informational asset "is who

he/she says he/she is;" that the asset "has the position or access the asset claims to have;"

and that the asset "is not working for or reporting to a foreign intelligence service or

international terrorist organization without the knowledge of the FBI."

331
conducted, by whom, when, or the results. Without that material, the

informational asset's bona tides were merely verifiedthrough tlhe attestation of

Stan. It is possible that Stan conducted numerous indices checks and

conducted an exhaustive bona tides check on the informational asset each year.

It also is possible that he conducted minimal or no checks and merely attested

to the informational asset's credibility based on their personal history and

relationship. Because we were unable to interview Stan, we could not

determine which 'was more likely.

:However, n,oFBI policy described the level of detail to be contained in

an asset file, We believe the policy ,;hould require an asset file to contain at

least minimal information to allow a reviewer to independently verify that an.

adequatebackground check has been conducted. This informal:ion is necessary

to allow FBI managers to determine whether the control agent Js continuing to

assess each informational asset's credibility. This information would also help

ensure that the.control agent has notbecome too comfortable with the

informational asset and thus vulnerable to being misled or failing to obtain

adequate information about the asset.

We also were concerned by the lack of policy or practice specifying what

information from the asset must be documented. The Hazmi and Mihdhar case

clearly demonstrates that information must be documented to be useful. Even

if Stan had obtained the full names of Hazmi and Mihdhar from the

informational asset, he would not have been required to document it in any

retrievable format. Without the requirement to document such information, the

information would not have been accessible to other FBI personnel. For

information to be useful, it must be documented in a retrievable form and it

must be available for consideration and analysis.

In sum, we believe that Hazmi and Mihdhar's presence in San Diego

should have drawn some scrutiny from the FBI. Although untcnown at the

time, documenting their presence in San Diego in a searchable and retrievable

manner would have provided an opportunity for the FBI to connect information

in the future. If Hazmi and Mihdhar's presence in San Diego in 2000 had been

documented, an FBI indices record check in August 2001, when the FBI

received information from the CIA that Hazmi ancl Mihdhar had entered the

332
United States, might have led the FBI to the San Diego information. This

connection would have provided substantive leads for the New York FBI's

effort to locate Mihdhar in August 2001.265

3. San Diego FBI's failure to prioritize counterterrorism

investigations

As discussed in Chapter Two, in 1998 the FBI adopted a 5-year strategic

plan that established the FBI investigative priorities in a 3-tier system. Tier I

priorities were "foreign intelligence, terrorist,:and criminal activities that

directly threaten the National or Economic Security of the United States."

Tier II priorities were "crimes that affect the public safety or undermine the

integrity of American society: drugs, organized crime, civil fights, and public

corruption." Tier Ill priorities were "crimes that affect individuals and

property such as violent crime, car theft, and telemarketing scams..."

On March 15, 1999, shortly after Director of Central Intelligence George

Tenet asserted the U.S. Intelligence Community was declaring war on Usama

Bin Laden and al Qaeda, FBI Headquarters established national level priorities

within its Counterterrorism Program. Bin Laden and al Qaeda, along with the

Bin Laden-allied Egyptian Islamic Jihad (EIJ) and al Gama'at al Islamiyya

(IG), were designated as "priori .tygroup one" for the FBI,s counterterrorism

efforts.

Our review of the Hazmi/Mihdhar chronology revealed no appreciable

shift in resources by the FBI's San Diego FieM Office in response to these

changed priorities. We found that prior to September 11, 2,001, the actual

investigative priority for the San Diego Field Office was drug trafficking.

According to former San Diego Special Agent: in Charge William Gore, the

highest concentration 0fFBI agents and resources in San Diego was directed at

combating drag trafficking based on the FBI's process and procedures used

each year to set priorities in its field offices. He said that white-collar crime

was the office's second priority, and violent crime was its tihirdpriority.

265AS noted, Mihdhar and Hazmi used their own names to open bank accounts, conduct

financial transactions, obtain state identification cards, purchase a vehicle, obtain telephone

service, take flying lessons, and rent an apartment while residing in San Diego.

333
Counterterrorism was only the fourth priority for the San Diego FBI office.

The counterterrorism efforts in San Diego were directed primarily at another

terrorist organization and related groups not connected to A1 Qaeda, and the

majority of San Diego's counterterrorism investigations targeted activities

related to the indirect support of terrorism conducted by those groups.

We found that the San Diego FBI focused little tO no investigative

activity on al Qaeda prior to September 11. San Diego FBI personnel stated to

us that they had believed there was no significant al Qaedaactivity in San

Diego based on information from their sources and investigative activities. _

The former supervisor of the San Diego counterte:rrorism squad explained their

job at the field orifice level was to "shake the tree and see what fell out".in

relation :topotential terrorism activities in their area_ Although San Diego

agents assigned to counterterrorism conceded they had received little to no

specific training c,onceming Bin Laden or al Qaeda, they asserted that al Qaeda _ :

did not have a significant presence in San Diego prior to September 11.

Yet, al Qaeda was present in San Diego, unbeknownst to the FBI. Hazmi

and Mihdharresided in San Diego. Unfortunately, the San Diego agentswere

not focusingon al Qaeda. Even though FBI Headquarters had ,designated al

Qaeda as the number one counterterrorism priority, the San Diego FBI was not

attempting to identify individuals that were associated with al Qaeda.

Since September 11, many San Diego agents have been moved from

other squads and ;assigned to counterterrorism. Significantly, the San Diego

office opened a large number of intelligence investigations on potential al

Qaeda subjects immediately after September 11. Obviously, the focus and

priorities dramatically changed after September 11. But there is no reasonto

believe the al Qaeda presence in San Diego began only after September 11 If

San Diego's focus on counterterrorism and al Qaeda had occur_cedearlier in

San Diego, there 'would have been a greater possibility, though no guarantee,

that Hazmi's and Mihdhar's presence in San Diego may have come to the

attention of the F]3I before September 11.

However, it is important to note that San Diego's allocation of resources

before September 11 and the lower priority it gaw_ to the Coun_Ierterrorism

Program were not atypical of FBI field offices before September 11. In an

OIG September 2002 audit report entitled "A Review of the Federal Bureau of

Investigation's Counterterrorism Program: Threat Assessment, Strategic

334
Planning, and Resource Management," we found that "Although the FBI has

developed an elaborate, multi-layered strategic planning system over the past

decade, the system has not adequately established priorities or effectively

allocated resources to the Counterterrorism Program."

FurtheaTnore, the OIG report found that resources were not allocated

consistent with the FBI's priorities - particularly at the field office level -

because of the lack of"management controls" in the FBI's "complicated and

paper-intensive strategic planning process.,' Insteadof allocating resources

based on FBI priorities, field offices allocated resources primarily based on

previous case]Loadsin the field office. According to the report, prior to +

September 11, "the Bureau devoted significantly more special agent resources

to traditional law enforcement ac,tivities such as white collar crime, organized

crime, drug, and violent crime investigations than to domestic and international

terrorism inve,stigations." For example, in 2000 twice as many FBI agents

were assigned to drug enforcement than to counterterrorism. Thus, the San

Diego's office allocation of resources was not different from many other FBI

field offices, despite the stated priorities of the,'FBI.

C. Events in the spring and summer of 2001

As described in the factual chronology, the FBI had several opportunities

in the spring and summer of 2001 to obtain critical intelligence about Mihdhar

and Hazmi. Although the FBI and the CIA were discussing Mihdhar, Khallad,

andthe Cole investigation throughout the spring and summer of 2001, the FBI

did not become aware of the critical intelligence involving Mihdhar's U.S. visa

and subsequent travel to the U.S.. until late August 2001. As we discussed

above, we believe that systemic ]problems regarding information sharing

between the two agencies contributed to the FBI's failure to obtain this

irlformation earlier. But restrictions within the FBI also contributed to the

FBI's failure to acquire critical information about Hazmi and Mihdhar before

September 11. In this section, we discuss those problems.

1. Restrictions on tl)e flow of information within the FBI

By the summer of 2001, the effect of the various restrictions within the

FBI on information sharing - commonly referred to as "the wall" - had

resulted in a nearly complete separation of intelligence and criminal

investigations; within the FBI. This separation greatly hampered the flow of

335
information between FBI personnel working criminal and intelligence

investigations, including information concerning Hazmi and Mihdhar in the

summer of 2001.

As discussed in Chapter Two, in late 1999 the FISA Com_ had become

the "wall" for purposes of passing FISA information on targets of a particular

terrorist organization from FBI intelligence investigations to criminal

investigations, iAny information that intelligence agents wanted to give to

criminal agents had to be provided to the FBI's NSLU, which then provided it

to OIPR, which then provided it to the FISA Court, which then had to approve

the passage of the:information to criminal agents. In addition, after the FISA'

Court was notified in the fall 2000 about errors in approximately 100 FISA

,applications; a significant portion of which related to the FBI's representations

about the "wall" procedures in al Qaeda cases, the FISA Court imposed new

restrictions on the',FBI's handling of FISA information. The FISA Court

required a certification from all individuals who received FISA information

stating that they understood this requirement.

The FISA Court exempted CIA and NSA personnel, who often received

FISA information from the FBI, from this certification requirement. But the

FISA Court required that the CIA and NSA indicate on the information they

provided tothe FBI whether the information had been obtained based on FISA

information previously provided to them by the FBI (called "FISA-derived

information"). In response, the NSA decided that it was more efficient not to

delay dissemination of intelligence while checking to see if it was derived from

FISA, and it therefore placed a caveat on all NSA counterterrorism reports to

the FBI stating that before information could be considered for dissemination

to criminal perso_mel, the FBI had to check with the NSA General Counsel

about whether the intelligence was FISA-derived. Once the NSA determined

whether the information was FISA-derived, the FBI had to comply with the

wall procedures for passing FISA-derived information to criminal agents or

prosecutors. If the information was not FISA'-derived, it could be passed

directly.

FBI Headquarters personnel became wary that any involvement of

criminal agents in intelligence investigations could present problems for the

FBI with the FISA Court.. A former ITOS unit chief described the FISA

Court's certification requirement as a "contempt letter" and said that it "shut

down" the flow of information in the FBI. He further stated that FBI

336
Headquarters employees became worried that any misstep in handling FISA

information could result in harm to their careers because an FBI agent was

banned from appearing before the FISA Court and OPR began an investigation

on him. These three factors - the Court had become the screener in al Qaeda

cases, the certification requirement imposed by the FISA Court, and concerns

about violating the Court's rules - combined to stifle the flow of intelligence

information within the FBI. FBI employees described this _Lothe OIG as the

walls within tlheFBI becoming "higher" over time. New York FBI agents told

the OIG that the wails were viewed as a "maze" that no one',really understood

or could easily navigate.

As we discuss below, these walls affecte,d the FBI personnel's

discussions about the Mihdhar information at the June 11,2001, meeting in

New York and the FBI's decision to open an investigation to locate Mihdhar in

August 2001.

2. Problems at the June 11 meeting

At the June 11,2001, meeting, FBI Headquarters and CIA CTC

personnel discussed with New York FBI investigators issues relating to the

Cole investigation. At the time of this meeting, the FBI analyst who we call

Donna had received information fromthe CIA concerning l_avel in January

2000 of an al Qaeda operative named Khalid _d-Mihdhar to Malaysia through

Dubai.

After receiving the information from the:CIA, Donna had conducted her

own record check on Mihdhar in CTLink and discovered the NSA information

from late 1999 and early 2000 associating

266Although not shared with Donna or known to anyone else in the FBI, the CIA also

knew in June 2001 that Mihdhar had a U.S. visa, that Mihdhar's associate -- Hazmi -- had

traveldd to the United States in January 2000,

337
This NSA intelligence about Mihdhar would have been important to the

FBI agents conducting a criminal investigation n__, However,

Donna did not share this information with the criminal agents at the June 11

meeting because of concerns about the wall. By tlhistime, the FBI was

operating under the requirement that all NSA counterterrorism information had

to bereviewed by the NSA's General Counsel's Office for a determination of

whether it was FISA-derived before it could be considered for dissemination to

criminal agents. Because she had not yet asked the NSA whether the

information could bepassed, Donna did not provide the New York agents with

any of the NSA information. That information would have been important to

the New York agents who were working the Cole investigation because they

specialized in al Qaeda operations and at the June 11 meeting showed great

interest__i That information may also

have provided the criminal agents with additional leads and could have led to

the information that Mihdhar and Hazmi had traveled to the Un:ited States in

January 2000.

We recognize that the caveat on sharing any NSA counterterrorism

information did not mean that the criminal agents were prohibil:ed from ever

obtaining access to the NSA information on Mihdhar. But if the information

was FISA-derived, the caveat created a delay in the criminal agents receiving

_ the information because of the lengthy procedures that had to be followed to

share the information with them.

With respect to the information Donna had received from the CIA about

the Malaysia meetings, Donna showed the photographs to New York agents

and asked whether they could identify___ .:

.After one of the agents made a tentative identification, the agents

asked questions about Mihdhar and the photographs. The agents continued to

ask Donna questions about Mihdhar, the Malaysia meetings, a_Ldthe

photographs on June 11 after the meeting. As we discussed above, it is unclear

how much questioning occurred during the actual meeting and how much

occurred after the meeting. Donna was unable to answer most ,ofthe agents'

questions because: she had not obtained the information from the CIA. This, in

our view, was not: because of the wall, but was because of Dorma's failure to

plan the meeting adequately or ask sufficient questions from the CIA in

advance of the meeting.

338
First, we believe the planning for the June 11 meeting was flawed.

Although Donna and other IOSs frequently traveled to New York to work on

the Cole investigation, she told the OIG that this was the first time that she had

arranged for a meeting involving CTC personnel in New York. Yet, according

to what the meeting participants told the OIG, the purpose _mdthe agenda of

the rneeting were not clear. The participants agreed that they knew there was

going to be a cliscussion of the investigative results on the Cole attack. The

New York agents believed that the CTC and FBI Headquarters had information

to sharewith New York. Donna and the CTC participants, however, described

the meeting as a "brainstorming'" session to de,termine what new leads could be

pursued' and what FBI Headquarters could do to assist New York.

No agenda was preparedand no supervisors were consulted for their

inpui about the meeting. Even though Donna said that she ,called the meeting

to explore further leads or avenues of investigation in the Cole case, she

apparently did not ask the CTC participants to be prepared to present

information or answer questions. Mary and Peter told the OIG they were not in

a position to discuss the Cole investigation. Mary said she was not up to speed

about the Cole investigation or the Malaysia meetings. Peter told the OIG that

as an analyst at the CIA, he did not have authority to discuss CIA information

atthe meeting and he was merely "tagging along."

:Donna told the OIG that she considered Mary to be another FBI

employee at tlhemeeting, and for this reason did not provide her with any

specific instructions in preparation for the meeting. Donna also said that she

had not invited,Peter and because she was not in his chain of command, shedid

not ask him to be prepared. However, the New York agents we interviewed

told the OIG that they believed that CTC personnel were coming to the

meeting in part to share information with them. The fact that all the

participants we interviewed described the meeting as unproductive and a

"waste of time" highlighted that a more useful exchange of information could

have occurred.

With respect to the __l, Donna had obtained only

limited information from CIA employee John about the photos when'she

received them. She did not ask general background questions such as whether

anyone else in the photographs had been identified, or what else was known

from the Malaysia meetings. Donna told the OIG that because she believed the

CIA provided her with everything she was entitled to know, she did not have

339

/
an in-depth discus;sion about the photographs. Jotm said he did not recall

anything about his discussions with Donna regarding the ]]re[Illm

Donna told the OIG that when the New York agents asked her questions

about Mihdhar, the Malaysia meetings, and the photographs, she thought that

they were reasonable questions, but she did not know the answers. She stated

that at the time she obtained the _n from the CIA, she

believed that they were only potentially related to Quso and their significance

to the Cole would, hinge on whether Quso was in the photographs.

We believe Donna should have asked the C!A additional questions about

the photographs.

Given her interest in

, she should have wanted to ascertain,

and asked the CIA, what, if anything, was known about the purpose of the

Malaysia meetings, who were the other participants at the meetings, what was

known about the ]participants, and any other available information.

Donna also did not ask the CIA whether there were additJLonalphotos Or

documentation, Donna told the OIG she was unaware that there could have

been additional photographs or other relevant information avai}table. We

believe that someone in her position should have known or at least asked for

additional information about the subject of the photographs in preparation for

the meeting.

We alsowere troubled by Donna's inadequate efforts to obtain additional

information after the June 11 meeting, particularly information about the

Malaysia meetings, since ithad been the subject of a dispute between Donna

and Scott, Although Donna told the New York agents that she would check

with the CIA about additional information regarding the photographs and the

Malaysia meetings, Donna made little effort to obtain this information until

two months later, in August 2001. Donna told the,'OIG that she believes that

she made some unsuccessful follow-up phone call[s to Peter and John about the

photographs. It is not clear from the documentary evidence how much Donna

did before August to obtain the information, but she did not provide additional

information to the New York agents about the photographs for at least two

months. We recognize that FBI analysts were ow_rwhelmed with assignments

and had to juggle many responsibilities, however, given the possible

340
connections of this information to the Cole investigation, we believe Donna

should have made more aggressive and timely efforts to oblLainthis information

soon after the June 11meeting and to keep the',New York agents informed

about what her follow-up efforts were.

By the same token, Scott, the New York Cole case agent, did littleto

follow up after the June 11 meeting to obtain information he requested

_lll. Scott told the OIG he "often" asked Donna about the

status of the information, but he was not provided any such information.

Donna contended that Scott did not follow up on his June I 1 requests. We

found no evidence such as e-mails or other documents to support Scott's claim

•that he raised the issue often with Donna. We believe that neither Donna nor

Scott made significant efforts after the meeting to obtain the information.

3. The FBI's investigation in August 2001 to find Mihdhar and

Hazmi

As discussed above, on August 22, 2001, the FBI learned that Mihdhar

and Hazmi had entered the United States in January 2000, that Mihdhar had

again flown to New York on July 4, 2001, and[that there was no record of

either of them leaving the country. The FBI also learned that Khallad hadbeen

identified in tl_eKuala Lumpur photographs. Upon discovery of this

information, the FBI opened an intelligence investigation in New York in an

effort to locate Mihdhar.

Once again, however, the separation between intelligence and criminal

information affected who could receive access;to the information about Hazmi

and Mihdhar. This interpretation of the wall also hampered the ability of the

FBI New York agents working on the Cole investigation to participate in the

search for Hazmi and Mihdhar. In addition, we found that llheFBI's efforts to

locate Hazmi and Mihdhar were not extensive. We do not i['aulthe case agent

assigned to locate them. He was new and not instructed to give the case any

priority. Rather, we found tlhatthe FBI New York did not pursue this as an

urgent matter or assign many resources to it.

341
a. The effect of the wall on the FBI's attempts to locate

Mihdhar

As discussed above, Donna drafted an EC to the New York FBI

requesting it open an investigation to locate Mihdhar. She also called Chad,

the FBI New York agent who primarily handled intelligence investigations for

the Bin Laden squad, to give him a "heads up" about the matter, and she

subsequently sent the EC to him. She wrote in the e-mail that she wanted to

get the intelligence investigation going and the EC could not be shared with

any of theagents working the Cole criminal case. Chad forwarded the EC to

his squad supervisor, Jason, who nevertheless disseminated the EC via e-mail

within the Bin Laden squad, including to the criminal agents assigned to the

Cole investigation.

Scott read the EC and contacted Donna regarding it. Donna informed

Scott that he was :not supposed to have read the EC because it contained NSA

information that had not been cleared to be passed[ to criminal agents. Donna

told Scott that he needed to destroy his copy. Scott responded that the effort to

locate Mihdhar II ill|, and he argued

with Donna regarcling the designation of the investigation as an intelligence

matter. Donna asserted that, because of the wall, criminal agents were not yet

entitled to the underlying intelligence provided by the NSA, andll

_l the FBI could not establish any connection between

Mihdhar and the Cole criminal investigation.

Scott, Donna, and acting UBL Unit Chief Rob then spoke: via conference

call. Scott argued that the investigation should be opened as a criminal

investigation and that more resources and agents couldbe assigned to a

criminal investigation by New York. He also argued that criminal investigative

tools, such as grmad jury subpoenas, were far quicker in obtaining information

than the tools available in intelligence investigations.

Donna consulted with an NSLU attorney, Susan. According to Donna,

Susan concurred that the matter should be handled as an intelligence

investigation and that because of the wall, a criminal agent cou![d not

342
participate in the search for or any interview of Mihdhar. 267 When Donna

advised Scott of Susan's opinion in an e-mail message, Scott responded by email that he believed the wall was inapplicable. Scott ended his message by

suggesting that because of the NSLU's positien, people were going to die and

that he hoped that NSLU would stand by its position then.

The way that FBI Headquarters handled the Mihdhar information

reflected its interpretation of the requirements of the wall prior to September

11. First, because the predication for the search for Mihdhar originated from

the NSA reports, this information could not be,immediately shared with

criminal agents. Instead, it first had to be cleared for dissemination by the

NSA, which would determine whether the intelligence was based on FISA

information. If so, the information had to be cleared for passage to the criminal

agents - the information had to be provided to the NSLU, which then provided

the information to OIPR, which then provided it to the FISA Court, which then

had to approve the passage of this information, to criminal agents. In fact, the

limited INS information concerning Mihdhar's and Hazmi's entries into the

United States was the only unrestricted information in the EC immediately

available to the criminal investigators.

__, the decision to open an intelligence

investigation resulted in certain restrictions. FBI Headquarters employees

understood that they needed to ensure that they avoided any activities that the

FISA Court or OIPR could later deem "too criminal" and could use as a basis

to deny a FISA application. This included pre.venting a criminal agent from

participating in a subject interview in an intelligence investigation. While

Scott was con:ect that the wall had been created to deal with the handling of

only FISA intbrmation and that there was no legal barrier to a criminal agent

being present for an interview with Mihdhar if it occurred in the intelligence

investigation, FBI Headquarters and NSLU believed that the original wall had

been extended by the FISA Court and OIPR to cover such an interview.

Scott's frustration over the wall was similar to Henry"s

when Henry was told by Don that seeking prosecutor

267AS discussed above, Susan told the OIG that she did not recall this discussion with

Donna.

343
involvement prematurely could potentially harm any FISA request. Scott, like

Henry, wanted to pursue a criminal investigation _mdbecame fi:ustrated when

he was advised by FBI Headquarters that he could[not proceed in the manner

he deemed appropriate. Scott's perception was that FBI Headquarters had

misconstrued "the wall" and the wall had been inappropriately expanded. He

told the OIG that he believed the wall should only relate to FISA or FISAderived information. Like the Minneapolis FBI, Scott believed that he was

being "handcuffed" in the performance of his job and that FBI Headquarters

"erred on the side of caution" in its approach to intelligence information.

FBI Headquarters, on the other hand, acted in accordance: with its

experience with OIPR and the FISA Court. FBI Headquarters believed that

OIPR and the FISA Court requiredstrict adherence to the procedures for the

passage ofintelligence information to criminal investigations and required

separating criminal and intelligence investigations;. Donna explained that the

FISA Court's rnandates resulted in the need for the FBI to creaTLea near

complete separation between intelligence and criminal investigations in order

to effectively use intelligence inforrnation. Rob also told the OIG that there

were "land mines" in dealing with intelligence versus criminal information,

and it was difficult to appropriately straddle the two sides.

,Our review of this case showed that the wall had been expanded to create

a system that was complex and had made it increasingly difficult to effectively

use intelligence information within the FBI. The wall - or "maze of walls" as

one witness described it- significantly slowed the flow of intelligence

information to criminal investigations. The unintended consequence of the

wall was to hamper the FBI's ability to conduct effective counterterrorism

investigations because the FBI's efforts were sharply divided in two, and only

oneside had imrnediate and complete access to the available information.

The wall was not, however, the only impediment in the FBI's handling of

the investigation to find Mihdhar and Hazmi. We found there were also other

problems in how the search for Mihdhar and Hazmi was handled.

b. Allocation of investigative resources

We found that prior to the September 11 attacks, the New York Field

Office focused its;al Qaeda counterterrorism efforts on criminal investigations,

but it did not expend a similar effort on intelligence investigations or the

344
development of intelligence information. New York agent,; told the OIG they

believed that criminal prosecution was the most effective tool in combating

terrorism. They asserted that criminal investigations are al,,;oa preventive

activity and the FBI had always focused on preventing terrorism, even before

September 11. They pointed to the TERRSTOP investigation in 1993, an

investigation to uncover a terrorist plot to attack New York City landmarks,

and the criminal investigation into the East African embassy bombings.

Prosecutors also argued that criminal investigations and prosecutions are

an effective preventive measure against terrorism. Testifyi_ag before the Joint

Intelligence C,ommittee, Mary Jo White, the former U.S. A_Ltorneyfor the

Southern District of New York (SDNY), stated, "[W]e viewed the terrorist

investigations and prosecutions we did from 1993-2002 as a prevention tool."

Patrick Fitzgerald, currently the U.S. Attorney for the Northern District of

Illinois and formerly an Assistant U.S. Attorney in the SDNY, told us that it is

a misconception that there has to be a difference between prosecution and

gathering intelligence. He added that the SDNY prosecutions produced a

"treasure trove of [intelligence] information."

However, prosecutors alsorealizedcriminal investig_tion and

prosecution were not the only means:of countering terrorism. White stated,

"the counterterrorism strategy of our country in the 1990s was not, as I have

read in the media, criminalprosecutions." She further stated, "none of us

considered prosecutions to be the country's counterterrorism strategy, or evena

major part of it." As Fitzgerald told us, "in order to connect the dots, you need

people to gather the dots."

Although we agree criminal investigations are a highly effective

counterterrorism tool, intelligence investigations were not given nearly the

same level of resources and attention in the FBI's New York Field Office

before September 11,2001. This criminal focus was clear in the assignment of

personnel on the New York Bin Laden squad. From October 2000 to June

2001, only one agent on the Bin Laden squad was designated as the

"intelligence'" agent- the agent we call "Chad." The remainder were

designated as "criminal" agents. 268Chad told us that he was inundated with

268Onecriminalagentworkedon intelligencematterson a part-timebasis.

345
intelligence investigations and information, and he rarely had enough time

even to review all the incoming Bin ]Ladenintelligence information, let alone

to digest, analyze, or initiate the procedures to pass the information to the

criminal agents Where applicable. Chad also told us that the "intelligence"

agent designation was "not a desirable position" within the Bin Laden squad.

He described himself as the "leper" on the squad clue to "the wall."

Furthermore, Chad stated that the intelligence side of the squad received far

less and lower quality resources.

The handling of the investigation to locate Mihdhar provides a clear

indication of the primacy of the criminal over intelligence investigations in the

New York office. On August 28, ZOO1, the New :fork Field Office opened an

intelligence investigation to locate Mihdhar based upon Donna"s EC. Donna

told the OIG that .shebelieved there was some urgency to the Mihdhar

investigation, not because of any evidence that he was operational, but because

he could leave the;United States at maytime and the opportunity to find out as

much as possible about him would be lost. She said she therefore called Chad

about the EC in advance, which she did not normally do.

However, when she sent the EC to New York, she assigned the matter

"routine" precedence, the lowest precedence level. When asked about this

discrepancy, Dorma told the OIG that the Mihdhar investigation was "no

bigger" than any other intelligence investigation that the FBI was pursuing at

the time.

The NewYork Bin Laden squad relief supervisors, who we call "Jay"

and "David," told the OIG that they recognized that there was some urgency to

the Mihdhar investigation. Yet, the FBI in New York did not treat it like an

urgent matter. The investigation was given to an inexperienced agent-

"Richard"- who ihadonly recently been assigned to the Bin Laden squad. This

was his first intelligence investigation. As one of the largest field offices in the

FBI, with over 300 agents assigned to the JTTF, the New York Field Office

could have assigned additional or more experienced agents who were not

involved in the Cole criminal investigation to assist Richard. However, the

New York Field Office Bin Laden Squad was focused on criminal

investigations. As a result, the designation of the Mihdhar mat_Ieras an

intelligence investigation, as opposed to a criminal investigation, undermined

the priority of any effort to locate Mihdhar.

346
Finally, we also noted that there was a dear predicate for a criminal

investigation that no one appeared to notice at the time. In her EC, Donna

noted that Mihdhar had previously traveled to the United States, according to

information she had obtained from the INS. After the FBI's intelligence

investigation was opened, she obtained and forwarded to Richard a copy of

Mihdhar's June 2001 visa application on which he stated that he had not

previously been issued a visa'and had never traveled to the United States.

