The name was little more than a scribble, entered in a shaky hand on a U.S. visa application by Ahmed Alnami. In the space for traveling companions, he scrawled: "My frind MOSH A BAB." It was April 2000, 17 months before Alnami would help commandeer the United Airlines flight that crashed in Pennsylvania on Sept. 11, 2001.
After the attacks, FBI investigators puzzled over the entry. Was Alnami's mysterious friend part of the terrorism plot? And were there others?
The discovery came in the spring after the attacks. A search through thousands of visa applications revealed that MOSH A BAB was Moshabab Hamlan, a Saudi national who had obtained a U.S. visa on the same day and in the same place -- Jeddah, Saudi Arabia -- as Alnami. Saudi authorities interviewed Hamlan and his family and sent back a report: He was meant to be part of the hijacking mission, but his mother confiscated his travel documents when he lost his nerve and decided to drop out of the plot, said those familiar with the case.
Hamlan's identification, which has not been revealed previously, is one of numerous discoveries made over the past 33 months by PENTTBOM, the FBI's sprawling investigation into the Sept. 11 attacks.
Working from the basement of the J. Edgar Hoover Building, next to the fumes and clatter of a print shop, a dwindling team of FBI agents and analysts has conducted the largest criminal investigation in U.S. history, a probe that continues to this day. Until now, members of the team have not publicly discussed their work.
For nearly three years, the team has endured the tedium and frustration of chasing thousands of dead-end leads in pursuit of information about the worst terrorist attack in U.S. history. The group has shared the anguish of the families of attack victims, quietly briefing them on their discoveries and returning personal items from the wreckage.
"The victims are really what keep us going," said Joan Marie Turchiano, 34, who became head of the team earlier this year. "We want to see it through. We've been here since the beginning, and we'd like to see some sort of finality."
Originally numbering more than 70 people, the team chased more than a quarter-million leads in the months after the attacks, dispatching thousands of FBI agents worldwide. FBI agents have conducted more than 180,000 interviews, and reviewed millions of pages of immigration records, parking receipts, airline manifests, al Qaeda membership rolls, interrogation transcripts and other documents.
The team's job, said FBI Director Robert S. Mueller III, is to "find the needle in a haystack. . . . You spend most of your time disproving the theories that people are postulating."
Two other panels that have investigated the terrorist attacks fault the PENTTBOM team for not pursuing some aspects of their probe aggressively enough, and for discounting some information because it could not be thoroughly proven. The team has also feuded with the CIA and other agencies over access to information.
Now, as the independent commission investigating the attacks prepares to reveal its findings about the plot Wednesday, the FBI's team is down to 10 regular members who are exploring the remaining mysteries of that day. The team's leaders said investigators have identified new al Qaeda associates, helped prevent attacks and shed light on how the terror network functions.
PENTTBOM agents still comb through daily military and CIA intelligence reports; work closely with prosecutors in the Zacarias Moussaoui case; and analyze interrogation reports from the military prison at Guantanamo Bay, Cuba, and other U.S. facilities where suspected al Qaeda operatives are being held.
"Every single thing that we can learn about al Qaeda, whether [it is] how they behave, how they act, what their modus operandi is, is a little bit more ammunition in the war on terrorism," said Mary Galligan, 42, who headed the PENTTBOM team until January. "We don't know six months from now what might be important."
Still, there is much they do not know. Why did the lead hijackers decide to pass through Las Vegas? Why did terrorist leader Mohamed Atta and another hijacker start their day in Portland, Maine, nearly missing the flight from Boston to Los Angeles that they crashed into the World Trade Center's North Tower? Are there still undiscovered accomplices?
All they have, for now, are theories.
Unprecedented effort
On a recent visit to FBI headquarters, the signs, hand-lettered in marker, point the way with a wink: "Kennedy Assassination," reads one; "Hoffa Case," says another.
They lead to a poorly lit back room in the basement. Notes and newspaper clippings cover the walls; manila files and personal computers spill off the desks. Blue tubing pokes from a groaning HVAC unit in an attempt to improve the air.
The office, like the investigation itself, was set up on the fly. After the twin towers fell, Mueller announced the formation of PENTTBOM, which in the FBI's arcane nomenclature stands for "Pentagon and twin towers." "BOM" usually refers to traditional bombings such as the Oklahoma City bombing, or OKBOM. On Sept. 11, 2001, the bombs were fueled jetliners.
The FBI's effort, unprecedented in bureau history, threw experienced counterterrorism investigators together with rookies barely out of the FBI academy. They were uprooted from their homes and families and brought to Washington to work for months at a time.
The probe, first headed by then-Deputy Director Thomas J. Pickard, began with one group of investigators for each of the four hijacked planes and one agent for each of the 19 hijackers. Galligan, a longtime FBI agent with a master's degree in psychology, took over in October 2001. Her deputy, Turchiano, is a Brooklyn native who has been tracking terrorists almost since she started at the bureau in 1997.
Other members have included a former soldier and state trooper who became an expert on Atta; an Arabic-speaking Special Forces member who came to the FBI after fighting in Afghanistan; a rookie who became the team's point person on the plot's origins in Germany; and a longtime New York police detective who worked two years past retirement "to see it through to the end."
