Document text
5. 7 ?é m
. I O ,Q 2 Sl§§éET,NOFORJN,Xl! _% WW!
rf!+i*" /
QATE: U32§2UB5
LA3SIFiED BY nana ans TRMKNLTECLQ
._, 3 , ,' " r356 " -3,1; M *3 L,_s"1,a_»f<§k. l¬¢1;1;,,@g 1;: H3~HL§5¢i-- E é ~ [15 J
I1-I E RI%I§%T I OI? C CJZ92TT}'L § N E I13
IN IE QNCLREEIFIEE EXCEPT
EHGWN QTHEEWISE
I /
The 11 September Hijacker
REQ. #364,
_ mm:Cell Model
February 2003
V v" dbw FB' CT
Reason" -Detféity on: X1 M
S%é¬T,NOFORN,Xl!? oboonnoza
fax 92 b. , t
' 6 °.- a J
l$o><E'r.No1=0|uv.x|!
"/11 ~'92-:_=Q§l-"_'9292 :9292 , .- V
The 11 September Hijacker Cello Model
U! EXECUTIVE SUMMARY
U! Key Flndinrgrtsin
"Tire 11 September hijackers successfully eluded the notice of US law enio~rcemen_t and
intelligence as they plotted to commandeer and use four airliners as weapons, but details of their
lives and activities can be used to detect cells that may follow the 11 September hijackers model.
It should be noted, however, that the 1993 attack on the World Trade Center and the Millennium
bombing plot--the previous two major international terrorist operations on US soil-used tactics
that are different in key respects from the ll Septémher model, suggesting that future sleeper cells
will use a variety of measures to conceal their" activities.
- The ll September hijackers were all Middle Eastcm men between 20 and 33 years of-age
who w0re"a wastern style of dress and grooming.
~ The hijackers entered the US legally and used either their tme names or variations of their
true names. Thirteen of the 19 ihijackem traveled to the US in groups of two or three--four
or the remaining six were the pilots.
< 92
~ Once in the country, the hijackers obtained typical US identicationdriver licenses, state
identication cards, and cormnorcially available:rdocuments--likely in order to avoid further
use of their passports.
~ The hijackers changed residcnos Frequently.
~ The hijackers enrollment at US flight schools was not in itself necessarily uncrommorn, but
their focus during simulation training on learning only tho skills that would benefit their mission
dlistlnguishcid them from typical students.
- The hijackers opened bank aocountsoltcn in pairs--with money either they brought legally
into the US or wired from overseas.
* The. hijackers largely avoided associating with radical Islamic groups in the US, likely in an.
effort to reduce the chances of detection by law enforcement.
' The l'1i_l?1£El¬¬7I5'GOII1IIlllIllCi!1iQrlS tcchniqucsifaoc-to~face meetings, prepaid phone. cards, payphoncs,
cell phones, the Internet, and possibly cornrneroially available mailboxes-made it difficult to
trace thoir operational rrornmunications, ~.
REQA #36-1 1'_NQ_FQRN,X]! ooooooorzs
' ' ._. .., -. ._,. I< ... _ 921.' . . . ..--.".... . _.__....,.._...._.- .~ _
- 5 J M , -r>h.J»>_;__nu> ...,92_¢.L|a:»_92
1
~
1 I 0 9
l.. " t , ss¬Q;T.r~roroRN.xo
1' ,,._ 1 ~;- Q1".-.. 92 .. _ M»»92'924.: -ll '-1, ..92|V The ll. S%epte~mber Hijacker Cell Model bl
Sf/NF! Al-Qalda leaders and key 11 September plotters such as Usama Bin Ladin, Khalid
Shaykh Muhammad KSM!, and Ayman al-Zawahiri probably have derived lessons; from the
activities and experiences of the ll September hijackers and may be relying on them to plan
future attacks against the US. |: E: I]
- The ll Se temberi lot was at least two years in the al-P P
Qafida operative calling himself Ubaydah" claimed in a videotaped interview in June Z002
that 31-Q&1'l l3~S¬Hi a reconnaissance team to the US two _years before the 1,1 September operation.
