Document text
Rev.08-28~2000! .
W 8:' FEDERAL BUREAU OF INVESTIGATION -
Precedence: ROUTINE Date: O4/ll/2002
To: Ottawa » Attn: Legat b6
FBIHQ Attn: PE bvcSAI I
New York
San Diego Attn: SAI I
From: San Diego '
Squad 199 Contact: SAIUUUUUUUUUUUUUUUU 858 99-7385
Approved By:I I
Drafted By= [I:IIIIIIIIIII]tr
Case ID #: 265ANY28035O Pending!
265ANY280350SD Pending! b . _6
Title: PENTTBOMB; _ 97¢
Synopsis: Set lead for Legat to contact service providers to determine
identity of individual using IP addresses.
Administrative: Reference telcall between SSAI Iof San
Diego and SAI I PENTTBOMB Team, FBIHQ, on 4 16 2002.
Details: At approximately 3:45 p.m. on September 12, 2001, the
Washington Field Office of the FBI was notified by the Dulles Airport
Police that a suspicious vehicle was found at the Dulles International
Airport located in the Hourly Lot, Row G, Dulles, Virginia. Department oi
Motor Vehicle records were reviewed by FBI agents from the Washington
Field Office and determined the 1988 Toyota Corolla, with California
license plates, Vehicle Identification Number JT2AE92E9J3137546, was
registered to Nawaf AlHazmi, of 8451 Mount Vernon Avenue, Lemon Grove,California I
The vehicle was searched by agents of the FBI and found to' ' ription for Khalid AlMihdhar from
California, a receipt for car service at
San Diego, California, signed by Khalid Al-
Mihdhar, and an insurance card under the name of Khalid Al-Mihdhar, 7091
Eskstrom Avenue, San Diego, California. Subsequent investigation in San
Diego confirmed that both AlHazmi and AlMihdhar resided in San Diego ir
1999 and 2000.
ALL II'IF|:l1l'.I'Ii:lTI[!]1I CEII-ITAIIIIED
HEREIN IS UI-IlILiL§:1SIFIED
DATE Cll252E!lIl? B1 ISEISDB iLUC_.-TAI:I;I§LT_:'LR2 Ilerivat-i=.re
BF
To: Ottawa From: San Diego
Re: 265ANY28035O , O4/ll/2002
On September 13, 2001, FBI agents from the_San Diego Field
Office interviewed flight instructors at the Sorbi Flight Club which is
located at the Montgomery Airfield, San Diego, California. According to
the flight instructors, in May of 2000, Al-Hazmi and AlMihdhar began
taking flying lessons with the Sorbi Flight Club. AlHazmi and AlMihdh'
expressed a strong interest in flying Boeing and jet aircraft. Al-Hazmi
and AlMihdhar were instructed that they would have to learn to fly
smaller single engine aircraft first. Al-Hazmi and AlMihdhar took
approximately six flying lessons at the Sorbi Flight Club. Al-Hazmi and
AlMihdhar were mainly preoccupied with learning to control the aircraft
while airborne and took no interest in takeoffs and landings and made
little effort to improve those flying skills.C
On September 15, 2001, Special Agents of the FBI made contact' person named|[fii&:j During an initial interview,! |stated that he is a
citizen of Yemen, was raised in Sau 1 Ara ia and entered the UnitedStates in 1998 on a student visanE:::::::::::j remained silent when asked
if he knew Al-Hazmi and AlMihdar. He denied knowledge of the terrorist
events of September 11, 2001. During subse uent interviews with[:::::::::::]on September 15 and 16, 2001,Ef;:::;:;;::]admitted knowing Al
Hazmi and AlMihdhar and advised that he a me em at a local Mosqueapproximately eighteen months ago and regularly prayed there with them.
claimed that he regularly gave them English lessons and
attempted to help them adjust to life in the United States. In July of
2000, he m ' partment located| ICaliforniaTff:ifi2:i7:TrecalledQthat Al-Hazmi and AlMihdhar were still
listed on the lease at that time but were preparing to move out.
| | said that in December 2000 he moved into a residence located
at| Iafter Al-Hazmi and
AlMihdhar moved out of the residence.
On September 15, 2001,[:::::::::::]granted Special Agents ofthe FBI consent to search his room and his home computer at the[::::::::]
I I The San Diego Regional Computer Forensics
Laboratory "RCFL"! subsequently performed a forensic analysis of
[:::::::::::::]computer. The RCFL uncovered several web pages on the
computer's hard drive which expressed strong anti-American sentiments.
