DC Bureau - Investigative Journalism, Environmental News, and National Security Stories That Matter

Politicians have long made promises that if taxpayers spend enough money, they can be protected from evil forces. The Maginot Line was supposed to protect France from a German invasion. The Germans defeated it easily because it was poorly conceived and largely built as a boon to French contractors. America’s Strategic Defense Initiative, the hugely expensive — $50 billion and counting — and failed “Star Wars” missile defense system envisioned by President Reagan, has so far only protected the bottom line of defense contractors.

Now once again — as with the Maginot Line and Star Wars — eight years after 9/11 the government has wasted $40 billion on a poorly conceived, largely contractor-inspired effort, this time on master intelligence lists for commercial aviation. And President Obama and his national security team seem to be embracing the same failed security and intelligence polices that offer little real protection.

The most serious unmet security need is the federal government’s ability to screen all airline tickets and reservations through a central database. Virtually every security expert says that the most important element in airline security is information. Determining who has access to airplanes and airports is, as we all were reminded again on Christmas Day, a life-and-death matter. The Transportation Security Administration is at the mercy of multiple government agencies that did not share intelligence with one another before 9/11and still do not share it today. Scores of false starts have been made toward putting together a uniform database — a series of lists of questionable, undesirable, and dangerous passengers — as a last line of defense. Unfortunately, the no-fly list has been a boon to Department of Homeland Security and other government contractors trying to fix its shortcomings, but it has never met a standard that will protect the public.

The error-filled list has caused tens of thousands of innocent people to be confused with terrorists. What was promised as protection against Al Qaeda and other terrorists through government interagency cooperation is instead a list brimming with mistakes and government agencies reluctant to correct them. But there is something worse than hassling innocent passengers. We know that known terrorists have repeatedly flown either because of gaps and mistakes in the no-fly list or because intelligence agencies allowed them to fly to see where they would go. We also know that the same government agencies that in 2001 refused to share information with the FAA — as a way to protect sources and methods — are at the heart of why there is no effective no-fly database today.

DCBureau.org’s National Security News Service obtained a copy of the March 2006 no-fly list when it arrived over the transom without a hint of who sent it. We established its authenticity through TSA and CIA sources. TSA representatives have told some media outlets the list is a secret/sensitive document. In fact, it is not classified as secret but only as sensitive — an administrative classification. As expected, it is dominated by Arabic names — the first third of the list begins with the letter A. What is unexpected is that the list is a mess, filled with names of dead people, Irish Republican Army fund-raisers, and others who have never been a threat to air travel. “The list is a joke,” a high-level official of United Airlines says. We investigated the accuracy of the no-fly list. The goal was to determine its value in protecting the nation’s air transportation system. The result of that investigation reveals a government dominated by national security organizations that continue to heavily censor the information they share with one another and TSA and the airlines. More disturbing, terrorists who present a real threat to aviation have been deliberately left off the no-fly list. The basic recommendation of the 9/11 Commission — to improve interagency communication — is unmet eight years after the 9/11 attacks despite high-level government officials saying it has been fixed.

The net effect is that by keeping important terrorism and intelligence information from the no-fly list, public safety is jeopardized and the likelihood of another 9/11-style attack is increased. One high-level TSA official describes the group of terrorism watch lists consolidated into several lists by the Department of Homeland Security as “a fake. No-fly doesn’t protect anyone. It is every government agency’s cover-your-ass list of names. Many of the really bad guys are never put on the list because the intelligence people think the airlines are not trustworthy. That makes the incomplete list we give the airlines next to worthless.” That was in 2006.

Four years later the current no-fly list is still full of errors and the CIA and other intelligence agencies are still not sharing all current known names of terrorists for inclusion on the list, something that angered and shocked President Obama after the near loss of Delta Northwest Flight 253 to Detroit on Christmas Day.

