History Commons Groups

February 13, 2010

July 2001 Communication between KSM and Bin al-Shibh Intercepted, Later Obtained by Moussaoui Prosecutors

A July 2001 telephone call between alleged 9/11 mastermind Khalid Shaikh Mohammed (KSM) and 9/11 coordinator Ramzi bin al-Shibh was intercepted, apparently by the NSA. Prosecutors and FBI agents working on the Zacarias Moussaoui case later obtained detailed information about the call, and shared it with the 9/11 Commission.

A memo about the meeting with the commission was found at the National Archives by History Commons contributor Erik Larson, who posted it to the 9/11 Document Archive at Scribd.

The three-page memo sets out events concerning Moussaoui in chronological order and the passage about the intercept is between events on 20 and 25 July 2001, indicating it took place within that five-day period.

The first sentence of the paragraph is redacted, but it continues:

Sally is probably Moussaoui, as there is discussion about sending money to Sally. There is a discussion about Teresa being late, which probably refers to [Flight 93 pilot Ziad] Jarrah and possible conflicts with [lead hijacker Mohamed] Atta about Jarrah’s isolation from the plot and perhaps uncertainty about whether he would carry out the attacks. It seems that Moussaoui may have been thought as a replacement, since there’s an exchange where KSM speaks of Teresa being late so send the money to Sally. KSM is concerned about Jarrah dropping out, stating that if there is a divorce, it will cost a lot of money. Bin al-Shibh tries to reassure him, saying it will be ok. KSM may have been concerned also because he had never met Jarrah and so did not know him personally. There is also a reference to “Danish leather” which is believed to be [“20th hijacker” Mohamed] al Qahtani. At this time, KSM was under great pressure from UBL [Osama bin Laden] to carry out the operation as soon as possible.

The code used by the two men is typical of al-Qaeda operatives talking on the phone, where innocuous words—in this case “Sally,” “Teresa,” “being late,” “divorce” and “Danish leather”—are substituted in for their real meanings. One example is “big wedding,” meaning “attack” or “bombing.” Another was revealed by former Alec Station chief Michael Scheuer in a PBS documentary about al-Qaeda intercepts: “Over time, if you read enough of these conversations, you first get clued in to the fact that maybe ‘bottle of milk’ doesn’t mean ‘bottle of milk.’”

The intercept raises a two key questions.

First, who intercepted the call and why? German authorities were monitoring bin al-Shibh’s associates (such as Mamoun Darkazanli, Mounir El Motassadeq and Mohammed Haydar Zammar), and the NSA and FBI were monitoring KSM at this time. However, the most likely explanation is that this was an NSA intercept of a call by bin al-Shibh, who it would therefore appear the NSA was tracking.

If the call had been intercepted based on surveillance of KSM, then a post-attack review of it would have made it immediately clear to the listener that KSM was heavily involved in planning 9/11. Bin al-Shibh was identified as an associate of the hijackers shortly after the attacks. However, the US allegedly failed to put together various pieces of intelligence indicating KSM was heavily involved until FBI investigator Ali Soufan got the information out of militant training camp facilitator Abu Zubaida in the spring of 2002, just before Zubaida was taken away from him by the CIA. Therefore, although bin al-Shibh was probably identified as one of the voices on the tape soon after 9/11, KSM must not have been.

In addition, there is a cryptic mention of this intercept in the 9/11 Commission report. A passage apparently drafted by Special Projects leader Barbara Grewe on page 277 says that “KSM had communicated with a phone that was used by bin al-Shibh, and … bin al-Shibh had used the same phone to communicate with Moussaoui.” However, there is no mention of what the source for this claim is in the endnotes. Analysis of the endnotes to the commission’s report indicates that although information from the CIA and FBI was sourced to these agencies in the report, information that apparently came from the NSA was not sourced to it. Sourcing for sections of the report based on NSA intelligence is missing, or the endnotes simply say “intelligence report,” without identifying the originating agency. The lack of sourcing for this section indicates a probable NSA origin.