Thus, there was a clear basis to charge Mihdhar criminally with false

statements or visa fraud. Significantly, this information had been provided to

the FBI without the restrictive caveats placed on NSA reports and other

intelligence information. As a result, if Mihdhar had been found, he could

have been arrested and charged with a criminal violation based on the false

statements on his visa application. However, tlhe FBI did not seem to notice

this when deciding whether to use criminal or intelligence resources to locate

Mihdhar.

D' IndJividual performance

This section summarizes the performance of individual FBI employees in

the Hazmi and Mihdhar matter. While none of them committed misconduct,

we believe that several FBI employees did not perform their duties as well as

they could have and should have. We address in turn the FBI employees

involved in each of the five lost opportunities.

In this section, we do not discuss the performance of J[ndividual CIA

employees. However, we believe that a significant cause of the faihlres in the

sharing of infi_rmation regarding the Hazmi and Mihdhar case is attributable to

the actions of the CIA employees. It is the responsibility o1_the CIA OIG to

assess the accountability of the actions of CIA employees.

1. Dwight

In January 2000, intelligence information was developed about Hazmi,

Mihdhar, and _l meeting in Malaysia. Dwight, an FBI

detailee to the CTC's Bin Laden Unit, read the CIA cables about the Malaysia

meeting. The cables indicated that Mihdhar had a U.S. visa and that he listed

New York on the visa application as his intended destination. Dwight

recognized the significance of this information to the FBI and drafted a CIR to

pass this information to the FBI.

347
Unfortunately, his draft CIR was never sent. A notation added to the CIR

suggested that it was held at the request of the CIA's Deputy Chief of the Bin

Laden Unit. Seve,ral FBI detailees accessed the CIR, and Dwight inquired

about it again five days later, asking the Deputy Chief in an e-mail whether it

was going to be sent or whether he needed to "remake" it in some way. We

found no response to his e-mail, and none of the participants, including Dwight

and the Deputy Chief, said they remembered this CIR at all.

We believe the primary responsibility for the failure to pass this

information rests with the CIA. The evidence indicates that the CIA did not

provide permission for the CIR to be sent.269However, we also believe that

Dwight should have followed up as much as necessary to ensure that the

information was sent to the FBI. Although we found evidence that he inquired

once about the disposition of the CIR, we found no additional e,vidence that he

continued to follow up to ensure that:the information was sent. If Dwight was

stymied in his attempt to learn about the disposition of the cable, or if the CIA

gave no reasonable explanation for why the information was not being sent, he

could have brought this issue to the attention of another superwisor in the CTC.

In our view, Dwight took the commendable initiative to draft tile CIR to share

the information with the FBI, but did not follow through adequately to ensure

that it was sent, and the information in the CIR was not provided to the FBI

until shortly before the September 11 attacks.

2. Malcolm

Malcolm was a New York FBI agent detailed for several years to the

CTC. He toldthe, OIG that he understood his role, at the CTC was, among

other things, to be the "eyes and ears" of the New York Field Office. We do

not believe that he performed this role sufficiently. He acknowledged to the

OIG that one of his duties was "to monitor" New York Field Office cases, but

he said he read only the cables that he thought were "interesting," generally

269The CIA has asserted that the information in the CIR was sent to the FBI through

another cable, which may be why the CIR was not sent. A CIA cable stated that Mihdhar's

travel documents, including a multiple entry U.S. visa, had been copied and passed "to the

FBI for further investigation." As discussed above, however, we found no evidence that this

cable was correct and that this informationhad actually be,en provided to the FBI.

348
based solely on his review of the cable subject line. In addition, while he said

his role was to "facilitate inquiries of mutual interest," the only example he

could provide was his acting as a. liaison for FBI offices areund the country by

following up on tracing requests and reporting on their statals. This was not

very onerous or substantive. We believe that FBI management is primarily

responsible for failing to provide the FBI detailees to the CTC, including

Malcolm, with clear duties, direction, and supervision. But we believe

Malcolm should have done more and taken more initiative JLnperforming his

duties at the CTC.

3. Stan

For several months in 2000, Hazmi and Mihdhar lived as boarders in the

house of an FBI informationalasset. The asset briefly mentioned the two

boarders to his FBI control agent:, who we call "Stan." Stan did not document

this information, seek to learn the boarders' full identities, or conduct any

checks on them.

No FBI policy required Stan to seek or document this type of information

from the asset, and we founddifferences among the other FBI agents who we

interviewed about whether they would have sought such inl'ormation from an

asset. While Stan did not violate any specific FBI policy, vie believe it would

have been a better and more prudent practice for him to have sought at least

minimal information from his asset about the boarders livinLgwith him. The

asset knew little about the boarders, and the boarders could have compromised

information provided by the asset to the FBI.

Moreover, FBI policy required Stan to continually evaluate the asset's

credibility and provide a yearly evaluation report on the asset. Stan's yearly

report on this asset was minimal, with a bare attestation of the asset's bona

tides. It contained no indication of what evidence Stan had used to make these

attestations. _N%ilewe do not suggest that Stan had to conduct extensive

reviews of everyone living with the asset, Stan's actions in following up on this

information were not particularly thorough or aggressive.

4. Max

In January 2001, a joint FBI/CIA source: identified IChallad l

__. Because the FBI ALAT who was

349
involved in the handling of the source, Max, was unable to speak any of the

joint source's languages, a CIA employee conducted the debriefings of the

source, including the debriefing in which the source identified Khallad. We

concluded that Max was not informed of the source's identification of Khallad

__, .either at the time of the

identification or afterwards. Although CIA cables covering the:debriefing

described the identification of Khallad, these were',not shared with Max.

Instead, he saw CIA TDs that did not contain the information about the

identification.

CIA documents do not indicate that the ALAT was informed of the

identification, and no other evidence indicates that the ALAT knew. We found

that the ALAT included detailed descriptions in hJisreports of other

information from the source, which indicates he was not provided the

information about the identification of Khallad. We also found that the New

York FBI agents who interviewed the source in February 2001 were not

informed of the identification of Khallad. In sum, we believe t]heALAT did

not learn about the source's identification, not that he knew about identification

but failed to share this information with others.

We believe that, as the ALAT, Max should have been more familiar with

the CIA's reporting process. He was not aware that the CIA's TDs contained

only a part of the information obtained during the source debriefings.

Although our review revealed that many FBI employees operated with

misunderstandings about the ways the CIA recorded and reported intelligence

information, a significant function of the ALAT position is to interact with the

CIA. Had he recognized that he could not rely on TDs for ful! reporting about

the source's information, he could have asked his CIA counterpart directly for

any additional infbrmation from the source, and the ALAT may have learned

about the identification of Khallad. In addition, given Max's concern that he

provide FBI Headquarters with all of the information reported by the source, it

,would have been prudent for him to consult with the CIA case officer and ask

sufficient questions to ensure that he had received all of the infi_rmation. We

found no indication that he did so.

5. Donna

Donna, the FBI analyst who worked on the investigation of the Cole

attacks, planned a June 11,2001, meeting with the Cole investigators and CIA

350
!

employees to discuss information relating to the Cole investigation. She

deserves credit for organizing this meeting and seeking to share intelligence

information with the Cole investigators. However, we faul_Lher performance in

two respects. First, we found that the meeting: was poorly planned, and Donna

did not clearly communicate the purpose of the meeting to _Lheparticipants.

Donna also failed to obtain significant information prior to the meeting that

could have been shared with the investigators __.

After the meeting, although Donna devoted a significant amount of time to the

Cole investigations, she did little specific follow-up to provide answers to the

investigators about their logical questions regarding I_-

We believe she did not do all she could have to acquire thai:information for the

New York agents, even though she had said that she would as a result of their

discussion at the June 11meeting. As a result, the FBI missed another

opportunity to focus on Mihdhar and Hazmi earlier than it did.

When Donna finally learned from Mary on August 22, 2001, that Hazmi

and Mihdhar were in the United States, Donna dluickly and appropriately took

steps to have the FBI open an investigation to locate them. She personally

called the New York Bin Laden intelligence agent and told him about the

matter. This was an unusual step to call the agent directly, and it suggested

that the investigation should be given some priority. However, when she sent

the EC to New York, she designated the EC as having a routine precedence.

Donna's actions indicated some urgency in the need for the investigation yet

the subsequent EC did not convey any urgency. The New York Field Office

assigned the case immediately, and the agent began working on the case within

two business days of the assignment. If the EC had conveyed urgency, the FBI

New York FMd Office might have assigned additional or more experienced

agents to locate Mihdhar and Hazmi and initiated the search sooner.

6. Rob

We believe that Rob, as Donna's supervisor, is also responsible for

Donna's failures. While the FBI at the time permitted IOS,; to make significant

decisions, often with little supelwisory input, we believe that as a supervisor, he

should have ensured that she was handling the:June 11 meeting appropriately

and, if necessary, become involved with the p]lanning or execution of the

meeting. Although Donna often traveled to New York to work on the Cole

investigation, the June 11 meeting involved the CIA and an AUSA, which

351
should have led to more supervisory involvement in the purpose, agenda, and

outcome of the meeting. But Rob had little supervisory involw_ment with it,

either before or after the meeting. In. addition, although Donna drafted the EC

requesting the investigation of Mihdhar, the EC was ultimately approved and

sent by Rob: Therefore, we believe he also bears some responsibility for

failing to ensure tlhat the appropriate precedence level was used on the EC.

7. Richard

We do not fault Richard for his limited investigation, which was still in

the nascent stages, by the time of the September 1]Lattacks. As we described

above, Richard took logical steps to try to locate Mihdhar and Hazmi, such as

completing a lookout for Mihdhar with the INS, requesting local criminal

history checks, checking with New York hotels about Hazmi and Mihdhar, and :

conducting commercial database checks on them. However, there were many

more investigative steps that could have been purs;ued, in New York and

elsewhere, had the investigation been assigned greater priority and had the FBI

provided more resources to this investigation. The FBI was not close to

locating Hazmi and Mihdhar when they participated in the Sepl:ember 11

attacks. We believe that the FBI in New York should have assigned the matter

more priority than it did.

8. Mary

Mary was assigned by her CIA managers in May 2001 wJithfinding and

reviewing the CIA cables relating to the Malaysia meetings and their potential

connection to the Cole attack. Mary did not find the relevant CIA cable traffic

until late July and.mid-August 2001. She told the OIG that she did not have

time to focus on this assignment until then. Upon discovering on August 21

that Hazmi and Mihdhar had travelecl to the United States, she iimmediately

passed this information to the FBI.

.J

We recognize that the disparate pieces of information about the Malaysia

meetings were not easyto connect and that the task of developing patterns

from seemingly unrelated information was complex. Yet we question the

amount of time that elapsed between Mary's assignment and her discovery of

the important information. As we discussed previously, however, Mary's

assignments were directed and controlled by her raanagers in the CTC. We,

therefore, leave this issue to the CIA OIG for its consideration.

352
V. OIG conclusions

In sum, we found individual and systemiic failings in the FBI's handling

of information regarding the Hazmi and Mihdhar matter. The FBI had at least

five opportunJities to learn about their presence in the United States and to seek

to find them before September 11,2001. Much of the cause for these lost

opportunities involved systemic problems. We found information sharing

problems be_veen the CIA and the FBI and systemic problems within the FBI

related to counterterrorism investigations. The systemic problems included

inadequate oversight and guidance provided to.FBI detailees at the CIA, the

FBI employees' lack of understanding of CIA procedures, the inconsistent

documentation of intelligence information received informally by the FBI, the

lack of priority given to counterterrorism investigations by the FBI before

September 11, and the effect of the wall on FBI criminal investigations.

Our review also found•that the CIA did not provide information to the

FBI about Hazmi and Mihdhar when it should•have and we believe the CIA

shares significant responsibility for the breakdown in the Hazmi and Mihdhar

case. However, the FBI also failed to fully exploit the infolTnation that was

made available to them. In addition, the FBI did notassign sufficient priority

to the investigation when it learned in August 2001 that Ha:zmi and Mihdhar

were in the in the United States. While we do not know what would have

happened had the FBI learned sooner or pursued its investigation more

aggressively, the FBI lost several important opportunities to find Hazmi and

Mihdhar before the September 11 attacks.

353
354
CHAPTER SIX

RECOMMENDATIONS AND CONCLUSIONS

Our review found many deficiencies in the FBI's handling of intelligence

information related to the September 11 attacks. In addition to individual

failures, whidh we detail at the end of each chapter, we found significant

systemic problems that undermined the FBI's Counterterrofism Program. For

example, before the September 11 attacks the FBI lacked an effective

analytical program, failed to use the FISA statute fully, and was inadequately

organized to disseminate timely and sufficient information within the

Intelligence Community. As we detailed in this report, these systemic

problems significantly affected the FBI's handling of the Phoenix Electronic

Communication (EC), the Moussaoui investigation, and the:pursuit of

intelligence information relating to Hazmi and Mihdhar, two of the September

11 terrorists.

Since September 11,2001, the FBI has taken numero_as steps to

reorganize and strengthen its Counterterrorism Program. In this report, we

have not analyzed each of these changes, manly of which are substantial,

ongoing, and evolving. The National Commission on Terrorist Attacks Upon

the United States (9/11 Commission), as well as other OIG and GAO reviews,

is assessing the impact of the changes in the FBI since September 11, 2001.

In this chapter, we make broad systemic recommendations to address the

specific problems examined in our review that webelieve t]heFBI must address

as it continues to change its Counterterrorism Program. Our recommendations

flow from the analysis of the deficiencies that we found in the way the FBI

handled infonmation related to the September 11 attacks. 27°

I. Recommendations

A. Recommendations related to the FBI's analytical program

Recommendation No. 1: Improve the hiring, trainting, and

retention of intelligence analysts.

270Attached in the Appendix is the FBI's respons,e to this report and our

recommendations.

'\

355 _,
As discussed in Chapter Two, the FBI acknowledged shortly after the

September 11 attacks that its analytical program was inadequate and in need of

improvement. Since then the FBI has made important changes to attempt to

address this deficiency. For example, the FBI has established the Office of

Intelligence with separate management and career tracks for analysts. In

addition, the FBI has created an analytical branch in the Counterterrorism

Division and has .established the College of Analytical Studies at the FBI

Academy in Quantico, Virginia, with a 6-week training program for all

analysts.

In addition to these important changes, the FBI must ensure that it hires,

trains, and retains a sufficient number of skilled maalysts. Hiring sufficient

numbers of qualified analysts is a challenging task. As part of this effort,

training'for analysts must be improved. For example, we found that training

for analysts prior to September 11 was infrequent and often did: not occur until

months after they began working in their analyst positions. While training for

analysts has improved since September 11, the FFII needs to ensure that it

provides comprehensive and timely training for all its analysts. :271

To retain analysts, the FBI must ensure that it creates an attractive career

path for analysts, with sufficient benefits and stature within the FBI. Analysts

should have the opportunity to receive promotions to senior positions, such as

assistant directors; or deputy assistant directors, rather than being supervised

solely by special agents who have risen to management positions within the

FBI. Prior to September 11,2001, the FBI did not sufficiently value or support

the critical work of its analysts. The FBI must ensure that it elevates the

importance of analysts and their work within the FBI.

Recommendation No. 2: Ensure effective managemel_lt of

analysts.

Our review revealed problems in the management of analysts within the

FBI, particularly the Intelligence Operations Specialists (IOSs) in the

International Terrorism Operations Section (ITOS) at FBI Headquarters. Our

review revealed t]flatsupervisory special agents in FBI Headquarters failed to

271The OIG is currently conducting an audit examining the FBI's effi_rtsto hire and

train intelligence analysts.

356
provide consistent oversight and supervision of these analysts. Part of the

problem was that the analysts were long-time FBI Headquarters employees J

with substantive expertise in terrorism matters, while their supervisors were

agents who often lacked analytical expertise and rotated through FBI

Headquarters on short assignments.

Moreover, prior to September 11,2001, ITOS worked in crisis mode,

with insufficient resources to respond its many tasks. Consequently,

overwhelmed analysts had to respond to the emergency of the moment. They

did not have sufficient time to conduct comprehensive, proactive analysis to

assess the significance or the relationship of disparate pieces of intelligence

information. ;Supervisors also allowed the analysts to make.,critical decisions

independently', without requiring any supervisory consultation even on

significant matters.

The FBI must ensure effective management of analysts. It must identify

the priorities for analysts and ensure that their workload is reasonable enough

for them to adequately perform the tasks assigned to them. The FBI should

more clearly define supervisors' responsibilities in managing its analytical

programs. On important decisions, including cletermination of the priority to

assign analytical requests, analysts should be required to consult their

supervisors. In addition, analysts should not be able to close leads by simply

reassigning them, which also occurred with regard to the Phoenix EC.

We also believe that the analysts' supervisors must have greater

experience and broader knowledge of the activities under their area of

supervision. Moving supervisors rapidly through critical units dealing with

counterterrorism undermines the management of the program and the FBI's

critical need for continuity and expertise in these important units. Supervisory

positions that oversee analysts should be filled by experienced and permanent _-

personnel, not analysts in acting capacities or ;agents who rotate through the

units for short periods of time.

Recommendation No. 3: Require greater coordination and

consultation between the operational and analytical units.

Various FBI analysts and managers told us that, in the past, operational

managers in the FBI frequently overruled the conclusions of analytical work

products. Before information could be dissemdnated to the field, ECs

containing the analytical information had to be approved by the operational

357
unit with responsibility for the area. The wimesses stated that the job of

operational personnel is to verify that the facts cited by analyst,; are correct, but

that the expertise .andjudgment of analysts normally should be relied upon in

deciding the conclusions to be drawn from those facts.

We agree that operational personnel generally should not alter or veto the

conclusions of an analyst in an analytical product. At the same time, analytical

products need the input and expertise of operational personnel. The FBI

therefore should take steps to institutionalize the operational components'

involvement in developing and reviewing analytical products and set up a

process for ensuring that these products reflect the'.consensus of the FBI's

analytical and operational components.

Because the FBI combines intelligence and ]lawenforcement

components, disputes inevitably will arise between the operatic,nal unit and the

analyticalunit ow_r, among other things, whether ,certain infomlation should be

distributed to _thefield or should appear in a briefing document because of

concerns thatit could jeopardize a pending investigation or prosecution. We

believe that the FBI should establish a more defined and efficient process for

handling thesetypes of conflicts. The process should involve discussions

between the disagreeing components and the input of the FBI's Office of

General Counsel iinappropriate circumstances, with a decision resting with

upper-level FBI management.

B. Recommendations related to the FISA process

Recommendation No. 4: Ensure adequate training of FBI

employees involved in the FISA process and

eounterterrorism matters.

We found that many FBI employees who were assigned t,o

counterterrorism work- whether analysts, special agents in field offices, or

FBI Headquarters', supervisory special agents- received little formal training

about counterterrorism matters in general or FISA in particular.. Even in

complicated matters, such as the intricacies of terrorist organizations such as al

Qaeda, these FBI employees primarily receivedon-the-job training.

We found, in particular, that FBI employees' knowledge :aboutFISA was

limited and uneven. FBI Headquarters employees',we interviewed generally

were not even familiar with the 1995 Procedures. Although they were

:. 358
knowledgeable about basic steps required for obtaining a F![SAwarrant, they

were not welt versed in the requirements of the FISA statute, particularly when

the facts of the case did not fit within a standard pattern. We also found that

special agents in FBI field offices were not well informed about the FISA

process, such as the steps needed to finalize a FISA request, or the types of

information needed to meet the requirements for a FISA warrant.

After the September 11 attacks, the 1995 Procedures and other

restrictions regarding FISA and the dissemination of intelligence information

have dramatically changed. By many accounts, the FBI and the Office of

Intelligence and Policy Review (OIPR) are now much more aggressive in their

approach to obtaining FISA warrants than be_re September 11. In addition,

we were informed that in the spring and summer of 2003, many FISA training

sessions were provided for FBI and OIPR employees, as well as employees

from other De,partment of Justice components and intelligence agencies

working on counterterrorism matters. This type of training., in our view, should

be expanded and provided regularly.

In additiion, the FBI must ensure that its employees understand the

requirements for opening intelligence and criminal investigations that relate to

counterterrorism and the tools available to them to conduct these

investigations. This training should include detailed inforn_ation on FISA and

how it can be used, even when the case does not fit a standard fact pattern.

FBI agents also should receive training about the rest_.'ictionson the use

of information acquired in intelligence investigations. Formal training should

be provided at all levels in FBI Headquarters and for all field office employees

who are involved with counterterrorism investigations, including the Chief

Division Counsels (CDC) in the field. Widespread and COl_Ltinual training on

FISA and other counterterrorism issues is especially important given the

increase in the number of FBI employees who, since September 11,2001, have

been reassigned to counterterrorism matters from other programs.

Recommendation No. 5: FBI attorneys should be better

integralted into counterterrorism investigations.

Our review found that the FBI lacked an effective system for ensuring

thatFBI lawyers were sufficiently integrated into the FISA process or other

legal issues arising in counterterrorism investigations. For example, the FBI

Headquarters supervisor most involved with I/Ill had to consult

359
with four different National Security Law Unit (NSLU) attorneys about the

II FISA request because FISA requests were not assigned to a single

NSLU attorney who was responsible for seeing it through the process. In

addition, none of the NSLU attorneys consulted with anyone from OIPR about

the l/1 FISA request, despite its unusual nature, partly because one

NSLU attorney never was completely responsible for the matter.

We believe that one NSLU attorney normally Should be assigned to

handle a particular FISA request or other legal matter arising il_La

counterterrorism investigation. This would ensure that an NSLU attorney is

familiar with the facts and legal issues from beginning to end of the case, and it

would give the attorney greater responsibility for a particular matter. In

addition, we belie.ve that NSLU attorneys should have more contact with field

agents in important cases. None of the NSLU attorneys in the ll__

•spoke with the fie.ld agents, or even were provided the underlying documents

drafted by the field agents.

On the other hand, we found that the Minneapolis field agents in the

did not consult fully with their CDC about what was needed to

support their FISA request, despite their frustration and disagreement with the

advice they received from FBI Headquarters. Fie][dagents should be

encouraged to consult with CDCs about FISA requests or other legal issues that

arise out ofcounterterrorism investigations. CDCs also should be more

involved in the FISA process and better trained to be in a position to provide

useful guidance to field agents and represent the field office on a particular

FISA request., .

Recommendation No, 6: Ensure closer consultation between

theFBI and OIPR, particularly on important or unusual

cases.

In the 'll__, the FBI never consu]lted OIPR about the

possibility of obtaining a FISA warrant, despite the strong disagreements about

the case between FBI Headquarters and the field office. The chief of the

NSLU told us that he had never seen. a supervisory special agent in

Headquarters so adamant that a FISA warrant could not be obtained and at the

same time a field office so adamant that it could. We believe that in unusual

cases, _ I did not ill: a standard fact

pattern for FISA and strong disagreement existed within the FBI about the

360

t L
strength of the evidence, FBI lawyers should consult with OIPR about the

issues involved in the case. OIPR is responsible for implementing FISA and is

the Department's expert on the requirements of the statute, and the FBI should

discuss with it the important and contentious issues involved in such a FISA

request.

Since the September 11 attacks, much has changed about the

requirements and use of FISA, including the legal framework and the way the

Department uses the statute. We also underst_md that OIPR and the FBI now

consult more closely on the use of FISAs in particular case,;, as well as on the

requirements ,ofthe statute. We recommend that this closer consultation be

enhanced and promoted, and that the FBI be encouraged to seek assistance and

advice from OIPR at early stages of investigations involving the use of FISA.

C. Recommendations related to the FBI's interactions with the

Intelligence Community

Recommendation No. 7: Ensure effective management of

FBI detailees.

Our review found that the FBI detailees to the CIA's Counterterrorist

Center (CTC) lacked defined responsibilities. The detailees told us theywere

not given specific instructions about their responsibilities and each detailee

defined the job individually. As a result, they:,as well as the FBI and the CIA,

had significam misperceptions and inconsistent expectations about their roles.

For example, the detailees did not believe they were to act as "backstops" to

ensure that CIA information was passed to the,FBI, and they did not scour CIA

cable traffic fbr this purpose. Yet CIA employees believed that at least one of

the FBI detailees had been assigned to the CTC specifically' for this purpose.

The FB][and the CIA did not have any memoranda of understanding

describing the',detailees' functions. Moreover, the detailees were not even

evaluated based upon what they did at the CTC. Instead, their performance

appraisals were based on what they did as FBI employees, not as detailees to

the CTC.

The FB][needs to formally describe the roles and responsibilities of

detailees and communicate this to the detailees and to the CIA. To avoid

misunderstandings and ensure continuity in the program, the FBI should

document these responsibilities in a formal memorandum of understanding

361
with the CIA. In addition, the performance work plan of each detailee should

be revised to reflect the critical elements of the job being performed by the

detailee at the CIA, and someone who oversees their daily work should

evaluate them.

Recommendation No. 8: Ensure FBI employees who

interact with other intelligence agencies better understand

their reporting processes.

As we discussed in Chapter Five of this report on the Hazmi and Mihdhar

matter, FBI employees we interviewed did not fully understand the CIA's

system for reporting intelligence information. For example, the FBI's

Assistant Legal Attach_ (ALAT) who dealt with the source mistakenly

believed that the CIA's TDs he received contained all source reporting that was

available from the CIA. In fact, other operational cables contained significant

CIA information about the source, including that the source had identified

Mihdhar in the Malaysian meeting photographs. VVe found that other

experienced FBI agents who interacted frequently with the CIA also were

unaware of CIA procedures and important ways to obtain additional

intelligence information from the CIA.

We believe that FBI employees who interact with the CIA should be

more familiar witlh CIA and other intelligence agencies' processes for reporting

intelligence information. Even if FBI employees clo not have fiJll access to the

reports :of other intelligence agencies or the systems from which these

intelligence reports are produced, the FBI employees should be aware of the

processes and reporting by other intelligence agencies to avoid the

misunderstandings that occurred in the Mihdhar matter.

Recommendation No. 9: Provide guidance for how antd

when to document _ntelligence information received fi'om

informal briefings by other inteliigence agencies.

The FBI lacked clear policies and procedures for how and when to

document intelligence information received from the CIA, partiicularly

intelligence communicated in an informal manner. For example, FBI

employees receiw_d verbal briefings on Mihdhar fi'om CIA employees in the

FBI's Strategic Information Operations Center (SIOC) around the time of the

Millennium threa_L.One of the reasons the SIOC was activated during this

period was to obtain and coordinate the response to threat information from

362
various sources. Yet, the information the FBI received about Mihdhar in the

SIOC was never documented in a way that was accessible to other FBI

employees.

We are not suggesting that every informal communication from the CIA

to the FBI must be documented. However, the FBI should establish better

guidance for its employees as to how and when such information from such

informal briefings should be documented.

Recommendation No. 10: Ensure thalt the FBI's information

technology systems allow FBI employees to more readily

receive, use, and disseminate highly classified information.

The FBI has acknowledged for several years that its information

technology systems are not adequate. The FBI is in the process of

implementing widespread changes to its systems, and the upgrading of its

information technology systems is one of the highest priorities of the FBI. The

OIG and others have monitored and reported extensively oi1 the progress of the

upgrade to the FBI's systems, particularly the FBI's Trilo_¢ project. 272

In this review, we found many examples; of how the FBI's poor

information technology systems hindered the ]handling and use of intelligence

information. For example, most of the persons listed on the attention line of

the Phoenix EC never saw it. Unless a lead is "set" for a specific person in the

FBI's ACS system, the system does not notify the person that a document is

addressed to them. While it was possible for the addressees to access the

document in ACS by searching fbr documents containing their names, the

system was so cumbersome that FBI employees usually did not do this.

As the FBI moves forward in upgrading its information technology

systems, it must ensure that it is able to disseminate electronically throughout

the FBI intellJigence information., regardless of the classification level. Agents

272The Trilogy project is the largest FBI information technology project, and has been

recognized as essential to upgrading the FBI's archaic and inadequate computer systems.

Trilogy's three main components involve upgrading tlheFBI's hardware and software;

upgrading the FBI's communications networks; and upgrading the FBI's most important

investigative applications, including its Automated Case Support (ACS) system and the

introduction of the Virtual Case File system.

363
and analysts at FBI Headquarters and in the field should be able to access

intelligence information readily to enable them to adequately perform their

jobs. They shouh:l also be able to communicate electronically with their

counterparts at otJher intelligence agencies. The FBI's upgrade of information

technology must take into account the needs for access and use of highly

classified information.

Recommendation No. 11: Ensure appropriate physical

infrastructure in FBI field offices to handle highly classified

information.

