Category: Framework For Analysis

Foreword

This article was updated on April 9, 2012, in order to add primary source audio to establish what was known and when about the impacts of AA11 and UA175 with the World Trade Center.  All the added material is at the end of the article.

Original Article

The 9/11 Commission and the Congressional Joint Inquiry before it determined that 19 terrorists in four groups  hijacked four commercial aircraft to use them as guided missiles to attack four buildings on September 11, 2001. Three attacks were successful; the fourth thwarted by passengers aware of their probable fate.  The Inquiry and Commission reports were published in the Spring 2003 and Summer 2004, respectively, and are generally accepted as an accurate accounting of what happened that day and in events leading up to that day.

The Commission and the Joint Inquiry gathered and considered a large body of evidence that considered the terrorist attack and the events leading up to the attack. In addition to pre-attack evidence and primary source evidence about the attacks, the Commission also examined post-attack information.

The dates and times in the following chart provide one way of defining the  pre-attack, attack and post-attack phases.

Phase	Begins	Ends
Pre-Attack	Feb 26, 1993	5:45am Sep 11, 2001
Attack	5:45am	10:03am
Post-Attack	8:46am	Present

The starting date for the Pre-Attack is the date of the first terrorist strike on the World Trade Center. Depending on one’s interest, different starting points can be taken—the bin Laden Fatwah, for example. The Pre-Attack ends as soon as Atta and one accomplice enter the National Airspace System (NAS) in Portland, Maine; the attack has begun. The attack ends when United Airlines Flight 93 (UA 93) plummets to ground near Shanksville, PA.

The commencement of the attack can be described in military terms. The Commission established the scheduled takeoff times of the four hijacked aircraft to be:

7:45 AA 11

8:00 UA 175

8:10 AA 77

8:00 UA 93

That establishes a line of departure (LD) at Boston Logan Airport between 7:45 and 8:00 a. m. for the attack against the World Trade Center and an LD at two locations, Newark Airport and Dulles Airport between 8:00 and 8:10 for the attack against Washington D. C. It is speculative but the timing suggests that the overall attack plan was synchronized with the four impacts to occur in a short span of time, but with the northern attack to precede the southern attack.

This description in military terms now allows us to place Atta’s departure from Portland Airport in perspective. Colgan Air flight 5930 departed at 6:00 a. m., on time. That became, then, an initial or preliminary line of departure. Actually, Atta entered into the National Airspace System at 5:45 a.m. when he passed through security and was free to board.

We can further speculate that Atta established that tactical procedure as a backup plan;  he only needed one plane to hit one target for the day to be a success. Anything else was simply value added. So, he, together with one accomplice, traveled as a team to enter the system at a remote location, with a backup plan to attempt to hijack AA 11 with just a two-man team. There is one piece of evidence that supports this speculation. Atta was, according to a Commission Staff Report of August 24, 2004, visibly upset when he learned he would have to pass through screening a second time at Logan Airport.

As it turned out, a backup plan was not needed. According to the same Staff Report. Atta received a phone call at 6:52 a.m. from Terminal C, the departure terminal for United Airlines Flight 175 (UA 175). By the time that three minute call ended all 10 hijackers for the attack against the World Trade Center had passed through security and were in the NAS. In military terms, they achieved tactical superiority; they were inside the decision cycle of their enemy. They were well on their way to demonstrating mastery of a key principle of war; surprise.

Surprise was achieved between 8:46 and 8:47 a.m.; the Post-Attack phase began with the impact of AA 11. It overlapped the Attack phase and it continues to this day. From that moment personal recall started and the reporting and telling of events were shaped by what people thought they saw, what they recalled doing, and what the media reported.

Added Information

How News of AA11 and UA 175 was Received

La Guardia and Newark Towers

La Guardia Tower, Class B airspace position,  was the initial Air Traffic Control facility to learn of the first collision at the World Trade Center.  The controller was in routine communication with a helicopter, Bravo Quebec, whose description of the event was brief.  That first description was that it “looks like somethin’ just collided [with the World Trade Center].”  0847 Looks Liike Something Just Collided 

Shortly thereafter, the La Guardia controller compared notes with a colleague at Newark Tower.  The latter reported that there was a huge amount of smoke coming from the top ten floors. “All of sudden a huge plume of smoke came out of the World Trade Center.  0848 Newark Huge Amount of Smoke

At that same time, 8:48,  an unidentified plane asked the Newark Tower Ground Control position  about the “smoke coming off the World Trade building.”  The controller advised that they were “calling the port right now about it , it just started.”  The plane reported that they saw it, “a couple minutes ago, big puff of smoke.”  The controller advised that “they werenot sure if something hit it or something happened inside.” 0848 Calling the Port Right Now

A few seconds prior, acknowledgement of a fire at the World Trade Center was recorded at the Newark Tower Local Control position.  That controller also told an unidentified plane that the Port Authority had been called. 0847 Fire at the World Trade Center

At 8:55, a law enforcement helicopter reported in with La Guardia and directed that all traffic above 2000 be diverted, “we possible have a plane into the World Trade.”  0855 Posslble Plane into the World Trade

