The cable was correctly formatted. That is the part that has never been explained.
Doug Miller was an FBI agent on secondment to Alec Station, the unit the Central Intelligence Agency had built to track Osama bin Laden. In the first week of January 2000 he drafted a Central Intelligence Report, the standard instrument for passing Agency information to the Bureau. It recorded that a man the Agency had just watched at a meeting in Kuala Lumpur held a valid multiple-entry United States visa, and that his travelling companion had flown to Los Angeles.
A CIA desk officer read the draft and typed one line onto it. Pls hold off on CIR for now per a named Deputy Chief of the Bin Laden Unit.
Miller wrote back the same week. Is this a no go or should I remake it in some way.
The Justice Department's Inspector General went looking for the answer to that message four years later, with the authority to compel it. There was no answer in the system. Not a refusal, not an instruction, not a revised draft.
The cable was never sent. It survives for that reason, because an unsent document stays in the drafting system while a transmitted one disperses into the receiving one. Everything about the act is preserved: the visa, the flight, the formatting, the hold, the name of the officer it was placed on behalf of, the unanswered question. What is not preserved, and what the Inspector General concluded he could not establish, is why.
He wrote that the failure to send was significant and that he was unable to determine its cause. The Agency's own Inspector General found that somewhere between fifty and sixty individuals had read at least one cable about the two men without acting, and characterised this as a systemic breakdown rather than a decision. Every relevant witness, including the officer who placed the hold, told both investigations they had no recollection.
Twenty months later the two men boarded American Airlines Flight 77.
Twenty-Five Years of Releases, in Order
An extraordinary amount of what investigators, journalists and litigants sought has since been produced.
In 2004 the Commission published a report whose narrative runs to 428 pages and whose notes end at page 567. In 2005 the Agency's Inspector General completed an accountability review naming officers whose conduct he believed warranted examination. In 2006, under subpoena and against the resistance of the department holding them, the multi-channel audiotapes of the Northeast Air Defense Sector were released, and they contradicted the military's own published account of the morning. In 2016, after thirteen years of campaigning by a former chairman of the Senate Intelligence Committee, the twenty-eight withheld pages of the Congressional Joint Inquiry were declassified. In 2021 and 2022, under an executive order, the Federal Bureau of Investigation released internal product from Operation Encore, the Saudi-network investigation it opened in 2007 and closed without charges. In November 2022 an interagency panel declassified the memorandum of the joint interview with the President and Vice President, eighteen years after it was written. In 2024 a videotape seized by British police in Birmingham ten days after the attacks was unsealed in civil litigation, twenty-three years after the Bureau took possession of it.
Each of those releases added facts. The visa was known. The cable was drafted. The hold was placed. The tapes establish what the sector knew and when. The twenty-eight pages name individuals. The videotape shows a man narrating security positions at the United States Capitol in 1999.
What almost none of them added was a recorded reason.
This is not a complaint about redaction. The twenty-eight pages came out with their contents largely intact, and the Joint Inquiry had already written on their face that the material was unverified lead reporting rather than finding. The memorandum held for eighteen years contained nothing that appears to have warranted the classification. The declassification worked. It told us, with increasing precision, what was done.
The 9/11 archive is one of the largest sustained experiments anyone has run in whether disclosure can settle a question of purpose, and it has been running for a quarter of a century.
The Two Registers
Modern institutions generate records of what they do. Fewer generate records of why, and the ones that do were required to.
The first record fills by itself. Acts generate paper as a byproduct of being performed: a cable is drafted and the draft exists, a hold is placed and the annotation exists, a watchlist entry is made or not made and the database logs both states. Nobody decides to keep this record. It accumulates as a condition of the work being done at all.
The second record fills only under a condition. It fills where a rule, an office, an external authority, or occasionally an accident requires that a reason be produced as an output rather than left as a private state. Where that condition holds, reasons survive in quantity and in detail. Where it does not, they survive by chance or they do not survive.