These web pages contained headlines such as "America's Campaign to Destrc
Islam," "U.S. & Britian Kill Muslim Children In Genocide Attempt," and "Z
Message From Bin Laadin[sic]: Declaration of War." There were also severe
web pages in support of the Muslims and their war against the Russians ir
Chechnya. Digital records from[:::::::::::::]computer revealed the email
address [email protected].
Investigation at GrossmontCuyamaca Community College District,
8800 Grossmont College Drive, El Cajon, California by the FBI revealed
that the email address, [email protected], was provided by Mohdar
Abdullah as a point of contact.
2
b6
.b7CTo: Ottawa From: San Diego
Re: 265ANY-280350 , O4/ll/2002
On September 19, 2001, Special Agents from the FBI interviewed
Mohdar M. Abdullah of 1415 E. Lexington Avenue, Apartment Number 146, El
Cajon, California regarding his association with AlHazmi and AlMihdhar.
Abdullah related that he met AlHazmi and AlMihdhar in 1999 in San Diegc
California. Omar AlBayoumi asked Abdullah to become acquainted with Al-
Hazmi and AlMihdhar and to acclimate them the area and assist in any wa§
in their affairs; Abdullah assisted AlHazmi and AlMihdhar in arranging
travel arrangements and flight lessons while in San Diego, California. Ir
early 2001, Al-Hazmi telephonically contacted Abdullah and informed him
that AlHazmi was in Arizona attending flight school.
On September 21, 2001, a Federal material witness warrant,
pursuant to Title 18, United States Code, Section 3144, was issued in the
Southern District of New York for Abdullah's detention. On September 21,
2001, Abdullah was arrested as a material witness in San Diego, Californi
and transferred to New York on September 25, 2001.
On October 5, 2001, Abdullah was interviewed by Agents of the
FBI in conjunction with a Grand Jury investigation in the Southern
District of New York. Abdullah was shown and acknowledged writing a
document that contained references to Stinger anti-tank weapons,
"martyrs," "mortors,", and "grenade launchers." Abdullah further explaine
that the document reflected his interest in weaponr which was spawnedthrough his relationship with an individual named [i:::::]
Abdullah advised that he and had utilized an indoorshooting range in El Cajon, California. kofJ I lAbdullah and attended the Al Ribat mosque in the San Diego area. Abdu atalso knewl land stated that he was a veteran of
the Unite States Navy.
Subsequent investigatio ' ' d States Navy has
revealed that an individual named was previously enlisted
in the Navy and had received small arms weapons training.+j
On September 22, 2001, Special Agents of the FBI executed aFederal search warrant at|
Subsequent to the search, a computer was identified by a resident of the
address, [:::::::::::::] as having been used frequently by Abdullah.
A separate Federal search warrant was acquired for this
computer, which was then forensically reviewed by the RCFL. Located on
this computer was an email message dated August 12, 2001, from[::::::]
II| l with the subject line SALAAM U yllPONSE NEEDED In the message,E:::::]said "PLEASE TALK TO THE BROTHERS IN SAN DIEGO As MANY AS Y on CAP
COLEN POWELL STATED TODAY THAT THE US WAS COMMITED TO MOVING THE EM BAss§
TO JERUSELEM WE MUST ORGANIZE A MASSIVE PROTEST OF THI s STANCE WE NEEDPRESS COVERAGE." The message was sent ti I Furthe
3
b 6
Ib 7 CTo: Ottawa From: San Diego
Re: 265ANY28035O , O4/11/2002
investigation revealed that numerous individuals used the seized compute:
to perform a myriad of functions, including checking email.
Special Agent[:;:::::;:;:;::]advised that based on discussion
with agents working Domes lC an n ernational Terrorism, the alleged
terrorists involved in the attacks on the World Trade Center Towers and
Pentagon collaborated and communicated with a network of individuals and
organizations to facilitate their attacks. It is believed that they usec
the Internet, including email accounts to communicate with associates.
FBI analysis of the business records and email activity
obtained in the investigation to date indicates that some of the 19
suspected hijackers used the internet to further their criminal conduct.
For example, at least l2 of the suspected hijackers purchased airline anc
other tickets over the internet using email and giving email addresses as
contact and confirmation points for their reservations. The tickets for
the hijacked flights that were purchased using email addresses were all
purchased between August 25 and August 29, 2001, further indicating that
the hijackers had closely, and secretly, communicated to coordinate thei1
scheme.
Upon reviewing the contents ofL::;;;:;:::::::;JMSN Hotmailaccountlvl I agents of t e iscovere an email dated
O1/18/20 , trod |that contained
statements relating to possible terrorist activities. The communication
contained, in part, the following statements:
"before, our plan was to go to the U.S, we would have a few
people ready to plant bombs in very important buildings"
The communication specifies as targets; the White House, NASA, the UN
Headquarters and the Canadian Parliament Building, among others. It goes
on to say that "All this sounds impossible, but anything is possible".
