You are on page 1of 53

\.;.

£&'•'&*

:; T-~^;:i-.: -;.-
o

^|*Sf.H
Sf^?S^M'*t'^Vs^>";;: :r:- L '• .
:p§^p£||:py&:-^|gier-v
li OF TERRORISTS
$Mfc^fest~iivV,v-"..Vv.«:. . • -
SEPTEMBER 11, 2001
• .

RESPONSIVE
MfSSfe ^: tO

ftia^

.:• •v-.:,-d:;.u,Ms;;-,>:;;;"?^; •:' - -.V -"r::-- :! • • '..• COMMISSION COPY


. ..-Si^iilS^^--;:;-' -''''"<*
••^^^rWy-^W-^--^L-'''--'- %'*:--: ':-•
:^iKr*Mfr;-;.>;9;,-KrS~^^- ' ' : ' • • ' • .•''''[' •
' ''".'^ff-.V- -~ '^'-SSii'S^'v''^';'^ "^""'."

^fift -iliSfe*'^:: :
FEDERAL BUREAU OF INVESTIGATION

Precedence: Iromedi Date*: 09/14/2001

To: All Field Offices Attn: ADlC's


S.AC' s

From: Counterterrorism Division


Domestic Terrorism / Counterterrorism Planning
Section
Contact: SSA

Approved By: Mueller Robert S


Pickard Thomas J
Watson Dale L
Locke Thomas Bernard /
Dick Ronald L
Jarboe James F
_...-•-" 9/11 Law Enforcement Privacy
Drafted By: j_

Case ID # : - 265-NY-280350 (Pending)

Title: TWIN TOWERS BOMBING;


"Project Lookout"
00:NY

Reference: EC dated 09/14/2001, directing all field offices


to interview all UBL, IRF and Sunni Extremists Full Field
Investigation (FFI) and Preliminary Investigation (PI)
subjects.

Synopsis: Instructions to all Field Offices to locate, identify


and interview possible associates of hijackers connected with
captioned investigation.

Details: All field offices are directed to immediately assign


personnel to access the SIOC web-page on the F3I Intranet and
locate a spreadsheet list of individuals who may be connected
to the hijackers associated with the captioned investigation.
The SIOC web-oage contains two spreadsheet lists or
individuals, one list is being utilized as the Federal
Aviation Administration watch-list of individuals for

000000001
Req 13-6
9/11 Law Enforcement Privacy /9/11 Law Enforcement
Sensitive

From.: ounte£t=
_mmeai=

connections to any future airline travel; this j.is~ is


-..designated, by the name 1EO-FAA. The second spreadsheet is a
iav: enforcement sensitive list with greater ir.f or~ation and
•detsil snd is''-designated by the name "Associates". All
assigned oersonhel are to immediately aiccess and 'retrieve the
"Associates" spreadsheet of individuals and conduct all
logical investigation to identify, locate and interview all
individuals on the list located withip their respective field
of rice 'territories . ''••.._ ;; \e spreadsheet lis.t can be a

SIOC C Home-^paae
Hom bv selecting the, Aviation Alert List \or by the
-'-agc: I I if for some re'ason, the
\ o f f i c e cannbt r e t r i e v e the list of'-gndividuals, then \d
personnel a r e ' x t o imrnediatelv contact'! J'-in SIOC
o.perations at L J a n d the list will be sent by
facsimile transmission, This list will be uodated twice
daily.

Some of the individuals en the "Associates"


spreadsheet list may. be closely or tanger.tially connected with
the'.known hijackers. \l offices should conduct all logical
investigation, including but not limited to, all FBI database
searches, drivers license searches, state.and local law \t catabase searches,

any information on the further identification and whereabouts


of the-, individuals listed on the "Associates" spreadsheet;
Based upon the exigent circumstances, SIOC has not cross- \d the " Associates"'

names of-, those individuals with whom the FBI has ongoing Full
Field or''-.Preliminary Investigations. Off-ices are directed 'to
alert UC I ~ J and/or UC'L J if any individuals
listed on the "Associates" spreadsheet are under current
investigation.

Once located and completely identified, topics of


interview coverage should include but not be limited to issues

so on.

Req 13-6 000000002


Re: Immediate lead Date: 05/14/2001

interview of the individuals should be immediately reported to


S10C operations at I I and followed by EC. Please be
advised that a Law Enforcement fclLETS message will be sent out
simultaneously with the publication of the "Associates"
spreadsheet names and therefore; contact with all state and
local law enforcement liaisons should occur to coordinate
search efforts. ;

LEAD (s) : ,, 9/11 Law Enforcement Privacy

Set Lead 1:

ALL RECEIVING OFFICES

Immediately assign personnel to access the 3IOC


Intranet web-site-, locate the law enforcement sensitive list
of individuals,, who may be connected to the hij'a.ckers
associated with .the captionea investigation and''conduct all
logical investigation for the identification, location and
interview' of these individuals. Once completed, ai'l results
are to-'be immediately reported to SIOC operations at I ~~|
}and followed by EC.

Req 13~6 000000003


. os-2$-:ooo> i
FEDERAL BUREAU OF INVESTIGATION

Precedence: DEADLINE 03/20 '2002 Date: 03/19/2002


DEADLINE 04/15/2002
To: All Field Offices Attn: SACs
All Divisions ADs
All Legats LEGATs
Counterterrorism TAWU

From: Counterterrorism
Contact: AD Pasquale J. D'Amuro p/11 Law Enforcement Privacy
Approved By: Mueller III Robert S
Watson Dale T,

Drafted BY:

Case ID #: 66F-HQ-A1296544-P (Pending)


Title: CREATION OF TERRORISM WATCH LIST
OO:HQ
BUDED: 03/20/2002
BUDED: 04/15/2002
Synopsis: The FBI is establishing a permanent Terrorism Watch List (TWL). The purpose of this electronic
communication (EC) is to outline the development protocol and the approach that will be followed 10
establish the TWL.
Details: As you are aware, following the terrorist attacks of September 11. 2001. FBI Headquarters
compiled what became known as the "Project Lookout Watch List." The project was successful in
identifying a number of individuals potentially connected to the PENTTBOM investigation. Due to the
success of this effort and in recognition of the need to maintain a centralized repository of names of
investigative interest related to tenorism investigations. Director Mueller authorized the establishment of
a permanent Terrorism Watch List (TWL). As the Director noted, this TWL is not intended to replace the
National Crime Information Center (NCIC), the Interpol "RED" notice. Federal Aviation Administration
(FAA) Security- Directives, the State Department ClasslBIS/Visa Viper program, the Custom Department's
TECS, the Immigration and Naturalization Sen-ice NAILS, FBI BOLO Alerts, or any other watch and
warning system. It is intended to supplement these existing tools and to be the CTD's single, integrated
listing of individuals of investigative interest.
Composition of the TWL

Req 13-6 000000021


9/11 Law Enforcement
Sensitive

To-. All Field Off!, es From: Counterterroris


Re: 199-HQ-NEW, 03/19/2002

The TWL will consist of a compendium of names based on information identified through
FBI and Joint Terrorism Task Force investigations. U.S. Intelligence Community reporting, and Department
of Defense intelligence gathering, as well as information provided by foreign intelligence/security services.
Although potential candidates for inclusion on the TWL will come from multiple sources, the FBI will
decide which names are ultimately placed on the TWL. The FBI also will decide into \vhich systems TWL
names will be entered (e.g.. some names may be forwarded to the Violent Gang Terrorist Organizations File
[YGTOF] maintained by NCIC. while other names may be forwarded to other databases, to include the Visa
Viper System operated by the Department of State, the FAA Watch List, or other systems).

The TWL will be designed to assist both the intelligence and the law enforcement
communities in their investigations of terrorist groups/individuals. TWL staff will coordinate with the
Criminal Justice Information Services (CJIS) Division to ensure the utilization of appropriate NCIC files
(i.e., VGTOF). This capability will provide all state and local law enforcement agencies ready access to this
'information. Information in the TWL will also be shared with U.S. Government agencies that operate
comparable tracking systems.

The TWL will be divided into three distinct categories. The first category will include the
names of individuals for whom formal criminal charges or indictments have been handed down (e.g.. the
22\s on the Most Wanted Terrorist list). The second category will include the names of
individuals under Full Investigations by the FBI, (Preliminary Investigations may be recommended by a
Field Office or selected by FBfHQ for inclusion into the TWL.) The third category of the TWL will include
the frames of individuals of interest to the FBI but who may not be the subjects of an active FBI investitzation

The list will be based upon criteria established by CTD. Individuals on the TWL will be
listed with identifying information, much like a "wanted" poster.

Administration of the TWL


The TWL will be managed by the Counterterrorism Threat Assessment & Warning Unit
(CTAWU), CTD, in conjunction with CJIS. As part of the reprogramming of FBIHQ. however, the
Counterterrorism Division will immediately identify one (1) Supervisor}' Special Agent (SSA) and six (6)
Intelligence Operations Specialists (IOS) to staff the TWL. These positions will be filled and personnel in
place by 04/15/2002.

