Work Plan: Investigation re alleged Insider Trading

I. Review any SEC reports or memoranda summarizing results of investigation (to

the extent they exist): _

A. Key Issues:

1. What companies were investigated for unusual stock trading patterns:

a. United, American
b. Other Airlines // / /^
c. Insurance Cos /
d. Other companies based in WTC
e. Any others (how selected for analysis)

2. What period used-(i.e., how far before/September 11 did investigators look)

- 3. -Were any unusual trading patterns detected

a. short-selling -
b. put options or other stock derivative trading
c. large sales ^^

4. To extent any relevant equities/ean be traded on any overseas exchange, what

was done to investigate any such trading.

Non-Company Specific Derivatives:

a. In addition to specific companies, was there any unusual trading in any

index-based or whole market derivatives (e.g., S&P futures or similar
products)

b. What if anything was done to investigate potential trading on foreign

exchanges in whole market derivatives or similar products linked to broad
U.S. indices

Follow-Up by SEC

a. How many suspicious traders identified

i. any offshore
ii. unidentified traders

b. What document requests or subpoenas were issued

 c. What witnesses interviewed
*SJ
A
d. Was any testimony taken ('*-"

e. Any refusals to cooperate; Fifth Amendment Assertions , <jt u^ ° x"

f. Did any other agency play any role in investigation .^ . ^ y vi

_.. SEC Conclusions x . tr-1

V ' V ^
a. Suspicious trading; satisfactory explanations \

b. Suspicious trading; no compelling explanations, but no link to 9/11

\'
c. Are there any issues not resolved, still pending investigation

n. Meet w/ SEC Enforcement Staff who led investigation y v I" ^

A. Get answers to questions unresolved by any reports or memos. 49

B. Follow up on questions unresolved by reports, memos.

ffl. To the extent necessary, review "raw" investigative data: account statements,
interview memos, testimony transcripts, etc.: This review would be limited to
resolving any questions or conflicts raised by the above.

IV. Other Agencies/Entities w/ potential information regarding illicit securities

trading ~

A. DOJ/FBI: need to determine if any criminal investigation initiated; pursue

if it exists; to learn of existence, we can serve document requests or ask
SEC.

B. Chicago Board/other options exchanges: could be source of information,

but likely anything useful provided to SEC

C. Broker-dealers/Banks etc: could be source of information, but likely

anything useful provided to SEC.

D. Foreign securities regulators/prosecutors: need to assess their role based

on information provided by SEC or DoJ

V. Non-stock securities: To investigate allegations of illicit speculation in precious

metals or other non-stock based derivatives, we will likely need to pursue inquiry
with the CFTC, along the lines of the SEC investigation described above.
Thomas II. Kcan
CHAIR
I,cc 1-1. Hamilton
VlOli CHAIR
Richard Bun-Vcniste
Max Clclnnd
Frctl l;. Fielding
Jamie S. Corclick
Sladc Gorton
John Lehman
Timothy J. Kocmcr
James II. Thompson
Philip D. /clikow
K X H C U T I V K niKI-CTOK
DOCUMENT REQUEST No. 1
NATIONAL SECURITY AGENCY (NSA)
The National Commission on Terrorist Attacks Upon the United States (the
"Commission") requests that the National Security Agency (NSA or the
"respondent") provide the Commission with copies of the following documents no
later than June 25, 2003 (the "production date"):
1. Documents prepared between 1995 and 2003 that set forth NSA's strategic
plans for its SIGINT collection, analysis and management activities.
2. 9/11 Classified Information
3. Approved requirements documents tasking NSA systems to collect and
analyze information on terrorism from 1995 to 2003, particularly those
documents that tie to PDD-35.
4. Director NSA memoranda to senior leadership on the efforts to combat
terrorism, the effectiveness of NSA's counterterrorism SIGINT efforts,
counterterrorism management within NSA and resource issues.
5.
9/11 Classified Information
6.
Any internal "after action" reports for the 1993 WTC bombing, Khobar
Towers, Nairobi and Dar es Salaam bombings, the attempted Millennium
attacks, the Cole attack, and the attacks of September 11th.
8.
9/11 Classified Information
9. All signals intelligence reporting concerning the financing of the September
11 terrorist attacks.
•ri-x (202)331-4060
FAX (202) 296-3545
www.9-1 lcommission.gov
DCI DOCUMENT REQUEST No. 3
Page 2

10. Any other documents, briefings, reports, emails or memoranda that the
Director NSA believes are important to the conduct of this investigation.

The Commission requests that the documents requested above be provided as soon as
they are available, even though all requested documents may not be provided at the
same time, through means of a "rolling" production.

If any requested documents are withheld from production, even temporarily, based on
an alleged claim of privilege or for any other reason, the Commission requests that
the respondent, as soon as possible and in no event later than the production date,
identify and describe each such document or class of documents, as well as the
alleged basis for not producing it, with sufficient specificity to allow a meaningful
challenge to any such withholding.