The author finally directs the recipients of the email to respond to theaccounq land tell him what they think of the plan.
A 2703 d! Court Order was served on MSN Hotmail for recordsrelating to the account Lt dg The results showed that
the account was accessed rom a number or IP a resses. MSN Hotmail keep
a record of every login to a Hotmail account and what IP address was usec
for that login. An IP address is a unique number assigned to each
computer on the Internet. The physical equivalent would be a telephone
number with country and area code. The subscriber records can be obtaine
for an IP address just as with a telephone number.
The following IP addresses were used to access the
laccount at the times listed:
4
_______I£__iOttawa From: San Diego
265ANY28035O , 04/11/2002
, .b6
Time PacificL Date b7@
5
Y
To: Ottawa From: San Diego
Re: 265A-NY-280350 , 04/11/2002
SA[::::::::::::::]queried a publicly accessible database for
information o ses used to access th e Hotmail account. The
address block is owned by:
b6
b7C
The address block of[::::::::::::]is owned by:
The above list points of contact can be contacted to determine
h .t e identity of the person using each IP address at the specified date ar
time.
1
6
To: Ottawa From: San Diego
Re: 265ANY-280350 , 04/11/2002
LEAD s! :
Set Lead 1:
OTTAWA
AT OTTAWA
Liaison with Canadian officials to have the following companies
contacted to determine the identity of the individual who used the IP
addresses at the specified dates and times:
All IP addresses beginning with[::::::::::::]
be
.b7C
All IP addresses beginning with[::::::::]
Q0
7
I
_;.-s
I15?
S3
15: ?' Connectionsvof San Diego PENTTBOMB Subjects" » ;
92 . tothe Governmentof Saudi Arabia
Links td Saudi Govcmment:
SECRET .
', 1' _, r , q ' » * , * £1LL*ll*¬i*'U£?i-Lé. I'.LUlf=J w;1m*m;m:~:n
V l m" **i"=L * "l3 ' ~ ' . rmRE1=: "#1 H11rLr".m*~*-L~=z1:"1:z1:» >?w".E1=~"1"
=:I.;1§§11F:E1:1 @022»-1 ;¢1f.E~lZ,sE=.ixI»1..?:IE'£-;+~"f£*I[1I1 _é HEPEL gjow QT£_Ep_.mSE ~ i:§»:.ms|.;m= 1.-1 gar; - , * -
I:=E1IL;55$;II-FY ..i~z:n1-11;.-2L0-32 _ ' » 4 - 'A
s
_¢~:92;¢
bl A
b6
b7C,
¢
i
~ Omar Ahmed Al-Bayoumi _
. . l F
' Links to Saudi Government: ' V.
', t; . ,
' 2. Education & Financial Support: On his application for admission to a doctoral program at
Case Western Reserve University, Al-Bayoumi stated he was employed by the Saudi Civil Aviation V
Administration CAA! for 20 years and was the "Assistant to the Director of Finance, Contracts and
Finance Control Division, PCA, Airways Engineering" of Dallah/Avco-Trans Arabia Company
{which is under contractto the CAA to provide aircraft operations maintenance!, In" 1995, Ercan
Engineering, a San Diego subcontractor of D_all,ah/Avco, was asked by the CAA to provide nancial
support to Al-Bayoutni while he studied in the U.S. Ercan refused and was told its contract maybe _
jeopardized as aresult. Al-B ayoumi told NS? that the CAA pays him $5,000 per month to study in
England for his PhD. However, the Mabahith claims A1~Bayoumi is nancing his own education. In
a 1998 letter to Case Western Reserve University, the Royal Embassy of Saudi Arabia, National i
Guard Office, WDC, claimed that Al¢Bayoumiwas a candidate for a full scholarship from the i
government of Saudi Arabia, t ' , - i i ' - , Y. i H
' i 3. Mailings: On 01/ 18/2001, Al~Bayourni received a UPS paekageat his San Diego
apartment from the Saudi Embassy in _ f _ ' . V Ib 7C1
<n_
~4-
srR92B92E'r» *
