Foresight — and Hindsight

Key Passages from The 911 Commission Report

Chapter 11 “Foresight — and Hindsight,” pp. 339-360

Emphasis added.
p. 341

A National Intelligence Estimate distributed in July 1995 predicted future terrorist attacks against the United States-and in the United States. It warned that this danger would increase over the next several years. It specified as particular points of vulnerability the White House, the Capitol, symbols of capitalism such as Wall Street, critical infrastructure such as power grids, areas where people congregate such as sports arenas, and civil aviation generally. It warned that the 1993 World Trade Center bombing had been intended to kill a lot of people, not to achieve any more traditional political goal. It warned that the 1993 World Trade Center bombing had been intended to kill a lot of people, not to achieve any more traditional political gain.

This 1995 estimate described the greatest danger as “transient groupings of individuals” that lacked “strong organization but rather are loose affiliations.” They operate “outside traditional circles but have access to a worldwide network of training facilities and safehavens.”…

In 1996-1997, the intelligence community received new information making clear that Bin Ladin headed his own terrorist group, with its own targeting agenda and operational commanders. Also revealed was the previously unknown involvement of Bin Ladin’s organization in the 1992 attack on a Yemeni hotel quartering U.S. military personnel, the 1993 shootdown of U.S. Army Black Hawk helicopters in Somalia, and quite possibly the 1995 Riyadh bombing of the American training mission to the Saudi National Guard. The 1997 update of the 1995 estimate did not discuss the new intelligence. It did state that the terrorist danger depicted in 1995 would persist. … The 1997 update was the last national estimate on the terrorism danger completed before 9/11.

[Comment — Why was this new intelligence not included in the 1997 NIE update?]

p. 343

…[G]overnment experts who saw Bin Ladin as an unprecedented new danger needed a way to win broad support for their views, or at least spotlight the areas of dispute, and perhaps prompt action across the government. The national estimate has often played this role….Such assessments, which provoke widespread thought and debate, have a major impact on their recipients, often in a wider circle of decisionmakers. The National Intelligence Estimate is noticed in the Congress…[but] none was produced on terrorism between 1997 and 9/11.

[Comment — The Report gave no explanation for why no NIEs were produced. ]

By 2001 the government still needed a decision at the highest level as to whether al Qaeda was or was not “a first order threat,” Richard Clarke wrote in his first memo to Condoleezza Rice on January 25, 2001. In his blistering protest about foot-dragging in the Pentagon and at the CIA, sent to Rice just a week before 9/11, he repeated that the “real question” for the principals was “are we serious about dealing with the al Qida threat? . . . Is al Qida a big deal?”

One school of thought, Clarke wrote in this September 4 note, implicitly argued that the terrorist network was a nuisance that killed a score of Americans every 18-24 months. If that view was credited, then current policies might be proportionate. Another school saw al Qaeda as the “point of the spear of radical Islam.” But no one forced the argument into the open by calling for a national estimate or a broader discussion of the threat. The issue was never joined as a collective debate by the U.S. government, including the Congress, before 9/11.

p. 344-345

In late 1998, reports came in of a possible al Qaeda plan to hijack a plane. One, a December 4 Presidential Daily Briefing for President Clinton (reprinted in chapter 4), brought the focus back to more traditional hostage taking; it reported Bin Ladin’s involvement in planning a hijack operation to free prisoners such as the “Blind Sheikh,” Omar Abdel Rahman. Had the contents of this PDB been brought to the attention of a wider group, including key members of Congress, it might have brought much more attention to the need for permanent changes in domestic airport and airline security procedures.

