History and culture March 31, 2022 Updated: September 21, 2026 24 min read Ulrik Adda

September 11, 2001: Investigations, Intelligence Gaps, and Open Questions

The article separates three 9/11 questions — the hijackings, foreknowledge, and collapse mechanisms — and consolidates the strongest technical, intelligence, and support-network evidence without turning anomalies into unproven conclusions.

September 11, 2001 raises three different questions that should not be collapsed into one: who organized the hijackings, who may have possessed enough advance information to prevent or exploit the attack, and what physically caused the complete collapse of three high-rise buildings. Evidence for one proposition is not automatically evidence for the other two.

This article therefore does not assume that an institutional explanation is correct simply because it is official. Reports by NIST, the 9/11 Commission, the FBI, CIA, inspectors general, and courts are important parts of the evidentiary record, but they are evaluated by their sources, methods, scope, later corrections, and by which alternative explanations they actually tested.

At the same time, the article avoids the opposite error. An accumulation of anomalies is a reason to investigate further, not a mathematical proof of a single plan. The strongest evidence comes from concrete intersections: information about specific future hijackers, documented assistance, telephone and financial records, physical exhibits, forensic signatures, and verifiable timelines.

The result is an open reconstruction. Some anomalies often dismissed as myths are real; others are weaker than commonly portrayed; and later declassifications materially changed the early public picture. The question is not whether one must choose between an “official story” and one alternative theory, but how far each evidentiary line actually reaches and which link is still missing.

Three questions, three evidentiary chains

The 9/11 Commission reconstructed the multi-year development of al-Qaeda’s “planes operation,” Khalid Sheikh Mohammed’s role, the selection of hijackers, flight training, and financial flows. It estimated the operation cost roughly $400,000–$500,000 and concluded that most financing came through al-Qaeda. That is a strong operational record concerning the hijackings.

It does not automatically answer the other two questions. Someone outside the operational cell could have known more than was later acknowledged; agencies could have possessed fragments they failed to connect in time; and the physical mechanism of each building collapse can be tested separately. This article therefore treats each proposition through its own evidentiary chain.

What the public investigative record attributes to al-Qaeda

The published Commission record links the nineteen hijackers to al-Qaeda and KSM to the planning of the operation. The Commission’s financial investigation found that funds moved through ordinary banking and cash channels and said it found no credible evidence that a person in the United States or a foreign government provided substantial financing to the hijackers.

That conclusion should be taken seriously without being stretched beyond its scope. A demonstrated al-Qaeda operational role does not by itself exclude additional foreknowledge, logistical assistance by people who did not know the full plot, concealment of institutional failures, or a different technical mechanism for a particular collapse. Those are separate claims.

Towers 1 and 2: NIST’s mechanism and the modeling boundary

NIST concluded that the aircraft impacts damaged structural systems and dislodged fireproofing, while the ensuing fires weakened floors and columns until global collapse initiation. In NIST’s reconstruction, failure began in the impact-and-fire zones and progressed downward; NIST reported no corroborating evidence of explosive demolition.

A public methodological boundary matters: NIST modeled in detail the period from aircraft impact to collapse initiation, not the entire subsequent destruction of both towers at the same numerical level of detail. NIST regarded the later collapse as inevitable once global failure began; critics argue that this leaves the later dynamics less directly tested. That distinction does not establish an alternative mechanism, but it defines what the model itself demonstrated.

WTC 7: free fall and a competing structural reconstruction

WTC 7 was not struck by an aircraft. It sustained debris damage, burned uncontrolled for hours, and collapsed at about 5:20 p.m. NIST attributed the failure to thermal expansion, failure around Column 79, and cascading internal failures. A distinctive feature is that NIST acknowledged roughly 2.25 seconds of gravitational acceleration, or free fall, in the exterior descent; in its explanation, that phase occurred only after internal support had already been lost.