The consequence is a specific and durable asymmetry. An official acts. The act generates a document, because procedure requires one. Nothing requires him to record what he believed he was protecting, and the form he is completing has fields for what, when, under which authority, and none for why. The reason stays in the room. The room empties. An investigator arrives years later with clearance and subpoena power and finds the act preserved in detail and the reason nowhere. That is not necessarily concealment. A filing convention will produce the same result, and it will produce it whether or not anyone intended it.
Two materially different explanations of the same episode can then remain compatible with the complete record. A cable withheld out of institutional habit and a cable withheld to protect something undisclosed leave the same trace: a one-line annotation and a message nobody answered.
The record holds the act. Whether it holds the reason depends on whether anyone, at the time, was obliged to produce one.
Fifty to Sixty Officers, and No Recorded Reason
The Alec Station episode is the strongest place to test this, because it is the one item where the alternative to ordinary institutional failure was taken seriously by trained investigators with full access.
Consider what the documents establish. The hold was placed on a report already drafted in the correct format by the correct person, so the mechanism worked and was then stopped. The follow-up message received no recorded response. A cable of the same period stated that al-Mihdhar's travel documents had been passed to the Bureau for further investigation, and the Justice Department's Inspector General could find no other document and no witness corroborating that they ever were, including the cable's own author, who had no recollection of who told her. The information gap held for some nineteen months, through a further identification in January 2001 and through a meeting in New York in June 2001 at which Agency representatives showed Bureau agents surveillance photographs from Kuala Lumpur without providing the identifying data attached to the faces. When the Agency's Inspector General recommended an accountability board, Porter Goss, by then Director of the Central Intelligence Agency, announced on 5 October 2005 that he would not convene one to judge the performance of any individual officer. Nobody was disciplined.
A transmission was stopped. A cable asserted that a transmission had occurred, and no corroboration for that assertion has been found. The institution then declined to examine the officers its own inspector had named.
Note what the documents do not establish. There is no recorded instruction, no memorandum of a decision, no operational file on either man predating the hold that has been produced, no contemporaneous note beyond the eleven words on the draft. Two officers who were present have since described in public, consistently, being told verbally that the matter was not one for the Bureau, and a former counterterrorism official has said he heard the account at the time. That testimony is real and it is the nearest thing to a reason that exists. It is also unsworn, never tested in cross-examination, and uncontradicted mainly because those who could contradict it have stated they remember nothing.
I do not know whether the hold was protective, territorial, or something else, and having worked through what both Inspectors General produced, I no longer expect that question to be settled from documents.
The record of what was done here is unusually complete. The record of why is as thin as it is everywhere else, and twenty-five years of declassification has not changed that.
The NEADS Tapes Settle the Acts and Nothing Else
The obvious objection is that this reflects one agency's thin paper. The air defence record disposes of it, because there the room was recorded.
For almost three years the military's account was that the Federal Aviation Administration had notified it of American 77 at 9:24 and of United 93 at 9:16, and that fighters had been positioned accordingly. Officers testified to this publicly in May 2003. The Commission then obtained the sector's own multi-channel tapes. Its Staff Statement is unusually blunt: of the 9:16 notification, This statement was incorrect. There was no hijack to report at 9:16. United 93 was proceeding normally at that time. Of the 9:24 notification, This statement was also incorrect. The 9:24 entry in the sector's log carried the tail number of American 11, an aircraft that had struck the North Tower forty-seven minutes earlier.
The corrected record is worse for the institution than the version it had published. The sector was never told American 77 had been hijacked at all; it learned the aircraft was missing at 9:34, by chance, from a Washington Center manager who volunteered it. It learned of United 93 at 10:07, four minutes after the crash. The scramble from Langley, ordered at 9:23 and airborne at 9:30, was a response to a report that American 11 was still flying toward Washington. The fighters flew east over the Atlantic because the order carried no distance or location, because a generic flight plan indicated 090 for sixty miles, and because the lead pilot and the local controller took that as superseding guidance. When engagement authority eventually reached the sector, the commander did not pass it down, and the only instruction conveyed to the Langley pilots in that window was to identify type and tail number.
