Category: 9-11

9-11: VIVI 36; another airborne command post, not a mystery either

This short article concerns a NAOC (National Airborne Operations Center) aircraft, an E4B, stationed at Wright-Patterson AFB.  At 9:39, after the nationwide ground stop had been declared, the E4B, call sign VIVI 36, requested clearance from Patterson Tower to fly to Kennedy airport in New York.

The issue was referred to Herndon Center because of the ground stop.  Here is the primary source communication with Herndon. The caller was Indianapolis Center, ZID.   093907 VIVI 36 Patterson to JFK

The caller continually refers to the flight as “Presidential support.”

The answer soon came back that someone up the chain of command would have to make the decision.  Herndon would not allow the plane to depart.  094217 Answer to ZID on VIVI 36

Situation

The National Military Command Center (NMCC) has just segued from a Significant Events Conference to an Air Threat Conference.  The latter had SIOP (Single Integrated Operations Plan) implications according to NMCC officers that Commission Staff interviewed.

Concurrently, a decision was being made as to where the President would fly; he is on his way to the airport to board Air Force One.  At the same time, Venus 77, another E4B has told Andrews Tower it is going to take off VFR, initially declaring for either Wright Patterson or Offut and then changing its plan to fly a holding pattern over Richmond, Virginia.

There is nothing remarkable or unusual about any of this activity.  It is what we would expect the National Command Authority to be doing, given the unfolding attack, the NMCC’s activation of an Air Threat Conference, and the determination as to where it was the President should fly.  It is likely, given the VIVI 36 flight plan request, that one option on the table was for the President to fly to New York.

9-11: Transponders and Ghosts; the search for AA 11

This brief article provides additional evidence that air traffic control was looking for AA 11 after the false report that it was still airborne and possibly heading for the nation’s capital.

Washington Area Ground Stop

On a conference call shortly before 9:24, Herndon Center directed a ground stop into the D. C. metro area; National, Dulles and Baltimore.  That action followed the determination, somehow, that AA 11 was still airborne.  I am not aware of any primary source information that documents that determination.

Here are the primary source voices, recorded at Position 14, Ops phone 5154 at Herndon Center. 092354 Ground Stop DC area

Radar and TSD Search

It is clear that someone a few minutes later, most likely Herndon Center, observed on a Traffic Situation Display (TSD) that AA 11, on its original flight path, was still in the system and was, according to Herndon Center, crossing the boundary into Cleveland Center’s (ZOB) airspace.  Herndon called the ZOB Traffic Management Unit and asked if they had the plane on radar.  ZOB checked; they did not.  That exchange also occurred at Position 14, Ops phone 5154.  092815 Herndon asks Cleveland about AA11

Note that this recording also confirms Ben Sliney’s order to ground stop everything, everywhere.  The time was just approaching 9:29.

Assessment

The latter exchange is clear evidence that there were two AA 11 flight paths in the TSD system.  Recall that we established that a new track, AA 11A, had been entered to track AA 11 after it turned south in the vicinity of Albany, New York.  Conversations on tapes from New York Center (ZNY) verify that action.

It is clear from this Herndon exchange with Cleveland that the old flight plan was not removed from the system.  I recall that there was a later second call to a Midwestern Center, most likely Kansas City, posing the same question as was posed to ZOB.  I will add a link to that audio when I find it.

It has long been established that the primary source voice that announced the rebirth of AA 11 was Colin Scoggins at ZBW in a call to NEADS.  The conversations in this article show that Colin was not the only one who heard a reference to AA 11.

John Farmer and I believe, intuitively, that the false information concerning AA 11 was conflated from the report by Great Lakes Region that AA 77 had been lost.  We continue to work to resolve the issue.  My personal estimate, as I’ve voice in several articles, is that the FAA’s regional structure and its focus on incident and accident investigation, interfered with the Herndon counterattack that morning.


9-11: The Attack; A Different Perspective, Khalid Sheikh Mohammed (KSM)

Introduction

In a recent article I defined the 9-11 battlefield and discussed both the attack and the counterattack.  In this article I will build on our earlier discussion of the attack and focus specifically on one of its architects, Khalid Sheikh Mohammed (KSM).

The Moussaoui Trial

KSM “testified” at the Moussaoui Trial in an interesting way.  He spoke for the defense; his testimony is defense exhibit 941, “SUBSTITUTION FOR THE TESTIMONY OF KHALID SHEIKH MOHAMMED.”  And that raises the immediate question, “why the defense?”  The answer is straight-forward and concise.  KSM testified that “[he] denied that Moussaoui ever had a 9/11 role.”  KSM further stipulated that “Moussaoui did not know Atta and there was never any contact between the two of them.”

KSM, a problematic witness

A few voices have argued that because KSM was subjected to torture any statements attributed to him are without value.  I assess that position as naive and largely self-serving.  KSM is a valuable secondary source of information, understanding that such information was derived from interrogation.

Here is how the Moussaoui defense framed the testimony.  “You should assume that if Sheikh Mohammed were  available to testify in this courtroom under oath and subject to perjury he would have said what is contained in these statements.”  The defense further elaborated, “In evaluating the truthfulness of these statements, you should consider all other evidence in this case, including all exhibits, regardless of which side may have produced the exhibits…”

It is precisely on the point, “consider all other evidence,” that KSM’s testimony is valid and relevant.  The convergence of evidence is compelling and conclusive that the events of 9-11 occurred as reported by both the 9-11 Commission and the Congressional Joint Inquiry.  KSM’s testimony adds substance to what we already know from other primary and secondary source information.

Moreover, for those who claim that Chapter One of the Commission’s Report, “We Have Some Planes,” is flawed because it relied on information from KSM’s interrogations, consider this:  not one of 241 end notes to chapter one makes reference to KSM.  In writing the first chapter, we did not use or take into consideration the reports of KSM’s interrogations.

Atta as “Emir”

KSM stipulated, “At some point during Atta’s training, Bin Laden decided that Atta would be the “emir” of the hijackers in the U.S., with [Nawaf] a-Hazmi serving as Atta’s deputy.”  KSM recalled that “Atta was a good operative.  Atta had extensive exposure to the West, worked hard, and learned quickly.”  KSM “gave Atta enough authority that he wold not need to consult with them frequently, and would be the decision maker.”

That decentralized approach to management is one reason that the nation was caught by surprise.  Atta left no unusual trail other than an unthinking abandonment of a plane on the tarmac of Miami International Airport.  Moreover, he was able to leave the country soon after al-Midhar entered on July 4, 2001, and well after the system was “blinking red.”  Further, he was allowed to return without suspicion.

The planning was so decentralized that “The final decisions to hit which target with which plane was [sic] entirely in the hands of the pilots.  Atta informed Bin al-Shibh [of the targets] in July 2001 when they met in Spain…”

Operational Security, a Quick Comment

The totality of KSM’s testimony details good operational security; but the biggest offender in this regard was bin Laden.  We know that Atta and Moussaoui were compartmented.  KSM maintained that just six individuals knew the plot details: “Atta, Marwan al-Shehhi, Hani Hanjour, Ziad, Jarrah, Nawaf al-Hazmi, and Khalid al-Midhar.”    KSM further revealed that, “he learned of the impending date of the hijackings via courier.”  He also described the process of traveling to see bin Laden in person with specific details.

It was bin Laden who was largely responsible for the “chatter,” the series of over 30 signals intelligence (SIGINT) reports that caused the system to “blink red.”  According to KSM; “During the summer [sic], Bin Laden made several remarks vaguely hinting at an upcoming attack, which generated rumors throughout the worldwide jihadist community.”  During a speech at the al-Faruq camp, bin Laden, “urged the trainees to pray for the success of a major operation involving 20 martyrs.”  KSM stipulated that he and others were concerned “about this lack of discretion.”

Bin Laden’s lack of discretion did cause the system to “blink red” in late spring, but the attack did not proceed on the timetable he wished, nor on the timetable the counterterrorist community saw in the reporting.  Nothing happened after the flurry of SIGINT reports.  Bin Laden’s vision did not coincide with that of his chosen “Emir,” Atta.