A University of Alaska Fairbanks study led by J. Leroy Hulsey reached the opposite structural conclusion: its model found that fire could not produce the observed collapse and that reproducing the motion required near-simultaneous failure of multiple supports. The project was funded by Architects & Engineers for 9/11 Truth, which is relevant to provenance and potential interest; the study itself does not identify an explosive, perpetrator, or operational plan. WTC 7 therefore remains a serious technical dispute, not standalone proof of controlled demolition.

Physical evidence: testimony, red-gray chips, and unusual steel damage

Firefighters, police officers, employees, and other witnesses described bangs, flashes, and events they interpreted as explosions. Those statements are part of the historical record, but the word “explosion” does not identify a cause: possibilities include explosives, fuel, electrical equipment, pressure events, or structural failure. The testimony is strongest when it can be matched in time and location to independent evidence.

Harrit and colleagues reported red-gray chips in dust samples in 2009 and interpreted them as unreacted energetic thermitic material. Another analysis of comparable chips found a composition consistent with epoxy, iron oxide, and kaolin. The published thermitic interpretation therefore remains part of the evidentiary record, but not a settled chemical demonstration of thermite at the WTC.

FEMA documented unusual high-temperature oxidation and sulfidation, intergranular penetration, and an Fe–O–S eutectic associated with localized liquefaction and thinning in recovered steel. FEMA called the phenomenon unusual and recommended further study; it did not conclude that thermate caused it. NIST later stated explicitly that tower steel was not tested for explosive or thermite/thermate residues. The absence of such testing does not prove explosives, but it means chemical residue testing was not part of NIST’s exclusion of that alternative.

World Trade Center 7 burning on September 11, 2001, after the collapses of WTC 1 and WTC 2. — **WTC 7 before its collapse.** This Library of Congress image documents the building burning after the collapse of the Twin Towers. The photograph itself does not establish the mechanism of the later collapse; it provides direct visual context for the technical dispute between NIST’s explanation and competing reconstructions. Image: Anonymous / Library of Congress, Prints and Photographs Division, via Wikimedia Commons Public domain / no known copyright restrictions — Library of Congress 9/11 collection

Silverstein, BBC, and put options: three anomalies with different limits

Larry Silverstein did not buy the WTC land in July 2001; his group obtained a 99-year lease, and property insurance was required by the lease. Roughly $3.5 billion in coverage per occurrence and the later dispute over whether the two aircraft impacts constituted one or two occurrences are real. So are his absence that morning for a dermatology appointment and the later “pull it” remark concerning WTC 7. None of those facts alone proves foreknowledge or a demolition order, but neither are they pure internet inventions.

BBC did report WTC 7 as having collapsed while the building was still standing and visible behind its correspondent. The error can be traced to a Reuters report in an environment where emergency personnel already expected that the building might collapse. The premature report is a documented anomaly; without additional evidence it does not distinguish between a pre-scripted narrative and a mistaken report in a chaotic information flow.

Unusually large put-option trades in United and American Airlines before the attacks were also real. The Commission’s investigation concluded, in a prominent example, that 95 percent of the UAL puts on September 6 were tied to one U.S.-registered investment adviser and found no demonstrable connection to al-Qaeda or advance knowledge. The anomaly was investigated and received an explanation, though the public report does not reproduce the complete regulatory file.

Pre-attack warnings: from strategic danger to specific names

CIA’s September 11, 2026 declassification released 71 President’s Daily Brief products. Titles from 1998 include Reports That Bin Ladin is Planning Attacks Inside the US and Bin Ladin Preparing To Hijack US Aircraft and Other Attacks. This substantially strengthens the evidence that attacks inside the United States and hijacking U.S. aircraft were subjects of strategic warning years before 2001.

The trail is stronger still when it reaches specific people. The Justice Department Inspector General found that CIA knew in January 2000 that al-Mihdhar had a multiple-entry U.S. visa and was associated with the Kuala Lumpur gathering of al-Qaeda operatives, and by March knew that al-Hazmi had traveled to Los Angeles. Critical information did not reach the FBI in time. The OIG identified at least five lost opportunities in which the FBI could have learned more or developed further leads.