If the respondent does not have possession, custody or control of any requested
documents but has information about where such documents may be located, the
Commission requests that the respondent provide such information as soon as
possible and in no event later than the production date.

If the respondent has any questions or concerns about the interpretation or scope of
these document requests, the Commission requests that any such questions or
concerns be raised with the Commission as soon as possible so that any such issues
can be addressed and resolved prior to the production date.

June 11, 2003 Daniel Marcus

General Counsel
 Unclassified

September 11 Plot Financing: Key Questions

Financial Activity of 19 Hijackers (and Moussaui)

A. How much can we show they spent (living expenses, travel, flight
training, flight supplies, etc.).
B. What other costs, if any, do we know they must have incurred,
even if not demonstrable
C. What is the best estimate of how much the plot cost
• resolve conflict on this figure
• requires setting start date for each participant in plot

A. How much can we show they received

• wire transfers to Hamburg

• wire transfers to U.S.
• cash deposits in U.S.
• other funds received

A. How much of a "gap" exists between what they spent and what we
know they received

• where is "gap" (i.e., can we identify which hijackers

must have received more funding than we can trace)
• Al-Mihdhar
• Al-Hazmi
• Others
• Best explanation for gap (i.e., what does evidence
suggest is most likely explanation, additional overseas funding, more
cash, funding by persons in U.S., or something else).

A. What U.S. persons, if any, may have provided funds to 19 hijackers

• Persons in contact with Al-Mihdhar and Al-Hazmi in

San Diego
• Anyone else

A. How were Moussaoui's activities funded

• Funds received and spent
• Story of Moussaoui's financing inextricably linked to
19 hijackers

A. Return of Unused Funds

 Unclassified

how much
to whom
when

El. Sources of Funds

A. Who provided hijackers (and Moussaoui) with funds

• wire transfers from overseas
• Cash/Traveler's Checks
• Anything else
• Resolve conflicting testimony re source of transfers
from UAE

A. Can we trace funds originating overseas beyond initial source

• From whom did persons providing money to hijackers

get those funds
• If not from direct Al-Qaeda source, were funds
provided with knowledge of purpose

A. Can we identify source of funds, if any, received by hijackers from

persons in United States
• San Diego persons
• What is status of investigation, reported by press, into
allegations Saudi Princess Haifa Al-Faisal, wife of Prince Bandar,
provided funds to families of certain persons who had contact with
hijackers in San Diego
• What knowledge, if any, did any source have of purpose
for funds

ffl. Other questions

A. Did any of the hijackers use false social security numbers to open
bank accounts
• has been alleged in press, but no mention of it in Govt.
sources
• would be inconsistent with Mueller's public testimony
("they lived lawfully"); would be major omission in Lormel's public
2/02 testimony that "none of hijackers had social security numbers"

A. Did any Banks file S ARs re any of the hijackers' financial

activities
• Allegation by M. Levitt that SARs> were filed, but not
did not reach proper authorities until after 9/1 1 . See M. Levitt,
Stemming the Flow of Terrorist Financing, Fletcher Forum of World
 Unclassified

Affairs, Vol. 27:1 at 64. See also H. Morgan, TNR Article (April 14,
03) making similar allegation.
The Financial Times (November 29,01) reported that
when Atta opened a SunTrust account in June 2000 with a $69K wire
transfer, "three months later prompted SunTrust Bank to make a
suspicious transaction report" to FinCEN.
If not, did circumstances of any transactions warrant a
SAR
 Document Request to FBI: Draft (6/10)

[Documents produced to the Joint Inquiry excluded] .•.

. ;,x • •'
1. Documents summarizing, identifying, or analyzing the financial transactions
(including expenditure and receipt of funds) of the September 11 hijackers and
each co-conspirator including:

a. Comprehensive timelines of the financial transactions of the September 11

plot;

b. Individual spreadsheets reflecting the financial transactions of each of the

September 11 hijackers and any other co-conspirator,

c. Documents identifying any funds expended on behalf of the September 11

hijackers by any person and any reimbursement of any such expenditures;

d. Documents estimating or analyzing the total cost of the September 11

attacks (and explaining the methodology of any such estimates).

2. Documents summarizing, identifying, or analyzing the source of any funds

received by the September 11 hijackers or any co-conspirator.

3.

9/11 Closed by Statute

4.

5. All FD-302s or other documents reflecting or memorializing interviews of the

employees of any bank, foreign or domestic, used by the September 11 hijackers
or any co-conspirator.

6. All documents reflecting or memorializing interviews of the employees of the

Wall Street Exchange, Dubai, United Arab Emirates (UAE), UAE Exchange
Centre, Bur Dubaie, UAE, or any other persons interviewed in connection with
any transfer of funds from outside the United States to any of the September 11
hijackers or any co-conspirator.

7. All documents, including account statements, checks, and any;spreadsheets

related to any bank accounts in the names of the Septemberfl 1 hijackers or other
co-conspirator at any bank or other financial institution in the United States or any
foreign country.
8. All debit card and credit card records, statements and spreadsheets for the
September 11 hijackers or other co-conspirator.

