FACILITATING DISASTER: AN OVERVIEW OF 11 SEPTEMBER FINANCE

• Document Type: FOIA
• Collection: FOIA Collection
• Document Number (FOIA) /ESDN (CREST): 05433001
• Release Decision: RIPPUB
• Original Classification: U
• Document Page Count: 12
• Document Creation Date: March 9, 2023
• Document Release Date: July 26, 2021
• Case Number: F-2017-00397
• Publication Date: August 22, 2002

Approved for Release: 2021/07/26 C05433001
-SE-C-RST,
SECRET
(b)(3)
(b)(3)
(b)(3)
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
CCRET
Facilitating Disaster: An Overview of
11 September Finance
Key Finding
(b)(3)
The financial transactions that supported the 11 September attacks in many
ways reflected the overall nature of the operation, relying on ostensibly
legitimate activities carried out in the United States and Western Europe
over the course of more than two years. The hijackers and their financial
facilitators appear to have been well coached by an organizational
leadership with lengthy experience in moving funds unobtrusively. In the
pre-11 September atmosphere, the plotters' clean personal histories and
close adherence to an unobtrusive system of fmancial interaction that
supported the plot could not�absent additional cause for suspicion�have
alerted US officials or financial sector observers to the impending disaster.
Key characteristics of the financial support operation include
� Long-term planning. Transfers of significant funds related to the
operation began nearly two years before the attacks and appear to have
been calculated to cover specific training and travel needs.
� Division of labor. Each hijacker appears to have been responsible for
maintaining his own account and personal transactions, while three
hijackers generally assumed responsibility for communicating with
financial facilitators, receiving funds, and distributing them to other
hijackers.
� Pervasive use of cash. The plotters used cash to open accounts and
effectively concealed their day-to-day activities through cash withdrawals
rather than check or credit transactions.
� Trickle-down via intermediaries. The plotters obscured the operation's
ultimate funding sources by sending funds through various individuals
before reaching the final recipient.
� Exploitation of open economics. The operation's principal financial hubs
were the United Arab Emirates (UAE), Germany, and the United States,
in part because of the relative ease and anonymity with which financial
transactions can be conducted in these countries.
� External funding. Virtually all of the financial support for the attacks
came from abroad.
SECRE1
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
Al-Qa`ida almost certainly has interpreted the operation�given its
relatively low cost compared to the extensive damage inflicted�as a
financial success and may seek to replicate some elements of the plot's
financial tradecraft and methodology in future operations, particularly
high-impact attacks conducted in the United States.
� Al-Qa` ida's flexibility in adapting to new terrain will be aided by our
public discussion of the financial sector's response to the September
attacks and, despite new security precautions, will keep open the
possibility of another similarly orchestrated spectacular attack.
i;
3-E6RST
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
-3EGRE-T
Facilitating Disaster: An
Overview of 11 gentPnih r
Finance
The financial transactions that facilitated the
11 September operation reflect al-Qa`ida's ability to
exploit the international financial system and the
openness of Western societies. The hijackers and
their coconspirators generally did little that would
have alerted authorities even in today's heightened
security environment, providing a model for
facilitating future attacks inside the United States and
posing significant challenges to combating terrorist
finance
A Chronology of 11 September Finance
financial activities related to
the 11 September operation began roughly two years
before the attacks and proceeded through three
general phases: 1) startup funding in support of
travel and meetings during the period when the plot
was conceptualized; 2) funding the training and
casing stages of implementation, which coincided
with the arrival in the United States of the three
Hamburg-Cell pilots and included their subsequent
flight training and exploratory travel, possible dry
runs, and target casing in this country; 3) final-stage
funding support for the expanded teams of hijackers
that began with the arrival of the "second wave."
� The first two phases involved only six hijackers,
three who had already been in the United States,
and the three Hamburg-cell pilots who joined them.
The remaining 13 probably did not engage in
significant financial activity until they arrived in the
United States in Spring 2001.
(b)(3)
Startup Funding: Late 1999�Mid-2000
Financial preparations for the 11 September attacks
probably began in late autumn 1999 and centered
around Hamburg cell members Ma:wan al-Shehhi,
Muhammad Atta and Ziad Jarrah.
In what we assess to be the first signs of operational
planning for the 11 September plot, the three future
hijacker-pilots began arrangements for travel to
Kandahar, Afghanistan, for meetings with senior
al-Qa`ida leaders around Ramadan
(9 December 1999-7 January 2000)
This assessment was prepared by the DCI Counterterrorist Center's Office of Terrorism Analysis.