“Blinking Red,” in perspective

When officials describe the system as “blinking red,” they are referring to the counterterrorism system.  While on the Joint Inquiry Staff I looked at all the Senior Executive Intelligence Briefs (SEIB) and Chairman, JCS, intelligence briefs for the period Mar 1-Sep 11, 2001. The intelligence system as a whole was not “blinking red.”  Was there a spike in terrorism reporting?  Yes.  Did that spike show in the overall intelligence reporting?  Yes, but as a transient, for a short period of time.

The percent of articles/briefings on terrorism was small, never more than five percent of the total reporting and usually substantially less. So what caused the spike?  I attribute it to al-Shehhi’s report immediately after he made the first terrorist cross-country orientation flight on May 24, 2001.

It is my recall that on his return al-Shehhi immediately called the Yemen number from the baggage claim area at JFK airport.  The spike in SIGINT reporting began a few days later when bin Laden compromised operational security.

April 1, 2001, an interesting date

I categorized articles/reports in about ten categories, most geographic (Eastern Europe, Middle East, e. g.), some functional (terrorism, specifically).  The plurality of briefings/articles was not on a subject you might expect; it was on China.

On April 1, 2001, the Chinese forced down a U.S. EP-3 reconnaissance aircraft on Hainan Island, a serious international incident that focused the government’s attention.  It was the first major challenge for the Bush administration.  Moreover, China was the emerging threat after the fall of the Soviet Union.

On April 1, 2001, Nawaf al-Hazmi received a speeding ticket while traveling through Oklahoma.  He was sent on his way; Hani Hanjour was likely with him.

On  April 23, 2001,  the hijacker accomplices began arriving in the United States.

Timing of the Attack

KSM testified that he “withstood pressure from Bin Laden to launch the operation earlier than planned.  The first time was in the spring of 2000, shortly after Atta and the other pilot/hijackers arrived in the U.S….”  The other two occasions were in the “Spring of 2001…”

More specifically, bin Laden wanted to strike on “May 12, 2001, exactly seven months after the bombing of the U.S.S. Cole in Yemen.”  That not being feasible, bin Laden then wanted to strike “in either June or July 2001 because [he] had learned from media reports that Ariel Sharon would be visiting the White House.”

According to KSM, he learned that “Atta had all selections and assigments finalized in late August 2001.”  As we stated earlier, KSM learned of the actual date via courier.  According to KSM, bin Laden “notified the al Qaeda Shura council that a major attack against unspecified U.S. interests was scheduled to take place over the coming weeks, but he did not reveal additional details.  His attention to operational security improved considerably, it seems.

The Targets

The overall concept was simple.  According to KSM, “Bin Laden indicated that he wanted to hit a military, political, and economic target.”  That was at a time that there were only three pilots; Hani Hanjour had not yet been identified.

KSM revealed that, later, “Bin Laden told Atta that Atta must hit both towers of the WTC, the Pentagon, and the U.S. Capitol, but that additional targets from which Atta could choose included the White House, the Sears Tower, and a foreign embassy…”  KSM also said that “the plane that crashed into the field in Pennsylvania was targeted at the Capitol building (Congress and Senate).”

According to KSM, “Hanjour was one of the best-prepared operatives sent by Sheikh Mohammed to the U.S.”  KSM told Hanjour that he wanted him “to pilot the plane that would strike the Pentagon…given that the Pentagon would be a tough target…[KSM] figured that Hanjour would be the best qualified of the pilots.”

Pilot Qualifications

Some voices argue, ethnocentrically, that the hijacker pilots were poorly trained and inadequate to the task, specifically Hanjour.  None of these voices consider the obvious point that it may well have been in the hijackers’ best interest to be perceived as inept and inarticulate; to fly under the radar screen of suspicion, so to speak.  The whole notion that, for example, Arabs cannot learn to fly is nonsensical.  For starters, I recommend that people inclined to that point of view read The Bin Ladens, An Arabian Family in the American Century, by Steve Coll.  The book describes a family that lived, and died, in the air.

The Assault

KSM testified about the camp training the so-called “muscle” hijackers received.  He explained that he “instructed the muscle hijackers to focus on seizing the cockpit first and then wory about seizing control over the rest of the plane.  The hijackers were told to storm the cockpit at the moment that the pilot cabin door opened, and to avoid trying to break down the door if necessary.”

The Results

In the end, Atta, the “emir,” took the bare bones of his assignment to hit economic, military, and politic targets and conceived and executed a tactical plan that accomplished two-thirds of his mission, with the added bonus of taking out the entire World Trade Center complex.  Atta had quality time measured in days, weeks, even months to hammer out details and discuss what-ifs with his colleague, al-Shehhi.  The attack was no casual “back-of-the envelope” affair.

Atta survived his own miscue at Miami International as well as the premature and ill-advised pronouncements of bin Laden to the Shura.  It is my assessment that he was able to do so because the operation, twice, got inside the nation’s decision-making cycle. All 19 hijackers were in country and ready for final planning and training before the government got itself organized to deal with the threat that was “blinking red.”

The last hijacker, al-Midhar arrived, ironically, on July 4, 2001, six days before a White House meeting dealing with the threat.  It took the Intelligence Community a month to deliver its assessment to the President, the August 6, President’s Daily Briefing (PDB).  I will address that briefing at the close of this article.

By that time Atta had departed and returned and Jarrah had made one last trip out of country to see his girl friend.  Both trips were dangerous in terms of operational security, but the system did not pick up the trail. Separate voices in the government were picking up the trail–in Phoenix and in Chicago.  The Counterterrorism Security Group, CSG, scheduled a key meeting on September 12, 2001.  Atta’s schedule stayed within his enemy’s decision-making cycle by just one day, and that was enough.

PDB: “Bin Ladin Determined to Strike in the U S”

On August 6, 2001, The President’s Daily Brief included a summary article on the threat.  My understanding of that article is that is was the result of guidance to the intelligence community to put the “chatter,” the “system blinking red” into perspective.  It took the community nearly a month to do the assessment, get it coordinated, and present it.

The August 6, PDB was “Defendant’s Exhibit 901, U.S v. Mouassaoui, Cr. No. 01-455A.”  As far as intelligence analysis articles go it was not all that remarkable and did not contain any specifics as to time, place, or threat.  Those who consider the document to be the “holy grail” for 9-11 miss both the point and the content of the document.  It was a summary, largely historical on the intelligence side, and vaguely reassuring on the law enforcement side.

A parallel Senior Executive Intelligence Brief (SEIB) was seen by a larger audience; mid- and senior-level officials in far better position to make an informed judgment.  The intelligence summary was, to them, old information repackaged.  What was new and not contained in the SEIB was the law-enforcement information.

(Author’s note.  My understanding of the PDB and SEIB is based on my work on the Joint Inquiry Staff.  We had a copy of the SEIB and knew what the PDB contained.  I participated in interviews of several intelligence community analyst supervisors who saw the SEIB, but not the PDB.)

9-11: The Battlefield; Attack, Counterattack, and Operation Noble Eagle

Introduction

One of my first posts was an initial Framework for Analysis.  The premise was the universally accepted fact that there was an event on September 11, 2001.  I developed a neutral framework that allowed anyone to present a body of evidence that included pre-facto, facto, and post-facto information to support their definition of the event.  No one has set forth a credible thesis that the event was anything other than a terrorist attack because there is no body of evidence to support a different conclusion.

The body of evidence assessed by both the Congressional Joint Inquiry and the 9-11 Commission is convergent and conclusive that the event of 9-11 was a terrorist attack.  Therefore, I used the framework for analysis to outline the basics of the event as a terrorist attack in my first article.

In this article, I will describe the attack in more detail and will also examine the Nation’s response.  I will again identify the battle commanders and will establish the battlefield.  Then we will discuss the attack and the government’s counterattack.  Finally, I will set the stage for the Nation’s transition to Operation Noble Eagle.  The history of that operation is being written by United States Air Force historians.

The Battlefield and the Battle Commanders

On 9-11, nineteen terrorists commandeered four aircraft to mount a multi-prong attack against the National Airspace System (NAS), the battlefield.  The NAS is a component of the larger National Transportation System.  The attack also impacted at least three other national systems; defense, preparedness (emergency response), and policy (continuity of government).  In this article I will focus on the NAS and one defense component, the U. S. air defense system.