We have no information to conrm that this rqconnairssance operation occurred or that it can
be tied to the ll September attacks, but it is consistent with al-Qaficla trad;er:ralt that calls for
long and detailed planning for major operations.
~ Al-Qai.da has lost its camps in Afghanistan where the plot was largely honed anti
the hijackers were trained, but between 10,000-2ll,0 lll potential terrorists trained in
the camps and al-Qaidals networks in countries such as Pakistan, Saudi Arabia, and
Indonesia leave it with an ample pool of potential recruits for future attacks.
U! Snapshot of the Hijackers
LES! Al-Qaidas criteria? in choiosinrg the 11 September hijackers is unknown, but one of the
most important factors probably was their ability to not arouse suspicion from US or foreign
intelligence and law enforcement services.
~ The hijackers used Western-style clothing and grooming once in the US.
* The hijsacikers. were all Middle Eastern men between 20 and 33 years of age. Many of them
spent time in Afghanistan in either late 19919 or 2000, according to a variety of rcportingi
~ Personal connections and family ties among the hijackers also may have been important;
among the 1.9 were two sets of brothers--Waled and Wai1al-Shehri andiltlawaf and Salim al-
Hazmi~and other sub-groupings in which individuals. appear to have known each other for
years before the plot. 4
U! How They Entered the US
LES! The hijackers entered the US legally on valid visas--15 on B1 tourist visas, three on B2
business visas, and one on a F1 student visa-using their true names.
' Thirteen of the 19 hijacl-tors traveled to the US in groups of two or three-the four pilots,
Mohamed Atta, Marv/an al~Shehhi, Haini Hanjour, and Ziad Jarrah are notable exceptions.
S%Tl1ORCON.NOFORN,X I!REQ- #36-1 i 000000026
-....._-.- . . _, _ _
l MM
_...,,,,. . < .. . < . ~ .._.,M....-,.. _,.. .t .. ..I
' n
lt 1
rsE§QT.Noi=oRn.xii»; 92 . K . , if V MW if , AV _. ; 1 .. r.__;.§-_-, _ ,__ __ _,__
t V. -_-KI " . -. ~'~: -> 5; _.~x_~_. »,. V" ,.,
s The hijackers arrived in the US on eight different airliners: United, Delta, Virgin Atlantic,
Swiss Air, Sabena, Cesrkosiovslci Air, Condor, and SaudiAirlines.r Their ights departed from
Brussels, Frankfort, London, Bangkok, Zurich, Riyadh, Paris, and Prague, and they arrived in
Newark, Atlanta, San Diego, Orlando, Miami, tvashirtgton,-Dulles, New r'orl<~JFK, nd L08
Angeles.
-r The four pilots acquired their travel documents»-passports from Saudi Arabia, United Arab
Erriirate UAE!, and Egypt, and visas issued in Jeddah, Saudi Arabia; Dubai, UAE; and
Berlin, Germany-hetween one and live months before entering the US. The other hijackers
acquired their d0euments-Sau<li and UAE passports with visas issued mostly in Jeddah and
Riyadhfrem several months to more than a gear before entering the US
~ Most of the hijackers reported their previous passports as lost or stolen and received new
ones that revealed no travel to Afghanistan,-~ea potential red flag" that might have invited
scrutiny even prior to ll September.
U! Where They Lived and What They Drove
LES! The hijackers choices for living arrangements and cars were nondescript and likely would
not have in themselves raised suspicion.
' The hijackers usually lived in small groups of two to ve and routinely moved between cheap
motels -and apatrtmenets. The pilots maintained relatively stable residence during their ight
training, obtaining apartments for approximately six months.
e't They owned four older non-deseript vehicles: Nawafal-He2rnis 1988 Toyota Corolla,
Iarrahs [990 Mitsubishi Eclipse, Waleed al-Shehri's 1993 Dodge Colt and Attas 1989
Pontiac Gran Prix. The hijackers also rented a variety of vehicles 2'7 times from several companies,
including Enterprise, Budget, and Alamo.
U! Identication Used
LES! Many ofthe hijackers obtained identication, cards or driver licenses to rise instead of
their passports, which would have called attention to them as foreigners. .
