Scope: United States and Saudi-linked activity from the January 2000 Kuala Lumpur meeting through the current U.S. civil-litigation record, assessing whether public evidence establishes that the CIA, through Saudi liaison channels, attempted to recruit Nawaf al-Hazmi and Khalid al-Mihdhar and then suppressed inquiry.

Executive Summary / BLUF

• The public record establishes a grave CIA–FBI information-sharing failure concerning al-Hazmi and al-Mihdhar; it does not establish a CIA-directed recruitment operation.
• Omar al-Bayoumi provided consequential logistical assistance to the two men shortly after their arrival in California; later litigation has made his official Saudi connections more consequential than the 9/11 Commission’s 2004 treatment.
• A 2021 military-defense investigator’s declaration records multiple former officials alleging that Saudi intelligence approached the pair for a CIA liaison recruitment effort and that inquiry was obstructed.
• Those allegations are material investigative leads, not adjudicated facts: most decisive sources are anonymous, several state beliefs or inferences, and no public tasking order, cable, asset file, contact report, or payment record proves CIA direction.
• The visa record shows permissive and inconsistent consular screening, including 22 approvals from 23 hijacker applications; it does not show that visas were issued on CIA instructions.
• The 2004 Commission found no credible evidence that Bayoumi knowingly aided extremists and no evidence that a foreign government or official funded the plot; later evidence and litigation weaken the completeness of that baseline but do not prove the stronger CIA thesis.
• The 2025 district-court ruling allowed claims against Saudi Arabia to proceed past a threshold stage; it did not determine liability on the merits or adjudicate CIA conduct.
• Net assessment: high confidence in institutional failure; moderate confidence that Saudi-linked officials monitored or assisted the pair; low confidence / not publicly established that the assistance formed a CIA-directed recruitment operation.
• The decisive uncertainty can be resolved only by authenticated operational records or named, independently corroborated testimony with direct knowledge.

Yanbu Under Threat: Saudi Arabia’s Red Sea Exposure

Riyadh May Face the Court, but the CIA Liaison Question Remains Outside It

On the eve of the 25th anniversary of 9/11, the New York civil action against Saudi-linked operative Omar Bayoumi presents a narrower question than its political consequences suggest. The immediate fiscal exposure belongs to Riyadh; the diplomatic cost falls across the US–Saudi relationship; and the institutional risk reaches the CIA and FBI. Operation Encore was described as assigning a “50/50 chance” that Bayoumi possessed detailed advance knowledge, while a later court filing records confidential-source allegations that the CIA sought to recruit Nawaf Hazmi and Khalid Mihdhar through Saudi Arabia’s General Intelligence Directorate. If litigation isolates Saudi conduct while leaving that alleged liaison chain untested, it may allocate liability without resolving command, knowledge or purpose. The decisive issue is therefore not whether Saudi-linked assistance existed, but whose operation that assistance served.

Riyadh is exposed in court while the alleged liaison chain remains protected

The forthcoming New York District Court case has been presented as a route to “smoking gun” evidence against Riyadh, yet its case number, hearing date and precise procedural posture are [NOT IN DOSSIER]. What is documented in the dossier is the asymmetry: Omar Bayoumi is placed at the centre of the Saudi case, while a filing that surfaced publicly one year after March 2022 alleges that the General Intelligence Directorate acted through a “liaison relationship” with the CIA.

That distinction changes the object of inquiry. If Bayoumi acted solely for Riyadh, the civil case is directed at the relevant state relationship. If the confidential-source allegations are accurate, Saudi intelligence may instead have functioned as a CIA “proxy” or “cutout” for an approach that US officers considered unwise or impractical to conduct directly on American soil. The filing alleges the second model; it does not, within the dossier, supply a named CIA operational order, a liaison cable or an authenticated asset file.

Operation Encore’s “50/50” finding raises the stakes but does not identify command

Operation Encore is described as concluding that there was a “50/50 chance” Bayoumi—and, by extension, the House of Saud—had detailed advance knowledge of the attacks; that assessment was not publicly disclosed until March 2022. The formulation is politically explosive because it moves Bayoumi beyond accidental contact, but analytically incomplete because a numerical split does not identify who tasked him, what he knew or whether the inference to the Saudi state was institutional, operational or merely derivative.

A court filing surfaced publicly one year later and introduced a different causal chain. Based on classified government discovery disclosures and interviews with anonymous senior US intelligence officials, it alleges that the CIA sought to recruit at least Hazmi and Mihdhar through the Saudi General Intelligence Directorate. That allegation does not erase the Saudi question: it makes the purpose of Saudi assistance the central issue and separates state attribution from ultimate operational sponsorship.

Bayoumi converted a January 2000 encounter into settlement infrastructure

Nawaf Hazmi and Khalid Mihdhar arrived in the United States in January 2000 and encountered Bayoumi at an airport restaurant. FBI reports cited in the filing record a witness who said Bayoumi dropped a piece of paper near their table and initiated conversation in an “unnatural” manner; the witness gave that account to the FBI in 2002, but it was not publicised.

Bayoumi subsequently found the pair an apartment, co-signed their lease, helped establish bank accounts, provided money towards rent and organised a social gathering. In later Operation Encore interviews, he characterised the encounter as happenstance and the assistance as charity to fellow Muslims with weak English and little familiarity with Western society. The filing instead alleges that Saudi Ministry of Islamic Affairs official Fahad Thumairy instructed him at the Saudi Consulate in Los Angeles to recruit the two men.

Housing, banking, introductions and social cover reduced the operational friction facing Hazmi and Mihdhar immediately after entry. The filing further states that Bayoumi was in California to monitor Saudi dissidents and was seen with the future hijackers on numerous occasions. What remains [NOT IN DOSSIER] is the primary tasking document that would distinguish charitable facilitation, Saudi surveillance, recruitment activity and knowing support for an attack.

The Jeddah visa record turns administrative weakness into an operational question

Fifteen of the 19 hijackers obtained 18 US visas in Saudi Arabia; 14 were issued at the US Consulate in Jeddah, and 11 by consular officer Shayna Steinger. The dossier states that applications were often incomplete, error-strewn or based on forged documents, while the consulate remained divided between stricter interviews for young Saudi men and a more permissive policy.

Shayna Steinger arrived in Jeddah in July 2000 and approved applications for 11 future hijackers. She interviewed Hani Hanjour, initially rejected his request for a three-year visa, then approved a renewed application two weeks later. In subsequent inquiries, she first said Hanjour supplied supporting documentation and later acknowledged that he had not, explaining her judgement by reference to his “middle-class” background.

The filing’s confidential source alleges that Hazmi and Mihdhar received visas to facilitate a Saudi GID–CIA operation. That is not equivalent to proof that Steinger acted under CIA instruction: the dossier contains no directive, contact record or testimony linking her to the Agency. Consular adjudication files, internal communications and any intelligence-community requests would separate permissive processing from deliberate facilitation; those records are [NOT IN DOSSIER].

Shaikh made the FBI’s closest access point its most consequential blind spot

From September 2000, Hazmi and Mihdhar lodged with Abdussattar Shaikh, described in the dossier as a long-term FBI informant and asset. Shaikh did not provide their surnames when his handler asked. The joint congressional and Senate intelligence inquiry later characterised their residence with him as the US intelligence community’s “best chance to unravel the September 11 plot”.

The filing adds that Shaikh received funds from Riyadh, housed prominent Saudi visitors and monitored Saudi citizens abroad. It also states that Hani Hanjour stayed with him alongside Hazmi after Mihdhar returned to Saudi Arabia in late 2000. These claims create a possible overlap among FBI access, Saudi monitoring and three future hijackers, but the dossier provides no payment records, handler instructions or Saudi tasking document.

By late 2000, an FBI source was close enough to report two boarders later central to 9/11, yet the absence of surnames prevented that proximity from becoming a usable lead. Whether Shaikh failed, protected, monitored or simply misunderstood them remains unresolved; the source file and financial trail needed to decide among those explanations are [NOT IN DOSSIER].

The blocked January 2000 report is the hinge between failure and concealment

In January 2000, an FBI special agent assigned to Alec Station—the CIA unit tracking al-Qaeda—learned that Hazmi and Mihdhar, described as known al-Qaeda operatives under intensive CIA and NSA surveillance, held multi-entry US visas and drafted a report for FBI headquarters. According to the agent’s account in the filing, an unnamed CIA analyst blocked transmission. The same analyst allegedly directed the GID to contact the two men after arrival and later told US inquiries, falsely, that the FBI had been informed.

The filing also attributes a more serious allegation to that FBI agent: CIA Director George Tenet and Director of Operations James Pavitt allegedly discussed concealing the analyst’s identity and activity from the 9/11 Commission. Separately, the filing says Commission Executive Director Philip Zelikow worked to “blunt” investigation of Saudi involvement, while senior FBI officials prevented investigators from interviewing Saudi nationals despite numerous leads pointing to the Saudi Embassy in Washington.

These accounts are not interchangeable with findings. They originate in confidential-source testimony summarised in a filing, and the dossier contains no contemporaneous minutes, dissemination order or Commission directive. An intelligence failure becomes protection of an operation only if records establish that information was withheld to preserve recruitment, liaison or source equities. Without the January 2000 draft, routing history and CIA–GID traffic, motive remains [NOT IN DOSSIER].

The next 12–24 months will determine whether litigation finds liability or merely a defendant

Over the next 12–24 months, the New York civil process can impose evidentiary discipline on the Bayoumi–Thumairy network only to the extent that it reaches primary records. Operation Encore’s March 2022 disclosure, the January 2000 blocked report, the 18 Saudi-issued visas and Shaikh’s late-2000 proximity provide four documentary routes; none, as presented in the dossier, completes the chain from CIA instruction to GID tasking, Bayoumi contact and reporting back.

If proceedings test Saudi conduct but exclude the alleged liaison relationship, Riyadh carries the litigation and diplomatic exposure while US intelligence institutions avoid adjudication of the filing’s central claim. If no primary tasking, payment, visa or dissemination records emerge, the families bear the cost through another partial account; the FBI bears it in source-handling credibility; and the CIA bears it in an unresolved allegation of operational concealment. The procedural choice is whether to examine the full chain or price responsibility at the first state actor that can be brought before the court.

Yemen Proxy War: Saudi Re-entry and Red Sea Risk

---

Navigational Index

1. Documented institutional failure — what U.S. official inquiries establish about watchlisting, notification, and missed opportunities.
2. Saudi-linked support and the liaison allegation — what is established about Bayoumi, Thumairy, Shaikh, and what the Canestraro declaration actually proves.
3. Legal significance and unresolved proof — what the civil case changes, what it does not decide, and which records could change the assessment.

