Mihdhar was born in Saudi Arabia and fought in the Bosnian War during the 1990s. In early 1999, he traveled to Afghanistan where, as an experienced and respected jihadist, he was selected by Osama bin Laden to participate in the 9/11 attacks plot. Mihdhar arrived in California with fellow hijacker Nawaf al-Hazmi in January 2000, after traveling to Malaysia for the Kuala Lumpur al-Qaeda Summit. At this point, the Central Intelligence Agency (CIA) was aware of Mihdhar, and he was photographed in Malaysia with another al-Qaeda member who was involved in the USS Cole bombing. The CIA did not inform the Federal Bureau of Investigation (FBI) when it learned that Mihdhar and Hazmi had entered the United States, and Mihdhar was not placed on any watchlists until late August 2001.
Upon arriving in San Diego, California, Mihdhar and Hazmi were to train as pilots, but spoke English poorly and did not do well with flight lessons. In June 2000, Mihdhar left the United States for Yemen, leaving Hazmi behind in San Diego. Mihdhar spent some time in Afghanistan in early 2001 and returned to the United States in early July 2001. He stayed in New Jersey in July and August 2001, before arriving in the Washington, D.C. area at the beginning of September 2001. On the morning of September 11, Mihdhar boarded American Airlines Flight 77, which was hijacked approximately a half-hour after take off. The plane was deliberately crashed into the Pentagon, killing all 64 people aboard the flight, along with 125 on the ground.
In the late 1990s, Mihdhar married Hoda al-Hada, who was the sister of a comrade from Yemen, and they had two daughters. Through marriage, Mihdhar was related to a number of individuals involved with al-Qaeda in some way. Mihdhar's father-in-law, Ahmad Muhammad Ali al-Hada, helped facilitate al-Qaeda communications in Yemen, and in late 2001, Mihdhar's brother-in-law, Ahmed al-Darbi, was captured in Azerbaijan and sent to Guantanamo Bay on charges of supporting a plot to bomb ships in the Strait of Hormuz.
Once selected, Mihdhar and Hazmi were sent to the Mes Aynak training camp in Afghanistan. In late 1999, Hazmi, Attash and Yemeni went to Karachi, Pakistan to see Mohammed, who instructed them on Western culture and travel; however, Mihdhar did not go to Karachi, instead returning to Yemen.
On January 4, 2000, Mihdhar left Yemen and flew to Dubai, United Arab Emirates, where he spent the night. The CIA broke into his hotel room and photocopied his passport, which gave them his full name, birth information and passport number for the first time, and alerted them that he held an entry visa to the United States. The photocopy was sent to the CIA's Alec Station, which was tracking al-Qaeda.
On January 5, 2000, Mihdhar traveled to Kuala Lumpur, where he joined Hazmi, Attash and Yemeni, who were all arriving from Pakistan. Hamburg cell member Ramzi Binalshibh was also at the summit, and Mohammed possibly attended. The group was in Malaysia to meet with Hambali, the leader of Jemaah Islamiyah, an Asian al-Qaeda affiliate. During the Kuala Lumpur al-Qaeda Summit, many key details of the 9/11 attacks may have been arranged. At the time, the attacks plot had an additional component involving hijacking aircraft in Asia, as well as in the United States. Attash and Yemeni were slated for this part of the plot, however, it was later canceled by Bin Laden for being too difficult to coordinate with United States operations.
In Malaysia, the group stayed with Yazid Sufaat, a local Jemaah Islamiyah member, who provided accommodation at Hambali's request. Both Mihdhar and Hazmi were secretly photographed at the meeting by Malaysian authorities, whom the CIA had asked to provide surveillance. The Malaysians reported that Mihdhar spoke at length with Attash, and he met with Fahad al-Quso and others who were later involved in the USS Cole bombing. After the meeting, Mihdhar and Hazmi traveled to Bangkok, Thailand on January 8 and left a week later on January 15 for the United States.
On January 15, 2000, Mihdhar and Hazmi arrived at Los Angeles International Airport from Bangkok and were admitted as tourists for a period of six months. Immediately after entering the country, Mihdhar and Hazmi met Omar al-Bayoumi in an airport restaurant. Al-Bayoumi claimed he was merely being charitable in assisting the two seemingly out-of-place Muslims with moving to San Diego, where he helped them find an apartment near his own, co-signed their lease, and gave them $1,500 to help pay their rent. Mohammed later claimed that he suggested San Diego as their destination, based on information gleaned from a San Diego phone book that listed language and flight schools. Mohammed also recommended that the two seek assistance from the local Muslim community, since neither spoke English nor had experience with Western culture.