* Eight ehijackers obtained driver licenses from Arizona, California, and Florida, l6 obtained
state idemiiication cards from Florida and Virginia, and seven obtained commercially available
ID cards. None had social security numbers,
~ At least two hijackers requested duplicate Florida, driver licenses, and both Alta and al-Shehhi
requested replacement pilot licenses, leaving open the possibility that Ell-Q8'id~8 forgers
received the originals or duplicates and can try to reproduoe these items».
REQ. #35,-1 S ,NOFORN,Xi! 000000027
i
_.., _»._v.~.,_ Y ,,. __¥ _ _ d7___7_*_li____, _ ___ _ _ _
l' '_
. tr
S FORN,Xl!. r T552 I 1
. ; '~f!_;¢ 1.». 3; .,, ~>~ Q }:' - V . -.' -. ", *92;;st_,:~.- /. Q, ;_ V ___.._W~ W _-1?, 1 _ i _.~,. 1. ,5 A ._,92"i »: in T 4_ ,_v . E .
t LES! Mohamed Atta in Germany: His Conduct Before Coming to the US
l LES! As an expatriate in Europe, Atta behaved much like the typical budding jihadist. It was
only after he apparently was tapped for his m_l'ssion-perhaps spotted and selected because of
this hehavior~and returned from Afghanistan that he began observing strict operational security
practicos.
-i Prior to early February 2000, Atta and his assocriatcs in Hiamburg--intzludingl 11 Septecmbcer
pilots Marwan al-Shehhi and Ziad Jarrah-ware known to wear beards and Arab-style dress,
attended a mosque known for extremists views, and openly asswociated with radical gt1res-
all acts that contradict recommendations in al-Qaida training manuals not to behave in ways
that would attract law enforcement attention.
- After defending his thesis in October i999, A-tta left for Afghanistan and Pakistan in late
Nlosvembar and returned to Hamburg in late Fnbmary 2000, where he no longer appeared to be
outwardly radical, according to law enforcement and intelligence reporting- He did not wear
aboard or Arab-style dress and generally blended into the Western world. Shortly thereafter,
Attat applied for a new passport--apparently both to disguise his travel to Afghanistan and
to acquire ca new photograph-made inquires to US ight schools, received a U S visa, and
- spread word to family and friends that he was leaving Germany to continue his education.
U! Flight Schools
LES! The hijackers enrollment at multiple US ight schools was not in itself uncommon, but
their focus on learning only the skills that would benet their milsslon<-such as Atta and al
Shehhi requesting advanced jet flight training that focusesd on approaches and turns but not on
take-offs and landings-made them stand-out. 0
~ Between June 2000 and September 2001, Atta, at-Shclthi, and Jarrah took ying classes,
underwent ight simulator training, and flew test ights in at least height facilities in Florida
and Georgia. Alta and al--Shehhi also visited tho Airman Flight School in Oklahoma.
' Hanjour altltendod threc ight schools in Arizona and Califomia between 1996 and 1999.
Alter renaming to the US in December 2000, he took jet simulator lessons in Arizona and
rented planes from at least ve other facilities in Arizona, New Jersey, and Maryland.
' Two other hijackers briey took iintroiductory flying lessons in San Diego in spring of 2000,
but neither sought further ight training.
REQ ~ #364 l SP%ET,NOFGRTN_Xll! 990999923
tv~
.. 0 9
Y 1 -,'i V st; _T,NOFORN,Xl! l
.. =_ 5- -v_-'3 , .y4-pt
~ s ~ ~=~* M ~ W r
_',92j_":.-1, ~ K ~'i>"_':_';- ,p*r ;v_'_____.. _._ H .. -. no
U! Banking in the US ~
LES! The hijackers nanced their operation with money electronically translerredi from overseas
as well as with cash and traveler checks they carried--and declaredwhen they entered the US.
They opened US bank accounts and used; them legally, but they favored an llnusual practice of
sihari»ng accounts between unrelated members. None ofthe hijackers worked to supplement this
funding.
- The hijackers, oen in pairs, used 24 bank accounts, from branch banks belonging to Sun
Trust, Hudson United, First Union, Bank ofArnericsa, and Dime Savings.
5
- As the Operation drew near, the hijackers closed the majority of their bank accounts and wired
most of the remaining rnoncy overseas through Wcstcm Union stations at bus terminals and
grocery stores.