The NAS is operated by the Federal Aviation Agency’s (FAA) Air Traffic Control System Command Center (Herndon Center), commanded by a National Operations Manager (NOM).  Benedict (Ben) Sliney was the NOM on 9-11.

The NAS is defended by the North American Aerospace Defense Command (NORAD), which is divided into regions, one of which was the Continental U. S. Region (CONR).   The east coast of the U. S. was the responsibility of one of CONR’s sectors, the Northeast Air Defense Sector (NEADS).  Air Force Colonel Robert Marr commanded NEADS on 9-11.

Sliney and Marr were the nation’s battle commanders that day.  Given that the attack on 9-11 was a battle in a larger war against terror, Sliney and Marr were the highest level personnel who could take any timely action that morning.  As we have discussed elsewhere in a series of articles on Chaos Theory, information did not flow concurrently to Sliney and Marr, or between them.  They never talked to each other during the battle.

The Flow of Information

The battle commanders did not talk to each other for two primary reasons.  First, as we have discussed elsewhere, Boston Center (ZBW) preempted the hijack protocol and, in the terminology of Chaos Theory, established ZBW and NEADS as “strange attractors,” the focal points for the exchange of relevant information.

Second, no one at a higher level, in particular the battle managers, Maj. Gen. Larry Arnold, USAF, at CONR, and Jeff Griffith at FAA Headquarters, had the situational awareness to force the flow of information to be  between NEADS and Herndon Center.  A chart I prepared while on the Commission Staff illustrates the flow of information to and from NEADS, during the period 9:21 to 10:22.  Note that the flow of information during the time that AA 77 and UA 93 were an issue was between NEADS, primarily the identification technicians, and the regional air traffic control centers.

The Attacker’s Tactical Advantage

At the strategic level, the hijacker planners achieved a basic principle of war, surprise.  The surprise was so complete that the attack proceeded as planned until the passengers and crew aboard UA 93 learned what was happening. At the tactical level, the hijackers got within the government’s decision cycle and stayed there for most of the battle.  In the vernacular, the government was always playing ‘catch up ball.’

The counter attack gained its only tactical advantage when the Langley fighters established a combat air patrol (CAP) over the Nation’s capital.  According to the 9-11 Commission Report: “At 9:46 the Command Center updated FAA headquarters that United 93 was now ‘twenty-nine’ minutes out of Washington D.C.”  The CAP began at 10:00; the projected UA 93 arrival was 10:15.

The Attack

The attack lasted for four hours and 18 minutes, beginning at 5:45 a.m. when Mohammed Atta and one accomplice entered the NAS at Portland, Maine and ending at 10:03 a.m. when UA 93 plummeted to earth near Shanksville, Pennsylvania.

Dulles, Boston, and Newark airports were the primary line of departure, and all four targeted planes were scheduled to take off in a short time span centered on the eight o’clock hour.  I have speculated elsewhere that Atta’s entry into the NAS at Portland was a preliminary line of departure, simply a “Plan B,” a contingency to ensure that if all else failed, he and one accomplice could complete one prong of a planned four-prong attack.

The attack had a northern and a southern component, each two-pronged.  In the language of Chaos Theory, that unfolded as a nonlinear double bifurcation which overwhelmed a nation determined to follow existing linear response systems.

The Tactics

The attack was a simple plan: commandeer four aircraft through violent, expedient means and fly them into buildings.  The tactics were equally simple.  A Commission Staff Report of August, 2004 summarizes events concerning the takeover and control of each hijacked plane.    First, overwhelm the crew, kill the pilots, and then fly the planes to their targets.  Second, manipulate the transponders to cause problems for air traffic control.  A previous post, “Transponders and Ghosts,” is my assessment of that tactic.

The hijackers had sufficient knowledge from their cross-country orientation flights as passengers to know the variances between scheduled and actual takeoff times.  They tended to fly United for their orientation flights, so they also knew that it was possible for United passengers to listen to flight deck air traffic control communications on cabin channel 9.  They also gained a sense of the habits and tendencies of cabin crews and knew they would be preoccupied once the seat belt light was turned off.  Further, they purchased their tickets close enough to September 11 to have some degree of confidence from long-range weather forecasts that it would be a clear day on the East Coast.  Their overall planning was meticulous, detailed, and, ultimately, successful.

The final line of departure and point of most likely failure was security screening.  We can estimate that the line crossing began around 7:00.  There is no video record of when the hijackers passed through security at either Logan or Newark.  The hijackers entering the NAS at Dulles passed through security screening beginning at 7:18 and began boarding about 30 minutes later.

That allows us to speculate that the pass through security screening began about 30 minutes prior to boarding at the other two points of departure.  That extrapolation means that al Shehhi and his crew passed through security prior to Atta and his crew; the UA 175 crew began boarding at 7:23, the AA 11 crew at 7:31.  This analysis is supported by a three-minute 6:52 call to Atta from, most likely, al Shehhi.  That was the “go” signal for al Shehhi to enter and Atta to re-enter the NAS.

(Note: bolding above added on Feb 7, 2010.  Atta had to pass through security a second time at Logan.)

The sequence of entering the NAS at Dulles provides a glimpse into the detail that went into the plan.  At Dulles, two hijackers preceded the designated pilot through the checkpoint, followed by the pilot and then the last two hijackers.

That pattern was replicated with minor variation during the boarding process.   In each case, two hijackers preceded the designated pilot on board, followed in three cases by the pilot, either alone (AA 77) or with a colleague (AA 11 and UA 175), and then followed by the rest of each crew.  The one exception was UA 93.  Jarrah was the last to board.

The first hijacker boarded at 7:23, UA 175, and the last boarded at 7:55, AA 77.   The boarding window of exposure across all four flights was just over 30 minutes.  I estimate that the window of exposure to enter the NAS, to pass through security, was about the same.

We can extrapolate that the pattern of passing through security at Logan and Newark was identical to Dulles: accomplices first, followed by the pilot and rest of the crew, in some order.  Why might this be so?  A simple answer is that the pattern did not expose the pilot immediately, allowing him the opportunity in every case to abort if his accomplices encountered difficulty.

Once the hijackers were through security and on board the aircraft, three additional distinct, measurable  events defined the attacker’s entry into the NAS; cabin door closed, push back, and liftoff.  A detailed discussion of those events is beyond the scope of this paper.  Suffice it to say that each event took the passengers and hijackers further away from local and airport security and to a point where the only security was provided by the air crew.  None of the four hijacked aircraft had an air marshal on board.

For our purposes in this paper, the time between push back and liftoff is defined as the delay time.  According to the August 2004 Commission Staff Report the average delay time for AA 11, UA 175, and AA 77 was approximately fifteen minutes.  By contrast the delay time for UA 93 was nearly three times as long, 42 minutes.  That establishes a “delta,” a delay approximating 30 minutes, the difference between expectation and reality. The UA 93 prong of the southern attack lagged well behind plan, giving the government’s counter attack a chance, as we shall later see.

AA 11 pushed back at 7:40 and lifted off at 7:59.  UA 175 pushed back at 7:58 and lifted off at 8:14.  AA 77 pushed back at 8:09 and lifted off at 8:20.  UA 93 pushed back at 8:00 and lifted off at 8:42.

Situation Summary

At this point we need to pause for a moment and take stock of the situation.  By 8:20,  three hijacked aircraft were airborne; and the fourth, UA 93, would have been if we consider the “delta” of 30 minutes.  At Herndon, Ben Sliney, in his first day as the NOM, was in a routine morning meeting.  At NEADS, Col. Bob Mar was in the battle cab, an unusual situation predicated on scheduled exercise activity for the day.  The battle cab was fully staffed, and he had a designated exercise mission crew commander, Major Dawne Deskins, USAF, to assist.

No one at any level anywhere in the government, the airlines, or on board the four targeted aircraft was aware that the attack had been underway for well over two hours and that a well-timed assault was imminent.

The Assault

AA 11. Atta struck first, quickly, a short 15 minutes or so after liftoff.  Within no more than three or four minutes, his crew secured the cockpit and Atta was in command of and flying a domestic commercial airliner.  A few moments later, he announced his success to the NAS, “we have some planes.”

