. 7?

é m
5

. IO
Q 2
,
Sl§§éET,NOFORJN,Xl!
% WW! _
rf!+i*" /

QATE: U3 2§ 2UB5
LA3SIFiED BY nana ans TRMKNLTECLQ
._,3 ,,
'
r356" "-3,1; M
*3 L,_s"1,a _ »f<§k. l¬¢1;1
1; ;,,
: H3
-- Eé ~HL§5¢i
~ [15 J

I1 -I E RI% I§%TI OI? CCJZ92TT}&#39;L

N E I13§
IN IE QNCLREEIFIEE EXCEPT
EHGWN QTHEEWISE

I/

The 11 September Hijacker

Cell Model
February 2003

Vv" dbw FB&#39;CT

Reason" -
Detf éity on:X1 M

REQ. #364, S%é¬T,NOFORN,Xl!

?oboonnoza

_mm:
fax 92 b
. , t

&#39;
.- a
6
J
°
l$o><E&#39;r.No1=0|uv.x|!
"/11 ~&#39;92-:_=Q§
,.-
9292 l-"_&#39;9292 V
:

The 11
September Hijacker Cello Model

U! EXECUTIVESUMMARY

U! Key
Flndinrgrtsin
"Tire11
September hijackers successfully
eluded the
of
notice US laweni o~rcemen_t and
intelligence they
as plotted
to commandeer
and use
four airliners
as weapons,
but details
their
of
lives andactivities canbe usedto detectcells thatmay
follow the 11September hijackersmodel.
It shouldbe noted,
however, that
the1993attack
on the WorldTrade Center
and theMillennium
bombing plot --theprevious two
major international
terrorist operations
on US soil- used tactics
that aredifferent in
key respects
from thell Septémher
model, suggesting
future sleeper
that cells
will use avariety of
measures to concealtheir" activities.

-The llSeptemberhijackers were

all MiddleEastcm men
between 20
and 33years of-age
who w0re"awastern styledress and grooming.
of

~The hijackers entered

the USlegally and
used either
their tmenames or
variations of
their
true names.
Thirteen of
the 19ihijackem traveled
to theUS ingroups of
two orthree--four
or theremaining sixwere thepilots.
< 92
~Once in thecountry, the
hijackers obtained
typical USidenti cation driver licenses,
state
identi cation cards,
and cormnorcially
available:rdocuments--likelyorder
in toavoid further
use of their passports.

~The hijackers changed

residcn os Frequently.

~The hijackers enrollment

at USflight schools
was notin itselfnecessarily uncrommorn,
but
their focus
during simulation
training onlearning only
tho skillsthat would
benefit their
mission
dlistlnguishcid them
from typicalstudents.

-The hijackers opened

bank aocounts ol in
tcnpairs- -with
money either
they brought
legally
into the US or wired from overseas.

* The.hijackers largely
avoided associating
with radical
Islamic groups
in theUS, likelyin an.
effort to reduce thechances ofdetection by law enforcement.

The l&#39;1i_l?1£El¬¬7I5&#39;GOII1IIlllIllCi!1iQrlS
&#39; meetings,tcchniqucsi
prepaid
phone.faoc-to~face
cards,
payphoncs,
phones, the Internet,
cell and possibly
cornrneroially available
mailboxes- madedifficult
it to
trace thoiroperational rrornmunications, ~.

REQA #36-1 1&#39;_NQ_FQRN,X]!

ooooooorzs
&#39;
._.
&#39; .., -. ._,. I< ... . . ...--.".... ._.__....,.._...._.-
_ 921.&#39; .~ _

-5 J M ,-r>h.J»>_;__nu>
...,92_¢.L|a : »_9
 1

1 I0.. " t l
9,
ss¬Q;T.r~roroRN.xo
1&#39; 1~;-
,,._ Q1".-
. .. 92 _M .
»»92&#39;924.: -ll &#39;-
1,| ..92
V The ll.
S%epte~mber
Cell
Hijacker
Model bl