---

Master Abstract

The strongest finding is failure, not recruitment

The most defensible public account begins with an established intelligence failure. The CIA possessed information connecting al-Mihdhar and al-Hazmi to the January 2000 Kuala Lumpur al-Qaeda meeting but did not timely place them on watchlists or notify the FBI that they might travel to, or were present in, the United States. The 9/11 Commission also found that later congressional testimony suggesting the FBI had access to the relevant reporting was inaccurate. It characterized the resulting sequence as lost operational opportunities, while the Joint Inquiry judged the pair’s later residence with FBI informant Abdussattar Shaikh as perhaps the Intelligence Community’s best chance to unravel the plot—although whether it would have done so remained speculative. The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004 Report of the Joint Inquiry into the Terrorist Attacks of September 11, 2001 — U.S. Senate Select Committee on Intelligence and U.S. House Permanent Select Committee on Intelligence — Dec 2002

That record establishes failure and inaccurate retrospective representation. It does not identify the motive for every withheld communication. Bureaucratic compartmentation, legal misunderstandings, interpersonal conflict, protection of sources and methods, and an undisclosed recruitment attempt are different explanations. The public record supports the first four as classes of institutional mechanism more directly than it supports the fifth as a specific operation. Treating non-disclosure as proof of recruitment reverses the evidentiary burden: a motive must be demonstrated independently, not inferred solely from the failure it is offered to explain.

Saudi-linked assistance is real; knowledge and direction remain contested

Bayoumi met al-Hazmi and al-Mihdhar soon after their arrival in California and helped them obtain housing and establish themselves. The 9/11 Commission recorded Bayoumi’s nominal employment by a Saudi aviation contractor and a sharp increase in his monthly allowance around the relevant period. On the evidence then before it, however, the Commission reported no credible evidence that he believed in violent extremism or knowingly aided extremists. It also found no evidence that the Saudi government as an institution or senior Saudi officials individually funded al-Qaeda, and no evidence that any foreign government or official funded the 9/11 plot. These are bounded 2004 findings, not proof that every later-disclosed Saudi connection was innocent. The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004

The legal baseline changed with the Justice Against Sponsors of Terrorism Act. JASTA created a terrorism-related exception to foreign sovereign immunity and civil secondary-liability pathways, including knowing substantial assistance; negligence alone is insufficient for aiding-and-abetting liability. Justice Against Sponsors of Terrorism Act, Public Law 114-222 — U.S. Congress — Sep 2016 In August 2025, the district court declined to dismiss the claims against Saudi Arabia after finding the plaintiffs had presented reasonable evidence concerning the alleged roles of Bayoumi, Fahad al-Thumairy, and the Kingdom, while Saudi Arabia had not supplied sufficient contrary evidence at that stage. That ruling is a threshold determination in civil litigation, not a final finding that Saudi Arabia knowingly supported the attack and not a finding about CIA operational direction. Opinion and Order, In re Terrorist Attacks on September 11, 2001 — U.S. District Court for the Southern District of New York — Aug 2025

Saudi Arabia’s War Pivot: Deterrence or Entrapment?

The Canestraro declaration creates a collection requirement, not a smoking gun

Donald Canestraro, an investigator for the Military Commissions Defense Organization, signed a 2021 declaration summarizing interviews and records reviewed during defense investigation. It attributes to confidential former FBI and CIA personnel—and, in one passage, former counterterrorism official Richard Clarke—the belief or allegation that CIA personnel sought to penetrate al-Qaeda by having Saudi intelligence approach al-Hazmi and al-Mihdhar, concealed the effort from the FBI, and later obstructed scrutiny. The declaration also records allegations that an FBI-drafted central intelligence report was blocked, that investigators were restricted from interviewing Saudi nationals, and that Commission inquiry into Saudi links was blunted. Declaration of Donald C. Canestraro — Military Commissions Defense Organization — Jul 2021

Its evidentiary meaning is narrower than the underlying article’s rhetoric. The signed declaration establishes that Canestraro reported receiving those accounts; it does not independently authenticate every account or transform them into judicial findings. The most consequential operational allegation is anonymous, frequently expressed as what a source “believed,” and partly corroborated by other witnesses only as to information withholding—not as to CIA tasking of Bayoumi or the Saudi General Intelligence Directorate. One source said the alleged withheld cable was not disclosed during contemporaneous Joint Inquiry or CIA Inspector General questioning, citing fear; another witness cautioned that without a paper trail the claim was difficult to establish. Clarke’s stated belief supplies a senior, named analytic inference but not direct operational testimony. No retrieved public record contains a CIA tasking order, liaison-service request, recruitment plan, handler report, asset-validation record, operational payment, or after-action review tying Bayoumi’s assistance to CIA direction.

The visa pattern is diagnostic of weak screening, not covert facilitation

The official travel monograph found 23 visa applications by the 19 hijackers, of which 22 were approved; only two applicants were interviewed. Eighteen visas were issued in Saudi Arabia, 14 in Jeddah, and 11 by one officer. The surviving applications were incomplete, but the pre-9/11 Saudi process functioned as a de facto permissive regime in which most applicants without a database hit were approved. Consular personnel were also unaware of passport-manipulation indicators later associated with extremists. 9/11 and Terrorist Travel — National Commission on Terrorist Attacks Upon the United States — Aug 2004

Hani Hanjour’s September 2000 application was initially refused under Immigration and Nationality Act section 221(g) after an interview and then approved when he reapplied as a student with an I-20 form. The sequence supports criticism of screening quality; it does not establish that a consular officer acted under intelligence instruction. 9/11 and Terrorist Travel — National Commission on Terrorist Attacks Upon the United States — Aug 2004 The claim that the CIA arranged visas therefore remains an allegation reported by a confidential source, with a strong alternative explanation in documented consular practice and no public operational or personnel record connecting the issuing decisions to the Agency.

Net assessment and decision consequence

The public evidence supports a graduated judgment. First, the information-sharing failure is established beyond serious dispute. Second, Bayoumi’s assistance and official Saudi connections justify continued judicial and documentary scrutiny; the 2025 ruling shows that the Saudi-linked case cannot be dismissed as mere speculation at the preliminary stage. Third, a Saudi monitoring or recruitment effort—whether conducted for Saudi purposes or in liaison with U.S. intelligence—is a serious unresolved proposition. Fourth, the specifically alleged CIA-directed recruitment operation and subsequent coordinated cover-up are not publicly proven. The further assertion that such an operation “resulted in 9/11” is more remote still: it requires proof of tasking, operational contact, causation, and foreknowledge that the retrieved record does not supply.

For decision-makers, the appropriate response is preservation and controlled disclosure, not premature exoneration or accusation. The FBI’s Executive Order 14040 repository confirms a substantial continuing release corpus concerning the Saudi support investigation, but a release index cannot resolve what remains redacted or outside the published files. 9/11 Material Released in Response to Executive Order 14040 — Federal Bureau of Investigation — Sep 2021–present Review priorities should be records linking Bayoumi and Thumairy to Saudi government tasking, CIA–GID liaison traffic, Alec Station dissemination logs, visa referral or security-advisory records, and unredacted Operation Encore assessments. The judgment should move toward the CIA-liaison hypothesis only if records or direct named witnesses independently connect CIA personnel to Saudi tasking or reporting on the pair before 11 September 2001.

Key Evidence Table

Indicator	Value/status	Reference date	Definition/scope	Issuer	Exact source
CIA–FBI notification	Material information on al-Mihdhar and al-Hazmi was not timely passed; later testimony implying FBI access was inaccurate	Jan 2000–Aug 2001; report Jul 2004	Watchlisting, travel, and interagency notification	9/11 Commission	The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004
Best domestic investigative opportunity	The pair’s residence with an FBI informant was described as perhaps the Intelligence Community’s best chance to unravel the plot; outcome remains speculative	2000–2001; report Dec 2002	Counterterrorism investigation	Congressional Joint Inquiry	Report of the Joint Inquiry into the Terrorist Attacks of September 11, 2001 — U.S. Senate Select Committee on Intelligence and U.S. House Permanent Select Committee on Intelligence — Dec 2002
Hijacker visa applications	23 applications; 22 approvals; two applicants interviewed	1997–2001; monograph Aug 2004	All 19 hijackers’ known U.S. non-immigrant visa applications	9/11 Commission staff	9/11 and Terrorist Travel — National Commission on Terrorist Attacks Upon the United States — Aug 2004
Saudi-issued visas	18 visas issued in Saudi Arabia; 14 in Jeddah; 11 by one officer	1997–2001; monograph Aug 2004	Issuing-post distribution, not evidence of intelligence tasking	9/11 Commission staff	9/11 and Terrorist Travel — National Commission on Terrorist Attacks Upon the United States — Aug 2004
CIA–GID recruitment allegation	Multiple confidential-source accounts and a named senior official’s belief; no public operational document retrieved	Interviews 2016–2018; declaration Jul 2021	Defense-investigator declaration; mostly anonymous attributed testimony	Military Commissions Defense Organization investigator	Declaration of Donald C. Canestraro — Military Commissions Defense Organization — Jul 2021
Saudi civil-liability threshold	Claims permitted to proceed past Saudi Arabia’s dismissal challenge; no merits finding	Opinion Aug 2025	Civil jurisdiction and preliminary evidentiary sufficiency under JASTA	U.S. District Court, SDNY	Opinion and Order, In re Terrorist Attacks on September 11, 2001 — U.S. District Court for the Southern District of New York — Aug 2025
Published declassification corpus	Multiple FBI release tranches remain publicly indexed	2021–2024 releases; accessed Sep 2026	EO 14040 records concerning 9/11 investigations and related material	FBI	9/11 Material Released in Response to Executive Order 14040 — Federal Bureau of Investigation — Sep 2021–present

Competing Explanations

The ACH gate is met because three distinguishable explanations generate different documentary and testimonial predictions. They are framed around the principal reason for the Saudi-linked contact and U.S. non-disclosure; incidental overlap remains possible.