The CTAWU staff will maintain TWL international and domestic terrorism files covering
various classifications, such as 199.265.174.266. and 279. These case files will contain a sub-file for each
of the individuals listed in the TWL. These sub-files will be worked much the same way that field office
investigative case files are handled. This applies to persons who are not readily identifiable with a field
division. As a result, preliminary investigative steps will be undertaken by FBIHQ. For example, records
checks will be performed, leads will be set. and intelligence and biographical information will be
accumulated and maintained in these sub-files, until such information is developed to allow a field office
designation. When sufficient information has been developed, an EC will be generated to the field directing
that a case be opened and assigned. In situations where a field division already has an investigation opened,
the FBIHQ sub-file will mirror the field case file and will only be maintained at FBIHQ for reference.

The initial TWL will include the 22 individuals named to the Most Wanted Terrorists list
(Category One. as discussed above), other individuals being sought in connection with the PENTTBOM

Req 13 ~ 6 000000022
9/11 Law Enforcement Privacy

To: 'A-1,1 Fie-l.c Of: es Prom: Counterterroris


Re : LS'SKHQ-NEW",..... 03 / 1 9 / 2 0 C 2

investigation, and all Full Field investigation subjects. From this starting point, the TWL staff will expand
the list, as appropriate, base'd-..on contributions from the sources identified above. A protocol will be
established and mechanisms will'be put in place to ensure full utilization of this asset. The CTD and TWL
staff, in coordination with relevant FBIHQ divisions, will develop the protocol and establish the mechanisms
necessary for utilizing the TWL. The field will be advised by'EC when this protocol has been developed.
However, in the interim, beeinninc on the date of this EC. field offices are advised to direct all inquiries and
candidates for inclusion on the TWL to Unit Ch'ie-fl \" ail "1 FBIHQ. Room
5432. In addition to the name, field offices will be asked to provide as many of the following identifiers as
possible for each submission: date of birth (essential), known aliases, alien registration number, social
security number, terrorist group affiliation, race, height, weight, and hair color.

Req 13'6 000000023


To: All Field Or c:es From: Counterterroris.
Re: 199-HQ-NSW, 03/19/2002

LEAD(s):
Set Lead 1:
ALL RECEIVING OFFICES
Be"innin" 0^/"'0/"I002. receiving offices should direct all inquiries and Preliminary- Inquiry
candidates for inclusion on the TWL to Unit nhiefl ~"l. CTAWU.,.al\ . /• FBIHQ. Room
5432. In addition to the name, field offices should provide as ..many of the following identifiers _as possible
for each submission: date of birth (essential), known aliases,_ alien registration number, social security
number, terrorist group affiliation, race, height, weight, and hair color.

Set Lead 2:
CQUNTERTERR PRISM
AT TAWU
/' 9/11 Law Enforcement Privacy
By 04/15/2002, one (1) Supervisory Special Agent (SSA) and six (6) Intelligence Operations
Specialists will be reassigned to manage and implement the Terrorism Watch List in accordance with the
general framework outlined in the "Details" section of this EC.

1 - Mr.
1 -Mr.
1 -Ms.
1 - Mr.

Req 13-6 000000024


FEDERAL BUREAU OF INVESTIGATION

Precedence: Immediate Date: 06/IC/20C2

To: All Field Offices Attn: .-.DICs


SACs
All Divisions ^~~
National Security Ms.
Mr.
^ -r -r c*
cJIS *Mr
Ji •
Mr/.'
Counterterrorism ' Mr.

From: Counterterrorism Division


Domestic Terrorism / Counterte'rrorism Planning Section
Contact: SSAI I

/9/11 Lav; Enforcement Privacy


Approved By: Mueller Robert S
Watson Dale L
McChesney Kathleen/ L
Caruso James T
D'Amuro Pasquale /
Parkinson Larry /
Kirkpatrick Michael D
Bowman M E
Jarboe James F /
Davis Todd /

Drafted By: |_

Case ID #: 66F-HQ-A1255362 (Pending)


66F-HQ-C1321794 (Pending)

Title: PLACEMENT OF TERRORIST INFORMATION IN THE


NATIONAL CRIME INFORMATION CENTER (NCIC)

Reference: 6SF-HQ-A1255362, serial 12, 66F-HQ-A1255362,


serial 13, 66F-KQ-AI255362, serial 68 and 66F-HQ-A1296544-P,
serial 37.

Synopsis: Notification to all Field Offices of upcoming


changes and protocol procedures for Counterterrorism Program

„„ f 000000025
Req 13-6
n: '-.our.terte:
e: 06/10/20C2

subjects p_aceci into

Details: As all recipients are aware, based upon an analysis


of the systems use and functionality during the 2002 Winter
Olympic Games, the minimal potential for compromise to active
investigations, feedback from field offices, and in light of
the Director's initiative for designing and maintaining the
FBI'S new Terrorism Watch List, a meeting was held on March
20, 2002, among senior FBI managers. During this meeting the
decision was made to provide guidance to the field and provide
protocols to clarify which subject names and identifying
information from the Ccunterterrorism Program must be kept in
NCIC.

I. PROTOCOLS FOR USING AND MAINTAINING INFORMATION IN NCIC

NCIC includes a file for listing members of violent


criminal gangs as well as members of terrorist organizations.
Currently these are grouped together in NCIC under the heading
"Violent Gang and Terrorist Organization File" (VGTOF). As
explained in this communication, the Bureau is adding more
NCIC sub-groups for other categories of persons who may not
meet the criteria for existing NCIC files, and it may be
appropriate in the future to change the heading "VGTOF" to a
more generally encompassing heading. Until such time as the
term "VGTOF" might be changed, the NCIC entries addressed by
this communication (except for silent hits) will be entered
into the NCIC file described herein via the VGTOF entry screen
• "-d its newly created sub-groups.

The following protocols are to be used for


determining which subjects are to be entered into the system
and when the Silent Hit system should be utilized:

1) As of the date of this communication only FULL


Investigation subjects will be required to be placed into the
NCIC system.

2} The decision as to which, if any, Preliminary


Inquiry (Pi's) subjects are placed into the NCIC system is
i-lecatec: tc tr.i;- 2AC and appropriate Section Chief of the
International or Domestic Terrorism program at F3IHQ. If the
particular individual who is the

Req 13-6 000000026


To: All Field Ofi(. as rroir.:
Re: 5-5F-HQ-A1255352 Date: 06/1C/2CC2

tc be aocrocriste for er.trv ir.~e the svstem,


then that SAC or Section Chief can order that subject's name
and identifying information be loaded and maintained in the
NCIC system.

3) The protocol for selecting a subject (Full or


PI) as a candidate for 2 Silent Hit, are as follows:

A) International Terrorism Investigations - SACs


should consider the following criteria when selecting an IT
subject of a FULL investigation to be placed into the Silent
Hit system within NCIC.

i) Subject of investigation is
target of classified collection techniques
or FULL investigation was opened based upon
single source reporting.

ii) Subject of FBI FULL


investigation was opened due to classified
information received from other U.S., or
foreign law enforcement or intelligence
agencies.

iii) Subject does not pose a


safety or violence threat to local law
enforcement.

E) Domestic Terrorism Investigations - SACs


should consider the folloxving criteria when selecting a DT
subject of a FULL investigation to be placed into the Silent
Hit system within NCIC.

i) Subject of FULL investigation


was opened based upon single source
reporting. •

ii) Subject of FBI FULL


investigation was opened due to classified
information received from other U.S., or
foreign law enforcement or intelligence
aoencies.

Req 13-6 000000027


To: .-.11 r i e l a O r n Counterter cisrr. Division
Re: 6SF-HQ-A1253362 06/10/2002

iii) Subject does not oose a


safetv or violence threat to Iocs! law
enforcement.

iv) Subject is an employee,


member of or affiliated with' a military,
federal, state, local or other law
enforcement agency, first responder agency
or any .group that could have access to NCIC
terminals.

II. THE FBI TERRORISM WATCH LIST AND NCIC SILENT HITS

As described in the communication creating the FBI's


new Terrorism Watch List (see 66F-HQ-A1296544-P, serial 37),
the Counterterrorism Threat Assessment & Warning Unit (CTAWU)
at FBIHQ, will establish a permanent Terrorism Watch List. In
light of the Terrorism Watch List (TWL) project which will be
managed on a 24 hour per day, seven day per week schedule by
the CTAWU at FBIHQ, the decision was made that CJIS will not
re-program its software concerning NCIC "Silent Hits." At
this time, reporting of a "Silent Hit" is made only to FBIHQ
SIOC, however, in light of the proposed capabilities of the
Terrorism Watch List Group and after discussions with CJIS
personnel, it was decided that CJIS will program its system to
report all "Silent Hits" to the TWL personnel at FBIHQ who
will be responsible for notifying a field office when a
subject of a Silent Hit is identified.

Once the TWL project personnel .and 24/7 operations


are established and in place within the CTAWU at FBIHQ, all
offices will be notified so that all ADICs and SACs can make
their NCIC operators and Counterterrorism Program personnel
aware of the Silent Hit notification being sent to the CTAWU
and to establish a method for responding to the Silent Hit
notifications communicated to the field office.

