Daniel's been thinking about how investigations actually start — not the procedural version, but the real thing. He's asking about 9/11 specifically, and he's got three questions. First, how soon after a catastrophic terror attack do authorities actually begin investigating responsibility — not when they announce it, but when the work starts. Second, how do you balance the drive to find who did it against the need to prevent follow-on attacks when every single person is already overwhelmed? And third, how does the investigation itself change shape as investigators close in on the truth? The answer to all three turns out to be surprising, and it starts earlier than you'd think.
The investigation started before the second plane hit. That's not a metaphor — FBI field offices were activating evidence response teams within minutes of the first impact. There was no phone call from headquarters. No formal authorization. Just agents who saw what was happening on television and started moving.
So the investigation clock doesn't start when someone declares it open.
It starts the moment someone with training and authority recognizes what they're looking at. The North Tower was hit at 8:46 AM. By 9:03, when United 175 hit the South Tower, FBI agents in New York were already on the ground at the World Trade Center. Not in an organized way — they were just there, doing what they'd been trained to do. The formal case, PENTTBOM, wasn't opened until 10:45 AM. But that's a paperwork timestamp, not the real beginning.
PENTTBOM. Pentagon and Twin Towers bombings, that's the portmanteau.
Right. And by the time that case number was assigned, the investigation had already been running for nearly two hours. The reflex was faster than the bureaucracy. That's actually the first thing most people get wrong about catastrophic investigations — they imagine a switch flipping from rescue to investigation mode. There is no switch. It's a cascade.
A cascade. Walk me through what that means on the ground.
The first wave is crisis response — firefighters, paramedics, police. But embedded in that wave are people whose job is evidence preservation and intelligence gathering, even if nobody's called it an investigation yet. FBI agents are securing perimeter footage. They're pulling flight manifests. They're starting to interview witnesses at the airports. All of this is happening while the towers are still standing and the Pentagon is still burning. Nobody said "begin the investigation." The investigation was already the only thing anyone with a badge knew how to do.
And that instinct — to start collecting evidence before anyone tells you to — that's trained, not innate.
Completely trained. It's drilled into every FBI special agent from day one at Quantico. The first responder instinct in federal law enforcement is "secure the scene and preserve the evidence." Even when the scene is a burning skyscraper with thousands of people still inside. The two things aren't in conflict in the moment — they're just different people doing different jobs in the same disaster zone.
So that's the "when." Daniel's second question is about the balance — finding who did it versus stopping what's next. And this is where it gets uncomfortable, because the math is brutal.
The math is four thousand of seven thousand. The FBI had about seven thousand special agents in 2001. Within hours of the attacks, four thousand of them were diverted to the 9/11 response. That left three thousand agents to handle every other federal crime in the United States. Bank robberies, kidnappings, organized crime, counterintelligence, everything.
Three thousand agents for the entire rest of the country.
And that's not even the real tension. The real tension is that within the four thousand assigned to 9/11, you have two competing missions. Every agent you put on evidence collection — interviewing witnesses, tracing credit cards, pulling flight school records — is an agent who isn't working on threat prevention. And in the first 72 hours, nobody knew if there were more attacks coming. The assumption was that there probably were.
So how did they structure it so those two things didn't cannibalize each other?
They created two separate chains of command. A threat desk and an investigation desk, physically separated, reporting up through different channels. The threat desk's only job was "find what's coming next." The investigation desk's only job was "find who did this and how." They shared intelligence — the same raw data fed both teams — but they didn't share personnel. You couldn't pull an agent off a threat assessment to go interview a flight instructor. The walls were real.
That's a design choice. It's not obvious. The intuitive thing would be to put everyone on everything and hope the smart people sort it out.
The intuitive thing would have been a disaster. This is actually one of the lasting organizational innovations that came out of PENTTBOM — the recognition that investigation and prevention are complementary but not interchangeable. The investigation becomes the intelligence-gathering engine for prevention. Every piece of evidence about the hijackers — their travel patterns, their funding sources, their communication methods — was also a clue about what else might be in motion.
So the investigation isn't competing with threat prevention. It's feeding it.
And that was the insight that shaped the entire structure. The PENTTBOM team wasn't just four thousand agents thrown at a problem. It was four thousand agents organized into 25 separate sub-investigations, each with its own team lead, each feeding into a central command structure at FBI headquarters with a forward operating base at 26 Federal Plaza in New York. Plus three thousand support staff — analysts, linguists, evidence technicians, IT people.
25 sub-investigations. What did that breakdown actually look like?
Each one was a thread. Flight manifests was one sub-investigation. Hijacker identities was another. Flight school records was a third. Credit card trails, phone records, immigration files, rental car records — each one got its own team. The idea was that no single team would drown in the volume of information. You break the problem into pieces small enough that each team can actually finish something.