U! How They Communicated
LES! The hijackers favored communications techniques designed to make operational discussions
difcult to trace.
~ They used pre-paid cealiing cards combined with poayphoncs to make operational telephone
calls to conspirators in the US as well as the Middle East and Germany, according to law
enforcement information They used cell phones to receive operational calls.
- They apparently reserved their most sensitive planning discussionos for face-t0~face meetings,
which likely were held three times in 2001; Germany in January, Spain in July, and Las Vegas
in mid-August.
~ At least nine hijackers used post office mailboxes from such places as Mail Boxes Etc and
Mail Depot, possibly to receive regular mail and to help establish residcnoel.
U! Businesses They Frequented
LES! Besides rental car businesses and commercially available post ofce boxes, the hijackers
also frequented several other businesses.
- Many of the hijackers worked outta: gyms-~possioly to help prepare them for subduing passengers
in taking over the airliners.
- They used Kinkos for photocopying unknown niatcrials and for computer rentals,
~ Marwan al-Shchhi also visited several bars during his stay in the US and along with Hamza
al~Gamdi Iwicc in July 2001 purchased a large amount of pornograp1hy-~$2s50, and S183
worthfrcun a Video Outlet store in Floricla.
3119- #354 <sr¬t} E'r,NOFoRN.xn 999090029
¬
L.
.
. . ' E' $#~§T.NOFORN,! l! L
.: V - W 1 ~__l__1 - :7?
., :. ;.;<. 4 92_ -' ,._:_-- " ~_4,
U! Rituals
LES! While the hijackers made a special effort to blend in and conceal their jihadist zeal, this
mask cracked in the closlnlg days ugf their mission.
~ A maid at the Days Inn in Boston where the Flight 1'75 hijackers stayed the night before the
attack reported nding La large amount of body hair in the room, all of the rooms lotion used A
pessibly to aid the shaving-and that they had only slept on top of their beds
- Copies of the same letter were recovered from the_hijackers belongings that aemileld steps and
prayers that were,-to be followed before the attacksé.
REQ . #3¬~"- 1 Vs 'NQFORN'X~}! Q 00 QQ Q Q 30b2
b5
ma:
13;"/D
Q Q
~ 2T.o-
1.
1 SECRET,NOFORN,X 1!
5 - * ": "*r92."_~
e92 '-" ; W " " ~ 1" =- >, rr e W"
T. 1; -,, '1 "' -Q. -' .. ._-92 -lV .'. '. -=,,-, . X
LES! Annex A: Rsrnzi Yousefs and the ll September Hijackers Operational 'Iradeera,l't
LES! There are some similarities between the 1993 World Trade Center WTC! bombers led by
Rirnzi Yousef and the 11 September hijackers, but there also are key differences that make it difcult
to establish a single pattern that sleeper cells in the US likely would follow.
LES! Key operational characteristics common to the I993 and 21101 plotters include:
V - Some of the conspirators from both plots arrived in the US at least six months prior to the
attacks-~in some cases, more than a year-~and members focused their time and energy in
preparing for the attacks. ~
* Some members of each plot used shared bank accounts.
- The key leaders of both plots~Youset and the ll September pil0tS-»-shareid a variety of personal
characteristics. They had broad exposure to the West-Yousefand three ofthe four pilots
studied in Weistcym Europe and had technical bacl=:gro~unds~spokc workable English, were in
their 20s or early 30s, and hailed from aluent families.
LES! Key operational differences include:
' Yousef and co-conspirato-r Mohammad Ajaj traveled together from ?aldstan and used false
names and documents to enter to the US, while all 19 hijackers used their true names, legitimate
passports, and secureti visas to enter the country.
~ Yousef used at least four passports and three different names to enter, operate, and exit the
US, while the hijackers acquired legitimate forms of identications, such as driv_ers licenses
and state identication cards in their true name.
or Yousef relied on a local network of childhood friends and individuals introduced to him by
others after his arrival in the US to carry out his attack. Most had no signicant training and
indoctlrination, and one conspirator was brought into the plot two weeks before the attack.