In our review, we found that the FBI's field offices generally lacked the

necessary physical infrastructure to readily use highly classified intelligence

information from the CIA and NSA. For example',, the workspaces in the FBI's

New York and San Diego Field Offices did not permit FBI personnel to handle

SCI information at their desks. In addition, the FBI's sensitive compartmented

information facilities (SCIFs) in those offices were not large enLough or

adequate enough to permit agents to regularly accessor handle highly

classified information. In addition, many field agents did not have sufficient

access to secure telephones. For example, in the New York FMd Office, the

office most responsible for counterterrorism investigations before the

September 11 attacks, an entire squad with as marly as 25 individuals shared

one secure phone.. In order.to successfully carry out its counterterrorism

functions, the FBI must provide its personnel with adequate intiastructure to

handle highly classified information.

)

Recommendation No. 12: Improve dissemination of tl_reat

information.

Prior to September 11,2001, the FBI provided little guid_mce to its

employees about what information constituted a "threat" and what threat

information should be disseminated in the FBI, to the Intelligence Community,

or more widely. FBI employees told us that it was left to the judgment of the

supervisory special agent or analyst in FBI Headquarters to decide what

constituted threat information and what should be disseminated[.

364
The teletype was not

distributed to all FBI field offices or even to all Intelligence Community

agencies.

/

We recognize that threat assessments require judgments, and not every

piece of infol_mation suggesting some kind of harm should be disseminated

throughout the FBI and the Intelligence Community. By necessity, FBI

employees must exercise discretion in evaluating potential threat information.

However, we believe the FBI should issue clear guidance fi)r evaluating what

type of threat-information should be disseminated, within and outside the FBI,

and how it should be disseminated.

D. Other recommendations

Recommendation No. 13: Evaluate the effectiveness of the

rapid rotation of supervisory special agents through the FBI

Headquarters' Counterterrorism Program.

Many FBI supervisory special agents rolLatethrough important FBI

Headquarters supervisory positions for a short time, often two years or less.

Because of the rapid turnover, the supervisory positions can remain unfilled for

months at a time. We believe this turnover of managers in the FBI

Counterterrofism Program can harm the operation and management of the

program. For example, we found that analysts, often long-time FBI

Headquarters employees, were more knowledgeable than their supervisors

about the operation of the unit and the substantive subject matter. Brief stints

at FBI Headquarters can make it difficult for managers to become fully

conversant with the subject matter and procedures in the Counterterrorism

Program at FBI Headquarters before they are ,,senttoa new assignment.

Part of the jobof a manager is to understand the context with respect to a

particular terrorist organization or part of the world, and to use this knowledge

when advising field offices about their various investigations. The rotation of

special agents, through supervisory positions in FBI Headquarters is so frequent

365
and rapid that managers often do not have the time, ability, or incentive to

acquire the expel-t knowledge related to their functions. As a result, we believe

the FBI should evaluate the effectiveness of rotating supervisory special agents

and unit chiefs so rapidly through FBI Headquarters.

Recommendation No. 14: Provide guidance on the type of

information that agents should obtain for evaluating atssets

and for documenting the yearly check on assets.

In assessing the FBI's handling of an asset in San Diego with whom

Hazmi and Mihdhar lived in 2000, we determined that the FBI control agent

who handledthe asset did not inquire about the individuals who the asset said

was living with him. The asset told the control agent that two young men who

recently came to the United States had moved in with him as boarders but the

FBIagent did not obtain any additional information about the boarders, other

than their first names. Had the control agent pursued information about the

asset's boarders, he might have learned about the CIA information regarding

Hazmi and Mihdhar and documented their presence in the United States.

We found little FBI guidance about what information the control agent

should have obtained from an asset in circumstances Such as this. We also

found no consens:as among the FBI agentswe interviewed as to whether they

would have requested additional information from an asset in these

circumstances.

The FBI's policy at the time was that the FBI agent was required to

"continually address" the asset's "bona tides" and provide a yearly evaluation

report to FBI Headquarters. However, the policy ,did not specit_, how to assess

the bona tides of the asset or what information should be contained in the

yearly evaluation. The control agent's report on the San Diego asset used the

same boilerplate language each year, with no substantive information provided

about the asset or the checks done on the asset.

We believe the FBI should evaluate its policies regarding evaluation of

assets and determine if agents are.collecting and documenting sufficient

information about its assets. For example, the FBI should consider the

circumstances when FBI employees should seek information about persons

living With or otherwise closely associating with an FBI asset. In addition, the

FBI should consider detailing the minimum info_nation an asset file must

contain to verify that an adequate background check has been conducted. This

366
information i,;necessary to allow the FBI to determine whe,ther the control

agent is continuing to assess each informational,asget's credibility, as required.

Moreover, information from an asset is only accessible and useful if

documented. The FBI should evaluate its asset policies and consider what

information it:should require control agents to obtain and document about

assets.

RecommendationNo. 15: Improve the flow of intelligence

information within the FBI and the dissemination of

intelligence information to other intel]ligence agencies.

Prior to the September 11 attacks, sharing of intelligence information

within and outside the FBI was piecemeal and ad hoc rather than systematic.

The FBI's normal process for disseminating intelligence information was to

-route it primarily to analysts, who then used their judgment and experience to

decide what needed to be disseminated further, and to whom. However, the

analysts were overwhelmed and had to address crises and emergencies as they

arose, with little time to conduct systemic evaluations or carefully consider

what information should be provided throughout the FBI. As a result;

information_that did not demand immediate attention, such as the Phoenix EC,

was not addre,ssed thoroughly or timely.

Moreover, the FBI]acked clear priorities or requirements for the

dissemination, of information once it was colle,cted. There was little guidance

regarding the types of information that had to be disseminated or included in

reports to other intelligence agencies. I.naddition, FBI procedures for

disseminating: intelligence information were cumbersome, requiring many

levels of review just to distribute information, even within the FBI.

Since September 11, the FBI has made significant changes as to how

intelligence is',routed and shared,, both within and outside the FBI, and we have

not examined in detail each of these changes. 273But the FBI's evolution is a

difficult and ongoing process. We believe that, as part of this process, the FBI

should continue to examine its policies to ensure that it has clear guidance for

273For example, see the OIG report entitled "The Federal Bureau of Investigation's

Efforts to Improve the Sharing of Intelligence and Other Information" (December 2003).

367
its employees to identify what kind of intelligence information must be shared

and how it must be shared, both within and outside the FBI.

Recommendation No. 16: Ensure that field offices allocate

resources consistent with FBI priorities.

In 1998, the:FBI elevated counterterrorism t:oa top agency priority.

However, the FBI failed to ensure that resources in field offices were

redirected to counterterrorism to reflect this change in priority. For example, in

our review of the Hazmi and Mihdhar matter, we found that the San Diego

Field Office did not shift its resources in response to changed l:,riorities. As a

result, the San Diego Field Office focused little• attention on counterterrorism in

general and al Qaeda in particular. The relatively low priority the San Diego

•FBI gave to the Counterterrorism Program was not atypical of FBI field offices

before September 11.

After September 11, the FBI refocused its traditional crime-fighting

orientation and placed its highest priority on terrorism prevention, dramatically

shifting resources to the Counterterrorism Program. We believe the FBI must

ensure that it systematically evaluates the allocation of resources by field

offices to ensure that each field office directs its resources in accord with the

FBI's priorities. 274

II. Conclusions

Our review found significant deficiencies in the FBI's handling of

intelligence information relating to the September 11 attacks. Shortly after the

attacks, the FBI indicated that it did not have any :informationwarning of the

attacks. However, information was soon discovered that had been in the

q'

possession of the FBI and the Intelligence Community before _,eptember 11

that related to the hijacking of airplanes by extrerrfists or that involved the

terrorists who committed the September 11 attacks.

At the request of the FBI Director, we examined what the:FBI knew

before September 11 that was potentially related to the terrorist attacks. We i

I

274For an evaluation of the changes that the FBI has made in the allocation of its

investigation resources, see the OIG report entitled "Federal Bureau of Investigation

Casework and Human Resource Allocation" (September 2003).

368
focused on the FBI's handling of the Phoenix EC, the mml[lm_, and the

information about Hazmi and Mihdhar, two of the September 11 terrorists.

Our review found that the FBI had failed to fully evalLuate,investigate,

exploit, and disseminate information related to the Phoenix EC, the

m and the Hazmi and Mihdhar matter. The,'causes for these failures were

widespread and varied, ranging from poor individual performance to more

substantial systemic deficiencies that undermined the FBI',,; efforts to detect

and prevent terrorism.

By describing the action and inaction of individual FI3I employees in this

report, particularly the lower-level employees whose conduLctwe discuss in

detail, we do not suggest that they committed intentional misconduct. Nor do

we think that they are responsible individually for the FBI's deficiencies in

handling the information related to the September 11 attacks. We believe it

would be unfair to blame these individuals, wlhooften worked with insufficient

resources and with overwhelming impediments. Many pursued their duties in

good faith, making difficult judgments about where to focus their efforts.

Some perforated aggressively and well. Others did not do all they could have

and should have to respond to the information they received. While the FBI

should examine the performance of the individuals who we describe in this

report, we do not believe they are personally responsible for not preventing the

attacks or should be blamed for the tragedy that occurred.

Rather, we believe that widespread and long-standing deficiencies in the

FBI's operations and Counterten:orism Program caused the problems we

described in this report. For example, the FBI did not handle the Phoenix EC

appropriately or give it the attention it deserved. The FBI did little with the

Phoenix EC before the September 11 attacks because of the',FBI's inadequate

analytical program, insufficient supervision of analysts in the program, the

focus on operational priorities at the expense of strategic aa_Mysis,the failure to

adequately share intelligence infi?rmation, and the lack of adequate tools to

facilitate info_nation sharing within and outside the FBI.

P_

These agents did not receive adequate support, either from :fieldoffice

,managers or from FBI Headquarters.

369
the handling of this •caseillustrated systemic deficie,ncies in how the

FBI handled intelligence cases. These deficiencies included a :narrow and

conservative interpretation of FISA, inadequate analysis of wh,ether to proceed

as a criminal or intelligence investigation, adversarial relations between the

field and FBI Headquarters, and a disjointed and inadequate review of potential

FISA requests by FBI attorneys.

With regard[ to Hazmi and Mihdhar, the FBI had at least five

opportunities to uncover information that could have informed the FBI about

these two terrorists' presence in the United States and led the F'BI to seek to

find them before ;September 11,2001. But the FBI did not uncover this

information until shortly before the September 11 attacks. The:FBI's

investigation then was conducted without much urgency or priority, and the

FBI failed to locate Hazmi and Mihdhar before they participated in the attacks.

Our examination of the five lost opportunities found significant systemic

problems with information sharing between the CIA and the FBI, and systemic

problems within the FBI related to its Counterterrorism Prograna. These

problems included inadequate oversight and guidance provided_to FBI

detailees at the C][A,FBI employees' lack of understanding of CIA procedures,

inconsistent documentation of intelligence information received informally by

the FBI, the lack of priority given to counterterrorism investigations by the FBI

before September 11, and the impact of the "wall" between criminal and

intelligence investigations.

In evaluating the FBI's actions in the three matters examined in this

report, we cannot say whether the FBI would haw_ prevented the attacks had

they handled these matters differently. Such a judgment would be speculative

and beyond the sc,ope of our inquiry. But while we cannot say what would

have tiappened had the FBI handled the information differently or if the FBI

had pursued these, investigations more aggressively, the way the FBI handled

these matters was a significant failure that hindere,d the FBI's chances of being

able to detect and prevent the September 11 attacks.

In this chapter, we make 16 recommendations to the FBI to address the

problems we found in our review. In providing these recommendations, we

• (_l recognize that the FBI has made significant changes since the _.,eptember 11

attacks, and it is already addressing many of the matters that we describe in this

report. But we be,lieve that the FBI should know exactly what happened with

370
regard to the Phoenix EC, _1 and the Hazmi and Mihdhar

matter to ensure that it fu!ly addresses the systemic failures',we found in these

matters. We believe that our detailed descriptions of the FBI's actions,

together with our recommendations, can help the FBI improve its

counterterrorism operations as it transforms itself to better address the threat of

terrorism.

Glenn A. Fine

Inspector General

371
tkPPENDltCE:S
i

LIST-O_FACRON S

ACS - Automated Case Support System

ADIC - Assistant Director in Charge

AG Guideline,s - Attorney General Guidelines

AGRT- Attorney General,s Review Team

ALAT- Assistant Legal Attache

ASAC - Assi,_tant Special Agent in Charge

AUSA-Assistant. United States Attorney

CDC - Chief Division Counsel

CIA- Central Intelligence Agency .

CIR- Central Intelligence Report (CIA)

CIRG- Critical Incidents Response Group

CTC -Counter Terrorist Center (CIA)

CTD- Counterterrorism Division (FBI)

DCI - Directo:r of Central.Intelligence

DEA - Drug Enforcement Administration

DTOS- Domestic Terrorism Operations Section

EC- Electronic Communication ,:

FAA- Federalt Aviation Administration

FBI - Federal Bureau of Investigation

FCI - Foreign Counterintelligence

FFI - Full Field Investigation

FISA- Foreign Intelligence Surveillance Act

FISC, Foreign Intelligence Surveillance Cout_L

FTO- Foreign. Terrorist Organization

GAO- General Accounting Office

IIIA- Integrated Intelligence Information Appltication

INS - Immigration and Naturalization Service.

IOS - Intelligence Operations Specialist

Ills -Intelligence Research Speciiatist

ISD- Investigative Services Division
ITOS- International Te_ofism Operations Section

J-ICI-Joint Intelligence Committee Inquiry

JTTF - Joint Terrodsm Task Force

LEGAT- Legal Attache .

LHM -Letterhead Memorandum ,

MAOP- Manual of Administrative Operations: .and Procedures.

MIOG - Manual of Investigative Operations and Guidelines

•

NSA - National Security Agency '

NDPO- National Domestic Preparedness Offic,e

NIPC ' National Infrastructure Protection.Program

NFIP- National Foreign Intelligence Program

NSD - National .Security Division

•NSL- National Security Letter

NSLU- NationalSecurity Law Unit -

OGC - Office, of General Counsel[

OIG - Office of the Inspector General • '-

OIPR- Office of Intelligence Policy and Review ..

OLC - Office of Legal Counsel

OPR- Office of Professional Responsibility

ORCON- Originator controlled

PI - Preliminary Inquiry.

RFU Radical Fundamentalist Unit

SAC- Special Agent in Charge

SCI- Sensitive compartmented information

SCIF - Sensitive Compartmented Information Facility ........ ...

SDNY Southern District of New York

SIOC- Strategic Information & Operations Center

SSA- Supervi,_ory Special Agent .

STU III - Secure Telephone Unit third generation

TAOG- Threat Assessment Operations Group

TD - Telegrapttic Dissemination (CIA) _
TECS- TremmryEnforcement Communication System

LIBL- Usama Bin Laden

UBLU- Usama Bin Laden Unit

USAO- United States Attorney's Office

USIC- U.S. Intelligence Community

WTC- World Trade Center

f
/
_' _i '

FEDERAL BUREAU OF INVrSTIGATION!

.Q

Precedence: ROUTINE Date: 07/10/2001

_'.. , :

To." Counterterrorism Attn: RFU _

.. . SSA,/lllll h------

• IRS .. . . " _

IRS : . e_. _..B_ :-.

_- IRS

New York ISSA

SA"I

F rom: Phoen ix

Squadl6 _i

: Contact: SA Kenneth J. Williams "

ApproVed By:

. .

Drafted By:. williams Kenneth J

. .

Case .ID '#: .{PendJ ng }.... "

.. .

Title:

THE CAUCASUS)

" Synopsis: UBL: and AL-MUHAJIROUN supporters attending civil

aviation unlversitles/collegeS in the State of Ariz(ma.

..

Derived From : G-3

Declassify On. Xl.

I Full Field Investigation Instituted: 04/!7/2"08'O(NONUSPER}" ..

Details: The purpose _of this.-communication is to advise the '

Bureau York of the possibility of-a coordinated effort by

USAMA-B:_N-LAD2_ (UBL} to. send students, to the United states to attehd

civil aviation universities and colleges. Phoenix has Observed an

_nordinate number of individuals of investigative interest who are

attending or who have attended civil aviation universities and

col-l-eges in the State of Arizona. The inordinate number of these

" individuals attending these t_qse of schools and fatwas issuedby AL-

.00038.3
To : CO' From: _ Phoenix

Re: _ 07/10/200i

MUHJIROUN spiritual leader SHEIKH OIdAR BAKRI MoHAIg4ED FOSTOK, an

ardent supporter of UBL, gives reason to belie'Je that a coordinated

effort is underway to establish a cadre, of individuals who will one

day be working in the civil.aviation community around the world.

These individuals will be in a position in the future to conduct

terror activity against civil aviation targets. - ..

. .

"/ : - , .

•,... _•!_ _ Phoenix believes that the FBI should accumulate a

'lis.ting illavlation un_iversities/colleges around the country.

..FBI field 0f.flceSlWith these types of schools in their area shoul'd

• " a : ' _ . ...e .

establish pp_oprzate liaison. FBIHQ should discuss this matter with

other elements of £_e u. s,. .intelligence comm.unlty and task the

•- community for any information that supports Phoenix' s suspicions.

FBIHQ should ._0nsiider seeking _he necessary authority to obtain visa

Informati0hii_i_0m the USDOS on individuals obtaining visas to attend

these _ypeS of schools and notify the appropriate FBI field office

when these individuals are scheduled to arrive in 1:heir area of

responsibility.

• . . . ,. , . _ , ... , " , . "..

>.. "., .: • . , , .-.. . ., -

_:].Ph0enix has dra%m the aboW_i_iConClUsion:from several

Phoenix invest_tgations to

• _ ....cam_o_ned::_nve StLi_n _and the

:following in_estigat

Arabian nat'o al an

....I__). and i). -.".- _"

.-... _ Investigation o£,__Rwas.""initiated

as the result .of.information -pr_,ded:.by__ a -source who has

• provided reliabl :in the .pas_,'-T-he:. ,T, "

2 0 00. ,.o_ UBL

Phoenix has identified several associates of__dat_

WhO e individu a: als at a:retheSuuniv nniersity imsaround who hathe ve same the±sametime radi thacal " .

fundamentali,sts views as_ They come from__

2
To: • te:L_L_/.__om: Phoenix . .

Re: / o7/zo12oo

I

;es are:

as enrolled ia

s

enro

is

• _.'heabove individuals are i.nvoi:ved._wi!th_ and

regulaIly rtlcipate in meetings with hlm in__ona.

• • • I FBI'HQ, _RS_ RFU,:wrote an analyti.cal"

paper .on th 7AL'MU_. JIRO

.RS__S _reSeaf,c-pa--_ h

The followlng information

:was gleaned fro_ • ...paper; '

, . .

The. AL-MUHAJiROUN, which in English means THE

EMIGRANTS, a -Sunni Muslim fundamentalist organiza£ion based .in the

United Kingdom. The .organization' s spiritual •leader .is SHEIKH OMAR

BAKRI MOHAMMED FoSTOK. The organization is dedicated to the overthrow

3

; ,

• .

000385
'

:' m"•

4

000386
To : .Counter'terrorlsm ,'tom: Phoeni_ .'_.

Re: g 07t'10/200! • .... .

•

.... )enix tnvestigatidn o_

• ted _.on_:el g

On 06J_20011 the I

P arre._ two indiv:

to being members of UBL:s AL-QA'IDA ¢_rganization.

Evidence was developed demonstrating that •these individuals were

planning an operation to bomb _the U.S. El_ss_=_ b ...._ and U .S. Military

forces in SaudJLArabia. AI passport _ in the name of

5

• ' 000387
To: Counterterrori rom: Phoenix : .... , ..... +

Re: ..1 , 07/10/2001 " " /. ' "

PhOenix believes that it+is highly, has"anestablished •support network in place in Arizona. This network.was

most likely established during the time period that EL-HAGE lived in

Arizona.

.+.

6

, 000388
To: Coun ' From: Phoenix

Re: _: 07/10,/2001 :, .,:.. ....._..

_.. This information, is being provided to receiving

offices for information, analysis and comments.

/

- i/

..'_

• ::!. ..

•..7,

7
m

To : Countert From: Phoenix ' " .

Re: IL 071_10/_200.1.. .... ..:....... • " - W'

LEAD (s) :

Set Lead I:

COUNT ERTERROR ISI_4

• e

..

• The RFU/UBLU is requested-to consider _ implementing

" the" suggested a_:tions put forth by Phoenix at the beginning of this

communication.

set Lead 2:

NEW YORK

..... AT NEW YORK, I_EW YORK

Read and Clear

..

f

_...

• . .',: ..! . ..

_ .

0003[0

June ]t8,2004

' s

The Honorable Glenn A. Fine

Office of the Inspector General

United States Department of Justice

Room 4322

950 Pennsylvania Avenue, N.W.

3Vashington, D.C. •205.30

Dear Mr. Fine:

Re: OIG DRAFT AUDIT REPORT- A REVIEW OF _IE FBI'S

HANDLING OF.INTELLIGENCE INFORMATION RELATED .TO

THE SEPTEMBER 11 ATTACKS

' Reference is made _oyourmemorandums, dated May 24, 2004 and June 10,

2004, requesting the FBI renew the first five chapters and the recommendations of the

subject drait audit reportfor faztual accnmcy and forwhether anything in the

recommendations is classified or too sensitive for public release. In addition the

" memorandums sought our comments as to whether Ornot theFBI beliv_,ed the

recommendations and conclusions were either inaccurate or unwarranted.This document

is the FBI's formal response to the factual inaccuracies which is attacho:l and the report's

recommendations.. The classification aiadsensitivity review was+provided under separate

cover. (U) • "

Onbehalf of the Director, I want to thank:you and your staff for this report

and for the countless hours of hard Workthatit required. As you know, the FBI values the

Office of the Itispector General'sinput as a comprehensive independent assessment of our

operations and as a means of identifying weaknesses thnt require correcl_ve action to

strengthen our operations. That iswhy_e Director requq_ed your office to conduct this

•review shortlyaRer the 9/1.1 tragedy Based upon Our revtew, your findings and

recommendations are consistent withthe FBI'sinternal reviews and with those of other

oversight entities. I am pleased.to inform you _at the FBI has made significantprogress

not only on the recommendations proffered in your repoli but on all the issues discovered

by our own interm_lassessments. (U)

.

Before re_,_ondingto the individual recommonc_sti0ns,the 0IG and the

American public need to be made aware of the progress made by the Federal Bureau of

Investigation (FBI)since the horrific attacks of Septemb¢_ 11, 2001. If we only

responded to the recommendations in the report, readers would have an incomplete

picture of the progress we have made and perhaps have a difficult time piecing together
)

the information_mdersixteen differentrecommendations.D/rectorMueller has

implementeda a>mprehensiveplanthatfundamentallytransformsthe FBIto enhance

our abilityto predict andpreventfutureactsof terrorism.We have overhauledour

counterterrorismoperations,expandedourintelligencecapabilities,modernizedour

business practices andtechnology, and improvedcoordinationwith ourpartners.(U)

DirectorMueller replaced a prioritysystemWhichallowed supervisorsa great

deal of flexibility,with a set of 10prioritiesthatstrictlygovern the allocationof personnel

andresourcesin (everyFBI programandfieldoffice. C!ounterterrorismis now the

overridingpriority,andevery terrorismleadis addressed,even if it requiresa diversion

of resourcesfrom otherpriorityareas.(,_

' To impl(,_mentthese new priorities,we increasedthe number of SpecialAgents

assignedto terrorismmatterslandhiredadditional_teII/gence analyst_iandtranslators.

We also establisheda numberof operationalunitsandentitiesthatprovidenew or

improved,capabilitiesto addressthe terroristthreat.Theseincludethe :24/7

CounterterrorismWatch(CTWatch)andtheNationalJoint TerrorismTaskForce

(NJTI'F)to manage andsharethreatinformation;the TerrorismFinancing Operation

Section (TFOS)to centralizeeffortsto stopterroristfinancing; docum(mt/media

exploitationsquadsto exploitmaterialfoundbo_ domesticallyando,_erseasforits

intel!i'sence..value:;deployable"Fly.Teams_-'to. .lendo0untertcrrorm/s e_q3ertiswherever e it

is needed;theTerrorist.Screening.Center(TSC)and.F.orei.gn.Terro_Tra_kingTask

.Force (PTI'll _') to help identify terroris_andkeep themoutof theUnitedStates, the

Tenorism Reportsand RequirementsSectionto dissen_'_te FBIterr0dsm,related

' intelligenceto the IntelligenceCommuni_y;an&theC_unt_,ermrism,_...knalysisSectionto

"connectthedots', andassess tile indicatorsOf terrofi_ activity againstthe U,S. froma

strategicperspective.(U) ..

_Wecentralizedmanagementof our Counterterrorism Programat HeadquarterstO

limit "sto • . ve-pip_ of information,to (,=nsurcoe nsistencyof counterterrorismpriorities

and strategyacrosstheorganization,to integratecountertermrismoperationshereand

overseas,to improve coordinationwith o_heragenciesand govemmen(_,andto make

seniormanagersaccountablefor the overall developmentand success of our

counterterrorismefforts.(U)

TheFBIis buildingan enterprise-wideintelligenceprogramthathas .

substantiallyimp1_vedOurabilityto strategicallydirectour integigence collection and to

fuse, analyze, and disseminate our terrorism-relatedintelligence.After passageofthe

USA PATRIOTAct, relatedAttorneyGeneralGuidelines,andthe en_Ltingopinionby the

Foreign Intelligence SurveillanceCourtof Review removedthe ban_erto sharing

informationbetween intelligence andcriminalinvestigations,we quicklyimplementeda

plan to integrate allour capabilitiestobetterpreventtel_fist attaoks.DirectorMueller

elevated intdligence tOprogram-levelstatus,puttinginplace a formalstructureand

concepts of operationsto governFBI-wideintelligence functions,SUd,_tab]ishivgField

Intelligence Groups(FIGs)in everyfiddoffice. (U)

o

2
Under,tendingthatwe cannotdefeatterrorismwithoutstrongpartnerships,we

have enhancedthe level of coordinationandinformationsharingwith state and municipal

law enforcemelltpersonnel.Weexpanded_henumberofJoint TerrorismTaskForces•

(YFTFs),increasedtechnological connectivitywith our partners,and implementednew

ways of sharinginformationthroughvehiclessuchastheFBIIntelligenceBulletin,the

Alert System,andthe TerroristScreeningCenter.To improvecoordinationwith other

• federal agencies and membersof the _n_elligenceCommunity,wejoined with our federal

partnersto establish the TerroristThreatIntegration(',enter,exohaug(_personnel,

institutedjoint briefings,andstartedusingsecurene_vorksto sharei_aformationW. e also

improvedour.relationshipswith foreigngovernmentsbybuildingon the overseas

expansionbegununderDirectorLouisFreeh;by offeringinvestigativeand forensic

supportandtraining,and byworking._g6therontaskforcesandjoint OperationsF. inally,

the FBIhas expandedoutreachto minoritycommunities,andimprov(_dcocoon with

privatebusinessesinvolved in criticalinfrast..ructureand finance.(U)

..

•. o

• The FEIIis making substantialprogressin upgradingourinformationtechnology

to streamlineourbusiness processes.andto improveourabilityto search for andaualyze

information,drawconnections, andshareitboth inside the Bureauand out. We have

deployed a secure high,speednetwork,putnewer up_c_ded.¢oniputerson desktops,and

consolidatedt_rorist informationin a searchableoentraldatabase.We developed, andare

p_aring to lat_ach,theVirtualCaseFile managementsystemthat will revolutionize _

•how:theFBI doesbusiness. 03) •

" . Re-engineeringeffortsaremakingourbureaucracymore efficient andmore

r_onsive to operationalneeds. We revisedour approachto strategicplanning, andwe

refocused our recruiting and hiringto attractindividusls with skillscritical to our -

counterterrorismand intelligencemissions.We have developed a morecomprehensive

trainingprograatandinstitutednew leadershipinitiativesto keep our workforceflexible.

We aremoder_z_ngthe storageandmanagementof FBI records.We also built, and

•continueto improve, anextensive,securityprogramwithcentralizedleadership,

professionalsecuritypersonnel,morerigoroussecuritymeasures,andimprovedsecurity

educationand _ining. (U) ,.