Hypothesis	Diagnostic support	Disconfirming evidence	Indicators	Current standing
H1 — Institutional failure plus unwitting assistance: information remained compartmented through error, policy, and conflict; Bayoumi helped the pair without knowing their plot	Official inquiries document missed watchlisting, notification failures, the intelligence/law-enforcement “wall,” and permissive visa practice; 2004 Commission found no credible evidence Bayoumi knowingly aided extremists	Does not readily explain all alleged restrictions, retrospective inaccuracies, Bayoumi’s official connections, or the concentration of Saudi-linked contacts	Contemporaneous error reports; dissemination logs showing routine handling; records excluding operational tasking	Best-supported baseline, but later Saudi-linked evidence makes a wholly coincidental account less satisfactory than in 2004
H2 — Saudi-directed monitoring or recruitment without CIA control: Saudi officials or intelligence-linked personnel tracked, assessed, or sought to recruit the pair for Saudi purposes, without knowing the 9/11 plan	Bayoumi’s official links, extensive assistance, alleged Thumairy contact, Saudi monitoring context, and the 2025 court’s threshold assessment	No final merits judgment; public record does not establish the content of any Saudi tasking or prove knowledge of the attack	GID/Islamic Affairs tasking, reporting chains, payments, consular communications, Bayoumi/Thumairy handler records	Serious and strengthened relative to 2004, but purpose, authorization level, and foreknowledge remain unresolved
H3 — CIA-directed liaison recruitment concealed from the FBI: CIA personnel used the GID or Saudi-linked intermediaries to approach the pair and protected the operation	Canestraro declaration records several mutually reinforcing allegations; CIA had a clear collection interest in penetrating al-Qaeda; established non-disclosure is consistent with source-protection behavior	Decisive testimony is anonymous or inferential; some accounts were not contemporaneously disclosed; no public tasking, contact, reporting, payment, or asset record; visa data have a documented systemic explanation	Authenticated CIA–GID traffic; Alec Station operational files; named handlers; Saudi reporting passed to CIA; independent direct witness corroboration	Plausible investigative hypothesis, not publicly established; materially weaker than the evidence for information-sharing failure

Principal Gaps and Watch Indicators

• CIA–GID operational traffic: tasking, liaison requests, contact reports, asset-validation documents, compartment records, and after-action reviews concerning al-Hazmi, al-Mihdhar, Bayoumi, or Thumairy. A verified pre-9/11 reporting chain from a Saudi intermediary to CIA personnel would materially strengthen H3; a complete negative search with auditable record controls would weaken it.
• Alec Station dissemination audit: original cable drafts, routing metadata, approval logs, desk notes, and Inspector General interview records. These would distinguish deliberate operational compartmentation from policy error, analytic conflict, or retrospective reconstruction.
• Operation Encore’s underlying assessment: the public record reviewed here does not authenticate the quoted “50/50 chance” formulation or establish its exact referent, analytic method, or approval level. The signed final assessment, annexes, and source-validation record are required before treating that phrase as an FBI conclusion.
• Saudi tasking and finance: original GID, Ministry of Islamic Affairs, diplomatic, contractor, payroll, and banking records defining Bayoumi’s and Thumairy’s duties. These would clarify whether observed support reflected charity, monitoring, recruitment, or knowing facilitation.
• Visa referral trail: consular lookout checks, security-advisory opinions, intelligence referrals, and personnel communications for the relevant applicants. Routine adjudication records would weaken covert-facilitation claims; a non-routine intelligence instruction would sharply strengthen them.
• Named direct testimony: public, cross-examinable testimony from personnel who issued, received, or reviewed the alleged tasking. Independent convergence on operational details—not merely on the known information-sharing failure—is the critical indicator.
• Civil-case merits record: admissibility rulings, authenticated exhibits, depositions, and any final findings. Movement past dismissal increases the importance of the allegations but should not be mistaken for proof until the evidentiary record is tested.

Documented Institutional Failure

Principal judgment

U.S. official inquiries establish a sustained institutional failure to convert correctly collected intelligence on Khalid al-Mihdhar and Nawaf al-Hazmi into coordinated domestic action. Between January 2000 and late August 2001, the CIA did not timely watchlist the two men or transmit three decisive facts to the FBI: al-Mihdhar held a valid multiple-entry U.S. visa; al-Hazmi had flown to Los Angeles; and Tawfiq bin Attash—“Khallad,” a senior al-Qaeda operative implicated in the USS Cole bombing—had attended the Kuala Lumpur meeting with them. When the FBI finally received enough information to open a search, internal restrictions, low prioritization, weak supervision, and elementary investigative omissions further reduced the remaining opportunity.

The record supports high confidence that the failure was repeated, multi-agency, and systemic rather than a single clerical lapse. It supports high confidence that several identifiable interventions could have created earlier opportunities to identify, exclude, locate, or monitor the men. It does not establish that any one intervention would have prevented the attacks, that U.S. authorities possessed specific intelligence about the 9/11 plot, or that the information was withheld to protect a CIA–Saudi recruitment operation. The last proposition remains a separate hypothesis requiring evidence of operational motive that the official failure findings do not supply.

The failure chain

Collection identified the threat but did not produce a managed operation

The initial intelligence collection was not the principal failure. By late 1999, signals intelligence had identified men called Khalid and Nawaf whose travel suggested that an operational al-Qaeda group was assembling. Surveillance of the January 2000 Kuala Lumpur meeting produced photographs and travel information. The CIA learned that al-Mihdhar held a valid multiple-entry U.S. visa and, by early March, that al-Hazmi had flown from Bangkok to Los Angeles on 15 January 2000. Staff Statement No. 2: Three 9/11 Hijackers: Identification, Watchlisting, and Tracking — National Commission on Terrorist Attacks Upon the United States — Jan 2004

The operational breakdown occurred after the targets dispersed. No authority assumed end-to-end responsibility for reconstructing their identities, mapping likely onward destinations, establishing alternative interception points, or assigning a domestic lead. The Commission found no evidence of continued tracking once the men disappeared in Bangkok. It later identified two strategic management errors: the failure to assemble an all-source background assessment and the failure to establish systematic coverage of predictable travel routes. A U.S. visa in al-Mihdhar’s passport made the United States an evident destination or interdiction point, yet neither the FBI nor the Immigration and Naturalization Service was alerted before the two men entered through Los Angeles. Staff Statement No. 2: Three 9/11 Hijackers: Identification, Watchlisting, and Tracking — National Commission on Terrorist Attacks Upon the United States — Jan 2004

This distinction is decisive. The official record does not describe an intelligence community wholly unaware of the targets. It describes institutions that acquired significant fragments but failed to designate an official responsible for integrating them and sustaining the operation across CIA stations, headquarters, NSA, State Department, immigration authorities, and the FBI.

Watchlisting was delayed for approximately nineteen months

Before 9/11, the State Department’s TIPOFF system was the principal U.S. watchlist dedicated to suspected terrorists. Its function was not equivalent to the modern consolidated screening system and it was separate from the Federal Aviation Administration’s limited no-fly list. Adding al-Mihdhar or al-Hazmi to TIPOFF would not, by itself, have prevented either man from boarding a domestic aircraft on 11 September. It would have allowed visa and border encounters to alert diplomatic, immigration, intelligence, and law-enforcement authorities. Staff Statement No. 2: Three 9/11 Hijackers: Identification, Watchlisting, and Tracking — National Commission on Terrorist Attacks Upon the United States — Jan 2004

The CIA did not nominate al-Mihdhar and al-Hazmi for the U.S. terrorism watchlist when it learned of al-Mihdhar’s visa in January 2000 or al-Hazmi’s Los Angeles travel in March. The first official record of either man being placed on a U.S. watchlist dates to 24 August 2001, after analysts rediscovered the travel information and confirmed that al-Mihdhar had re-entered the United States on 4 July without a recorded departure. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

The Commission therefore rejected a narrow conception of the episode as merely a watchlisting error. Watchlisting was a tool within a larger intelligence process: it could support denial of entry, generate an encounter, or permit surveillance and network discovery. The deeper failure was that no integrated operational plan determined which outcome the government wanted. The official counterfactual is appropriately limited. The Commission judged that watchlisting alone probably would not have prevented 9/11 because al-Qaeda could replace non-pilot operatives, but it emphasized that the government lost the opportunity to decide whether to exclude, question, or monitor the men. The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004

A drafted warning to the FBI was placed on hold

In January 2000, an FBI employee detailed to the CIA’s Counterterrorist Center drafted a Central Intelligence Report intended to inform the Bureau about al-Mihdhar’s visa, his suspected al-Qaeda associations, and the Malaysia meeting. A note indicated that a deputy chief in the CIA’s Bin Laden Unit directed that the report be held. The detailee asked once about its status eight days later, but the report was never released to the FBI. The Justice Department Inspector General found no witness who remembered why it was held and no later documentary action resolving its status. It judged both that the CIA should have transmitted the report and that the FBI detailee should have pursued its dissemination more forcefully. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

This is the strongest documented episode behind allegations that information was deliberately blocked. What it establishes is specific: a warning was drafted, placed on hold by CIA management, and not sent. What it does not establish is the reason. The Inspector General could not determine a motive, and the officials interviewed did not recall the decision. The evidentiary gap must not be filled retrospectively with either an innocent administrative explanation or a covert-recruitment explanation. Both go beyond the official finding.

The episode also exposes a structural weakness in the liaison arrangement. FBI detailees inside the Counterterrorist Center could read CIA traffic but lacked independent dissemination authority. Their duties were not governed by a memorandum of understanding, supervisors held inconsistent expectations about whether they were meant to identify information relevant to the FBI, and performance evaluations remained tied to their nominal FBI positions rather than their work inside the CIA. The Justice Department Inspector General concluded that neither agency had created a shared understanding of what the detailees were responsible for transmitting or how they should act as institutional backstops. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

The Khallad identification did not reactivate the search

In January 2001, a joint FBI–CIA source identified Khallad in a photograph from the Kuala Lumpur meeting. This linked al-Mihdhar’s travel group to a senior operative associated with the October 2000 bombing of the USS Cole. The CIA did not renew the abandoned search for al-Mihdhar and al-Hazmi or promptly notify the principal FBI Cole investigators. Director of Central Intelligence George Tenet and Counterterrorist Center Director Cofer Black later testified to the Joint Inquiry that the FBI had access to the identification from the beginning. After examining a broader record, including documents unavailable to the personnel who prepared that testimony, the 9/11 Commission concluded that the FBI’s primary Cole investigators did not possess the information before the attacks. The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004

The discrepancy establishes that the congressional account supplied by senior CIA leaders was inaccurate. It does not, without additional evidence, establish that Tenet or Black knowingly lied. The Commission traced part of the failure to compartmented reporting: the FBI agent working with the source received disseminated CIA reports but lacked access to more detailed operational cables containing the identification. The CIA officer involved did not recall the specific identification and could not explain why it was not shared. The failure therefore combined restrictive information architecture, incomplete translation and reporting practices, and an absence of management follow-through.