9. All money orders, traveler's checks, or other financial instruments utilized by the
September 11 hijackers or other co-conspirator.

10. All documents reflecting any financial transaction by any of the September 11
hijackers or other co-conspirator, including such documents as rent receipts,
purchase receipts, wire transfer records, etc.

11. Reports, summaries, and intelligence or analytic products, concerning the time
period from 1996 to the present, discussing or describing the means or methods
by which Usama bin Laden, al-Qaeda or related groups raise'fiinds, including,
without limitation:

a) any direct or indirect funding of Usama bin Laden, al-Qaeda or related groups
by any foreign government (or persons or entities associated or related to any
foreign government);

b) the use of informal value transfer systems, such as hawala, for terrorist
financing activities or the movement of money in support of terrorist activities
or groups;

c) the use or potential use of commodities, precious metals or stones, and trade-
based value transfer systems for terrorist financing activities or the movement
of money in support of terrorist activities or groups;

d) the use or potential use of charities or other non-governmental organizations

to raise funds for Usama bin Laden, al-Qaeda or related groups;

e) direct or indirect funding of al-Qaeda or related groups by any persons located

within the United States;
C H"

f) the extent to which the financing activities of Usama bin Laden or al-Qaeda
are linked or interrelated to the financing activities of any other Islamic
extremist group.

12. Reports, summaries, and intelligence or analytic products, concerning the time
period from 1996 to the present:

a. Describing or discussing any effort prior to September 20, 2001 to secure

cooperation of any foreign government in any effort to identify, track or disrupt
the financing activities of Usama bin Laden, al-Qaeda or related groups;
 b. Describing or discussing any actual or contemplated program, policy, or
operation prior to September 20, 2001 designed to identify, track or disrupt the
financing activities of Usama bin Laden, al-Qaeda or related groups;

c. Identifying or discussing known or suspected assets prior to September 20,

2001 of al-Qaeda or Usama bin Laden.

13. All documents received from the National Security Council (NSC) Office of the
President, or Attorney General containing strategy, policy or guidance on efforts
to identify, track or disrupt the financing of terrorist activities or the movement of
money in support of terrorist activities or groups, from 1996 to the present.

14. All documents, concerning the period from 1996 to the present:

a. Evaluating or analyzing the effectiveness of programs or policies of the FBI

specifically, or the U.S. government generally, to identify, track or disrupt
terrorist financing activities. This includes, but is not limited to, all internal
inspections reports, inspector general reports, and GAO evaluations;

b. Setting forth, describing or interpreting policies and procedures, including

Memoranda of Understanding, for cooperation with any local, state, or federal
government agency (or between or among components within the Department
of Justice), to identify, track or disrupt the financing activities of Usama bin
Laden, al-Qaeda or related groups;

c. Setting forth, describing or interpreting policies and procedures for

cooperation with foreign governments or multilateral organizations to
identify, track or disrupt the financing activities of Usama bin Laden, al-
Qaeda, or related groups.

15. All documents received from the terrorist financing Policy Coordinating
Committee (PCC) or its predecessor, reflecting guidance, strategy, or policy, from
September 11, 2001 to the present.

16. All FD-302s, investigative inserts, electronic communications, Letterhead

Memoranda and other summaries or analytic documents relating to pre September
11,2001 investigations into any of the following persons or entities:

a. Al-Barakaat
b. Al-Taqua
c. Global Relief Foundation
d. Benevolence International Foundation ;
e. Al-Harimain Islamic Foundation
f. [Individual 1; name to be provided]
g. [Individual 2; name to be provided]
17. Documents reflecting the organizational structure, mission, role and function of
the Terrorist Financing Operations Section or its predecessor, the Terrorist
Financial Review Group (collectively, "TFOS"), including:

a. mission statements, organizational charts, roster of personnel;

b. memoranda or other documents setting forth policies or procedures

regarding the coordination or communication between the TFOS
and the Field Offices, the National Joint Terrorism Task Force
(JTTF) or the JTTF programs at the field offices;

c. memoranda or other documents setting forth policies or procedures

concerning TFOS's international outreach program;

d. documents describing the goals and capabilities of TFOS's data

mining projects and efforts to develop predictive models for
detecting terrorist financing activities, including, without
limitation, documents describing the Financial Control List and
identifying the criteria for inclusions of persons on the Financial
Control List;

e. documents setting forth policies or procedures regarding

cooperation with domestic private banks or other financial
institutions to track or disrupt terrorist financing activities;

f. documents setting forth policies or procedures for cooperation with

foreign governments or multilateral organizations to identify, track
or disrupt terrorist financing activities, or encouraging foreign
governments to take action to identify, track or disrupt terrorist
financing.

18. To the extent not covered by previous requests, documents setting forth or
summarizing any post-September 11, 2001 changes in the FBI s policies or
procedures regarding identifying, tracking or disrupting terrorist financing
activities.

19. Reports, summaries, and intelligence or analytic products discussing any changes
in the financing activities of al-Qaeda or other Islamic extremist groups in
response to the post-September 11,2001 efforts of the U.S. government to
identify, track or disrupt terrorist financing activities.