These h_provementshaveproducedtangible_mdmeasurableresults. We

significantly increasedthe numberof humansourcesandthe amountof surveillance

coverageto supportour counterterrorismefforts.Wedevelopedand refined a processfor

briefing daily threatinformation,andconsiderablyincreasedthe numberof FBI

intelligence reportsproducedand disseminated.Perhapsmostimportant,since September

1!, 2001, we have participatedin disruptingdozensof terroristoperationsby developing

actionable intelligence andbettercoordinatingour counterterrorismefforts.0J)

Priorto september11, 2001, the Bureauhad r_ocentralizedstructureforthe

national managementof its Counterten'orismProgram,and terrorismcases were routinely

managedout of individualfieldoffices. An al-Qa'i_ case: for example,might have been

runout of theNew YorkFieldOffice; a HAMAScase mighthavebeea managedbythe

WashingtonField Office. This arrangementfunctionedfor years, andproduceda number

of impressiveprosecutions.Once counterterrorismbecameour overridingpriority,
however, itbecame clear thatthis arrangementhada numberof failingsin thatit 1)

"stove-piped"investigativeintelligen0e informationamong field offices; 2) diffused

responsibilityandaccountabilitybetween countorterrofismofficials atFBI Headquarters

and the SACs who hadprim_aryresponsibilityfor the individualterrorisminvestigations;

3) allowed field offices to assign vsryingprioritiesand resourcelevels to terroristgroups

andthreats;4) impededoversight by FBIleadership,and 5) complicati_ coordination

with other federal,agencies andentitiesinvolved in the waragainstten_orism.ForaU

thesereasons, itbecame apparentthatthe CountertorrodsmProgramneeded centralized

leadership.(U) ._

.. ' i

r - < '

In December2001, the Directorreorganized_ad expandedthe Counterterrorism

Division (CTD)and createdthe position of EXecutive1_sistantDirector(EAD)for

CountoRermrismand Court.terinteUigenco(T. heAssistant Directorof C_D reportsto,the

EAD.)We now kave the centralized management:tomn a.trulynatiomdprogram-to

•ooo_ oountmorrorismoperationsand intelligenceproductiondomesticallyand

overseas;to Conductliaisonwith otheragencies andgovernments; andto establish clear

lines of accountabilityfor the overall development.andsuccessof ourCountmerrorism

Program.With _is _¢ment sl_cturo in.place,we are dfivingthe 15mdamontal

changesthatarenecessarytOaccomplishourcounterterrorismmission. (U)

........sc_dons,.and.uenits achof,whioh:focusesondiaff_vnt_zpe_.n_:.currentlcrforism

thre_facingtheU.S.Theseconymnentsarestaffedwii_inteUianaly 'gencsts eandsubject "

matteerxpertswhoworkcloselwity hinvesti'gat in._orsefieldandintegrate inteMgence

acroscsomponentlinesT.his.inte_'oanllowfos rreal-tiremesponste:othreat

informatiaonndq_ckcommunicafionwi"_ 'decision- "" makanerdsinvestigationtrshefield.

(u) /

TheBureauis designed, and has always operated,as a law entbrcementand an

intelligence agency. Ithas the dua_mission: 1)to inve_gate andarrest:perpetratorsof

completedcrimes(the law enforcementmissi , on) and2) to collectintelligencethatwill

:helppreventfuture crimesand assistpolicy makersin theirdecisionmaking (the •

intelligence mission). Historyhas shown thatwe are most effective in protecting,the U.S.

when we performthese two missions in tandem.(U).

• .. ,

The FBI recognizedthat investigations could pfodu_ intelligencebenefits

: beyond arrestandprosecution.Startingwith.the Ku Klux Klan cases iu the 1960'sandthe

Mafia cases of the 1970's,:ouragentsbegan to view crhninalinvestigationsnot only as a

means of arrestingandprosecutingsomeone for a completedcrime,but als0 as ameans

of obtaininginformationtopreventfuturecrime.The goal wasnot simply to arrest

individualmembe,zsof the Klan orthe Mafia, but tOpenetrateand di_tantle the whole

criminalorganization.(U)

As this approachwas adopted,theFBI fiudherdevelopedthe intelligenoetools-

• such as.electronicsurveillance and the cultivationofhumau Sources-.that are criticalto

predictingand preventingcriminalactivity:We alsolena'nedto thinkstrategicallybefore

__ 4
makingarrests,Sometimesoptingto dday a suspect'sarrestto allow_moreopportun'tyi. for

sttweillance that might disclose otherconspiratorsorothercriminal plans. We have used

this approachto greateffect in orgimizedcrimecases andespionage investigations,and

membersof 0ur Safe StreetsTaskForcesuse it in th¢_ fight against_'eet gangs. (U)

, ..

This is the approachthatis neededto preventterrorism. Priorto September

1lth, however,we wereh_mdicappedin Ourabilityto implementthis approachin the

counterterrorisma,rena for two primary reasons.(U)

First,judicial rules and DOJimer_ procedures.prohibitedc,urcounter_errorism

agentsworking_intelligencecasesfi'0mcoordinatingandsharinginfolanationwith

agents'who oftenwere workinginvestigationsagainstthestone targets.Second,

we hadnot dove)lopedthe.institutionalstructureandprocessesnecessm'yfor a fully

functioning intelLligencope eration.We_to sdd_)sseach of these problems.

"tmmediatelYaf_ the Septemb_ 11, 2001 aOacks.(U)

By definition,investigations of international(lerrorismareboth "intelligence"

and"criminal" investigations.They are intelfigenceinvestigationsb_)ause theirobjective,

pursuantto Executive Order12333, is '_e detectiona_d counteringof international

terrorist activities,"andbecansethey employthe authorities-andinve_,Cigafi'vtools e -

such-asForeign IntelligenceSurveillanceActwarrant_,-thatare designedforthe

_ ..... , into_ee misi)ionof protectingthe U.S. _gainstatC_kor otherharm by foreignentities:"

•_, . They are erimimdinvestigationssince international_rism agai_ (heU.S. constitutes

• a violationof the federalcriminalcode.-CO) .

.. " I.'-L_>. ......

%" . .. . ,

., •,.,.:. .... Over the pasttwo decades, a regimeof courtrules and intonedDOJ pr_edur_

• developedsurrolmding the use of FISA warrantsthatbarredFBI agents and.other

Intel!i'g_ce Connnunitypersonnelworking intelligencecasesthat employed theF_A

tool fromcoordinatingandswapping leadswith.agent_;workingcrim_a_ cases.As a

result0fthis legal ',wall," "intelligence" agentsand"criminal" agentsworking on a

•terroristtargethad to proceedwithout kno.whg what tl!e othermay have been doing

about Chatsame _hargetIn. short,we were fightinginternationalterrorismwith one arm

tied behindourback. (U)

The USA PATRIOTAct' enacted on October26, 2001 eliminatedthis',wall"

and authorizedcoordinationamong agentsworkingcriminalmattersandthose working

intelligence investigations. On March(5,2002 the Atto:meyGeneralis,,mednew

Intelligence SharingProceduresfor ForeignIntelfigenceand ForeignCounterintell/gence

InvestigationsConductedby the FBI Orn_elligencShar e ingProcedures)to capitalize on

thi'slegislative change. The new procedures_specificallyauthorizedag,_ts working

intelligence cases to disseminateto trim/hal prosecutors and investiga_Lorasll relevant

foreignintelligence information,including informationobtainedfrom FISA, in

accordance.Withapplicable minirn{zati'onstandards and other specific :restrictions

(originator con_ls): Likewise, theproeedures authorized prosecutors and criminal

agentsto adviseFBI agentsworking intelligence oaseson all.aspects of foreign

intelligenceinvestigations, includingtheuse of FISA. i_r)

,)
\

( .. . .. ..

. OnNovomber 18, 2002 theForeign IntefiigenceSurveillanceC0urVofReview

issuedan opinion.approvingthe IntelligenceSharingProcedures, therebyauthorizingthe

FBIto shareinformation,includingFISA-derivedinformation,betweenourcriminaland

intelligence investigations.With this opinion,we were finally able to conduct our

terrorisminvestigationswith.the full use and coordinationof our criminaland '

• intelligencetools andpersonnel.(U)

To forma!izethismerger of intelligence and criminaloperations,we have

abandonedthe Separatecase classificationsfor "cdm_ml" internationalt,errorism

investigations(withthe dassificafion number265) and"intelligence"intemationa]

terrorisminvestigations(classificationnumber199), md have consolidatedthem,intOa •

single classificationfor "intemati."onalterrorism"(new classification namber 315).This

reolassificationofficially designates.aninternationalmrodsminvestigation as one.that

can employintel]ligencetools as wdlas _ processesand procedures..InJuly2003,

we formalizedthis.approachin ourModelCounterterrorismInvestigative Strategy

(MCIS), whichwas issued to all field offices and has been.the subjectof extensive field

tni.nngto",) .....

.-

With the dism--an_ of the lega! *'wall!!,. and(lho,integrafionof.ourcriminal and

•intelligence:personnelandoperations,.wenow :have_thelatitude_ coordinate our • .

.int_liigence and(, "wimininalv-.estigations and to .usethe.fullrange,of'investigative tools

againsta subveotJ_dterrorist. On (heinteUigenceside, we can conductsurveillanceon the

smspec_edterrori,,to_ learnabouthis movementsandidentifypossible confederates;We

can obtainFISAauthorityto monitorhis conversatiom;and/orwe canapproachand

• .attempt.t0c,ultivatehim.as a sourceor _0perational,a_set.:On the-criminalside,we have

the optionofincapaoitatinghim throughatrest_detention, and proSeouti'onW. e decide

amongtheseoptionsby cominuouslyba!anoing.theopport_ty to developintelligence

agvinstthe needlieapprehendthe suspectand prevent i'himfromcarryingouthisterroristplans.Thismtegl"atedapproachhas guided ouroperations andwe have successfully

Soiled terrorist-relatedoperations and disruptedcells t_romSeattle,W_mhingtonto, Detroit,

Michiga_ toLackawanna,New.York.(U) "

\

Althoughwe arenow able tocoordinate our iutelligence coll(_tion and

_al law enforcementOperations,wecan only realize ourfull pot_mtialas a

terrorismprevenl_ioagen n cy by developingthe intelligence structure,oapabilities,and

processesto dir_t those operations.Without an effective inteUigencecapacity, we

cannotexpect to defeat a sophisticated and opportunisticadversarylike al-Qa'ida_(U)

) . .

For a varietyof historicalreasons,the Bureauhad not developed thisintelligence '

capacityprior to September 11. While the FBI has alwaysbeen one of theworld'sbest

collectorof information,wenever established the infnastructureto exploit that

information full)'for its intelligence value_"IndividualFBI agentshavoalways analyzed

the evidencein tl_eirparticularcases, andthen used that analysis to g_de their

inveatigatiom.The FBI as'an institution, however,had not elevated that analytical "

processabove the individual case orinvestigation to anoverall effort1Ioanalyze

(
u

intelligence _d strategicallydirectintelligencool e lex:tioangainst threats aer0ssall

programs.(U)

The attacks of September 11, 2001 highlighted the need to develop•an

intelligence processfor the Couuterte_TorismProgr_Land the rest of theBureau.Since "

then, we have undertakento buildthe capacityto fuse, analyze,I_d d_sseminateour

terrorism=relatedintelligence, andto directinvestigativeactivitiesb_ed on our analysis

of gapsin ourcollection againstnationalintelligencer_uiroments"[hal teffort . has

proceededin four stages. (U)

Ourfirststep was to increase the numberof _alysts working on

oountorterrorismImmediately . after September11, we temporarilyreassignedanalysts

f_omtheCriminalInvesti'gativ©Division andCount_intelligenee, Division to various

unitsin the Court.terten'orismDivision. InJuly 2002, 25analysts were;detailedfromthe

•CIAto assist ot_r_tmtertem3rismefforts.Manyofthese analystsprovidedtaotical

intelligence analysis; others providedstrategic"bigpioture"analysis. All of them worked

exceptionallyhard and helped us _al. yze the mass of datageneratedinthe aftermathof

theterroristattacks.These deploymen_ were a tempoirarymeasure,butthe progress

made,the confldenoegained, andthe lessonslearnedduringthisperiodstartedus down

. .,<.... . thief.roadtowarda functioninginteUigenceanalysisop(.'rationWe . also estabfishedthe

• College ofAnal_cal StuSiesto help trainand, developourowncadre,of analysts.(U)

OnDecember3, 2001, the Directorestablishedthe Office of Intell/gence(O1)

withinthe Counl_rorism Division.TheOI Wasresponsiblefor establishingand

executingstandardsforrecruiting,"hiringtra, ining,and developingthe intelligenoe

•_:..... _ytic workforce,andensuringthat_malys_are assignedto operatic)haland field

divisions based oninteUigence priorities.Recognizingthatintelligence and analysis are

integral to all of the Bureau's programs,"mFebruary2(_3, Director l_Iuellermoved the

OI out of the CounterterrorismDivision and createda staudraloneOI, headed by an

Executive Assistant Director (EAD-I), to providecenOadizedsupport _mdguidance for

the Bureau'sintelligence functions. (O)

The nextstep in ourinteDigenceintegrationwaste elevate imelligence functions

to program-levelstatus, institutingCentralizedmanagementand/mplementinga.detailed

blueprintforthe IntelligenceProgram.(Lr)

The Directoi"articulateda clearmission forthe IntelligenceProgram- to

position the FBIto meet cunent and emergingnational secur!tyand ol.iminalthroatsby: 1)

aiming investiga_Livework proactively against threats;2) building and sustaining

enterprise-wideintelligence policies and capabilities;_nd3) providingUseful,appropriate,

and timely info_nation and analysis to the national security,homeland security,and law

enfo_ement communities. We then set out to:embed intelligenceprocessesinto the dayto-day workof the FBI; fromthe initiation.of a preliminaryinvestigationto the ,

developmentof FBI=widestrategies. 0_Y)

7
•Now thattheIntelligePnrceogramisestablisahedndeveloping, _e FB!is

movingontothenextstagoeftransforming theBureauintoanintelliigeagnecenoyreformulatpeingrsonnand el admhdstrativproecedurtoesinstiwillthinourworkforcean

expertiinsetheprocesssuesdobjectiveofsintelligewnork. ce (U)

A majorelemenotf_e Bureau'strausfonnation isurinore_tging integrataion nd

coordinationwith ourpartnersin the U.S. and intematJLonallaw enfor_3ementand

intelligence Con_nunities.Morethan anyothertype of enforcementmission,

counterterrorismrequirestheparticipationof everylevel of looal,.state,national,and

internationalgovernment.A good example is the case of the Lackawannaterroristcell

outsideBuffalo,]NewYork.,Fromthe polioeofficers Whohelped to identify and conduct

surveillanceon the cell members;to the CIA officersWhoprovidedin_'ormationfrom:

the_ sources,ovemeas;to the diplomaticpersonnelWhocoordinatedour effortswith

foreigngov,emments; to the FBI agentsandfederal prc.,secutorswho conductedthe

investigationlest'ring.tothearrest_andindictment,everyoneplayed a significantrole, (U)

..... We recognizethata prerequisitefor anyoperationalcoordinationisthe full and

frecexchangeofinfonnation._Withoutproced_._ •andmechanismsthat allow •

informationsharingona regularandthncly basis,we _mdour partner_lCannotexpectto

alignouroperationalefforts to best accomplishoursh_zedmission.A,_cordingly,we have

tak_stcps •to._establish.:unifiedFBI-wide.policiesforslharing:informationand intelligence.

• _U_ ..

• . .

• .

: .... .

•To ensm_ a coordinated,enterprise-wideapproach,theD'n_x_,torrecently -

....designatedtheEAD-I to-serveasthepfincipal::FBI0fficial:forinfommtionand ""

intelligence.sharingpolicy. In thiscapacity, the EAD-I.functions,asazL: advisor to the

Director andprovides policy direction on information amdintelligence/sharingwithin and

outsidethe FBI with the lawenforcementand intelligencecommunities,as well as

•foreign governm(mts.(U)

On Februar20y ,2004we fomledaninformationshmpolicy -ing group,

comprisedofExecutiveAssistaDnitrectorAss,istaDirecto nt arsndo_hesrenior

exeoutivemanagers.UnderjtheDirection .ofthe EAD-I, this groupis establishingFBI

informationand inteRigence sharingpolicies. (U)

On Febnmry11, 2004 the Attorney General almounced the creation of the DO}

Intelligence CoordinatingCouncil. The Council is comprised of the heads of DOJ

agenoiewisthinteUigenceresponsibilities,andiscurrcatlychairedby theFBI'sEAD-I.

The CouncilWillwork to improveinformationsharingwithinDOJ and to ensurethat

DOJmeets the intelligence needs of outside customers and actsin acc_)rdancewith

intelligence priorities. It will alSOidentify common ch_dlenges(such _ electronic

connectivity,colIaborativeanalytictools, and intellig_lce.skills training)and establish

policies andprograms_to addressthem.(U) • ,

i

Beyondthese informationsha3iuginitiatives,we areincreasirLgour operational

coordinationwith our state, federal, and internationalpartnerson a nmnberof fronts._')
o

/ ° ,,

,;. ..

We have establishedmuchstrongerw0rkingrelationshipswilththeCiA and ,

other membersof the IntelligenceCommunity:Fr0mthe Director's&dlymeetingswith

the Directorof CentralIntdligence andCIAbriefers,toour regularexchange of

personnelamong agencies,to ourjoint effortsin specific investigations and in the

TerroristThreatIntegrationCenter,the TerroristScreeningCenter,and othermultiagency

entities,the FBI andits partnersin the IntelligenceCol_nunity arenow integratedat

virtually every level of ouroperations.(U)

..

..

TheTerroristThroatIntegrationCent_ is a good exampleof ourcollaborative

relationshipwithLthe CIA and oth0rfederalpartners.Establishedon May1, 2003 atthe

directionof PresidentBush,TTICc_rdinates strategicanalysisof threatsbased on

intdligence fromthe FBI, CIA,DHS, andDOD. Analystsfromeach _cgenoyworksideby-sidein one locationto piece togetherthe big pictureof threatsto _heU.S. andour

interests.THCanalysts synthesize government-wide_format/on regerdingOutrent

terroristhreatsandproducethe PresidentialTerrorismThreatReportfor thePresident.

The FBIpersonnelat TTICarepartof_he Office of Inlellige•nce an. dworkclo•sely:With.

analystsat FBIE[eadquarterins comb'mingdomestic and intemationa!terrorism

developmentsinto a comprehensiveanalysisof terroristthreats. In._dition to the

__.. an_ysis developed by FBI anatys_ detai_ed_oTTIC, FBI analystsat Hemdquarters

"-"i"'I regularlycontributearticlesto the President'sTerroristThreatReport.(U)

..

•The FBI currentlyhas AgentsandAnaly_ detailedtoCIA _Ltifies,including

the CIA'sCountc_TerrorismCentcir(CTC).We also ktve FBI agents_mdintelligence

., analystsdetailedto theNSA, the NationalSecurityCouncil,DIA, the Defense Logistics

Agency, DOD's RegionalCommands,(theDepartmentof Energy,andother federaland

...... ..'........ state.agencQiUes. .)

CIA personnaerlealswoo rkinginkeypositionthsroughout theBureau.The

AssooiateDeputy Assistant Directorfor Operationsin the Counterterro,rismDivision is a

CIA detailee:CIA officers aredetailed to the SecurityDivision, includiLngthe Assistant

.Director,the Chiefof thePersonnelSecuritySection, madmanagerswc)rkingwith the

Secret CompartmentalInformation(SCI)programand ltteFBI Police.,Anexperienced

managerfr0mflaeCIA's Directorateof Science and Tedmologynow heads the

Investigative Tecl_olo .giesDivisionandaSectionChiefinthatdivisiionsonrotation

fromCIA.(U)

• .

Thisexchangeofpersonneisltakingplaceinoutfieldofficeasswell.In33field

locationthes,CIAhasofficerco-s locatwith ed FBIagentsatYITFsites, andthereare

planstoaddCIAofficers toseveraaldditionsiatleThe s. NSA hasanalystsdetailed to

FBIHeadquarterthes,WashingtonFieldOfficte,heNew YorkFielOdffice,andthe

BaltimoreFieldOffice.(U)

Eachmol_g, in addition to FBIBriefs,the Directoris bfiefe_/bya CIAbriefer.

The Directorof CentralIntelligence and the FBI Directorthen jointlybrief the Pt_esident

: .
/ •

on currentterrorismthreats.Inaddition,CIA andDHS personnelattendtheDirector's

internalterrorismbriefings everyweekdaymorningandafternoon.(t_ _-

• . _.

" -The FB1is now using secure systems.todisseminateclassified intelligence

reportsand anal3fdcalproductsto the IntelligenceConnnunityandother federalagencies.

The FBIhosts a 'website on the Top-SecretInte_Jomt World-WideIntelligence

CommunitySystem (_CS), a fully-encryptedsystemthat connects:more than100

DePartmentof Defense, CDL,andother IntelfigenceCommunitysites. We also host a

web site on SIPRNET,a similarsystemusedby DOD forsharinginformationclassified

atthe Secretlevel. Inaddition,a new TS/SCInetworkkno._ as "SCION" is being

pilotedin severalfield offices, scIONwilI ConnectFBIHeadquartersand field0ffices tO

the CIA and othe,_membersof the Inte[tigenceCommlmity,and:_ increase •

Opportunitiesfor inter:agencyColl_oration. (U)

ImprOvingthe COmpatibilitOf Y informationtechnology systems throughoutthe

IntelligenceCommunityWfllincrease:_e Speedand ease ofinformatkmsharingand

collaboration.iAcCordingly,theFBFs inform_on technologyteam hasworkedclosely

with the ChiefInf0rmationOfficers(CIOs) ofDHS.and oth_ IntelligemceCommunity •

agencies, to develop ourrecentandongdng t_hn01offyupgrades.Thiscoordinationhas

affected.ourdedsions on Several.keytechnology upgrades,(U. ) - ' .-

. , . _, . • : . . .. .

To facilitate:furthercoordination,theFBI CK)sitons the Intelligence

Communi'tyCIO Executive Council TheCounoii developsand recommendsteohnioal

: req_ents, policies andprocedures;and:coordinatesinitiativesto improve:the :

int_ility of informafi'ontechnologysystemswithin_e htemgenceCommum'ty. It

was establis• hedbyDirector. of. CentralIntelligencedirectiveandischaired by the CIA's

CIO. _J)

DHS phys a criticalrole in assessing and Protectingvulnerabflitiesin our

national_;ture and atour borders,and in overseeingourrespoz_e capabilities.We

have workedclosdlyWithDHS to ensurethatwe have the integration_mdcomprehensive

informationsharhagbetween ouragenciesthat arevital to the success of our missions.

The FBI and DHS share _ase access at TTIC,intheNational YrrFat FBI

• Headquarters,inihe FIITF and the TSC, andin local JTTFsin our field offices around

the country.We workedclosely together to get thenew TerroristScreeningCenter up

andrunning.We lloldweekly briefingsin which ourC]'D analysts brie_ftheirDHS

counterpartson currentterrorismdevelopments.We coordinate all FBI warningswith

DHS, andwe now coordinatejoint warningsthrough theHomeland So:urityAdvisory

System to address:our customers' concerns aboutmultiple and duplicativewarnings. We

designatedan experiencedexecutivefromthe.Transporlmtion.SecufityAdministrattion o•

runtheTSC anddetailed a seniorDHS executive to the FBI's Office of Intelligenceto

ensurecoordinationandtransparencybetween the agencies.(U)

On Marcl_4, 2003, the AttorneyGeneral,the.Secretaryof H0melandSecurity,

andthe Directorof CentralIntelligence signeda comprehensiveMemo_randumof

UnderstandingOv[OU)establishingpolicies andproceduresfor informationsharing,

handling, and use. Pursuantto that MOU, informationrelatedto terroristthreats and

• m .... 10
B

'vutnerabilitiesis providedto DHS automatioallywithoutDHS having,to requestit.

• Consistentwiththeprotectionof sensitivesourcesand methods and_heprotectionof

privacyrights,we now shareas arule,andwithholdby exception.(U)

Withterroriststraveling,communicatingan, dplanningattacksall aroundthe

world,coordinationwith our foreignpartnershas becomemore cfitic_dthaneverbefore.

We have steadilyincreasedouroverseas presenceandnow routinelydeploy agentsand

crime scene exp,_ts to .assistin the investigationof overseas attaoks,moll asthe May

2003 bombingsin SaudiArabiaandMorocco.ASof 3anuary7, 2004, 4i3FBI personnel

were assigned overseas,over200 of whom arepermanenttyassigtled:Theirefforts,and

the relationshipsthatgrow fromthem, haveplayeda critical rolein _ie successful

internationaloperationswe have conductedover the past 31months.!_U)

.:

Bureaupersonnelhave participatedin numerousinvostigatioJ_Ofterrorist

attacksin foreigncountriesoverthe past 33 months.C_"approazhto those investigations

differsf_omthe approachwe tradi'fionallyhavetaken..Pri6rto Septemberi lth, our

overseas inves_gationspfimafilywere focusedon buildingcases for prosecutionin the

U.$. Teday, ourfoous has broadenedto provideour foreignpartnerswithinvestigative,

fore_."C,and other types of supportwhich enhanceour joint effortsto preventand disrupt

terroristattacks.Ourpartnershave embraced:thisapproach,andit is payingdividends

with greaterreciprocalcooperationandmore effectivejoint investigations.(U)

• ..

The fotmdation of acentralized andeffective counterterrori_zoperationis the

capabffitytoassemble, assimilate,anddisseminateinvestigativeandoperational

-, ' _ormation both.internallyandwith fellow intelligenoeandlaw ¢_or_ement agencies.

This Capabilityrq_uiresinformationtechnology(IT).th_:makesinfomaationeasily

accessible andtumbleby all personnetwhile protecting,the.security of that information.

([3") .

Priorto September! lth, theBureau'sinformation:teChnologywas ' inadequatet°

supportitscounterterroristnmission. In previousyears:,substantialinvestments were

made to upgradetechnologiesthat directlysupportedinvestigations,reichas surveillance

equipment andforensic serviceslike the IntegratedAutomatedFingerprintidentification

System.Insufficientattentionwaspaid, however,to technologyrelatedto themore

fundamentaltasksof recordscreation,maintenance,dissemination,and retrieval.In2001, ...

many employeesstill used vintage 1987 386 desktop _3mputers.Some residentagencies

could only access data in their field office via a slow dial-up connection.ManyBureau

programswereusing computersystemsthatoperatedindependentlyaud did not .

interoperatewithsystems in otherprograms0r other pe_csof the Bureau.(U)

TheFBI also had a deficientinformationmamtgementsystem.TheFBI'slegacy

investigativeinformationsystem, theAutomatedCase ',Suppor(ACt S), Wasnot very

eff_tive in identifying information or supporting_vestigations, Users_navigatedwith the

functionkeys instead of.the "point and click"method common to web-based applications.

Simple tasks,such asstofing an electronic version of a document, required a user to

perform12 separatefunctionsina "green.screen"envkonment.Also,.the systemlacked
•':'_

rnultimedi'afunctionalitytoallow forthe storageof i_ormation in its:originalform.

Agen_ could notstoremany forms of digital evidence into electroni,0format, instead

havi_g to describethe evidence md indicatewhere the evidencewas _gtoreind a control

room. CI.J)

to the character andresoiveof its pen:onnel,the:FBIWasableto achieve

numerousinvestigative successes, in spiteof these obstacles.Itwas_c]Learas of September

11,however,thatWe needed an integrated1Tinfrastrtt_turtoe manage ourinformation.

We broughton-boarda highly skied teamofexperts _mctset outto _'eate an IT "

infim_'uctureti_ is fastand secure,andthatties togeth_ the apph'cmionsanddatabases

usectthr0ughouttheBureau, we also designeAuser-friendly,web-bas_ soRware

applicationsto reducerelianceonpaperrecordsand :tostreamlineinveatigativewOrkflow.

These hnprovementsare enhancingourabilityto collect, st0re,search,analyze, andshare

information.CO.)._ : _ ...

• " " " i .

The firststepintheFB!'s modernizationeffol_is the Trilogy:Program,a multiyear.effortto enlmnceO_ effectivenessthroughtechnologiesthatallow us to better

access,0rganize, andanalyze _ormation_ TheT_ogy Programis amledatprovidingall

FBI offices, inc!udingoverseasLeg_ Attach6offices,:'withimproved._etwork

¢0r_rnu.lcafions,a commonandcurrentset of office xltomation togls, anduser-friendly

Web-baSed appli'cations. Trilogy ttp[_d._ also i!!corpol_te controlsto providean

enhancedlevel of security,forFB[ "mformafi'o(I_f) ..._ .