And then the tip funnel hits.
Ninety-six thousand tips in the first week.
Ninety-six thousand.
Phone calls, emails, web forms, in-person reports. Every single one had to be triaged. The FBI set up a system where each tip got one of three classifications: credible threat requiring immediate action, possible evidence to be assigned to a sub-team, or irrelevant — log it and move on. The triage itself was a full-time operation with hundreds of people.
The problem isn't finding evidence at that point. It's drowning in it.
And most of it is noise. For every tip that leads somewhere — "I recognize that guy from flight school, he was asking weird questions about cockpit doors" — there are ten thousand that go nowhere. Someone saw a suspicious van in Omaha. Someone's neighbor is acting strange. The challenge isn't collecting information. The challenge is filtering it fast enough that the real signals don't get buried.
So you've got four thousand agents, 25 sub-teams, 96,000 tips, and a separate threat desk running in parallel. That's the first 24 hours. Daniel's third question is about how the investigation changes shape as it closes in. What does that evolution actually look like?
It happens in phases, and each phase generates the next one. Phase one — the first 72 hours — was "who were these people?" Tracing the 19 hijackers backward through everything they touched. Credit cards, rental cars, phone records, flight school applications. Phase two — the first month — was "how did they get here?" Mapping the logistics chain. Visas, travel routes, funding sources, training schedules. Phase three — months two through six — was "who helped them?" The support network, the facilitators, the money movers.
And the pivot point between phase one and phase two is where it gets interesting.
The pivot happens within 48 hours. Investigators find the flight training records. They realize at least four of the hijackers had received training at U.S. flight schools. And suddenly the question shifts from "who did this" to "how did the system miss this?"
That's the moment the investigation becomes self-reflexive.
It's the moment the investigation stops being a manhunt and starts being an autopsy of the entire U.S. intelligence apparatus. How did 19 people, most of them on watch lists or with suspicious travel patterns, get flight training in the United States without anyone noticing? The investigation isn't just finding the perpetrators anymore. It's finding the failures.
And that second investigation — the one into the system — is the one that produced the lasting reforms.
It's also the one that took years. The 9/11 Commission Report documented this really clearly. The investigation into "who" was fast. Within weeks, the FBI had identified all 19 hijackers, mapped their movements, and traced their connections back to al-Qaeda. The investigation into "how the system failed" took until 2004 to fully document. And that second investigation is what gave us the Department of Homeland Security, the Director of National Intelligence, the restructuring of the FBI's counterterrorism division.
The investigation changed the investigators.
By October 2001 — one month after the attacks — the FBI had already restructured its entire counterterrorism division based on lessons from the first weeks of PENTTBOM. The investigation wasn't just finding answers. It was stress-testing the entire U.S. intelligence and law enforcement system in real time. And the system was failing the test, so they redesigned it while the investigation was still running.
That's the meta-level that doesn't make it into most retellings. The investigation into responsibility became an investigation into the investigators.
And it had to. Because one of the things they discovered in that first week — and this is where it gets uncomfortable — is that the information was there. The hijackers didn't operate in total secrecy. They left trails. Flight school instructors reported suspicious behavior. CIA had tracked some of them. FBI field offices had open inquiries. The pieces existed. They just weren't connected.
So phase one finds the perpetrators. Phase two finds the logistics. Phase three finds the network. And running underneath all of it is this fourth investigation — the one into why the system couldn't see what was right in front of it.
And that fourth investigation is the one that changed everything. The 9/11 Commission's finding was essentially: the operational investigation succeeded rapidly. The systemic investigation revealed failures that took years to fix. Some of them still aren't fixed.
Let me push on something. You said the investigation fed threat prevention — that the evidence about the hijackers was also intelligence about what might be coming. How did that actually work in practice? What did they find that changed the threat picture?
The biggest thing was the international expansion. Within the first week, phone records and financial trails connected the hijackers to al-Qaeda operatives in Yemen and Afghanistan. That transformed the investigation from a domestic criminal case into an international intelligence operation overnight. It required new legal authorities, new interagency coordination, new relationships with foreign intelligence services — some of whom were not exactly eager to help.
The investigation didn't just cross state lines. It crossed the line between law enforcement and intelligence gathering.
And that line had been a wall before 9/11. The FBI and the CIA operated in different legal frameworks with different rules about what they could collect and share. PENTTBOM smashed through that wall — not because anyone decided to, but because the evidence demanded it. You can't trace al-Qaeda's funding network without working with foreign intelligence services. You can't work with foreign intelligence services without the CIA. The investigation forced integration that decades of policy memos had failed to achieve.