Comments and Queries are welcome and may be directed to
1
SEGRE-T
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
ECREI
Al-Shehhi---an Emirafi national who apparently was
the point man within the hijacking group for financial
In the months following the late-spring 2000 arrival
of Atta and al-Shehhi in the United States, the influx
of funds intensified when individuals in the UAE
transferred $115,000 by wire into the Atta/al-Shehhi
joint account at SunTrust Bank in Florida
� Ramzi Bin al-Shibh, a suspect who fled to
Pakistan the week before the attacks and has been
indicted in Germany since, was a primary recipient
� Bin al-Shibh applied five times during summer and
fall of 2000 for a US visa for flight training in
Florida but was denied each time
Indicted suspect Zacarias Moussaoui was in
London at the time of the transaction, and Bin
al-Shibh may have passed funds along to him.
Moussaoui declared
over $35,000 in cash at a customs checkpoint upon
entering the United States from London in February
2001, and Bin al-Shil later wired Moussaoui funds
directly during Augus
Other hijackers involved in the plot in its early
stages�Jarrah, Khalid al-Mihdhar, and Nawaf
al-Hazmi�did not receive the sizeable, frequent
transfers al-Shehhi and Atta received. Jarrah appears
to have spent money freely and even relied on his
girlfriend for financial help
Al-Mihdhar and al-Hazmi opened an account at Bank
of America in San Diego, California, with a $9,900
cash deposit
These two hijackers' pattern of activity
SECRET
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
-SECRET
(b)(1)
� (b)(3)
differed throughout the operation from that of the
Hamburg cell members
Training and Casing: September 2000�May 2001
The second phase of the financial side of the
operation was a prolonged perioa in which the
hijackers made few depoeits and rnnsictently
withdrew large amounts.
four occasions but
his trips may have been personal visits to his family
or girlfriend that he fmanced with his own money.
� From 10 June 2000 to early July 2001, al-Mihdhar
spent more time abroad than in the US
Al-Shehhi m 'p that resulted in significant
cash deposits. pril 2001 he traveled to Egypt,
where he met with Atta's father in order to procure
Atta's international driving permit
On 11 May
deposited
$8,600 into the joint SunTrust account
deposited another $3,400 and $8,000 cash on 22 May
and 1 June respectively
During this phase the hijackers traveled abroad on
several occasions. but the travel anoarently was not
related to finance
(b)(1)
(b)(3)
�
� Al-Shehhi traveled to Morocco and Atta to Spain in
January 2001
Jarrah traveled to Europe and the Middle East on
(b)(1)
(b)(3)
3
Al-Shehhi likely received
the cash from financial facilitators while in Egypt.
Final-Stage Funding: May-September 2001
The third phase of the operation broadened the
financial sphere to include the "second wave" of
hijackers�younger Saudis who came to the United
States during the, plot's final stages. These hijackers
appear to have served as both couriers for cash from
the Middle East and points of distribution for funds
that, if concentrated in one or two large accounts
might have drawn suspicion to the group.
This second wave of 13 hijackers arrived in the
United States�mostly in pairs and al via the UAE�
between late April and late June 2001
"SECRET
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
-SECREI
All(b)(1)
W(b)(3)
(b)(1)
(b)(3)
�
(b)(1)
(b)(3).
second-wave hijackers had
cash or traveler s checks, most of which
they probably had received from handlers such as al-
Baluchi or al-Husawi in the UAE and carried with
them to the United States.
� The second-wave hijackers also appear to have
passed cash along to the first group of hijackers,
mostly pilots, who had been in the United States for
over a year
� This group also used debit cards for many of their
personal transactions, but they did not engage in
nearly as much financial activity as the earlier set of
hijackers.
� The second-wave hijackers brought in more cash
than was needed for both living expenses and
airline tickets during the summer and returned
unused funds to facilitators before the operation,
Moussaoui also received funds from al-Husawi
during the summer in a series of transfers that came
through Bin al-Shibh.
The Unique Role of Banihammad. Emirati national
and Flight 175 hijacker Fayiz Ahmed Banihammad
performed a significant financial role during the final
months of the operation and may have been included
in the plot as a distributor of funds directly from
al-Husawi. He began preparations�procurement of a
new passport and US visa�for travel to the United
States in mid-June 2001, well after most of his fellow
hijackers, but we lack information about his
background or how he was recruited for the
operation
Banihammad collaborated closely with al-Husawi
� Banihammad and al-Husawi opened accounts at
Standard Chartered Bank (SCB) in the UAE on
25 June 2001 using cash deposits totaling almost
$30,000.