Sf/NF! Al-Qa ldaleaders andkey 11September plotters

such as
Usama Bin Ladin, Khalid
Shaykh Muhammad KSM!, andAyman al-Zawahiri
probably have
derived lessons;
from the
activities and
experiences the
of ll September hijackers
and maybe relyingon
them to plan
future attacks
againstUS.
the |: E:
I]
-The
ll Se
temberi
was
PP least
lot
atyears
two
thein al-
Qafida operative
calling himself
Ubaydah" claimed
in avideotaped interview
in June
Z002
that 31-Q &1&#39;l
a reconnaissance
l3~S¬Hi team to
the UStwo _years
before the
1,1 September
operation.
We have
no information
to con rmthat this
rqconnairssance operation
occurred that
or itcan
be tiedto thell September
attacks, but
it isconsistent with
al-Qaficla trad;er:ral
that calls
t for
long anddetailed planning
for majoroperations.

~Al-Qa i.da has lostits campsin Afghanistanwhere theplot waslargely honedanti

the hijackers
were trained,
but between
10,000-2ll,0 lll potential
terrorists trained
in
the camps
and al-Qaidals
networks incountries such
as Pakistan,
Saudi Arabia,
and
Indonesia leaveit with an amplepool ofpotential recruits for future attacks.

U! Snapshot of theHijackers

LES! Al-Qa ida scriteria? in

choiosinrg the
11 September hijackers isunknown, but
one ofthe
most importantfactors probablywas theirability tonot arousesuspicion from
US orforeign
intelligence andlaw enforcementservices.

~The hijackers used

Western-style clothing
and grooming
once inthe US.

*The hijsacikers.all
were
Middle
Eastern men
between and
20 33
years of
age. Many
of them
spent time
in Afghanistan
in eitherlate 19919
or 2000,according to
a variety
of rcportingi

~Personal connections and

family tiesamong thehijackers also
may havebeen important;
among the
1.9 were
two sets
of brothers- -Waled
and Wa i1al-Shehri
andiltlawaf and
Salim al-
Hazmi ~ and other
sub-groupingswhich
in individuals.
appear to
have known each other
for
years beforethe plot. 4

U! How They Entered the US

LES! The hijackers enteredthe US

legally on valid visas--15 onB1
tourist visas, threeon B2
business visas,and one on aF1 student vis a -using their true names.

Thirteenof the19 hijacl-tors

&#39; traveled to
the USin groups
of twoor three-thefour pilots,
Mohamed Atta,
Marv/an al~Shehhi,
Haini Hanjour,
and ZiadJarrah arenotable exceptions.

REQ- #36-1
S%Tl1ORCON.NOFORN,X
i 000000026
I!
-....._ -.-.. _,_ _

l MM
 I

&#39;
n t l
1

»;
92 . K
V_.; 1 .. r.__;.§-_-,_
. , ifrsE§QT.Noi=oRn.xii
,____
V MW
_,__
if , A
V.~&#39;~:
.t -. - » -_-K
> I"5;_.~x_~_.
,. V",.,

s Thehijackersarrivedin theUS oneightdifferentairliners:

United,Delta,VirginAtlantic,
SwissAir, Sabena,Cesrkosiovslci
Air, Condor,
andSaudiAirlines.rTheir ightsdeparted from
Brussels,
Frankfort,London,Bangkok, Zurich,Riyadh,Paris,andPrague, andtheyarrivedin
Newark,Atlanta,SanDiego,Orlando, Miami, tvashirtgton,-Dulles,
New r&#39;orl<~JFK,
nd L08
Angeles.

-r The fourpilotsacquired
theirtraveldocuments»-passports
fromSaudiArabia,UnitedArab
ErriirateUAE!, andEgypt,andvisasissued
in Jeddah,
SaudiArabia;Dubai,UAE;and
Berlin,Germany- hetween oneandlivemonths beforeentering
theUS. Theotherhijackers
acquired
theird0euments-Sau<li
andUAEpassports
withvisas
issued
mostly
in Jeddah
and
Riyadh fremseveral
monthsto morethana gearbeforeentering
theUS

~ Mostof thehijackers
reported
theirprevious
passports
aslostor stolenandreceived
new
onesthatrevealed
notraveltoAfghanistan,-~ea
potentialredflag"thatmight
haveinvited
scrutinyevenpriorto ll September.