20. Summaries, reports and memoranda concerning any investigation into any
securities or other trading activity designed to profit (or avoid losses) from the
September 11, 2001 terrorist attacks.
21. For the period from 1996 through September 11, 2001, any documents related to
any investigation of 18 U.S.C. 2339A or 2339B presented to the Department of
Justice (including any U.S. Attorney's office) for prosecution, where such
prosecution was declined.

22. Any policy statements, procedures, and guidelines received from the Department
of Justice regarding investigations or prosecutions under 18 U.S.C. Sections
2339A or 2339B.
 Document Request to FBI: Draft (6/2)

[Documents produced to the Joint Inquiry Excluded]

1. Documents summarizing, identifying, or analyzing the financial transactions of

the September 11 hijackers, including:

a. documents summarizing or identifying all funds received by

the September 11 hijackers;
b. documents summarizing or identifying all funds expended by,
or on the behalf of, the September 11 hijackers;
c. documents estimating or analyzing the total cost of the
September 11 attacks (any explaining the methodology of any
such estimates.

2. Documents summarizing, identifying, or analyzing the source of any funds

received by the September 11 hijackers.

3. To the extent permissible by law and under applicable court orders, documents
summarizing, identifying, or analyzing the financial transactions of Zacarias
Moussaoui and the source of funds received by Zacarias Moussaoui.

4. Documents summarizing, identifying, or analyzing any funds spent on behalf of

(or reimbursed by) any of the September 11 hijackers by any person, including,
without limitation, any funds spent on behalf of the September 11 hijackers by:

5. All documents related to any investigation into any allegation that any person
affiliated with the Saudi royal family, the Saudi government, or any Saudi
corporation or institution provided funds to the September 11 hijackers or any
person who potentially aided or associated with the September 11 hijackers.

6. Memoranda, reports, and summaries created prior to September 11, 2001

discussing known or suspected Bin Ladin or Al-Qaeda assets.

7. Memoranda, reports, and summaries discussing any pre-September 11,2001

actual or contemplated program, policy, or operation designed to track or disrupt
the financing activities of Al-Qaeda or other Islamic extremist groups.

8. Memoranda, reports, or summaries related to any pre-September 11 effort to

secure cooperation of any foreign government in any effort to identify, track or
disrupt the financing activities of Al-Qaeda or other Islamic extremist groups or
encourage any foreign government to make such efforts.

9. Memoranda, reports, or summaries evaluating the pre-September 11 cooperation

or actions of any foreign government in identifying, tracking or disrupting the
financing activities of Al-Qaeda or other Islamic extremist groups.
10. Any and all documents evaluating, critiquing or assessing the pre-September 11
efforts by the FBI specifically, or the U.S. government generally, to identify, track
or disrupt terrorist financing activities.

11. Memoranda, reports, and summaries discussing the means and methods by which
Al-Qaeda or other Islamic extremist groups raise funds for terrorist purposes,
including, without limitation,

a. use or potential use of charities or other Non-Governmental Organizations

(NGOs) to raise funds for Al-Qaeda or other Islamic extremist groups;
b. direct or indirect funding of Al-Qaeda or other Islamic extremist groups
by any foreign government or persons affiliated or associated with any
foreign government;
c. direct or indirect funding of Al-Qaeda by any persons located within the
United States;
d. informal value transfer systems, such as Hawala, for the purpose of
financing Al-Qaeda or other terrorist groups;
e. the extent to which the financing activities are linked or inter-related to the
financing activities of any other Islamic extremist group.

12. Any and all documents, including Memorandums of Understanding, reflecting

policies and procedures for cooperating with any other government agency to
track or disrupt the financing activities of Al-Qaeda or other Islamic extremist
groups, including, without limitation:

a. Documents setting forth policies and procedures regarding cooperation

with OFAC to track or seize terrorist assets;
b. Documents setting forth policies and procedures regarding cooperation
with FinCEN on any issue related to terrorist financing;
c. Documents setting forth policies and procedures regarding cooperation
with the CIA's Counterterrorism Center, Financial Operations Group.

13. Documents reflecting the organizational structure, mission, role and function of
the Terrorist Financing Operations Section or its predecessor, the Terrorist
Financial Review Group (collectively, "TFOS") and the place of the TFOS within
the Counterterrorism Division.

14. Memoranda or other documents setting forth policies or procedures regarding the
coordination or communication between the TFOS and the Field Offices, the
National Joint Terrorism Task Force (JTTF) or the JTTF programs at the field
offices.
I'M

15. Memoranda or other documents setting forth policies or procedures concerning

TFOS's international outreach program to share information regarding terrorist
financing with foreign financial institutions or law enforcement organizations.
16. Documents describing the goals and capabilities of TFOS's data mining projects
and efforts to develop predictive models for detecting terrorist financing
activities, including, without limitation, documents describing the Financial
Control list, (used to identify individuals under investigation for potential links to
terrorists and terror organizations), and identifying the criteria for inclusions of
persons on the Financial Control List.