Some hold that announcement to be evidence of Atta’s poor skills and ineptitude.  I find that position ethnocentrically deceptive and a gross underestimation of the terrorist threat on that day and in general.  I hold, based on Atta’s demonstrated ability to plan in detail, that his broadcast was intentional, for two reasons.

First, it was possible that al Shehhi could hear him on cabin channel 9 aboard UA 175.  There is no evidence that he did, but we do know that Atta’s transmissions “on frequency” were heard by the UA 175 crew; AA 11 and UA 175 were on the same frequency during the time span of Atta’s transmissions. The UA 175 pilot/co-pilot reported the fact to New York Center as soon as the plane was handed off by Boston Center.  Second, I credit Atta with wanting the NAS to know there “were some planes,” to introduce uncertainty into the system, chaos if you will.

UA 175. UA 175 lifted off at about the time the assault began on AA 11.  Al Shehhi waited until the plane was in New York Center airspace before he struck.  He would have known that fact by listening to cabin channel 9.  Further, my assessment is that the plan was to hijack each plane in the airspace of a different NAS air control center.

Al Shehhi’s crew assaulted the cockpit immediately after the crew had made its report to New York Center, 28 minutes after liftoff.  As was the case with AA 11, al Shehhi was in command of UA 175 within minutes, certainly by 8:46 when the transponder code changed concurrent with the impact of AA 11 into the World Trade Center north tower.  The code changed again within a minute.

I asked the UA senior pilot to demonstrate changing the transponder code on a similar aircraft, made available for us to explore, guided by the senior pilot.  The transponder knobs were arranged as two stacks of two each.  The senior pilot demonstrated a two-step process.  The first step changed the first and third digits; the second and fourth digits then defaulted to zero.  The second step changed the second and fourth digits.  The new codes for UA 175 were 3020 and 3321, respectively.  UA 175 morphed in the air traffic control system to be a transponding intruder.

AA 77. Hanjour’s crew assaulted the cockpit a little over 30 minutes after liftoff.  There is no known correlation to the takeovers of AA 11 and UA 175, but AA 77 was hijacked soon after the takeover of UA 175 and at about the time that New York Center knew it had a problem with UA 175.  As with the other flights, the takeover was swift and sure.  Hanjour was in command by at least 8:56, when the transponder was turned off.

There is no evidence that the hijackers knew that a transponder turned off during a turn would cause the problems it did for Indianapolis Center.  The tactic was likely simply one in a series of distinct transponder manipulations designed to present a different problem set for each of four air traffic control centers.  In this case, the plane was assumed lost and reported as such to the Air Force Rescue Coordination Center.

UA 93. Jarrah was the most disadvantaged of all the hijacker pilots.  He had only three accomplices, his plane was over 40 minutes late in departing, and he and his crew waited an additional 46 minutes to assault the cockpit.

The assault occurred around 9:28 and, as in the other three cases, was swift and sure.  Within a few minutes, Jarrah was in command.  He turned off the transponder well after the turn back east, which presented little problem to Cleveland Center in maintaining spatial continuity on the aircraft.  Cleveland Center successfully used the same tactic which Boston Center tried, without success, planes in the air to sight and report UA 93’s position.

We can extrapolate that had UA 93 departed on time his takeover would have been virtually time-concurrent with the takeover of AA 77.

Assault Summary

In every case, the cockpit was secured by the hijackers within a few minutes, at most five and, more likely, two to three.  In each case, the transponder was manipulated differently, each manipulation presenting a different situation to the NAS.  With the flights commanded by terrorist pilots, it was left to their accomplices to control the cabin.  Three crews did so successfully; the fourth did not.

We do not know what the hijackers expected by way of a counterattack or if they expected one at all.  We do know the details of the counterattack and we turn to Chaos Theory for our discussion.

Chaos Theory and the Counterattack

Chaos  is deterministic.  It is not random and can be bounded.  One key to managing chaos, therefore, is to reduce the bounds and concurrently to limit uncertainty.  Chaos is also self organizing and information flow in a chaotic situation follows the path of least resistance.  Another key to managing chaos is to direct the flow of information to those who can take coordinated action, in this case Herndon Center and NEADS.

Herndon Center was established to manage chaos on a daily basis. One of its main concerns is weather, and it is no accident that one of the key positions on the Center floor is Severe Weather.  Intuitively Herndon Center knew that the flap of a butterfly’s wings somewhere would bring instability to the NAS.  Herndon Center had procedures in place to manage chaos.

NEADS was also established to manage chaos; it never knew what any given day’s activity would bring.  As with Herndon Center, NEADS had procedures in place to manage chaos.

I know of no evidence that anyone in the government or in the military had ever introduced NEADS and Herndon Center to each other prior to 9-11.  NORAD exercise scenarios speak to the testing of command and control procedures with “FAA,” but nothing apparently happened to cause the NOM and NEADS commander to pick up the phone and talk to each other.  They certainly did not do so on the morning of 9-11.

Procedures

Ben Sliney and his NAS managers had at least three procedures available to them to manage chaos: ground stops, airborne inventories, and ACARS messages to cockpits.  Herndon Center deferred to the airlines in the latter case.

Colonel Marr had specific activity centers whose sole reason for existence was to reduce uncertainty.  Foremost were the identification technicians, dedicated enlisted women and men who were under the clock to identify unknowns by reaching out to whoever had actionable information.  He also had surveillance technicians, equally dedicated enlisted men and women who were also under time constraints to track unknowns, given actionable information.  Finally, he had weapons controllers and a senior director, experienced officers, whose job was to scramble, vector, and control air defense aircraft to targets provided to them.

The Counterattack

The counterattack began at 8:25 when Boston Center declared AA 11 to be hijacked.  It ended 95 minutes later, at 10:00, when the Langley fighters established a combat air patrol over the nation’s capital.  Shortly thereafter, there was nothing more to counter–the attack had ended.

Early indicators were picked up by both Boston Center and American Airlines; both followed existing linear processes, assuming that this was a singular event that would follow historic procedures. All that changed when Atta came on the air.

Boston Center managers soon comprehended that their report of a hijack was not going to initiate hijack procedures to the military and they took matters into their own hands.  Within 13 minutes, they had figured out how to reach NEADS, both through Otis TRACON and direct to NEADS.  The air defense response began at 8:40, and planes were in the air 13 minutes later.

The knowledge that there was a second plane came at 8:53 when New York Center realized it had a problem with UA 175.  The plunge of UA 175 into the World Trade Center south tower caused the air traffic control system, working in concert with the Herndon Center, to immediately put in place a series of ground stops: Boston at 9:04, all traffic through/to New York at 9:06, with both Centers at “ATC Zero” by 9:19.

At that same time, United Airlines began sending specific warnings about cockpit intrusions to its airborne pilots.  United 93 received such a message at 9:23, according to the dispatcher.  Herndon Center considered such contact to be an airline prerogative and deferred to them.  United Airlines dispatchers had begun contacting pilots as early as 9:03, but not initially with specific warnings.  The first contact was to inform the pilots that aircraft had crashed into the World Trade Center.

With the knowledge that Atta said “we have some planes,” and with the emerging information that AA 77 had been lost by Indianapolis Center, Herndon Center initiated a nationwide ground stop at 9:25.  An order for an airborne inventory swiftly followed.

The airborne inventory confirmed that AA 77 was lost and soon surfaced that fact that UA 93 “had a bomb on board.”  The counterattack was gaining momentum but was still outside the decision cycle of the attackers.

With the further knowledge that a fast-moving unknown, in reality AA 77, was approaching the nation’s capital, Herndon Center, by 9:45, ordered all planes to land nationwide.  That mission was accomplished by 12:16, according to the Administrator’s briefing book.

Herndon Center and the Air Traffic Control System used the tools at their disposal to try and bound the problem.  They were outside the attackers’ decision cycle in every instance.  They used one of the two keys we mentioned to manage chaos.  They did not use the other: Herndon Center never talked to NEADS.  They got no help from FAA Headquarters.  FAA activated its tactical net (internal) at 8:50; it did not activate its primary net (external) until 9:20.  By then it was too late.