U! Where They Lived and What They Drove

LES! Thehijackerschoices
forlivingarrangements
andcarswerenondescript
andlikelywould
not have in themselvesraisedsuspicion.

&#39;
Thehijackers
usually
livedin smallgroups
oftwoto veandroutinely
movedbetween cheap
motels
-and
apatrtmenets.
Thepilotsmaintained
relatively
stable
residence
during
their ight
training,
obtaining
apartments
forapproximately
sixmonths.
e&#39;t
Theyowned
fouroldernon-deseript 1988
vehicles:
Nawafal-He2rni s Toyota
Corolla,
Iarrah s[990 Mitsubishi
Eclipse,Waleedal-Shehri&#39;s
1993DodgeColtandAtta s1989
Pontiac
GranPrix.Thehijackers
alsorenteda varietyof vehicles
2&#39;7
timesfromseveral
companies,
includingEnterprise,Budget,andAlamo.

U! Identi cation Used

LES! Manyofthehijackers
obtained
identi cation,
cardsor driverlicenses
to riseinstead
of
their passports,
which wouldhavecalledattentionto them asforeigners. .

* Eightehijackers
obtained
driverlicenses
fromArizona,
California,
andFlorida,
l6 obtained
stateidemiiication
cardsfromFloridaandVirginia,andsevenobtained
commercially
available
ID cards. None hadsocialsecuritynumbers,

~ At leasttwohijackersrequested duplicate
Florida,
driverlicenses,
andbothAltaandal-Shehhi
requested replacementpilotlicenses,
leavingopenthepossibility thatEll-Q8&#39;id~8
forgers
received theoriginals
or duplicates
andcantry to reproduoe theseitems».

REQ.
#35,-1 S ,NOFORN,Xi! 000000027
_...,,,,. . < .. . < . ~ .._.,M....-,.. _,.. .t .. ..

i
_.., _»._v.~.,_ Y,,. __¥ _ _d7___7_*_li____, _ ____ _ _

v~
l&#39; &#39;_

.tr

.
>~Q
r T552
.; &#39;~f!_;¢
1.».
.,, 3;
I 1
}:/.";_ V___.._W~
S FORN,Xl!
~
,&#39; - V . -.&#39;
*92;;st_,:~.-Q, -. W _
-1?,1 _ i_.~,
. 1. ,5 A._
, 92" in
i »:T 4
_,_v. E.

t LES! Mohamed Attain Germany: His ConductBefore Comingto the US

l LES! As an expatriate in Europe, Attabehaved muchlike the typical buddingjihadist. It was

only after he
apparently was tapped for his m_l&#39;ssion- perhaps spotted
and selected
because of
this hehavior ~and returned from Afghanistan that he
began observing strict operational security
practicos.

-i Priorto earlyFebruary 2000,

Atta andhis assocriatcs
in Hiamburg--intzludingl
11 Septecmbcer
pilots Marwan al-Shehhi
and ZiadJarrah -ware knownto wearbeards
and Arab-styledress,
a mosque known
attended for extremists
views , and
openly asswociated
with radical
gt1res -
all acts that contradict recommendations inal-Qa ida training manuals notto behavein ways
that would attract law enforcement attention.

-After defending histhesis inOctober i999,A-tta leftfor Afghanistan

and Pakistan
in late
Nlosvembar and
returned toHamburg inlate Fnbmary 2000,wherehe
no longer appeared to be
outwardly radical, according to law enforcement and intelligencereporting- He did
not wear
aboard or Arab-style dressand generallyblended
into the Westernworld. Shortly thereafter,
applied
Attat for a new passport--apparently
both todisguise histravel toAfghanistan and
to acquire ca newphotograph- made inquires to US ight schools, received aU Svisa, and
-spread word to family andfriends thathe
was leaving Germany
to continuehis education.