The missed January 2001 opportunity was particularly consequential. Al-Mihdhar was then outside the United States, while al-Hazmi remained inside. A renewed review could have triggered al-Mihdhar’s watchlisting before he applied for another visa in June and returned through New York on 4 July; it could also have initiated a domestic search for al-Hazmi. This remains a potential opportunity, not proof of a preventable outcome.

Spring and summer reviews repeatedly stopped short of dissemination

The existing record resurfaced several times during the elevated threat period of 2001. In May, a CIA officer detailed to the FBI and a CIA analyst reviewed cables showing al-Mihdhar’s visa and al-Hazmi’s Los Angeles travel. The officer recognized that the underlying network was dangerous but focused on the Malaysia dimension and did not alert his FBI counterpart to the U.S. nexus. In July, he rediscovered the Khallad identification, characterized it as important, and asked whether it could be transmitted to the FBI. No official record shows that the CIA supplied it until 30 August. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

At an 11 June meeting, CIA and FBI personnel discussed the Malaysia meeting in the context of the Cole investigation. An FBI analyst possessed NSA-derived information connecting al-Mihdhar to a suspected al-Qaeda communications facility but withheld it from FBI criminal investigators because of concerns about the legal and procedural “wall” separating intelligence and criminal cases. The Inspector General found that, by summer 2001, fear of violating Foreign Intelligence Surveillance Act procedures had produced a near-complete separation between the two sides of the Bureau. New York agents described the rules as a maze; headquarters personnel feared professional consequences if information crossed improperly. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

The wall was therefore a real institutional constraint, but it was also applied more broadly and rigidly than the facts required. It explains why personnel hesitated to involve experienced criminal investigators; it does not explain the earlier CIA failure to nominate the men for watchlisting or communicate their U.S. travel. Nor does it explain why senior managers failed to adjudicate the conflict rapidly once the domestic threat became apparent.

The late-August search lacked urgency and experienced resources

On 21–22 August 2001, analysts located the old CIA cables and confirmed through immigration records that al-Mihdhar had entered at New York on 4 July and had no recorded departure. CIA personnel then initiated watchlisting, and on 29 August the FBI’s New York Field Office opened a full-field intelligence investigation. The assignment went to a relatively inexperienced agent conducting his first intelligence investigation. He was not told that the matter was an emergency, began substantive work on 4 September after another case, and initially submitted an immigration lookout that did not mark al-Mihdhar as a security or terrorism subject. Searches focused on New York Marriott hotels, credit and motor-vehicle records, and other administrative databases. A lead to examine Los Angeles Sheraton records was drafted on 10 September. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

Experienced New York criminal agents from the Cole investigation sought to participate but were excluded because headquarters and legal personnel treated the search as an intelligence matter subject to the wall. One agent warned internally that institutional caution could have fatal consequences, but the restriction remained. The Bureau did not connect the men to their documented San Diego history, did not locate them before 11 September, and did not integrate their presence with the broader summer threat reporting. The official record supports a finding of insufficient priority, supervision, and resource allocation. It does not support the stronger claim that the late search was intentionally designed to fail.

San Diego contained searchable opportunities that were never created

Al-Hazmi and al-Mihdhar lived openly in San Diego during 2000. They used their true names to rent housing, obtain driving licences, open bank accounts, obtain credit cards and telephone service, and take flying lessons; al-Hazmi was listed in a local telephone directory. They associated with Bayoumi, whose earlier FBI preliminary inquiry had closed in June 1999, and later boarded with an active FBI informational asset. The Bureau learned of neither connection until after the attacks. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

The handling agent knew that two recently arrived young men were living with the asset but obtained only their first names and did not create a retrievable record. The Inspector General found no clear FBI policy defining what information handlers should collect about an asset’s boarders or how annual source validation should be documented. Had the names been recorded in a searchable system, the August 2001 search might have connected al-Hazmi and al-Mihdhar to a precise address, associates, and local activity. Again, the inference is conditional: the opportunity existed, but discovery and disruption were not guaranteed.

Resource allocation amplified the weakness. Although FBI headquarters had formally designated al-Qaeda a leading counterterrorism priority, counterterrorism ranked fourth in the San Diego Field Office behind drugs, white-collar crime, and violent crime. The office devoted little investigative attention to al-Qaeda and had limited specialist training. The Inspector General found this mismatch was not unique to San Diego: in 2000 the FBI assigned approximately twice as many agents to drug enforcement as to counterterrorism. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

Reconciliation of the official inquiries

The principal inquiries use different counts because they apply different units of analysis. The Justice Department Inspector General identified five FBI-centered junctures: the January–March 2000 CIA information; the men’s San Diego associations; the January 2001 Khallad identification; spring–summer interagency exchanges; and the late-August domestic search. The 9/11 Commission catalogued a broader set of ten operational opportunities, seven of which directly concerned al-Hazmi and al-Mihdhar and three of which addressed Moussaoui or Khalid Sheikh Mohammed. These are complementary taxonomies, not contradictory findings. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006 The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004

Decision point	Information available	Documented failure	Opportunity lost	What the record does not establish
Jan 2000	Al-Mihdhar’s identity, al-Qaeda links, Malaysia meeting, U.S. visa	No U.S. watchlisting; drafted report to FBI held and not released	Alert border/FBI; choose exclusion or surveillance	Motive for holding the report
Mar 2000	Al-Hazmi identified as having flown to Los Angeles on 15 Jan	No watchlisting or FBI notification	Open domestic search while both men were in California	That a search would have discovered the plot
May–Dec 2000	Men lived openly in San Diego; later boarded with FBI asset	Names and presence not collected or entered in searchable FBI systems	Build an address-and-associate trail usable in later searches	That the asset or handler knew their terrorist role
Jan 2001	Khallad identified at Malaysia meeting	Search not revived; principal Cole investigators not informed	Link targets to a major al-Qaeda operational figure	Knowing deception by senior CIA leaders
May–Jul 2001	Old travel cables and Khallad link rediscovered during high threat	Reviews did not produce timely FBI dissemination	Watchlist before al-Mihdhar’s June visa and 4 Jul entry	CIA operational purpose behind non-disclosure
Aug–Sep 2001	Confirmed U.S. entry and no recorded departure	Late watchlisting; low-priority intelligence search; criminal agents excluded	Concentrated multi-office search and use of San Diego leads	That an adequately resourced search certainly would have succeeded

What the official record permits—and forbids

The official baseline permits four firm findings. First, the failure was cumulative: no single missed cable explains the outcome. Second, CIA and FBI responsibilities were distinct but overlapping. CIA controlled crucial foreign intelligence and dissemination; the FBI failed to structure its detailees, document informal information, equip field offices, exploit its San Diego asset relationship, and prioritize the final search. Third, the foreign–domestic division fragmented ownership of a transnational case. Fourth, senior threat awareness did not translate into specific domestic mobilization: the Commission found that U.S. border, transportation, federal, state, and local systems were not operationally aligned with the summer 2001 threat environment. The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004

The same baseline forbids three retrospective shortcuts. The inquiries found no evidence that the FBI or another intelligence-community component possessed specific advance intelligence identifying the 9/11 plot. They declined to state that competent handling would have prevented the attacks because that conclusion is counterfactual. Finally, although deliberate withholding occurred in the literal sense that a draft report was put on hold, the inquiries did not establish that the purpose was to protect a recruitment operation, shield Saudi actors, or allow the attacks to proceed. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

The most defensible characterization is therefore documented institutional incapacity with unresolved motives at several critical nodes. That formulation neither minimizes the failures nor promotes an unverified explanation into an official conclusion.

Key judgments

• Established: CIA components had sufficient information by March 2000 to recognize a U.S. nexus involving al-Mihdhar and al-Hazmi, but the men were not placed on a U.S. terrorism watchlist until 24 August 2001.
• Established: an FBI detailee’s January 2000 report conveying al-Mihdhar’s visa and al-Qaeda associations was placed on hold inside the CIA and never transmitted; official investigators could not determine why.
• Established: the January 2001 identification of Khallad at Kuala Lumpur was not timely provided to the principal FBI Cole investigators; later congressional testimony indicating FBI access was inaccurate.
• Established: the FBI’s late-August search lacked urgency, experienced staffing, full criminal-investigative participation, and effective exploitation of immigration and San Diego leads.
• Established: fragmented authority, ill-defined detailee roles, compartmented systems, inadequate secure infrastructure, rigid application of the wall, and misaligned resources converted repeated warnings into isolated fragments.
• Not established: that any single corrective action would have prevented 9/11; that U.S. agencies possessed specific intelligence about the plot; or that non-disclosure was intended to protect a CIA–GID recruitment operation.

What would change the assessment

• Authenticated contemporaneous records identifying the reason the January 2000 report was placed on hold would change the judgment on motive, but not the established finding that dissemination failed.
• Dissemination logs or operational cables showing that the FBI received the visa, Los Angeles travel, or Khallad identification earlier than August 2001 would require revision of the interagency chronology.
• A documented senior-level direction to withhold the information for a defined operational purpose would shift the explanation from unmanaged institutional failure toward deliberate compartmentation.
• Complete evidence that the relevant records were available in searchable FBI systems, accessed by responsible investigators, and consciously disregarded would increase the assessed weight of individual rather than systemic responsibility.
• Verified investigative reconstruction showing that a timely watchlist encounter or August search would have led directly to the wider cell would strengthen—but still not prove—the prevention counterfactual.

Open official record

• The full, unredacted CIA Inspector General accountability review and supporting interview exhibits.
• Original CIA routing metadata and approval history for the January 2000 Central Intelligence Report.
• Complete CIA–FBI dissemination logs concerning al-Mihdhar, al-Hazmi, Khallad, and the Kuala Lumpur photographs from December 1999 through September 2001.
• Unredacted Inspector General and Joint Inquiry interview transcripts addressing why specific cables were withheld or not acted upon.
• The complete legal guidance applied to the June and August 2001 information-sharing disputes, including contemporaneous National Security Law Unit advice.
• Search-tasking, resource-assignment, and supervisory records for the New York investigation opened on 29 August 2001.