Shortly after 9:00, the La Guardia controller compared notes with Teeterboro and speculated that “personally, I don’t think it was an airplane.”  He soon corrected the record in a discussion with, first, the police helicopter (PD 14) and then a news helicopter (Chopper 4)  The police helicopter reported “unknown size [of the airplane] at this time.”  The news helicopter reported, “can’t tell  how big [size of the airplane] it is right now.” 0900 Helicopter reports police and news 

At 9:03 the  La Guardia controller received a report from an unidentified caller [likely PD 14] that a 737 [UA175] hit the World Trade Center.  0903 A 737 Just Struck the World Trade Center

Immediately thereafter, La Guardia worked with the police helicopter to ensure that all aircraft under La Guardia control were exiting the airspace. That effort spanned two minutes during which it was not clear from observers in the sky or at La Guardia what planes and of what size had struck the two towers.  0904 La Guardia Traffic Control Sequence

At Newark Tower, the Local Control position acknowledged that they saw the impact as it occurred.  Within a minute the controller advised, “everbody just stand by.”  Within another minute he took action to stop all takeoffs;  “just stand by, there is a situation, just, all departures are stopped, stay with me.  Everybody just monitor my frequency, please don’t call me, I will call you.” 0903 Yes I Saw It

It is clear from this series of conversations recorded at New York area towers that observers closest to the scene did not have accurate situational awareness.  The helicopters in the vicinity and the Class B airspace controller  knew only that two aircraft, possibly 737s had flown into the World Trade Center and that they had an emergency situation on their hands.  And that became the focus of attention at that level.

The next entity in the air traffic control chain-of-command was New York TRACON and we next look at the situational awareness at that level.

New York TRACON

New York TRACON first learned of a problem with AA11 shortly after 8:40 when it joined a telecon with Boston Center linked by the FAA’s Air Traffic Control System Command Center (Herndon Center).  That call was taken at the Traffic Management Unit, Departure Director position (TMUDD).  The call was a continuous exchange of information, first with Boston Center and Herndon Center, and then New York Center (ZNY), which broke into the conversation. The exchange lasted nearly three minutes.

The fear was that AA11 would land at Kennedy without advanced notice. However, the ZNY caller reported that he had learned that the aircraft was still at 29,000 feet and would bypass Kennedy.  Here is the conversation as recorded at New York TRACON. 0840 ZBW TRACON ZNY AA11 notification

At 8:51,  a caller asked for assistance in locating AA11 on the TMS (traffic management system).  the TMUDD specialist reported that he had lost the plane on radar and at 8:52 learned of the news.  “Hang on, what’s that?”  A background voice responded,  “An airplane crashed into the top of the World Trade Center.”  The response was at once cryptic and clear.  “What?”  “Wow?”  0852 Hang on Whats That 

Immediately thereafter, the Operations Manager in Charge of New York Center, Mike McCormick, called New York TRACON.  That nearly two minute call is important for three reasons.

1. All key senior managers in the New York area; McCormick, his next in command, Bruce Barrett, and the Operations Manager in Charge at Newark TRACON, Bob Burch, participate.
2. The initial alert about UA175 by the New York controller to Bruce Barrett is heard in background (amplified)
3. Initial reporting information became conflated and confused at New York Center, New York TRACON, and at least one of the area towers, Newark.

McCormick stated that two things were going on, but he had not assimilated that UA175 was yet a third thing.  He conflated the alert about UA175 to pertain to AA11 as one thing.  The unidentified plane that struck the World Trade Center was the other thing.  Here is that call as recorded at New York TRACON. 0853 McCormick, Burch, Barrett in real time 

The TMUDD position then took two calls in sequence which, taken together, show the uncertainty in the National Airspace System.  The first caller, a traffic manager from U.S. Air called to see if the incident at the Word Trade Center involved one of their aircraft.  the New York TRACON traffic manager, Carl, said “we don’t know [what happened]” and “I guess we’ll have to turn on CNN to find out.”

The second caller was Wanda, a traffic manager from Herndon Center, who inquired about the impact on the air traffic control system.  Carl told her, “we’re just trying to figure out what actually occurred and what is going on, and what needs to be done.” 0855 TRACON called by US Air and Herndon Center 

 

Introduction

In a recent article I defined the 9-11 battlefield and discussed both the attack and the counterattack.  In this article I will build on our earlier discussion of the attack and focus specifically on one of its architects, Khalid Sheikh Mohammed (KSM).

The Moussaoui Trial

KSM “testified” at the Moussaoui Trial in an interesting way.  He spoke for the defense; his testimony is defense exhibit 941, “SUBSTITUTION FOR THE TESTIMONY OF KHALID SHEIKH MOHAMMED.”  And that raises the immediate question, “why the defense?”  The answer is straight-forward and concise.  KSM testified that “[he] denied that Moussaoui ever had a 9/11 role.”  KSM further stipulated that “Moussaoui did not know Atta and there was never any contact between the two of them.”

KSM, a problematic witness

A few voices have argued that because KSM was subjected to torture any statements attributed to him are without value.  I assess that position as naive and largely self-serving.  KSM is a valuable secondary source of information, understanding that such information was derived from interrogation.