The same OIG found no evidence that the FBI or another Intelligence Community member possessed specific intelligence about the full September 11 plot. The public record therefore establishes serious and repeated failures in the flow of concrete information; it does not by itself prove that information was deliberately withheld to protect the attack.

San Diego: documented assistance and a reopened support-network inquiry

When al-Hazmi and al-Mihdhar reached California, the story moves from general warning into a documented network of contacts. Omar al-Bayoumi met them in Los Angeles on February 1, 2000, after visiting the Saudi consulate, and then helped them secure housing in San Diego, complete rental paperwork, and open a bank account. The Commission could not determine whether the first meeting was accidental or arranged.

The future hijackers later lived for months in the home of an active FBI informational asset without the FBI recognizing who they were. Bayoumi himself had already been the subject of a preliminary FBI inquiry that closed in 1999. These are verifiable intersections between future hijackers, people who assisted them, and the pre-existing U.S. investigative apparatus.

The FBI reopened the issue through Operation Encore in 2007. Its May 2021 closing document confirms years of investigation into Bayoumi, Fahad al-Thumairy, and Musaed al-Jarrah and whether they knowingly aided the hijackers. The FBI and prosecutors ultimately concluded there was insufficient evidence to prosecute them for knowing participation in the attack. That is an important boundary: assistance and contacts are documented; knowledge and intent were not proven to the standard required for criminal prosecution.

Phones, money, and evidence provenance in San Diego

The declassified Joint Inquiry material described the documentary evidence that Bayoumi assisted the hijackers as strong. A later FBI record temporally links a $1,558 cashier’s check for the first rent, an equal cash deposit into Bayoumi’s account, and al-Mihdhar’s opening of an account with $9,900 within seven minutes. That strongly supports an immediate cash reimbursement explanation without automatically identifying the source or purpose of the cash.

FBI analysis of telephone toll records documented 67 contacts between numbers associated with Bayoumi and al-Thumairy and 11 contacts between Bayoumi’s mobile phone and a line subscribed to the Saudi consulate in the period around al-Hazmi and al-Mihdhar’s arrival. This establishes calls between numbers; their content and purpose are unknown.

FBI documents also record unusual financial timing, including a large increase in Bayoumi’s Dallah/AVCO allowance in spring 2000. The timing is relevant, but no public record reviewed here directly identifies the increase as payment for assisting the hijackers. This is why the article distinguishes the underlying record, FBI analysis of that record, witness testimony, and investigative inference.

Bayoumi’s British exhibits: the sketch, Washington, and a fragmented evidence path

British police seized a substantial body of documents, videos, and computer material after Bayoumi’s arrest in September 2001. An October 2001 FBI memorandum says copies of seized exhibits were provided to the U.S. side while also acknowledging that many videos, disks, and pieces of correspondence still awaited review or translation. Possession of evidence is not the same as analysis or distribution to the right investigators.

Among the later-highlighted exhibits is an airplane sketch with an equation for horizon geometry. The equation itself is standard and does not prove attack planning; FBI investigators only later developed operational interpretations of additional numbers and the drawing. In 2025 the court considered the exhibit as part of a broader jurisdictional record, not as standalone proof of intent.

Another exhibit is an approximately hour-long 1999 Washington video. It contains government sites, comments about Congress and security, as well as ordinary tourist imagery; the transcript includes a reference to a “plan.” Plaintiffs’ experts interpreted the video as surveillance, but Judge Daniels did not hold that the recording itself proved “casing.” The recipient, any tasking, and a direct connection to the attack planners remain missing.

The evidentiary path was uneven: the sketch’s specialist analysis is publicly documented only in 2012, while civil plaintiffs obtained additional Metropolitan Police material in 2022–2023, including a fuller Washington recording. That legitimately limits claims that every early public assessment rested on the entire body of material now known; by itself it does not prove deliberate suppression.