The misspelling of Umar Farouk Abulmutallab’s name in a State Department cable is being cited as one of the mistakes that helped the Al Qaeda terrorist. According to State Department officials, who spoke to the news media on the condition of anonymity, an initial check based on his father's information failed to disclose that his son had a multiple-entry US visa. The reason given was that Abulmutallab's name was misspelled. The question of who provided the misspelled name is a major issue among intelligence officials. The CIA has a history of providing incorrect spellings to avoid having terrorists they are following or other people of interest from being placed on the no-fly list. Since Abulmutallab’s father met with a top CIA official at the US Embassy in Nigeria, the question is: Did that CIA officer intentionally misspell the name that ended up in the State Department cable? It would not be the first time.

DCBureau.org’s investigation reveals that one of the 9/11 hijackers appeared on the no-fly list with a deliberately misspelled name. The CIA supplied that name just like they did Abulmutallab’s. We are publishing the page from the 2006 no-fly list with the misspelled 9/11 hijacker’s name.

The terrorist was known to the CIA as one of two men who had attended a meeting of Al Qaeda officials in Malaysia before coming to the United States. That hijacker was also a Saudi intelligence agent with the General Intelligence Directorate, the Saudi agency that works closely with the CIA. DCBureau sources in both the CIA and Saudi government insist that Khalid al-Mihdhar was one of two GID agents who were supposed to feed back information on Al Qaeda. Al-Mihdhar was on the no-fly list as “al-Midham.”

The night before the 9/11the attack on the Pentagon, al-Mihdhar and his cohorts spent the night in the same motel near Dulles International Airport as the top Saudi official who provides aid to overseas Islamic causes.

The CIA giving other federal agencies a misspelled name is not inadvertent. The CIA has had software for more than a decade that will match variants of names automatically. This software was not shared with any government agencies except the National Security Agency. The software was specifically developed to deal with difficult Arab names.

A CIA official, now retired, who was responsible for contributing names to the list says, “I cannot describe to you how reluctant our operational people were to turn over names. Many terrorists act as assets for our case officers. We do deal with bad guys, and, like cops protect snitches, we protect ours, too, and none of those guys is going to show up on the no-fly list anytime soon. So we made a deal. The CIA effectively has the ability to allow people to fly who are on the no-fly list if we deem it in the national interest —just not on domestic airlines.”

Everyone who flies has his or her name entered into a computer that matches each potential passenger against a series of government-compiled databases. Some passengers are flagged and pulled aside for more screening and questioning. Others, who may have been stopped at airports before, are not allowed to proceed. Then there is a group of people who are supposed to never fly — the “no-fly list.”

The no-fly list is a mystery to most travelers. Actually, it is one of several lists totaling about 550,000 names that begin with the Terrorist Identities Datamart Environment. The TIDES list is then downsized into a much smaller list for the TSA and requires TSA and the airlines to rescreen, notify law enforcement, or stop passengers from boarding an aircraft. The most important list, the no-fly list, has been reduced from about forty-nine thousand names to around seven thousand names today.

The second most important list is the selectee no-fly cleared list, which requires the airlines to double-check identities and to do additional screening before permitting passengers to fly. This list has many more names on it than the no-fly list. The newest lists are of passengers who have been removed from the no-fly list and selectee lists because of either updates or mistakes; these lists simply tell the airlines that additional security is no longer required.

Most airline security departments download the lists from the TSA onto airline hard drives, where the name of a suspect is put onto an Excel spreadsheet and incorporated into the airlines’ reservation system, which matches names with any new reservations and tickets sold. High-level airline officials (who have government security clearances) are permitted to see more information— such as biometric identifiers (hair and eye color, weight, height, scars, et cetera). According to airline security expert Michael Pilgrim, “If a match is made, the supervisor with the airlines is contacted and he contacts his local TSA office, who will make the stop at screening or at the gate. The problem is the process is so cumbersome that sometimes people get through.”