Here is how the Moussaoui defense framed the testimony.  “You should assume that if Sheikh Mohammed were  available to testify in this courtroom under oath and subject to perjury he would have said what is contained in these statements.”  The defense further elaborated, “In evaluating the truthfulness of these statements, you should consider all other evidence in this case, including all exhibits, regardless of which side may have produced the exhibits…”

It is precisely on the point, “consider all other evidence,” that KSM’s testimony is valid and relevant.  The convergence of evidence is compelling and conclusive that the events of 9-11 occurred as reported by both the 9-11 Commission and the Congressional Joint Inquiry.  KSM’s testimony adds substance to what we already know from other primary and secondary source information.

Moreover, for those who claim that Chapter One of the Commission’s Report, “We Have Some Planes,” is flawed because it relied on information from KSM’s interrogations, consider this:  not one of 241 end notes to chapter one makes reference to KSM.  In writing the first chapter, we did not use or take into consideration the reports of KSM’s interrogations.

Atta as “Emir”

KSM stipulated, “At some point during Atta’s training, Bin Laden decided that Atta would be the “emir” of the hijackers in the U.S., with [Nawaf] a-Hazmi serving as Atta’s deputy.”  KSM recalled that “Atta was a good operative.  Atta had extensive exposure to the West, worked hard, and learned quickly.”  KSM “gave Atta enough authority that he wold not need to consult with them frequently, and would be the decision maker.”

That decentralized approach to management is one reason that the nation was caught by surprise.  Atta left no unusual trail other than an unthinking abandonment of a plane on the tarmac of Miami International Airport.  Moreover, he was able to leave the country soon after al-Midhar entered on July 4, 2001, and well after the system was “blinking red.”  Further, he was allowed to return without suspicion.

The planning was so decentralized that “The final decisions to hit which target with which plane was [sic] entirely in the hands of the pilots.  Atta informed Bin al-Shibh [of the targets] in July 2001 when they met in Spain…”

Operational Security, a Quick Comment

The totality of KSM’s testimony details good operational security; but the biggest offender in this regard was bin Laden.  We know that Atta and Moussaoui were compartmented.  KSM maintained that just six individuals knew the plot details: “Atta, Marwan al-Shehhi, Hani Hanjour, Ziad, Jarrah, Nawaf al-Hazmi, and Khalid al-Midhar.”    KSM further revealed that, “he learned of the impending date of the hijackings via courier.”  He also described the process of traveling to see bin Laden in person with specific details.

It was bin Laden who was largely responsible for the “chatter,” the series of over 30 signals intelligence (SIGINT) reports that caused the system to “blink red.”  According to KSM; “During the summer [sic], Bin Laden made several remarks vaguely hinting at an upcoming attack, which generated rumors throughout the worldwide jihadist community.”  During a speech at the al-Faruq camp, bin Laden, “urged the trainees to pray for the success of a major operation involving 20 martyrs.”  KSM stipulated that he and others were concerned “about this lack of discretion.”

Bin Laden’s lack of discretion did cause the system to “blink red” in late spring, but the attack did not proceed on the timetable he wished, nor on the timetable the counterterrorist community saw in the reporting.  Nothing happened after the flurry of SIGINT reports.  Bin Laden’s vision did not coincide with that of his chosen “Emir,” Atta.

“Blinking Red,” in perspective

When officials describe the system as “blinking red,” they are referring to the counterterrorism system.  While on the Joint Inquiry Staff I looked at all the Senior Executive Intelligence Briefs (SEIB) and Chairman, JCS, intelligence briefs for the period Mar 1-Sep 11, 2001. The intelligence system as a whole was not “blinking red.”  Was there a spike in terrorism reporting?  Yes.  Did that spike show in the overall intelligence reporting?  Yes, but as a transient, for a short period of time.

The percent of articles/briefings on terrorism was small, never more than five percent of the total reporting and usually substantially less. So what caused the spike?  I attribute it to al-Shehhi’s report immediately after he made the first terrorist cross-country orientation flight on May 24, 2001.

It is my recall that on his return al-Shehhi immediately called the Yemen number from the baggage claim area at JFK airport.  The spike in SIGINT reporting began a few days later when bin Laden compromised operational security.

April 1, 2001, an interesting date

I categorized articles/reports in about ten categories, most geographic (Eastern Europe, Middle East, e. g.), some functional (terrorism, specifically).  The plurality of briefings/articles was not on a subject you might expect; it was on China.

On April 1, 2001, the Chinese forced down a U.S. EP-3 reconnaissance aircraft on Hainan Island, a serious international incident that focused the government’s attention.  It was the first major challenge for the Bush administration.  Moreover, China was the emerging threat after the fall of the Soviet Union.

On April 1, 2001, Nawaf al-Hazmi received a speeding ticket while traveling through Oklahoma.  He was sent on his way; Hani Hanjour was likely with him.

On  April 23, 2001,  the hijacker accomplices began arriving in the United States.

Timing of the Attack

KSM testified that he “withstood pressure from Bin Laden to launch the operation earlier than planned.  The first time was in the spring of 2000, shortly after Atta and the other pilot/hijackers arrived in the U.S….”  The other two occasions were in the “Spring of 2001…”

More specifically, bin Laden wanted to strike on “May 12, 2001, exactly seven months after the bombing of the U.S.S. Cole in Yemen.”  That not being feasible, bin Laden then wanted to strike “in either June or July 2001 because [he] had learned from media reports that Ariel Sharon would be visiting the White House.”