17. Documents setting forth policies or procedures regarding cooperation with

domestic financial institutions to track or disrupt terrorist financing activities.

18. Documents setting forth policies or procedures for cooperation with foreign
governments or multilateral organizations to identify, track or disrupt terrorist
financing activities, or encouraging foreign governments to take action to identify,
track or disrupt terrorist financing.

19. All documents evaluating, critiquing or assessing the post-September 11 efforts

by the FBI specifically, or the U.S. government generally, to identify, track or
disrupt terrorist financing activities.

20. All documents evaluating, critiquing or assessing the cooperation of any foreign
government or multilateral organization in identifying, tracking or disrupting the
financing activities of Al-Qaeda or other Islamic extremist groups since
September 11,2001:

21. To the extent not covered by previous requests, documents setting forth or
summarizing any post-September 11, 2001 changes in policies or procedures
regarding identifying, tracking or disrupting terrorist financing activities.

22. Memoranda, reports, and summaries discussing any changes in the financing
activities of Al-Qaeda or other Islamic extremist groups in response to the post-
September 11,2001 efforts of the U.S. government to identify, track or disrupt
terrorist financing activies.
 Substantive Briefing Request: CIA

A briefing from the CIA personnel best able to provide it on the history of Al-
Qaeda's financing activities from its emergence to the present day. The briefing should
include discussions of the following subjects:

a. all means and methods by which Al-Qaeda finances its activities, and how
those means and methods have changed over time;

b. the source of Al-Qaeda's funding, and how the sources have changed over
time;

c. any involvement of any foreign government in directly or indirectly funding

Al-Qaeda, and how any such foreign government involvement has changed
over time;

d. the best estimates of how much Al-Qaeda spends on an annual basis, and how
its "budget" has changed over time;

e. the impact on Al-Qaeda's operations of the U.S. government's efforts to

disrupt its financing activities;

f. how Al-Qaeda has responded to the efforts of the U.S. government to disrupt
its financing activities;

g. the extent to which Al-Qaeda's financing activities are interrelated with the
financing activities of other Islamic extremist groups;

h. the most significant loopholes, failings, or shortcomings in the current

international effort to disrupt the financing activities or Al-Qaeda and other
Islamic extremist groups.

To promote the efficiency and usefulness of the briefing, we would like to receive
any memoranda, reports, or other analytical documents recommended by the CIA
addressing the above issues in advance of the briefing.
OFAC document request

The National Commission on Terrorist Attacks Upon the United States ("the
Commission") requests that Office of Foreign Asset Control, Department of the Treasury,
("respondent") provide the Commission with an opportunity to inspect [and copies of] the
following documents no later than [production date] ("production date"):

1) Memoranda, reports and summaries prepared in connection with the listing by

executive order designation of the following entities or individuals:

a) Al-Qaida and bin Laden (8/22/1998)

b) Taliban (7/4/1999)
c) Al-Barakaat and al-Taqua (11/7/2001)
d) Global Relief Foundation and Benevolence International Foundation (12/14/01)
e) Al-Hamati Sweets Bakeries and Al-Shifa' Honey Press For Industry and
Commerce, et al., (10/12/2001)
f) Afghan Support Committee and Revival of Islamic Heritage Society (1/9/2002)
g) Al-Harimain Islamic Foundation (3/11/2002)

2) Memoranda, reports and summaries of Specially Designated Terrorists (SDT)

associated with the above designations.

3) Memoranda, reports and summaries involving the designation of Foreign Terrorist

Organizations by the Department of State associated with the above designation.

4) Memoranda, reports and summaries describing assets frozen and blocked as a result
of the above Executive Order and SDT designations.

5) Memoranda, reports and summaries, including after action reports, prepared in

connection with trips taken by OFAC personnel to Saudi Arabia, Bahrain, Kuwait and
the UAE from 1998 to present.

6) Memoranda, reports and summaries prepared in connection with meetings between

OFAC personnel and the bin-Laden family, including post-meeting summaries.

7) Memoranda, reports and summaries identifying or describing known or suspected

assets of Usama bin Laden, his associates, or Al-Qaeda generally, and the sources of
such assets, from 1995 to the present.

8) Memoranda, reports or summaries prepared in connection with OFAC charities

outreach program, from 1995 to the present.

9) Memoranda, reports and summaries prepared in connection with the implementation

of and compliance with Presidential Decision Directive 42 (1995).
10) Memoranda, reports and summaries prepared in connection with the implementation
of and compliance with the conclusions and recommendations pf the National
Commission on Terrorism (Bremer Commission).

The Commission requests that documents requested above be provided as soon as

they are available, even though all requested documents may not be provided at
the same time, through means of a "rolling" production.

If any requested documents are withheld from production, even temporarily,

based on an alleged claim of privilege or for any other reason, the Commission
requests that the respondent, as soon as possible and in no event later than
the production date, identify and describe each such document or class of
documents, as well as the alleged basis for not producing it, with sufficient
specificity to allow a meaningful challenge to any such withholding.