So the investigation's scope kept expanding. First it's 19 hijackers. Then it's flight schools. Then it's an international terrorist network. Then it's the entire U.S. intelligence apparatus. At what point does an investigation like this stop being an investigation and start being something else?
It doesn't stop being an investigation. But it stops being a single investigation. PENTTBOM spawned dozens of derivative cases — financial crimes, immigration fraud, material support for terrorism. Each one became its own investigation with its own case number and its own team. The original case file kept growing, but the work splintered into a web of related inquiries that spanned years.
And the people running it — four thousand agents, three thousand support staff — they're working around the clock for months. What does that do to an organization?
It burns people out and it builds careers. Both things happen simultaneously. The PENTTBOM investigation became the defining professional experience for an entire generation of FBI agents. The people who worked it are now the senior leadership of the Bureau. The organizational knowledge from that investigation is embedded in how the FBI operates today. But at the time, it was exhausting and chaotic and nobody knew if they were doing it right because there was no template.
They were building the template.
They were building the template while using it. And that brings us to something that doesn't get talked about enough — the infrastructure problem.
The database problem.
The database problem. All 96,000 tips had to live somewhere. All the evidence from 25 sub-investigations had to be searchable, cross-referenced, and secure. The FBI's existing case management systems weren't built for anything close to this scale. They had to build new systems while the investigation was running.
That's where things get concrete in a way that most analysis misses.
It's where the abstract "information management challenge" becomes a real problem with real consequences. The same tip would come in from three different channels — phone, email, web form — and get logged as three separate leads. Investigators would spend hours chasing something that someone else had already cleared. The deduplication problem alone wasted thousands of agent-hours in the first year.
The investigation wasn't just fighting the terrorists. It was fighting its own information architecture.
Losing, for a while. The FBI didn't really solve the deduplication problem until 2003. Even then it was a patch, not a fix. The system they built for PENTTBOM eventually became the foundation for the FBI's modern case management infrastructure, but the first version was held together with duct tape and overtime.
I want to go back to something you said earlier about the investigation becoming self-reflexive. The moment they found the flight training records and realized the system had failed — that's a turning point not just for PENTTBOM but for how we think about investigations in general. Most investigations ask "who did it." This one had to ask "who failed."
And "who failed" is a much harder question. It requires looking at your own organization, your own procedures, your own assumptions. The FBI doesn't normally investigate itself. But PENTTBOM forced exactly that. The hijackers didn't defeat the system — the system defeated itself through fragmentation and poor information sharing. The investigation had to document that without destroying the organization's ability to function.
That's a tightrope. "Here's how we failed" — written by the people who failed.
To their credit, they mostly did it. The 9/11 Commission Report is remarkably candid about the failures. It names specific breakdowns, specific missed opportunities, specific moments where different agencies had pieces of the puzzle and nobody put them together. The investigation produced accountability, not just for the terrorists but for the system that was supposed to stop them.
Let's talk about the international dimension more. You mentioned that within the first week, the investigation had expanded to Yemen and Afghanistan. What did that actually require?
It required the FBI to operate in countries where it had no legal authority and no existing relationships. They had to negotiate access to witnesses, to financial records, to phone logs — all through foreign governments and foreign intelligence services, some of whom were cooperative and some of whom were not. The investigation became a diplomatic operation as much as a law enforcement one.
That's where the Five Eyes and other intelligence-sharing arrangements become critical.
Right. The post-9/11 intelligence sharing reforms — the ones that created the current framework for how the U.S. and its allies share threat data — were driven directly by the needs of the PENTTBOM investigation. They needed information from German intelligence about the Hamburg cell. They needed information from Pakistani intelligence about the training camps. They needed information from Saudi intelligence about the funding streams. None of those channels existed in a reliable way before 9/11.
The investigation didn't just find the perpetrators. It rewired international intelligence sharing.
It forced it. There was no alternative. You can't investigate a global terrorist network with domestic investigative tools. The investigation had to become global because the conspiracy was global.
That brings us to the present. The PENTTBOM template — separate threat desk, 25 sub-investigations, evidence cascade, international coordination — has become the model for every major terror investigation since. But there's a question hanging over all of this that I think is worth sitting with.
Whether the template still works.
Whether the template scales to threats that don't look like 9/11. Nineteen hijackers with flight training and credit cards is a coherent conspiracy with a central command structure. What happens when the attack is cyber, or distributed across fifty actors with no central coordination, or carried out by autonomous systems?
The PENTTBOM model assumes you can trace the conspiracy backward through financial records and phone calls and travel patterns. That assumption breaks when the conspiracy doesn't leave those trails. Or when the trails are deliberately obscured in ways that didn't exist in 2001.