Saudi-Linked Support and the Liaison Allegation

Principal judgment

The verified record establishes that Omar al-Bayoumi provided significant practical assistance to Nawaf al-Hazmi and Khalid al-Mihdhar soon after their arrival in Southern California; that Bayoumi maintained official and financial links to Saudi institutions; that he had repeated telephone connectivity with Saudi consular official and imam Fahad al-Thumairy; and that the two future hijackers later lived with Abdussattar Shaikh, an active FBI informational source. These facts created an unusually dense intersection of al-Qaeda operatives, Saudi-linked figures, and U.S. law-enforcement access.

The same record does not establish that Bayoumi or Thumairy knew the 9/11 plot, that Shaikh deliberately shielded the men, or that the three formed a coordinated Saudi support network. Operation Encore investigated precisely whether Saudi-linked subjects knowingly facilitated the hijackers. Its May 2021 closing assessment, coordinated with the U.S. Attorney’s Office for the Southern District of New York, found insufficient evidence to prosecute Bayoumi, Thumairy, or Musaed al-Jarrah for knowingly conspiring to assist the hijackers in furtherance of the attack. To Administratively Close Case — Federal Bureau of Investigation, New York Field Office — May 2021

The Canestraro declaration materially strengthens the case for further investigation of a CIA–Saudi liaison recruitment hypothesis, because it records several former officials alleging that the CIA used Saudi intelligence to approach al-Hazmi and al-Mihdhar and suppressed the domestic consequences. It does not prove that hypothesis. Its decisive claims depend on anonymous sources, frequently express belief or inference rather than observed tasking, and are unsupported in the public record by an authenticated CIA order, liaison request, contact report, asset file, payment record, or Saudi reporting passed to the Agency. The correct net assessment is therefore: assistance is established; Saudi official linkage is substantial but its operational purpose is unresolved; knowing support for 9/11 and CIA direction remain unproven.

Bayoumi: extensive assistance, unresolved purpose

The encounter and support are not disputed

On 1 February 2000, Bayoumi encountered al-Hazmi and al-Mihdhar at a halal restaurant near the King Fahd Mosque in Culver City after visiting the Saudi consulate in Los Angeles. The Commission could not determine whether the meeting occurred by chance or design. Within days, Bayoumi helped the pair relocate to San Diego, found an apartment in his own complex, completed and co-signed the lease, facilitated the bank arrangements needed for the deposit, and organized a gathering introducing them to members of the local Muslim community. Financial records reviewed by official investigators showed that the men reimbursed Bayoumi for the rent and deposit on the same day; the 9/11 Commission therefore found no evidence that this transaction constituted a gift to the hijackers. The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004

The assistance was nevertheless operationally consequential. Al-Hazmi and al-Mihdhar arrived with weak English, limited familiarity with the United States, and an immediate need for accommodation, banking access, transport, and social orientation. Bayoumi reduced those barriers at a formative stage of their presence. Whether he intended to facilitate an al-Qaeda mission is a different proposition from whether his actions objectively facilitated the men. The first is unresolved; the second is established.

The Commission found Bayoumi capable of dissembling about parts of his story but reported no credible evidence that he embraced violent extremism or knowingly assisted extremist organizations. That 2004 conclusion was confined to the evidence then available. The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004 The Justice Department Inspector General later confirmed the practical support while noting that Bayoumi’s earlier FBI preliminary inquiry had closed in June 1999. The Bureau therefore was not actively investigating him when the encounter occurred. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

Saudi institutional connections are stronger than a “student” label suggests

Bayoumi described himself in the United States as a business student, but official inquiries found that he was supported by Dallah/Avco, a contractor to the Saudi civil-aviation authority for which he had worked for more than two decades. The Justice Department Inspector General recorded a monthly salary of approximately $4,000, plus allowances ranging from $465 to $3,800. The 9/11 Commission separately noted that his allowances rose markedly around the period when he began assisting the hijackers. These facts establish sustained Saudi institutional financing; they do not by themselves establish an intelligence relationship. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006 The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004

The FBI’s later Saudi-support investigation treated Bayoumi as a principal subject rather than a peripheral witness. Operation Encore originated in 2007 as an enterprise counterterrorism investigation into a possible Southern California network that assisted al-Hazmi and al-Mihdhar. Its stated purpose was to determine whether Bayoumi, Thumairy, and al-Jarrah provided or directed practical assistance while knowing that the recipients intended a terrorist act. The investigation reviewed financial, telecommunications, and travel records, conducted searches, obtained foreign-partner material, and undertook approximately 60 interviews between 2007 and 2016—the latter figure correcting an earlier internal statement that had said “hundreds.” It was re-examined again in 2019–2020 for missed leads. To Administratively Close Case — Federal Bureau of Investigation, New York Field Office — May 2021

The investigation’s existence and breadth show that the Saudi-support hypothesis was taken seriously inside the FBI. They do not validate every working theory developed during the inquiry. An investigative predicate, a source assessment, a case-team hypothesis, and a closing prosecutorial judgment have different evidentiary status.

The “50/50” formulation is not a quantified institutional probability

The frequently quoted claim that the FBI found a “50/50 chance” that Bayoumi possessed advance knowledge cannot be used as a statistical estimate. No public methodology, evidence weighting, defined outcome, or institutional approval process accompanies the formulation in the official material verified for this chapter. Even if accurately transcribed from an individual source or analytical note within the larger release corpus, it is not equivalent to a Bureau-wide probability assessment and cannot be extended “by implication” to the Saudi state.

The controlling accessible FBI disposition is the 2021 closing communication. It states that the evidence was insufficient to prosecute Bayoumi, Thumairy, and al-Jarrah for knowingly conspiring to assist the hijackers and that no additional criminal violation or priority national-security threat warranted continuation of the case. It also records that al-Qaeda compartmentalized attack planning, limiting what persons assisting individual operatives might have known. To Administratively Close Case — Federal Bureau of Investigation, New York Field Office — May 2021 This is not an affirmative finding that all assistance was innocent. It is a finding that the available evidence did not satisfy the knowledge and intent requirements for federal criminal prosecution.

Thumairy: official position and suspicious connectivity, no proven tasking

Fahad al-Thumairy served as an imam at the King Fahd Mosque and was identified in State Department documentation as an administrative officer at the Saudi consulate in Los Angeles. In May 2003 he was refused re-entry to the United States after the State Department determined that he might be connected with terrorist activity. The 9/11 Commission found aspects of his denials suspect: he denied knowing Bayoumi despite witness and telephone evidence demonstrating contact, and another witness contradicted his denial of knowing Mohdar Abdullah. Yet, after investigating the available leads, the Commission found no evidence that Thumairy provided assistance to al-Hazmi or al-Mihdhar. The 9/11 Commission Report — National Commission on Terrorist Attacks Upon the United States — Jul 2004

Later FBI records establish telephone connectivity between numbers associated with Thumairy and Bayoumi beginning in December 1998 and continuing sporadically until Bayoumi left the United States in 2000. Some contacts occurred while al-Hazmi and al-Mihdhar were in Southern California. The FBI closing record explicitly states that the nature and content of those conversations were not established. Operation Encore was predicated in part on the theory that al-Jarrah, as head of Islamic Affairs at the Saudi embassy in Washington, directed facilitation through Thumairy and Bayoumi; the word “theory” is analytically important. The closing communication did not find sufficient evidence to charge it as a knowing conspiracy. To Administratively Close Case — Federal Bureau of Investigation, New York Field Office — May 2021

The strongest defensible judgment is therefore that Thumairy occupied a position capable of connecting religious, consular, and governmental networks; communicated with Bayoumi during the relevant period; and gave explanations official investigators found partly unreliable. The public record does not establish that he instructed Bayoumi to meet the hijackers, knew their operational role, or acted under GID or CIA direction.

Shaikh: an extraordinary proximity, not evidence of a joint operation

Abdussattar Shaikh was an active informational source for the FBI’s San Diego Field Office when al-Hazmi and al-Mihdhar rented rooms in his home beginning in May 2000. Al-Mihdhar remained for approximately one month; al-Hazmi stayed until December. The handling agent reported that Shaikh told him two Saudi visitors named Nawaf and Khalid were boarding there. The agent asked for surnames but did not receive them and did not follow up or create a searchable record. Shaikh later gave conflicting accounts about what he had told the Bureau. Official investigators found that the tenants behaved quietly, paid rent, prayed regularly, and did not display conduct that Shaikh said should have alerted him to terrorist activity. A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

This proximity was an exceptional missed collection opportunity. It is not evidence that Shaikh was assigned to protect the hijackers. The official record establishes that the FBI failed to identify or document his boarders and that better source handling might have created a lead later connecting the men to San Diego. It does not establish that Shaikh knew their full identities, al-Qaeda affiliation, or mission.

The Canestraro declaration adds a different allegation. Confidential Source 22 told Canestraro of a private individual’s post-9/11 investigation that purportedly showed Shaikh receiving Saudi-government funds and being used to monitor Saudi citizens abroad. That information has at least two intermediary layers: CS-22 reported what a private investigator allegedly found, and Canestraro recorded CS-22’s account. The declaration does not identify the investigator, attach the financial records, specify the Saudi payer, or describe the method used to establish government tasking. Declaration of Donald C. Canestraro — Military Commissions Defense Organization — Jul 2021

Accordingly, Shaikh’s status as an FBI source and landlord is established; Saudi funding or Saudi intelligence tasking is not established by the declaration. The proposition would require original bank records, a named payer, government instructions, or direct testimony from a handler. Without such evidence, it cannot support the inference that the FBI and Saudi government jointly monitored or insulated the hijackers.

What the Canestraro declaration proves

It is a sworn account of an investigator’s inquiry

Donald Canestraro stated that he had served as an investigator with the Military Commissions Defense Organization since April 2016 after more than 21 years as a Drug Enforcement Administration special agent. He began investigating possible Saudi-government and CIA involvement in July 2016, reviewed U.S.-government discovery and open-source material, and interviewed former officials and other sources whose identities he said were known to him. He signed the 21-page declaration on 20 July 2021 under 28 U.S.C. §1746, declaring its contents true to the best of his knowledge. Declaration of Donald C. Canestraro — Military Commissions Defense Organization — Jul 2021

That legal form matters, but its effect must be stated precisely. The declaration places Canestraro under penalty of perjury for accurately describing his investigation and what sources told him. It does not make him a direct witness to events in 2000, authenticate every underlying document, establish the reliability of each confidential source, or convert reported allegations into findings by the Office of Military Commissions. It is a defense-investigator filing, not a judgment, Inspector General conclusion, or adopted U.S.-government assessment.