If the respondent does not have possession, custody or control of any

requested documents but has information about where such documents may be
located, the Commission requests that the respondent provide such
information as soon as possible and in no event later than the production date.

If the respondent has any questions or concerns about the interpretation or

scope of these document requests, the Commission requests that any such
questions or concerns be raised as soon as possible so that any
such issues can be addressed and resolved prior to the production date.
Re: Briefing requests on terrorist financing:

We would like to request each of the agencies to provide us with a briefing on its efforts regarding terrorist
financing. We are interested, in general terms, what the efforts of each agency has been, what units are
responsible and the chain of command, how it generally coordinates with other agencies, and the types of
documents that get generated. We would also be interested in any existing written summaries or other
work product generally describing what they do or the results of their efforts, as well as organizational
charts and telephone directories of the personnel involved.

We would like briefings from the following agencies:

FBI TFOS (hold pending review of Joint Inquiry and briefing)

Justice, Criminal Division, CT Section
Main Treasury
IRS, Exempt Organizations
FinCEN
OFAC
Customs
CIA CTC (hold pending review of Joint Inquiry and 5/20 briefing)
State, Office of the Coordinator for Counter-terrorism and/or Intelligence and Research

We understand that these requests need to be centrally coordinated. Please advise.

 Securities and Exchange Commission Document Request — DRAFT

The National Commission on Terrorist Attacks Upon the United States

(Commission) requests that the Securities and Exchange Commission (SEC) provide the
Commission with an opportunity to inspect and copy the following documents no later
than (the production date).

Any and all documents (including memoranda, spreadsheets and other

staff-generated documents, as well as documents received from any other
source) related to any investigation into any trading activity designed to
profit (or avoid losses) from the September 11, 2001 terrorist attacks,
including, without limitation:

• short selling
• purchase of put options
• sales of stock.

The Commission requests the documents requested be provided as soon as they

are available, even though all requested documents may not be provided at the same time,
through means of a "rolling" production.

If any requested documents are withheld from production, even temporarily,

based on an alleged claim of privilege or for any other reason, the Commission requests
that the respondent, as soon as possible and in no event later than the production date,
identify and describe each such document or class of documents, as well as the alleged
basis for not producing it, with sufficient specificity to allow a meaningful challenge to
any such withholding.

If the SEC does not have possession, custody or control of any requested
documents but has information about where such documents may be located, the
Commission requests that the SEC provide such information as soon as possible and in
no event later than the production date.

If the SEC has any questions or concerns about the interpretation or scope of these
document requests, the Commission requests that any such questions or concerns be
raised as soon as possible so that such issues can be addressed and resolved prior to the
production date.
FinCEN document request

1) Any and all documents used to develop or reflecting the analysis contained within
FinCEN Report Number 4, January 2002.

2) Memoranda, reports, analysis and summaries prepared in connection with Suspicious

Activity Reports filed from 1994 to September 11, 2001. Include any written
referrals to law enforcement agencies and the results, if known, of the referral.

3) Memoranda, reports and summaries describing the functions, staffing, budget and
duties the Office of Intelligence, from 1999 to the present. Include any written
referrals resulting from the activities of the Office of Intelligence to law enforcement
or intelligence agencies and the results, if known, of the referral.

4) 1998 report on hawala prepared by Patrick lost.

5) Memoranda, reports and summaries regarding assessments of the status and

effectiveness of the Financial Intelligence Units (by whatever name, and regardless of
membership in the Egmont Group) of Saudi Arabia, Bahrain, Yemen, UAE, Qatar
and Kuwait.

6) Memoranda, reports and summaries regarding assessments of the anti-money

laundering and anti-terrorist financing laws, regulations and practices of Saudi
Arabia, Bahrain, Yemen, UAE, Qatar and Kuwait.

7) Memoranda, reports and summaries prepared in connection with the proposed

regulation of money services businesses (including wire remitters, check cashers,
money exchangers and informal value transfer systems) from 1994 to September 11,
2001.

8) Memoranda, reports and summaries prepared in connection with the implementation

of and compliance with Presidential Decision Directive 42 (1995).

9) Memoranda, reports and summaries prepared in connection with the implementation

of and compliance with the conclusions and recommendations of the National
Commission on Terrorism (Bremer Commission).
 /9/11 Classified Information

Main Treasury document request

1. Memoranda, reports andsummaries prepared in connection with the establishment of

the Foreign Asset Tracking Center, and its| |
| H Includes report to Congress on status of FTAT pursuant to
section 906 of the US A PATRIOT Act, due February 2002, delivered on or about
July 23, 2002.

2. Memoranda, reports and summaries (including meeting agendas and minutes)

prepared in connection with the terrorist financing PCC, from its inception to the
present.

3. Memoranda, reports and summaries prepared in connection with proposals for anti-
money laundering or terrorist financing legislation, by the Department of the Treasury
or others, from 1994 to September 11, 2001.