U! Flight Schools

LES! The hijackers enrollmentat multiple US ight schools wasnot in itself uncommon,but
their focus on learningonly theskills that would bene t their milsslon <-such
as Attaand al
Shehhi requestingadvanced jetflight training that focusesd on approachesand turns but not on
take-offs and
landings-made them
stand-out. 0

~Between June 2000and September2001, Atta, at-Shclthi, andJarrah took ying classes,
underwent ightsimulator training,
and flewtest ights in atleast height
facilities inFlorida
and Georgia.Alta andal--Shehhi also
visited thoAirman FlightSchool inOklahoma.

&#39; Hanjour
altltendod threc
ight schoolsin Arizonaand Califomiabetween 1996
and 1999.
Alter renaming
to theUS inDecember 2000,
took jet simulator
he in
lessons Arizona and
planes
rented from atleast veother facilitiesin Arizona,New Jersey,
and Maryland.

&#39;other
Two hijackers
brie y tookiintroiductory flying
lessons in
San Diego
in springof 2000,
neither
but sought further ight training.

REQ
~#364 l SP%ET,NOFGRTN_Xll! 990999923
t
 ..0 Y 1
9
-,&#39;
i V st; _T,NOFORN,Xl! l
.. =_5- -v_-&#39;3
.y4-pt ,

~ s~ M
~=~* ~ W r
~
_&#39;,92j_":.-1,
K ~&#39;i>"_&#39;:_&#39;;
- r ;v_&#39;_____..
,pH* .
_._
. -. no

U! Banking in the US ~

LES! Thehijackersnanced
theiroperation
withmoney
electronically
translerredi
fromoverseas
aswell aswith cashand travelercheckstheycarried--anddeclared whentheyenteredthe US.
They openedUS bank accounts andused;themlegally,but theyfavoredan llnusualpracticeof
sihari»ng accounts
betweenunrelatedmembers.Noneofthe hijackersworkedto supplement this
funding.

- Thehijackers, 24
o enin pairs,used bankaccounts,
frombranchbanksbelonging
to Sun
Trust,HudsonUnited, FirstUnion, BankofArnericsa,
and Dime Savings.
5

- As theOperation
drewnear,thehijackers
closedthemajorityof theirbankaccounts
andwired
Union
mostof the remainingrnoncyoverseasthroughWcstcm stationsat busterminalsand
grocery stores.

U! How They Communicated

LES!Thehijackers
favored
communications
techniques
designed
tomake
operational
discussions
dif cult to trace.

~ Theyusedpre-paidcealiingcardscombined withpoayphoncsto makeoperational

telephone
callsto conspirators
in theUS aswell astheMiddleEastandGermany, accordingto law
enforcementinformationTheyusedcellphones to receiveoperational
calls.

- Theyapparently
reserved
theirmostsensitive
planning
discussionos
forface-t0~face
meetings,
2001; Germanyin January,
whichlikelywereheldthreetimesin Spainin July,andLasVegas
in mid-August.

~ At leastninehijackers
usedpostofficemailboxessuch
from places
asMail BoxesEtcand
Mail Depot,possiblyto receiveregularmail and to help establishresidcnoel.

U! Businesses
TheyFrequented

LES! Besides
rentalcar businesses
andcommercially
availablepostof ceboxes,thehijackers
also frequentedseveral other businesses.

- Many of thehijackersworkedoutta:gyms- ~possi to

oly
helppreparethemforsubduing
passengers
in takingover the airliners.

- TheyusedKinkosforphotocopying
unknown
niatcrials
andforcomputer
rentals,

~ Marwan
al-Shchhi
alsovisited
several
barsduring
hisstayintheUSandalong
withHamza
al~Gamdi a
Iwiccin July2001purchasedlargeamountof pornograp1hy-~$2s50,
andS183
worth frcun a Video Outlet store in Floricla.
3119-#354 <sr¬t} E&#39;r,NOFoRN.xn 999090029
¬
L.