It independently reinforces the blocked-report episode

The declaration’s strongest contribution concerns the Central Intelligence Report that was drafted but not transmitted to the FBI. CS-3, described as a former FBI agent assigned to the CIA’s Bin Laden unit, gave a first-person account of learning about the visas, attempting to distribute the report, and being instructed by a CIA analyst not to send it outside the unit. CS-4 stated that CS-3 later produced the draft and that CS-4 personally carried it to a senior FBI counterterrorism official. These accounts converge with the Justice Department Inspector General’s independent finding that an FBI detailee drafted a report, a CIA supervisor placed it on hold, and it was never disseminated. Declaration of Donald C. Canestraro — Military Commissions Defense Organization — Jul 2021 A Review of the FBI’s Handling of Intelligence Information Related to the September 11 Attacks — Office of the Inspector General, U.S. Department of Justice — Nov 2004, released Jun 2006

This corroboration raises confidence in intentional non-distribution as an act. It does not resolve motive. CS-3 acknowledged withholding the report story from the Joint Inquiry and from the CIA Inspector General, citing legal concerns and lack of counsel. That delay does not invalidate the account, but it weakens contemporaneous corroboration and increases dependence on records that remain unavailable publicly.

It alleges a recruitment operation but supplies no public operational chain

CS-3 said he or she believed the report was suppressed because the CIA did not want FBI interference with a domestic operation and asserted that Bayoumi approached the hijackers through a CIA–GID liaison arrangement. CS-5 likewise inferred a long-term CIA penetration operation from the otherwise inexplicable failure to share information. Former national-security official Richard Clarke, a named source, told Canestraro that he believed the CIA was running a false-flag recruitment approach in which Bayoumi would appear sympathetic while reporting through Saudi intelligence. Clarke’s institutional seniority makes the inference significant, but the declaration does not show that he was briefed into such an operation; his account identifies it as his explanation for conduct concealed from him. Declaration of Donald C. Canestraro — Military Commissions Defense Organization — Jul 2021

CS-23 made the most direct allegation: that CIA operational files existed on Bayoumi, that Thumairy instructed him at the Saudi consulate to recruit al-Hazmi and al-Mihdhar, and that the CIA directed the attempt through its Saudi liaison relationship. The declaration does not state how CS-23 acquired this knowledge, identify the supposed files, name a CIA handler, describe reporting returned by Bayoumi, or attach an operational record. CS-16 separately offered the opinion that information was withheld to permit recruitment. CS-7, an investigative journalist, based the CIA–GID proxy account on other unnamed sources, creating nested hearsay rather than independent official corroboration. Declaration of Donald C. Canestraro — Military Commissions Defense Organization — Jul 2021

The declaration therefore establishes convergence around a hypothesis among several former officials. It does not establish convergence of independent evidence streams: multiple sources reason from the same known non-disclosure, some repeat information obtained from others, and the document does not demonstrate that their accounts arise from separate access to the alleged operation.

The obstruction allegations remain allegations

Canestraro records claims that Commission Executive Director Philip Zelikow limited Saudi-related witnesses and documents, that investigators were instructed not to interview Saudi nationals, and that senior officials concealed a CIA analyst from Commission investigators. The Zelikow allegation comes principally from CS-2, a former Commission investigator who stated that Zelikow dismissed the source after an unauthorized acquisition of a classified index and interpreted the dismissal and other restrictions as an effort to blunt the Saudi inquiry. CS-3 alleged having overheard George Tenet and James Pavitt approve keeping an analyst from the Commission. Declaration of Donald C. Canestraro — Military Commissions Defense Organization — Jul 2021

These are serious collection leads. They are not findings of obstruction. The public filing provides no Commission directive, witness-list audit, contemporaneous instruction, corroborating participant, or adjudication showing that investigative limits were imposed for the purpose alleged. CS-2’s direct involvement gives the account relevance; the source’s dismissal and interpretive interest also require independent corroboration. CS-3’s claimed overheard conversation is potentially direct evidence, but remains anonymous, untested, and unsupported by a contemporaneous record in the retrieved public corpus.

Evidence-status matrix

Proposition	Strongest public support	Limitation	Current assessment
Bayoumi materially assisted al-Hazmi and al-Mihdhar	Lease, banking and witness evidence examined by official inquiries	Intent not shown by the acts themselves	Established
Bayoumi had Saudi institutional and financial links	Dallah/Avco employment, Saudi civil-aviation connection, payments and official contacts	Institutional link is not equivalent to intelligence status	Established; purpose unresolved
Bayoumi’s restaurant encounter was arranged	Suspicious timing, disputed witness accounts, prior consulate visit	Commission could not determine chance or design	Unresolved
Bayoumi and Thumairy communicated during the relevant period	FBI telephone analysis	Content and purpose unknown	Established contact; tasking unproven
Thumairy assisted the hijackers	Position, connectivity and partly unreliable denials	Commission found no evidence of direct assistance; Encore found insufficient criminal proof	Not established
Shaikh housed both men while serving as an FBI source	FBI source file and official investigations	No evidence he knew their mission	Established proximity; knowing protection unproven
Shaikh was funded or tasked by Saudi Arabia	Canestraro’s account of CS-22’s description of a private investigation	Multi-layer hearsay; no underlying financial or tasking record	Not established
Saudi-linked subjects knew the 9/11 plan	Investigative theories and suspicious associations	Encore found insufficient evidence; al-Qaeda compartmentalization cuts against inference	Not established
CIA directed GID/Bayoumi to recruit the pair	CS-3 and CS-23 allegations; Clarke, CS-5 and CS-16 inferences	Anonymous sourcing; no public tasking or reporting chain	Plausible collection hypothesis; unproven
Official inquiries were deliberately sabotaged	Anonymous accounts of restrictions and concealment	No adjudication or authenticated directive proving obstructive purpose	Serious allegation; not established

Key judgments

• Established: Bayoumi’s actions objectively enabled the two future hijackers to settle in San Diego, regardless of his unproven intent.
• Established: Bayoumi’s Saudi institutional financing and contacts were substantial; the public record does not conclusively establish his formal status as a GID officer or CIA intermediary.
• Established: Thumairy was a Saudi consular official and imam who communicated with Bayoumi; investigators found parts of his denials unreliable, but did not establish that he assisted the hijackers.
• Established: Shaikh housed al-Hazmi and al-Mihdhar while serving as an FBI source, creating a major missed opportunity; the claim that he was simultaneously Saudi-funded rests on unproduced, indirect evidence.
• Established institutional position: after a long investigation and later re-review, the FBI and SDNY prosecutors found insufficient evidence to prosecute Bayoumi, Thumairy, or al-Jarrah for knowingly conspiring to assist the 9/11 operation.
• Analytical judgment: the clustering of Saudi-linked contacts is too consequential to dismiss as irrelevant, but proximity and facilitation do not establish knowledge of the attack.
• Unresolved: the Canestraro declaration raises a coherent CIA–GID recruitment hypothesis and corroborates deliberate non-distribution of intelligence; it does not publicly prove operational direction, recruitment contact, or subsequent reporting.

What would change the assessment

• Authenticated CIA or GID tasking that names Bayoumi, Thumairy, al-Hazmi, or al-Mihdhar would materially strengthen the liaison hypothesis.
• A pre-9/11 contact report, recruitment pitch, assessment of either hijacker as a prospective source, or reporting returned through Saudi channels would move CIA direction from allegation toward established operation.
• Original telecommunications content—not merely call metadata—showing Thumairy directing Bayoumi’s encounter or assistance would materially change the finding on purposeful facilitation.
• Saudi payroll, diplomatic, or intelligence personnel files defining Bayoumi’s actual duties would resolve whether his government links were administrative, monitoring-related, or operational.
• Primary banking records identifying Saudi-government payments to Shaikh, combined with instructions or reporting, would transform the present hearsay claim into documentary evidence.
• Named, independently corroborated testimony from CS-3 or CS-23, tested against contemporaneous records, would materially increase confidence in their operational allegations.
• Evidence that Bayoumi, Thumairy, or Shaikh knew the target, timing, aviation method, or broader cell structure would alter the present conclusion that knowing assistance to the 9/11 plot is unproven.

Open official record

• The complete, unredacted Operation Encore files, including the document containing the widely quoted “50/50” formulation, its author, source basis, intended referent, and review status.
• CIA indices responses and any operational files concerning Bayoumi, including the alleged “paper trail” described by CS-23.
• CIA–GID liaison traffic from December 1999 through September 2001 concerning al-Hazmi, al-Mihdhar, Bayoumi, Thumairy, or Southern California.
• Unredacted telephone toll records and any lawfully collected communications between Bayoumi, Thumairy, al-Jarrah, and Saudi government offices.
• Saudi employment, payroll, travel, diplomatic, and Ministry of Islamic Affairs records defining the duties and reporting chains of Bayoumi and Thumairy.
• The underlying records of the private investigation cited by CS-22 regarding alleged Saudi payments to Shaikh.
• The identities, access basis, interview recordings, and corroborating documents for Canestraro sources CS-2, CS-3, CS-5, CS-16, CS-22, and CS-23.
• The alleged classified index obtained by CS-2 and Commission management records showing which Saudi-related witnesses or documents were approved, limited, or rejected and why.

Legal Significance and Unresolved Proof

Principal judgment

The civil litigation materially changes the public evidentiary position, but it does not settle the historical question. On 28 August 2025, the U.S. District Court for the Southern District of New York denied Saudi Arabia’s renewed motion to dismiss for lack of subject-matter jurisdiction. After targeted discovery and review of a large evidentiary record, Judge George B. Daniels found enough direct and circumstantial evidence to support preliminary conclusions that Omar al-Bayoumi and Fahad al-Thumairy assisted Nawaf al-Hazmi and Khalid al-Mihdhar while acting within the scope of Saudi employment or agency, and that the assistance was rendered knowingly or at least with deliberate indifference. Saudi Arabia failed, at that stage, to carry its ultimate burden of showing that the Justice Against Sponsors of Terrorism Act exception to sovereign immunity did not apply. In re Terrorist Attacks on September 11, 2001, Memorandum Decision and Order — U.S. District Court for the Southern District of New York — Aug 2025

That ruling is a significant official finding. It means the Saudi-support case can no longer be described accurately as consisting only of speculation that every competent institution rejected. A federal court tested the jurisdictional evidence, rejected several innocent explanations as inadequate, and held that the plaintiffs may seek a decision on the merits.