4. Memoranda, reports and summaries regarding assessments of the anti-money

laundering and anti-terrorist financing laws, regulations and practices of Saudi
Arabia, Yemen, UAE, Qatar and Kuwait, since 1994. This should include
assessments done as part of training proposals prepared by the Office of Technical
Assistance within the Office of International Affairs.

5. Memoranda, reports and summaries prepared in connection with the implementation

of and compliance with Presidential Decision Directive 42 (1995);i
'}'''
(,'J
6. Memoranda, reports and summaries prepared in connection with the implementation
of and compliance with the conclusions and recommendations of the National
Commission on Terrorism (Bremer Commission).
 Substantive Briefing Request: CIA

A briefing from the CIA personnel best able to provide it on the history of Al-
Qaeda's financing activities from its emergence to the present day. The briefing should
include discussions of the following subjects:

a. all means and methods by which Al-Qaeda finances its activities, and how
those means and methods have changed over time;

b. the source of Al-Qaeda's funding, and how the sources have changed over
time;

c. the best estimates of how much Al-Qaeda spends on an annual basis, and how
its "budget" has changed over time;

d. the impact on Al-Qaeda's operations of the U.S. government's efforts to

disrupt its financing activities;

e. how Al-Qaeda has responded to the efforts of the U.S. government's to

disrupt its financing activities;

f. the extent to which Al-Qaeda's financing activities are interrelated with the
financing activities of other Islamic extremist groups;

g. the most significant loopholes, failings, or shortcomings in the current

international effort to disrupt the financing activities or Al-Qaeda and other
Islamic extremist groups.

To promote the efficiency and usefulness of the briefing, we would like to receive
any memoranda, reports, or other analytical documents recommended by the CIA
addressing the above issues in advance of the briefing.
 Tail :: INBOX: Fwd: Page 1 of 4
°

INBOX Compose Folders Options Search Problem? Help Addressbook Tasks Memos .Calendar Logout Open Folder l~

1 9.87MB / 476.84MB (4. 1 7%)

INBOX: Fwd: (27 Of 29) C Move I copy [Thlsjmessageto^ __ H
Delete I Reply I Reply to All I Forward I Redirect I Blacklist I Message Source I Resume I Save as I Print Back to INBOX ^ ^
Date: Mon, 2 Jun 2003 1 1 : 1 6:02 -0400
From: "" <bgrewe@9-11commission.gov>4P
To: "" <jroth @ 9- 1 1 commission.gov> 4F
Subject: Fwd:
John:

Please just print this for me. Thanks.

Barbara

The National Commission on Terrorist Attacks Upon the United States ("the
Commission") requests that the FBI provide the Commission with copies of the
following ,
documents as soon as possible, on a "rolling" basis, but no later than June 10,
2003:

1. Curricula and manuals from the following FBI training courses:

a. New Agent training, both a current version and the one in effect on
September 11, 2001;

b. Any "in-services" and conferences on Counterterrorism matters, from August

1998 to the present;

c. Any training courses, including the College of Analytic Studies, for FBI
analytic personnel from August 1998 to the present;

d. Any training courses and conferences for FBI Legal Attaches, from 1998 to
the present;

e. Any training courses specifically designed for FBI counterterrorism managers

and executives, August 1998 to the present;

f. Reports Officer training courses.

2. Copy of the Manual of Investigative and Operational Guidelines, both a

current version and the one in effect on September 11, 2001. ';
' fi

3. Copy of the Manual of Administrative and Operational Procedures, both a

current version and the one in effect on September 11, 2001.

4. Any written communications from the National Security Council to the FBI or
the Department of Justice containing counterterrorism strategy, policy or
guidance, from August 1998 to the present

5. Policy statements, directives, or guidance from the Attorney General, Deputy

Attorney General, or Assistant Attorney General of the Criminal Division to the

http://kinesis.swishmail.com/webmail/imp/message.php ?index=313 6/2/03

lail:: INBOX: Fwd: Page 2 of 4

FBI or to the U.S. Attorney's Offices on counterterrorism matters from August

1998 to the present, except for those exclusively relating to particular
investigations.

6. Copy of all versions of the Attorney General Guidelines for Foreign

Intelligence and Counterintelligence Investigations from 1983-Present.

7. FBI's annual Congressional Budget Justification Books, FY 1995-FY 2004.

8. Documents containing instructions from FBI Headquarters to FBI Field Offices

in late 2002/early 2003 to conduct an international terrorism-related
demographic survey within their territories, and any responses by the FBI Field
Offices.