Then the Commission turned to why officers had testified for three years to something untrue, and the machinery slowed.
It considered a criminal referral and instead referred the matter to the two departments' own Inspectors General. The Transportation Department's found no evidence that officials had knowingly made false statements or intentionally failed to correct them, regarding aviation notifications to the Defense Department, and attributed the errors to chronology documents created on 17 and 18 September 2001. The Defense Department's report of 27 May 2005 found that the department had not accurately reported to the Commission, attributed that to forensic and record-keeping deficiencies, conceded that those deficiencies had contributed to the impression that information was knowingly presented inaccurately, and expressly deferred the question of intent to a joint report with its counterpart.
So a recording existed, the acts were settled beyond argument, and the question of purpose resolved into a referral and a deferral. Recording the room populates the first register with great precision. It does not populate the second.
Cambone Wrote a Reason Down at 2:40 That Afternoon
There is a place in this record where the second register filled, and both when it filled and what it says are instructive.
At 2:40 on the afternoon of 11 September 2001, Stephen Cambone was taking notes of the Secretary of Defense's direction to his staff. The page, released to the National Security Archive, carries redactions and fragmentary lines. In the rendering CBS News published in 2002: Judge whether good enough hit S.H. @ same time. Not only UBL. Further down: Go massive. Sweep it all up. Things related and not. S.H. is Saddam Hussein. UBL is Usama bin Laden. The towers had been down for under five hours.
That is a purpose, recorded contemporaneously, by an aide in the room. It supports the distinction rather than undermining it. Nobody present at 2:40 that afternoon had yet understood that the page would ever be read as evidence of anything. Contemporaneous reasons survive disproportionately in two circumstances: where an institution has been made to produce them as an output, and where they were captured by accident before their future evidentiary significance became apparent. Cambone's page is the second kind. It is not evidence that reasons are routinely recorded. It is evidence that they can be, and of how narrow the window usually is.
What the page records is also not what a causation hypothesis needs. The following evening the President asked his counterterrorism coordinator to look for an Iraqi link, an account the Commission published and which the President disputed only in its particulars. Ten months later the head of the British Secret Intelligence Service reported from Washington that military action was now seen as inevitable and that the intelligence and facts were being fixed around the policy. That is a documented record of an administration reaching for an objective that was already on the shelf: regime change in Iraq had been American statute since 31 October 1998, passed in the House by 360 votes to 38 and in the Senate without objection, and it authorised no use of force.
Then there is the number that does the most work. Gallup asked, between 19 and 21 February 2001, whether respondents would favour or oppose invading Iraq with United States ground troops in an attempt to remove Saddam Hussein from power. Fifty-two per cent were in favour and forty-two per cent opposed, seven months before the attacks. On 7 October 2001, ninety per cent approved of the strikes on Afghanistan.
The clearest contemporaneous record of purpose examined here documents the exploitation of the event, and the polling shows that the consent such a hypothesis says had to be manufactured was already present and already measured. That does not disprove a causation hypothesis. It removes one of the principal explanatory tasks such a hypothesis is usually asked to perform, which is a narrower claim and a more durable one.
The Birmingham Material, and the Chain After the Record
The Two Registers describe what gets written down. A second mechanism governs what happens to a record after it exists, and the Saudi material is where it shows.
Ten days after the attacks, police in Birmingham searched a flat and seized the belongings of Omar al-Bayoumi, a Saudi national employed on paper by an aviation contractor, who in January 2000 had met the two Kuala Lumpur travellers in a Los Angeles restaurant, found them an apartment in San Diego, co-signed their lease and advanced their deposit. Among the material were a videotape he had made at the United States Capitol in 1999, narrating entrances, security posts and the proximity of the airport, and a notebook containing a drawing of an aircraft with equations beside it.