Banihammad gave al-Husawi authority
over his account and used an SCB card al-Husawi
had mailed him in the United States to withdraw
$20,600 during August, part of which probably was
distributed among the hijackers
al-Husawi�wired $14,616 from the UAE to
Bin al-Shibh in Germany in two installments on
30 and 31 July. Bin al-Shibh then wired $14,126 in
two installments to Moussaoui, then a flight trainee in
Minnesota
SF(717P
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
CECRE7
�
Return of Excess Funds to the Middle East
Beginning about two weeks before the attacks, the
hijackers began to consolidate remaining funds in
several accounts and then returned them to handlers
and possibly relatives in the Middle East. The
consolidation started around the same time the
hijackers began to purchase airline tickets for their
11 September flights, suggesting that the final
(b)(3) preparations immediately proceeded from a decision
to execute the attacks on that date.
(b)(1)
(b)(3)
(b)(1)
(b)(3)
(b)(1)
(b)(3)
�
Al-Hazmi and al-Mihdhar also apparently attempted
to return unused funds to the Middle East, yet chose
not to use wire transfer services. Al-Mihdhar
First Union Bank and transferred over $10,000
into the
account by 10 September
In a departure from their usual, cash-based method of
transferring funds among themselves, several
hijackers wrote checks to consolidate excess cash.
Haril7a
may have used some of the money to purchase
Ahmed's Flight 175 ticket
Four hijackers�recipients of consolidated funds from
other hi' ackers�retunied over $26,000
the week before the attacks.
Banihammad began the process on 6 September by
wiring $8,000 from his SunTrust Bank account to his
joint SCB account with al-Husawi
� The FBI advised that al-Hazmi addressed a oackage
containing the First Union bank card to a
post office box
but that the package did not
leave the United States before the 11 September
attacks.
Key Nodes: UAE, Germany, United States
The UAE, Germany, and the United States were the
operation's most prominent financial hubs. The
hijackers and their supporters took advantage of the
abundant financial institutions, diverse international
communities, and relative secrecy with which
financial transactions can be conducted in each
country. A significant portion of the funding that
facilitated the attacks flowed from the UAE through
Germany to the United States.
The United Arab Emirates was host to the most
critical financial activity related to the operation. The
general openness of the UAE, its loose financial
regulation, and its status as the financial center of the
Middle East made it a far more attractive location
than other Gulf countries for launching funds related
to the operation.
at least $250,000, or
roughly 80 percent of our estimate of the total cost
of the operation, came from cash, wire transfers,
and direct bank accounts in the UAE
. Pi:14
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
StCKEI
Key financial facilitators operated in the UAE during
important phases of the plot, particularly the final five
mont s A 1-aghlrhi had been living and working
there and al-Husawi operated in the UAE
� The two men were in contact with al-Shehhi and
Atta and likely provided funds
k'ho traveled directly to the United States
from the UAE.
The two hijackers who were Emirati nationals�
al-Shehhi and Banibairnnad--each performed unique
financial roles in the operation, maintaining the
"flow-through" accounts by which facilitators such as
al-Husawi funded the operation.
Germany functioned as a locus of financial activity
primarily because al-Shehhi, Atta, and Jarrah had
lived in Hamburg before traveling to the United
States. Several key associates of the Hamburg
hijackers�two of whom probably intended to
participate in the attacks�operated in Hamburg for
the duration of the plot's planning phase and
apparently managed financial and logistic matters in
the hijackers' absence. The individuals and accounts
in Germany usually served as halfway points for
funding, rather than origins or final destinations.
� Bin al-Shibh and Essabar both applied for and were
denied multiple times US visas
A
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
"SteRE-1
The United States was a notable financial hub
despite the fact that none of the funding for the
operation appears to have originated here. The
hijackers used the domestic banking system
extensively and may have assessed that doing so
would help them appear nonintrusive.
� The hijackers opened
accounts
US-based checking
The conspirators' financial behavior suggests that
they were well coached by the leaders of an
organization with lengthy experience in moving
money unobtrusively. They often appeared to take
pains to comply with reporting regulations.
� Moussaoui complied with US regulations by
declaring over $35,000 upon entering the United
States
and
used debit cards rather than checks for most of their
transactions
� The importance of purchasirtrairline tickets
without drawing suspicion may have been the
overriding rationale behind onening an account for
each hijacker.
The hijackers conducted much of their financial
activity in groups
Financial Tradeeraft: Learned From the Masters
Typical of an al-Qa`ida operation, the financial
tradecraft of the plotters showed long-term planning
and careful preparation. In the pre-11 September lax
atmosphere of the US and international financial
sectors, the hijackers managed to stay below the radar
of possible observers while making open use of the
banking system to deliver the funds needed to support
the operation. They relied on the overall appearance
of legitimacy and on a multitude of relatively minor
transactions that�absent additional incriminating
evidence�did not appear suspicious
None of the 19 hijackers opened an account in the
United States with more than $10,000 in cash,
although Moussaoui opened an account in Oklahoma
with $32,00C
� The closest any of the hijackers' cash deposits came
to the $10,000 threshold for a Currency Transaction
Report was in April 2000, when Khalid al-Mihdhar
opened an account at Bank of America in San
Diego with a cash deposit of $9,900
� Although the $10,000 threshold does not apply to
wire transfers, some wire transfers appear to have
been sent to the hijackers in several installments
possibly to avert suspicion.