UA 93, A Closer Look

John Farmer in The Ground Truth used a decreasing time approach–days, minutes, hours, seconds–to tell the story of 9-11.  That approach is useful in telling the story of the counterattack as it concerned UA 93.  Recall that earlier we established that the attackers got inside the nation’s decision-making cycle and stayed there throughout the attack.  The case of UA 93 illustrates the point.

Newark Airport was ground-stopped soon after 9:00. Following added March 10, 2010. The order to ground stop Newark came at 9:04:40 in the immediate aftermath of UA 175 hitting the WTC.  The audio can be heard here. 090440 Newark Stop All Departures UA 93 was still on the ground at 8:42, some 20 23 minutes earlier.

At 9:25, Herndon Center ordered an airborne inventory.  UA 93 was hijacked beginning at 9:28, some three minutes later.  At 9:26, UA 93 asked for confirmation about the cockpit warning message from United Airlines.  A minute later, UA 93 responded to a routine air traffic control communication from Cleveland Center.  Within a minute, the attackers began the assault on the crew and then the cockpit.

The Herndon Center counterattack was well executed but never had a chance.  The advantage of being inside the nation’s decisionmaking cycle gave the attackers enough of a time cushion to overcome the late departure of UA 93.  The counterattack was gaining momentum, but it never caught up.  That left the counterattack to NEADS and, ultimately, to the passsengers and crew themselves.

The Air Defense Counterattack

The air defense backup was just four aircraft on the East Coast, two at Otis and two at Langley. No other air base, including Andrews, had the tactics, techniques, and procedures in place to respond on notice.  Some argue that Andrews should have responded.  The facts show otherwise.  It took Andrews well over an hour from time of alert to get a pair of fighters airborne and closer to two hours to get air defense-capable fighters in the air.  Even flying a circuitous route the Langley fighters accomplished the same task in 36 minutes.

We discussed the air defense response extensively in the article; “NORAD; should it and could it have done more.”  The only time that NEADS successfully tracked one of the hijacked aircraft was just before AA 77 slammed into the Pentagon.  NEADS demonstrated that within minutes, given actionable information, it was capable–information and surveillance technicians and weapons directors working as a team–of tracking a primary-only aircraft and vectoring air defense aircraft to the target.

The only other case where NEADS had any amount of time, again just minutes, was AA 11.  It is clear from the NEADS tapes that they did find AA 11 moments before impact, but personnel had no time to establish a track.

At the end of the battle, the Langley pilots were in place to respond to UA 93.  Given that Cleveland Center and Herndon Center knew where the plane was, and given NEADS’ demonstrated performance in tracking AA 11 and AA 77, it is clear that once notified, NEADS would have established an actionable track on UA 93 long before it reached its target area.  But NEADS knew nothing about UA 93 until after it plummeted to earth.

Even if the FAA had notified NEADS in sufficient time, being in place and having the authority to do something are two very different things.  It is clear that with sufficient notice NORAD could have done something; it is not clear that they should have, as they had no authority to act.

The Aftermath

NORAD segued into Operation Noble Eagle, basically to protect the barn after the horse was stolen.  There was no operational imperative for Noble Eagle other than the chilling words, “we have some planes.”  That threat led to an extended operation to protect the nation’s skies in the near term, to watch over the rebuilding of the NAS in the mid term, and to continue air defense protection for the long term.  Air Force historians will tell the story of Operation Noble Eagle; here we need describe only its genesis.

Operation Noble Eagle, an extension of the existing air defense of the nation, began the moment Colonel Marr began looking for additional assets wherever he could find them.  One of the first calls for additional help was to the Langley detachment asking how many planes they could sortie.  The answer was that they had two more planes and one more pilot.  That pilot, Quit 27, began Operation Noble Eagle when he lifted off, shortly after 9:30 on September 11, 2001.


9-11: AA 77 and the Pentagon; a Personal Comment

There is in the blogosphere a mythology that denies the reality that AA 77 struck the Pentagon.  That mythology is based on speculation, innuendo, and, most of all, wishful thinking.

The supporting methodology is an intellectually dishonest and analytical unsupportable notion that snippets of information out of context can be extrapolated to a larger whole that does not exist.  Those who perpetrate and perpetuate the mythology are engaged in a self-serving exercise in futility.

Those who attempt to argue against the mythology are also engaged in an exercise in futility; they are in a ‘do-loop’ of repeated, near incessant, psuedo-science that replicates itself at repeated intervals.  There is no progess in the argument and little progess in the counter-argument.

My Position

I accept the “Pentagon Building Performance Report,” a January 2003 report sponsored by the American Society of Civil Engineers (ASCE) and the Structural Engineering Institute (added Jan 25, 2010), as definitive.  I also accept the work of Creed and Newman in Firefight to Save the Pentagon as a valuable addition to our understanding of the event and its aftermath.

I am an eyewitness to the immediate aftermath of the Pentagon attack as I wrote in one of my first articles on this website.  There is no question in my mind that the event was anything other than a terrorist attack using a plane, AA 77, as a weapon. (Edited Mar 1, 2010)  All evidence points to only one conclusion:  the strike on the Pentagon was perpetrated by terrorists, who used a plane, AA 77, as a weapon.

I am a former member of ASCE; I hold a professional engineering degree, GeolE, from the Colorado School of Mines, and joined ASCE as an undergraduate.  I understand the professional vetting that goes into an article such as the ASCE-sponsored building performance report.  The ASCE findings are comprehensive, compelling, and conclusive.  They are incorporated into the design of the Pentagon Memorial.

The Pentagon Memorial

If for any reason you are engaged in the blogosphere point/counter-point discussion about AA 77 and the Pentagon you owe yourself a visit to the Pentagon Memorial.  Sit on the bench of the youngest victim and answer for yourself  any questions you might have.

9-11: NORAD; Should It and Could It Have Done More

NORAD was, in the minds of some, the court of last resort on 9-11 and failed to prosecute the case.  Those voices ask why it is the defender of air sovereignty failed?  NORAD had the mission and it exercised regularly, often imaginatively, yet did not recognize that the nation was in danger nor respond in time that morning.  Multiple levels and organizations of government failed long before NORAD’s opportunity came; yet some believe that it was NORAD that dropped the ball with the game on the line.

If NORAD is indeed the court of last resort, then what about the ‘courts’ that went before?  Amy Zegart in Spying Blind provides some perspective.  She wrote that the CIA had “eleven different opportunities to penetrate and possibly disrupt the…attacks.”  She further wrote that, “FBI agents had twelve opportunities to try and derail al Qaeda inside the United States before September 11.  Like the CIA, the bureau missed them all.”  Skipping over other agencies with failed opportunities—State, INS, FAA, e. g.—we can also say that the airlines had 19 opportunities and missed all of them.

A Paradigm Unchanged

An irony of the day is that despite NORAD’s imagination in planning exercise hijack scenarios none of that imagination changed the paradigm one bit.  As the 9-11 Commission concluded, 9-11 was a failure in imagination.  Part of the failure was a lack of recognition that the paradigm had changed.  The paradigm, as cited in interview after interview conducted by the Commission Staff, was that a hijacking would be a singular event with the outcome to be a safe landing somewhere for political or publicity gain.  It then became a law enforcement problem, if domestic, not a NORAD problem.

The Joint Inquiry Staff Director, Eleanor Hill, in her first public staff statement eloquently laid out the history of planes as weapons, a compilation of information available to the Intelligence Community.  She cited 12 specific examples during the period 1994 to 2001 of intelligence reporting the use of planes as weapons, eight overseas and four domestic. Separately, during the same period NORAD exercise planners were routinely creating imaginative hijack scenarios, some of which included the use of planes as weapons. Yet the translation from information reporting and imagination to real world actionable intelligence was not made.

We can point at the NORAD exercises scenarios but cannot lay the blame solely on NORAD.  If there was, in part, a NORAD failure it was that the exercise planners who came up with the scenarios were intelligence officers, members in some way of the Intelligence Community and with input to it.  Yet the Intelligence Community did not provide NORAD or anyone else an updated threat assessment that was actionable.  Amy Zegart told us in relentless detail why this is so.  To lay the blame for an unchanged paradigm at NORAD’s feet is disingenuous, at best.