Threat reports also mentioned the possibility of using an aircraft filled with explosives. The most prominent of these mentioned a possible plot to fly an explosives-laden aircraft into a U.S. city. This report, circulated in September 1998, originated from a source who had walked into an American consulate in East Asia. In August of the same year, the intelligence community had received information that a group of Libyans hoped to crash a plane into the World Trade Center. In neither case could the information be corroborated.…

p. 345 After the 1999-2000 millennium alerts…Clarke held a meeting of his Counterterrorism Security Group devoted largely to the possibility of a possible airplane hijacking by al Qaeda. In his testimony, Clarke commented that he thought that warning about the possibility of a suicide hijacking would have been just one more speculative theory among many…Yet the possibility was imaginable, and imagined. In early August 1999, the FAA’s Civil Aviation Security intelligence office summarized the Bin Ladin hijacking threat. [T]he paper identified a few principal scenarios, one of which was a “suicide hijacking operation.” The FAA analysts judged such an operation unlikely…[as] an option of last resort.”19 p. 346

The North American Aerospace Defense Command [NORAD] imagined the possible use of aircraft as weapons, too…. One idea, intended to test command and control plans and NORAD’s readiness, postulated a hijacked airliner coming from overseas and crashing into the Pentagon. The idea was put aside in the early planning of the exercise as too much of a distraction from the main focus (war in Korea), and as too unrealistic…

Since the Pearl Harbor attack of 1941, the intelligence community has devoted generations of effort to understanding the problem of forestalling a surprise attack….These methods … almost all seem to have at least four elements in common: (1) think about how surprise attacks might be launched; (2) identify telltale indicators connected to the most dangerous possibilities; (3) where feasible, collect intelligence on these indicators; and (4) adopt defenses to deflect the most dangerous possibilities or at least trigger an earlier warning… Considering what was not done suggests possible ways to institutionalize imagination. To return to the four elements of analysis just mentioned: p.347 1. The CTC did not analyze how an aircraft, hijacked or explosives-laden, might be used as a weapon. It did not perform this kind of analysis from the enemy’s perspective (“red team” analysis), even though suicide terrorism had become a principal tactic of Middle Eastern terrorists. If it had done so, we believe such an analysis would soon have spotlighted a critical constraint for the terrorists — finding a suicide operative able to fly large jet aircraft. They had never done so before 9/11.

2. The CTC did not develop a set of telltale indicators for this method of attack. For example, one such indicator might be the discovery of possible terrorists pursuing flight training to fly large jet aircraft, or seeking to buy advanced flight simulators.

3. The CTC did not propose, and the intelligence community collection management process did not set, requirements to monitor such telltale indicators. Therefore the warning system was not looking for information such as the July 2001 FBI report of potential terrorist interest in various kinds of aircraft training in Arizona, or the August 2001 arrest of Zacarias Moussaoui because of his suspicious behavior in a Minnesota flight school. In late August, the Moussaoui arrest was briefed to the DCI and other top CIA officials under the heading “Islamic Extremist Learns to Fly.” Because the system was not tuned to comprehend the potential significance of this information, the news had no effect on warning.

4. Neither the intelligence community nor aviation security experts analyzed systemic defenses within an aircraft or against terrorist-controlled aircraft, suicidal or otherwise. The many threat reports mentioning aircraft were passed to the FAA. While that agency continued to react to specific, credible threats, it did not try to perform the broader warning functions … No one in the government was taking on that role for domestic vulnerabilities…

The methods for detecting and then warning of surprise attack that the U.S. government had so painstakingly developed in the decades after Pearl Harbor did not fail; instead, they were not really tried. They were not employed to analyze the enemy that, as the twentieth century closed, was most likely to launch a surprise attack directly against the United States.


The most serious weaknesses in agency capabilities were in the domestic arena. In chapter 3 we discussed these institutions-the FBI, the Immigration and Naturalization Service, the FAA, and others. The major pre-9/11 effort to strengthen domestic agency capabilities came in 2000, as part of a millennium after-action review. President Clinton and his principal advisers paid considerable attention then to border security problems, but were not able to bring about significant improvements before leaving office. The NSC-led interagency process did not effectively bring along the leadership of the Justice and Transportation departments in an agenda for institutional change.

The FBI did not have the capability to link the collective knowledge of agents in the field to national priorities. The acting director of the FBI did not learn of his Bureau’s hunt for two possible al Qaeda operatives in the United States or about his Bureau’s arrest of an Islamic extremist taking flight training until September 11.The director of central intelligence knew about the FBI’s Moussaoui investigation weeks before word of it made its way even to the FBI’s own assistant director for counterterrorism.


