From court documents involving Iyman Faris, on trial for Al Qaeda plots:

] C-2 [Khalid Shaikh Mohammed] described the equipment as
] "gas cutters" but instructed the defendant [Faris]
] to refer to them in code as "gas stations" in any
] subsequent communications sent to C-2. C-2 also
] explained that al Qaeda was planning to derail
] trains. C-2 assigned the defendant to obtain the
] necessary tools for the train-derailment plot as well. In
] messages to C-2, those tools were to be referred to as
] "mechanics shops." The defendant indicated that he had
] email and was familiar with the internet. C-2 instructed
] the defendant never to access email immediately after
] logging on but only after opening other internet sites
] first.
  . . .
] Between April 2002 and March 2003, the defendant sent
] several coded messages through another in the United
] States to C-1 in Pakistan, indicating that the defendant
] was still trying to obtain "gas stations" and "mechanics
] shops" (i.e., he had been unsuccessful in his ongoing
] attempts to locate the equipment). In March 2003, the
] defendant inquired about C-2's arrest through a message
] to another here in the United States.
 . . .
] In late 2002, the defendant traveled to New York City. After
] examining the particular bridge, he concluded that the plot to
] destroy the bridge by severing the cables was very unlikely to
] succeed because of the bridge's security and structure. In early
] 2003, after scouting the bridge, the defendant sent a message to
] C-1 which stated "the weather is too hot." This message was coded
] and meant to convey the defendant's assessment that the bridge
] plot was unlikely to succeed.

Interesting stuff on the codes that Al Qaeda was actually using (as opposed to all the rumors about steganographic embedding in porn images).

It's also worth noting that one of the messages between Atta and Binalshibh (according to Binalshibh when he granted an interview to Al-Jazeera last year) also used a similar message: "the summer will surely be hot" when planning the September 11th attacks.

Question though: What would be the benefit of checking Email *after* browsing other internet sites first? Would this just be to throw watchers off the scent by making a session look like an "innocent" session, or would that kind of pattern mess with sniffer programs somehow? Or maybe the "other internet sites" were specific ones designed to disguise source IP?