9. A copy of the documents listed below from each of the following FBI Field
Offices: Baltimore, Jacksonville, Los Angeles, Miami, Newark, New York,
Phoenix, San Diego, Tampa, and Washington Field Office.

a. Each of the above listed Field Offices' annual organizational charts, on an

at least an annual basis, from August 1998; and documents sufficient to show,
on at least an annual basis, the breakdown of the number of personnel (broken
down by agent/support) assigned to each Field Office squad, and a description
of each squads' areas of responsibility.

b. Documents sufficient to show annual statistics from 1998 to the present of

the above listed Field Offices' TURK rates, broken down by program
classification.

c. A current version and the one in effect on September 11, 2001 of any
Memoranda of Understanding and other documents reflecting agreements of
coordination on counterterrorism matters between the above listed FBI Field
Offices and state/local law enforcement authorities (including the Joint
Terrorism Task Forces).

d. A current version and the one in effect on September 11, 2001 of any
Memoranda of Understanding between the above listed FBI Field: Offices and other
federal agencies regarding their cooperation and coordination on
counterterrorism matters.

e. FBI Annual Field Office Reports and any other documents, including program
plans outlining each of the above listed Field Offices' priorities and
strategies from August 1998 to the present. This request should be construed
to include any program plans or strategy documents specifically for or by the
offices' international terrorism squads.

f. Inspection Reports of the above listed Field Offices from 1998 to the
present, including interrogatories, written responses, and program write-
ups .

g. Documents containing the annual statistics from 1998 to the present

regarding the number of counterterrorism intelligence (199 classification) and
counterterrorism criminal investigations (265 classification) pending at each
of the above listed Field Offices; and, records reflecting whether these
investigations were Preliminary Inquiries or Full Field investigations, and
broken down by program classification.

h. Documents containing statistics from 1998 to the present regarding the

number of surveillance targets authorized under FISA targeting international
terrorist groups for each of the above listed Field Offices; and, records which

http://kinesis.swishmail.com/webmail/imp/message.php ?index=313 6/2/03

 :: INBOX: Fwd: \e 3 of 4

of these surveillance were targeting al-Qa'ida targets and which were targeting
other terrorist organization targets.

i. Documents containing annual statistics from 1998 to the present, regarding

the number of "informational assets" and "operational assets" who were solely
or primarily reporting on international terrorism matters for each Field
Office.

10. Inspection Reports from 1998 to the present, including interrogatories,

written responses, and program write-ups from Legats Riyadh, Paris,
Bonn/Berlin, Madrid, London, and Singapore.

11. Inspection Reports from 1998 to the present, including interrogatories,

written responses, and program write-ups from all of the FBI HQ
Counterterrorism Analytic Units.

12. Inspection Reports from 1998 to the present, including interrogatories,

written responses, and program write-ups from all of the FBI HQ
Counterterrorism Operational Units.

13. Any documents from August 1998 to the present reflecting agreements of
coordination and collaboration on Counterterrorism matters between the FBI and
the intelligence and law enforcement agencies of Saudi Arabia, Germany, Spain,
Yemen, and Pakistan.

14. Any briefing materials created by the FBI relating to Counterterrorism or

foreign intelligence collection in the United States created for or provided to
the Bush-Cheney Transition
Team.

15. Written policy statements, directives, guidance, organization charts, and

briefing material used by the Director, Deputy Director, Executive Assistant
Director for Counterterrorism, and the Assistant Director for Counterterrorism
regarding the post-September 11, 2001 FBI reforms, including but not limited to:

a. the FBI HQ Counterterrorism reorganization;

b. the creation of the Office of Intelligence;

c. the Counterterrorism "flying squad";

d. the National Joint Terrorism Task Force and the expansion of the JTTF
program at the FBI Field Offices;

e. the establishment of a Reports Officer program;

f. the efforts to upgrade the FBI's Intelligence Research Specialist and

Intelligence Operations Specialists programs;

g. the efforts to centralize the FBI's Counterterrorism program at FBI HQ.

16. Documents containing annual statistics from 1998 to the present regarding
the FBI's total number of pending Counterterrorism intelligence investigations
(199 classification), and Counterterrorism criminal investigations (265
classification); and records reflecting whether the investigations were
Preliminary Inquiries or Full Field investigations, and broken down by program

http://kinesis.swishmail.com/webmail/imp/message.php ?index=313 6/2/03

 .ail:: INBOX: Fwd: Page 4 of 4

classification.

17. Copies of the FBI's annual budget requests to the Department of Justice,
Fiscal Years 1998 to 2004.

The Commission requests that documents requested above be provided as soon as

they are available, even though all requested documents may not be provided at
the same time, through means of a "rolling" production.

If any requested documents are withheld from production, even temporarily,

based on an alleged claim of privilege or for any other reason, the Commission
requests that the respondent, as soon as possible and in no event later than
the production date, identify and describe each such document or class of
documents, as well as the alleged basis for not producing it, with sufficient
specificity to allow a meaningful challenge to any such withholding.

If the respondent does not have possession, custody or control of any

requested documents but has information about where such documents may be
located, the Commission requests that the respondent provide such
information as soon as possible and in no event later than the production date.

If the respondent has any questions or concerns about the interpretation or

scope of these document requests, the Commission requests that any such
questions or concerns be raised as soon as possible so that any
such issues can be addressed and resolved

End forwarded message

Delete I Reply I Reply to All I Forward I Redirect I Blacklist I Message Source I Resume I Save as I Print Back to INBOX
Move I Copy I™?JTtessage to

http://kinesis.swishmail.com/webmaiyimp/message.php?index=313 .- 6/2/03