One missing element was effective management of transnational operations. Action officers should have drawn on all available knowledge in the government. This management should have ensured that information was shared and duties were clearly assigned across agencies, and across the foreign-domestic divide.

Consider, for example, the case of Mihdhar, Hazmi, and their January 2000 trip to Kuala Lumpur, detailed in chapter 6. In late 1999, the National Security Agency (NSA) analyzed communications associated with a man named Khalid, a man named Nawaf, and a man named Salem. Working-level officials in the intelligence community knew little more than this. But they correctly concluded that “Nawaf”and “Khalid” might be part of “an operational cadre” and that “something nefarious might be afoot.” 9

The NSA did not think its job was to research these identities. It saw itself as an agency to support intelligence consumers, such as CIA. The NSA tried to respond energetically to any request made. But it waited to be asked.

If NSA had been asked to try to identify these people, the agency would have started by checking its own database of earlier information from these same sources. Some of this information had been reported; some had not. But it was all readily accessible in the database. NSA’s analysts would promptly have discovered who Nawaf was, that his full name might be Nawaf al Hazmi, and that he was an old friend of Khalid.

With this information and more that was available, managers could have more effectively tracked the movement of these operatives in southeast Asia.

Operational Opportunities

1. January 2000: the CIA does not watchlist Khalid al Mihdhar or notify the FBI when it learned Mihdhar possessed a valid U.S. visa.

2. January 2000: the CIA does not develop a transnational plan for tracking Mihdhar and his associates so that they could be followed to Bangkok and onward, including the United States.

3. March 2000: the CIA does not watchlist Nawaf al Hazmi or notify the FBI when it learned that he possessed a U.S. visa and had flown to Los Angeles on January 15, 2000.

4. January 2001: the CIA does not inform the FBI that a source had identified Khallad, or Tawfiq bin Attash, a major figure in the October 2000 bombing of the USS Cole, as having attended the meeting in Kuala Lumpur with Khalid al Mihdhar.

5. May 2001: a CIA official does not notify the FBI about Mihdhar’s U.S. visa, Hazmi’s U.S. travel, or Khallad’s having attended the Kuala Lumpur meeting (identified when he reviewed all of the relevant traffic because of the high level of threats).

6. June 2001: FBI and CIA officials do not ensure that all relevant information regarding the Kuala Lumpur meeting was shared with the Cole investigators at the June 11 meeting.

7. August 2001: the FBI does not recognize the significance of the information regarding Mihdhar and Hazmi’s possible arrival in the United States and thus does not take adequate action to share information, assign resources, and give sufficient priority to the search.

8. August 2001: FBI headquarters does not recognize the significance of the information regarding Moussaoui’s training and beliefs and thus does not take adequate action to share information, involve higher-level officials across agencies, obtain information regarding Moussaoui’s ties to al Qaeda, and give sufficient priority to determining what Moussaoui might be planning.

p. 357 The U.S. government must find a way of pooling intelligence and using it to guide the planning of and assignment of responsibilities for joint operations involving organizations as disparate as the CIA, the FBI, the State Department, the military, and the agencies involved in homeland security. p. 359 In the summer of 2001, DCI Tenet, the Counterterrorism Center, and the Counterterrorism Security Group did their utmost to sound a loud alarm, its basis being intelligence indicating that al Qaeda planned something big. But the millennium phenomenon was not repeated. FBI field offices apparently saw no abnormal terrorist activity, and headquarters was not shaking them up.

[Comment— Both the Phoenix and Minneapolis field offices reported something abnormal, but the information/requests they sent were apparently stopped at the same mid-level office.]

FAIR USE NOTICE: This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in our efforts to advance understanding of criminal justice, political, human rights, economic, democracy, scientific, and social justice issues, etc. We believe this constitutes a ‘fair use’ of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. For more information go to: If you wish to use copyrighted material from this site for purposes of your own that go beyond ‘fair use’, you must obtain permission from the copyright owner.