Because the TSA says the no-fly list and other watch lists are classified, only cleared senior airline security employees, designated by the airlines and cleared by the TSA, are permitted to handle their data. Since a series of critical internal Inspector General’s Office and Government Accountability Office audits, the DHS is now allowing the TSA to include dates of birth so it now has another marker to compare passengers with similar names. One top security official at Delta Air Lines says, “They will not give us the other markers they have, such as previous places traveled, all possible names used by someone on the list, or even passport numbers. All we had was the DOB and the name, and sometimes they are both wrong.”

Only a few highly cleared TSA employees are allowed to see the raw terrorism watch lists from which the names are culled. The real security that DHS and TSA officials say is built into the system comes from the fact that the only part of the list reservation clerks or “secondary employees” will ever see is when they type a name in the computer and get a hit. It is not possible for most ticket and reservation clerks to see or to copy the watch lists— all they can do is use the system to match names. “Because the no-fly list is not a perfectly secure document, the government agencies that create the lists and add to them have sometimes been reluctant to contribute all the names that should be on it because they are fearful terrorists could learn they are on the lists and the US government was on to them,” a former CIA official says. One top major airline official describes this attitude as “insane . . . We are the last line of defense, and their attitude is we will not tell you the identity of a terrorist because we don’t trust your employees not to leak to terrorists. For this they will risk another 9/11.”

Remarkably, the names of fourteen of the nineteen 9/11 hijackers remained on the no-fly list. The following fourteen hijackers are considered threats from beyond the grave:

Ahmad al-Haznawi — Flight 93

Salem al-Hazmi — Flight 77

Hani Hanjour — Flight 77

Saeed al-Ghamdi — Flight 93

Fayez Ahmed Banihammad — Flight 175

Majed Moqed — Flight 77

Hamza al-Ghamdi — Flight 175

Ahmed al-Ghamdi — Flight 175

Mohand al-Shehri — Flight 175

Ahmed al-Nami — Flight 93

Wail al-Shehri — Flight 11

Satam al-Suqami — Flight 11

Abdulaziz al-Omari — Flight 11

Waleed al-Shehri — Flight 11

These five are not on the no-fly list:

Mohammed Atta — Flight 11

Nawaf al-Hazmi — Flight 77

Khalid al-Mihdhar — Flight 77

Ziad al-Jarrah — Flight 93

Sources at the CIA say that actually al-Mihdhar was on the list. His name was deliberately listed with the wrong spelling. Instead of al-Mihdhar he was listed as al-Midham. “We disguised names passed on to TSA all the time. His connection to GID is why he was never on any watch list under his full true name,” a CIA veteran officer said.

One reason the 9/11 hijackers were kept on the no-fly list is that the FBI has never been able to confirm the real identities of many of the 9/11 hijackers. CNN reported on September 21, 2001, that FBI director Robert Mueller “acknowledged that some of those behind last week’s terror attacks may have stolen the identification of other people.”

A report by Insight magazine did not get much attention when it disputed the FBI’s claim that it had properly identified the 9/11hijackers. When that article is matched against the official no-fly list, however, the FBI identifications seem very shaky. The possible misidentifications raise an important question: How was Al Qaeda able to find Saudi citizens to target for identity theft? One possibility is that more than one Al Qaeda operatives had connections at a high-enough level in Saudi society to put together a list of identities to steal. The Insight story and other news reports name seven Saudis who have claimed that they have been wrongfully identified as 9/11 hijackers. At least two have had their photographs linked to alleged 9/11 hijackers by the FBI. The FBI strongly denied misidentifying any of the 9/11 hijackers. According to Insight magazine: “Abdul Aziz al-Omari was identified as one of the hijackers and the pilot who crashed American Airlines Flight 11 into the North Tower of the World Trade Center. Another man with the same name is an electrical engineer in Saudi Arabia. That man lived in Denver after earning a degree from the University of Colorado in 1993.