According to KSM, he learned that “Atta had all selections and assigments finalized in late August 2001.”  As we stated earlier, KSM learned of the actual date via courier.  According to KSM, bin Laden “notified the al Qaeda Shura council that a major attack against unspecified U.S. interests was scheduled to take place over the coming weeks, but he did not reveal additional details.  His attention to operational security improved considerably, it seems.

The Targets

The overall concept was simple.  According to KSM, “Bin Laden indicated that he wanted to hit a military, political, and economic target.”  That was at a time that there were only three pilots; Hani Hanjour had not yet been identified.

KSM revealed that, later, “Bin Laden told Atta that Atta must hit both towers of the WTC, the Pentagon, and the U.S. Capitol, but that additional targets from which Atta could choose included the White House, the Sears Tower, and a foreign embassy…”  KSM also said that “the plane that crashed into the field in Pennsylvania was targeted at the Capitol building (Congress and Senate).”

According to KSM, “Hanjour was one of the best-prepared operatives sent by Sheikh Mohammed to the U.S.”  KSM told Hanjour that he wanted him “to pilot the plane that would strike the Pentagon…given that the Pentagon would be a tough target…[KSM] figured that Hanjour would be the best qualified of the pilots.”

Pilot Qualifications

Some voices argue, ethnocentrically, that the hijacker pilots were poorly trained and inadequate to the task, specifically Hanjour.  None of these voices consider the obvious point that it may well have been in the hijackers’ best interest to be perceived as inept and inarticulate; to fly under the radar screen of suspicion, so to speak.  The whole notion that, for example, Arabs cannot learn to fly is nonsensical.  For starters, I recommend that people inclined to that point of view read The Bin Ladens, An Arabian Family in the American Century, by Steve Coll.  The book describes a family that lived, and died, in the air.

The Assault

KSM testified about the camp training the so-called “muscle” hijackers received.  He explained that he “instructed the muscle hijackers to focus on seizing the cockpit first and then wory about seizing control over the rest of the plane.  The hijackers were told to storm the cockpit at the moment that the pilot cabin door opened, and to avoid trying to break down the door if necessary.”

The Results

In the end, Atta, the “emir,” took the bare bones of his assignment to hit economic, military, and politic targets and conceived and executed a tactical plan that accomplished two-thirds of his mission, with the added bonus of taking out the entire World Trade Center complex.  Atta had quality time measured in days, weeks, even months to hammer out details and discuss what-ifs with his colleague, al-Shehhi.  The attack was no casual “back-of-the envelope” affair.

Atta survived his own miscue at Miami International as well as the premature and ill-advised pronouncements of bin Laden to the Shura.  It is my assessment that he was able to do so because the operation, twice, got inside the nation’s decision-making cycle. All 19 hijackers were in country and ready for final planning and training before the government got itself organized to deal with the threat that was “blinking red.”

The last hijacker, al-Midhar arrived, ironically, on July 4, 2001, six days before a White House meeting dealing with the threat.  It took the Intelligence Community a month to deliver its assessment to the President, the August 6, President’s Daily Briefing (PDB).  I will address that briefing at the close of this article.

By that time Atta had departed and returned and Jarrah had made one last trip out of country to see his girl friend.  Both trips were dangerous in terms of operational security, but the system did not pick up the trail. Separate voices in the government were picking up the trail–in Phoenix and in Chicago.  The Counterterrorism Security Group, CSG, scheduled a key meeting on September 12, 2001.  Atta’s schedule stayed within his enemy’s decision-making cycle by just one day, and that was enough.

PDB: “Bin Ladin Determined to Strike in the U S”

On August 6, 2001, The President’s Daily Brief included a summary article on the threat.  My understanding of that article is that is was the result of guidance to the intelligence community to put the “chatter,” the “system blinking red” into perspective.  It took the community nearly a month to do the assessment, get it coordinated, and present it.

The August 6, PDB was “Defendant’s Exhibit 901, U.S v. Mouassaoui, Cr. No. 01-455A.”  As far as intelligence analysis articles go it was not all that remarkable and did not contain any specifics as to time, place, or threat.  Those who consider the document to be the “holy grail” for 9-11 miss both the point and the content of the document.  It was a summary, largely historical on the intelligence side, and vaguely reassuring on the law enforcement side.

A parallel Senior Executive Intelligence Brief (SEIB) was seen by a larger audience; mid- and senior-level officials in far better position to make an informed judgment.  The intelligence summary was, to them, old information repackaged.  What was new and not contained in the SEIB was the law-enforcement information.

(Author’s note.  My understanding of the PDB and SEIB is based on my work on the Joint Inquiry Staff.  We had a copy of the SEIB and knew what the PDB contained.  I participated in interviews of several intelligence community analyst supervisors who saw the SEIB, but not the PDB.)

Introduction

One of my first posts was an initial Framework for Analysis.  The premise was the universally accepted fact that there was an event on September 11, 2001.  I developed a neutral framework that allowed anyone to present a body of evidence that included pre-facto, facto, and post-facto information to support their definition of the event.  No one has set forth a credible thesis that the event was anything other than a terrorist attack because there is no body of evidence to support a different conclusion.

The body of evidence assessed by both the Congressional Joint Inquiry and the 9-11 Commission is convergent and conclusive that the event of 9-11 was a terrorist attack.  Therefore, I used the framework for analysis to outline the basics of the event as a terrorist attack in my first article.