Bayoumi and Anwar al-Awlaki: acquaintance is documented, meaning remains disputed

Later British video evidence matters in part because of Anwar al-Awlaki. Bayoumi denied in a 2021 deposition that he had personally met him, while a 1998 recording shows the two together. The public litigation record also describes Awlaki contact information in Bayoumi’s address materials and additional shared social settings. On the narrow question of acquaintance, physical evidence carries more weight than the later categorical denial.

Paintball footage and gatherings involving visiting Saudi religious officials add context to the network, but they do not establish that a particular paintball event was operational terrorist training for September 11. The proper boundary is straightforward: acquaintance and repeated contacts are documented; purpose and linkage to the specific plot are not.

Awlaki, future hijackers, and Dar al-Hijrah

Awlaki enters the story not only through Bayoumi. Witness and FBI records place him in the same environment as al-Hazmi and al-Mihdhar in San Diego. Commission notes also document four calls between numbers associated with Awlaki and Bayoumi on the day Bayoumi helped the pair secure housing; the records do not establish who spoke or what was discussed.

After Awlaki moved to Virginia, al-Hazmi and Hani Hanjour appeared at his new mosque, Dar al-Hijrah. Eyad al-Rababah then helped them with housing and transportation. Some FBI agents suspected Awlaki may have directed Rababah to assist them; the Commission wrote that it shared the suspicion but could not prove it.

A further telephone trace comes from Hamburg: a 2002 FBI record says a number associated with Dar al-Hijrah was found in German-seized material connected to Essabar and Binalshibh; a later Commission appendix described it as Awlaki’s phone number. Because the underlying German seizure record is not publicly available for verification, the two formulations are not treated as identical. A stored contact number is also not proof that a call occurred.

Rababah’s logistics chain: assistance is established, higher direction is not

Rababah’s assistance is time-stamped and administratively traceable. In May 2001 he drove al-Hazmi, Hanjour, and two other future hijackers among Virginia, Connecticut, and New Jersey and helped them obtain lodging. Fairfield Inn telephone records contain 75 local calls, including calls to flight schools and real-estate offices; these are business records, not later witness memory.

Rababah also told the FBI that another person called him, said there were now “four” and that they wanted to see him, and that some of what he did for the group was requested by another person. Identities are partly redacted in the public record. Later FBI analysis therefore left as an explicit investigative gap the question of who, if anyone, directed Rababah and how much he knew about the hijackers’ activities.

That is more precise than either extreme. Rababah was not merely an incidental passerby with no verifiable role, but the public record also does not establish a higher command chain or his knowledge of the attack plan.

NORAD, Vigilant Guardian, and confusion between exercise and real event

The Vigilant Guardian exercise was underway on September 11. The public record confirms that some personnel initially checked whether incoming information was real-world or part of the exercise and that early FAA/NORAD timelines were later revised. That matters for understanding confusion, communication, and response speed.

The fact that an exercise occurred that morning does not by itself prove complicity. Such a claim would require a documented order, a deliberately created procedural obstacle, or communications showing that the exercise was used to facilitate the attack. The public record reviewed here does not establish that chain.

Two Israeli counterintelligence leads that should not be conflated

The so-called Israeli art students story and the case of five Israelis associated with Urban Moving Systems are separate leads. Internal DEA material recorded roughly 130 incidents in more than 40 cities involving young Israelis presenting themselves as art students at DEA and other federal or military locations; DEA examined the possibility of organized intelligence collection. The public record does not establish their involvement in the September 11 attacks.

Five Israelis in New Jersey were detained after the attacks, questioned, and later deported. Later reporting, citing anonymous former U.S. intelligence officials, alleged intelligence ties for some and the possibility that Urban Moving Systems served as cover; Israel denied spying, and the same reporting did not say the five had advance knowledge of the attacks. This is therefore a counterintelligence lead, not a direct link to the hijackers or the collapse mechanism.