ABC News has reported that his Denver apartment was broken into and his passport and other documents stolen in 1995. In September 2001 the engineer said, ‘I couldn’t believe it when the FBI put me on their list. They gave my name and my date of birth, but I am not a suicide bomber. I am here. I am alive. I have no idea how to fly a plane. I had nothing to do with this.’” Insight reported that the FBI accidentally may have fused two names to create one identity, because another man, Abdul Rahman al-Omari, who has a different birth date, is the person pictured by the FBI, but is still a pilot for Saudi Arabian Airlines. After his photograph was released, he walked into the US embassy in Jeddah and demanded to know why he was being reported as a dead hijacker. Insight also reported that Salem al-Hazmi was identified as one of the suspected hijackers on American Flight 77, the plane that was crashed into the Pentagon. Saeed al-Ghamdi, meantime, works for the Saudi Royal Commission in Yanbu. He was, according to the FBI, one of the alleged hijackers on United Airlines Flight 93, the plane that crashed in the Pennsylvania field. He and another hijacker — Ahmed al-Nami — were said to have been in control of the plane when it was destroyed. Two Saudi Arabian pilots have the same names, and one is alive and well in Riyadh.

Insight reported that Wail al-Shehri, who was identified as one of the suspected hijackers on American Flight 11, was supposedly in control of the plane when it was crashed. To confuse matters further, yet another Saudi who has the same name and is also a pilot is the son of a Saudi diplomat in Bombay. That man’s photograph was displayed by the FBI as the “terrorist” al-Shehri who supposedly took the plane into the tower. According to Insight, al-Shehri is alive and lived in Daytona Beach, Florida, where he did his flight training at Embry-Riddle Aeronautical University. He is currentlya Moroccan airline employee. The Associated Press reported that al-Shehri had complained to the US embassy in Morocco. His photograph having been released and repeatedly shown around the world is evidence the man in the FBI photograph still is alive, the Saudi embassy explains. Waleed M. al-Shehri, the name used by another suspected hijacker on American Flight 11, reportedly is the brother of Wail al-Shehri. The odd coincidence is that the other son of the diplomat father is named Waleed M. This prompted the BBC to report in 2001 that “another of the men named by the FBI as a hijacker in the suicide attacks on Washington and New York has turned up alive and well.”

So why are the names of hijackers thought to be dead on the no-fly list? According to a top FBI official, “There is a real fear we have no assurances as to who really carried out the attacks.” By the spring of 2006 experts in aviation security discovered that American intelligence and counterterrorism officials had been withholding the names of terrorists from the airlines and deliberately allowing suspected terrorists to fly among innocent passengers in the hope that a terrorist would lead them to collaborators or even a terrorist cell. This is the same simpleminded game that the CIA played against the FBI prior to 9/11 and, remarkably, it continues today. Prior to 9/11 senior CIA officials had convinced themselves that GID, the Saudi intelligence service, had placed agents inside Al Qaeda. Because these two men — Khalid al-Mihdhar and Nawaf al-Hazmi — were Saudi agents, the CIA did not tell the FBI about them when they came into the United States from a terrorist summit meeting in Malaysia. Had the CIA shared what it knew, the FBI might have had a chance at preventing the 9/11 attacks. The 9/11 Commission reported that two and a half weeks before 9/11 and twenty months after GID agents attended the Malaysia summit, the CIA, as the law requires, finally notified another federal agency — not the FBI, but the Immigration and Naturalization Service. Unfortunately, the INS reacted too slowly to the information.

Why did the CIA stop protecting the two GID agents but not fully inform the FBI as to their whereabouts? Because a month before 9/11 there was a dramatic change in Saudi intelligence. The longtime head of GID, the moderate Prince Turki, trusted by the United States, left GID and became the Saudi ambassador to the Court of Saint James in London shortly before the 9/11 tragedy. Had Turki been forced out by more radical elements in the Saudi royal family? Had he quietly warned the CIA that he suspected that GID’s assurances about the penetration of Al Qaeda were not as reliable as thought previously?