In this article, I will describe the attack in more detail and will also examine the Nation’s response.  I will again identify the battle commanders and will establish the battlefield.  Then we will discuss the attack and the government’s counterattack.  Finally, I will set the stage for the Nation’s transition to Operation Noble Eagle.  The history of that operation is being written by United States Air Force historians.

The Battlefield and the Battle Commanders

On 9-11, nineteen terrorists commandeered four aircraft to mount a multi-prong attack against the National Airspace System (NAS), the battlefield.  The NAS is a component of the larger National Transportation System.  The attack also impacted at least three other national systems; defense, preparedness (emergency response), and policy (continuity of government).  In this article I will focus on the NAS and one defense component, the U. S. air defense system.

The NAS is operated by the Federal Aviation Agency’s (FAA) Air Traffic Control System Command Center (Herndon Center), commanded by a National Operations Manager (NOM).  Benedict (Ben) Sliney was the NOM on 9-11.

The NAS is defended by the North American Aerospace Defense Command (NORAD), which is divided into regions, one of which was the Continental U. S. Region (CONR).   The east coast of the U. S. was the responsibility of one of CONR’s sectors, the Northeast Air Defense Sector (NEADS).  Air Force Colonel Robert Marr commanded NEADS on 9-11.

Sliney and Marr were the nation’s battle commanders that day.  Given that the attack on 9-11 was a battle in a larger war against terror, Sliney and Marr were the highest level personnel who could take any timely action that morning.  As we have discussed elsewhere in a series of articles on Chaos Theory, information did not flow concurrently to Sliney and Marr, or between them.  They never talked to each other during the battle.

The Flow of Information

The battle commanders did not talk to each other for two primary reasons.  First, as we have discussed elsewhere, Boston Center (ZBW) preempted the hijack protocol and, in the terminology of Chaos Theory, established ZBW and NEADS as “strange attractors,” the focal points for the exchange of relevant information.

Second, no one at a higher level, in particular the battle managers, Maj. Gen. Larry Arnold, USAF, at CONR, and Jeff Griffith at FAA Headquarters, had the situational awareness to force the flow of information to be  between NEADS and Herndon Center.  A chart I prepared while on the Commission Staff illustrates the flow of information to and from NEADS, during the period 9:21 to 10:22.  Note that the flow of information during the time that AA 77 and UA 93 were an issue was between NEADS, primarily the identification technicians, and the regional air traffic control centers.

The Attacker’s Tactical Advantage

At the strategic level, the hijacker planners achieved a basic principle of war, surprise.  The surprise was so complete that the attack proceeded as planned until the passengers and crew aboard UA 93 learned what was happening. At the tactical level, the hijackers got within the government’s decision cycle and stayed there for most of the battle.  In the vernacular, the government was always playing ‘catch up ball.’

The counter attack gained its only tactical advantage when the Langley fighters established a combat air patrol (CAP) over the Nation’s capital.  According to the 9-11 Commission Report: “At 9:46 the Command Center updated FAA headquarters that United 93 was now ‘twenty-nine’ minutes out of Washington D.C.”  The CAP began at 10:00; the projected UA 93 arrival was 10:15.

The Attack

The attack lasted for four hours and 18 minutes, beginning at 5:45 a.m. when Mohammed Atta and one accomplice entered the NAS at Portland, Maine and ending at 10:03 a.m. when UA 93 plummeted to earth near Shanksville, Pennsylvania.

Dulles, Boston, and Newark airports were the primary line of departure, and all four targeted planes were scheduled to take off in a short time span centered on the eight o’clock hour.  I have speculated elsewhere that Atta’s entry into the NAS at Portland was a preliminary line of departure, simply a “Plan B,” a contingency to ensure that if all else failed, he and one accomplice could complete one prong of a planned four-prong attack.

The attack had a northern and a southern component, each two-pronged.  In the language of Chaos Theory, that unfolded as a nonlinear double bifurcation which overwhelmed a nation determined to follow existing linear response systems.

The Tactics

The attack was a simple plan: commandeer four aircraft through violent, expedient means and fly them into buildings.  The tactics were equally simple.  A Commission Staff Report of August, 2004 summarizes events concerning the takeover and control of each hijacked plane.    First, overwhelm the crew, kill the pilots, and then fly the planes to their targets.  Second, manipulate the transponders to cause problems for air traffic control.  A previous post, “Transponders and Ghosts,” is my assessment of that tactic.

The hijackers had sufficient knowledge from their cross-country orientation flights as passengers to know the variances between scheduled and actual takeoff times.  They tended to fly United for their orientation flights, so they also knew that it was possible for United passengers to listen to flight deck air traffic control communications on cabin channel 9.  They also gained a sense of the habits and tendencies of cabin crews and knew they would be preoccupied once the seat belt light was turned off.  Further, they purchased their tickets close enough to September 11 to have some degree of confidence from long-range weather forecasts that it would be a clear day on the East Coast.  Their overall planning was meticulous, detailed, and, ultimately, successful.

The final line of departure and point of most likely failure was security screening.  We can estimate that the line crossing began around 7:00.  There is no video record of when the hijackers passed through security at either Logan or Newark.  The hijackers entering the NAS at Dulles passed through security screening beginning at 7:18 and began boarding about 30 minutes later.