The New York field office, cradle of the FBI's al Qaeda expertise, largely ran the show in those early days. The attacks had forced agents out of their offices downtown; they worked first from a parking garage and later from the aircraft carrier USS Intrepid.
By October, Mueller, who had been on the job for a week when the hijackings occurred, made a controversial decision: PENTTBOM would be run from Washington and, for the first time in anyone's memory, an operational investigation would be based at headquarters.
The hijackers had been identified within hours, and many of their financial transactions and movements were confirmed within days.
The investigation was divided into groups focused on the flights; on elements of the plot in Germany, Saudi Arabia and the United Arab Emirates; on the use of computers; and so on. One group focused solely on Atta.
The leader of the Atta group is Jim Fitzgerald, the former soldier and Massachusetts state trooper. He was a member of the SWAT team that protected the FBI team that traveled to, and was expelled from, Yemen after the bombing of the USS Cole in October 2000.
Others made similar roundabout journeys to the FBI and to PENTTBOM. Matt Gutierrez, 37, a former Marine with more than six years at the FBI, was a classified-information expert responsible for overseeing an estimated 130,000 files produced for discovery in the case of Moussaoui, the only person in the United States charged in connection with the terrorist attacks. Another agent, Aaron Zebley, had been transferred out of counterterrorism to work on criminal cases on Sept. 10, 2001. The transfer lasted a day.
Jackie Maguire, 30, was three months into a counterterrorism posting under Galligan when the planes hit the World Trade Center and Pentagon. "I was told I was going to Washington for 30 days," Maguire recalled. She is still on the team.
A few members are not FBI agents. Robert F. Sassok, 43, a New York City police detective, gave up a lucrative pension to work on PENTTBOM. As a member of New York's joint terrorism task force, he had previously worked on the case of the 1998 U.S. embassy bombings in Africa.
"We hoped we'd put a dent in them," Sassok said of the earlier case. "But the way they operate, we couldn't be sure. ... You felt a sense of satisfaction putting people away in the embassy bombings. Then you think, here we go again."
The evidence
The list hangs from a divider in the team's basement redoubt, nearly five feet long. In Project Backtrack, FBI investigators drew upon millions of passenger records turned over voluntarily by airlines to tally more than 180 flights taken by the 19 hijackers since 1991.
They include surveillance flights in the United States in the summer of 2001. Six hijackers, at least one from each plane, took the practice flights in the United States between May and August 2001, the PENTTBOM team has concluded. All went from the East Coast to California and back, and each made a stop in Las Vegas. On at least one leg, the traveler occupied a seat near the one he would take on the day of the attacks.
From the broader universe of all hijacker flights, the team has also identified the "dirty 44," names that appeared on the same 180 flight manifests more than once. In many cases, however, authorities cannot tell whether the individuals are the same because of spelling differences and a lack of personal information, and few answers have been gleaned from the mysterious list, investigators said.
The team has logged more than 155,000 items of evidence, including debris from the attack and crash sites. Investigators also assembled a timeline more than 8,000 lines long of the hijackers' activities in the United States. Pasquale "Pat" D'Amuro, a former FBI counterterrorism chief and head of the New York field office, calls the list "one of the most significant things the investigation did" because it serves as the primary framework for understanding how the plot was organized and why it was successful.
The linchpins of the probe are bank and telephone records, which allowed PENTTBOM investigators to rapidly reconstruct the activities of the hijackers and their associates, and to continue tracking al Qaeda movements to this day.
The team has played a central role in the aggressive tactics used since the attacks to monitor and apprehend suspected al Qaeda associates, including would-be hijackers such as Hamlan, who is in custody in Saudi Arabia.
Another probable hijacker identified by the team, Mohamed Qahtani, was foiled in his attempt to enter the United States a month before the attacks. Qahtani, a Saudi national whose existence was first revealed earlier this year by the Sept. 11 commission, had been picked up in Afghanistan and was being held in Guantanamo Bay in the summer of 2002 when authorities got a hit on his fingerprints. He had attempted to enter the United States at Orlando on Aug. 4, 2001.
PENTTBOM investigators, aware that Atta was in Central Florida about the same time, manually searched parking and telephone records and determined that Atta was on a pay phone in the Orlando airport at the same time Qahtani was detained for questioning by a suspicious immigration inspector. The call was made to a phone used by Mustafa Ahmed Hawsawi, the alleged paymaster in the terrorism plot.
Qahtani, the team concluded, was meant to be part of the hijacking plot, foiled only because the inspector refused to grant him entry. The discovery prompted a mobilization of field agents to search for other accomplices. They sifted by hand through months of parking receipts at eight major airports and compared them with license plates of cars the hijackers used.
"At every [U.S.] airport that we knew a hijacker had been to, we went through the same exercise," Galligan said. But no additional matches were found.