Had Al Qaeda penetrated GID? Turki has never said; what is known is that money flowed from the Saudi US embassy accounts to al-Mihdhar and al-Hazmi when they lived in San Diego prior to the attacks. The FBI was made aware of the two men by INS and claimed to have initiated a search, although apparently San Diego agents never looked in the local phone book. The San Diego white pages contained the following entry:

ALHAZMI, Nawaf M, 6401 Mount Ada Road, 858-279-5919.

This lack of trust and interagency cooperation was at the heart of the 9/11vulnerability. The great secret of why the president and his team were complacent about warnings of an impending 9/11 attack in the summer of 2001 is that the CIA had assured the national command authority that the CIA’s cooperative arrangement with Saudi intelligence had resulted in the penetration of Al Qaeda at the highest levels, according to intelligence sources who worked in this area for both the Saudi and US services.

A single Arabic name, once converted to English, can start a chain of events that can lead to mistakes and misidentification. According to Mike Pilgrim, the CIA contractor SAIC had developed software that allowed the CIA to narrow the possibility of such errors, but for security reasons the agency did not share it with the FBI; to this day the CIA hasn’t shared it with DHS or TSA. The government’s ability to automatically determine that Nawaf al-Hazmi is the same person as Nawaf Alhazmi was impaired because the CIA did not share the technology. As we learned after 9/11, the CIA was not alone. The FBI refused to share its database. In April 2001, for example, when al-Hazmi was arrested for speeding by an Oklahoma state trooper, the policeman ran his registration and driver’s license through the system and found nothing. Al-Hazmi got a pair of traffic tickets and continued on to his 9/11 mission.

Another bizarre move by the CIA began in early 2001, shortly after George Bush’s inauguration. At that point STATION ALEC — the joint CIA–FBI bin Laden task force — began to cut the FBI off from NSA material tracking Al Qaeda members. By withholding from the FBI the identities of Al Qaeda members, as well as message traffic, the CIA effectively ended any chance in the months leading up to 9/11 of discovering that these Saudi nationals were actually Al Qaeda agents destined to play major roles in the 9/11 attacks.

Remarkably, the no-fly list reveals that the CIA is up to its old tricks again: allowing terrorists or suspects on the list to fly because intelligence officials believe there is a chance at recruitment. In 2001 officials of the Saudi GID and the CIA thought everything was under control. In private briefings Richard Clarke’s warnings about impending Al Qaeda attacks were mitigated by reassurances given by the Saudis that GID was inside Al Qaeda and knew full well what bin Laden had planned. It was the same attitude that former CIA director George Tenet displayed when he told President Bush that it was a “slam dunk” that weapons of mass destruction existed in Iraq. Now many of the same men are running national intelligence — eight years after 9/11 — and the airlines and flying public are once again being used as unwitting players in a potentially deadly intelligence game. There is fear among airline security experts that government methods used in trying to track terrorists could fail, as they did in 2001, and passengers on airlines and people on the ground could be put in jeopardy as last Christmas Day proved. As Mike Pilgrim explains: “There is not much question that the government will allow terrorists and suspects to get on planes to track them in the hope of discovering other cells. The government may have a good relationship with airline security officials and may warn them — but I doubt it. This kind of operation can be a huge risk if they lose track of the target or if the target has colleagues that get on the same flight.”

Even more curious is that the CIA is routinely placing employees undercover with airlines and even as sky marshals. Such undercover assignments allow the CIA to control arrangements when it wants a target to fly openly without the airlines or marshal service’s knowledge. A congressional hearing in June 2006 illustrated the TSA’s helplessness in controlling security. TSA officials testified that they were proud that six passengers on the no-fly list were successfully detained after coming off a flight. No one in the hearing bothered to ask what would have happened if these suspects had tried to take control of the aircraft during the flight. As one aviation security official for a major airline puts it: “We know they lost track of two of the Dulles hijackers after they attended a meeting with Al Qaeda in Malaysia. Why in the world would we have any faith in the FBI or CIA to keep track of known terrorists as they fly from country to country?”