That allows us to speculate that the pass through security screening began about 30 minutes prior to boarding at the other two points of departure.  That extrapolation means that al Shehhi and his crew passed through security prior to Atta and his crew; the UA 175 crew began boarding at 7:23, the AA 11 crew at 7:31.  This analysis is supported by a three-minute 6:52 call to Atta from, most likely, al Shehhi.  That was the “go” signal for al Shehhi to enter and Atta to re-enter the NAS.

(Note: bolding above added on Feb 7, 2010.  Atta had to pass through security a second time at Logan.)

The sequence of entering the NAS at Dulles provides a glimpse into the detail that went into the plan.  At Dulles, two hijackers preceded the designated pilot through the checkpoint, followed by the pilot and then the last two hijackers.

That pattern was replicated with minor variation during the boarding process.   In each case, two hijackers preceded the designated pilot on board, followed in three cases by the pilot, either alone (AA 77) or with a colleague (AA 11 and UA 175), and then followed by the rest of each crew.  The one exception was UA 93.  Jarrah was the last to board.

The first hijacker boarded at 7:23, UA 175, and the last boarded at 7:55, AA 77.   The boarding window of exposure across all four flights was just over 30 minutes.  I estimate that the window of exposure to enter the NAS, to pass through security, was about the same.

We can extrapolate that the pattern of passing through security at Logan and Newark was identical to Dulles: accomplices first, followed by the pilot and rest of the crew, in some order.  Why might this be so?  A simple answer is that the pattern did not expose the pilot immediately, allowing him the opportunity in every case to abort if his accomplices encountered difficulty.

Once the hijackers were through security and on board the aircraft, three additional distinct, measurable  events defined the attacker’s entry into the NAS; cabin door closed, push back, and liftoff.  A detailed discussion of those events is beyond the scope of this paper.  Suffice it to say that each event took the passengers and hijackers further away from local and airport security and to a point where the only security was provided by the air crew.  None of the four hijacked aircraft had an air marshal on board.

For our purposes in this paper, the time between push back and liftoff is defined as the delay time.  According to the August 2004 Commission Staff Report the average delay time for AA 11, UA 175, and AA 77 was approximately fifteen minutes.  By contrast the delay time for UA 93 was nearly three times as long, 42 minutes.  That establishes a “delta,” a delay approximating 30 minutes, the difference between expectation and reality. The UA 93 prong of the southern attack lagged well behind plan, giving the government’s counter attack a chance, as we shall later see.

AA 11 pushed back at 7:40 and lifted off at 7:59.  UA 175 pushed back at 7:58 and lifted off at 8:14.  AA 77 pushed back at 8:09 and lifted off at 8:20.  UA 93 pushed back at 8:00 and lifted off at 8:42.

Situation Summary

At this point we need to pause for a moment and take stock of the situation.  By 8:20,  three hijacked aircraft were airborne; and the fourth, UA 93, would have been if we consider the “delta” of 30 minutes.  At Herndon, Ben Sliney, in his first day as the NOM, was in a routine morning meeting.  At NEADS, Col. Bob Mar was in the battle cab, an unusual situation predicated on scheduled exercise activity for the day.  The battle cab was fully staffed, and he had a designated exercise mission crew commander, Major Dawne Deskins, USAF, to assist.

No one at any level anywhere in the government, the airlines, or on board the four targeted aircraft was aware that the attack had been underway for well over two hours and that a well-timed assault was imminent.

The Assault

AA 11. Atta struck first, quickly, a short 15 minutes or so after liftoff.  Within no more than three or four minutes, his crew secured the cockpit and Atta was in command of and flying a domestic commercial airliner.  A few moments later, he announced his success to the NAS, “we have some planes.”

Some hold that announcement to be evidence of Atta’s poor skills and ineptitude.  I find that position ethnocentrically deceptive and a gross underestimation of the terrorist threat on that day and in general.  I hold, based on Atta’s demonstrated ability to plan in detail, that his broadcast was intentional, for two reasons.

First, it was possible that al Shehhi could hear him on cabin channel 9 aboard UA 175.  There is no evidence that he did, but we do know that Atta’s transmissions “on frequency” were heard by the UA 175 crew; AA 11 and UA 175 were on the same frequency during the time span of Atta’s transmissions. The UA 175 pilot/co-pilot reported the fact to New York Center as soon as the plane was handed off by Boston Center.  Second, I credit Atta with wanting the NAS to know there “were some planes,” to introduce uncertainty into the system, chaos if you will.

UA 175. UA 175 lifted off at about the time the assault began on AA 11.  Al Shehhi waited until the plane was in New York Center airspace before he struck.  He would have known that fact by listening to cabin channel 9.  Further, my assessment is that the plan was to hijack each plane in the airspace of a different NAS air control center.

Al Shehhi’s crew assaulted the cockpit immediately after the crew had made its report to New York Center, 28 minutes after liftoff.  As was the case with AA 11, al Shehhi was in command of UA 175 within minutes, certainly by 8:46 when the transponder code changed concurrent with the impact of AA 11 into the World Trade Center north tower.  The code changed again within a minute.