Conversely, the hijackers relied mainly on experienced, well-trained manpower from abroad
and did not bring unknown individuals into their plot latter arriving in the US.
' The 1993 conspirators frequently made overseas phone calls from their residences, while
the hijackers relied on prepaid cell phones, calling cards, and Internet cafes to communicate
abroad. Youscf had ea personal computer, but the hijackers are not known to have owned laptop
or desktop computers or any electronic data storage media.
R29 #36 c$E§[Qor,~01=om~1.ext_1 909099031
~ O Ov 1 V I 9292
l 1- .'92!>|;92,l ' .~. :-. SW T,NOPORN.Xl!Z 195" K
J;",¢-v";92.':_'I§:_.* WK 1.. _ _. . '~>-_ _ __ . t= N __;.~i"t-._,W._ : .51 ,',_xT_ -=_,.~:._,__92.* x»»~ t |.~ .
LES! Annex B: Ahmed Ressam and the 11 September Hijackers Tactics in the US: More
Contrasts in Tradecraft
LE8! There are few similarities between the Millennium bomber Ahmed Ressakn and his plot to
attack Lox Angeles airport and the 11 September .hija*ckers.
* Rcssams identication docmncnts»-including passpons, visas, driver liccnscs, social security
numbers, and credit cards-werc all fraudulently obtained in contrast to the 11 September
hijackers exclusive use of legitimate documentation.
-92 Rcssam applied for and was granted political asylum in Canada in 1994, inviting increased
scrutiny by Canadian immigration authorities. The ll September plotters sought no special
immigration status.
' Although Rcssam had lived in Canada since 1994, his English language abilities were poor,
probably a result of living in a predominantly Algerian commlmify The ll September piloi
all spoko workable English.
~ In contrast to the 11 September hijackcrs, neither Rcssam nor his associate, Abdcimajaid
Dahoumanc, conducted surveillance or rout: rchcarsals to the US, Oihr fha with a map-
~ In his debrielings, Rcssam has indicated that his cell was instructed to engagc in criminal
behavior such as credit card. aud and petty thc, to nance their terrorist-related activities;
Ressam was arrested for theft four times in only a Few years. The ll September hijackers
used lcginmatc US» bank accounts and neithmlcgally brought money to the US or had it elccitmnically
sent from the Middle East to their accounts.
' Like. the ll September hijackers, Ressam practiced operationalt security in communicating
with his associates, although not as well. Ressam used multiple pro-paid calling cards and
scvcral different pay phones, but used a cellular phone to leave messages at the local mosque
for associates to meet him thcrc.
Rm #36-1 c S 0FORN,Xl! QOQQMBZ
-_.~._ .... .-,l. 92, . ._ _, _, ~
¢ . .>_~a&: it.¢uv-r
, at
~:v.o~., » 0r I s@:3Em01=0aN.1<1!
1' .
#36,->-1 NQpQRNX1! 0QOQ0@O33~13» i T
.0
. < -;I
'..-".2 ~. ; » .._ W ,_,_ _ ._ {'4
~13 » 92-¢2; Z .,».92* v_» .,
U! Annex C: List of Hijackers and Planes
American Airlines Flight I1
Departed Boston~Corashed into the north tower of the World Trade Center
76 passengorsgand ll crew
Mahamcd Atia
Satam al-Suqarni
Waled air-Shehzi
Wail a'I~$hehri
Abdulaziz al-Omari
United Airlines Flight 175
Departed BostonCrashed into the south to war of the World Trade Center
51 passengers and nine crew
Marwan at-Shehhi
Faye: Bardhammad
Ahmed al~Ghamd.i
Hamza all-Gamdi
Mohand al-Shhri
American Airiines Flight 77
Departed Washington Dullrzs--C_rashcd into the Pentagon
53 passengers and sixrcrew
Hani Hanjour
Khalid al-Mihdhar
Majed Moqed
Nawaf a1-Hazmi
Salon: a1~Hazmi
United Airlines Flight 93
Departed Newark-Crashcd near Stony Crock Township, Pennsylvania
33 passengers and seven crew
Ziad Iarrah
Saecd al~Ghamdi
Ahmed aJ~Haznawi
Ahmed ali-Nami-v,-