The ruling is nevertheless expressly preliminary. It concerns immunity and the court’s authority to hear the claims, not a final determination that Saudi Arabia is civilly liable for 9/11. It does not establish criminal guilt, knowledge of the complete attack plan, authorization by senior Saudi leaders, participation by the Saudi state as a whole, or a CIA-directed recruitment operation. The court stated that disputed motive, witness credibility, the meaning of the airplane drawing, and scope of employment may be reconsidered at trial. Saudi Arabia appealed, and numerous plaintiff groups filed cross-appeals concerning alternative jurisdictional theories. The verified appellate record includes a consolidated plaintiffs’ brief filed under seal on 13 March 2026 and publicly in redacted form on 2 April 2026. Brief for Plaintiffs-Appellees and Cross-Appeal Appellants, Nos. 25-2202-cv(L) et al. — U.S. Court of Appeals for the Second Circuit — Apr 2026

The correct update is therefore: the civil case raises the Saudi coordination hypothesis from an investigative possibility to a judicially supported, but contested and non-final, inference. It does not convert that inference into adjudicated liability or prove the separate CIA–Saudi liaison allegation.

What changed the legal landscape

JASTA opened a route through sovereign immunity

Saudi Arabia is a foreign sovereign and ordinarily benefits from the jurisdictional immunity established by the Foreign Sovereign Immunities Act. The litigation was dismissed in 2015 after the district court held that the plaintiffs had not established the then-applicable noncommercial-tort exception. Congress changed the governing framework in 2016 by enacting the Justice Against Sponsors of Terrorism Act, or JASTA, over a presidential veto.

JASTA added 28 U.S.C. §1605B. It removes immunity in actions seeking damages for injury, property damage, or death in the United States caused by an act of international terrorism in the United States and by a tortious act of a foreign state—or of its official, employee, or agent acting within the scope of office, employment, or agency. Mere negligence is excluded. The Act also created civil aiding-and-abetting and conspiracy liability under 18 U.S.C. §2333(d) for knowingly providing substantial assistance to the person who committed an act of international terrorism. Congress made the amendments applicable to actions already pending and arising from injuries on or after 11 September 2001. Justice Against Sponsors of Terrorism Act, Public Law 114-222 — United States Congress — Sep 2016

JASTA did not declare Saudi Arabia responsible. It changed the threshold legal architecture: a state not designated as a sponsor of terrorism could no longer rely automatically on sovereign immunity when the statutory conditions were adequately established. The law supplied access to adjudication, not a predetermined result.

The 2018 ruling authorized a narrow factual inquiry

After JASTA, the district court held in 2018 that the plaintiffs’ direct-liability allegations were insufficient but that their vicarious-liability allegations narrowly provided a reasonable basis for jurisdiction. It authorized targeted discovery into whether Bayoumi, Thumairy, or their agents acted at the direction of more senior Saudi officials when assisting al-Hazmi and al-Mihdhar. That distinction shaped the record: the discovery process was focused principally on agency, employment, direction, and attribution rather than every possible Saudi-financing or al-Qaeda-support theory. In re Terrorist Attacks on September 11, 2001, Memorandum Decision and Order — U.S. District Court for the Southern District of New York — Aug 2025

The subsequent record included depositions, Saudi-produced documents, employment and payment evidence, telephone data, witness testimony, FBI material, and items seized from Bayoumi’s British residence. This civil process added an evidentiary stream distinct from the 9/11 Commission and Operation Encore. It compelled adversarial production and allowed each side to challenge the other’s witnesses, exhibits, and interpretations.

The 2025 decision was not a routine acceptance of allegations

The August 2025 decision followed completion of the jurisdictional discovery ordered in 2018. On a factual Rule 12(b)(1) challenge, the court was permitted to examine affidavits, documents, depositions, and testimony rather than simply assume that the complaint was true. Judge Daniels stated that he considered only evidence suitable for the jurisdictional inquiry, disregarded conclusory assertions, and relied primarily on evidence to which the parties did not object and on the primary sources underlying government reports.

The court made several consequential preliminary findings:

• Bayoumi had been a Saudi civil-aviation employee since 1977, was sent to San Diego in 1994, remained a Saudi employee until 2014, and received pay through Saudi contractor Dallah Avco. His nominal data-processing position did not correspond to work he actually performed.
• The total evidence permitted a reasonable inference that Bayoumi’s and Thumairy’s employment involved more than their official titles suggested.
• Bayoumi’s assistance, institutional contacts, unexplained pay increase, repeated interaction with the hijackers, and links to other facilitators supported an inference that his assistance bore a connection to his Saudi employment.
• The timing and frequency of communications and eyewitness evidence supported a preliminary conclusion that Thumairy worked with Bayoumi in assisting the hijackers, although the contents of their calls remain unknown.
• The court found it more likely than not, for the jurisdictional inquiry, that Bayoumi’s encounters with the hijackers were not merely coincidental.
• The plaintiffs produced sufficient evidence for jurisdiction that Bayoumi, Thumairy, and Saudi Arabia participated knowingly or with deliberate indifference in supporting the hijackers’ terrorist activity.

In re Terrorist Attacks on September 11, 2001, Memorandum Decision and Order — U.S. District Court for the Southern District of New York — Aug 2025

These findings carry more weight than a plaintiff’s allegation, a press description, or an untested investigative hypothesis. They were made by a competent court after adversarial discovery and under a defined legal standard. Any assessment that ignores them is incomplete.

What the court did not decide

Jurisdiction is not liability

The court expressly distinguished immunity from liability. Its question was whether Saudi Arabia could be required to answer the claims in a U.S. court, not whether the plaintiffs had finally proved every element of their causes of action. The order repeatedly described its findings as preliminary, stated that jurisdictional findings may be revised, and reserved overlapping factual questions for the merits phase.

The distinction is especially important because some factual questions perform two legal functions. Whether Bayoumi and Thumairy acted within the scope of Saudi employment helps determine both whether the JASTA immunity exception applies and whether Saudi Arabia may ultimately bear vicarious liability. A preliminary jurisdictional finding on that issue does not prevent the factfinder from reaching a different conclusion after a full trial record.

The court did not find that Saudi Arabia planned 9/11

The order did not find that the Saudi government conceived, approved, financed, or controlled the 9/11 operation. It did not identify a Saudi official who knew the complete target set, timing, aviation method, or command structure. Its reasoning concerned assistance to two hijackers, the knowledge or deliberate indifference accompanying that assistance, the employment relationship of the alleged facilitators, and the causal connection required to remove immunity.

It is therefore inaccurate to translate the ruling into “Saudi Arabia carried out 9/11” or “the House of Saud had detailed advance knowledge.” The legal theory can operate through acts of employees or agents within the scope of their employment; it does not require proof that every senior state authority shared their knowledge. Conversely, a later finding that a particular employee acted within scope could attribute conduct to the state without proving that the monarch or cabinet approved the operation.

“Some knowledge” is not knowledge of the complete plot

The court found sufficient evidence that Bayoumi had “some knowledge” when assisting the hijackers and concluded that the record did not support treating him simply as an innocent participant. That language is important, but its boundaries matter. The decision does not specify that Bayoumi knew the date of the attacks, the intended targets, the use of passenger aircraft, or the identities and assignments of the entire team.

The alternative standard invoked by the decision—deliberate indifference—also does not require proof of comprehensive operational knowledge. It addresses culpable support despite awareness of a substantial probability of terrorist activity. Consequently, the order strengthens an inference of culpability without proving detailed foreknowledge of 9/11.

The court did not validate every plaintiff claim

Judge Daniels expressly rejected or declined to credit several prominent characterizations. He found that the apartment gathering video did not show that the hijackers were the focus of a deliberately incriminating “welcome party.” He also found that the Washington video established that Bayoumi filmed government buildings and other sites, but did not by itself prove that he was “casing” the U.S. Capitol. The order observed that many of the plaintiffs’ 2,118 factual averments were actually attorney argument or were unsupported by the cited exhibits.

The court also left the meaning of the handwritten airplane drawing unresolved. It regarded the drawing and associated calculations as facially connecting Bayoumi to knowledge of the attacks for jurisdictional purposes, while acknowledging that the parties dispute its meaning. Authentication of the page, handwriting attribution, provenance, dating, technical interpretation, and the credibility of innocent explanations remain important merits questions.

The order did not decide the CIA–GID liaison allegation

The 2025 ruling concerns whether Saudi employees or agents assisted the hijackers within the scope of Saudi employment and whether the evidence satisfies JASTA’s immunity exception. It does not find that the CIA directed the GID, tasked Bayoumi, arranged the hijackers’ visas, attempted to recruit al-Hazmi or al-Mihdhar, or suppressed information to protect such an operation.

The Canestraro declaration is not the foundation of the court’s stated reasoning. The order does not authenticate the alleged CIA operational files or liaison communications described by Canestraro’s confidential sources. Proof that Saudi-linked personnel assisted the hijackers would be compatible with several explanations: unilateral Saudi activity; actions by Saudi officials outside an authorized policy; extremist facilitation concealed from Riyadh; a liaison recruitment attempt; or conduct whose participants understood only a fragment of al-Qaeda’s purpose. The civil ruling does not discriminate conclusively among them.

Accordingly, it is analytically invalid to use the ruling as indirect proof of CIA control. The decision increases the probability that Bayoumi’s and Thumairy’s conduct was organized and connected to Saudi employment. It does not identify the ultimate origin, purpose, or intelligence customer of that organization.

The court did not make a criminal determination

Operation Encore’s 2021 closing communication found insufficient evidence to prosecute Bayoumi, Thumairy, or Musaed al-Jarrah for knowingly conspiring to assist the hijackers. The 2025 civil ruling reached a more adverse preliminary assessment under a different legal framework and with a differently assembled record. To Administratively Close Case — Federal Bureau of Investigation, New York Field Office — May 2021 In re Terrorist Attacks on September 11, 2001, Memorandum Decision and Order — U.S. District Court for the Southern District of New York — Aug 2025

The two positions are not legally contradictory. Criminal prosecution would require admissible evidence capable of proving specified offenses and individual mens rea beyond a reasonable doubt. The civil jurisdictional inquiry applies the FSIA/JASTA burden structure and asks whether the sovereign has established immunity after the plaintiffs produce evidence supporting an exception. The court’s preliminary reliance on deliberate indifference is also not identical to proving a criminal conspiracy to participate in the 9/11 attacks.

The civil decision therefore does not retroactively establish that the FBI’s declination was unlawful or corrupt. It does show that a later adversarial record supported conclusions more serious than the accessible criminal closing assessment adopted.