The wider question is: why was the intercept not exploited to stop the plot? Exploitation of calls between the alleged mastermind and coordinator of the attacks would certainly have had such potential. While an attempt to examine the failings of the FBI and CIA has been made, the NSA—then headed by the controversial Michael Hayden—has largely escaped public scrutiny.

Finally, although not all materials from the Moussaoui trial are available, there is no public record of this intercept being used at the trial. As it indicates that Moussaoui, who escaped the death penalty by one vote, was being considered for a role in 9/11, it would certainly have been of interest to the jury.

Update: I kept digging and have some more information. According to this 9/11 Commission document the call was made on 20 July. The intercept was also mentioned elsewhere in the commission’s final report and in a staff statement, which make it clear that the first redacted sentence mentioned above is about sending “skirts” (a.k.a. “money”) to “Sally.”

Here is the quote from Staff Statement 16:

Perhaps the most significant evidence that Jarrah was reconsidering his participation in the 9/11 plot resides in the communications that took place between KSM and bin al-Shibh in mid-July 2001. During the spring and summer of 2001, KSM had a number of conversations that appear to have concerned the 9/11 plot. Both KSM and bin al-Shibh confirm discussing the plot during their mid-July conversation, which occurred just a few days before Jarrah embarked on his last trip to Germany.

At this point, Binalshibh had just returned from his meeting with Atta in Spain and was now reporting to KSM on the status of the plot. Concerned that Jarrah might drop out of the operation, KSM emphasized to Binalshibh the importance of ensuring peace between Jarrah and Atta.

In the course of discussing this concern and the potential delay of the plot, moreover, KSM instructed bin al-Shibh to send the, “skirts” to “Sally,” a coded reference instructing bin al-Shibh to send funds to Zacarias Moussaoui. Atta and Jarrah were referred to as an “unhappy couple.” KSM warned that if Jarrah, “asks for a divorce, it is going to cost a lot of money.”

The commission’s final report says:

As directed, upon returning from Spain, bin al-Shibh obtained two new phones, one to communicate with Atta and another to communicate with KSM and others, such as Zacarias Moussaoui. Bin al-Shibh soon contacted KSM and, using code words, reported the results of his meeting with Atta. This important exchange occurred in mid-July.151

The conversation covered various topics. For example, Jarrah was to send bin al-Shibh certain personal materials from the hijackers,including copies of their passports, which bin al-Shibh in turn would pass along to KSM, probably for subsequent use in al Qaeda propaganda.152

The most significant part of the mid-July conversation concerned Jarrah’s troubled relationship with Atta. KSM and bin al-Shibh both acknowledge that Jarrah chafed under Atta’s authority over him. Bin al-Shibh believes the disagreement arose in part from Jarrah’s family visits. Moreover, Jarrah had been on his own for most of his time in the United States because bin al-Shibh’s visa difficulty had prevented the two of them from training together. Jarrah thus felt excluded from the decisionmaking. Binalshibh had to act as a broker between Jarrah and Atta.153

Concerned that Jarrah might withdraw from the operation at this late stage, KSM emphasized the importance of Atta and Jarrah’s resolving their differences. Bin al-Shibh claims that such concern was unwarranted, and in their mid July discussion reassured KSM that Atta and Jarrah would reconcile and be ready to move forward in about a month, after Jarrah visited his family. Noting his concern and the potential for delay, KSM at one point instructed bin al-Shibh to send “the skirts” to “Sally”–a coded instruction to bin al-Shibh to send funds to Zacarias Moussaoui. While bin al-Shibh admits KSM did direct him to send Moussaoui money during the mid-July conversation, he denies knowing exactly why he received this instruction–though he thought the money was being provided “within the framework” of the 9/11 operation.154

The endnotes for this passage read as follows:

151. On bin al-Shibh’s new phones, see Intelligence report, interrogation of bin al-Shibh, Dec. 21, 2002. On bin al-Shibh’s call to KSM, see Intelligence reports, interrogations of bin al-Shibh, Oct. 1, 2002; Mar. 31, 2003. CIA cable, Sept. 10, 2003; CIA report, Director’s Review Group, Oct. 2003.