The Exercise Scenarios

NORAD did imaginatively include hijacking scenarios in exercises for several years prior to 9-11.  Some of those scenarios likely had real planes scrambling to notional targets.  My exercise spreadsheet listing some of the scenarios, constructed while a member of the 9-11 staff, is clear evidence that NORAD exercise planners had thought up scenarios that, in hind sight, promised more insight than was actually the case.  The spreadsheet, however, is cryptic, out of context, and interpretation today may lead to false expectations.

One key column is “element.”  What appear to be multiple coordinated events turn out to be singular situations.  In the Vigilant Guardian series, for example, it was necessary for planners to give each NORAD sector a separate hijack situation; not necessarily linked.  So in a given year there might be as many as five different hijack scenarios, one each for the three CONUS sectors—NEADS, SEADS, WADS—the Canadian sector, CANR, and Alaska, ANR.  The spreadsheet also shows an example of sequential exercise inputs for a single scenario.  That does not mean, for example, 6 different hijackings; it means one hijacking with multiple updates in the scenario.  In sum, NORAD planners imagined descriptive scenarios but they were in most cases singular events.  No one imagined a coordinated suicide attack involving multiple hijacked aircraft.  Further to the point, nothing in the hijacking scenarios caused NORAD, operationally, to anticipate in any way the real world events that occurred on 9-11.

What is more relevant, as I look over the spreadsheet several years after its creation, is the clear intent to exercise coordination, command, and control, to include involvement of the NMCC and FAA and in several instances to use the existing hijack notification procedures.  None of that held sway on 9-11.  The hijack coordinator was never involved, the NMCC and FAA set up their own crisis conferences each under the assumption that the other was in the net, and the key conference mechanism that was apparently exercised, an Air Event Conference, was never established.  The NMCC first convened a Significant Events Conference.  Then instead of segueing to an Air Event Conference the NMCC established an Air Threat Conference.  In grappling with this, and in terms of my own work on Chaos Theory, I’m struck by Zegart’s discussion of “bounded rationality problems—making decisions with some degree of uncertainty and information about the future.”  This to me is far more important than spending time in the analytical box canyon of parsing past NORAD exercises.

Should NORAD have done more?

There could have been multiple NORAD exercises ongoing, even war games, CPX or FTX, but it didn’t matter.  Alpha and Delta Flights at NEADS knew what to do, exercise or real world.  Michael Bronner writing in Vanity Fair told the NEADS story eloquently and accurately.  Anyone seriously interested in the issue owes it to himself or herself to listen to the NEADS tapes, to hear, in real time, how NEADS responded that day.  Listen to learn how NEADS was able to balance the real world with the exercise world with relative ease.  At no time did NEADS drop the real world ball to cross over into the exercise world.  Did they acknowledge the exercise from time to time; certainly, but it had no impact.  Once Jeremy Powell established the nature of the task at 9:38 8:38 (edited Jan 6, 10) exercises went by the way side.

The nation had its first string on duty that day, these were not benchers filling in for the varsity; the varsity was on the Sector floor that day.  At least three of the NEADS personnel on duty, including their commanding officer, were on duty the last time the nation had experienced a real world hijacking, a decade earlier.  Moreover, one of the two Otis pilots on duty participated in the last domestic intercept of a real world hijacked aircraft prior to 9-11.

Further, the Air National Guard had saved the air defense mission from extinction.  Had the Guard not carved out a niche mission for itself to be the nation’s guardians at home, there would have been zero planes available that morning and no infrastructure with the tactics, techniques and procedures in place to interface with the FAA.

The Answer

In sum, the answer to the question should NORAD have done more that day (Edited Jan 6, 2010) is ‘probably not,’ with one exception.  NORAD had saved the air defense mission from extinction, the battle cabs at all echelons were fully manned, no call-up rosters were needed, and the NEADS sector floor quickly identified the attack as real world.  Should they have done more prior to 9-11 to translate the imagination shown in exercises to an awareness of what al Qaeda planned that day?  Perhaps, but that wasn’t their job alone to do.  They needed the help of the Intelligence Community and the Law Enforcement Community.  As Zegart reported, the combined Communities had a score of 0 for 23.

The Exception

NORAD should have known, based on its exercise scenarios, how to communicate with the FAA (and the NMCC) at the national level.  The failure cuts both ways, however.  FAA should also have known how to do that at its end, and it did to the extent that its procedures allowed.  FAA activated its primary net at 9:20 and did, in fact, establish communication with the NMCC. We have some insight into what happened.  Major Chambers, the officer who picked up the phone, wrote down his recollection in a personal memo. Concerning the NMCC end we also know what happened.  Because of the classification level of the Air Threat Conference Call, FAA was unable to sync and continually dropped out of the call. Added, Jan 6, 2010.  Based on NORAD exercise scenarios, the NMCC should have known about the communications issue with FAA.

Could NORAD have done more?

Unlikely.  NORAD was dependent on someone tasking them and that tasking came too late to do anything about AA 11, UA 175 and AA 77.  The cueing to NEADS came at two discrete times, 9:38 8:38 (edited Jan 6, 2010) for the northern attack against the WTC and at 9:21 for the southern attack against the nation’s capital.  Even though the southern cue was for a plane that did not exist, AA 11, it was sufficient to get the last two NEADS assets, the Langley air defense fighters, airborne and over the nation’s capital to guard against a plane they did not know about, (Edited Jan 6, 2010) the oncoming UA 93.  So, how is it they could have done more?  To answer that we need to focus on two distinct times 8:25 and 9:09.

8:25

Post facto, the FAA’s Boston Center determined that AA 11 was a hijack at 8:25.  The combination of prior factors—no radio and transponder off—simply told FAA controllers that they had an aircraft in mechanical distress, nothing more.  There should be no expectation, retrospectively, that the situation called for air defense support.  All that changed when Mohammed Atta announced, “we have some planes” at 8:24.  That and an immediately following second transmission by Atta changed the situation fundamentally and Boston Center started spreading the word.  Even though their records show that a hijack was declared at 8:25 it was not until a few minutes later that they told anyone outside of Boston Center.  By 8:34, on their own recognizance and with no authority from above, Boston Center cut through all the standing procedures and began the process of reaching NEADS directly, which they did at 8:38.

But for our purpose in determining if NORAD could have done more we need to hypothesize a perfect world. And in that world NEADS would have been notified at 8:25, the time that Boston Center determined it had a hijack situation.  We are setting aside here the fact that American Airlines had earlier information that their plane was a hijack.  There was no protocol in place for American Airlines to notify the military.

We know that with an 8:38 notification time to NEADS the Otis fighters were scrambled at 8:46, and airborne at 8:53. It is not a given that the Otis fighters would have been airborne in 15 minutes, given a call to NEADS by Boston Center at 8:25.  The intervening variable is that the Otis pilots had a heads up to the actual situation because one of the pilots happened to hear the initial 8:34 call to Cape TRACON and the pilots, in effect, put themselves on battle stations before the scramble order was broadcast.  But let’s give NORAD the benefit of the doubt.

Therefore, given an 8:25 call to NEADS—the earliest reasonable time possible–we can project that the Otis fighters would have been airborne at 8:40.  We know that their rate of progression was going to be maximum subsonic, despite what the pilots said and despite any urge by anyone to have it otherwise.  It was long established in the air defense business that a rate of progression on the order of .9 Mach was both efficient and effective.  NORAD’s own timeline published on September 18, 2001, is definitive on this point. In lay terms, and for ease of calculation, a speed of maximum subsonic approximates 9 nm per minute, 90 nm in ten minutes.

That puts the Otis fighters over New York, assuming they proceeded directly, which they did not, too late to do anything about AA 11, but just there to do something about UA 175 on its final leg.  But, what?  NEADS had no target and without a target there can be no vectoring of the fighters.  The earliest cue available from New York Center would have been the perfect, instantaneous knowledge figured out by (edit Jan 6, 2010) Pete Dave Bottiglia, the controller who equated the transponding intruder Code 3321 to UA 175.  In a perfect world, therefore, and given the authority to do so, the Otis pilots would have possibly been in position to interdict UA 175 in its final moments.  But, how, and to what end?  A considerable number of people in the greater Manhattan area, on the ground, were doomed if somehow the Otis fighters had been able to bring UA 175 down.  It was, truly, a Hobson’s choice of terrible magnitude.