The appellate qualification

Saudi Arabia appealed the August 2025 jurisdictional decision to the Second Circuit. Multiple plaintiff groups cross-appealed the earlier rejection of alternative theories involving Saudi-controlled charities, additional alleged Saudi agents, and aiding-and-abetting liability. The consolidated appellate caption includes No. 25-2202-cv(L) and multiple cross-appeals. In their March 2026 brief, the plaintiffs asked the court to affirm the denial of Saudi Arabia’s renewed motion and to revive portions of their alternative jurisdictional case. Brief for Plaintiffs-Appellees and Cross-Appeal Appellants, Nos. 25-2202-cv(L) et al. — U.S. Court of Appeals for the Second Circuit — Apr 2026

This posture has three consequences. First, the district court’s order is not a final merits judgment. Second, the appellate court may affirm, narrow, vacate, or remand the jurisdictional reasoning without deciding ultimate liability. Third, descriptions that a trial has already established Saudi responsibility—or that an imminent trial is procedurally certain—overstate the verified position. The sound formulation is that the plaintiffs overcame Saudi Arabia’s renewed immunity challenge in the district court and obtained the right to pursue the merits, subject to appellate review.

How the civil ruling changes the analytical assessment

Question	Before the 2025 ruling	Effect of the ruling	What remains unresolved
Was Bayoumi’s assistance merely charitable?	Official inquiries documented assistance but did not establish criminal intent	The court found the innocent-participant account inadequate for jurisdiction and inferred planning and coordination	Final motive, precise knowledge and admissible proof at trial
Was Bayoumi’s activity connected to Saudi employment?	Strong institutional and financial links; operational purpose disputed	The court preliminarily found the assistance connected to employment and within scope	Final vicarious liability and identity of directing officials
Did Thumairy assist the hijackers?	Contacts and unreliable denials, but no prosecutable case	The court found credible evidence that he worked with Bayoumi to assist them	Nature of tasking, call contents, exact knowledge and final credibility findings
Is Saudi Arabia immune?	Presumptively immune absent a statutory exception	District court held JASTA’s exception applicable and retained jurisdiction	Second Circuit review and any renewed merits-stage determination
Is Saudi Arabia liable for 9/11 losses?	Unresolved	Plaintiffs may pursue a merits determination	No verdict, damages judgment or final attribution yet
Does the case prove a CIA–GID operation?	Alleged principally through confidential-source accounts	No material judicial validation in the 2025 order	CIA tasking, liaison traffic, asset status, recruitment activity and reporting

The ruling should increase confidence that the California assistance was not an isolated sequence of benign coincidences. It should also increase confidence that Bayoumi’s and Thumairy’s formal employment descriptions were incomplete accounts of their functions. It does not justify the further leap from Saudi-connected coordination to CIA command. That remains a separate proposition requiring a separate evidentiary chain.

Records capable of changing the assessment

CIA operational and liaison records

The most decisive missing evidence for the liaison allegation would be authenticated CIA operational traffic concerning al-Hazmi, al-Mihdhar, Bayoumi, or Thumairy. Relevant categories include operational files, source-registration or asset-validation records, cable traffic, liaison requests to the Saudi GID, contact or meeting reports, recruitment assessments, reporting from a Saudi intermediary, and instructions concerning dissemination to the FBI.

A record showing CIA authorization for the GID to approach the two men would transform the current hypothesis. A complete file search showing no operational trace would weaken it, although absence would remain less conclusive if records were destroyed, compartmented, misfiled, or withheld. The evidentiary value would depend on repository completeness, audit logs, document provenance, and testimony from officials with direct access.

Saudi GID, MOIA, embassy, and consular tasking

Saudi records could resolve whether Bayoumi and Thumairy were performing assigned state functions. The decisive material would include personnel files, secondment orders, duty descriptions, performance reports, payment authorizations, travel orders, operational instructions, intelligence reporting, expense reimbursements, and communications with the Ministry of Islamic Affairs, General Intelligence Presidency, embassy, and Los Angeles consulate.

The present record shows employment, contacts, payments, and activity inconsistent with narrow official titles. It does not publicly disclose the complete tasking chain. Documentary instructions to receive, assess, monitor, recruit, or assist al-Hazmi and al-Mihdhar would establish purpose. Records showing unrelated administrative duties, supported by contemporaneous work product and consistent financial documentation, would strengthen the innocent explanation.

Communications content rather than metadata

Call timing and frequency support coordination but cannot identify its subject. The content of calls, faxes, messages, memoranda, or contemporaneous notes between Bayoumi, Thumairy, Musaed al-Jarrah, the Saudi embassy, the Los Angeles consulate, and Saudi ministries would be highly diagnostic.

Communications referring to the hijackers by name, travel status, housing needs, security exposure, recruitment potential, or al-Qaeda affiliation would materially strengthen the knowing-support or liaison hypotheses. Administrative or religious content consistent across the relevant calls would weaken them. Without content, temporal sequencing remains circumstantial.

The complete British seizure record

British authorities seized material from Bayoumi’s residence after 9/11. The public litigation has highlighted the Washington video, handwritten aircraft material, address books, and associated notes. A complete inventory, forensic images, original metadata, translations, handwriting analysis, chain-of-custody documentation, and contextual pages preceding and following isolated exhibits are necessary to assess their meaning reliably.

The aircraft page is particularly important because the court treated it as facially connecting Bayoumi to attack knowledge while recognizing that its meaning is disputed. Technical analysis must determine what the equations actually calculate, when the page was produced, who supplied the problem, whether it corresponds to any 9/11 planning requirement, and whether the surrounding notebook supports a schoolwork explanation.

Unredacted civil discovery and live testimony

The civil case contains depositions and exhibits unavailable in complete form to the public. Unredacted transcripts, Saudi document productions, exhibit indices, privilege logs, translation records, and the materials underlying sealed filings could materially alter the assessment. The most valuable testimony would come from witnesses with personal knowledge of tasking, reporting, supervision, or payments—not from witnesses repeating retrospective beliefs.

At trial, some government interview summaries and hearsay statements may require presentation through the original witness or another admissible form. The court explicitly deferred some admissibility and credibility questions. Cross-examination of Bayoumi, Thumairy, Saudi supervisors, embassy officials, investigators, and document custodians could therefore strengthen or collapse important portions of the circumstantial chain.

FBI source and interagency-distribution files

Abdussattar Shaikh’s complete FBI source file, payment history, tasking instructions, contact reports, suitability reviews, and handler communications could resolve whether his proximity to the hijackers was accidental, negligently handled, or connected to an undisclosed monitoring role. Original financial records would be required to establish the alleged Saudi payments described indirectly in the Canestraro declaration.

For the CIA–FBI non-distribution episode, the decisive record would include the draft Central Intelligence Report, routing and access logs, messages placing it on hold, identities and authorities of the officials involved, contemporaneous explanations, and any operational-security justification. Those records could distinguish bureaucratic restriction, negligent information handling, protection of sources and methods, a recruitment effort, or deliberate concealment of a domestic liaison operation.

Evidence thresholds

Missing record	Proposition it could establish	Minimum validation required	Effect if authenticated
CIA liaison tasking to GID	CIA-directed recruitment approach	Original repository record, provenance, author and recipient authentication	Potentially decisive for liaison allegation
GID or MOIA instruction to Bayoumi or Thumairy	Saudi state direction and purpose	Contemporaneous order or report tied to verified chain of command	Potentially decisive for attribution and intent
Reporting returned after contact with the hijackers	Monitoring or recruitment actually occurred	Dated contact report linked to handler and source	Stronger than tasking alone; demonstrates execution
Call or message content	Subject of apparent coordination	Authentic intercept, message, note, or participant testimony	Could strongly confirm or rebut circumstantial inference
Complete payroll and personnel record	True employment function	Issuer-authenticated files with complete period coverage	Clarifies scope of employment; not necessarily plot knowledge
Forensic aircraft-document record	Meaning and date of the drawing	Original image, metadata, context, expert method and chain of custody	Could materially affect knowledge finding
Shaikh financial and source files	Dual FBI–Saudi relationship	Original payments, payer identity, instructions and reporting	Could transform current hearsay into documentary evidence
Full civil depositions and sealed exhibits	Credibility and completeness of existing case	Court-authenticated public release or merits-stage admission	Could strengthen or weaken multiple findings

Key judgments

• Legally established: JASTA created a statutory route for claims against foreign states arising from international terrorism in the United States; it did not declare any state liable.
• Judicially established at the jurisdictional stage: the plaintiffs produced sufficient evidence for the JASTA exception, and Saudi Arabia did not carry its burden of establishing immunity in the district court.
• Preliminarily found: Bayoumi’s and Thumairy’s assistance was connected to Saudi employment; Bayoumi possessed at least some relevant knowledge; their conduct supported knowing-assistance or deliberate-indifference inferences.
• Not finally adjudicated: Saudi liability, final scope of employment, precise mens rea, causation on the complete merits record, damages, and the credibility or admissibility of every disputed item.
• Not decided: knowledge or authorization by senior Saudi leadership, Saudi state planning of 9/11, or detailed advance knowledge of targets, timing, and method.
• Not addressed or proven: CIA direction of a GID recruitment effort, CIA control of Bayoumi or Thumairy, visa facilitation for recruitment, or suppression of intelligence to protect such an operation.
• Procedurally unresolved: Saudi Arabia’s jurisdictional appeal and the plaintiffs’ cross-appeals mean the district court order remains subject to appellate review.
• Analytical effect: the civil record materially strengthens the organized Saudi-linked facilitation hypothesis, but the CIA-liaison conclusion still lacks the primary operational chain needed for an established finding.

Net assessment

The civil case changes the assessment because it subjects the Saudi-support theory to adversarial discovery and produces a competent judicial conclusion that the evidence is sufficient to overcome sovereign immunity. That is more probative than the existence of allegations and more consequential than an investigative lead. The court’s findings concerning planned encounters, some knowledge, coordinated assistance, employment connection, and deliberate indifference must be incorporated into any serious account.

The same decision supplies its own limiting instructions. It is preliminary, concerns jurisdiction, rejects some plaintiff overstatement, reserves decisive disputes for trial, and remains under appellate challenge. Most importantly for the broader thesis, it establishes no bridge from Saudi-linked facilitation to CIA operational direction. Only authenticated tasking, liaison, reporting, payment, or source-control records—or direct, corroborated testimony from participants with access to them—could close that gap.

---

Copyright of debuglies.com - Even partial reproduction of the contents is not permitted without prior authorization Reproduction reserved