A Bureau report of 11 October 2001 records that a complete copy of the seized material was sent to the New York field office. San Diego, where Bayoumi and two of the hijackers had lived, received a fraction: a San Diego memorandum of 15 May 2002 records agents being asked to review five of more than eighty videotapes, and finding nothing of significant investigative value. According to CBS News, the Capitol video was not among what San Diego received. The tape was unsealed in 2024, in civil litigation. In May 2025 two senators, Richard Blumenthal and John Cornyn, wrote to the Bureau asking why the material had not been made available to the Commission or to the Agency at the time.
So the chain has more links than the writing of a record. An event is observed. The observation is recorded. The record is transmitted, or not. What is transmitted is retrieved, or not. What is retrieved is interpreted, or not. And an interpretation leads to accountability, or does not. A failure at any link produces the same visible outcome as a failure at any other, and a documented fact can effectively disappear without anyone having removed it.
A record that fills automatically is not the same as a record that is read, and an archive nobody opens performs like an archive that does not exist.
The Commission's finding that the San Diego encounter may have been chance was reasonable on the material before it. It did not have this material. That is not an indictment of the Commission. It is a demonstration that the negative findings of any inquiry are worth what its access was worth, and that access is a variable nobody can assess at the moment the finding is written.
Why Disclosure Can Widen the Gap
The conventional expectation is that disclosure closes questions. More documents, less suspicion. This record suggests a more specific and less comfortable relationship.
If a disclosure programme adds documented acts faster than it adds explanations for those acts, the ratio of known anomalies to resolved purposes rises. Transparency then reduces factual uncertainty and increases interpretive uncertainty at the same time. That is not a universal law of disclosure. It is what happens when the material being released is predominantly of the first kind, which is what most institutional material is.
The 2016 release of the twenty-eight pages is the clean case. It produced names, contacts and payments in San Diego and Los Angeles that the Joint Inquiry had itself labelled unverified lead material. It did not produce a finding, because the section had never been one. What it produced in public was a durable conviction that a finding had been suppressed. The 2024 unsealing of a videotape of a Saudi government employee narrating Capitol security positions did the same at larger scale. The tape is real and its provenance is documented. It can be read as reconnaissance or as a recording made for some other purpose, and nothing in it or attached to it records which.
It would be easier to write that the reasons were removed. Removal is a story with a person in it, and people can be subpoenaed. In much of the surviving record, there is no indication that the reason was ever written down. That is a harder condition than removal, because an excision leaves a shape and something never written leaves nothing.
An inquiry that promises to establish purpose while its material is overwhelmingly a record of acts will tend to generate the suspicion it was convened to dispel.
What a Thin Second Register Is Worth
Treating this as a melancholy fact about bureaucracy would be the mistake that lets the argument read as an acquittal.
Negligence is expensive. It costs a reorganisation, a set of resignations, a line of legislation. Congress passed the National Construction Safety Team Act on 1 October 2002 because the assessment team examining the World Trade Center had no power to impound evidence and no right of access, and steel was disposed of before any body with that authority existed. In the Intelligence Reform and Terrorism Prevention Act of 17 December 2004 it layered a Director of National Intelligence, a National Counterterrorism Center and a mandated information-sharing environment over the existing agencies, merging none of them. The costs were real and the institutions paid them.
Purpose is a different order of expense. Purpose is prosecutable. It ends careers rather than reassigning them and converts an administrative failure into a criminal question with individual defendants. The distance between an officer who blocked a cable out of institutional habit and an officer who blocked it to protect something undisclosed is the distance between a reorganisation and an indictment.
And the record that would distinguish them is the one that fills only when somebody insists.
No institution needs to conspire to benefit from this. It needs only to document procedure closely and purpose not at all. The protection is free, automatic and indistinguishable from ordinary administrative practice, which makes it more durable than concealment could be.