• . ." _ ....... . • ... . ,

• ( F011owhtgSeptember11, we sawtheneedto:provide:countert,errorism o

investigatorsand analystswi'thquid_ easy acc_ssto:thefullbreadthoifinformation

relatingto terro_sm.We developedathree-stepplau t_t wouldprovide immedi_e

Supportto counteirterrorismandtheninoremefitallyin_:ease therange _mdeffectiveness

of thatsupportfor other criminal investigations.ThisPlan transitionstmawayfrom

separatesystems containingseparatedata,towardsanInvestigativeDatabase Warehouse

(IDW)thatcontainsall datathat canlegallybe storedt!_gether.TheIDWprovidesthe

BureauWitha si_e access pointto severaldatasourc¢_thatwerepreviously available

only throughsep_wate,stov_piped systems.By providingconsolidated accessto the data,

for thefirs.t time _malyticaltools canbe used.acrossdatasourcesto prc.videa more

completeview of the informationpossessedby the Bureau.(U)

•

" Theinitial steptowardthe IDWwasthe implementationof_ Secure

C0mterterr0fistOperationalPrototypeEnvir0ment (SCOPE)progr_a.Under the

SCOPEprogramwe quicklyconsolidatedcounterterrofisminformationfromvariousdata

source_,providinganalysts atHeadquarterswith substantiallygreater _cess to more

informationin fro'less time than withotherFBIinvestigative systems.The SCOPE

databasealso gave USan opportunityto test new capabilitiesin a controUedenvironment.

This prototypeenviroment has nowbeen replaced by the IDW. (U)

The IDW, delivered in its first phase to theOffice of Intelligence in January

2004, now provides analystswith full accessto investigative information within F-BIfries,

inclttdingACS aad VGTOFdata, open sourcenews feeds, and the file_ of otherfederal

• .
m

agenciessuchas DHS.The IDWprovid_ physical storagefordata_d allowsusersto

accessthatdatawithout needingto know itsphysicallocationor format.The &ta in the

IDWis at the Secretlevel, andthe additionof TS/SCIlevel datais _ the planningstages.

j), • .

Laterthis year,we planto enhance_heIDWby addingadditionaldatasources,

suchas SuspiciousActivityReports,andbymaking iteasier to searclhW. hen the IDWis

complete,agentsand analystsusing nt,'wanalyticaltools will be able to searchrapidlyfor

picturesof known terroristsand matchor comparethe pictureswith otherindividua!s

minutesrathert_handays.They will be able to extractsubjects'addresses,phonenumbers,

and otherdata in secon&, ratherthan searching forit manuaUy.They will have the ability

to identifyrelationshipsacrosscases. Theywillbe able to search,upt_ 100 millionpages

of international_terrorism-relateddocumentsin second_.(U) ....

•

Ultimately,we planto turnthe IDWinto aMasterDataWarehouse(MDW)that

will includethe administrativedatarequiredby the FEIIto manage itsinternalbusiness

processesin additionto the investigativedata_MDW will growto eventuallyprovide

physical.datastc)ragefor, andbecome the systemofrec0rd for, all FB! electronicfiles. (U)

. ..

We areintroducingadvanced analyticaltools to helpUs makethemostof the

.... :_ : data storedin the IDW. Thosetools allow FBI agents _mdanalyststo look acrossmultiple • ._ ,

• ca,sosandmultipledata sourcesto identifyrelationshipsandotherpi_:es of information -

thatwere notreadily availableusing olderFBIsystem_;Th. esetools t])make database

searchessimple;rodeffective; 2) give analysts new visualization,gee-mapping,"link-chart

•._ capabilitiesandreportingcapab_fies; and3) allow amdyststo requestautomaticupdates

to theirqueryresults whenevernew, relevantdata is downloadedinto _thedatabase.03)

/

• ,?

As the t_t partof ourITmodernizationeffortsnear completio_ FBI gents,

analysts,andsupportpersonnelarealreadyenjoyingnew capabilities_mdapplyingthose

Capabilitiesto th_ cotmterterr0rism ission.Theyhave uprto-datedesktops,fastand

secureconnectiviity,a user-friendlyinterfaceto the ACS case managezaentsystem, the

abilityto access and search consolidatedterr0rism-relateddata, andnew capabilities for

sharinginformationinsideand outsidethe Bureau.02)

While there is .stillmuchto be done,these effortsare startinglx_deliverthe

technologywe need to stay aheadof evolvingthreats.Upgradingourteclmologywill

•remainan FBI priorityfor the foreseeablefuture,and o'arnew ITmanagementwill

ensurethat we continueto improveour systems.(I3)

With the recent directivesimplementingthe intelligence agent career track and

the adrninistratiw_r,eforms relatedtobuildingan intelligenceworkforcowe,have in place

the essentialstructural elements of an intelligence-drive.__unterterroriism operation.The

challengenow is to refine and continue to develop that ,operation- an effort that will

requireadditionalresources,continuedattentionby FBI leadership,and constanttraining _.

of FBI personnelin intelligenceprocesses and objectives. 03)

i 13
.,

While we have clearlymade substantialprogress•overthepast 33 months,it is

difficultt0 come up with an exactmessUrem_t of _e currenteffectivenessof our

counterterroris-mefforts.Besides citingthe absence of successful atts_l_ on thehomeland

•since SeptemberIlth, there is no singlemeasurethat oompletelycaptureatheprogreas

we havemade. There are several yardsticl_,however, thatdemonstratethe effectiveness

of the core functionsof a CounterterrorismProgram.These yar&ticlminclude the

following: . ... .. ._

• Developmentof humanassets

• Numberof FISAs , ....

• Numberofintelli'gence reportsgenerate_ _,

' .Que ." ry ofdailybriefings ...... ' ..

, Effectiveness of COunterterrodsmoperations

•Continuedpr0t.eofticiv0ilnliberties , - : .

-Anapplicationo:fthese yar&ticks.demOm_-a_estheprogress we have achieved since . "

SeptemberH, 2001.(U) : ..

"TheFBIhaslongrecognizthat ed .humsoan.twinf _e 0rmation i_oneofthe.most

impoi_mway t stoinv_figate.cfiamctinivalit.Wey.havel0ng-standing expertisine

-recruitingandusing humansources,andwe have _ed those skillsto gre_ effect acrossa

wide rangeof:investigative programs,includiorngganizedcrime,drugs,public

corruption,and white collarcrime. (U) . . " "

• .. • , " . ,. :

..

" • While we also have developed,souroos.overthe yearsin theComltort_oriSm

Program,September 11mmgh!i'ght . edthe.ShomgeOfhtunan.inteliigenoereportingabout

al.Qa'idb0athi:ntheU.S.andabroadW.iththe.U.S.govemmentha,viJ_relativfelyew

assetsWh0 wereabletopenetratande reportonai-Qa'ida!spWel_,werevulnerabtleo

surprise.att((aY)ck"-,: "

•TheBureauhasplacedaprioritydev on eiopinhugmanintelligensoucerces

reportinonginternatiOnterraloristS We have . revisedour,trainipngrogramo,ur

personnel evaluation crited.a,andOuroperationalpriorities:tofoous on source"

development.Wldle we continue to growthiscapacity, we have already seen a marked

increase in the numberof humanintelligencesources in the .Counterte , _rorismProgram.

:

Between Augus_30, 2001, and September30, 2003, the numberof sources relatedto

internationalterrorismincreasedby more than 60.p_cent, andthe numberof sources

related-todomestic terrorismincreasedby more than 39 peroent.(U)

..,

FLSAcoverage has also increasedsignificantly,reflectingboth ourincreased

focus oncountert(_orism andcounterintelligenceinvestigationsandimprovementin the

operationof theFISA process.From2001 to 2003, the:numberofFISA applicationsfiled

annuallywith the ForeignIntelligenceSurveillanceCo_ inc_asedby 85 percent.We

haveseen a simih_ increase in the use of _e emergencyFISAprocess_thatpermitsus to

obtainimmediatecoverage in emergencysituations.In '.2002,forexaml)le,the

Departmentof Jus_ceobtained a totalof 170 emergencyFISAauthol_tions, whichis

more thanthree _mes the numberof emergencyFISAs we obtainedin lthe23 years

betweenthe 1978 enactmentof FISAandSeptember1.1,2001. CO)

•. Q 14
W '"

• ..,

..

• . ,,

• I " . 'J '

Inthe pastyear,theFBI producedmorethan3,000 mtelligeuoeproducts,

including"raw'"reports,intelligcncemomorandain-depth ) strategic_malysisassessments,

special eventthreatassessments, andfocusedPresidentialbriefings,we also conducted

numerousintelligencebriefingsto membersOfCongress,othergovernmentagencies,_d

the law enforcement and intelligence communities."ll_eseeffortsmarka new beginning

for the FBI'sintelligenceoperation.(I_

) Priorto September1I, 2001, the FBIproducedvery few raw.inteUigcncereports.

inFY 2003; weproduced anddisseminated2,425 Intc!ligenceInfommtionReports(IIRs)

contains,g raw :intelligencederivedfxomFBIinvestigationsandintelligencecollection.

ThemajorityContainedintelligencerelatedto internationalterrorism;the next greatest

number,containedforeignintelligenceand_unterinteUi , genceinform_ttion;andthe

remainder.conc(_-medcriminalactivitiesandcybercthne. These firs Weredisseminated

to a wide customer setin FBI fieldOffices,theintelligenceCommunity,Defense

Community,ottterfederallaw enforcementagencies, _mdU.S. po!i'cyentities.(U)

• . In.additionto these raw.intelligcn_ reports,the FBI.has.be_m producing

" analyticassesm_entsona parwiththose of the IntelligenceCommunity. TheFBI

developed andissued,in January2003, a classifiedcomprehensiveas:_essmentof the

terroristthroatto thoU.S. Thi'sassessmentfocuses onthe threatsthat_theFBIsees

.,. do, eloping over.the nexttwo years,based.onan analy,ds of informationregarding.the

motivations, objectives,methods,andCspabilifies0f.¢xistingtaToristgroupsandthe.

potentialfoi:.theemergenceof neWterroristgroupsandthreatsthroug_outthe world,This

...... :'"....... _-assessment is usedasa guideinthe allocationofinvesCigativeresources, as a

usefulcompilationOfthreatinformationforinvestigatorsand.intelligencepersonnel

withinand withouttheFBI, andasa resourcefor decidon'makerselsewherein the

government.The 2004 threatassessmentwas released,in April2004. FBI analystshave

producedover 100 in-depth.analysesaudseveralhun&redcurrentintelligence articlesin

additionto the workthey do assistingl_I investigations.(U)

..

We are preparing to produce,in thenearfuture,theFBIDaily RePort andthe

FBINationalRep.ort to providedailyintellige_cebriefingsto personnelin .thefield and

externalcustomers.Onewill be producedattheclassifiedloyalandihnitodin distribution

ire,upper-levelfield managers.Theotherwill be unclassifiedandWidei[ydistributedto

field office personnelandourpartners"mthe_awenforcementcomm_,_ity.(U)

A good exampleof ourabilityto exploitevide,_cefor itsintetligoncevalue and

sharethatintelli[/enceis ouruse of the al-Qa'idaterrorismhandbook.A terrorism

handbookseized from anal-Qa'idalocationoverseashi themid-1990's was declassified

andreleasedby DOJ shortlyafterthe eventsof September11, 2001. We determinedthat

intelligenceglemed fromthe handbookcouldprovideuseful,guidanceaboutal-Qa'ida's

interestsandcapabilities.Accordingly,we producedanddisseminateda seriesof

intelligenceproductsto sharethisintelligenceWithourpersonnelin th(s.fieldandwithour

law enforcementpartners.Nine IntelligenceBulletinswerebasedin w3_Ol.eorinparton

thisintelligence.Inaddition,we usedinformationderivedfi_m theal-Qa'ida Handbook

o

' .,

.. _" 15

. •
gBl

/

..

to updateourcounterterrofismtraining,ino_udingthe IntelligenceAnalystBasic Course

at the College of A_a!yticalStudies,the _ntroducfionto CountertenorismCourse a_the

NationalAcademy, andsessions on TerrorismIndicatorsand Officer Safety in our

SLATTtraining."TheunclassifiedVersionof thehan_,ook is now maintainedas a

referencein the FBI Eibraryandis accessibleto .allthe studentsat the Academy.It also is

includedin the referencemanualCD-RomdistributedasPart. of SLA'ITtraining..(U).

Onetelling measureof ourimprovedcounterterrorismopera_ionsis the

developmentof our capability to brief the daily terroristthreatinformation.The

development of this capabilityreflects _hematuringof ourcentralizedCounterterrorism

Program.CO : : -

• . . •

.

• ' .Prior toSeptember i lth, theFB[ lackedthe capacityto provide a comprehensive

dailyt.errorismbrie.fing-tO,assemblethe currentthrea_Iinformatiton, odetemdnewhat

stepswerebein,gtaken to addresseach threat,andto p_esentaclearpi()tureof eachthreat

andtheB_'S response to that threat to the Director,seniormanag¢_,,the Attorney._

General,and others in the AdministrationWhomakeoperationalandpolicy decisions.

With a d.ecentra"' _._edpr0gramin.which investigationswere runby inc_[vidualfidd offices,

the.Bureauneve_hadto develop thisspeciafized skill.With the need.fi)r.centralized

maaagement,however, it became animperative.(U) .: . •

-••

• .. in the aftermathof._e terroristatta.c_,.weweire asked_ beginsending to the"

•WhiteHouse each m0ming dai!y:reportson-counterten_rism.=related.events: .Wehadno

..m_ in p_0e forcollecting thatinformation so p,reparationofthereportswas •

•.initiallyhaphazan.£ Duringthe past 33>months,',with:,:.the,ass'.tstaaceof._:etfrom eransthe

InteUi'ge_ceCon_n.unity,we have establishedthe ."mf_,_uct_e andthe cadreof

professionals,to p:.mduceeffective .daffybriefingsandto sharebriefingmaterialsmore

widely withinthe Bureauandwith ourp_tnors. (If)

- ..

..... ..

In 2002 we establishedthe PresidentialSuppoi_Groupwithin,the

CountertetrorismDivision to preparedailybriefingm_terials.In the summerof 2003, this

group.Wasrenamedthe.S.trategicAnalysis Unit andmovedto the Office of intelligence.

Be_:in August 2003, the StrategicAnalysis.Unitbeganproducingthe Director's"

DailyReP0rt (DDR), a daily intelligence briefingthatincludesinformationon

counterterrorismo:perations,terrorismthreats,.andinfo_rmationrelatedto allareas ofFB!

investigataciveti_d(Uty). .. .. "

To .producethe DDR,.the StrategicAnalysisUnit consolidatesandrefines

informationprovidedin a standardizedformatby intelligencepersonnelin,eachdivisionl

Eachmorning, . int._ormatioabout n new threatsis added, and information.aboutthreatsthat

have beenthoroughlyvetted duringthe nightis rem0ve(1.TheDDR is ,$stributedto

executivesin all FBI operationaldivisions. TheDirectorusesthe DDRto briefthe

.Presidentnearly every weekdaymorning.The FBIalsoproductheesPresidential

Intelligence Assessment, a finished FBIintelligenceproductcovetingtopics of particular

intere_ to thePresident,andasnoted,earlier,out personnel atTTICand at FBI

...

i

i . 16
i

HeadquaxterScohtdbute to the formulationof.the dailyPresident's T(,,rrori'stThreat.

,

Report. (U) '"

J

Director Mueilerholdsthroat briefingstwice a da_: an intell_tgencebriefingin

themorning anda case-oriented briefing in theevening.At these briefings, a brieferand

the operationalIexecutive managersprovidea summatyofthe currentthreats andour

operations.With CIA and DHS representativesin attendance,these n_eetingsalso serve

to ensure thatall[threatinformationis appropriatelypassedto those ai,)encies.(U)

•

• ..

The developmentof thisdailybriefingoperationis atangiblemeasureof the

progresswe have made since the daywhenterrorisminvestigationswere runby

mdivid.ualfield offices andlittle effortwasmade to centrallydirector coordinatethem

throughoutthe i_)ureauandwith the otheragenciesinvolvedin protecl_g the U.S. against

terrorism. (U) • • . .

<

• . ..

The Bt_roauhistoricallymeasuredits performance,to a largeextent, bythe • .

numberof crim_naisi,t arrested.Whileusefulfor traditionalaw enfo_)ement,where the.

primaryobjective is arrestand prosecution,thisstandardis under-inclasiveas appliedto _

counterterrorism,where theprimaryobjectiveis to neutralizeterroristthreats.Itonly

Capturesthatsubset , of terroristthreats.thatare neutmllzedby arresting terroristsand

prosecutingthem with chargesof criminal_rorism. It fails to capture)theterroristthreats

wenoutralize throughmeansotherthanformalterrorismprosecutions- such as

">"_": ' deportation,detention, arreston non-_ charges:,seizureof financialassets,_andthe

sharingof informationwith foreigngovernmentsfor_eir use in taki_ actionagainst

...,..:...terroristswithin their borders:(U)

. . .

..... ,..,'ii._.-A/. moreuseful measureis one we have.used/u organizedc_nte cases- the

numberof disruptionsanddismanfleme_ts.Thismeasurecountsever),timewe-either

by ourselvesorwith our partners'inthe law enforceme,t andintelligencecommtm/tiesconductanoperationwhich disables,prevents,or"interruptsterrori_fimdraising_

recruiting,(rainh.zg,or operationa_planning.Since Sep!Iember11, 2001, the FBIhas

participatedin &)zensof suchoperations,disruptinga'_de varietyof.domestic ,and

internationalterrorist Undertaidngs(U,). '

While the numberof disruptionsis Significant.the, most tellingmeasureof our

progressis themanner in whichwe haveconductedin(fividualoperationsconsistentwith

ourpreventionmission. Theextentof ourtransformationis most clearlyseen in the

approachwe take when confrontingSpecificterroristt_reats. Our app_>achto these

operations demonstrates the extent to which coOrdinationand prevention through the

development of eLctionableintelligence havebecome our gui_ opere_onal principles.

Co)

The September 1l, 2001, terroristattacksawakenedallof us to the deadlythreat

of modemterrorism andto the need for b01daction.Woin the FBI have undertakenthat

bold actionover 1Lhepast 33 months. Whilethere is still much work to be done, we have

madesignificant progress. With these efforts, andwith the unwaveringsupportof the

Americanpeople, we are confident thatwe will prevail in our war aga_astterrorism.(U)

i• 17 .
sPECIFIc RESPONSESTO OIGRECOMMENDATIONS:

A. Recommend.afionsrelatedto the ESI's analyticalprogram:(U) ..

• ...

Recommendation rNO.,1: Improve the hirnng,_ralnfag and retention of intelligence

•• analysts.(U) • '

Response: TheFBi has _akena numberof measurablestepsto ira:prove . thehiring,

training,andretentionof analystssincetheSeptember11attacks.(U)

•

•

• The FBI's Office ofIntdligence (OI), ledby anExecutiveAssistantD/rectorWho

• is a care_ intelligence analystin theU.S. IntelfigenceCommUnity,hasdeveloped

........ arecrui_igplanto¢nmlretha_theFBIactivdyreerucaitsndidates wit,h_e.::_"

criticalskills necessary toprovide world-classiintelligenoe nalysisfor theFBI_s

mission. InSeptembe2003, r theDirectorapprovedtheFBI'sHumanTalentfor

. .IntelligPrenocduc e tio.CnonceopftOporations(CONOPS), wlfichfocusesonthe

reeruitment,.,hiringd,evdo.pment,and _ ofintelligenc _aleY_z.(U)i_

• Recruitn_mtMiring Prio!r-ttheoapprovoalfthe.HumanTalcCOzNOPSthe Lt FBI

.didnot haves recrm'tmenteffortspecific to the inte-lligenceanfiyst positio_ As

•-..-.h,.!in.s_.toltliagaenc alys¢ ts.nowet_routinelypof__mruitment:teams;In

©ffort:t©o nsuro.theFBIispreparetod meetemerging.lecruitm,tand._"

• priorities:forintelligenceanalysts,,the OIselected intelligence analy.m (FB_Q

.. 8ndfield) ,toserveasinte.iligenceanalystrecruiters.The intelHl_ce an.alyst"

recruiters attendevents-at colleges and univer_ties, aswell as designated

conferencesand.careerfairsthroughoutthe country, From October200./ 3 - April

•

•2004,

• ._

the. FBI participatedin more.than10recu._itmenteventsandplanS,to. .

• participatein at leastfive additionalevents throughseptember 2o04. (u)

• . . •

• A marketingplan was also.implementedtosupplementthe Intd!igenceAna!ys. t

r_'ting efforts.OnFebruary8, 2004, anadvertisementspe0ific to the

intelligence'analystposition at theFBI was p!ac,_edin-theW.ashingtonPo_

WashingtonTimes, andthe New YorkTimes, _id hassincebeen re-advertised

severaltimes, OnFebruary9, 2004, _.e firstpressrelease ad&essingintelligence

.-analystre_:ruitmentat the FBI was releasedby lhe FBI:Nati0nalPressOffice

•kicking off an aggress.iveintel!igenceanalyst hj'_ngCampaign,.And,OnFebruary

17, 2004,the Secondpresrelease Wasreleased featuringaninterviewWithEAD

for Intelligence MaureenA.Baginski andtwo FBIIntelligenceAnalysts.CrY)

-

, •In2004,the FBIreused itshiringproceduresforIntelligencetmalyststOmore

effectivelyrecruitandhirecandidateswithnecessarycriticalst_lls. Thenew

systemis a resumeandweightedqUestion-basedsystem.Theweightedquestions

were developedbya groupofseniorintelligenceanalystsandintelligenceanalyst

•" managersun, derthedirection.oftheEADforIntd!i'genceand , weredesignedto. • .r

identify themost highly:qualifiedcandidatesat all on'trygradelevels. Aside from

, directrecruitmentintothe intelligence analystposition, the oI i[sestabh".'shing

• ":. • . . • -. . . . , ' . . .

..

q_' 18
/ n

educationcooperative programswherein college studontswc,uldhave an

• arrangcunentto workat the FBI and earn a four-yeardegree.'Students may

alternatesemestersof Workwith full-lime studyor maywork:in the summersin.

•i exchange for tuition assistance. Theprogram targets_tud_l_ who intendto

complete a four-year degree in disciplines needed forFBIIntelligenceAnalyst

Workto include: InternationalStudies;ForeignLanguages;S._es pertinentto

• specific geographic areas andc_tures; History;Economics;Business;Political

Science;Public Adminis_.ation;PhysicalSciences; andJournalism.In additionto

financialt.assistance,studentswould bvnefitby obtainingsig_.'ificantwork

experience, and the FB1W0uldbenefitthrough an agreement the studentto

- continueworking forthe FBIfor a periodof timeuponcompletionofthe_

educatioCO)n: " .

• College of Analytic Studies: Since Fiscal-Year2002, the ColI.egeofAn_ytic

.Studie(CAS) s has-deliv_13iterations oftheBasic Intellig,Ana _ncelysis

Course fi)rnewly hLredanalysts. Inaddition,tl_-oughintelIig_ce community

partners_ipsandprivatevendors,the CAS has coordinatedspcx:ializedtrainingfor

.novice. andexperienced FBIInteRigenceAnalysts(U). _

/-

•' 264 FBIAnalysts have graduatedfromthe College'ssix=weekBaSicIntelligence

,..:..::.." AnalystCoursesincits e establishmen(U)t, " . ? . i .: " " " . . . . •

-,,:.-_- :0 655I_Ifield andheadquartAn-al ers ys_haveiattond_¢_(xlial_co_tyse_ona

.. variety of topicssuchas,analytimecalthods,tools, anddat_ases. (U)

":- • ":_: 1,389 FBI field andheadquarterspersOnnel(Analystaand A. g_at.s) have at..tended

• specialicoun zed terterrocrimn ourseoffered s inconjunctiwoin(_CIAUniversity. .,....: . --._: •

' _ "

• "ACES I:'TheBasicIntelh"gence AnalystCoursecurc_tlyoffc1._d by._eCASis

beingrevised/updated Upon.completioofnthiseffothrtecoursweillbere-tiUed:

Analytic_CaldreFAucationStrategy.I (AC_qI).aou_J s Jnedin_theHuman Talent

.ConopThs.eACES Icoursewillincorporaseven te cox,elemenfotsrinte.IHgence

trainifongrnew agentsandnewanalystAsdc..fitionally .thenewcourse

curriculumteaches.advanced.analytictrade craftand practice, fl_inkingand

writing skills, resources,and fiel[dskills;.Anint_ediate courseentitledACT_ If

is anticipatedin the futurethatwouldtargetmore exper/encedr_mlysts.CO)

Mentoring Program.:The OI is creatinga career mentoringpro1_unto.provide

guidance_d advice to IntelligenceAnalystson the analyticalcareerin the FBI.

Once implemented,all new IntelligenceAnalysts(new to _heposition or nowto

theFBI)w_llhave a mentorto assistthem. Thisprogramwill be implementedin

•calendaryear2004. (U)

..

,Recommendation No. 2: Ensure effectimveanagement of analysts. (U)

/' 19
.'.. :,_.

:, ,',_. •:_.... .: . ' .,

• . . • , . .. - .. . • . .' ; . .._ .. ' .. .

Response: Tlie FBI agreesthatit mustdo allthatit cantoensure thatitsde_oated

intelligence Analystsreceive effective managementsupportanddirection. Sino©

september 11,2001, a numberofchanges have takenplaceto improvethemamgement

. of Intelligence:kctalySts.TheEAD-I and the OIhave i_nmediateprogrammanagement

responsibilityfor theFBI's analyticalfunctionsandproduced,forthe firsttime,a

comprehensivem_ategyfor_e entireamdyficalarena. The Intellige11_cAna e lystsatthe

FBi arekey playersin achievingthe FBI's comprehermiveintelligence strategy.(U)

•

• The Ofis_m_ supplemen_pefformance expectationguidaneoforall |nteUigence

AnaIysts,speeif3_g _ectafi0ns for the reportsofficer, operationsspecialist,and

all-sourceanalystworkroles:' Thiscommunicationwas intendednotonly to

informanalystsas to the expectafi'ons,butalso to keepsupervisorsinformedasto

_ • thePr0p_:u"til_ti0nof_e Inte!!i'gen_Anal_.t position. :TheOIhasinstructed

aUFBIfield offices that-/nte_gence _malysts must reportthroughthe Field

InteIiigen(_eGroupchain=of=command.,(U)

..... . - .. ._

:. .. , .. .

• The O! assumed_ve controlforall IntelligenceAmdysts onFebruary1,

2004. TheOI is responsiblefor establishingand executingstandardsfor

_ting, _g, 'Oaining, anddevelopingthe ]_Fs intelligenceanalytic

workforce,as Wellasfor _ tl_ ey,_,_j"smg"n ed:to,ope,ration_-aadfield

divisionsbasedon intelligencepriorities.Operationalandfield divisionsare

' -,..responsib!tefor day-toMay.sup_on:_, telli[gence_ys_and_foradhering

'0 sCand_dsfor .analystdevelopmentestablishedby.theOLCt_)

• .This new:managementroodel was implementedby placing the section chiefsat

Headquarters curr_fly perfo_,'mte_gence, functionsund_,,theoperational

controlofthe OL Those Sectionchiefs arented by the approF_iatoffi e cial in OI

andreviewed by the Headquartersinvestigative division intowhich they are

integrated. CO) ..

J -Re_,,.mmendationNo. 3: Require grea_ercoordination and consultation between the

operational and analytical Units. (U) . '

.,

Response: TherBIagreetSh,atanexaminationof the events.surrmmdingthe

., Septemberl 1 a_tcks showed a need for imp_vementin .thecoordinationbetween

operationsandanalytic Units.We believe coordinationmd consultationhasdramatically

improved. Consistentwith theDirector'sMay 2002 a_nouncementof theFBI Strategic

Focus, the CounterterrorismDivision was r_rganizedto implementa threat-team

approachtObetter alignthe FBI's effortsto preventterrorism.Therevised approach

moves awayfrotha traditionalhierarchicalstructuretrodseparationbetween analyticand

operationalfunctions and employs matrix-managementconcepts used iinsuccessful

businesses andprivate organizations and in government agencies. (U)

The goal of the reorganizationwas the implementationof an organizational

s.tructureandconceptof operationsthatempowersand enablesthe FBIto achieve the

priorityof protectingthe United Statesfi'omterroristattackby facilitatingthe flow of

" 20
ma

iz_t'ormatbetween ion opera_onalunitsand_eiran_]_ocolmte_1_sT_h1e_). FBI

categorizesthe currentthreatas follows: Radica_Fuadamentalists,GlobalExists,

andDomestic Terrorists.Additionally,a cross-cuttirgthreatin e_h of those areasis the

terroristacquisition ofweap0ns of mass des_ction (WMD) and the misuse of U.S. sad

internationalmonetary rules andprocedures.03)

Using this threat-basedframework,the FBIstructuredthe op(_ationsof the CTD

along a threat-teamconceptthat organizedthe bulk oi'its investigative, financing,,reports

andrequirements.andauaIyticalresourcesinto threel_reattean_. "E_ecomponentsof

eachthreatteam areco-located to facilitateday-to-dayinteractionsaxtdcreatesynergy

•betweenthe investigative and intelligence disciplines. The CTDAssiis.tantDirectorand

DeputyAssistantDirectors(DADs)jointly identify the investigative_mdanalytic

priorities,establishintegratedOperationaland analytical objectives,md allocateCTD

resourcesfor each teambased on those prioritiesandobjectives. The operati6nal

Strategiesagreedupon foreach threatteam have been disseminatedto allFBIfield•

offices whereth(_ will guide field operationalactivities. The componentsof eachthreat

team.areoo-lo0atedto facilitate day,to-dayinteractionsandcreatesy_iergybetweenthe.

investigative and intelligencedisciplines.(U) •. . .