In early February 2000, Mihdhar and Hazmi rented an apartment at the Parkwood Apartments complex in the Clairemont Mesa area of San Diego, and Mihdhar purchased a used 1988 Toyota Corolla. Neighbors thought that Mihdhar and Hazmi were odd: months passed without them getting any furniture, the men slept on mattresses on the floor, yet they carried briefcases, were frequently on their mobile phones, and were occasionally picked up by a limousine. Those who met Mihdhar in San Diego described him as "dark and brooding, with a disdain for American culture". Neighbors also said that the pair constantly played flight simulator games.
Mihdhar and Hazmi took flight lessons on May 5, 2000 at the Sorbi Flying Club in San Diego, with Mihdhar flying an aircraft for 42 minutes. They took additional lessons on May 10; however, with poor English skills, they did not do well with flight lessons. Mihdhar and Hazmi raised some suspicion when they offered extra money to their flight instructor, Richard Garza, if he would train them to fly jets. Garza refused the offer but did not report them to authorities. After the 9/11 attacks, Garza described the two men as "impatient students" who "wanted to learn to fly jets, specifically Boeings".
On July 4, Mihdhar returned to the United States, arriving at New York City's John F. Kennedy International Airport, using a new passport obtained the previous month. A digital copy of one of Mihdhar's passports was later recovered during a search of an al-Qaeda safe house in Afghanistan, which held indicators, such as fake or altered passport stamps, that Mihdhar was a member of a known terrorist group. At the time when Mihdhar was admitted to the United States, immigration inspectors had not been trained to look for such indicators. Upon arriving, Mihdhar did not check into the Marriott but instead spent a night at another hotel in the city.
Mihdhar bought a fake ID on July 10 from All Services Plus in Passaic County, New Jersey, which was in the business of selling counterfeit documents, including another ID to Flight 11 hijacker Abdulaziz al-Omari. On August 1, Mihdhar and fellow Flight 77 hijacker Hani Hanjour drove to Virginia in order to obtain driver's licenses. Once they arrived, they scouted out a 7-Eleven convenience store and a dollar store in Falls Church, and found two Salvadoran immigrants who, for $50 each, were willing to vouch for Mihdhar and Hanjour as Virginia residents. With notarized residency forms, Mihdhar and Hanjour were able to obtain driver's licenses at a Virginia motor vehicle office. Flight 77 hijackers Salem al-Hazmi and Majed Moqed, and United Airlines Flight 93 hijacker Ziad Jarrah used the same addresses obtained from the Salvadorans to obtain Virginia driver's licenses.
In August 2001, Mihdhar and Hazmi made several visits to the library at William Paterson University in Wayne, New Jersey, where they used computers to look up travel information and book flights. On August 22, Mihdhar and Hazmi tried to purchase flight tickets from the American Airlines online ticket-merchant, but had technical difficulties and gave up. Mihdhar and Moqed were able make flight reservations for Flight 77 on August 25, using Moqed's credit card; however, the transaction did not fully go through because the billing address and the shipment address for the tickets did not match.
On August 31, Mihdhar closed an account at Hudson United Bank in New Jersey, having opened the account when he arrived in July, and was with Hanjour when he made a withdrawal from an ATM in Paterson on September 1. The next day, Mihdhar, Moqed and Hanjour traveled to Maryland, where they stayed at budget motels in Laurel. Mihdhar was among the muscle hijackers who worked out at a Gold's Gym in Greenbelt in early September. On September 5, Mihdhar and Moqed went to the American Airlines ticket counter at Baltimore-Washington International Airport to pick up their tickets for Flight 77, paying $2,300 in cash.
On August 28, the FBI New York field office requested that a criminal case be opened to determine whether Mihdhar was still in the United States, but the request was refused. The FBI ended up treating Mihdhar as an intelligence case, which meant that the FBI's criminal investigators could not work on the case, due to the barrier separating intelligence and criminal case operations. An agent in the New York office sent an e-mail to FBI headquarters saying, "Whatever has happened to this, someday someone will die, and the public will not understand why we were not more effective and throwing every resource we had at certain 'problems.'" The reply from headquarters was, "we [at headquarters] are all frustrated with this issue...[t]hese are the rules. NSLU does not make them up.