t __ 4. Witness Reports: Various SD -witnesses have described Al-Ba oumi as "associated withthe Saudi government" |:[!; "a frequent travel-er to Saudi Arabia" ti; "member of the
' Avtiation Board for Saudi Arabia" _{:b; "having regular contact with.the92Saudi Arabian L
92 Consulate in LA" |:|; "making frequent trips to the Saudi Consulate during the six years he was
i known to live in San Diego" |:|; "working for the -Saudi govemmentttowtatch the actions of 1. Saudis in the U.S." :1; inquiring aboutthe Welfare of Saudilstudents in San Diego 1:;
"on a scholarship and nancially supported by the Saudi government". |:|;"'h2tvi11g friends at the
-Saudi Consulate in LA" 1:!; "a spy for the Saudi government" hijacker Al-Hazmi as reported by
Shaikh!; "receiving support from thetSaudi Arabian Government or Saudi Airlines" ]:|; a reputed
"Saudi Arabian intelligence officer" due to his prolific videotaping of services at the mosque
Abulcar!; "an engineer for the Saudi Arabian government" 4:!; providing a $500 checkto the SD
Kurdish Coniniunity Islamic Center drawn onthe account of the Royal Embassy of Saudi Arabia
4 3 |:|; considered by some in the comrnunityas "sorne typeof intelligence agent for the Saudi
E1! Arabcian»-goven1ment'| 4 ' _ _ I frequently traveling toA ,1: ti ,th6 .LQ5,A,I1g,1¢S,,3.i1'pQITlI_IO,Q0}!Qi0I.p1Ci llpSl9.llCllS.1/1S1I1l'lg southenaa-Califor=nra'1'|a travelingto WDC every one to twomonths" to visit the civil aviation office of the Saudi Consu ateon yomingto :5 :1 Streetin>~WeDC:|t"disclosin to others at the Islamic Center that he hasfriends/contacts in the iSaudi Consulate in LA" Ij a "ghost employee" ofDallah/Avco and one of "a proximately SO
1 i___.lIE~'
i srzthqzr 4w
<bl '
102 -
12:70 . L - V t _ t t t t f A , p , V v b6 _ In _V t - individuals carried on the books of Dallah and being paid fordoin nothi " "Working for the .19"; CSaudi»lntel1igence:tServicetoareportaonadissicdent»Saudis» » _ ' ~ t t 'I
-.92ml . 3'44" .l||" " '&; QSE¬iR3'ET -
_ :92U.S.1§.epartn1ent of Justice 4
V Federai 92Bur_eagpf iqvestigatio
éInR%w mB%e San Diéqo,.California 92123' Refér to
File No.
mam: -IIl3_~,.L~'-;':lZ1C'? , V .» April 15, V2002
CLELESIFIED BY 1§£iL§iZ¢l 5§92UiI-,»*B§?J.s.F,>"lIEB,- I&T ' __ ~ ~
DE;?L§5EI1iI2 1,4 C1 r '
DE~E'T.;5.f- 1?iTF"1 !'.lkF_: R1-=1?--}'~2i'.iT-ii':~Z _ L OMAR AL BAYOU-MI _. _
' V A 'é EMPLOYED BY DALLAH AL BARAKA ELL I1'IF@Fl5-WI???Z V ? ijlV;_&i¢:7 1' * KW§E?EIH_IE UMCL£3$IFIED EXEEP?
' * EHEBE*$HEHH UTHERHIEE Q
r v' I
This d~ocuma~nt contains neither recammendations no: conclusions of .1:he FBI. It is the property of the FBI' ~ '~ J - -' 'b d 1'"d ~ ur a enc and is loaned to your agenqy; Lt and 11:5 sc>ntent=are no-_to be d1str1 qte 01.1.»; e yo, q y. ~
SECRETin i
b-6
1,":*3 1
..=..=»'1'
7v
5- ALL IIIIFDPHATISIII CEIDITAIHEI1 Y E
§ - I-IEHIIIII-I II-I III-IlIiI.I1IL?II IIiI1I| I _-
WY DATE El-1ll_51EIIl§]I5 BY SIIIZICIQ ATIET;"TI1_I-I_.-"I-ILT,1LP.2 EIerivative
?%T%. .
U.S. Department of Justice
$. fis
Federal Bnreau of Investigation
InR ly Pl a . . ._h5£pw' ESE San Diego, Callfornla
F e No. r '92123
H Aprll 15, 2002 b6
- 'b7C
113713
OMAR AL Bi-XYOUMI
EMPLOYED BY DALLAH AL BARAKA
telephonically interviewed attelephone number andWES
I
1b7D I
| H I I | be maiD£in§__I£Tidence
I
Fhis document ccntalns neither reccmrnendations nor conclusicns of the I-BI. It is the property of the FBI
and is loaned to your agency; it and its contents are not to -be distr1b92'Y' d "' ' '
rang; 4 1::4.8 OUC;1Qe YOU! agency.
000000104-