Some Classic Suspicious Indicators: TipotTs of
Future Terrorist Plots?
Although their behavior generally appeared to match
the student status given on their visa applications,
several elements of the hijackers' tradecraft are
typically associated with certain types of criminal
behavior.
Approved for Release: 2021/07/26 C05433001
Approved for Release: 2021/07/26 C05433001
(b)(1)
(b)(3)
�
(b)(1)
(b)(3)
(b)(1)
(b)(3)
(b)(1)
(b)(3)
�
�SfeRE-i
Pervasive Use of Cash
The use of cash was critical to concealing the origin
and final use of large portions of the hijackers'
funding. They often used debit cards for flight
training and personal expenses, leaving large cash
transactions unexplained.
� Fifty-five percent in total
deposits associated with the hijackers' US-based
checking accounts was in cash or traveler's checks.
The remainder came primarily via wire transfer,
� Forty-two percent of the total disbursements from
the accounts was in cash. Other major expenses
were for flight training, airline tickets, and lodging,
Intermediate Accounts and Individuals
Much of the funding that reached the hijackers had
traveled through at least one intermediate acrint or
individual before reaching its final recipient.
Several accounts that were critical to the operation
appear to have served as flow-through accounts�one
indicator of suspicious financial activity in which
periods of inactivity and stable, often low, balances
are interrupted by large deposits that are soon
followed by equally large withdrawals. In the case of
the 11 September operation, flow-through accounts
both obscured the source of funding and enabled
intermediaries to pass money to associates along the
way.
� Al-Shehhi's joint SunTrust
account with Atta, and Banihammad's SCB account
all seem to qualify as flow-through accounts
No Known Use of Hawalas
We have no information indicating the hijackers used
hawala networks to send or receive funds. Despite
several possible advantages that hawalas offer
terrorist financiers over traditional wire transfer
services�such as anonymity, cultural and language
expediency, and ease of redeeming lost funds�the
11 September plotters may have calculated that the
use of hawalas would draw unnecessary attention to
their activities, particularly because al-Qa`ida
operative freauentiv distribute funds using hawala
networks.
Hawaladars themselves may be suspicious of large
transactions, especially if they do not know the sender
or if he is not of the same nationality. The hijackers
may have judged that Western banks and transfer
services offered more universal, flexible methods of
handling large sums of cash over the course of two
years before the attacks. They also may have sought
to follow local financial custom as a general rule for
operational security purposes.
Khalid Shaylch Muhammad, probably the mastermind
of the 11 September plot, appears to have used
several intermediaries in disseminating funds.
Al-Baluchi, al-Husawi, and other sources of wire
transfers to the hijackers all appear linked to
Muhammad, who effectively avoided drawing
suspicion by varying the sources of transfers.
� Muhammad possessed a supplemental credit card
on the UAE account of facilitator Mustafa Ahmad
al-Husawi
Concealment of Identity
The hijackers generally conducted financial matters
using true names or variants of true names, but they
may have made nominal attempts to conceal some
aspects of their identities.
(b)(1)
(b)(3)
(b)(3)
(b)(3)
(b)(3)
(b)(3)
(b)(1)
(b)(3)
Approved for Release: 2021/07/26 C05433001
(b)(3)
Approved for Release: 2021/07/26 C05433001
(b)(1)
(b)(3)
(b)(1)
(b)(3)
(b)(1)
(b)(3)
� Nawaf al-Hazmi used an apparently
unwitting associate's bank account to receive a wire
transfer from al-Baluchi in the UAE
The hijackers' coconspirators took even greater pains
to conceal their identities. Nearly all the nonhijackers
associated financially with the operation appear to
have used aliases or truncations of their names.
(b)(1)
(b)(3)
� Al-Baluchi and al-Husawi likely used several
aliases
� Bin al-Shibh also operated in alias
(b)(1)
(b)(3)
�
(b)(3)
�
Implications for Future Operation
Al-Qa`ida successfiilly conveyed necessary funds to
the operational group while concealing the identities
of the plot's financial backers, offering al-Qa`ida and
other terrorist leaders an effective model of terrorist
finance, particularly for operations in Western Europe
or the United States.
� Al-Qa`ida likely will seek to replicate the hijackers'
financial tradecrafl and their ability to operate
undetected in Western settings for prolonged
periods
(b)(3)
9
Approved for Release: 2021/07/26 C05433001