I asked the UA senior pilot to demonstrate changing the transponder code on a similar aircraft, made available for us to explore, guided by the senior pilot.  The transponder knobs were arranged as two stacks of two each.  The senior pilot demonstrated a two-step process.  The first step changed the first and third digits; the second and fourth digits then defaulted to zero.  The second step changed the second and fourth digits.  The new codes for UA 175 were 3020 and 3321, respectively.  UA 175 morphed in the air traffic control system to be a transponding intruder.

AA 77. Hanjour’s crew assaulted the cockpit a little over 30 minutes after liftoff.  There is no known correlation to the takeovers of AA 11 and UA 175, but AA 77 was hijacked soon after the takeover of UA 175 and at about the time that New York Center knew it had a problem with UA 175.  As with the other flights, the takeover was swift and sure.  Hanjour was in command by at least 8:56, when the transponder was turned off.

There is no evidence that the hijackers knew that a transponder turned off during a turn would cause the problems it did for Indianapolis Center.  The tactic was likely simply one in a series of distinct transponder manipulations designed to present a different problem set for each of four air traffic control centers.  In this case, the plane was assumed lost and reported as such to the Air Force Rescue Coordination Center.

UA 93. Jarrah was the most disadvantaged of all the hijacker pilots.  He had only three accomplices, his plane was over 40 minutes late in departing, and he and his crew waited an additional 46 minutes to assault the cockpit.

The assault occurred around 9:28 and, as in the other three cases, was swift and sure.  Within a few minutes, Jarrah was in command.  He turned off the transponder well after the turn back east, which presented little problem to Cleveland Center in maintaining spatial continuity on the aircraft.  Cleveland Center successfully used the same tactic which Boston Center tried, without success, planes in the air to sight and report UA 93’s position.

We can extrapolate that had UA 93 departed on time his takeover would have been virtually time-concurrent with the takeover of AA 77.

Assault Summary

In every case, the cockpit was secured by the hijackers within a few minutes, at most five and, more likely, two to three.  In each case, the transponder was manipulated differently, each manipulation presenting a different situation to the NAS.  With the flights commanded by terrorist pilots, it was left to their accomplices to control the cabin.  Three crews did so successfully; the fourth did not.

We do not know what the hijackers expected by way of a counterattack or if they expected one at all.  We do know the details of the counterattack and we turn to Chaos Theory for our discussion.

Chaos Theory and the Counterattack

Chaos  is deterministic.  It is not random and can be bounded.  One key to managing chaos, therefore, is to reduce the bounds and concurrently to limit uncertainty.  Chaos is also self organizing and information flow in a chaotic situation follows the path of least resistance.  Another key to managing chaos is to direct the flow of information to those who can take coordinated action, in this case Herndon Center and NEADS.

Herndon Center was established to manage chaos on a daily basis. One of its main concerns is weather, and it is no accident that one of the key positions on the Center floor is Severe Weather.  Intuitively Herndon Center knew that the flap of a butterfly’s wings somewhere would bring instability to the NAS.  Herndon Center had procedures in place to manage chaos.

NEADS was also established to manage chaos; it never knew what any given day’s activity would bring.  As with Herndon Center, NEADS had procedures in place to manage chaos.

I know of no evidence that anyone in the government or in the military had ever introduced NEADS and Herndon Center to each other prior to 9-11.  NORAD exercise scenarios speak to the testing of command and control procedures with “FAA,” but nothing apparently happened to cause the NOM and NEADS commander to pick up the phone and talk to each other.  They certainly did not do so on the morning of 9-11.

Procedures

Ben Sliney and his NAS managers had at least three procedures available to them to manage chaos: ground stops, airborne inventories, and ACARS messages to cockpits.  Herndon Center deferred to the airlines in the latter case.

Colonel Marr had specific activity centers whose sole reason for existence was to reduce uncertainty.  Foremost were the identification technicians, dedicated enlisted women and men who were under the clock to identify unknowns by reaching out to whoever had actionable information.  He also had surveillance technicians, equally dedicated enlisted men and women who were also under time constraints to track unknowns, given actionable information.  Finally, he had weapons controllers and a senior director, experienced officers, whose job was to scramble, vector, and control air defense aircraft to targets provided to them.

The Counterattack

The counterattack began at 8:25 when Boston Center declared AA 11 to be hijacked.  It ended 95 minutes later, at 10:00, when the Langley fighters established a combat air patrol over the nation’s capital.  Shortly thereafter, there was nothing more to counter–the attack had ended.

Early indicators were picked up by both Boston Center and American Airlines; both followed existing linear processes, assuming that this was a singular event that would follow historic procedures. All that changed when Atta came on the air.

Boston Center managers soon comprehended that their report of a hijack was not going to initiate hijack procedures to the military and they took matters into their own hands.  Within 13 minutes, they had figured out how to reach NEADS, both through Otis TRACON and direct to NEADS.  The air defense response began at 8:40, and planes were in the air 13 minutes later.

The knowledge that there was a second plane came at 8:53 when New York Center realized it had a problem with UA 175.  The plunge of UA 175 into the World Trade Center south tower caused the air traffic control system, working in concert with the Herndon Center, to immediately put in place a series of ground stops: Boston at 9:04, all traffic through/to New York at 9:06, with both Centers at “ATC Zero” by 9:19.