.
. .
&#39;
E
&#39; $#~§T.NOFORN,!
L l!
.: V - 1
W ~__l__1 - :7?
.,. 492_-&#39;
:. ;.;<"~_4,
,. _: _--

b2

b5
ma
13;

U! Rituals

LES! While the hijackersmadeaspecial effort to blend

in and conceal
their jihadist zeal,
this
mask cracked in the closlnlg daysugftheir
mission.

~A maid atthe DaysInn in Boston where

the Flight1&#39;75 hijackers
stayed the
night beforethe
attack reported
nding La
large amount
of bodyhair inthe room,
all ofthe rooms
lotion used A
pessibly toaid theshaving-and thatthey hadonly slepton topof theirbeds

-Copies of thesame letter

were recovered
from the_hijackers
belongings that
aemileld steps
and
prayers thatwere,-to befollowed before the attacksé.

REQ
.#3¬~"-
1 Vs &#39;NQFORN&#39;X~}! Q QQ
00
QQ30
T . o-
1.

Q Q
~ 2
1 1!
SECRET,NOFORN,X
5 *- ": "*r92." _~
; >,
e 92 =-&#39;-" Wrr e W" " " ~ 1"
T.&#39;
1;.. -,,
&#39;1
"&#39;
-Q-l-.
._-92
V.&#39;. -&#39;.
. ,-,
=, X

LES! AnnexA: RsrnziYousef and ll

s the SeptemberHijackers Operational&#39;I radeera,l&#39;t

LES! There are somesimilaritiesbetweenthe 1993WorldTradeCenter WTC! bombersled by

RirnziYousef
andthe11September
hijackers,
buttherealsoarekeydifferences
thatmakeit dif cult
to establisha singlepatternthatsleepercellsin theUS likelywouldfollow.

LES! Key operationalcharacteristics 21101 plottersinclude:

commonto the I993 and

V - Some
of theconspirators
frombothplotsarrived
in theUSat leastsixmonths
priortothe
attacks-~in
somecases,morethana year-~andmembers
focused
theirtimeandenergyin
preparing
fortheattacks. ~

* Somemembers
ofeachplotused
shared
bankaccounts.

- Thekeyleaders of bothplots~ Youset ll

andthe Septemberpil0tS-»-shareid
a varietyof personal
characteristics.
Theyhadbroadexposure to theWest - Yousef three
and ofthefourpilots
studiedin Weistcym
Europeandhadtechnical bacl=:gro~unds~ workable
spokc English, werein
early
their 20s or 30s,and hailed froma luent families.

LES! Key operationaldifferences

include:

&#39;
Yousefandco-conspirato-r
Mohammad
Ajaj traveledtogether
from?aldstan
andusedfalse
namesand documents
to enterto the US, while all 19 hijackersusedtheirtruenames,legitimate
passports,
andsecureti
visasto enterthecountry.

~ Yousefusedat leastfourpassports
andthreedifferentnamesto enter,operate,
andexitthe
US, whilethehijackersacquired
legitimate
formsof identi cations,
suchasdriv_erlicenses
s
and state identi cation cards in their true name.

orYousefreliedona localnetworkof childhood friendsandindividuals

introduced
to himby
othersafterhisarrivalin theUS to carryouthisattack.Mosthadnosigni cant
trainingand
indoctlrination,
andoneconspiratorwas broughtinto the plot two weeksbeforethe attack.
abroad
Conversely,the hijackersrelied mainly on experienced,well-trained manpower
from
anddidnotbringunknown
individuals
intotheirplotlatterarrivingin theUS.

1993
&#39;
The conspirators their
frequentlymadeoverseasphonecallsfrom while
residences,
thehijackers
reliedonprepaidcellphones,
callingcards,andInternetcafesto communicate
abroad.Youscfhadeapersonal
computer,butthehijackers
arenotknowntohaveownedlaptop
or desktop
computers oranyelectronic
datastoragemedia.