The PENTTBOM team also played a leading role in the 20-month investigation of Bradley University graduate Ali Saleh Kahlah Marri, who was put in a military brig in June 2003 after President Bush accused him of being an al Qaeda sleeper agent. PENTTBOM and Illinois FBI agents surveilled Marri in the months after the terrorist attacks after discovering that he had called a United Arab Emirates phone number associated with Hawsawi.
Marri was arrested as a material witness in late 2001. Khalid Sheik Mohammed, the mastermind of the attacks who was apprehended in Pakistan in March 2003, has told U.S. authorities that Marri was an al Qaeda agent, said sources familiar with the interrogations, leading to Marri's designation as an enemy combatant.
In another case, the PENTTBOM investigators pieced together the identity of Adnan G. El Shukrijumah, a suspected al Qaeda member and trained pilot who remains at large, from information provided by detainees at the Guantanamo Bay prison and elsewhere. Last month, Attorney General John D. Ashcroft renewed calls for public help in finding Shukrijumah, saying: "He has been involved in terrorist planning with senior al Qaeda leaders overseas and has scouted sites across America that might be vulnerable to terrorist attack."
Congressional criticism
In the first retrospective look at the Sept. 11, 2001, attacks, released publicly last summer, House and Senate intelligence committee investigators concluded that the team had not worked aggressively enough to investigate some strands of the plot, particularly in connection with a small group of immigrants associated with two of the hijackers in San Diego.
In its scathing report, the joint inquiry argued that intelligence sources and the FBI's own investigation had revealed contacts between the lead hijackers and at least 14 suspected terrorist associates in San Diego and elsewhere in the United States -- including several whom the FBI was monitoring at the time of the contacts.
The FBI has staunchly disputed the committee's claims, arguing that the 14 individuals referred to in the report have been cleared of terrorist connections and, in many cases, were several steps removed from contact with any of the hijackers. But Eleanor Hill, the inquiry's staff director, said in a recent interview that she was taken back by what she viewed as the team's lack of thoroughness.
"We didn't feel they knew a lot about issues we were pretty concerned about," she said. "I know they worked very hard, and there were a lot of FBI agents working very hard after 9/11, but part of my view was that they were playing catch-up. ... I still think there were several issues we came across that we felt should have been handled more aggressively."
Hill and others criticize, in part, the organization of the investigation itself, which featured a constantly revolving cast of agents on temporary assignments. The tumult may have made it difficult to keep up with the sheer volume of material collected during the probe, she and others argue.
"They clearly had their hands full," Hill said. "I think they were overwhelmed after 9/11 just in the scope of what they had to look at."
The independent commission investigating the attacks, whose own investigators have gone over much of the same ground as the FBI, is largely impressed with the PENTTBOM team's work, said the panel's executive director, Philip D. Zelikow. But the commission investigators disagree with the bureau on a number of key points, which will become evident when the panel releases its report.
"Overall, PENTTBOM displayed all of the FBI's characteristic strengths," Zelikow said. "They are a superb investigative organization, with a culture that very much respects facts and values hard evidence. ... But there are things that they didn't check out as aggressively as we might have liked ... and they have not always been as creative as they could have been."
Unanswered questions
Like the families of attack victims, the PENTTBOM investigators agonize over questions they cannot answer. "Two and a half years later, when there's still questions out there, of course that is frustrating," Maguire said.
On a bracing day in early January, Galligan is joined by Michael E. Rolince, a longtime senior FBI counterterrorism official, for a question-and-answer session in an FBI auditorium. The audience members are relatives of those killed when American Airlines Flight 77 crashed into the Pentagon. A reporter was allowed to observe part of the gathering, but was barred from taking notes.
Galligan and Rolince walked the families through much of what is known about the events aboard Flight 77 that day. They discussed the plane's trajectory as it crashed; the response of emergency vehicles and fighter jets; and what was known about their loved ones' last minutes aboard the jetliner.
The team's role as a liaison of sorts to victims' relatives has gone largely unnoticed. Galligan and others have briefed the families, members of Congress and their staffs and investigators for the House-Senate inquiry and the independent commission investigating the attacks.
The FBI and the PENTTBOM team set up a secure Web site and telephone number to provide information to loved ones about the case. The bureau began a program last fall to return belongings that had been held as potential evidence, from identification tags to jewelry.
One man from the Midwest brought the FBI an answering machine tape of his son's last words, which he hoped could be restored; FBI technicians were unable to rescue the recording. On another day, members of the PENTTBOM team aired a security tape from Dulles International Airport for a woman whose husband was killed in the Pentagon crash. The grainy footage showed the man walking down a corridor, minutes after she had dropped him off to board the plane.
"When she saw him, she reached out to touch the screen and just held her hand there," FBI agent Jane Rhodes said. "There wasn't a dry eye in the house."
"A lot of these contacts with families are very intense, very personal," said Kathryn Turman, the FBI's victim representative. "They come to us. We try to get the answers for them as much as possible. ... The message I try to get across to victims is: Life will never be the same again, but it can be good again."
The families' thirst for details is undiminished nearly three years after the attacks. Mueller said the PENTTBOM investigation will continue as long as there are leads to pursue.
"There is still information coming in," Galligan said, "and we still have so many unanswered questions."