: Tae Office of Intelligence,meanwhile,has establishedprinoipi[ewi s thinthe -

-'_-=._,Bureau :, that information belongs to the Bureau rather tl_ml a single field office or

headquartercomponent_d will be sharedwith al_thOSewith a legitimateneed-to-know.

:<::"._'.O,_.fflce of Intelligence is also workingwith the I_ifOrmatioRnesoeroes Division to

developthe systems thatwill fazili_e informationsharing,02)

:

- Since the September11attac_,the FBI's Office of Intelligencehaspublisheda

.::_.._t,,,... of Openttionsfor htelligence Production_radUse. This publiicationguidesthe

FBIin the coordination0f.intelligenceproduction. In general,the role of the operations

componentscent_ on Commentingonthe accuracyof thcts andthe p_)tecti0nto be

afforded for sources and methods. The Executive Assi,,,qantDirector for Intelligence is

the fiual arbiterin disagreements between operations aztdintelligence componentsin the

productionanddissemination of intelligenceproducts. (_J)

The FBI has putinto place a number of other m_hanisms that have vastly

improvedcoordinationbetween operations and analyticcomponents. These include:(U)

• Twice daffy inte_gence and operations briefiugs chaired by the Director and

attendedby executives, lower-levelmanagers, sad line analystsfrom both the

' operationsand intelligence componentsoftheinvostigative divisions, as well as

theExecutive AssistantDirector for Intelligence (EAD-I)and other OI managers.

Coordinationissues are discussed and directions are given for both operations and

intelligenceissues in connectionwith theprioritythreatsandimportant

investigations."CO)

. .

• A daily IntelligenceProductionBoard (IPB)was establ/shed inAugust 2003. The

IPBmeets d_ly andis chaired by the EAD-I. Representatives_olude senior

/

.... _._

i. 21
'! ..

managers,uuit'levelmanagers, andline analy_sfromthe inte3_gence•

componcatsof allinvestigative divisions. Coordinationtssu_ _d _ocessos:are

; discussed andresolvedin these meetingsin accordancewith directionprovided

• by.theE/_-L _ .. ,-

..

• The Directorhasdesignatedthe EAD-I asthe FBI's chiefpoli,_yofficialfor

IntelligenceandInformationSharing.Inthis capacity,the EAD,I haspolicy"

.authorityt.o ensurethe coordinationrecommendeddoesindeed take'place,andshe

has<"institut • eda numb_ of processesthathavelsignificantlyimprovedCoordinatiOn

. andconsultationbetween operationsandanalyiic units_(U) ' '

. ..

.' .

B..Recommendati0ns related ¢othe FISAprocess: 0U) " ..

..

" . .. . ... . , -

Reconnnendatien No.4: Ensure adequatetrainingef FBI employees involvedin _e

FISAprocess aud ¢ounterterrortsm nuttters. Off) ..

• Resvonse: The FBIis m agreementwiththeOIG's.recommendationto _

adequatetrain/ngto employees involvedin theFISA prooess andcomtterterro_

mattersandhas developed aprogram.toaddressthese issues. The Co_mterterrorism

Division (CTD)hasmade:tremendousprogressin.developinga trainingprogramthat

enhances the FB]?s abili'ty to .oonduct o0unterterrorism investigations_ ehat _in the

' prosecution of ten'Orists, ..disruption of terrorist organi_'ations and Sitpport nefworks," and

has led to anincreasein the Overal!.contn'bution0fin_lligence:t0:'th6U,S. Intelligence

Communityand(tO'Seniorpolicy _ers in govemmenlI,Tr _ aining focuses Onall aspeC_

of the FBPs response to the threatof terrorism, both domestic_y and abroad,which

includesintem_."onslterro"nstgroupsand/orcountries ofin_ do=!6sti0terrorism,

.. weapons 0fmass destruction,tetcorist:finanoi_.operations)Foreignzhttelligence

s m'ceillanceAct,.NationalSecuritTGuidelines,PatriotAct,source d_elopment,

interview,andinterrogationtechniques,rapiddeployment,,anddigital _mdeleotronic

_ exploitati0_ The CTDhas.deve!opedthistrsining thr0ugh.theidentifi.mfi0nofsubject

matter.expertsfromwithin .theFBI,.otherGovernmentAgencies and privateo0ntraot0rs;

CTD has offeredthis tnin.---_tog FBI SpecialAgems and Analystsfrom both the field and

headquartersas well as to law enforoementpersonnelassigned to the JointTerrorism

Task Forces,(_YI.T)throughoutthe country. CID has contributedsignificantly to the

courses•developedby the College of AnalytioalStudio:and theCentral Intelligence

Agency UniversityforFBIAnalysts. These coursesa_mtoimproveand enhance

analyticalcapabiJLityto quickly ascertainthe reliability,implications,and:detailsof

ten-oristthrea_, _mdhow threat-relatedinformationis disseminatedto local, state,and

federalagencies. (U) ._

CTD'sprimaryfocusis to addressthe most immediatetrainingneeds of theFBI's

workforce. CTDhas beenWorkingwiththe TrainingDivision, Office of Training

Development,to Createcurriculawhich addressesthe needs of Agents..AnalystsandTask

Force Officersassignedto counterterrorismrelatedmal_ters.This curri!culumbased

approachbegins'witha basic understandingof the foundationof both domestic and

internationaltem>rismand ¢xpan& to a speoific appr0aohto oounterterr0rism " ,

investigations.andimplementationof the CTinvestigative strategy. In,serviceUvining

I 22
being conductedon arvgularbasis include:InternationalTon'ofism.Ba_icOperations, •

InternationalTerrorismSourceDevelopment,andInterviewandInterrogationofIslamic

ExRemiSts.Thesetrainingcurriculaarebeing developedtomeet the,needsof theFBI's

everChangingcounterterrorism ission. _ ..

i CTD h_sdevelopedthe course, "Coanterterrc)rism:A StrategicandTactical

Approach",to addressthe overwhelmingdemandfortrainingof stateandlocal law

enforcementofficers engaged in counterterrodsmrelatedinVestigationsthroughtheH'TF.

The corecont_Lt.0fthis_g emphasizesanunderstandinguf adn"uni'strativeand.

Operationa! requirementsin conductingterrorisminvestigationsan_ operati0ns. CoUrse

participants_ebriefed ona varietyof internationalterroristorganizations;MiddleEast

culture_d mindset;.andareexposedto concep_ involving ass_smc_t;recrui'tmentand,

handlingof sources;surveillancemethodologY,mteryiew/interrogationproblems;

techniquesinherentin internationalmrorismmatters;andcase man_;ement. Thi'scourse

is presentedregionallyandprovides-thelaw .¢aforoementoffioe_, assignedtow0rk on

theYiTF, a bett(_unde/standingof theirvitalrole in the FBI'scounterterrorismmission.

Twenty five iter,ations ofthis courseare plannedfor this year. (U)

ThroughoutFY03, CTDparticipatedin designing anew apprc)achto teaching '

N_ Ag_mtsduringtheir fourmonths of New Agent'!_ (NAT) at the FBIAcademy.

_ __ December2002, a p!anwas designed to incorl_)ratea countertcrrorlsm(CT)and

_terintellig_ce (CI)instructionalblock.intotheNAT to include 110 hoursof CTand

.... CIinvestigative _6urdculut_.Thenew instructionalbk)ckis anappmacht0 investigative

tminingwhicht_es aMiddle F_stem _al Enterprise(I_ECE)as a -thread.through_

" th_'_vntiresessionof New AgentTraining. Thenew CF and CIinstructionalblock begins

with "basic investigative techniques"_ad culminatesin "advance investigative

:_.... _ques." Eachbasic andadvanced instructionalblock incorporates

informanqcoop_rativewitness/assetdevelopmentaswell as.financial iinves_. "gative

techniques. (U)

Conferences_at have been coordinatedby CH) havetargetedSACs, ASACs,

.ssAs, SAs, Analysts and_ Officersand have incktdedSuicideBomber Awareness,

WorkingTogeth_ inCounterterrorism(FBI/CL_coonlination),TerroristFinancing,

DomesticTerrorism,WeaponsofMassDestmction, YI_ AnnualConference,and

SpecialEventM_magement.Individualcoursecontentisspecifically d._igned to address

andmeetthe neo_ ofa'group's activities. Additionalconferences arebeing scheduledto

addressrecurring:issues on anim'alrights,eco-terrorism,black separatists,domestic

terroxismfugitives andinternationalterroristgroupsof interestsuchas Hamasand A1

, Qa,ida. CTDcontinuesto supportcounterterrorisminternational:trainingtl_ugh the

InternationalLawEnforcementAcademies(_LEA)and.providesinstru:ctionbythe

TerroristFinancingOperationsSectionto theFBI's law enforcementpartnersworldwide.

(U) ""

The FBi's Office of TrainingandDevelopment,.in coordinationwiththe

CounterintelligenceDivision, CounterterrorismDivision, andtheNational SecurityLaw

Brsuch(NSLB), Office of the GeneralCounsel(OCt), has prepared_ulddisseminated

_.: 2.3
.. _'i..D '

Bureau,widea F!SA/FordgnIntdHgenee/counterintelligenoe/Countc_rmri_: "

interactive.,Dbtmce LearningProgram"forNew Agents and all oth_ FBI personnel,

resignedFCI/IT.re_onsibilities.,.The_urseis entitled:"FISAandinformationSharing:

Thdr Impacton Investigations"andcoversthef011o_ingtopics: HandlingClassified

Information;SharingInvestigativeInformationwith fileIntelligence Community;FISA

RequirementsandProcess;andSharing' Intelligence.withProsecutorsasperleMarch6,

2002 Procedures. The course providesthe userwith a.foundationoninformation sharing

anditsimpact on investigations,the handlingandsafeguardingof cl_._Sifi.emat d erial,and

.. the FISA _strative proc..ess.,All agentsand analysts,wor_ on coenterter_fism Or.

-count_te_genceinveatigatio_..aet.xequired.totake_s distanoele,_g cOurseIt, is.

acCeSsible.t0.allimiployeesthrough...thVe_ Acadetny,the.FB_sL_aming

.Manag_en.t Sy_,'tem,The C.TD.andtheOffice of TrainingandDevelOpmenthave also

workedWiththeFBIS'.Yh'tua!Academyprogramto.developaonnline'content :

address :, . • _the ,. . •..... Patdo..t.Act. . -. (U) : _ ..... .

.....

..

• -: " .. • . .

. _; o " . • • . • .

• In additionto the.cHstanoleearnmgcourse, eactrofthe 56 fieldd!visions _mVe

condticted2-day,aof"han,ds-on"FISA_...Inscuctional teams aze appointedby the

.cognizant AssislantSpecial.Agentin Charge(ASAC) andconsist of an Assistan.tUnited.

States.Attorney(AUSA), the.ChiefDivision Co_msel(CDC),a squad.,s'up_.or, anda

CentralIiRelligenCeAgency (CIA) representative.:..:Wh.ere.pomible.C.)ffiee0f intelligence

Po!icYandReVi'ew(.OIPR),.Department:ofSustice(DOJ).andFBI Headquartersporsonnel

. stq_lement_the "mstruotionalteams.Thetwo-c_.y e_rdculumcOVeredthe:entireF.I,.qA

.process, includm,g_e "initiaoftioFInSArequests, _mizationproc_iutes , andthe

renewalprocess, These_g. sessionsbegan in_uly, 2003, andcontinuedthrough

November2003..(_U). . "

• .

AdditiomdlNy,SLB assignetwd9lawyerstosupporttheCo.unterterrorism

Division's NationalS...uecriPro C. gramOsperational TraininUgnit(OTU)attheFBI

Academy.OTU ihaesxpandeall d New Agent_ toincludeForeiL_.gn

CounterintelliangendCceounterterroirismtmcti _m on_'ThaWtainmgisprovidebdyOTU

andNSLB personnd. 03) " . -- ..

,:.

NSLB also.conductsjoint-wainingwith OIPR,DOi, in seleckx! field divisionsat •

leastonceamonth.Inaddition to six,houofrsclassroominstructlon,.t_esavcral re .day

.sPent_viewing currentand..closedF:!S.Aoases withtheass; igned case agonts andtheft

supernsor(s.U).

, ..

NSLB furtherprovides FISA instructionforall ForeignC0uaterin_iligence(_I)/

Counterintelligenc.e (CD/IntemationalTerrorism(133In-Servioe classes conductedatthe

FBIAcademy. Thistrainingis conduotedformore experiencedFBI p,_onnet(inoluding

ASACs,Chief DivisioCoun n sel,SpecialAgentsInt , eIligenceOperations Specialists,

IntelligeRnesceearchSpecialiand stsothesr,upportpersonnel)whoarenow assigned

FCI/CIffmatte F rasnd, forpersonnwh0_ el e _ransitioning tothose .. assignmonts(U.)

} . ..

NSLB alsopmvido:sFLSAinstruottion oallFBIHQ operatiouni naltsasadditional

FCI/C_ resourcaercsassigneNdSLB . hasa newly-croaNati ted onaSol.our . iPolicy ty

(
• . ._. .,

andTraining Unitwhich,whent iy-staffed,willassumbe adtra , ining . .

responsibilitiesforbothFBIHQandfielddivisiontrainingmFISA andrelatedmatters."

J

/

: The CTD andtheFBFSOffice of GeneralColmsel,National,SecurityLaw

Broth, have workedto pi:ovidenafi0n_ securitytra_fingto fie!d SuipervisorsandASAC

s atDepartmentof JusticeNationalSecuri_ TrainingConferencesholdatthe Department

of Yustice'sNationalAdvocacy Center. The NSLBassignedseveral attorneys,as

instructorsto supportthe conferenceswhichwere conductedat the NationalAdvocacy

Center(NAC))DOL in Columbia,SC. The conferenceswere four days _ length,:This

conferencewas developed to addressthe overwhelmhlgconcemregardingrevisionsto

•the NationalSecurityInvestigativeGuidelinesandimplementationof the Foreign

Intelligence SurvdHanceAct (FISA). The firstconference was heldbeginning on May6,

2003.A totalofsixsuchconferences wereconducted! attheNAC durinthe g summer

• monthsa,ndt.wocon£erencew sreheladtFortBelv0ir,VirgininiSepa tember2003The,

•attendeewere s SACa,ChiefDivisionCounselS,pecialAgents,AS_i_._,n Unitt ed-States..

Attorneysand,theattom.eaysssigne_odtheOfficeofIntelligePonce]_i.cydR_.evain.ew,

•DOJ,who-.wearlse oprovidi_mngtction.T.hecurri'culuminci_3 ludestru d cotinthone.

missioann d.org._izationof the IntelligenceCommunitya,noverview of the Foreign

IntelligenceSurveillanceAct, informationsharing,coordinationbetweeninteliigence and

-"':_.....lawl-enforcem_t components, foreign..inteiHgen and'.coucneterintellicgoil_ encetion

' t_.ls, the _e of FISAinformationin supportof crimhmllitigation, andpracticaland

•>_::"_cal decisiommaking..The conferencesa_soincluded a day-long,l,roblem-s0iving

exercise,conductedin individual"breakout"sections, to reinforcethe teachingobjectives

of the conference..(U) . "

b

TheCWDalso held anationalsecurityconferencewith theDOJ to trainboth

• " " AgentsandAna]_ts on informationsharingandcoovd_.'on between theIntelligence

.. • . Communityandlaw enforcement;FISA;foreignintelligence and foreign

counterintelligenceinvestigationsandcollectiontools; andthe PatriotAct. Based on the

.Successof both conferences,CTDimplementedand developed a regic)naltraining course

to guide all 56 FieldDivisions on the Attorney GeneralGuideLinesforNational Security

Inw,stigatiaonndstheFISAproces(U): s.

TheComlterintelliLgaewncUnie tinNSLB routinelyparticipacotUntry es.inspecificonc ferencteshaCtounterintelliDgence ivisionunitsSponso(us r uallonyayearly

., basis).The topics taught.. by NSLB includethe National SecurityGuidelinesandthe FiSA

" processCO.) -

" Before09/11;NSLBo(thethn eNationalSecuriLtayw Unitp)rc)videexdtensive

trainiantgFBIconferences heldannuaUyforChiefDivisioCnounse([I_BIAgent

attorneinysthefielddivisioninc s),ludione ng suchsessiownhichwasfundedbythe

CounterterrorSecistmionanddevotedentirely tointelHgence lawissues,Additionally;

NSLU provided:intelligence lawtraininforgChiefDivisioCoun nsdatthreeregional

trainiconferen ng cines1996and1997whichfocusede,_tirely onintelligelancwise sues.

..

..

.... D '" 25
'-:R

NSLU also routinelyprovid_i inteliig(mcelawtrainingatconferences sponsoredby the

• Count_orroriSm Seotion. (U) : . ,

¢

NSLB also provides FISA trig andguidance viaperiod/c communications

disseminatedto (dldivisions: e.g., NSLB guidanceentitled "intellige_ce Sharing •

ProceduresforForeignIntdligence and-ForeignCounterintelligenoeInvestigations.

Conductedby the FBI" whichwas disseminated,Coallfield divisions in November 2002.

NSLB ah)omaintainsthe 0CK: Intranet(avail"ableto HQ andell field divisions),

Recent instructionincluded sp_ific guidance on informationsharing. The NSLB.

•website alSOfea(_res an on-line, downioadable',broohure"entitled "How Do IC_ a

FISA?" CU). .

•. ,

....

• ... -: . -. .

-Withre_d to FY04 u'ainin,g, CTDwill continueto developmid "nnplement

"_"and c0_.'erencesforAgents, Analysts,.JT!_members,and st_eand, local law

enforoement.:Furth_ore, we are inthe,developm_t_dstages of intmduo'mg,with the

office of Intelligence, anAnalystHandbook-to_er the mission.of, (_ID and

introduo_.new,b'Urd'cu_! to _.ReportsOmoers(RO). TheReports Tradecmfl

.coursep_des the foundation for new.KOsassigned.t_counterterr0rismmatter_in. :

whi'ohthey will be train"ed on.variousintelligenoe eo.l!e0tionmanagoment(opi_ fo "

• Inolude.theFBI'l_atelligen_:ColleotionCycle;iden_ng intel!i'gence;;disseminationof

intelligencewhile pr0teotingso_,methods andinv(_tigati0ns, andwriting

inteUig_ce "mformatiOn reports.CU) . ,:.

• .. . . . ., . . -. •

C1_ has(developedaCounterterrorismTrainingTracl_to addressthe most

immediate educationalneeds of Agents,Analysts,andYFFFOfficers_signed to

counterterr0rismreiatedma_ters,,startingwi_ abasic understandingof.terrorist

.. operations andmoving onto intermediateandmote advancedlevels, (_U)

. . . - . .

Specific courses designed for theBasic level oftrainin"g forAgents, Aaalysts,-andJTTF

offioe_ include: (U) .. .-

• InternationalTerrorismBasic Operations- approximately850 trained.CO)

• InternationalTerrorismSourceDevelopment-approximately 300 trained.(U)

• CountertetrorismA: Strategicand.TaofioalApFroach- approxkaately 210 plus.50

• ins_oton_ trained. (U)

•, Domestio..Terrorism-approximately39 trah_ed0.1) .

• MiddleEasternCulture/ISLAM101- onlinecourse(U)

, CTTrainingfor Stateend LooalLawEnforoement- 130 Agenl_strainedas

"mstructonfor ; 26,880 law enforcementoffioers.(U)

• TheCollege of Analytical Studiesoffersa sefie,.;ofc0urses for analysts that

•supportthe CT mission - approximately250trained,CO) ' _

,. ,

Coursesdesigned for the intermediatelevel inolude:(U)

• IT Interviewand Interrogation- new intermediatecoursefor s_tnor 2004 for40

agents.(L_)
• Special_,.topicsincludingcourseson theArabianPeninsula.andHamas-

, appro.XitaatolyI00trained. (Lr_

._ • CTDworksin collaborationwith theCiA University offering specialtycourses

mainlyIbcuseond WMD issue-sapproximat22eltyraine(U) d.

• DigitaalndElectronic EvidenceExploitat-iaonpproximate8ly0trained. (U)

• Intera_ctmdEmailCommunicationInvs estigation- approximatel40ytrained. (U)

• SUicidBomb e erAwarenessTraining-approxJanatel 320tyraine(U) d.

Coursedsesignefod rtheadvancedleveinl clud(Ler:)

•, InterviowandInterrogationTeelmiques-.19ag(mtstrained ati_headvanced level in

•. IsraeL.(t0 .

.o Developmentand HandlingofIslamic ExtremistSources, 39 agentstrainedat

the advancedlevel. (U)

TheFBI's SeniorExecutiveService personnelaregoing throughanexecutive

developmentprogramthat was createdin par_ershipwith the Kellogg School of

Management_one of the country'sleadingbusinessschools. In an int_,_miveone-week

course,FBI executives receivegui'danceonmanaging .change,with a particularfocus on

the FBI'stransitionto new intelligence,investigative,and case manag;ementprocesses.

As of February 13, 2004, 260 FBI executivemanagers have completed the training,

_' ___including 12 As._:istanDir t ectors and54 SACg.(U)

...

. _ • . .

Thefollowing chart depicts the CotmterterrofismDivision projected laaining for FY2005:

•? !-... .....

/
"R!' .

• . -. _.. . .

COUNTERTERRORISM TRAINING STATUS FORFY200_

' coRE _ TARGET . -..... LEVEL DURAtiON PRO_,CTEDi_EEDS '

COURSES At_mN¢l_ • .

, . ,, . , " ! , . i . , , , , j., , .,

_ Culture All Agents, BASIC 3-4 Hours , ImminentLaunch

Online ._malysts,YITF Eventu,aliyaddIntermediate

Members , level

. , . I, , , ,.Ues,_mo.dfoelr

IT Basic 50 BASIC ' Every other : Revise

Operations Agents Monl_ Goals/0bjvctives/Curdc_la

A_ysts • for AlibiwithCompetencies

_n_Me_b_ : 5da_ _ r , _ .....

Regional 35 B/_SIC .Onc,e_onth for - C_dculum.Ulxlate

CT: A S/r_gio Agents 5days Rampup;.to_teLev¢l

& Tactical Amlysts Imtv_¢torDevelopment

Approach :YlTFMembers Ongoing.

• • Evalmtion/Align with

. ,., ,. , : . , ,.. , T . " ",J , , _". • ,' '---- . " , . ,

-.

"" 1T Source- 35 : BASIC/ OnceJrnonth - Modify onc_

Developn_nt " Agents Intermediate for " In_ew/Inten'ogation_bcg/ns.

..... rrrFMinim, ...... • . . ,. .. '

_ew & 20 :Interme_liate Once/quarter TwoPilotsoffered in July and

Interrogation Agents For ' August2004.

.Sdays :Evaluation/Modify

., . .... • _ , Align w/th Competencies

Interview& ' 10 .Advanced Twiceper Year FirstPilotofferedFY 2005

Interrogation Agents For Align.withCompetencies

(highly (including 10days Status ofIsraelitraining

selective) Israel[i) Ongoing CourseDevelop. .

Specialty 35 Intcrmedm_ AsNeeded 'Alignwith Con_ncics .-

Cn'oups Agems ToAdvanced Basi.,_

S_ainars: Analysts . for

__ HTF Members 2.5 days

AIQaeda

i Hizballak l ....

Future Coursesin Development:

. OverseasDeployment- SurviwdTrainingfor OverseasDeplo3maentsin hostile

environm_mts(U)

• AnalystsTrainingS-upportReports OfficerTraining atleast once per quaxter/2.5

daysCO)

• ASAC/SSA Training- FBFCIAPartnership,SpecificTopics, Operationsand

Management,Guest SpeakersforHQs once/month.(U)
. . .:- ...

• • .Online CourSes Ident/fywh/oh courseinformationad_ts easilyto online

VirtualAcademy sponsoredby _heTrainingDivision.(U)

• WMDand other specificInteraati0nalTerroristGroupCountmerrorismTraining

• " _ '

..

, .

• .

Reeo.mmendaflon,No.S: FBI Attorneys ,hould be better integrated into

eounterterrorism investigations, (U)

..

..._

FBI Resvonse; After9/ll, the NationalSecurity_w Branch(NSLB) was restmc.tured

so asto mirrorthe operationalstmctm'eof FBIHeadquarters.Refloc0ng the operati'onal

divisionbetw_n the Counterterrofis.mDivision (CTD)),theCountorintell/genceDivision..

(CD), andtheCyberDivision,threemlitswere _lished withinNSLB -two to hahdle

counterterrorimmatters l (CounterterrofismLawUnits(CTLU)I andII),and.one unitto

handle0ount_"ltelligence ando_er matters(C,ountel_telligence L_7_Unit (CILU)):(A

fourthunithas recentlybeen establishedto focusuponpolicy andtrainingissues.,).

Withineach •of•thethree,operafionally-.foouseNSLB d units,the _tomeys are assignedto

- particulartraitsor Sectionswithin CTD,CDorC_er. :Further,with regardto

• InternationalT_rrorismSectionsi andiI of C1_, NSLBhas assigned.twoattorneysto be

• co-looatedin orientSpaee.(U) '

-_. ..

. . . _/: •

Thus, w_ththe"assignment0f anattorneyto each of theoperationalunits or

" :,: secfi'ons,thereis,routinecontactbetweenagent,anal_,_andattorneyc)n!egalisauesthat

arise, With'reg_mito review,ofFISA_,.NSLB attorneyshave speci_c,and focused

knowledgeof the targetsforwhich theirunit.orsection is seekingto initiate orrenew

"-_:: coverage. Atthe point of initiation,the attorneyis responsibleforreviewing and

.,. al_roving the initiationsubmittedto I_ byhis cfient,the operationaltrait. Any

subsequentissues concem_ tha¢FISAwhich come to the attentionof the operational

unitWithrespon.._ifity forthe.paokag . b,is thenreinedto the attorneyassignedthat unit.

The long-termre,ult ofthis arrangemenist an increa,edfamiliaritybetweenclient and

counsel, and im improvedworkingrelationship.A sense of trustandpurposedevelops

betweenthe partieswhichgreatlyincreasesthelikelihoodthatlegal assistanceWillin fact

be soughtwhen itis necessary,and it increasesthe effectiveness of thoattorneyin

respondingto.requestsforlegal assistance.Furthermore,the historictmowledge thatthe

attorneygainsby being assigned to a parficul_,unit also increaseshis,effectiveness,

inasmuchas he hasboth presentandpsst familiaritync)tonly with the particular

investigationthatlis the subjectof the legal request,butwith related investigationsand

thesubjeCtmatterin general.(U)

..

The creationof new unitswithinNSLBwhichhave specific r_)ponsibilitiesfor

CTD, CD and Cyberunits andsectionshasa!soincreasedcontactwith the field, NSLB

attorneyshavethe opportunityfor increasedinteractionwiththe field agentswho are

handling the investigationsthat are berg supervisedbythe substantivounitsto which the

attorneysare assigned. Recognizingthatitis oftenthe field office thatwill have

questions requir_agan immediateresponse,orinformationneededby riteNSLB attorney,

particularlyif the issue isthe sufficiencyor completenessof a requestforFISA initiation,

the NSLB attorneyand the field agents_haverefinedtheirworkingrelationship,whereby
immmm

=

' the NSLB attorney knowswhom to turn to.get answersto his questiot_, andthe.field

agenlsknowwhom toseekout.inordertoresolvlegalissues(U),."

Additiomdly, in the near future,NSLBwm be furtherintegrat(_with the

Countert_rism Division operational units due to the plannedmove 1_now offioe space

in Tysons com_', Virginia The FBI,CIA,DOJ, andotheragencies'of theU.S.

IntelligenceCommunitywill be co-locatex!for the firsttime in !m'ge numbe_ in asingle

faoility. At prese_at,a total of 20 NSLB att0meys _e expect_ to moveto the new

' fazility in Virgitfia. We expect thatthis movewill restdt-inthe totalk_tegrationof NSLB

attorneysinto oolmterterrorism.'investigationsO,J): ' .: .

# . .. _. • . ,

• _ .... .. . . ,.