Then consider the behaviour that clusters around the thin register, all of it documented and none of it establishing a purpose. A joint interview with the President and Vice President, not under oath, not recorded, not transcribed, the only account written afterwards by the inquiry's own executive director and classified for eighteen years. Ninety-two videotapes of Agency interrogations destroyed on 9 November 2005, fifteen months after the Commission had closed, with Kean and Hamilton stating in January 2008 that the Agency had never disclosed the tapes existed despite requests for interrogation material, and the Agency replying that it had not been asked for tapes specifically and had deliberately preserved them while the Commission was sitting. Sworn public testimony from a cabinet secretary omitted from the narrative without a published explanation. Sixty-eight thousand five hundred files of structural model input withheld under a public safety exemption, leaving a computational result that cannot be independently replicated.
Each item is an act. For each, the reason is either contested between interested parties or absent.
The Federal Reserve Was Made to Keep One
The obvious question is whether the second register is structurally impossible or merely unbuilt, and the answer is that it is largely unbuilt, which is a harder finding.
A court judgment is a reason-giving instrument by definition: a judge who decides without reasons has not produced a judgment, and an appellate system exists to read the reasons and test them. The Federal Open Market Committee is the sharper example, because it was made to. At its meeting of 16 November 1993 the Committee voted to release lightly edited transcripts of its meetings back to March 1976, and of subsequent meetings, after a lag of five years. It did so after Chairman Greenspan disclosed to the House Banking Committee on 19 October 1993 that verbatim transcripts had been retained since 1976. The Committee's own conference call of 15 October shows that most of its members had not known this. A previous chairman had told Congress in 1975 that such records were routinely disposed of.
So a register of reasons is buildable, and it survives contact with markets, lawyers and hostile readers. It is also, in that case, a thing an institution was pushed into by an outside party with the standing to insist.
No comparable reason-giving regime governs routine intelligence withholding decisions, for reasons built into the work itself. A unit obliged to record a justification for every report it declined to pass would face two options, and neither is the one reformers picture. It could stop declining, which would collapse the compartmentation that source protection depends on. Or it could produce a justification that sounds procedural and commits to nothing, which is what organisations subject to a reason-giving requirement they do not accept have generally done. The register would fill, and it would fill with prose.
The gap between what an institution did and what it meant is closable in principle and closed mainly where an outside party had both the standing and the appetite to insist. For an air defence sector, a station chief and a commission of inquiry, no such party has existed.
The Strongest Case Against This Reading
The strongest counterargument accepts every document above and reverses the inference. It runs like this. An organisation that consistently fails to generate records of its reasoning, destroys recordings it does make, classifies unremarkable memoranda for eighteen years, declines to convene the accountability board its own inspector recommends, and produces years of testimony erring in one direction is not exhibiting a property of filing systems. It is exhibiting a learned practice, refined because it works: institutions discover that records of reasoning create individual liability, and they stop creating them. Calling that structural is how a practice gets laundered into a law of nature.
That objection is serious, it is not answerable from the documents, and one of the Commission's own chairmen has said in public of the watchlisting failure that it was not careless oversight but purposeful. A chairman departing from his own report is not a small thing.
What can be said is narrower and it does not dispose of the objection. The reading offered here does not claim that no official ever chose to leave a reason unrecorded. That certainly happens and it is ordinary. It claims that the asymmetry precedes any such choice, and it offers a test: if the same pattern appears in institutions carrying no comparable liability, the structural explanation is supported without the strategic one being excluded. That test is passable and worth running. Until it is run, both mechanisms are live, and they are not alternatives. A strategic practice can exploit a structural condition it did not create, and the documentary outcome is identical either way.
The Toeslagenaffaire Reaches the Same Boundary
Two comparisons are worth making, because both had substantially complete documentary access and both stopped in the same place.
The Dutch childcare benefits scandal produced years of parliamentary investigation, a cabinet resignation, and a reconstructable record of what was done to tens of thousands of families: which files were flagged, which repayments were demanded, which appeals were refused, on what dates and by which offices. One of the central questions was how nationality and dual nationality had entered selection and risk processes, and whether the treatment that followed reflected individual intent or institutional practice. The answer arrived largely as a finding about institutional culture and about how selection rules had been applied, which is the form an answer takes when the acts are reconstructable and the purposes are not.