Getting there and doing something are two very different things.  Once there, the target had to be found and identified, a firing or interdiction position had to be established and authority had to be given.  There was no authority in place for the Otis pilots to do anything other than act on their own.  The bravado of post facto statements aside, no one knows how the interdiction scenario might have played out; and we will never know.

9:09

The set of circumstances at this time is quite different than for the New York attack.  First, by 9:09, knowledge of the lost status of AA 77 was known to both FAA and the Air Force at locations outside both Indianapolis Center and NEADS.  No one knew where AA 77 was but the very specific knowledge that it was lost was known to the FAA’s Great Lakes Region and to the Air Force Rescue Coordination Center (RCC) at, ironically, Langley Air Force Base.  Great Lakes Region eventually shared its information with FAA and its Herndon Center.  The RCC, with no cue or reason to do otherwise, went about its business and started the search and rescue process.  Their actions subsequently led to erroneous circular law enforcement reporting the AA 77 had crashed.  Within FAA, the lost status of AA 77 apparently became the false report that AA 11 was still airborne.  Even though no one knew that AA 77 was headed to the nation’s capital from the west the alarm was sounded under the false assumption that the attack, AA 11, was coming from the north. At Langley, the certain knowledge of the lost AA 77 at RCC did not make it across the base to the air defense fighter detachment.

Further, the Langley fighters had actually been put on battle stations at 9:09 as a contingency for the New York situation.  The Mission Crew Commander wanted to scramble them; the Commanding Officer judged differently, not wanting to squander his last two air defense assets with no known target.  It was an opportunity to respond and perhaps pre-empt the developing attack on the nation’s capital, except it didn’t happen.

(Added Jan 6, 2010) We know, retrospectively, that by 9:10 the Joint Surveillance System, (the radars supporting NEADS) reacquired AA 77 as a primary only target.  Promptly cued by FAA, NEADS could have quickly established a track.  At a minimum the Langley fighters would have been scrambled.

No organization had the situational awareness to make it so.  Specifically, none of the following organizations with the ability to quickly marshal resources had actionable information; the National Military Command Center, NORAD’s Cheyenne Mountain Operations Center, the FAA’s Herndon Command Center, or the FAA’s Washington Operations Center.  The disconnect between the national level and the field is nowhere more starkly revealed than in this instance.  What Indianapolis Center, Great Lakes Region, and the RCC knew was nowhere else known where it could make a difference.

The NEADS notification about AA 11 still airborne came at 9:21; Langley fighters were scrambled at 9:24 (from battle stations, remember), airborne at 9:30 and at the decision point on where to go by 9:33, a total of 12 minutes.  The fighters were on the order of 12 additional minutes flying time from the Pentagon.  Given a 9:09 start time and even allowing time to transition to battle stations and then scramble, it is clear that they could have been in the skies over the Pentagon by the time that National TRACON established an “S” tag on the fast moving unknown that was AA 77 and, more important, by the time that the surveillance technicians at NEADS established track B32 on the same target. The problem would have been that there were only a few short minutes to find the target, establish an interdiction position, and get the authority to act.  It would have been another Hobson’s choice of terrible magnitude; the pilots would have to act on their own.  As in New York, a considerable number of people on the ground in Fairfax County, or Alexandria, or Arlington were doomed, had the pilots acted.

Recapitulation

We have shown that sufficient information was available that under near perfect circumstances would have allowed the air defenders to take positive action against UA 175 and AA 77.  They were not going to interdict AA 11 under any circumstances.  They would have been in position for UA 93, but it is not clear that they would have had the authority even then to do anything but act on their own recognizance.

We have also shown that in the case of both UA 175 and AA 77 they would have had very little time to react and that lives on the ground would have been lost.  People who argue that NORAD could have done something need to complete their thought process and acknowledge that NEADS was not going to be able to take lives in the air to save lives on the ground.

NORAD’s own analysis

General Eberhart tasked his operations research staff to do a “9-11 Excursion (AA77 and UA93),” a what-if exercise to determine what NORAD could have done.  General Eberhart did not task the same study for AA11 and UA175, but did testify before the Commission that with perfect notification from FAA NORAD could “shoot down the planes [AA11, UA175, AA77].”

The NORAD “Excursion” assumed that the Langley scramble order was given after the “2nd WTT (sic) hit,” 9:03, with takeoff at 9:10 and arrival “on station over the NCR flying air patrol” at 9:25.  Here NORAD allowed 15 minutes flying time which is consistent with the 9:09 scenario, above, which includes the time to fly runway heading to 4000 feet altitude.  NORAD then allowed 3 minutes for the FAA notification to NEADS, based on an FAA awareness time of 9:33 and concluded that “there was at most 1.5 minutes for the F-16s to respond.”  One NORAD slide has been withheld, but looking at their discussion of UA 93 we can conclude that one of the bullets most likely covered the time to receive authority (presumably in the cockpit).  NORAD said, “The analysis of AA77 demonstrated that once the NORAD fighters have intercepted a hostile, it still takes at least four minutes to receive the authority to shoot.”

Addendum, January 30, 2010

NARA has released additional relevant information, a post facto study to determine if a more robust air defense posture from previous years would have made a difference.  The paper concludes that perhaps the continued existence of the Atlantic City site could have made a difference, but for UA 175, only.  Even so, the response time portrayed is consistent with my what-if analysis in the main article.

The paper also acknowledges that Andrews was not an alert site at any time.  Had it so been then Andrews might have had the tactics, techniques and procedures in place to respond to AA 77, again a postulation consistent with the what-if analysis in the main article.

9-11: The Andrews Fighters; standing up, not so easy

Recently, a 9-11 researcher posted this article, “The 90-Minute Stand Down on 9/11:  Why was the Secret Service’s Early Request for Fighter Jets Ignored?” My initial instinct was to let my article on the Andrews fighters stand and not comment.  However, it later occurred to me that the article has considerable utility because it tells the beginning of the Andrews story, something I did not do in my article.  However, the author has the thesis backwards.

Standing Down or Standing Up?

It is intuitively obvious that there cannot be a stand down without a preceding stand up.  What the author actually reports are early attempts to stand up the Andrews fighters.  He reports conversations involving staff officers at four locations; the Secret Service, FAA Headquarters, Andrews Tower, and the fighter wing, itself.  The only actionable conversation is the one between the late General Wherley and the Secret Service.  General Wherley, however, was not a battle commander that morning.

In other articles we have talked about the battle commanders; Ben Sliney and Colonel Bob Marr.  None of the conversations referenced in the article involve either person or their staffs.  Nor do they involve the only other organization that could take action, the NMCC.  It would not have made any difference, the Andrews fighters were not relevant to the nation’s air defense that day.

Roles and Missions

We have gone over this before.  The only organization with the air defense mission was NORAD.  The only assets performing the role were four dedicated fighters, two at Otis and two at Langley.  Andrews was never seriously considered for good reason.

Major Chambers summed up the NMCC perspective; the Andrews fighters were not part of the air defense system and not available.   NEADS never considered the Andrews fighters because the Andrews Wing did not have the tactics, techniques and procedures in place to perform the role.  Moreover, they did not carry authentication tables, according to the pilots the Commission Staff interviewed.

Further, NEADS had the New York and DC skies covered by its own fighter assets.  Concurrent with the conversations referenced in the article, Colonel Marr started his own search for additional assets, but his focus was on the Midwest.  The only additional threat of which he was aware was D 1989.  NEADS had no immediate need for the Andrews fighters.

The Critical Moment

A few minutes after 9:30 Danielle O’Brien and her supervisor sounded the alarm about the fast approaching unknown (AA 77).  Shortly thereafter, and in part because of the preliminary conversations referenced, General Wherley took action, prompted by the Secret Service.  Even so, he wanted to hear from someone higher up in the food chain than the person calling him.

Concurrently, NEADS was redirecting the wayward Langley fighters and followed that redirection with a declaration of AFIO, Authority For Intercept Operations.  The Langley fighters established a combat air patrol over the nation’s capital at 10:00, 36 minutes from time of scramble.