Re¢o.mmendatlo,n.N0,6.: EnSurecloser consuI_tiobn,etweenthe]_I.and.OIPl_

particularly onl_np0rtan(_or unusual eases., (U) . • ,

_. • • . . • . .. .. ,,- .- . . .. • .

_: W TheFBI is inagroom_tWi_h.OIGislr.eoommondationto _,ordinate c_os_. •

i_ O_,R,:and b_ .takensteps to._ tlmtthisisa_oomplisheck. l'nmid.2003,the:

CTD's!ntomatio:naITorrOpofism erationss_tionI_['osI)initiabteiweek d ly.-• "

operatiomneealtings.wrepres ith entatfirves om.DOffOIPR.andD.Ol-C1"St ensuo rethat

all oporati0n_land _tive facets of (1)ongoing. _' prosecUtionsin the.fidd

and(2)0ngomg ifitelligenoeoperations,coordinat 'ouedgh0IPRw, ere in syno...

Attendeesatthe weeHy meeting include the ITOS,I SectionChiefor AssistanSeotion t

Chief, eachof the four ITOSI Unit.Chiefs orme_rrep esen_ es,auo.representauves

fromcrs andOIP1LDUtY-themeetingalenfi l ti.es.fieldand askqu_tions,resolvlng. '-. '

most".msuesin the,r00n_Typica£lssuesinclude thes_._ ofhigh-visibmty investigations.

in the.tie!d,the Statusof pending reque_'wifii OIPR,..._dthe statusof'DOJ requeatsof.

'FBIFieidDivisi0ns on'those issues underthe.pmgram.managomentof!TOS L(U) _-

-rrosIrel,resentatives werealsoheavilyinvoiv inthe:g oftheFISA

Ti_systom which.provides a v.ehi'0for:1e_FBI/OIPRprioritizationofFISA.>

applicatiaons wai_tipngresentattiotnheFISC.InlightofITOSI'slargepercentage.of

:" owmll USIC F!SA appficatio_,, Secfionmembers.hold a wealth:ofexl)oriencein HSA

mattersandwercableto contributeslgnificamly. (U) ' , "

-,

In May, 2004-_ ITOS I r:eoommendedanditdtiatodhosting of a weekly

m_ with OIPR strictlyfor disoussion onthe status of pendingmd active.HSA

applications. This meeting does not discuss operation_lissuosaud is held separate.and

distinctfromthe weekly operationalmeeting. As of Jtme2004, allFBlientities , involved

with presentingFISA applications.tothe FISC were in routineattendance and the ITOSI

' tmokingsystemttsedinternallyforthe seotionwasmodifiedandadopt(_foroverallFBI

use.. At thismeeting OIPR and theFBI balancethe li_ of pendingFLS(2applications

throughdiscussion of the last week's docket, _myemergencyFISAstakcn to Courtbutnot

yet included in any dat_ibase,and FISAwithdrawals. This combinationof weekly "

meetings, the FISA Tier System, and the FISA.TraokingSystemhave resultedin closer

coordinationbetweenthe FBI andOIPILcLr) "

• .

..."Inadditio.thee n, isregulaanrd significan Contsultatbeiontweethe n FBIandthe

' OiPRooncoming issuesthat arisewith legard.tothe initiation md renewalof Foreign

• .

i'. 3o
- . -. . " "....:,

t

.... ,.

• . ..

Intelligenoesm_eillan,ce Cour_(FISC):authorizedele_nic surveiilanceandphysical

sem-chpaokages,StandardMinlm_/zafionProcedures,interpretationof, the FISA.s_ttute,

and myriadOthermatters. Morespecifically,_ere arcbiweeklyme0tingsbetweenOIPR

supervisorsandNational.SecUrityLawBranch(NSLB) supervisors,iincludingthe

GeneralCorn!sel, andthe CIA. Therearealso biweeklymeetings on FISAissues

, betweenO]1'1l,NSLB, andthe Office of theDepuV ARomeyGeneral Moreover,

impromptumeetings between supervisorsof OIPRaddNSLB, as weUasmeetings

betweenline attorneys,areheld almostdaily. At present,thereis reg_ar androutine

dialoguebetwe_mthe FBI andOIPR,:at allleVeiS,on iimportmtandunusu__cases. (U)

• . . .- . ..

"

' On April 5, 2004, the AttorneyGeneraldirect(_ OIPR.andtheFBItO/mplement

certm changes"ratheFISA pr_:ess. Thisincluded the assignmento:ffive NSLB

attorneysto begin ful!<=tim0ne o,yearassignmentsto _e "IntematiomdTerrorism

OpcTationsS.ectionI E_A TaskForce"atFBIHQto itddresspending;requestsforFISA

coverage. Additionally,a total of I0 moreNSLB attccneyswill be a_Isigned(somehave

alreadybegunthe assignment)to<workfifll-timeon the FISAprocesswithinOIPR'Schain

of commandandunderOIPR_on for aperiod0lone year. Thisassignmentof

attorneyshasbeen beneficialin tin,herintegratingFBI _eys intocounterterrorism

operations(ad&:essedin recommendation#5). Overall,NSLBbelieves thatthe

...... assignmentofFBI attorneyswill notonly alleviateimmediateOIPR__ shortages,

,: btrtw/llalso serve to s(rengthencloserworkingrelationsbetween the FBIandOIPR.(U)

" . C. Recommendations related to the FBI's interactions with the i_telligence

• commu: OJ). " ..

,-..: ": .. ._,_.,....:

Recommendation N0.,7: Ensure effective management ofFBI de_Laflees.(U)

• ..

' TheFBIis in agreement_ the OIG's recornmen..dati0nto provide effective

management to the .employeesdetailedto the CIA'SC_unter-TerrorismCenter(CTC).

The FBI's Counterterro"rismDivision cutremlyhas one SES!_el m_aager,threeGS-15

SuPervisors,SixGS-14 Supervis0rsandthreeIntelligenceAnalystsdq,qailedto five CIA

dep.artmentsincluding , the CurrentAction S_ff. All ('heCTDdetaileesaresupervised

throughboththeFBI and CIAchainof comtnandfor (_e specific deFLrtmentthey are

detailed,with theSES managerbe_ingtheirultimatera_tingofficial. E'achdetai'leehas

beenmade awareof theirdutiesand rcsponsib'flitiesgqthintheir speoi_0d areaOf . .

Operationand this has been documentedaccordingly. In addi'tion,all UID detailw.s

assign_ to the CTCmeetdailywith the SESmanager,and the GS,I:; Supervisorsmoot

again in the afternoonWiththe SESmanagerto pr_m_ for th.. e DCI's evening briefing_ll_

i

TheFBI has,determinex!thatthecurront'porfozmanc planes for theGS-i5

Supervisor,GS-14 Supervisor andtheIntelUgenoeAnalystsare Sufficientlyinclusive to

adequatelyretieorthe critical elementsOfthe job being performedby the individual

detailcc. As s_Iod above, the FBI SESmanagertier/diedto CTCserves as the ratingor

reviewing official as appropriate,CIA managerinputisals0 solicitedforthe annual

PerformanceAppraisalandsemi-annualPerformanceUpdate. Itshotddbe notedthatthe

SESmanagerat CTCdoes nothave directreportauthorityto those FBIemployees

O 31
detailedto CIA-FIHO. These de_dlees aresupervisedbythe TerrorismFinanchlg .

OperationsSection (TFOS)withinCTD. The SESmanagerdoes ensure, however,that

theseemployees are included,in all mee_and providesn_essary j_tidanceand

sUpp'ortwhile they aredetailed_oFINO,__

• • • / • .

Reeomme_dathm NO.8: Ensure FBI empl_oyeesw!t0interact with other intemgenee

agencies better anderstand.theirreportingproeesses. (U)

Response: "EheFBI agreesthatFBI employees nee_ abetterunderstan"cling0f the

repottingprocessesand capabilities of oCherUiS. Intelfigencecomm_mities,andit has

taken,and will _ntinue to take,stepsto achievethis¢nderst_mdingacrossthe FBL The

FBI:doesbelieve, however,thatU.S. Iatdfigonce CorrtmUnityagencie:smteraCtingwith

the FBIhave an (pbligafionto independentlyensurethatthe FBIis:fitfi!y"reformedabout

their..reporting_reams andall of .theaV_able'informaifionthat_ey poss_salTOut

pre_ingthreatissues andinvestigations. (U)

• ,

_ Since September11, 2001, the FBI has establishedanumberof proceduresand

guidanoedirectivesto instill a better.,und_dingofU.S. !ntelfig_c e COm._m.'tY

repoxtingprocesses. These inclucte:i(U)_i ._ .- , :

•' ".

-::-::"TheEAD,I hasinformedtheheads of elFFieldOfftCe__lJ:iL_tdlig_

:CommUnitypersonnelwho operctejointly WietFBI Agelxtsandanalystsin the

field must op.erateunderthechainof ¢ommandofi .theField.Im_lfi'g.¢m_,Groupin

eachField Office, inthis way, FBIpersonnelWhohave devel0pedan<expe_isein

intelligence matterscan most effectively interactwithU.S. Intolligenee

Communitypersonnel. The respective:agencieswillbe intimatelyfamiliarwith

each-other'sreportingpr0cessesantlOt_e_cap_bilities:(U) :' .....

. . .

• Inatldition,the trainingcurriculumsforbothNew AgentsandIntelligence

Analystsis being re_i,:..etod improve.theknowledgethatFB! employeeshave

aboutU.S. IntelligenceCommunityagencies, theirroles; capalfdities,andba_c

processes(U) .

• The 0ffice oflnteUigence hasPOSteda glossaryofthe van'o_ types, of

inteuigence reportsproducedbythe U.S. inte_tgence Commmdtyon its FBI

intranet,website. (U) ,

.. • A seniorC!Aofficial has been detailedto .theFBI's CountertelrorismDivision to

...." enhance the'FBI'sknowledge of CIAcounterterrorismoperationsandimprove

coordination. Thisofficial attendsthedaily briefingsdescribedearlier,wherehe

discusses key cIA reportingstreamsandcoordinatesreportingexchangebetween

the two agencies.'(U)

.

.,

l_: 32

• L : :.
C: '" ".'". "."

Recommendation No, 9: Provide guidance for howand whento do_iument.

intelligence infor'mationreceivedfrom lnforma| bridlngs by other Intemgence

agencies. (U)

Resvonse: TheFBIhastakenthisrecommendationUnderadvisementin its

continuing developmentof intelligencepolicies andprocedures.We nolle,however,that

• atthe timeofthe _erbalbriefingsby theCL_ onMihdhm:aroundthe time.of the • ..

millennium threat,FBlpolicies to recordthisinformationdid exist, Theypermittedthe

recordingof this informatibyotnhe FBlempioyee(s)in _ ElectronicCommunication ..

. (EC.),classifiedapprop_atefy,anddirectedto the relevantfile(s). (U)

.Recommep.daflonNo, 10: Ensure•that the FBi'sinformaflon technoifogysysteu

• .allow FBI employeesto more readlilyreeeive_use, anddisseminate highly ¢iassifl_

Information.-(U) " " , .. • _.

The FBIh_ga responsibilityto then//tion,IC,Federal,StateandLocal law

: : .en.foroement-todisseminateinformafionandto do sois aninherentpartoit'its,mission,.

Sharing FBIinfom_fi0n willbe therule; filteringthe."mformationwill be the ex.ception,

• where sharingis legallyorprocedurallyunacceptable. .TheFBI will deli_er its.

infornmtion through the systems the FBI and itz custorner_ and partnors _;e. (I.Y)

,--:'" :" " _.::•_.:i., " " ' " " •

.........litheFBIisconnectetdotheresoft theU.$.IntelligeComm nceunityattheTop

Sec_.t(TS)sensitivCoempartmentIednfonnation(SCl)lev via_elnew,SCi

::: .._ii.- OP."e_ti'0nal Network(SCION),TheSCIONprojectwas initiatedin Sept_naber,2001,

":'and h_met allschedule,.budget_d performanceiequirements.SCION connects to the

'..... ii::..,InteCommun llig_ceityOnte-link)____

: '__ . ' SCl[ON'isthe busi..n_,s•tool forthe

. FBI's Office of Inte|.ligence, erronsm(CT),andCounterIntelhgence(CI)

Divisiom. Ithas enabledFBIHQCT andCl personnel.to more

SCION iscm.rently avaihblteOover.I[000 UserastFBIHeadquarteanrsd,theFBI

has initiated a pilotdeploymentprojectto the followingFieldOffices: New York, Boston,

and KansasCity. The planis tOdeliverSCION to all FB!Field Offices, as funding. '

becomes ayailable. Limitedaccess to Intelinkfr0m otherField Offices is available

through the old FBIInteiligenceInformationSystem Network(HSNET). Most ofthe

Field Offices have two workstationswhich have a connectionto FBI headquaRe,rs. These

workstations.areinadequate anddifficult to use, andthey are locatedin sme_llSecure

•CompartmentedlnformationFacilities(SCEF)that arenotin the agentor an_alyswork t

areas. An impedimenlto fieldexpansion OfSCION isthelack of SCIF space forthe Field

Intelligence Groups(FIGs) andthe J'ointTerrorismTaskForces (YFI'Fs)personnel. (U)

"_: '33
•/.. • .

' , Access to"theintelligence and 1iomelandsecuritycommuni_) at the SECRET

level is providedvia theDep__t of Defense SECI_T Intm_ P_.tocol Router ":

Network(SIPI_IET).whichprovid_ the cOn.nn_nicaliionsbaokbone..toiNTELINK- ';'

Secret. Ourgoa]Iis,to provideS]PRNET/INTELINK-Secreact cess ttaough SeCure.

dynamicvirtualprivatenetworksto all FBI workstationsin thenear fitture. Todayyou

cannotdirectlyaccess any external,networksi..f , rom theFBINETand.O_lylimitedbatvh

transactionsthrough secure guards arepermitted. The,Anti-DrugNetwork (ADNET)

tides the SIPRNBT' .,c, ommumca : • :o tion o.. s bac.kbon. eand providesterminals)and accessass

vehicle for the &)me.sticexchaage,Ofintelligence on (_ati,_ntg.©fforts,SIPRNE . Tis also

used to support_heTerrori_ EXploSiVDe,e. vice Analysis Center,the:_[ation_Vh_ual '

TranslationC_t0r, and ._.eF0i-ei.'gnTe_ris_. Tr_I_. LgTask Fo_e. (_. " "" - "

Inthe area 0forganizationalmeasage _c, fordiss_on:0foffici:_: ......': "

informationand_kin_ t0 0th_ag_ci_, theFBI1_sjust_em_ted.its n_FB] "

AutomatedMessagingSystem (FAMS)whiOhis based on the Defense Messaging "

System (DMS). The FBIis the firstcivilian agency to operate the cl_3sifiedDMS.

FAMS willpro_.'Ld0n- e Huemeasage creatio.n,r, e.vie_r,_md:seam. h..¢_U_oili , tioSt0everyone

'connectedto:FB]NET. FAMB giv_ usthe capabilitylk).s:end and.r_.(,'iveoritlcal -"

.or_onal-m0ssage _¢ toan_,ofme...40,a0_d.dt_seoanDM_ orAutomated ---'"

DigitalNetwork.(AWl'ODIN.:);TheTS/SCI.votsoion fFAMS.iscurrently intostingand• •

-willprovidethesamecapabilittYo.levery0ttsCIOI ono _:_I_I_.:T_bythofe:this :endyear..

.TheFBFsimpI_aentation_theofDMS Willprovidewriter-to-sr(_u eadtero-ma o rlto.

.internalandexteu._l users. Withinthe g0vernmenti:D:_,:wilt'Teplace.i,A,_ODIN.anda -

•- diversearray0f _mail.systemS _tly in..-_ethroughout_-Departm_t of Defense .

.andIntelligenceAgencies. _n.itsfinal.fo_. D.MS_:become.theg0_emment, s global.

,secure e-mailsystem.. "..ItW_.provi.de__interope.vabiH'ty.!ofvafioU s commercially

off the shelf._i_..vareproducts and.¢.0nn_t.over2.._i0n:ci_an.andmilits_.... : . "

users. Thes_nw. illporm. it mul:"'ti-mediat' taa'chm': ents'.tomossag " ....""e_ad....pro: vid ...." ee""nd.to- . -

ondsecurity.:(U) ' ":" '" " ' ' " : ';'" " ...." ..":: : "

.....

Inthe are_of. Oonnectivfoi_rdata_ducts,th,s.FB!.i :s.jb_e__ t to :

implem_t.:our inifl_p..m.._f0r _ _ as part.of the InteIfi_ __.0/> -, ..

Systemfor.Infort_6ti,,S_g _C,Sm )..,_t.FB! :.int__ .p_duCtsiu_e fo_, .,,

OfIntelligence b_etins, Inte_en_ AS.s_=tts,and._:_. l b_:publishod.0FBn I:.-.,

websiteconneclIo s toSdiPRNBTa_dT_cS; ThefirsFBi,_TS/$CIICDataMatt

(ICDM)iscurrontlyidenvelopmemandshouldbeon])inbyetheendof2004.The.FB!

ChiefInformatiOonfficerisalsoworkingwiththeDepartmenoftJustionceintorfacea

between ICSIS and the Law EnforcementInformation;Sharinginitiativeandwith the FBI

._ CriminalJusticetnformationServices(CJiS)Division to increasethe _haringof "

intelligencerelatedinformationfrom andto stateandlocal officials. (IY) '

The FBIis currentlydeploying_he.SECRETversions.ofFAMS,whichuses DMS .

andsecureOutlooklike e-mail for organizationalmessages,.so.thato_r analystsandreports officers can send and receivetimely intelligence with other:agenciesin near real

' time. The FBIisalso working on a digitalp.r0duc._oncapabilityforERs using.extended

markup language(XML) thatwill interfacewith FAMS and supporton=line,digital.
: ' production,of 'intelligencereport. TheFBIis applyingXM_ data st(md_ andrecta:

datataggingto facilitatethe exchange0finf0rmationwiththe intelligencecommunity.

The FBIis also applyingnew securitytechnologyto d_loya ProteciionLevel 3 Data

Martcapabilitywithdiscretionary. access.controls . andPublic Key Infiastructure

,certificatesin.supportof closed Communityof Imere_ltsWhichwill.pimnitSecuresharing

of ourmostsensitive datawith trustedmembersof otheragencies. TheFBIis also

investigatingthe use of secure one waytransfersto move informatiotLbetweensecurity

domains andtoPermitall,s0urce intelligence analysis. The USeofnext-generation_

CommunityHigh.AssuranceGuardsis being plannedi_ providefor the two WaYtramfer

on criticalintelfigencebetween secufi'_ydomains. Secure'wireless connectivityand

V_ PrivateNetworks:are also-beinglooked attOprovideincresset accessto

intelligenceto deployedpersonnel. TheFBIis also startingto use 0xt-line,d_p

•collaboration,toolssuchasInfoWorkSpacewhich is thefoundafi'onfor the Intelligence

CommunityCollaborationPortalto increaseintelligeticecollaboration.(U)

TheFmplans to use additionalsystems as the foundationfor add!tieredinformation

sharing witlithe IC,Federal StateandLocal entities,(L0 . :

• .

.The CJISNationalDataExchange (NDEx)lm'_l,ms fordevelopi_ a systems

_ach to theoperation,and maintenanceof several,interconnectedIT andsupp0rting-

: ..... tel_mmunic_iotm systems including Law BnforcementOn-.line(LEO).and C_-WAN.

._ _eNDEx is to be a repositoryof nationalindicesan_ta pointersystem for

state/local/fedendand inter-governmentallaw enfo_emententi,ties. TheNDEx will also

be..a fusionpoint for the correlationofnationally-baso_criminaljustice informationwith.

• c_ national securitydata. CO') . . ..

" iii':i Law EnforcementOn,Line providesweb-basedcommunicatic.nsto the law

enforcementcommunityto exchulge information,conducton-line educationprograms,and

participatein professionalspecial interestandtopicallyfocuseddialOg.Tlie system hasbeen

operationalsince 1995 andpresentlyservingabout30,000users. LEOhassecure _

connectivityto _heRegionalInformationSharingSystemsnetwork(riss.net). The FBI

Intelligenceproductsaredisseminatedweekly via LEOto over 17,000 law enforcement

agenciesandto 60 federalagencies,andprovidinginformationaboutIIerrorism,criminaland

cyber threatsto patrolofficers and Otherlocal law enforcementpersol3nelwho have direct

dailycontacts vdth the generalpublic. The FBIplansILo_ance LEO forrobust,highavailsbilityoperation_TheFBI will use the enhancedLEOasthe primarychannelfor

sensitivebutunclassifiedcommunicationswith Otherf_l_al, .stateand local agencies. LEO

" andthe Departmentof HomelandSecurities_ointRegionalInfommtic,nExchangeSystem

(JRIES)will be imteroperable.(U) . " "

The InvestigativeDataWarehouse0DW) is followinga multiple-phasedapproachto

quickly provide :rapportto _I investigators,andTask.Forcemembev_in.theformof a

spirally-developqx6lperationalprototypesystem,the Secure Counterterrorism Operational

" ' PrototypeEnvironment (SCOPE).The enterprisesystemwhich builds uponSCOPEisthe

.IDW.system;the!full deployment oflDW is scheduled forDecember2004. The IDW will
• :...' .

help meetthe Iawenforcementandthe ICne_ for rapid,s_ure,.deP!mdableindexed,data

and_ll providedatami_ni,gaccessto1_I:_v_tiga_ve.files,.(U)

' Tne Multi-agency InformationSharingInitiativeis intendedto enableFederal,state,

andlocal law enforeement agenciest0 shareregi0nalinvestigative fi!,_sandprovidepowerful

tools f0r cross-file analyses:A proof-0f_0ncept .effortis underwayin St_Louis; additionaI

demonstrati0nsites arebeing planned.The goa!of the dem0nstratiom;is to (1) show the

value of sharing:hivestigatiVedata which _ be ana!y_edbYmod_ softwaretools;'and(2)

help define tec_tical and Organ/zatio_ approachesfor region_ shar._xSyst l ems.-F'mat

d_isiOns.about deplo_ent of the MIS will be based:ontheresults of.thedemonstrationsand

thedepartmenwit deplanforlawenforc.em_t'mform_onshaxiugbein.deg;velopebyd the "

D_art: .m_t ofJ. tmti_e_ _.' • . ,. . + -....

.:Wiflthiecr.eafionof_e Office0..! f nteIliagen.ce tthe FBI,eachFBifl'elOffic d heas

-eatablisaheFied ldIntelligence GroUp:(FIG)I.tistherespomibJloity fthesFeIGStomanage,

executaendmaintainth,eFBI'sintelligence functio_nsthintheFBL HGpersonne.lhave -

routineaccess to TS:md SCI informationSothey_ ]beable to reoei,Te,analyze,r:eview:and

recommendsha_ingthisinformationwith entitieswithin the FBI as well as:outcustomers

andpartnerswittdnthe ]ntelligen.ceandLawenforcementcommtmi'fi<m(U),

: . • " . ., : - .. • _. • . •

• , ... • ...

R e_mmendatlon'N0,!:.:.iEnsUraPpr e opfiaph_ _• ,ical . infra. s.tructur -.. .' .. inFBe.Ifi..eld

omcestohandieltigidy elasSlfiedinforma_on, (u) . . '

. . . .. :.. . " ,.... _ '. ... ... :. • , •

•

• . .. :

The me To

•._dreSsth_ B_iU'S increasedd6maildfor_es.s _ s,msitive Comp.artmented " "

Information(SC]_)systemsthe following actionshavebeen taken:(U)

.

I)LargeSCIFs arebeingd_igned andincorl_wated"rote ... new FB!F_ilities. "

.will-allowfield Offic_ investigative.andinte. Mg_ce e.lemen_to.be locatedm._eas

thata_•conduciveto th..e flee.......flOW. .of

- hitell.

igenc .e• andcommonaccess .. ....to:highlyclassified

info... rmatisySsanum.(u) .

" 2) .Inaddition,ten (10)fieid0fficeS., including the New.York :FieldOffice"

•. m_tioned"in the above fm.d_ng,have _beeniidentifiedasthose:that aremostin

needof SCIFupgrades.Associatco_ ed include c6nstmctioncosts and

' miScellaneoUscosts. MiscellaneousCostsiuclude Eaglep!ton_ (1 p_rperson);

SeCurephones (1 per:.10p_ple); shredders(1 per 10people); and secur_fax

.... mach_nea(1 per 30 p.eople).Thisinformation.w_ provide_lin reaponseto

Questions for theRec0rdwhich.followedfromthe March 30, 2004 testimony ..

ofDADs Harrington and Ford concerning_hecouaterterrorismbudgetfor FY

2005. The constructionof the SCIFupgradesis dependenton the FBI

• receivingtheWxtUirefund d ing..(U) . :

3) The I_BIis cmentiy implementingaplan to adhereto the NationalSecurity

' Agen_3ymandateto have all.STU _nstmmentsrepla¢,edwith STEs by 2005 • . . .

...._.

,. .,

' m .( .36
- . .,

Recommenda_tonNo.!2: Improve dissemination of threat lufo_mattou, (U)

.,

. ._.

Response: l_neFBI agreesthst,like otherintelligence andlaw e_'orcementagencies,

itneeded to invrove in everyway possible theprocessesusedto disseminatethreat

information.Since September11, 2001, theFBIhas iissuedclear guidanceforthe

dissemination0fthreatinformation.Additionalpolicy developmentandtraining

initiativesare in:progressto furtherstrengthenthe FBI'sthreatinforvmtiondissemination

processes. Below are the steps theFBI hastaken:(iJ_!

• As indicatedearlier, the FBI's EAD-I,a senior lntelllgenceCommunitycareer

professional,has establishedconceptsof oper(_ions,policies, andpmc_ures

relatedto thediss_o_ .both.in,really andexternally, of'threatinformation.

(U)

• in December 2003, anEC was.distributedto a_llFieldOffices andLogats,entitled,

-,'ReportingRaw IntelligenCe."This ECprovidedguidance,r¢,_orting.thresholds,

and reportingproceduresfor rawintelligencederivedfromFEIIinvestigationsand

.intelligencecollection, andemphasizedthreatiinformationreportingand

disseminationprocedures.(U)

; -_?..-.. ., ....:._ .

.,...

. • The FBIhaspreparedanddistributedstandingandad-hoosets!of intelligence

requir_.ents (intelligencecollection andrepelling guidance)for agenCy-wideuse.

.. The+e:m].tdrementsare.postedontheFBIintranetandavailableto all employees.

.. "::: ........ Therequirementsprovide strategical!y-deVelopedandwell-defined intelligence

- needscoiacerningthe threatenvironment.Therequirementsframeworksnd

formatincludemdetailedreporting thre_olds, time fi-sznes,andreport_

instructions,to includereportingformatsandto what ¢ompon_mts the threat

informationshouldbe reporte_ CO) .

• .,"_

• The FBI has developedand implementeda twc_.weckspecialized_'g course

for analysts andagentSin reportinganddisseminating rawintelligence. This

courseteachesthe evaluationof collectedinteliligencefor dissc,_ainationas, well

as reportingand dissemination tradecraft using the most up'to-dateFBI business

processe,s,formats,and policies. _J)

• The FBI,isnearingcompletionof the developmentof a new web-based

. IntelligenceInformationReport(HR)application,which will serve to vastly

improvetheefficiency and effectivenessof reportinganddisseminatingthreat

information.Then_ applicationwill con_fina singleHR.fomaatfor use

throughoutall of the FBI's programs,andwill l_avea numberof advanced

features,such as electronicapproval,date andtime stamping,workflow tracking,

andstandarddisseminationlists. The applicationwillbe supportedby a

comprehemsiveHR.handbookwhich will be distributedthroughoutthe FBI in

3une2004:(U)

.

.
TheNational ThreatCenterS_)fion (NTCS)is the Countortc_rorismDivision's

(CTD) focal pohttfor the receipt,pre'limin '. _ analysis)and assignm_zt for immediate

actionof all emergingInternationalTerrorism(IT) antiDomestic Terrorism(DT)threats.

The NTCS coo_linates these threatswithseveralentieiesandagencieJ_to, includethe

TerroristThreatinte_on Center(TTIC),TerroristScreeningCenter (TSC) andthe

ForeignT_ri_ TrackingTaskForce (FITYF). CU)

..

..

TheNTcs isC0mpriseofdfiveunits:CT Watch(CTW), Publi'A coessCenter

unit('PACU)St, rategiInfo c rmatiOonperatioCnsentc_(SIr OC)T,erroriWatc st hand

Warnin"gUnit(TWWU), andThreatMonitoringUnit(TMU).TMU andCTW are

• resP0nsibl. e. formos intterfaciwitnghTTIC,TSC,andFITrF,(U) '

• • . ... .