The TSA official in charge of the no-fly list in 2006 was asked at the hearing to describe this list’s effectiveness in stopping terrorists. William Gaches, the assistant administrator for intelligence, gave an answer that may have been more revealing than he intended: “A very recent and exciting adventure that we took part in — in fact, actually led — a few weeks ago where, through other sources, we had six individuals, five individuals identified on a particular flight and, in fact, they were on that listing that we call the no-fly list. They were bona fide fliers. They had, unfortunately, gotten onto the flight because it was coming from an overseas location. So because we knew who they were, we could confirm that. They were greeted accordingly, and followed accordingly by law enforcement agencies to determine what they were up to, et cetera. And again, I wouldn’t want to go into any further detail. But I would say that, certainly several times a month, we are getting positive hits on this system.”

Confirming some of their fears of the ineffectiveness of TSA intelligence and security, the representatives learned from Gaches that none of the passengers flagged should have even been on the no-fly list to begin with. The idea Gaches and his TSA colleagues consider following six individuals after they landed “exciting” or a success for the TSA intelligence system is truly remarkable. Gaches, a former National Security Agency official, confirmed to Congress that the lists were in such poor shape that the TSA is undertaking a manual review of all of the names; this is expected “to take five or six years to complete.” He also admitted that the TSA is on something of a treadmill trying to fix the broken list, because thousands of new names come in from intelligence agencies routinely. The net effect is that it will be years before the TSA has an accurate no-fly list. The entire no-fly list process, Gaches said, is like being on a merry-go-round: “I think that there are so many entities now involved in the watch-list process that it’s probably time for us to, once again, sit down, examine the roles of the individual agencies’ entities, and talk about this very subject of taking so much time to go through this list and revisit it . . . We’ll get through the list. By the time we get to the Z’s, so to speak, there will be a whole new group of A’s, B’s, and C’s.”

Adding to the mess are the airlines’ lists. Cathleen Berrick, then the director of homeland security and justice issues for the GAO, testified, “There’s no standards for collecting passenger data. Each air carrier does it a little bit differently. That greatly influences the effectiveness of the matching process.”

For those hoping for a speedy resolution after being wrongly put on a watch list, Gaches’s reply will not be encouraging. He said there is little coordination between the Office of Redress — where wrongly flagged passengers can appeal their inclusion — and his office, which actually produces the lists. “They maintain that as an entirely separate operation from me. We occasionally get involved, depending on the particulars of the case at hand.”

The list for the Secure Flight program is done by application of flyers. If flyers have had problems being on other lists, they must go through the TSA redress process before joining Secure Flight. KNBC TV investigative reporter Ana Garcia had problems flying for years because her name matched someone on the selectee list. Her first experience on Secure Flight on a Christmas 2009 trip to London proved successful.

Secure Flight might help some passengers avoid the hassles of additional TSA screening, but the American taxpayers are not getting a good return on their investment of tens of millions of dollars to implement TSA programs such as Secure Flight when it comes to aviation security. The Government Accountability Office has reported that the very expensive Secure Flight program could not prevent terrorists using stolen identities from boarding aircraft. Compounding the problem is that poor security throughout the government has resulted in millions of peoples’ personal identities being made available to identity thieves. In light of the fact that the 9/11 hijackers might have used false identities, this makes the failure of Secure Flight even more serious.

Gaches also admitted to Congress in 2006 that at the insistence of the intelligence community, the TSA is often deprived of useful identifying information on potential terrorists: “Because we go from the classified to the unclassified world, there is a fair amount of information that drops off.”

Next: Part II - The No-Fly List: The CIA Lets Terrorist Fly