The FBI contacted Marriott on August 30, requesting that they check guest records, and on September 5, they reported that no Marriott hotels had any record of Mihdhar checking in. The day before the attacks, the New York office requested that the Los Angeles FBI office check all local Sheraton Hotels, as well as Lufthansa and United Airlines bookings, because those were the two airlines Mihdhar had used to enter the country. Neither the Treasury Department's Financial Crimes Enforcement Network nor the FBI's Financial Review Group, which have access to credit card and other private financial records, were notified about Mihdhar prior to September 11.
Regarding the CIA's refusal to inform the FBI about Mihdhar and Hazmi, author Lawrence Wright suggests the CIA wanted to protect its turf and was concerned about giving sensitive intelligence to FBI Agent John P. O'Neill, who Alec Station chief Michael Scheuer described as duplicitous. Wright also speculates that the CIA may have been protecting intelligence operations overseas, and might have been eying Mihdhar and Hazmi as recruitment targets to obtain intelligence on al-Qaeda, although the CIA was not authorized to operate in the United States and might have been leaving them for Saudi intelligence to recruit.
On September 10, 2001, Mihdhar and the other hijackers checked into the Marriott Residence Inn in Herndon, Virginia, near Washington Dulles International Airport. Saleh Ibn Abdul Rahman Hussayen, a prominent Saudi government official, was staying at the same hotel that night, although there is no evidence that they met or knew of each other's presence.
At 06:22 on September 11, 2001, the group checked out of the hotel and headed to Dulles airport. At 07:15, Mihdhar and Moqed checked in at the American Airlines ticket counter and arrived at the passenger security checkpoint at 07:20. Both men set off the metal detector and were put through secondary screening. Security video footage later released shows that Moqed was wanded, but the screener did not identify what set off the alarm, and both Moqed and Mihdhar were able to proceed without further hindrance. Mihdhar was also selected by the Computer Assisted Passenger Prescreening System (CAPPS), which involved extra screening of his luggage; however, because Mihdhar did not check any luggage, this had no effect. By 07:50, Mihdhar and the other hijackers, carrying knives and box cutters, had made it through the airport security checkpoint and boarded Flight 77 to Los Angeles. Mihdhar was seated in seat 12B, next to Moqed.
The flight was scheduled to depart from Gate D26 at 08:10 but but was delayed by 10 minutes. The last routine radio communication from the plane to air traffic control occurred at 08:50:51. At 08:54, Flight 77 deviated from its assigned flight path and began to turn south, at which point the hijackers set the flight's autopilot setting for Washington, D.C. Passenger Barbara Olson called her husband, United States Solicitor General Ted Olson, and reported that the plane had been hijacked. At 09:37:45, Flight 77 crashed into the west facade of the Pentagon, killing all 64 people aboard, along with 125 in the Pentagon. In the recovery process, remains of the five hijackers were identified through process of elimination, since their DNA did not match any from the victims, and put into the custody of the FBI.
On September 12, 2001, the Toyota Corolla purchased by Mihdhar was found in Dulles International Airport's hourly parking lot. Inside the vehicle, authorities found a letter written by Mohamed Atta, a hijacker aboard American Airlines Flight 11; maps of Washington, D.C. and New York City; a cashier's check made out to a Phoenix, Arizona flight school; four drawings of a Boeing 757 cockpit; a box cutter; and a page with notes and phone numbers, which contained evidence that led investigators to San Diego.
On September 19, 2001, the Federal Deposit Insurance Corporation (FDIC) distributed a special alert that listed Mihdhar as still alive, and other reports began suggesting that a number of the alleged hijackers were likewise still alive. For instance, on September 23, 2001, the BBC published an article that suggested Mihdhar and others named as hijackers were still at large. The German magazine Der Spiegel later investigated the BBC's claims of "living" hijackers and reported they were cases of mistaken identities. In 2002, Saudi officials stated that the names of the hijackers were correct and that 15 of the 19 hijackers were Saudi. In 2006, in response to 9/11 conspiracy theories surrounding its original news story, the BBC claimed that confusion arose with the common Arabic names, and that its later reports on the hijackers superseded its original story.
In 2005, Army Lt. Col. Anthony Shaffer and Congressman Curt Weldon alleged that the Defense Department data mining project Able Danger identified Mihdhar, Hazmi, al-Shehhi and Atta as members of a Brooklyn-based al-Qaeda cell in early 2000. Shaffer largely based his allegations on the recollections of Navy Captain Scott Phillpott, who later recanted his recollection, telling investigators that he was "convinced that Atta was not on the chart that we had". Phillpott said that Shaffer was "relying on my recollection 100 percent", and the Defense Department Inspector General's report indicated that Philpott strongly supported the social network analysis techniques used in Able Danger, and might have exaggerated claims of identifying the hijackers.