PNAC, Northwoods, and post-9/11 policy

PNAC’s Rebuilding America’s Defenses did use language about transformation being slow absent a “catastrophic and catalyzing event — like a new Pearl Harbor.” Operation Northwoods, from 1962, is an authentic Joint Chiefs document containing proposals for staged incidents that could help justify war against Cuba.

Both matter as historical context. Northwoods demonstrates that false-flag concepts were in fact put on paper at the highest military level; PNAC demonstrates that geopolitical ambitions and thinking about a catalytic shock existed before September 11. Neither document is, by itself, an operational plan for the 2001 attacks.

September 11 was followed by the Patriot Act, the Afghanistan war, the preventive-war doctrine, and later Iraq. The attacks proved extraordinarily useful to already existing policy agendas. But benefiting from an event and using an event are not, by themselves, evidence of causing it.

What was actually planned in advance

Several circumstances later cited in 9/11 debates were not spontaneous coincidences: Silverstein’s lease and insurance arrangements were completed before the attacks; Vigilant Guardian was a scheduled exercise; PNAC and other strategic programs predated the event; intelligence services had warned for years about Bin Ladin, attacks inside the United States, and aircraft hijacking; and in the al-Mihdhar/al-Hazmi case, specific personal information already existed.

That does not mean all these things were planned as part of the attack. It does mean they should not be erased by the single word “coincidence.” Each requires a separate question: what was its documented prehistory, who possessed the relevant information, and is there an actual link to the operational core of the attack?

When the documented elements are assembled into a combined pattern

If every anomaly is treated in complete isolation, a specific explanation can usually be offered: BBC received bad information, Silverstein had a medical appointment, the exercise was routine, suspicious options trades had an innocent buyer, and intelligence fragments were lost through bureaucratic failure. Some of those explanations are well supported and belong in the record.

But the availability of a separate explanation for each element is not the same as explaining the combined pattern. The public record contains real intersections: specific future hijackers in pre-attack intelligence files; their residence with an FBI source; documented assistance in San Diego; telephone and financial records; repeated Bayoumi-Awlaki contacts; later logistical assistance in Virginia; physical exhibits seized early but analyzed unevenly; and technical questions where official and alternative reconstructions diverge.

A cumulative approach therefore justifies further inquiry, not an automatic conclusion of one hidden operation. The strongest next step is not collecting more associations but finding connecting evidence: communications, orders, financial flows with demonstrated purpose, access chains, forensic signatures, or archival documents that actually join two currently separate lines.

The open question: what is established and what is still missing

It is established or well documented that WTC 7 experienced a free-fall phase; that a serious professional dispute exists over its structural reconstruction; that FEMA documented unusual high-temperature damage in some recovered steel; that NIST did not chemically test tower steel for explosive or thermitic residues; that BBC prematurely reported WTC 7’s collapse; that multiple strategic warnings existed before the attacks; and that U.S. agencies possessed specific information about al-Mihdhar and al-Hazmi before September 11.

Also documented are contacts and assistance in San Diego, telephone and financial traces, Bayoumi’s acquaintance with Awlaki, Rababah’s later logistical assistance, and a fragmented path for part of the British evidence. Operation Encore nevertheless did not develop enough evidence to criminally prosecute Bayoumi, al-Thumairy, or al-Jarrah for knowing participation in the attack. Civil litigation against Saudi Arabia cleared an important jurisdictional hurdle in 2025, but that was not a final finding of liability.

What remains publicly missing is a direct operational chain. For intentional demolition, there is no public evidence showing procurement, access to critical structural elements, placement, initiation, and command. For foreknowledge and support networks, there is no public document proving a complete command chain between additional actors and the operational planners. The absence of a public chain is not proof that none existed; it is the boundary of what can responsibly be stated as proven today.

The article therefore remains an open investigative reconstruction rather than a verdict. It does not accept institutional explanations by authority alone, but neither does it turn documented contact into proof of intent without the missing evidentiary step. That boundary is precisely why September 11 remains a live historical and research question.