III. CREATION OF SUB-GROU? CATEGORIES WITHIN NCIC

Consistent with the communication creating the new


TWL there will' be four (4) sub-groups created within the NCIC
(which until further notice will be accessed under the VGTOF

Req 13-6 000000028


9/11 Law Enforcement Sensitive

To: All Field O f f i c ; From: Counterteri ;Lsm Division


Re: 66F-HQ-A1255362 . Date: 06/10/2002

heading).
The f o u r sub-grcups will be comprised of:

Category 1: Individuals who are the subject of


fcrmal criminal charges or indictments (this includes
individuals 1 named to the Most Wanted Terrorist List);

Category 2: Individuals of Special Counterterrorism


interest to the FBI, but do not yet have formal charges
pending. This category will be limited to uniquely situated
individuals such as, the three (3) remaining individuals
listed on the F B I ' s Most Wanted Terrorist List;|

J and those individuals identified during


"Operation Enduring Freedom" that pose a threat to the United
States.

Category 3: All subjects of FBI Domestic and


International Terrorism FULL Investigations and subjects of
Preliminary Inquiries as deemed appropriate by the SAC or
Section Chief; and

Category 4: Individuals of active Investigative


interest. For example, the individuals who the FBI wanted to
interview who were identified as part of the Penttbom Watch
List.

Based upon the creation of the NCIC sub-group


- =-r.= ,-t-.ries described above, there will also be a corresponding
w a r n i n g statement programmed within the system for each sub-
group category that will provide federal, state and local law
enforcement o f f i c e r s with directions of what to do when an
individual within the system is identified.

1 Please be advised that out of the 22 individuals named to the FBI's


Most Wanted Terrorist List, 19 of these individuals are listed in the Wanted
Persons file within NCIC due to the fact that arrest warrants exist for those
i n d i v i d u a l s . However, the 19 known terrorists will additionally be listed in
sub-group Category 1 within the VGTOF f i l e of NCIC. The remaining three (3)
^ nrHviciuals will be listed in sub-group Category 2, within the VGTOF file of
NCIC.

Req 13-6
000000029
To: All Field Offx s From: Counterter. ;ism Division
Re: 66F-HQ-A1255362 Date: 06/10/2002

Field offices entering information into NCIC should


differentiate between the Wanted Persons File v/ithin NCIC and
the sub-group Category 1 within the VGTOF_file. Field
offices are directed to enter ALL subjects of terrorist
investigations2 who have arrest, warrants issued into BOTH the
Wanted Persons File within NCIC and the sub-group Category 1
within the_ VGTOF file. All field office subjects- of non-
terrorism criminal charges, who have, arrest warrants issued
should only be placed into the Wanted Persons File within
NCIC, NOT Category 1 sub-group of the VGTOF file.

Category 1: Individuals who are the subject of formal criminal


charges or indictments. ALL field offices and the CTAVJU will
have the ability to enter subject identifying information into
this category.

The following information will be programmed within


the NCIC system as directions to federal, state and local law
enforcement officers:

"WARNING - APPROACH WITH CAUTION - ARMED AND


DANGEROUS. PLEASE ARREST AND DETAIN INDIVIDUAL.
ONCE THE INDIVIDUAL IS SECURELY DETAINED,
IMMEDIATELY CONTACT YOUR LOCAL FBI FIELD OFFICE."

Category 2: Individuals of Counterterrorism interest to the


FBI, but do not have formal charges pending. Only the CTAWU
y.j.11 'nave Ll'iO Ability to enter subject identifying information
into this category.

The following information will be programmed within


the NCIC system as directions to federal, state and local law
enforcement officers:

2 Subjects of Terrorist investigations include all domestic and


international terrorism and weapons of mass destruction
classifications, including (98, 183C, 199, 253A, 256B, 265, 266, 279,
291), but also all other traditional criminal classifications with a
terrorism nexus, including but not limited to explosives or weapons
violations, or any of the covered offenses enumerated under Title 18
of the United States Code Section 2332b(g)(5)(B)(i)(ii) and (iii).

Req 13-6 000000030


To: All Field Offi.-^s From: Counterter. ..-irism Division
Re: 66F-HQ-A1255362 Date: 06/10/2002

"WARNING - APPROACH WITH CAUTION. PLEASE DETAIN


THIS INDIVIDUAL FOR QUESTIONING. THIS INDIVIDUAL IS
OF INVESTIGATIVE INTEREST TO THE FBI. ONCE THE
INDIVIDUAL IS SECURELY DETAINED CONTACT YOUR LOCAL
FBI FIELD OFFICE IMMEDIATELY."

Category 3: All subjects of FBI Domestic and International


Terrorism FULL Investigations and subjects of Preliminary
Inquiries as deemed appropriate by the SAC or Section Chief.
ALL field offices and the CTAWU will have the ability to enter
subject identifying information into this category.

The following information will be programmed within


the NCIC system as directions to federal, state and local law
enforcement officers:

"WARNING - APPROACH WITH CAUTION. HOWEVER, MAKE NO


EFFORT TO ARREST INDIVIDUAL UNLESS THERE IS EVIDENCE
OF A VIOLATION OF FEDERAL, STATE, OR LOCAL
STATUTE(S). ONCE AN INDIVIDUAL IS IDENTIFIED WITHIN
THIS SYSTEM, CONDUCT ALL LOGICAL INVESTIGATION
UTILIZING TECHNIQUES AUTHORIZED IN YOUR
JURISDICTION. DO NOT ALERT THE INDIVIDUAL TO THE
FBI'S INTEREST AND CONTACT YOUR LOCAL FBI FIELD
OFFICE AT THE EARLIEST OPPORTUNITY."

Category 4: Individ-gals of Active Investigative interest.


Only the CTAWU will have the ability to enter subject
identifying information into this category.

The following information will "be programmed within


the NCIC system as directions to federal, state and local law
enforcement officers:

"WARNING - APPROACH WITH CAUTION. HOWEVER, MAKE NO


EFFORT TO ARREST INDIVIDUAL UNLESS THERE IS EVIDENCE
OF A VIOLATION OF FEDERAL, STATE, OR LOCAL
STATUTE(S). ONCE AN INDIVIDUAL IS IDENTIFIED WITHIN
THIS SYSTEM, CONDUCT ALL LOGICAL INVESTIGATION
UTILIZING TECHNIQUES AUTHORIZED IN YOUR
JURISDICTION. DO NOT ALERT THE INDIVIDUAL TO THE
FBI'S INTEREST AND CONTACT YOUR LOCAL FBI FIELD
OFFICE AT THE EARLIEST OPPORTUNITY."

Req 13-6 000000031


„., „. , , r,-efi • From: Counterter.
To: All rield Orli- o - *-v «c/->n/9nn9
Re. 56F-HQ-A1255362 Date: 06/^0/2002

IV. RE-DESIGNATION OF TERRORIST ORGANIZATION CLASSIFICATIONS

in
In an
an effort
e f o r to reduce the risk of another law
o re
enforcement a ency compromising an active FBI ^est.gat.on by
matcbinq a single subject to a specific organization, iBiHy
matching c, i y .redefine the Terrorist Organization
Classifications
tions For all
a Domestic
omes Terrorism subjects, the
" Organization Classification is: Domestic Extremist
™STXTMST*DFBI). For all International Terrorism subjects,
the Terrorist Organization Classification is: International
Extremist (INTRNTL XTMSTS*IFBI] .
All field offices that have the capability to enter

information to CJIS.
All field offices are reminded to continue to
initiate and use the two tiered Reporting and Audit system
referenced on page three (3) of the communication located at
III HO A1255362 serial 68. Additionally, all receiving
S; lie In^ted to continue using a 66 classification
Administrative file) for their divisions and use that file

^ ethe
into ^o ri
NCIC s^
system.

000000032
Req 13-6
To: All Field Offices From: Countertei .Srism Division
Re: 66F-HQ-A1255362 Date: 06/10/2002

LEAD (s):

Set Lead 1:

ALL RECEIVING OFFICES


t
1) Please ensure that all names and all identifying
information of ALL investigative classifications for domestic
and international terrorism, including cases•concerning any
diplomats from state sponsors of terrorism are maintained in
the NCIC system for All FULL INVESTIGATIONS ONLY. All offices
are requested to review all currant entries of subject
information that each office has in the NCIC system, and to
cancel or modify any current entries that do not meet the new
criteria outlined above, and for offices in non-programmed
NCIC states to submit any cancellations or modifications to
CJIS.

2) Review ALL individuals who are subjects of


domestic and international terrorism Preliminary
Investigations (PI) to determine which subjects are relevant
enough to the FBI's mission of Counterterrorism and
Prevention, to maintain in the NCIC system.

3) Review and modify all "Silent Hit" submissions to


make certain they are consistent with the new criteria
outlined above.

Set Lead 2:

1) Please modify the NCIC program software, so that


"Silent Hit" notifications will be s/ent to the
Counterterrorism Threat Assessment & Warning Unit (CTAWU) at
FBIHQ, room 5432.

2} Please modify the system software so that "Silent


Hits" are given a unique code designation, so that
Counterterrorism "Silent Hits" can be distinguished from
Undercover Operation "Silent Hits."

9/11 Law Enforcement Sensitive

Req 13-6 000000032


9/11 Law Enforcement Sensitive
ve

To: All Field Offii. J From: Counterteri ism Division


Re: 66F-HQ-A1255362 Date: 06/10/2002

3) Please modify the system software to re-define


the Terrorist Organization Classifications, for all Domestic
Terrorism subjects, the Terrorist Organization Classification
is: Domestic Extremist (DMST XTMST*DFBI), for all
International Terrorism subjects, the Terrorist Organization
Classification is: International Extremist (INTRNTL
XTMSTS*IFBt).
4) Please modify the system software to create four
(4) sub-group codes within the NCIC file system. The four
sub-group codes will correspond to:
Category 1: Individuals who are the subject of
formal criminal charges or indictments. (This includes
individuals named to the Most Wanted Terrorist List);

Category 2: Individuals of Counterterrorism


interest to the FBI, but do not have formal charges pending.
For example, the three (3) remaining individuals listed on_ the
FBI's Most Wanted Terrorist List; /
~~~
those individuals identified during "Operation Enduring
Freedom" that pose a threat to the United States and others
sought in connection with the PENTTBOM investigation;

Category 3: All subjects of FBI Domestic and


International Terrorism FULL Investigations and subjects of
Preliminary Inquiries as deemed appropriate by the SAC or
Section Chief; and

Category 4: Individuals of Active investigative


interest. For example, the type of individuals who the FBI
wanted to interview who were identified as part of the
Penttbom Watch List.

5) In connection with the creation of the sub-group


categories, please program the appropriate Warning Statement
that corresponds to the appropriate sub-group category as
defined in detail in Section III, of this communication.

10

Req 13-6 000000034


To: All Field Offi -:s From: Counterter. rism Division
Re: 66F-HQ-A1255362 Date: 06/10/2002

Set Lead 3: (Adm.) 9/11 Law Enforcement Sensitive

CJIS

Please address, in consultation with the Office of


the General Counsel (OGC), the feasability and desirability of
replacing the heading "Violent Gang and Terrorist Organization
File" (VGTOF) with a more appropriately descriptive term.

11

Req 13-6 000000035


(Rev. 08-28-2000) {

FEDERAL BUREAU OF INVESTIGATION

Precedence: ROUTINE Date: 07/11/2002


To: All Field Offices Attn: ADIC
SACs
DT/1T SSAs
From: CJ1S
Programs Development Section/Criminal Information
Coordination Unit/Module C3
Contact:
i
Approved By: 9/11 Law Enforcement Privacy

Drafted By:
Case ID #: 66F-HQ-C1250689
Title: CJIS DIVISION VIOLENT GANG AND TERRORIST ORGANIZATION
FILE
Synopsis: Instructions to all field offices to utilize new terrorist organization group/subgroup codes and
to modify all NCIC VGTOF terrorist records to new codes.
Reference: 66F-HQ-A1255362 Serial 104
Enclosure(s): Modification chart/worksheet
Details: As all recipients are aware, the National Crime
Information Center (NCIC) Violent Gang and Terrorist
Organization File (VGTOF) has been utilized since January
£(jvz in an effort to prevent potential terrorist attacks.
The referenced electronic communication provides direction
for the entry of Counterterrorism Program subjects into the
NCIC VGTOF.

The entry of the Counterterrorism Program subjects


into the VGTOF increases information sharing among law
enforcement throughout the United States and Canada. In an
effort to facilitate the field offices in modification of
existing VGTOF records, to comply with the revised criteria
as detailed in the above referenced electronic communication
(EC), the CJIS Division has developed new VGTOF terrorist
group and subgroup codes. The new VGTOF group codes which
are to be used in new cases, as well as, in the modification
of records already entered into NCIC are listed below:
GROUP

Req 13-6 000000036


9/11 Law Enforcement
'Sensitive

To: All Field. Ofi .es From: CJIS


•Re: 66F-HQ-C12506.8'9, 07/11/2002

Domestic Extremist NCIC Code:


International Extremist NCIC Code:
In addition to the new group codes, four new categories
of subgroup codes have been created for both domestic (DFBI) and
international (IFBI) terrorism cases. The new subgroup codes are
listed below with associated description of each and caveat which
will appear.at the top of the VGTOF record. It is important to
ensure the proper codes are used so the appropriate warning is
appended to the record. The warning caveat directs federal,
state, and local law enforcement on proper procedures upon an
encounter with'the subject listed in VGTOF.

SUBGROUPS
Category 1
IndividualsXwho are the subject of formal criminal
charges or indictments\(this includes individuals1 named to the
Most Wanted Terrorist List). ALL field offices and FBIHQ's
Counterterrorism Threat Assessment and Warning Unit (CTAWU) have
the ability to enter subjects into VGTOF using this category.
The new VGTOF subgroup codes which are to be used are listed
below:
Domestic NCIC Code:
International NCIC Code:
Caveat:
WARNING - APPROACH WITH CAUTION - ARMED AND DANGEROUS.
PLEASE ARREST AND DETAIN INDIVIDUAL. ONCE THE
I N D I V I D U A L IS SECURELY D E T A I N E D , IMMEDIATELY CONTACT
YOUR LOCAL FBI FIELD O F F I C E .

Please be advised that out of the 22 individuals named to the F B I ' s


Most Wanted Terrorist List, 19 are listed in the NCIC Wanted Person File.
However, the 19 known terrorists will additionally be listed in sub-group
Category 1, within the VGTOF f i l e of NCIC. The remaining three (3) individuals
w i l l be listed in sub-group Category 3, within the VGTOF file of NCIC.

Req 13-6 000000037


9/11 Law Enforcement Sensitive

To.: All Field O f f r 3 From: CJIS


Re:', 66F-HQ-C1250689, 01/11/2002

Category 2

Individuals of Counterrorism interest to the FBI, but


do not vet have_formal charges pending. This category will be
limited to uniquely situated individuals such as: the three
'. remaining individuals listed on the FBI's Most Wanted Terrorist
\List; T " 1
\ and those individuals identified during
Operation Enduring Freedom" that pose a threat to the United
States. '-Only the FBIHQ.'s CTAWU have the ability to enter
subjects into VGTOF using this category. The new VGTOF subgroup
codes which are to be used% are listed below:

Domestic NCIC: Code:


International. NCIC Code:

Caveat:

WARNING - APPROACH WITH CAUTION. PLEASE DETAIN THIS


INDIVIDUAL FOR QUESTIONING. THIS INDIVIDUAL IS OF
INVESTIGATIVE INTEREST TO THE FBI. ONCE THE INDIVIDUAL
IS SECURELY DETAINED CONTACT YOUR LOCAL FBI FIELD
OFFICE IMMEDIATELY.\y 3

All subjects &f FBI Domestic and International


Terrorism.FULL Investigations and sublects of Preliminary
Inquiries as deemed appropriate by the SAC or Section Chief. All
field offices and the FBIHQ's CTAWU has the ability to enter
subjects into VGTOF using this category. The new VGTOF subgroup
which are to be used a,re listed below:

Domestic NCIC Code:


International NCIC Code

Caveat:

WARNING - APPROACH WITH CAUTION. HOWEVER, MAKE NO


EFFORT TO ARREST INDIVIDUAL UNLESS THERE IS EVIDENCE OF
A VIOLATION OF FEDERAL, STATE, OR LOCAL STATUE (S).
ONCE AN INDIVIDUAL IS IDENTIFIED WITHIN THIS SYSTEM,
CONDUCT ALL LOGICAL INVESTIGATION UTILIZING TECHNIQUES
AUTHORIZED IN YOUR JURISDICTION. DO NOT ALERT THE
INDIVIDUAL TO THE FBI'S INTEREST AND CONTACT YOUR LOCAL
FBI FIELD OFFICE AT THE EARLIEST OPPORTUNITY.

Req 13-6
000000038
_ -._.,. . .
9/11 Law Enforcement Sensitive

<• -
To: All Field Ofr- ;es From: CJIS
Re:1-,.. 66F-HQ-C1250689, 01/11/2002

Category 4
Individuals of Active Investigative interest. For
example, the individuals the FBI wanted to interview who were
identified as part -pf the Penttbom Watch List could be entered
into VGTOF using this... category. Only'the FBIHQ's CTAWU has the
ability to enter subjects into VGTOF using this category. The
new VGTOF subgroup codes' '--.which are to be used are listed below:
Domestic NCIC Code:
International NCIC Code:

Caveat:
WARNING - APPROACH WITH CAUTION. HOWEVER, MAKE NO EFFORT
TO ARREST INDIVIDUAL UNLESS THERE IS EVIDENCE OF A
VIOLATION OF FEDERAL, STATE, OR LOCAL STATUTE (S). ONCE AN
INDIVIDUAL IS IDENTIFIED WITHIN THIS SYSTEM, CONDUCT ALL
LOGICAL INVESTIGATION UTILIZING TECHNIQUES AUTHORIZED IN
YOUR JURISDICTION. DO NOT ALERT THE INDIVIDUAL TO THE
FBI'S INTEREST AND CONTACT YOUR LOCAL FBI FIELD OFFICE AT
THE EARLIEST OPPORTUNITY.
All new VGTOF terrorist entries and existing VGTOF
records should use the aforementioned codes. Per the referenced
EC, all field offices have been directed to use the new codes
when making VGTOF record entries. In addition, all field offices
are directed to modify existing VGTOF records to reflect the new
group and subgroup codes .
Below is an example of an existing VGTOF terrorist
record. Please note this is a test record.

WARNING - APPROACH WITH CAUTION. HOWEVER, MAKE NO EFFORT


TO ARREST INDIVIDUAL UNLESS THERE IS EVIDENCE OF A
VIOLATION OF FEDERAL, STATE, OR LOCAL STATUTE (S). ONCE AN
INDIVIDUAL IS IDENTIFIED WITHIN THIS SYSTEM, CONDUCT ALL
LOGICAL INVESTIGATION UTILIZING TECHNIQUES AUTHORIZED IN
YOUR JURISDICTION. DO NOT ALERT THE INDIVIDUAL TO THE
FBI'S INTEREST AND CONTACT YOUR LOCAL FBI FIELD OFFICE AT
THE EARLIEST OPPORTUNITY.

MKE/TERRORIST ORGANIZATION MEMBER - CAUTION


ORI/DCBIWAT2 NAM/[^ A. TEST TEST TEST TEST SEX/F RAC/W
DOB /I
GNG/ANRKST*DFBI .SGP/NONE KNOWN
ECR/DF DOP/20070118 OCA/123456 TEST TEST
MIS/TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST
MIS/TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST
MIS/TEST TEST /TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST

!/ 4
9/11 Law Enforcement Sensitive
9/11 Law Enforcement Privacy

Req 13-6 000000039


9/11 Law Enforcement Sensitive
9/11 Law Enforcement Privacy

To'-. All Field Of fi J.s From: CJIS


Re: , 66F-HQ-C1250689, 07/11/2002

•.MIS/TEST TEST TEST TEST TEST


QRI IS NCIC' .INVEST & OPER ASSIST UNIT/CJIS 000 000-0000
IMN/I2550040&4 IMT/I
IMN/I490004110'' -IMT/M
IM.N/I265005412 IMT/I
NIC/T250007891 DTE/20020118 1021 EST
If the field office utilizes formatted screens for NCIC
VGT'QF entries, it is suggested the NCIC operator always use the
NIC .number (a unique NCIC number assigned to the record by the
computer), along with other fields, to identify the record being
modified. If a field office does not have formatted screens the
following string format will.need to be used to modify all
\g VGTOF records:
MMG.DCFBIWAT2.NIC/T25Q007891.NAMj | TEST TEST TEST
\TEST.OCA/123456 TEST TEST.GNG/DMST XTMST*DFBI.SGP/CATEGORY 1
\o note the above record is identified by NIC, Name
0f subject (NAM), and Originating Agency Case Number (OCA),
while the -Group (GNG) and Subgroup (SGP) fields are being
modified to the new codes. Additionally, the modification of
t\\e VGTOF record will change the caveat which is appended to the
top of the record. After modification, the record would appear
as follows: \G - APPROACH WITH CAUTION - ARMED AND DANGEROUS.

PLEASE ARREST 'AND DETAIN INDIVIDUAL. ONCE THE


INDIVIDUAL IS SECURELY DETAINED, IMMEDIATELY CONTACT
YOUR LOCAL FBI 'FIELD OFFICE.
MKE/TERRORIST ORGANIZATION MEMBER - CAUTION
QRI/DC3IWAT2 NAM/i | TEST TEST TEST TEST SEX/F RAC/W

GNG/DMST XTMST*DF3I SGP/CATEGORY 1


ECR/DF DOP/20070118 OCA/123456 TEST TEST -
MIS/TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST
MIS/TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST
MIS/TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST TEST
MIS/TEST TEST TEST TEST TEST
ORI IS NCIC INVEST & OPER ASSIST UNIT/CJIS 000 000-0000
IMN/I255004094 IMT/I
IMN/I490004110 IMT/M
IMN/I265005412 IMT/I
NIC/T250007891 DTE/20020118 1021 EST

FBI staff should refer to the NCIC Operating Manual for


additional information on modification of records. In addition,
for NCIC audit and review purposes, all supporting documentation

Req 13-6 000000040


9/11 Law Enforcement Sensitive

To: All Field Off! .s From: CJIS


Re: 66F-HQ-C1250689, 07/11/2002

should be placed in a 66 classification file with original


documentation related to the entry of the record which is being
modified.
For those field offices located in states that are not
programmed to make VGTOF entries in NCIC /
/Field
Offices) , CJIS Division will continue to make the entries/updates
until advised otherwise. A chart/spreadsheet should be created
by each above-mentioned field office specifying the new group and
subgroup codes for the modification(s). The chart should
identify the record(s) to be modified by the NIC, NAM, OCA, new
GNG, and new SGP data (see attached). All records utilizing the
same group and subgroup codes should be listed together in the
chart and sent to the CJIS Division attached to an EC. All
documentation should be sent to: CJIS Division, Programs
Development Section, Attention: Unit Chief L |
Oace the CJIS Division has completed the,,NCIC transactions, the
original NCIC printouts will be mailed -b'ack to the field office
for placement in the 66 classification file for review and audit
purposes. All new VGTOF entries--"'should continue to be forwarded
to I ) via cover EC with a completed FD-930 for each
individual entry. Any questions regarding the modification of
records by the CJIS Diy-ision, should be forwarded to/
/\1 Law Enforcement Privacy

Req 13-6 000000041


9/11 Law Enforcement
'Sensitive

To: All Field Of: ces From: CJIS


Re: 66F-HQ-C1250689, 0 7 / 1 1 / 2 0 0 2

LEAD(s):

Set Lead 1:

ALL RECEIVING OFFICES


1) Use the newly created terrorist codes for entry of all new NCIC VGTOF records.

2) All existing VGTOF records should be modified to reflect the new codes.

3} The CJIS Division will continue to update existing VGTOF records foi/

your VGTOF records, you are requested to


create a chart listing each VGTOF record, specifying the appropriate new group and subgroup codes along
with the record's NIC, NAM, and OCA. Forward this chart with a cover EC to: CJIS Division, Programs
Development Section, Attention: Unit ChieA I
4) All new VGTOF ..entries should continue to be forwarded
via cover EC with a completed FD-930 for each individual entry to
the CJIS_ Division, Programs Development Section, Attention: Unit
Chief/ I

Set Lead 2: (Adm)

COUNTERTERRORISM

AT WASHINGTON. DC

, Attention: Chief; Domestic Terrorism/


Counterterrorism Planning Section

For information only. Please read and clear.

9/11 Law E n f o r c e m e n t P r i v a c y

Req 13-6 000000042


. os-:s-:oooj
FEDERAL BUREAU OF INVESTIGATION

Precedence: PRIORITY Date: 12/24/2002


To: All Field Offices Attn: ADICs
SACs
IT Program Manager
DT Program Manager
All Legats
Count ert error ism Section Chiefs
From: Counter-terrorism
SAWS/TWWU/Room 1130.3-
Contact: SSA
Approved By :
9/11 Law Enforcement Privacy
Drafted By:

Case ID #: 66F-HQ-C1392852 (Pending)


Title: TERRORISM WATCH LIST
TIPOFF MATTERS
Synopsis: This communication describes the Department of State's
terrorist TIPOFF system and establishes procedures for FBI field
office entries into TIPOFF.

Details: The Department of State (DOS) Bureau of Intelligence and


Research maintains a classified database, referred to as TIPOFF,
which contains information regarding known or suspected terrorists
who are not U.S. citizens. TIPOFF was designed to detect these
individuals as they apply for visas overseas or as they attempt to
pass through U.S., Canadian or Australian border entry points.
DOS has established a "reasonable suspicion" threshold for
a qualifying TIPOFF entry. Specifically, there has to be reasonable
suspicion the individual is a terrorist or is associated with
terrorism. The TIPOFF database maintains classified electronic
copies of supporting documents regarding individual TIPOFF entries.
In addition to the above, DOS shares qualifying TIPOFF
data with U.S. embassies via the Consular Lookout and Support System
(CLASS) and with other U.S. border agencies via the Interagency"
Border Inspection System (IBIS] Only those TIPOFF entries which
contain names and identifying data to facilitate positive
identifica-ions are shared through CLASS and IBIS. The information

Req 13-6 000000043


9/11 Law Enforcement
Sensitive

•-^--errorisrr
•-o7852.'°12/24/2;

. X ..<->-..CT.Sc a^ 73^ ^s orovided at the unclassified level and


si.i--^ •'-'--- -ft ~ ~' ~ ,= ^ h - c'a^^-f-ed suooorting documentation,
aces n'Q~ in-iuqe any o^ ^.11= ---=
\ ''>-, ^^q ~^n r"3 a"a d=v=looinc: crocedures and

sis-apLl^MSI'l'ySs-SFSK itain i d e n t i f y i n g data v;hich would


•; -r -i iro -i dsr.ti-ications .

\d offices desiring to make an entry into^TIPOFF should

^ ^ ^ o r o " ^ - ana
waning n
UnL,- .
Terrorism Watch List and the appropriate
.cUo-in,
information as available:

a.
b.
c.
d.
f.
h.

k.
1.

offices are reminded the criteria for TIPOFF entries

- h ^ ' c o m m u n i c a t i o n should ^
s p e c i f i c a l l y^sLate ^
•- i f u n c T = s - - ' i e d photocraphs of the individual (s)
A v a i l a b l e , ' f i e l d o f f i c e s should include -he p h o t o g r a p h s , in
izonz-C _ o — - •?.at, as enclosures to their commur.ica-ions.

000000044
Req 13-6
9/11 Law Enforcement Privacy

To: All Fieic Of::, as From: Ccuntertsrroris:


Re: 5SF-HC-C13S2852, 12/24/20C2

Legats should continue to coordinate with their DOS points


of contact and utilize the VisaViper program -co make entries into
TIPOFF. However, for tracking purposes and quality assurance, Legats
should forward a brief communication to the Terrorism Watch and
Warning Unit which summarizes any new submissions to TIPOFF.
Questions regarding this matter can be directed to SSA

Req 13-6 000000045


f f ! ;S from: Cour.terterrcris:
Re: 56F-KQ-C1392S52, 1 2 / 2 4 / 2 0 0 2

LEAD(s) :

Set Lead 1:

ALL RECEIVING OFFICES


International and Domestic Terrorism program managers will
disseminate this communication to appropriate personnel and ensure
compliance for entries into the Department of State's TIPOFF
database.

Req 13-6 000000046


(Rev. 01-31-2003) i

FEDERAL BUREAU OF INVESTIGATION

Precedence: ROUTINE ' Date: 05/09/2003


To: All Field Offices Attn: ADIC
SACs
JTTF POCs
FBIHQ, Manuals Desk
Counterterrorisra TWWU/NTCS/Room 11303
S SA .1

From: CJIS
Programs Development Section/Global Initiatives
Unit/Module C-3 - / .
Contact: 1

Approved By:

9/11 Law Enforcement Privacy


Drafted By:
Case ID #: 66F-HQ-C1250689-VGTOFTERR
66F-HQ-C1384970
Title: CJIS DIVISION VIOLENT GANG AND TERRORIST
ORGANIZATION FILE; VGTOF CASE ASSISTANCE-TERRORISTS;
SUPPORT TO THE FIELD FOR COUNTERTERRORISM
INVESTIGATIONS
Synopsis: To provide support to the field for counterterrorism
investigations by clarifying instructions for submitting
requests to CJIS for entry, modification, and cancellation of
VGTOr and Silent Hit terrorist records.
Reference: 66F-HQ-A1255362 Serial 104
66F-HQ-C1392852 Serial 8
66F-HQ-C1250689 Serial 88
Details: As the field is aware, the increased emphasis on
counterterrorism post 9-11 has resulted in changes and
enhancements to systems which support the counterterrorism
mission. One of these systems or resources is the National
Crime Information Center (NCIC), Violent Gang and Terrorist
Organization File (VGTOF). To support the field in its use of
VGTOF, the CJIS Division enters, modifies, and cancels VGTOF
and Silent Hit records in NCIC for field divisions upon
request. Specifically, CJIS enters VGTOF records as an interim

Req 13-6 000000047


9/11 Law Enforcement
Sensitive

To: All Field Off. as From: CJIS


Re: 66F-HQ-C1250689-VGTOFTERR, 05/09/2003

measure for those field divisions which are located in.states


not yet programmed to make entries. CJIS enters Silent Hit
re'cords for'all field divisions. This communication is not
intended to supercede referenced Electronic Communications
(ECsO, but to clarify the information required from the field
divisions for CJIS to process these requests effectively and
expedi.tiously.
, Requests for VGTOF and Silent Hit entries should be
provided'Xvia EC to CJIS, Programs Development Section, Global
Initiatives Unit, with an FD-930 attached. The FD-930 must be
complete and legible. The information listed below is required
.for entry: \

\ information is provided,
please ensure the information is valid and complete.

GANG/GROUP
Domestic Extremist NCIC Code:
International Extremist NCIC Code:
It is important to ensure the proper codes are used so
the appropriate warning is appended to the record. The warning
caveat directs federal, state, and local law enforcement on
proper procedures upon an encounter with the subject listed in
VGTOF.

Req 13-6 000000048


9/11 Law Enforcement Sensitive

To: All Field Off^es From: CJIS


'Re: 66F-HQ-C1250689-VGTOFTERR, 05/09/2003

SUBGROUP

Category 1

Individuals who are the subject of formal criminal


pharo.es or indictments (this includes individuals named to the
Most Wanted Terrorist ...Li_st.) . Field offices and FBIHQ's
Counter.perrorism Division, National Threat Center Section,
Terrorism Watch and Warning Unit (CTD/NTCS/TWWU) have the ability
to enter \subjects into 'VGTOF using this category. The VGTOF
subgroup codes are:

Domestic NCl.C Code:


International, NCIC Code:

Caveat:

WARNING - APPROACH WITH CAUTION - ARMED AND DANGEROUS.


PLEASE ARREST AND'.DETAIN INDIVIDUAL. ONCE THE
INDIVIDUAL IS SECURELY DETAINED, IMMEDIATELY CONTACT
YOUR LOCAL FBI FIELD, OFFICE.

Category 2

Individuals of. Counterterrorism interest ro the FBI.,


but do not vet have formal .charges pending. Only the FBIHQ's
CTD/NTCS/TWWU has the ability to enter subjects into VGTOF using
this category. The VGTOF subgroup codes are:

Domestic NCIC Code:


International NCIC Code:

Caveat:

WARNING - APPROACH WITH CAUTION. PLEASE DETAIN THIS


INDIVIDUAL FOR QUESTIONING. THIS INDIVIDUAL IS OF
INVESTIGATIVE INTEREST TO THE FBI. ONCE THE INDIVIDUAL
IS SECURELY DETAINED, CONTACT YOUR LOCAL FBI FIELD
OFFICE IMMEDIATELY.

Category 3

All subjects of FBI Domestic and International


Terrorism FULL Investigations and subjects of Preliminary
Inquj.ries as deemed appropriate by the SAC or Section Chief.
Field offices and the FBIHQ's CTD/NTCS/TWWU have the ability to
enter subjects into VGTOF using this category. The VGTOF
subgroup codes are:

Req 13-6 000000049


9/11 Law Enforcement Sensitive

To: AIT -Field Off__.£S From: CJIS


Re: S6F-HQ-Ca250689-VGTOFTERR, 05/09/2003

Dome's/tic NCIC Code:


International NCIC Code:
Caveat: \G - APPROACH WITH CAUTION. HOWEVER, MAKE NO

EFFORT TO ARREST INDIVIDUAL UNLESS THERE IS EVIDENCE OF


A VIOLATION OF FEDERAL, STATE, OR LOCAL STATUTE(S).
ONCE AN INDIVIDUAL IS IDENTIFIED WITHIN THIS SYSTEM,
CONDUCT ALL LOGICAL INVESTIGATION UTILIZING TECHNIQUES
AUTHORIZED IN YOUR JURISDICTION. DO NOT ALERT THE
INDIVIDUAL TO THE\FBI' S INTEREST AND CONTACT YOUR LOCAL
FBI FIELD OFFICE AT, THE EARLIEST OPPORTUNITY.
Category 4
Individuals of Active Investigative interest. Only the
FBIHQ's CTD/NTCS/TWWU has. the ability to enter subjects into
VGTOF using this category. The VGTOF subgroup codes are listed
below:
Domestic NCIC Code:
International NCIC Code:
Caveat:
WARNING - APPROACH WITH CAUTION. HOWEVER, MAKE NO EFFORT
TO ARREST INDIVIDUAL UNLESS THERE IS EVIDENCE OF A
VIOLATION OF FEDERAL, STATE, OR LOCAL STATUTE (S). ONCE AN
INDIVIDUAL IS IDENTIFIED WITHIN THIS SYSTEM, CONDUCT ALL
LOGICAL INVESTIGATION UTILIZING TECHNIQUES AUTHORIZED IN
vruJR JURISDICTION. DO NOT ALERT THE INDIVIDUAL TO THE
FBI'S INTEREST AND CONTACT YOUR LOCAL FBI FIELD OFFICE AT
THE EARLIEST OPPORTUNITY.
ENTRY CRITERIA CODES

Req 13-6 000000050


9/11 Law Enforcement Sensitive

To: All Field Off^~>es From: CJIS


Re: 66F-HQ-C1250689-VGTOFTERR, 05/09/2003

\s for VGTOF and Silent Hit modifications and


cancellations should be provided via EC to CJIS, attention Global
Initiatives Unit. An FD-930 is not necessary. Please include
subject's 1 |
Please ensure all Silent Hit requests are identified by
indicating "SILENT HIT" in the EC and on the FD-930. All
requests not identified as a Silent Hit will be entered in
regular VGTOF.
Your contacts at CJIS for VGTOF and Silent Hit requests
are:

CJIS Division appreciates your attention to this


communication. We understand that compliance with this request
may require additional time and effort on behalf of your staff.
Your cooperation, however, will alleviate any delay in entering,
modifying, and cancelling your VGTOF and Silent Hit records, thus
enabling CJIS to provide valuable support to your counterterrorism
investigations.

9/11 Law Enforcement Privacy

Req 13-6 000000051


To: All Field OffiV^ From: CJIS
Re: 66F-HQ-C1250689-VGTOFTERR, 05/09/2003

LEAD(s) :
Set Lead 1: (Action)
ALL RECEIVING OFFICES
Attention: ADIC, SACs, JTTF POCs
Please disseminate to personnel responsible for
submitting VGTOF and Silent Hit entries, modifications, and
cancellations to CJIS and ensure that requests are submitted
according to instructions thus allowing CJIS to process requests
effectively and expeditiously.

44

Req 13~6 000000052


FEDERAL BUREAU OF INVESTIGATION

Precedence: ..mmeciate

To- 1? 1 ^eld Offices Attn: ADIC


SAC
CDC

From: Counterterrcrism Division


'Domestic Terrorism / Counterterrorism Planning
Section
Contact: SSA |_

Approved By: Pickard Thomas J


Watson Dale L /9/11 Law Enforcement Privacy
Parkinson Larry
Locke Thomas Bernard
Jarboe James F

Drafted By: I I

Case ID #: 265-NY-280350 (Pending)

Title: TWIN TOWERS BOMBING;


"Project Lookout"
00 : KY

Reference: 2 65-NY-2S 0350 , serial 1564, dated 09/14/2001.

Synopsis: Guidance to all Field Offices on individuals located on


the LEO+FAA spreadsheet commonly referred to as the "Watch List".

Details: Questions from the field have arisen concerning what


action Agents should take if they come in contact with one of
the individuals on the "Watch List."

A 1 1 ^ield offices were previously directed to locate


the SIOC web-cage containing the spreadsheet designated by the
name LEO+FAA "Watch List". Previous instructions to the fiels
were to~conduct all logical investigation to identify, locate
and interview all individuals on the list located v:ithin _heir
respective field office territories. The primary goal behind
the" location, identification and interview investigation is to

,0 . 000000004
Req 13-6
1 Law Enforcement
Sensitive

err
From: Counterter ism
Da-e: 09/15/2001
Re.:

_
determine whether any of the individual ease be advise tha
are a current or continuous threat . Pleas
separate list designated as the Non-L£Q list, containing just
rhe\s and known identifiers of the "Watch List.," but not
cert'ain law 'enforcement sensitive information has been
provided to the FAA and all major commercial air carriers.

The following procedures have been established by


F3IHQ in the event, agents locate an individual listed on the
"Watch List," whether through contact from airline companies
or through logical investigation.
Agent personnel are directed to immediately notify
Immigration\and Naturalization Service (INS) personnel when an
individual on the "Watch List" is located or when notified by
airline persd-nnel . At this'vtime, it appears that an unknown
number of the | | individuals-., on the "Watch List" may have an
INS status problem that might lead to INS detention. INS
Agents should be contacted to advise or when practicable in
the interests of time, accompany 'FBI or JTTF Agents during the
interview in order to resolve any questions or ambiguities.
\n the event INS Agents are unavailable, contact should be
11 made with the INS's Law Enforcement Support Center (LESC)
11 through FBI Albany at telephone number L [
11 Upon location of an individual on the "Watch List"
V., agent personnel are directed to stop and detain the individual
ll for interview^ ' \e next step will

1 individual.

10/7/03
V

Vll Law Enforcement Sensitive

Tc: All O f f i c e s I From: ^ountert •;is:r. Division


Rs : Irriinedia" e lead Date: C9/15 .'20

Agents should be prepared to obtain material witness


warrants or other legal process for permanent custody. Agents
cViov'M, contact SIOC/OPS for further instructions and
coordination of all material witness warrants. Members of the
FBI' s Office of General Counsel (OGC) and Department of
Justice, (DOJ) representatives are _available 24 hours a day in
SIOC at'L " I or the National Security
Law Unit at A [to answer questions on the elements
and requirements for material witness warrants and o-cher legal
questions.

Once the immigration status of the individual is


completely determined, additional topics of interview coverage
should include but not be limited to issues of:/''

Req 13-6
000000006
Division
rroir.: Ccunzertez:
Da~e: OS/15/2001
Re: I~J leac

d other relevant topics.

placed
an
noved
individual on the "Watch List" cannot be detained through
criminal or INS process, the decision as to whether or not the
individual is allowed to board a commercial aircraft remains
solely with the private airline companies, who can refuse to
provide air services,

„,„„.,
SIOC operations at

9/11 Law Enforcement Sensitive

000000007
Req 13-6
Tc: All Offices • Frcr,: Counzerrerr isiu 'JiV^sj-y.:
Re: Irrnediare lead Daze: 09.'15/2001

LEAD (s) :

Set Lead 1 :

all personnel are provided with this


Please ensure
guidance .

000000008
Req 13-6
9/11 Law Enforcement Privacy *

FEDERAL BUREAU OF INVESTIGATION

Precedence':'---, IMMEDIATE Date: 10/01/2001

To: Countertenor isrr. Attn: AD Dale L. Watson


DAD James T. Caruso

From: General Counsel


National gp^-i^rv T.aw Unit
Contact: SSA'I .
Approved By: Pickard Thomas J
Watson Dale L
Parkinson Larry
Locke Thomas Bernard
Kelley Patrick w
Bowman M E
Woods Michael J
Drafted By: Turgal James L
Case ID #: 2S5A-NY-280350-WLC (Pending)
2S5A-NY-28035C-LEGAL (Pending)
66F-HQ-A1255362 (Pending)

Title: PENTBOMB;
"PROJECT LOOKOUT"
00:NY
Synopsis: To set forth OGC's opinion on the entry of information on
United States Persons (USPER) and Non-United States Persons
(NONUSPER) results of investigations conducted pursuant to the
Project Lookout "Watch List."
Reference: 265A-NY-280350-2164
Details: Following the terrorist attacks of September 11,
2001, numerous FBI field divisions engaged in a logical
investigation of the suspected terrorist subjects. In the
interests of safety and security for the public and the
security of future commercial air travel, the investigation
expanded from the terrorist subjects themselves to other
individuals who may be linked to the criminal acts that
occurred on September 11, 2001. Based upon criteria_outlined_
bv Project Lookout personnel, FBI personnel are compiling a list
of individuals who might be associates of the subjects,
i" t-.
material witnesses to the attacks or logically connected
the criminal activity.

„„ . 000000009
Req 13-6
To: Counterterroi ~ rrorr.: oenera_ Counsel
Re: 265A-KY-28035v-KLC, 10/01/2001

This investigation by the FBI is premised upon the


important duty to protect the public. Ac the same time, our
duty must be performed with care to protect individual rights
and to insure that investigations are confined to matters of
legitimate law enforcement interest.
It is the opinion of the Office of The General Counsel
that, based upon the FBI's legitimate law enforcement purpose of
investigating acts of terrorism and preventing future acts of
terrorism, this collection of information upon both United States
Persons and non United States Persons, meets the standards for
collection, use, retention and dissemination of information pursuant
to the Attorney General Guidelines on General Crimes, Racketeering,
Enterprise and Domestic Security/Terrorism Investigations and the
Privacy Act of 19"74, specifically,
5 U.S.C. § 552a(e}(7), which governs the collection of information
that may impact on an individual's First Amendment rights.
As such, retention of this information within the
FBI system of records and the indexing of all names and other
identifying information into the Automated Case Support System
(ACS) is appropriate.

Req 13-6
000000010
To: C o u n ~ e r t e r r c srn Frorr.: G e n e r a l Couns?
Re: 255A-NY-230350-v\L:, 1 0 / C 1 / 2 0 0 1

LEAD(s):
Set Lead 1:
ALL RECEIVING OFFICES
Read and clear.

Req 13~6 000000011


FEDERAL BUREAU OF INVESTIGATION

Precedence: ROUTINE Date: "• 0 ' "' 3 ••'' 2 C 0 1

To: All Field Offices Attn: ADIC 1 s


All Legats Attn: SAC ' s
Attn: CDC's
Attn: LEGAT ' s

From: Counterterrorismn
ITOS/UBL/R /RM 5328
Contact: UC[1 m
Approved By: Pickard Thomas J •9/11 Law Enforcement Privacy
Watson Dale L
D'Amuro Pasquale J /

Drafted By: |_

Case ID #: 265A-NY-280350-WLC (Pending)


265A-NY-280350 (Pending)

Title: PENTTBOM
"PROJECT LOOKOUT"
OO: NY

Synopsis: Information and guidance to all offices regarding the


elimination of the Project Lookout Watch List on 10/23/01.

•D^-P,,,.,->„,-„-,. 265A-NY-28Q350 Serial 1634


265A-NY-280350 Serial 2164

Enclosure (s) : Referral to Federal Aviation Administration (FAA), 20


Fact Sheets.

Details: The FBI initiated captioned investigation immediately


following the terrorist attacks of 09/11/2001. Through logical
investigation and in the interest of safety and security for the
public and commercial air travel, the investigation expanded from the
known suspect terrorist to other individuals who may possess
knowledae of the criminal act of 09/11/2001.

Based uoon criteria established following the attacks, ?3I


began to compile the Project Lookout Watch list. Tie Watch
List was made UD of individuals thought to be associates of tie known
subjects, material witnesses to the attacks or in some other way

000000012
Req 13-6
All Field
265A-NY-230350-WLC, 10/23/2001

connected to the events of 09/11/2001. Inclusion on the list aid no,


necessarily mean that an individual was a knowing ana o *-.-£*
D a -<cipant in criminal activity, but rather i. ^an^.^-s .n-ir. *-
someone who may possess information of value to tne investigation.
?oS°te t^s project has met with a high degree 01 success in
^dent xying'and interviewing individuals potentially connectec to ,he
PENTTBOM investigation and resolving their status as a thre.t to U.S.
interests.
Ove- th* last three weeks Project Lookout has reviewed
ev-ry name on the Watch List. This diligent review has resulted_in
the elimination of the Project Lookout Watch List. A aeterminat.cn
has been made in every case to open an investigation ^ the
individual, Place them into the State Department ^lass/IBxSAisa
Vioer program, recommend they be included on an FAA Security
Directive and/or recommend no further investigation.

For -ach of those individuals who have been recommended


for further investigation, SIOC has drafted, uploaded and
His^minat-d an EC to the appropriate field office. For those
individuals placed into the State Department Class/IBIS/Visa Viper
program, SIO? has drafted and disseminated a teletype to the State
Department. During the review Project Lookout aetermined that a
number of Watch Listed individuals could pose a risk to commercial
aiTtravol A fact sheet was created for each of these individuals
and provided to the FAA for review. All other Watch Listed
individuals were reviewed with a recommendation of no further
investigative action.
For the information of the field, attached are copies _-'
the FAA fact sheets provided to the FAA. _ These individuals may be
added to an FAA Security Directive. The field is requested "hen
asked bv airline or airport security to respond and interview these
individuals to evaluate their risk to commercial air travel The _
f^'d should consult with the UBL/RFU unit in the event that one or
th^- individuals is identical to the individual provide to the F*A
through these fact sheets. It will be left to the discretion of the
individual airline as to travel of these individuals.

r*-=ec^iv» ^he ca^e of -his communication Project Lookout


w <Tit^nate'the vvatch List. Notification of this termination will
_;;; •;; O';ovided through LEO, NLETS and the Virtual Private _Ne.wor/.
/v^) " Th» Daily investigative Accomplishment Report is still _
:^,i^^ and should be faxed to SIOC by COB each day. Tne nels
" SIOC Fax nu^s-H 1

9/11 Law E n f o r c e m e n t
Sensitive 000000013
Req 13-6
Frorr.:
10/23/2001

The Comnur-icstions VvE"ch sucervisor on ~ n s join ^_w


hsvs suosrviscrv resoonsibili'tv for ~ h s D s i l v Ir.ve3t.ica~ ive
AcconYciishment Report..

,_ c 000000014
Req 13-6
To: All Field Of! jes
Re: 265A-NY-280350-KLC, 10/23 '2001

LEAD(s) :

Set Lead 1:

ALL RECEIVING OFFICES

Inform all personnel connected to the Project Lookoul


Watch List that it will be terminated by the COB 10/23/01.

Req 13-6 0000000X5


FEDERAL BUREAU OF INVESTIGATION

Precedence:

To: .-.11 field :ffi;es Attn : A


c

From: Coup.terterrcrism Division - ;


Domestic Terrorism / Countertlerrorism Planning
Section
Contact: SSA |_

Approved By: Mueller Robert S I .,.--""


Watson Dale L ;..--""
McChesnev Ksthleen I. ,/9/H Law Enforcement Privacy
Parkinson Larry
Caruso James T
Bowman M E
Jsrboe James ~
Davis Todd

Drafted By: |_ \e ID #: 66F-HQ-A12 55362 (Pending)

66F-HQ-C1321794 (Pending)

Title: SAFE STREETS VIOLENT CRIME INITIATIVE


VIOLENT GANG AND TERRORIST
ORGANIZATIONS FILE (VGTOF)

Reference: 56F-HQ-A12 553 52 , serial 12, dated 11/20/2001, EC frcrn t


Office of the General Counsel (OGC) .

Synopsis: Instructions to all Field Offices to _ocate,- icentiry


oomoile =11 r.arves and ider.zifyinr inf crrr.aticr. rrcm Cour.terterror

Details: ~-.s a_i recicier.ts ^re av:are, a ccr._ertr." _:

,, , 000000016
Req 13-6
Law Enforcement
;nsitive

Based upon trie need for increased safetv for the Clvmcic
Games and the necessity for increased information sharing with cur
law enforcement partners, senior FBI management personnel concluded
that due to the substantial 'risk imposed upon the 20C2 V3inter Olympic
Games that each field division''-.would search their files to compile a
list of subjects from the Counte'rterrorisTn orogram who could oose a
threat to the Olympic Games. Therefore, all field offices are
directed to^immediately compile ~ list of all Coun.terterrorism
Program subjects from ooen Domestic Terrorism and International
Terrorism cases (Preliminary Inquiries and Full, Investigations''. All
assigned personnel are to immediately access and_retrieve the names,
dates of birth, social security numbers and- othe.r relevant
unclassified identifying information, such as-, descriptive data
(height, weight, eye _colorT hair color, etc.) , .miscellaneous numbers
(passport numbers, etc.), operator license niimberSj and vehicle
i.nf orm.at.ion, of ALL investigative classifications for Domestic_and
\l Terrorism, including cases concerning \____ "1
•/ "~1 and then, task vour NCIC operators
to load all names and identifying information into the NCIC VGTOF
file by CO 3 February 1, 2002. Additional information concerning
details for entry into the VGTOF can be found in the NCIC Operating
, VGTOF Chapter.

Not all states have the capability to enter records into


the VGTOF. The field divisions in the following states, due to a
lack of programming for this function in those respective states,
must submit their record entry requests with a cover EC and a
completed FD-930 for each individual er.trv, assicninq the ac-cronriate
Terrorist Organization Classification {outlined on page 3 of this
-v= r T- c r^-'i =; van . ?rocr=ms

9/11 Law Enforcement Privacy

Req 13-6
000000017
11 Law Enforcement Sensitive

. • • • • — „__-,
~ H"" 3 r ~ ii ~ CHCdC'Z-— "-' —C •^.._—_
"•!_" LTi-^^'d di."z^si,o"*™ £.v"-- — c '.T.= .^j ~^,o 3'c.i^r*1.LI

•5 n "H 2T V 2T £ C U S S "C .

who ha-
ini orrn.5L.ion intio
-'^^•-- the NCIC VGTOr file must use ^he following Terrcrist
Organi:=~ion Clsssificarions and corresponding codes prior LO
entering individual subjecr inf orms-ion. For Dcmesric Terrcrisrr.
subjecLs, -he Terrorist Organicerion

The following information v.'ill be programmed within the


NCIC VGTOF as directions to state and local law enforcement officers:

"WARNING - APPROACH WITH CAUTION. HOWEVER, MAKE NO EFFORT


TO ARREST INDIVIDUAL UNLESS THERE IS EVIDENCE OF A
VIOLATION OF FEDERAL, STATE, OR LOCAL STATUTE(S). ONCE AN
INDIVIDUAL IS IDENTIFIED WITHIN THIS SYSTEM, CONDUCT ALL
LOGICAL INVESTIGATION UTILIZING TECHNIQUES AUTHORIZED IN
YOUR JURISDICTION. DO NOT ALERT THE INDIVIDUAL TO THE
FBI'S INTEREST AND CONTACT YOUR LOCAL FBI FIELD OFFICE AT
T'-'-" TI.^".7TCT f~lCDriP'T';'H,: T T V "

:v a.

Req 13-6 000000018


Vll Law Enforcement Sensitive

oa^Cuiar^ub^crof'i^omes^ror ^^^^^^fb, , ^, of

iUL.Ui.= -~- -• "• "".",' ^.•jr^'' -- r n^.-ia^ain discussed at tne S.H>^

iSS IgDlLSl-lisS'SS,,
information, .o .ncluae p.^m- ii\ ^-,^v = d in HCIC ii.s.
and numeric identiriers capable o. a^_^y --" ^ 5Ociai security

. I »t«i o'r local law enforced, officer can


during Che course of a field interview.

^S^??4ii?rShatiUandi?ocar!ari^-"-^^^^

and t
an trackin
r a c i n g - W - ^ - . —- _ " _ „ an
0*--,~*
^a^Bon should coordinate wirh .h = _r =t = -= an
-ar.ners to ensure consistent application
en^rcem
rhe system

i, c 000000019
Req 13-6
LEAD (s):

Set Lead 1:

RECEIVING OFFICES

Immediately assign personnel to access and retrieve the


all identifying information of ALL investigative •••
classifications for domestic and international terrorism, including
cases concerning any diplomats from state sponsors of terrorism and
then zash your NCIC operators to load all names and identifying
information into the NCIC VGTOF system by COB February 1, 2002.

Req 13-6
000000020

You might also like