The Iraq weapons intelligence produced the same shape in Britain. Chilcot had extraordinary access and produced an exhaustive account of what was assessed, circulated and asserted. On purpose it concluded that the intelligence had not been challenged as it should have been, a statement about process standing where a statement about intention was wanted.
Neither case is equivalent to 9/11 in scale or in kind, and the comparison is not offered as equivalence. It is offered as a test of the same boundary, and both reach it.
Which suggests why the closing recommendation of an inquiry report tends to be addressed to the register that exists. It fixes procedure, because procedure is what the documents can be made to yield. The register that would show whether anyone intended the outcome stays thin, and the next inquiry begins in the same position.
What Was Never in the File
Doug Miller's cable is still there. Nothing about the act it records is missing: the format, the content, the visa, the destination, the hold, the name, the eleven words, the unanswered message, the twenty months.
It will not become anything more than that. The people who could have supplied what is absent were asked under the authority of two Inspectors General and said they did not remember, and no future declassification and no successful lawsuit can retrieve a reason that was never committed to paper. The file was complete in January 2000, in the sense that everything that was ever going to be written was written then.
There will be more releases. The litigation in New York will produce more, and the Agency's accountability review may yet emerge unredacted, and each will add names, dates, connections and acts. Some of them will be significant. None of them can supply what nobody wrote.
The uncomfortable finding is not that an answer was hidden. It is that a question can survive complete disclosure, indefinitely, when the evidence capable of settling it was never created, and that this condition is produced by ordinary administrative practice rather than by anyone deciding to produce it. Every actor in this has a designed position and a paper trail to occupy it. The question does not.
Evidence Map
Facts, interpretations, competing explanations, and what would break this.
Core claim. Institutional records document acts as an automatic consequence of procedure, and document reasons only where a rule, an office, an external authority or an accident requires reason-giving as an output. Where the second condition is absent, institutional failure and deliberate withholding can leave observationally similar records, which is why 9/11 disclosure has settled what was done with increasing precision while leaving purpose largely where it started.
Established facts. The Alec Station cable, the hold annotation and the unrecorded response are documented in the Justice Department Inspector General's review; the same review found no document and no witness corroborating the cable stating the travel documents had been passed to the Bureau. The fifty-to-sixty figure is the Agency Inspector General's; Porter Goss declined to convene an accountability board on 5 October 2005. The air defence corrections are in Staff Statement 17. The two Inspector General findings are Report CC-2006-085 of 31 August 2006 and the Defense Department report of 27 May 2005, the latter expressly deferring the question of intent. Cambone's notes are in National Security Archive Briefing Book 326. The Gallup figures are from a poll of 19 to 21 February 2001. The FOMC decision is that of 16 November 1993.
Interpretation. The two-register distinction is a structural reading argued from this case and from comparable inquiries. It is not the finding of any investigation.
Competing explanations. That the thinness of the reason record is a learned institutional practice rather than a structural property. This is not excluded here, and the two are compatible.
What would strengthen this. The same asymmetry documented in institutions carrying no comparable liability exposure.
What would weaken it. Evidence that reason-giving records exist in comparable agencies and were destroyed rather than never created.
What would falsify the structural claim. Evidence that institutions comparable to those examined here routinely create and preserve contemporaneous explanations for consequential decisions without being required to do so. That would undermine the proposed asymmetry between the automatic recording of acts and the conditional recording of reasons.
What would resolve the central case. A contemporaneous document establishing why the January 2000 report was held. That would settle the Miller episode without by itself invalidating the broader model.
Open documentary questions. The unredacted Agency Inspector General report and the January to March 2000 cable traffic. The 84 unreleased Pentagon-area videotapes. The Commission's Team 1A working files.
Watchlist. The Second Circuit ruling following argument on 7 October 2026 in the Saudi litigation, and whether it turns on documents or on inference.