#36
R29 c$E§[Qor,~01=om~1.ext_1
909099031
 ¢uv-r

v1
~O V I9292
O
l 1
-.&#39;92!>|;92, l &#39; .~
. Z 195"
:-. SW KT,NOPORN.Xl!
J;",¢-v";92 .&#39;:_&#39;I §:_.* WK 1.. _ _
.. &#39;~>-___ _ .t
= N __
;.~i"t-._,W._ .51:,
&#39;,_
t |.~. xTx»
»~ _ -= _,.~:._,__92.*

LES! AnnexB: Ahmed

Ressam and the11
September Hijackers Tactics
in theUS: More
Contrasts in Tradecraft

LE8! There
are few similarities
between the
Millennium bomber
Ahmed Ressakn
and hisplot to
attack LoxAngeles airportand the 11
September .hija*ckers.

*Rcssam s identi cation docmncnts » -including

passpons, visas, driver liccnscs,
social security
numbers, andcredit cards-wercall fraudulentlyobtained incontrast tothe 11September
hijackers exclusive
use oflegitimate documentation.

-92 Rcssam
applied for
and was
granted political
asylum inCanada in
1994, inviting
increased
scrutiny by
Canadian immigration
authorities. The
llSeptemberplotters sought
no special
immigration status.

Although Rcssam had

&#39; lived inCanada since
1994, his
English language
abilities were
poor,
probablyaresult of livingin apredominantly
Algerian commlmifyThellSeptemberpiloi
all spoko workable English.

~In contrast to
the 11September hijackcrs,
neither Rcssam
nor hisassociate, Abdcimajaid
Dahoumanc, conductedsurveillance or rout: rchcarsals to the US, Oih r fha with amap-

his debrielings, Rcssam

~ In has indicatedthat hiscell wasinstructed toengagc incriminal
behavior suchas creditcard. audand pettythc , to nance theirterrorist-related activities;
Ressam was arrested fortheft fourtimes inonly aFew years. ThellSeptember hijackers
used lcginmatc
US» bank
accounts and
neithmlcgally brought
money to
the US
or had
it elccitmnically
sent from the Middle East to their accounts.

&#39; the
Like.
llSeptemberhijackers, Ressampracticed operationalt
security in
communicating
with hisassociates, although
not aswell. Ressam used multiple
pro-paid calling
cards and
scvcral differentpay phones,
but useda cellularphone toleave messages
at thelocal mosque
for associates to meet him thcrc.

Rm #36-1 c S 0FORN,Xl! QOQQMBZ

-_.~._ .... .-,l. 92, .._ _ , _, ~

¢. .>_~a&: it .
 ~13» iT

, at
-v,-
.0

~:v.o~., » 0
r .
I s@:3E m01=0aN.1<1!
<-;
I

&#39;..-".2
; ».._
~. ,_
W
. ,_ _ ._ {&#39;4
1&#39;
~13 » 92-¢
2; Z .,».92* v_» .,

U! Annex
C: List of Hijackers andPlanes

American AirlinesFlight I1
Departed Boston ~Corashedinto thenorth
tower of theWorld TradeCenter
76 passengorsgand
ll crew

Mahamcd Atia
Satam al-Suqarni
Waled air-Shehzi
Wa il a&#39;I~$hehri
Abdulaziz al-Omari

United Airlines Flight 175

Departed Boston Crashed into the south towar of the World Trade Center
passengers and nine
51 crew

Marwan at-Shehhi
Faye: Bardhammad
Ahmed al~Ghamd.i
Hamza all-Gamdi
Mohand al-Sh hri

American Airiines Flight 77

Departed WashingtonDullrzs--C_rashcd intothe Pentagon
53 passengersand sixrcrew

Hani Hanjour
Khalid al-Mihdhar
Majed Moqed
a1-Hazmi
Nawaf
Salon: a1~Hazmi

United Airlines Flight 93

Departed Newark- Crashcd Stony
near Crock Township,
Pennsylvania
33 passengersand seven crew

Ziad Iarrah
Saecd al~Ghamdi
Ahmed aJ~Haznawi
Ahmed ali-Nami

#36,->-1 NQpQRNX1! 0QOQ0@O33