The investigation into the next catastrophic attack might not look anything like PENTTBOM. And we won't know if we're ready for it until it happens.
That's the uncomfortable truth. The 9/11 investigation was the largest in FBI history, and it was also the last investigation of its kind — because the nature of the threat has fundamentally changed. The question isn't just "how do we investigate the next 9/11?" It's "will the next 9/11 even look like something we know how to investigate?"
Hilbert: The database was a nightmare.
Go on.
Hilbert: I worked on it. Civilian contractor, FBI Investigative Technology Division, 2002 through 2003. They brought me in to help build the document management system for PENTTBOM. The thing that held all 96,000 tips and every piece of evidence from the sub-investigations. We were building the plane while flying it. Literally. The schema changed three times in the first month because the investigation kept discovering new categories of evidence nobody had anticipated.
What do you mean the schema changed?
Hilbert: The database structure. What fields existed, how they related to each other. Flight school records weren't in the original schema. Neither were rental car records. We had to add them as custom fields after the fact. And then later we had to restructure the whole thing because the custom fields became the main data structure. The original design assumed a certain kind of investigation. The actual investigation kept outgrowing it.
The database was fighting the same problem as the agents — the investigation kept changing shape.
Hilbert: The database couldn't keep up. The deduplication problem was the worst of it. Same tip comes in by phone, by email, and by web form. Three separate entries. Three separate lead numbers. Three different investigators chasing the same thing. We didn't solve that until 2003, and even then it was a patch. A fuzzy matching algorithm that compared name fields and phone numbers. It caught maybe seventy percent of duplicates. The other thirty percent just wasted people's time.
Seventy percent catch rate on deduplication means thousands of wasted hours.
Hilbert: Tens of thousands. And the investigators knew it. They'd be sitting in the command center at 26 Federal Plaza, comparing notes, and realize they'd both been working the same lead for three days. Happened constantly.
What was the thing that surprised you most about building that system?
Hilbert: How fast the investigation outgrew the categories we'd built for it. We thought we were building a system for a criminal investigation. Within six months it was a system for an international intelligence operation. The same database had to serve FBI agents, CIA analysts, foreign intelligence services, the 9/11 Commission staff. Each one needed different access levels, different search capabilities, different export formats. We were retrofitting all of it onto a system that was originally designed to track interview notes and evidence logs.
That system eventually became the foundation for the FBI's modern case management infrastructure.
Hilbert: Parts of it. The lessons, mostly. The actual code got replaced years ago. But the architecture decisions we made in 2002 — how to structure evidence, how to link related investigations, how to handle classified material in a shared database — those decisions are still embedded in how the FBI manages major investigations today. For better or worse.
For better or worse.
Hilbert: Mostly for better. But the thing that still bothers me is that we built the system for the last war. PENTTBOM was a paper-trail investigation. Credit cards, phone records, flight manifests. The next one won't be. The next one will be encrypted communications and cryptocurrency and autonomous agents. And the database we built can't handle any of that.
The template problem applies to the infrastructure too.
Hilbert: The infrastructure is the template. The organizational structure, the sub-investigation breakdown, the threat desk — all of that runs on the database. If the database can't handle the evidence, the investigation can't function. And nobody's built the database for what's coming.
That's the open question, isn't it? The PENTTBOM model was built for a specific kind of threat. It worked — it identified the perpetrators within weeks, mapped the network within months, and produced systemic reforms within years. But it was built for a world where terrorists leave paper trails and phone records and flight school applications. The next catastrophic attack might not leave any of those.
Or it might leave trails we haven't learned to read yet. The investigation into the next 9/11 won't fail because the FBI forgot how to investigate. It'll fail because the evidence looks like noise and the noise looks like evidence, and the systems we built to tell the difference were designed for a different kind of signal.
The misconception most people carry about 9/11 is that the investigation started when the FBI opened the case at 10:45 AM. The reality is that evidence response teams were activating within minutes of the first impact, before any formal case number existed. The investigation was already running while the towers were still standing.
The second misconception is that finding the perpetrators and preventing follow-on attacks were competing priorities. They weren't. The investigation was designed as the intelligence engine for threat prevention — every piece of evidence about the hijackers was also a clue about what else might be in motion. The two missions fed each other.
The template worked for 9/11. Whether it works for what comes next is the question we're going to be asking for a long time.
This has been My Weird Prompts. Our producer is Hilbert Flumingtop. You can find us at my weird prompts dot com, and if you want to hear more on how threat assessment has evolved from 9/11 to the present, we'll be digging into exactly that next time.
We'll be back soon.
