The passport agency in Saudi Arabia?
Pretty simple search. You have the passport numbers of those on board via the flight roster. You phone 'our good freinds' the Saudis and "send us the details for these passport numbers". Five minutes later by email you have everyones passport photo.
Go back and look at all the info that was coming out withing hours of the attacks, not just the pics. We had a lot more than just pics of these guys.