152. Intelligence report, interrogation of KSM, Oct. 31, 2003; Intelligence report, interrogation of bin al-Shibh, Nov. 1, 2003. KSM may also have intended to include these documents as part of the historical file he maintained about the 9/11 operation. He says the file included letters and email communications among those involved with the attacks, but was lost in Afghanistan when he fled after September 11. Intelligence report, interrogation of KSM, Oct. 15, 2003.

153. Intelligence reports, interrogations of bin al-Shibh, Nov. 1, 2003; Oct. 11, 2003; Intelligence report, interrogation of KSM, Oct. 31, 2002.

154. Intelligence reports, interrogations of bin al-Shibh, Oct. 31, 2002; Dec. 19, 2002; Apr. 17, 2003; Oct. 11, 2003; Nov. 1, 2003; Intelligence report interrogation of KSM, Sept. 11, 2003

No reference to any intercept by the NSA or anyone else there, but plenty to interrogation reports referencing the call.

Finally, the document linked to at the top (this one), suggests that one of the panels at a public hearing was to be asked about this:

What more can you tell us about the communications between the plotters during the summer of 2001 and the July 20 conversation? (Panelists are unlikely to elaborate on this question; it is merely designed to highlight the existence of the conversations.)

Here is the hearing transcript. I don’t see this question being asked.


  1. Correct me if I’m wrong; the context and wording of the passage you quoted from the Commission memo indicates it’s based on a tape or transcript of an intercepted call, not interrogation notes. The call was probably intercepted by the NSA, it happened sometime between July 20-25, and probably on July 20, given the proposed Commission question.

    The wording/context of the quoted passage from Staff Statement 16 indicates it’s based on both intercept tapes/transcripts and interrogation reports.

    The wording/context of the unsourced Commission Report passage you attribute to Grewe also indicates calls from and to bin al-Shibh’s phone had been intercepted prior to 9/11, though it was allegedly not until after 9/11 that the significance was understood.

    The passage in the Commission report based on info obtained by interrogation of KSM and bin al-Shibh refers to a call in “mid-July”, and does not refer to an intercepted call, but the info obtained correlates closely with what was learned from the intercepted call.

    When the hearing was held, the proposed question was not asked.

    While the conversation was cryptic, as part of the larger pattern of calls and intelligence, some of which is public, it would have indicated the existence and progress of the impending 9/11 plot. There’s nothing public indicating the July 20 call or any other intelligence related to people being monitored by the NSA and FBI was used to heighten alert levels or boost security in the US or anywhere else- let alone disrupt the plot.

    Despite knowing about the call, the Commission failed to raise questions about it in public hearings, and other than the quoted ‘cryptic’ passage, there’s no mention of it in their Report.

    Is there anything about this in the JI records?

    I wonder what else has been left out of the official version of 9/11-related events.

    Comment by Erik Larson — February 14, 2010 @ 11:48 am | Reply

  2. Erik, yes, that’s basically it.

    When I read the passage in the 9/11 commission report (which, when I read it again having worked out that the call was intercepted by somebody–probably the NSA–now seems obviously to have come from an intercept) I figured it was not from an intercept, because it was sourced to the interrogations and I stupidly thought the commission would have pointed out explicitly that the NSA intercepted the call if it had, rather than trying to pull a fast one on their readers. I guess plenty of other people made the same mistake.

    Comment by kevinfenton — February 14, 2010 @ 1:27 pm | Reply

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Create a free website or blog at WordPress.com.

%d bloggers like this: