NAVAL

POSTGRADUATE
SCHOOL
MONTEREY, CALIFORNIA

DA 4610
Final Project

Hamburg Network Analysis Over Time

By

MAJ Ian Davis

MAJ Carrie Worth

1
 OVERVIEW

The Hamburg Network was a group of 24 radical Islamists operating in

five cells and responsible for the 9/11 terrorist attacks. The origins of the network
lay with a study group at al-Quds Mosque in Hamburg, led by Mohammad
Belfas.1 The group originally consisted of Mohamed Atta, Mounir Motassadeq,
and Abdelghani Mzoudi who were all studying at the Technical University of
Hamburg-Harburg (TUHH). Over time, the study group grew to include Ramzi
bin al-Shibh, Said Bahaji, Zaid Amir Jarrah, Zakarya Essabar and Marwan al-
Shehhi. The actual “Hamburg Cell”2 began out of this study group when
Mohammed Atta, Ramzi bin al-Shibh, and Said Bahaji moved into an apartment
together on 53 Marienstrasse, which they named “Bait al-Ansar” or “the House of
the Supporters (of the Prophet)”. It was there that the three held meetings to
discuss their anti-American and anti-Israeli views and began trying to find ways
to further their cause.3 With all eight associated through the study group led by
Belfas and their increased social interaction through school, meetings, and
weddings, their discussions grew more “virulent” and ultimately led to the friends
looking to join the jihad and go to Chechnya to fight the Russians. It was not until
they met Mohamadou Ould Slahi that they were encouraged to travel to
Afghanistan for training.4

Prior to and completely independent of the forming of the Hamburg

Network, the plan for the “planes operation” was developing in the mind of Khalid
Sheikh Mohammed (KSM). “Equally comfortable in a government office or a
terrorist safehouse”, Khalid Sheikh Mohammed used his imaginative mind along

1 Marc Sageman, Understanding Terror Networks, Philadelphia: University of

Philadelphia Press, 2004, 103-104.
2 The individuals that met in the study group in Hamburg are widely known as the
Hamburg Cell. This paper will use the 9/11 commission report identifying them as the Hamburg
Contingent who became the larger Hamburg Network. See National Commission on Terrorist
Attacks Upon the United States, The 9/11 Commission Report,
http://www.gpoaccess.gov/911/index.html (accessed on November 17, 2010).
3 Sageman, Understanding Terror Networks, 105.
4 Sageman, Understanding Terror Networks, 106.
2
with technical and managerial skills to develop plans for a variety of terrorist
acts.5 KSM knew that his plan for using airplanes in a terrorist attack on the
United States required personnel, money, and logistical support that he did not
have, but Usama bin Ladin did. Although KSM had previously fought alongside
Usama bin Ladin in 1987, they did not have a “close working relationship”. But
Sheikh Mohammed knew he had to meet with bin Ladin because of he could
provided the personnel, money, and logistical support required. Mohammed met
with bin Ladin in mid 1996, but the two did not formally reach a deal to begin the
final planning until late 1998. Sheikh Mohammed formally joined Usama bin
Ladin and al-Qa’ida in 1998 after being given the green light for his “planes
operation.”6

With the arrival of the first three members of the Hamburg Network in
Afghanistan, Usama bin Ladin was about to find the perfect group to lead the
attack: the members of the Hamburg Network spoke fluent English, were
educated and knowledgeable of the western lifestyle, and were radical Islamists.
In November of 1999, Mohamed Atta and his Hamburg Network were selected
for the 9/11 operation.7

5 National Commission on Terrorist Attacks Upon the United States, “Al-Qa’ida Aims At
The American Homeland”, http://www.9-11commission.gov/report/911Report_Ch5.htm (accessed
on August 30, 2010).
6 Khalid Sheikh Mohammed did not join Usama bin Ladin and Al-Qa’ida when originally
invited in 1996 because he wanted to remain independent. This allowed him to remain free to
work with other organizations, such as the mujahideen led by Sayyaf, Sheikh Mohammed’s
mentor, who was loyal to Massoud, the leader of the Northern Alliance. Since bin Ladin was
forging ties with the Taliban, the opposition of the Northern Alliance, allying with Al-Qa’ida would
have proven troublesome for Sheikh Mohammed. See National Commission on Terrorist Attacks
Upon the United States, “Al-Qa’ida Aims At The American Homeland”, http://www.9-
11commission.gov/report/911Report_Ch5.htm (accessed on August 30, 2010).
7 Sageman, Understanding Terror Networks, 106-107.
3
 Figure 1 Photos of 911 Hijackers8

Background and Purpose of Our Study

Networks are dynamic. This paper focuses on Dynamic Network Analysis

and Geospatial measures over time. Our objective is to employ Dynamic
Network Analysis in order to identify the timeline in which the Hamburg Network
became viable to carry out its purpose and also to highlight potential areas of
vulnerability within the network. The specific question we intend to answer is: at
what point in time did the network have the capacity to attack the World Trade
Center? This study assumes that the minimum criteria for mission
accomplishment was the network required 2 aircraft, each with one simulator
trained commercial pilot and 3 additional personnel for security. Using the ORA
Dynamic Network Analysis software package, we analyze the Hamburg Network
over time to determine when the network met the minimum criteria to conduct the
“Planes Operation.”

Focus of our Study

8 Source: https://www.cia.gov/news-information/speeches-
testimony/2002/DCI_18_June_testimony_new.pdf.
4
 For the purpose of this study, our initial data set for the Hamburg Meta
Network consists of 45 agents. This data was derived using open source data
from both U.S. Government reports and academic research on the 911 attacks.9

Figure 2 Hamburg Network Initial Data

From the above data, we narrowed our focus down to the primary agent in
the 9/11 attacks consisting of 24 actors configured into five cells. Four of the
cells were comprised of the 19 hijackers and the remaining fifth cell was the

9 Primary sources used to generate data was: National Commission on Terrorist Attacks
Upon the United States, “Al-Qa’ida Aims At The American Homeland, ” Vladis E. Krebs,
“Mapping Networks of Terrorist Cells,” Connections: 2001, Vol 23, 43-52, and Prosecution
Exhibits from United States v. Zacarias Moussaoui, Criminal No. 01-455-A, available at
http://www.vaed.uscourts.gov/notablecases/moussaoui/exhibits/prosecution.html.
5
active support component located in Hamburg.

Figure 3 Hamburg Network Agents and Locations

The legend for Figure 3 is as follows:

Color Target/Flight
Pink WTC North Tower (AA Flight 11)
Blue WTC South Tower (UA Flight 175)
Green Pentagon (AA Flight 77)
6
 Teal Capitol (UA Flight 93)
Red Hamburg Cell (Hamburg, Germany)
Yellow Target Name
Table 1. Color Legend

The following table illustrates the agent, the target he was associated with,
and his primary task:

Name Target Primary Task

Abdul Aziz Al-Omari* WTC N Tower Security
Ahmed Al Haznawi Capitol Security
Ahmed Alghamdi WTC S Tower Security
Ahmed Alnami Capitol Security
Fayez Ahmed WTC S Tower Security
Hamza Alghamdi WTC S Tower Security
Hani Hanjour Pentagon Pilot
Khalid Al-Mihdhar Pentagon Security
Majed Moqed Pentagon Security
Marwan Al-Shehhi WTC S Tower Pilot
Mohamed Atta WTC N Tower Pilot
Mohand Alshehri* WTC S Tower Security
Nawaf Alhazmi Pentagon Security
Saeed Alghamdi* Capitol Security
Salem Alhazmi* Pentagon Security
Satam Suqami WTC N Tower Security
Wail Alshehri WTC N Tower Security
Waleed Alshehri WTC N Tower Security
Ziad Jarrah Capitol Pilot

7
 Table 2. Agent, Target, and Primary Task

Figure 4 Planes Operation Locations (Hamburg not Shown)

Relationships

The first relationship, agent to target, was selected because it provided a

clear and defining method for dividing the Hamburg Network into its five cells.
Additionally, the question we want to answer on network viability is based on
being able to strike the two World Trade Center (WTC) towers. By identifying
agent to target, we are able to identify the point in time the network was able to
strike those two targets. The second relationship, agent to primary task, was
selected because it identifies role played by each Hamburg Network member. In
order to have a viable network to strike the two WTC towers, a simulator trained
pilot and three additional members were needed per aircraft (i.e. 1 pilot and 2
security).

Finally, the two relationships were examined by utilizing ORA to first draw
the network and then analyze it based on established time periods from 3 Sep 91
to 11 Sep 01. We have also provided screenshots from geospatial analysis
performed with the same dataset.

Analysis Over Time

8
 We utilized ORA to analyze the Hamburg Network over time. For this
study, we used 13 distinct time intervals based on arrival of agents into the
United States.

Time Period Inclusive Dates

1 3 Sep 91 – 27 Apr 99
2 28 Apr 99 – 28 May 00
3 29 May 00 – 2 Jun 00
4 3 Jun 00 – 26 Jun 00
5 27 Jun 00 – 7 Dec 00
6 8 Dec 00 – 22 Apr 01
7 23 Apr 01 – 1 May 01
8 2 May 01 – 27 May 01
9 28 May 01 – 7 Jun 01
10 8 Jun 01 – 26 Jun 01
11 27 Jun 01 – 28 Jun 01
12 29 Jun 01 – 3 Jul 01
13 4 Jul 01 – 11 Sep 01
Table 3. Definitions of Time Periods

9
Figure 5 Hamburg Network at Time Period 1

10
 In time period 1, Hani Hanjour arrives in New York from Saudi Arabia. He
proceeded to Tucson where he took English language classes at the University
of Arizona and set up a safe house in Tucson. He visits Darul Masjid who is
living in Hollywood FL. By April 15, 1999 Hanjour has his Commercial Pilot
Certificate (obtained from Arizona Aviation). Also in the Spring of 1999, the
“Hamburg Cell” forms at the Dar el Ansar Safe House (Marienstrasse 54) in
Hamburg, Germany. This is shown above with the two distinct groups: (1) Hani
Hanjour and his ties to the schools and safe houses he establishes in Arizona as
well as the locations of his English language and flight training in Arizona and
California; (2) the Hamburg Cell in Hamburg, Germany. At this point in time, the
two “cells” are completely separate and unknown to each other.

Figure 6 Hamburg Network Time Period 2

In time period 2, Hanjour leaves the United States from JFK airport to
Amman, Jordan. He is believed to be in Saudi Arabia. Al-Midhar and Al-Hamzi
11
arrive in the United States and set up residence in San Diego, CA. They each
take flight lessons at the Sorbi Flying Club but do not obtain licenses. The
“Hamburg Cell” is still being educated and radicalized in Hamburg, Germany.

Figure 7 Hamburg Network Time Period 3

In time period 3, Al-Shehhi arrives in Newark, NJ where he takes English

language classes. He remains tied to the Hamburg Cell. Al-Midhar and Al-
Hamzi set-up a safe house in Lemon Grove, CA.

12
 Figure 8 Hamburg Network Time Period 4

Time period 4 brings Mohammed Atta to New Jersey where he activates a

cell phone listing 1950 Goddard Ave in Norman, OK as his address. This is the
address of the Airman Flight School. Atta and Al-Shehhi rent a car with a
Brooklyn, NY address listed.

13
 Figure 9 Hamburg Network Time Period 5

The network is beginning to branch out further in Time period 5. Ziad

Zarrah arrives in Atlanta and arranges flight training at the Florida Flight Training
Center in Venice, FL. Atta and Al-Shehhi check-in to a Norman, OK hotel and
they enroll at Huffman Aviation which is in Venice, FL. Meanwhile, Jarrah takes
up residence in Venice, FL. Although they are in Oklahoma, he and al-Shehhi
also begin residence in Venice, FL. On 9/18/2000, Atta and al-Shehhi receive
their Private Pilots License from Huffman Aviation and enroll in training at Jones
Aviation (Sarasota, FL). They eventually take a test for their instrument rating
with Huffman Aviation. At this point (not including the Commercial Pilot rated
Hanjour) the Network has two trained pilots and 3 additional personnel residing in
the United States.

14
 Figure 10 Hamburg Network Time Period 6

Time period 6 brings Hanjour back to the United States. Atta and Al-
Shehhi obtain their Commercial Pilot rating and begin simulator training in Opa-
Locka, FL. Meanwhile, Ziad Jarrah completes 737 simulator training in Miami,
FL. With Hanjour and Jarrah simulator trained pilots and Atta, al-Shehhi, al-
Mihdar, al-Hamzi also residing in the United States, the network is nearly viable.
All the the members currently in the United States continue to change addresses,
obtain flight training (to include flying the “Hudson Tour” in New York), and make
phone calls (presumably to coordinate), and obtain documents such as drivers
licenses. At this point, they could conduct the planes operation, but the lack of
security personnel is noted.

15
 Figure 11 Hamburg Network Time Period 7

Time period 7 brings al-Shehri and al-Suqami to Orlando, FL where they

move into a safe house. This marks the presence of enough Hamburg Network
personnel in the United States to conduct the operation as presented in our
research question. However, there is no indication that they personnel are
coordinated to do so at this point. It is proposed that a covert network sacrifices
efficiency for security.10 This applies to the Hamburg Network.

10 McCormick, G. H., and G. Owen. "Security and Coordination in a Clandestine

Organization." Mathematical and Computer Modeling, no. 31 (2000): 175-192.

16
 Figure 12 Hamburg Network Time Period 8

In time period 8, al-Ghamdi and Moqed arrive in Washington, D.C.

Hanjour, al-Hamzi, Moqed, and al-Ghamdi check into the Fairfield Inn in Fairfield,
CT. They eventually move to a safe house in Paterson, NJ.

17
 Figure 13 Hamburg Network Time Period 9

With time period 9 and the arrival of al-Nami, al-Shehri, and al-Ghamdi in
Miami, the network now appears to be coming together for the planes operation.
Hanjour flies the “Hudson Tour” and the others continue their tradecraft by
opening mailboxes and joining gyms (presumably, non-attention getting meeting
locations).

18
 Figure 14 Hamburg Network Time Period 10

In time period 10, al-Haznawi and al-Sheri enter the United States (Miami,
FL). Members of the network open bank accounts and continue to move around
to various safe houses.

19
 Figure 15 Hamburg Network Time Period 11

Time period 11 starts the network move to the area to begin the planes
operation. These moves are not direct (used safe houses around United States).

20
 Figure 16 Hamburg Network Time Period 12

In time period 12, the individual cells within the Hamburg Network
continue to move. Atta even heads to Las Vegas and stets the conditions for a
clandestine meeting with Hanjour and Nawaf. The visualization above shows the
distinct networks (the four based on target) have not yet solidified. Only
Hamburg, the active support cell, remains central.

21
 Figure 17 Hamburg Network Time Period 13

Finally, in time period 13, the network has separated into 5 distinct cells,
each with their target and roles. Although the network was viable in time period 7
(with the minimum personnel in the United States trained and capable of
performing the operation) the network was not coordinated for the attack until
time period 13.

22
Figure 18 Geospatial Time Period 13 – Hamburg not shown (Google Earth)
As you can see by examining the network visualized in ORA over the 13
time intervals, the Hamburg Network grows and becomes more organized and
tied together over time. By time interval 7 it has the basic requirements to be
viable and strike the WTC towers. By time interval 13, the network has reached
its maximum potential and becomes capable of making an attempt on all four
targets. By examining the last time interval visualization, you can see that not all
members of each cell are aware of or known to each other. This high degree of
compartmentalization allows for the secure coordination of work by ensuring that
the kill or capture of one member cannot take out the entire network nor
compromise its plan.

Conclusion:

The analysis of the Hamburg Network over time provides more than
network growth and geospatial disposition, it also highlights the key points in time
where the network had the operational capacity to conduct the planes operation.
Based on our given criteria, the analysis shows that the Hamburg Network had
the capacity to attack the World Trade Center with two aircraft by time period 7.

23
If the attacks were executed during that time period (Time Period X), the
operational cells may have used the following configuration:

• WTC North Tower: Mohammed Atta (pilot); Ziad Jarrah (alternate

pilot/security); Satam Suqami (security); and Waleed Alsheri (security).

• WTC South Tower: Marwan Al-Shehhi (Pilot); Hani Hanjour (alternate

pilot/security); Nawaf Alhamzi (security); and Khalid Al-Mihdar (security).

Figure 19 Hamburg Network Time Period “X”

Key to the success of the operation was the proper training of the pilots.
Without the proper training, the hijackers would not have been able to hit their
intended targets because of the level of technical difficulty associated with
delivering a commercial aircraft to a pinpoint location. While the addition of other
hijackers after time period 7 increased the magnitude of the 911 attacks, it
actually increased the chance of compromise of illumination. While it is unlikely
24
that the removal of the Atta and the other pilots would have prevented the attacks
from ever occurring, tougher scrutany of the hijackers’ indicators of clandestine
and covert behavior—such as multiple addresses, mail boxes, pre-paid cellular
phones, etc.—could have set the conditions to force the terrorists to abort the
operation due to increased hostiliy of the environment.

25
 BIBLIOGRAPHY
McCormick, G. H., and G. Owen. "Security and Coordination in a Clandestine
Organization." Mathematical and Computer Modeling, no. 31 (2000): 175-
192.
National Commission on Terrorist Attacks Upon the United States. The 9/11
Commission Report, http://www.gpoaccess.gov/911/index.html (accessed
on November 17, 2010).
Prosecution Exhibits from United States v. Zacarias Moussaoui, Criminal No. 01-
455-A, available at
http://www.vaed.uscourts.gov/notablecases/moussaoui/exhibits/procecutio
n.html accessed on November 11, 2010).
Sageman, Marc. Understanding Terror Networks, Philadelphia: University of
Philadelphia Press, 2004, 103-104.
Valdis E. “Mapping Networks of Terrorist Cells,” Connections: 2001, Vol 23, 43-
52.

26