., !nfomhaflon Sha,_inEwlth tl_eTerroris,t _treat !ntegrationCenter

Threat Monitoring Unit.

-.. ..

" ThemissionofTMUis toSupporttheFBPsroleindefendingt_he UnitedStates

fixnn the thr_ of t_ by receiving, assess/rig,di_m_g,_ andmemo--s

threatinformationand suspicious aotiwityinconjunctionwith FBIHQ,,FBI FieldOffices,

Legal Attaches, 8_d theU.S. Intelligence Community(USIC). (U)

•:Eachmonth,TMU receivesapproximatO!y_.l;000-thre_:alid:s_icious activity

refenals from vm.iousf_ state andlocal govemm_mtand hw ¢nfi>rcementagencies.

Each0fthese refi_i in the for&of e.mail _iions, electroniccommunications,

or hardcopysubmissions, arerev_ewedanda L ssessedby IwIU SupervJisorySpecialAgent

personnel. TMUhnmediatelyinsuresthe _propri'ate1,'BIsubstantiveunits,Joint

•TerroriSmTaskForce (JTTF)agenci'es,or:other,gov.er_rnent.ag_es;_are expeditiously

apprizedOfthet_xeatinformafi'onand , makes a reoordofthis threatinformationrcferml,

Additionally,if baseline criteriaaremet, these 0_reatmxdsuspicious activityreportsare

assignedto Tectadcal InformationSpecia!istswho ins._e the threatin£ormationis

researched,summarized,fully addreased,andenteredh the searchableTMU threats.

database.(Uy ....

. Durin"g fiscal year2003, TMUreoeivedand assessed approximately !1,000 threat

and suspicious-activityrefezmls. TMU subsequentlymemorializedmorethan 2,700

individual threat;rod/orsuspicious activityreportsin the TMU database. TMU

•disseminated the threatandsuspicious activityinformationto the org_aizafionsand

entitiesthat had c)versightresponsibilityfor individualsorproperty affected bythe threa_

or incident. TMIIroutinely provide_.all.threatsmeeting its baseline criteria to the

Terrorism Reportsand RequirementsSection CFRRS)who disseminat_ the information

. in the formof an Inte!ligenceInformationReport(HR.),.tomultiple colmterterrorism

customers,including TTIC. Beforethe FBIbecame actively involved in the publication

ofIiRs,TMUhaddirectcontacwt ithTrIc onadailybasis.(U)

" Over300 individualizedsearchesof the TMU tlh_eatsdatabasewere requestedof,

and conductedby;TMU to facilitate threattrendanalysisby FBI units,,the Departmentof

_ 38
HomelandSecurity,the NationalInfrsStmctureProteotionCenter,attdotheragenciesof

theUSIC who areseekingtomeasure targetvulnerability.Also, in 2003, over200

. individualthre_Litemswere submittedby TMUto TTICforpublicalionin the joint

FBI/CentralIntelligenceAgency Thre_ Matrix. Thi_)threatinformationwas then

distributedto t_iePresidentaswell as multiple federa[agencies. TMU alsoreceived

requestsfor, audconducted,more thantwentyspeciatizedthreatdare,basesearchesfor

major events (i.e., Superbowl,WorldSeries)_andfor.significant dateissuchasthose

c0rrespondingwithreligiouscelebrations.(U) • • .

. •

• .

Counterterrork_m Watch, <

, All TTI(_personnelwith access to FBIintermLle-mailhave been grantedproxy

fightsto themainCTWatch e-mailfolderandthe•CT WatchDaffy Log. Manynew

isles andupdatesarereportedto CTW by e,-msiLAll actions¢akenlincomingtelephone

calls, faxes, teletypes and e=mailsaredocument_ indetail)in the Daily Log. Through

this unlinn'tedreal-time , accessto both (he e=mailandlog, all informationreportedto CT

Watcliis also availableto TTIC. Furthermorea, CTWanalystis-pliysicallyassignedto

TTICwherethey serve in a liaisonrole, enmuinginformationis sliar(xlbetweenthe FBI

:.. audTTIC. Conversely,CTWpersonnelalso-haveaccessto TTICO_Hn_).whoreTTIC ,

recordsallnew 'threatinformationandprovidesupdateson current_reat investigations.

In-thelate summerto earlyfall of 2004, CTW will borcl0catOdto a new buildingaud,a_

_. suc.h)will.bophysioailyc.ollocatedwithTTIC.CO). ..'. . ..:# ....

" " _fformafio,n SharinlZwith _heTerro_istscreening .(:'.enter .,

• . ,._,...,:_>_'._ ,;... ..

..... The TSC,initiallyreceives an inquiry froma la,wenforcemen,t agencysubsequent

.; .... . .-.: _

. to)a;',V.iolenGat _gsandTerroristOrganizationFile (VGTO!_record raatch. The TSC

communicateswith the inq_ law enforcement agencyto provide ,_irectionand

confm_ amatch on the subject(s). If a possible matchismade, the TSC generatesa

reportcontainingallpertinentbiographicaldata and a checklist of anyresearchconducted.

The TSC thenmakes directconO_twith the CTWViatelephone aud/orsecurefacsimile

toprovide the informationregardingthe possible match..(U)

• Upon receipt of the telephonic notification fromthe TSC,'anatmlystfromthe

CTW will review all identifying information regarding the possible terroristsubject and

confirmanydatabasesearches alre,ady conductedby the TSC,such asNationalCfimina_

InstautBackgrotmd'Check,ACS andTip-Off. If nec_;sary,the aual_t will initiate

additionaldatabasesearchesto include:,a moredetaflodACSsearch,.Telephone

Applications,IntegratedIntelligenceInformationApplication,Treasm'yEnforcement

Communi'cationSystem,Watchlist,Department:of State,Immigrationand Naturalization

Sereico,TransportationSecurityAdministration,Bure_mof Prisons, D_I'ERPOL,and

pertinentpublic databasessuch as ChoicePoint,AutoTrack,and LexisNexis.(U) "

,:

' TheCTW analystprovidesa briefsynopsisto a CTWAgent, who then

•coordinatesreactiveandinvestigativeactionwith the field'Yiar._e FBI _Fs,

FioId/LEGATOffices, FBIcase agents, and/orFBI _khportLiaisonAgents. The CTW
. /

disseminatesthe informationto allrelevant agencies md coordinates:finalresolution

directlywith the JTTE When confirmationregardingthe final resolUtionisreceived '

fromthe JTTF,(_heCTWprovides asummaryof the elcotmter in the CTW/TSCGroup

Daily Logs. These TSC Group-DailyLog entriescontainisp_ifio dettils suchasnames,

locations, identifiers:.call-backnumbers,anda desoriptiofof how the matterwas

resolved. The log entries:arereadin realtim0by FBI personnel atthe TSC in Crystel

City, Virginia,andusedt0 documentafinal,resolutionfor the encounterand"close the

loop." TheTSC_timately reportsallpertinentinyestigativeand/orhttelligence ,

informationbackto the respectiveagencythatnomin_xl the terrorist.relatedsubjectfor

inclusion into the VGTOFdatabasefrrICor_I). (U)

•. ..

,. ,Information Sharin_ wlChthe Forelen Terrorist Traekin_ Task Force•

-. _' .. .... i... " .. " " . . "

!A representative:fromthe FrTrF hasbeen assignedf_,time tocTw.

Additionally,tmderthenew CTDorganizati'onalchart,_ has bemplaced underme

umbrellaof theI_gI'CS.This}c0!locationof resourceswill facilitate the flow of

" informationbetween.. the NTCS andFITTF.,(L_ .. ,.

..

.. .-.: . • .

D; OtherR. eeomameadatloas:

.

. : ...

,. . • .

" -_nmendation No..13: iEvaluate me eft._qivenesSof the raldd•rotation of

- Supervisory Sp(_ial Agents through :theFBI:Headquarters"Counterterrorism

l'rogram. Cu')

• . . . . ?. • . . "! . . . . . ,- ":. .:. .

•Supervisoryspecial Agents(SSAs) .assigned_to:_the_.counter_0rismDi,visiOn

follow the same,care_ pathandrelated:promotiona_lnetables:established:for all Agent

-- -Supervisorsassigned to FBI.Headquarters_IHQ),::_First.line._super_so_in:the,;fieldand

at FBIHQ•have0n,averegeserved_ inve_'gatorsfor .!L0.5yeats priorto assumingtheir

managementpoaifi0ns. GS-14 SSAs cttrrentlyservingatFBIHQ have.on average2.43

.years in theirFBH-QI SSA Positions, FBIHQSSAs.arein fact require_to complete,at

least twofull years in theirHQ assigmnentbefore_eir transferto oth(=assignmonts.

Even then, farfrombeing a prescheduledrotation,thdr movement to..afield assignment

requiresthatthey'successfully compete forassignmentspursuantto th,_demanding

requirementsera completelyrestructm'edselection system. (U)

• :.

Similar.tc)otherintelligence agencies,theFBI's growingcadreOf experienced

supp0rtintelii'genceanalysts:andother operationsspecialis_ providea significantportion

of the continuityof knowledge requir_lto understand_mdeffectively ,evaluatethe

emergingthr0atsover.the long term. However_itis notaccurate'fromthe perspectiveof

the FBI to characterizeatwo-year commitment,to anFBIHQposition as a "rapid

rotation,"implyhlg that 8SAs on _aesetwo-yearassignmentscontributeat a lessthen

optimumlevel to the FBFs counte/te_rism missiondue to theirlength of service. The.

intentionof service at FBH-IQisto provide:Bureauleaders,selected on the basis Oftheir

demonstratedactdevements,witha seri_ of uniquelyintense,particularlydemanding

•challenges. The assignmentsprovideexperientialopportunitieson a national.andglobal

scale. Firstlinemanagers, workingwiththdrmore experiencedsuperiorsandsupported

t

: 40

.-, o .-
' by a knowledgeableintelligenoe_, play a vital role in the identification 0f operational

' priorities,developmentand implemen_i'0n 0fageno_wide ini'tiatiVegthe assessmentof

the effectivenessofthose initiatives, andthepreparation ofproactive responsesto

. addressemergingtren&. TheseFBIHQ SSAssubsequentlyutilize t_,isgained

knowledgeandexperienceinthedomestic fieldandoverseasin furtheranceof theFBI's

mission. (U)

" If the FBIis _ foster the development of trueleadersto enhaz_ceits:management

• cadre,it is impeiative that_ firstline and mid-levelmanagers actively and fuUyavail

themselves of the widest possible rangeof leadershipohaUenges,most particularlythose

availablein FBE_IQSSA,positiom. TheFBI'sExecutiveDevelopmem andSel.eotion

.Programhassought to strikethe appropriatebalance betwee-n provi_ag first tine •

managerswith a rangeof developmentalopportuniti'_,andth.e.rebyaddresslead_p

•sucoessionconcerns,while still providingcontinuityin the managemmt of priority

programsmdregularly reinvig_ating those programs'withthe new p,.-'_,ective and..

approachesof new• . firstline.managers.(U)

Reeommendatl(mNo.14: Provtde glddanee on the type of information that agents

• should obtainfor evaluating.assets and for documenting the yearty ehe©konassets.

rU) , . -

... !_,_:i:':_, - _- ..

._ The FBi agrC¢swith r_mmcndation andhasimplemonted policy to addrossthe

issue. CurrentpoliCyrequir_ agentstoprovide semi-mnual or annuleetVaiuatio_,

. dependingon thetype of assetbeingdeveloped or opiated. The NFII?MSection 27-26.

•..._. establishes12points which must be addressed in each_¢valueti'onA_ . t0ngthe twelve

point:are:. !) accompiishmentsattributable.tothe asset,2) a ¢_ted .Ztion a .statemon:of t /

_:i: the_ and3)-(ite.:amountof money•pa_d:._ofhe .ass_i The.annual evaluationis not

intendedto d0cmnentthe assefs b0natides. NFIPM Si_ti0n27-29 pr0vides.eXamplesof

.teststhatthe Itandlingagent.mightutilizetodetermine 'thaseset'sbona tides. Additional

stepsto validate the assetareconductedby the handlinlgagent and are used to determine

the asset'sreliabijlityand.veracityof the informationthey provided. These areasof

reporting lendthemselvest0tlieadministrative facetof'asset development andoperation.

(U)

Within one yearofopening andevery 18 monthsthereaRer,the,handling agen_is

' requiredto submit a case agent assessmentto FBIHQ. 'Thisassessment is a brief

.. narrativebased onthe handler'sobservationsof andint(,_actionswithflie asset, and

.provides"insightinto anasset'smotivationand controlbeliefS,habits _ad any significant

behavioral chang(m.Thistimetable does not precludethe agent from s_bmittinga

revisedcase agent assessmentin the intor/mif the asse_s behaviorchanges significantly.

Additionally, a revisedversion of the NFIPM section 27 is currentlyin the _ stage.

Thenew NFIPMwill include language that directs agents.tonotify theJ!rimmediate:

suPervisorifthey identify a significantchange in the asset. The SSA ,_dllthen determine

if the asset'sbehavioralChangerisesto a levelwhich wouldrequireFBIHQnotification.

C_ • , .

!_ , 41
m . .

In contrasll,agents receiveinformationfromassetswhich,:althoughadministrative

.- "in nature,anddependingonthe information'sbe.afingonthe investigativeprogram,mag. '

requ|refollowup.=These areasOfr_pOrting!endthemselvesto,the investigative,:faceoft

asset developmenllandOperatiOn.Further_thisfacetof assetdevelopmentandoperation

aredictatedby the logicalprogressionoftheitwestigative processandCannotbe !imit_

• to or defined inadministrativepolicy. (U)

Recommends: ,tionNO:.15: Improve the flow of intelligence InformatiionWithinthe

FBI and thedisSemination of !nteillgeueeInformationto other lntellllgeueeagencieS.

_[_ .. . • . ,. _ _., . . .. ,: . . -,

• _ - .

• ' . . .. _ . ;

- ; • .. .... ."

• " :''" ' - " " 7 • ;'' ' '" " "'' " "

. . ,,.. . . ...

; The FBIhasareSponsibiiity tOthe nation,IC,Federal,Stateand Local law

enforcementto disseminateinformationand to dose-is mRinherentpartofits mission.

SharingFBl infomiati0nwill bethe rule;filt : eringthe infimnationWil|be,the exception,

where sharingis i_!_lly of procedurallyunae : c_table. The ._I will deliveritsi _

• infonnafion.throligh the systems,theFBI and itsCustomen.andpartnersuse:o J)

The FBIis connectedto.the rest.oftheU.S. IntelligenceCmam_ity atthe Top

• Secret O'S)Sensi•ti,_ecomp_ent_ _'ormation (SCl)i_.el via:the newSC! ::, "

Operational Network(SCIOIT).TheSCION projectwas hitiated in septe,mb_, 2o01, "

•. and hasmet allschexlule,budgetandpcrfonnancox_.uirements:.!sCiOH:i_0nii_ to the

• .Ia_!l igenee .Comm_'_ (Iate!ink)k_lmllmllllmlRll_NllNII/mlr-

• ._ _.scIoNt0ol. is the b/n_e_/s f0rthe "

]FBI'sOffice Of:!ntelfi'gencCoun e, __sm(_, and(:_ter Intelligence (el) • . ....

DivislonSiIt has ea._bled dutiesmore

. .

•., :.

•SCION is c_rrcntlyaV_lable-iOover 1000users.,atFBI.Headquartcrs,aadtheFBI "

hasinitiated apilot dcploymentprojectto(thefolloWingFieldOffices_New York,Boston,

• and Kansas.City.' Tllteplan is to deliver SCIONto allFBI FieldOffices, a_funding

becomes available..LimitedaccesstOIntelinkfromotherFieldOffices is available

throughthe old FBIIntelligence informationSystemNetworkOISNET). . Most ofthe

-. FieldOfficeshave twoworkstationswhich havea connectionto FBI headquarters.These

workstationsareinadeqUateanddifficultto use,and:theym_locatedinsmall Secure

Compartmented!nfo_rmationFacilities(SC_)that arenot h the/tgent or _aalystw0tk

areas.An impedimentto field exp...ansionof SCIONis the l_tckof SelF sp_3efor the Field

Intelligence GrOup(Fs IGs) and the J0intTerrofismTaskFc)rces(Yl"TFS)pcirsonneL(U) _"

.. Access tOthe _telligence and homelandsecuritycommunitiesat the SECRET

level is providedvia the Departmentof Defense SECRETInteractP/otocol Router

Network (SIP.R/_'I') which provides the communicationsbackboneto-I1_rELINK- "

Secret. Our goalis to provideS_PRHET_LINK-Secrell accessthroughSecure

dynamic virtualprivatenetworksto al_FBIworkstationsin the nearfuture. Todayyou .

• ,
,-. ,_. "... . .

' ::i.:.Hi/im) •

cannot,dire,ctIyar_ess anyeXterhal_networ_ fromthe FBINETandonly I/mitedbatch

• transactio _'onughssecurguae rdsarepennitted_TheAnti-DrNugetWork(AD_T).

.ridethesSIPR_Tcom_unic_onbts_kboneandprovidesteramnid.ac nalscaesass.

vehicle for the ,domesticexchange.ofintelligence on anti=drageffort_. S_RNBT is also

_. used to supportthe TerroristE_Iosive Device AnalysisCenter,the National Virtual

Transla •tionCenter,andtheForeignTerrorismTrackingTaskForce._

) .. _

In.the re:caoforganizationalmessagotrafficIbrdisseminafiolaof official

informationandtaskingsto otherageacies, the l_!has just implementedits new FBI

•. AutomatedM. essaging System(FAMS)whichis bas_xlOnthe Defe_e Messaging •

System (DMS). The FBIis thefirstCivilimagencyt_ operate_e',classifled. ..DMs.

FAMS will provideon-linemessagecreation,review:,andsearchcapabilitiesto everyone I

connected to FBINET. FAMS givesus thecapabilityto sendandrek_ivecritical

organizationalmessage tra_c to any of the 40,000+:_zldresseson DMS orAutomated

Digi.(alNetwofl_(AUTODIN). TheTS/SCIversionof FAMS is currentlyin testingand

•.. .wilprlovide,thsameecapabilitYto everyoneonSCION Or_I_NETbytheendofthiysear..

TheFBPsimple,unentationof theDMSwill provideWriter-tO,read (.)oceruree=_ to

internalandex_l Users. Withinthe gowwnmen¢D, Ms will replsce AUTODINanda

di.verse , arrayof e-mailsystems c.urrenflyinuse throuj_0Utthe Dc_pm:_ment of Defense

and Intelligence Agencies. Inits finalform,DMS wil[lbecomethe govemmenfs global

o-mail sTstom. It will provide certified interoperabili.t-y of variotm co .mmc1_ally

_. •o_,the she1£soflware products and .oonn_-'t over2 mil_lionm'.'vilian.aRd _t_

"-::.¢ us• ei_.. Thesyst(,wil-ml'pennimultt i-me . ., dia a_tt_hmen , . toam•essageiamd. pr, ovidend e -to.

.:: ..-e _ nesec_CtyO:). .. . '

.: '>ii::Ii_i n.thaerea.ofconnectivford i.tyatpra oducts, ritFBI e isjustbe_ to

•" _iement.our initial progrm"nsfor datamarts.as-partof _e InteIligenceComm_mity

S_m for InformationSharing(ICSIS.).CurrentFB£intelligence pvMuotsin the form

•of Inte!ligencebulletins, IntelligenceAsses.sments,and.IIRsarebeing publishedon FBI

web sites connectedto SiPRHET.andYWICS.The .firstFBI TS/SCI ][CDataMart

. (ICDM) is currentlyin developmentand shouldbe.on lineby the end of 2004. The FBI "

ChiefInformationOfficeris alsoworkingwiththe'Departmentof Susticeon interfaces

betweeniCSIS,and the LawEnforcementInformationSharinginitiativeand vo'ththe FBI

CYiminal/ustInicefo,rmation Services(CHS)Divisiotnoincr . eathseesharingof

intelligence related information fromandto state,and ]localofficials. (U)

.TheFBI is-current3ydeploying,the SECRETversionsof FAMS, which uses DMS

and secure Outlook like e=mm'flororganiz_'onalmessages,so that oturanalysts and

reportsofficerscan sendand receive.timelyintelligencewith other agenciesin nearreal

time, 'TheFBI is also workingona digitalproductioncapability.for]I_ using extended

markup language (XML) thatwillinterfacewith FAMSandsupporttin-linedigital

productionof intelligence reports. TheFBIis applyingXML ; datastandardsandmetsdata tagging to facilitate the exchangeof information with the inteUig(mcecommunity.

The FBI is also applying new securitytechnology todeploy a Pr_.tecti0n,Level3 Data

Martcapabi.lity_th diserefionmTaccesscontrolsand PublicKey Infiastmoture

certificatesin _pport of closed Communityof tntores(_whichwill,. permitsecuresharing
ofourmostsem_itive datawithtrust_mvmb0rosfothvr...agenciIzes.BiI.._ salso he .

inVestigatingthe.use of secureone way._f.e_.. :tomove informationbotwoen security

' domainsandto pemfit all-source intelligenceanaly_is_ Theuse ofne_t-generation,

•communi'tYl-IigliAssurance..Croa&. t. is beingplannedto-providefor tile.two way transfer

onoriiicinaltelli!gbe,entweceensecuritdomy ains.Se.e_ewirelessconneotivand iW

VirtuaPlrivatNetworksarealsobemglookodattoprovideincreased.-actoovss

intelligetnce odeployedpersonneThe l, FBIisalsostartitngouseOn-line,desktop

collaborattools ionsuchasInfoWorkSpaoewh/ohisthefoundatifonortheIntelligence

Comm.unityCoHabomti0nPotrtoincr aleaseintemg_tce.. c. ollabom(tU)io.a. .- . . . .

• . . • . _.... , •

•TheFBiplaas.tuse o addifionsay!stemas,the s foundation foradditional _Onnation

shar_ withtheIC,FederalS_ andLooa!.entit : i(eUa),: _ .....'

" -i" ' " _ " "

TheCHS NationalDataExc . .hange,(NDEx)ha ph_s fordevelopi:angsystems:_,_ .

.appma¢. h t0tiaeoperationan,dmain_tenance.osefveralinterconnectIT-edandsupp.orfi_

telecommunicatio:synsts einmsClOg Law Eaforovmen.Otn,line (Lt_) and_ :WAN:

TheNDEx istobear_ositow.ofnational-indi a ap0c_isn,tersystemfof :,

statedloca!/fedmdand.inter_g0vernmmtal _w: enforcemententities..-q._he.NDExWilt.alSo

be a fusion point f0r the correla: fion..ofnationally-based.eriminaljusiic_.infonnation wi_

•: " ..Law.Enforcc_mentOn-L_eprovideswe.b-basedcommunlcatic_s.to the.law

enfo_ement con.._._ty to.exohange.,._nfonnation/:conduct:on-!ie_educationprograms,and

.. participatein professionalspecial interestandtopicallyfocuseddialog.The systemhas:been

operationalsince 1995 andpresentlyservingabout30,.000.users.-LEOhas sevur¢

connectivityto.riteRegionaHnformation S.hafing"Syst(masnotwork(riss.net).":.ThFBe I

IntelligenceproductS:.arcdisseminated,w.eckly,via.iLE(),toover . 1:7_000". law?enforcement

agenci'_sandto 60:fcde_. agencies,,andpr0vidiningfOmmfionaboltcutfrorismCrim , inaland

oy,0or_ats to.patrol.offic.aneordtsherlocal.leanfw,orcemenpetrsonneWhlohavedirect

dailycontacts, withthegeneral, p_lio.TheFBIplanstoenhance LF._p-robu f r sth,igha_'._ability oPeration,TheFBI will use the enhancedI_O as the primarychatmel."for..

sensfllve but Unchssified communicatiowinsthotherfbderal,state andlocal agencies. LEO

: andthe D_artment of Homeland SecuritiesJoint RegionalInformaticnEXchangeSystem

(.}RIEwiS)llbehatcroperaCLble. D

. . , ': .. ..

The Investigative DataWarehouse 0DW) isfoiL!owinag multiple-phasedapproachto -.

qui'cklyprovideSupportto FBI investigators,andTask Forcemomb_; in the form of a

spit_y-deve!oped opemtionaiprototypesystem. ,the Secure Countert_orism Operational

Pro_type Environment .(SCOPE)<:Thenterprisesyst..emwhichbuilds upon SCOPEis.the

IDWsystem; the full deployment of IDWis scheduledforDecember2004. The IDWw/ll

helpmeet _elaw enforcementandthe ICneedf0rrapi[d,secure,depmdableindexeddata

and willprovide ,hta mining accessto FBI'investigativefiles. 03)

•

I

The Multi-agency InfornmtionSharingIn_thtiveis intendedto enableFederal,state,

andlocal law en_3rcementagencies to shareregionalinvestigativefite,,_and providepowerful

tools for cross-file analyses.A proof-of-concepteffort:isunderwayin St. Louis;additional

• _ 44

.?
"ira

demonstrationsites arebeing planned.The goalof the:dmonstr_i0ns iSto (i) show the

value of sharinginvestigative da_ which Canbeana_tyzedby mod_ soRwaretools;,end(2)

help.define teclmicalandorganizationalapproaches:forregionsl shareds_tems. Final

decisions abou_dt eploymentof the MISwil_be basedon theresults of the demonstrationsend

the departmentwide planfor law enforcementinfom_ationsharingbeing developedby the

Departmentof Justice. (U)

With the creation of the Office of Intelligenceatthe FBi, eachFBIfield office has

, establisheda Field _telligence Group(FIG), Itis.theresponsibilityof these FIGSto >

manage,execu•te and" o maintain "the

"

FBI's intelligencefunctionswith_ the FBI. FIG

" personnelhave routineaccess to TS andSCIinformationso they WIUbe able to receive,

anal_e, review'and recommendsharingthisinformationwith entiti_ withinthe FBI as

well asour . cuslomersandpartnerswithinthe IntelligenceandLaw enforcement

communities.

_egommendation No. 16: Ensure tl_t field offices allocate resour©eseonsistent with •

FBI priorities:

TheFBI agreeswith the generalconceptth_ the re_mmen&_ion is basedupon

.... andhasin fact instructedeach field office to addresshigherprioritytnattersbefore lower.

ones. -The Direr-tot has instruoted thefield offices to 1me whatever r_sources are

._: ._ necessaw to haudle.aUCounterterrorismleads. However,itmust be pointed out that.the

_ ..,-,,_ levelof resom_ allocatedto eachprioriW is notbascxluponOaerelativerenkof the

•_. prioritybutuponthe level andsignificanceof the threatin each priority area_d the

.. .__ extent_oWhichtheFBI hassole jurisdiction overthe matter. Thus,to determinethatthe

:_:- _ appropriatelevel of resourcesis allocatedto each priority, a:simplefc)rmulaCannobt e

.... _:_/_ usecL_ detailed analysis of the threatandworkloadin every FBI division must be

conducted. .'_

This analysisof thethreatandworkloadis conductedby eachFBIprogramas part

of theFBI's resourceallocationprocess. Inaddition,the FBI hasdevelopedand

implementedsemi-annualprogramreviews to ensure_ch fieldoffice is appropriately

addressing the F.BIandthe nationalprogrampriorities. Headquarter'_iprogrammanagers

arerequired to renew eachoffice's programreview submission andmake appropriate

management decisions. In addition, the FBI's InspectionDivision will use the semiannual review submissions as a source document of conductingthe field office
. ,. ,.. . ,.

•" inspections.Iffield:officesarenotaddressinpriori g _mattersappropriatelyth;e

Inspection.Division_!I writeia "finding'"andrequirea cOrrectiveactionbe taken.The "

InspectionDivisionwill also'r.e_iewtheactionsof thenationalprogr , _tmanagerlto.

ensurethatappropriateinstructionandactionswereN:en.

, ,"..

• .. .... . - . .

SincA_.relyyours, ...

-.

..

• . ..

•. - "i ! "

". .. '

• : :. " .. ..

:._. :: • . .

..... ..: StevenC. MoCraw

" Assisl_mtD_tor

• , .'_. :. . ,- .,

: • '...

• . . • • • . . .

• .. •: _. .

• , : : lnsp_:tionDiMsion ..... '

• .'.:

..

_ . . : _ ": ."

• °° .. ,. .. • . -: , " ,..- /.. ,- .

• Encios_e" _: _ :_:

-

. .: ;._

,_, . • .

, .- .

.. " -. • ... "-'.:-

• , ; •

h _

• ..

. , .

• ..

• . ,

..

• - . . . . . ..

..

• , . ..

.: :..

•. .

• .

°. . .

.- .:.

. .

u

• .

• ,

. .. .

..

..

. .

- .. z

• .

,.

• ..

• t

, ....

t , :

.,..

°°