At that same time, United Airlines began sending specific warnings about cockpit intrusions to its airborne pilots.  United 93 received such a message at 9:23, according to the dispatcher.  Herndon Center considered such contact to be an airline prerogative and deferred to them.  United Airlines dispatchers had begun contacting pilots as early as 9:03, but not initially with specific warnings.  The first contact was to inform the pilots that aircraft had crashed into the World Trade Center.

With the knowledge that Atta said “we have some planes,” and with the emerging information that AA 77 had been lost by Indianapolis Center, Herndon Center initiated a nationwide ground stop at 9:25.  An order for an airborne inventory swiftly followed.

The airborne inventory confirmed that AA 77 was lost and soon surfaced that fact that UA 93 “had a bomb on board.”  The counterattack was gaining momentum but was still outside the decision cycle of the attackers.

With the further knowledge that a fast-moving unknown, in reality AA 77, was approaching the nation’s capital, Herndon Center, by 9:45, ordered all planes to land nationwide.  That mission was accomplished by 12:16, according to the Administrator’s briefing book.

Herndon Center and the Air Traffic Control System used the tools at their disposal to try and bound the problem.  They were outside the attackers’ decision cycle in every instance.  They used one of the two keys we mentioned to manage chaos.  They did not use the other: Herndon Center never talked to NEADS.  They got no help from FAA Headquarters.  FAA activated its tactical net (internal) at 8:50; it did not activate its primary net (external) until 9:20.  By then it was too late.

UA 93, A Closer Look

John Farmer in The Ground Truth used a decreasing time approach–days, minutes, hours, seconds–to tell the story of 9-11.  That approach is useful in telling the story of the counterattack as it concerned UA 93.  Recall that earlier we established that the attackers got inside the nation’s decision-making cycle and stayed there throughout the attack.  The case of UA 93 illustrates the point.

Newark Airport was ground-stopped soon after 9:00. Following added March 10, 2010. The order to ground stop Newark came at 9:04:40 in the immediate aftermath of UA 175 hitting the WTC.  The audio can be heard here. 090440 Newark Stop All Departures UA 93 was still on the ground at 8:42, some 20 23 minutes earlier.

At 9:25, Herndon Center ordered an airborne inventory.  UA 93 was hijacked beginning at 9:28, some three minutes later.  At 9:26, UA 93 asked for confirmation about the cockpit warning message from United Airlines.  A minute later, UA 93 responded to a routine air traffic control communication from Cleveland Center.  Within a minute, the attackers began the assault on the crew and then the cockpit.

The Herndon Center counterattack was well executed but never had a chance.  The advantage of being inside the nation’s decisionmaking cycle gave the attackers enough of a time cushion to overcome the late departure of UA 93.  The counterattack was gaining momentum, but it never caught up.  That left the counterattack to NEADS and, ultimately, to the passsengers and crew themselves.

The Air Defense Counterattack

The air defense backup was just four aircraft on the East Coast, two at Otis and two at Langley. No other air base, including Andrews, had the tactics, techniques, and procedures in place to respond on notice.  Some argue that Andrews should have responded.  The facts show otherwise.  It took Andrews well over an hour from time of alert to get a pair of fighters airborne and closer to two hours to get air defense-capable fighters in the air.  Even flying a circuitous route the Langley fighters accomplished the same task in 36 minutes.

We discussed the air defense response extensively in the article; “NORAD; should it and could it have done more.”  The only time that NEADS successfully tracked one of the hijacked aircraft was just before AA 77 slammed into the Pentagon.  NEADS demonstrated that within minutes, given actionable information, it was capable–information and surveillance technicians and weapons directors working as a team–of tracking a primary-only aircraft and vectoring air defense aircraft to the target.

The only other case where NEADS had any amount of time, again just minutes, was AA 11.  It is clear from the NEADS tapes that they did find AA 11 moments before impact, but personnel had no time to establish a track.

At the end of the battle, the Langley pilots were in place to respond to UA 93.  Given that Cleveland Center and Herndon Center knew where the plane was, and given NEADS’ demonstrated performance in tracking AA 11 and AA 77, it is clear that once notified, NEADS would have established an actionable track on UA 93 long before it reached its target area.  But NEADS knew nothing about UA 93 until after it plummeted to earth.

Even if the FAA had notified NEADS in sufficient time, being in place and having the authority to do something are two very different things.  It is clear that with sufficient notice NORAD could have done something; it is not clear that they should have, as they had no authority to act.

The Aftermath

NORAD segued into Operation Noble Eagle, basically to protect the barn after the horse was stolen.  There was no operational imperative for Noble Eagle other than the chilling words, “we have some planes.”  That threat led to an extended operation to protect the nation’s skies in the near term, to watch over the rebuilding of the NAS in the mid term, and to continue air defense protection for the long term.  Air Force historians will tell the story of Operation Noble Eagle; here we need describe only its genesis.

Operation Noble Eagle, an extension of the existing air defense of the nation, began the moment Colonel Marr began looking for additional assets wherever he could find them.  One of the first calls for additional help was to the Langley detachment asking how many planes they could sortie.  The answer was that they had two more planes and one more pilot.  That pilot, Quit 27, began Operation Noble Eagle when he lifted off, shortly after 9:30 on September 11, 2001.