Standing Up Andrews

It should come as no surprise to anyone familiar with the roles and missions of the United States armed forces why the Andrews fighters were never a factor and were not tasked by the military chain of command that morning.  They could not, and demonstrably did not, respond in any meaningful time frame.  To do so was beyond their capability.

That is not a knock on the Andrews Wing, their personnel or their pilots.  They worked diligently to get assets airborne, once tasked.  It took them over an hour to do so and that was as fast as they were going to be able to do it under any scenario that day.

Correcting the Math

The referenced article headlines a 90-minute stand down.  Assuming that the clock starts about 9:05 the activities described became actionable by 9:35 when General Wherley was directly tasked by the Secret Service.  The implied 90 minute stand down was actually a 30-minute prelude to a concerted Andrews effort to get fighters in the sky, to stand up.  The best they could do was to launch a single sortie over an hour later; a pilot with virtually no fuel, no armament, and no authority.

A Final Comment

I appreciate the author’s initiative and effort.  He provides specificity concerning staff level discussions about protecting the nation’s capital in the immediate aftermath of the impact of UA 175 and the FAA’s determination that Atta said, “we have some planes.”

And a Postscript

The Washington Post, shortly after release of the Commission Report, published an editorial cartoon that portrayed the USAF and the Secret Service ‘Air Force’ butting heads in the sky.  I have not been able to find a link to that prescient cartoon.

9-11: NEADS MCC/T Log; a definitive secondary source

In previous articles we discussed the Mission Crew Commander/Technician (MCC/T) log kept at NEADS.  The purpose of this article is to provide historians, researchers, and other interested persons additional information about that important document.

It is the definitive secondary source document of the day to establish what NEADS knew and when they knew it.  Why definitive?  Because it is validated and verified by definitive primary sources, the NEADS and FAA tapes.

Explanation of copies of the log

My estimate is that the Commission Staff archived as many as three copies of the MCC/T log.  I archived one and it is likely that the New York office archived an additional copy.  Dana Hyde archived a third, unannotated copy.  The copy I linked in an earlier article was annotated by either Geoff Brown or John Azarrello while we were at NEADS; that is not my handwriting.

I note that we must have discussed the log with the several non-commissioned officers who performed the MCC/T duty that morning.  We established who made what entries via the handwriting.  For example, “Sgt Bianchi” made the 1324 entry.  Sgt Bianchi’s entries begin at 1240, the initial call from Boston Center.  He turned over the log to Sgt Perry sometime between 1401 and 1407.

A master copy of the log, as forwarded to the Commission via DoD, will ultimately be available when NARA uploads the Commission’s master paper files.  In the interim, the copy archived by Dana Hyde is an accurate rendition of the original log book, less redactions made by NARA.

The original log book, a general purpose ledger available in any office supply store, was and likely still is maintained in a safe at NEADS.  Each morning during our visits the NEADS staff would deliver the original to us for use during interviews; it was returned to them at the end of each day.  The approximate one-inch thick ledger was difficult to copy.  Readers familiar with the process will note that the book was opened to the relevant pages and copied under pressure to flatten the pages as much as possible.

Helpful background

Much work on the NEADS floor was accomplished by trained, experienced non-commissioned officers.  Each of the two key officers, the MCC, Major Nasypany, and the Senior Director, Major Fox, had such senior non-commissioned officers to constantly assist them.

For example, those familiar with the NEADS tapes will recognize that every scramble order that morning was broadcast by Sgt Powell, the SD/T.  Major Nasypany had three MCC/T on duty at various times, Sgt Bianchi, Sgt Perry, and Sgt McCain.

It is worth noting that McCain, Powell, Fox, and the Commander, Colonel Bob Marr, were all on duty the day of the Lufthansa hijacking a decade earlier.  This was an experienced crew, they knew what they were doing.

MCC/T log accuracy

Each critical entry was accurately posted, probably no longer than a minute or two after the fact.  For example, consider the first notification of the day, the call from Boston Center concerning AA 11.  That call was picked up by Sgt Powell a few seconds before 9:38.  It took a minute or two to gain actionable information.  We do not know when Sgt Bianchi actually made the log entry, but we do know that he determined the entry to be 8:40.

That pattern of accurate log entries by Sgt Bianchi continued.  He established the notification time for UA 175 as 9:05 and the notification time for AA 77 as 9:34; both consistent with the primary source audio files.  That pattern continued with Sgt Perry who recorded a notification time for UA 93 as 10:07.

Serious researchers, writers, and historians will appreciate and accept the work done by the non-commissioned officers, the ‘Technicians,’ at NEADS.

A key document thrice misinterpreted.

NEADS staff misread the MCC/T log in their initial review and established a notification time for AA 77 as 9:24, despite primary and secondary source information to the contrary.

NEADS staff again misread the MCC/T log  five days later under questioning by CONR and failed to accurately inform General Moore about the AA 77 notification as he was consulting with FAA, which knew the 9:24 time was not supportable.

NEADS staff, together with Col Scott, again misread the MCC/T log in preparation for the May 23, 2003 air defense hearing before the Commission.  It is then that an erroneous hijack time of 9:16 for UA93 was entered into the public record by NORAD.

9-11: NEADS tapes and logs; an update

This update provides additional information concerning NEADS primary source information, the NEADS tapes, and secondary source information, the NEADS logs.  Specifically it addresses the question of whether NORAD/CONR/NEADS reviewed relevant documents prior to the White House meeting on September 17, 2001 and the subsequent release of the NORAD timeline on September 18, 2001.  The answer is yes they did.

The Moore email and response

John Farmer in The Ground Truth wrote that “the Commission staff obtained the e-mail…sent late in the evening of September 16, 2001, from Brigadier General Doug Moore at CONR, under General Arnold’s command, to NEADS.”  That email exchange is available at the History Commons Scribd web site.

Moore was asking for additional clarification to pass to FAA to use “to brief the White House tomorrow.”  The night Director of Operations (DO) at NEADS, Clark Speicher, did the research and provided the answer.  At the time, Col Clark Speicher was the Deputy Commander, NEADS.  He reported directly to the NEADS Commander, Col Bob Marr.

AA 77 notification time to NEADS

Moore posed this question: “AA 77 1324Z, Which FAA organization passes notification of ‘a possible track heading to DC’?”  Clearly, CONR/NORAD wanted that pinned down.  Speicher responded, citing , in part, his research: “I have reviewed the crew MCC log book…The MCC log reveled (sic) the following:  “1st question: AA 77, 1342Z: (emphasis added) Boston FAA says another A/c is missing AA77 flight to LA lost unable to contact.”  However, my notes taken directly from the MCC/T log book reflect that the time was actually 13:34 (9:34), as recorded at NEADS.  Col Speicher and NEADS got the entry right, but not the time.

Further, the MCC/T log book never mentioned AA 77 at 9:24 and Speicher did not confirm to Moore a 9:24 entry concerning the tail number of AA 11 which NEADS originally conflated to be AA 77.  That original conflation is what Moore was now questioning.  He did not get a direct answer to his original question.

In the rush of the moment NEADS and CONR made two errors.  First, Col Speicher provided an incorrect time to Col Moore which appeared to simply transpose two digits.  Second, Col Moore was in contact with FAA and knew that they could not support a notification time of 9:24, as we have discussed in recent articles concerning AA 77.  Moore stayed with the original time of 9:24; he was not given a true reading  of the accurate 1334 (9:34) entry.  FAA apparently did not force the issue.

Additional information concerning the NEADS tapes

Col Speicher provided this additional information on the NEADS review.  First, he established that NEADS did review the tapes.  “…one of our MCC’s and I reviewed the audio tapes to answer your questions.”

Second, he detailed the difficulty and complexity of the tape review process.  “We spent six hours trying to retrieve data from the voice tapes but the system has 24 channels recording two postions each channel and four tapes total from the llth.”  He further elaborated: “the system is complex…it is rather cumbersome so analyzing the information is difficult to say the least.”

In the latter part of September, 2001, NEADS brought in a technician to try and transcribe the tapes.  It is his work that became the NEADS partial transcript provided to the Commission.  During his work one of the tapes was thought to be accidentally erased and his task was terminated and never completed.

Additional information about NORAD preparation for the May 2003 air defense hearing

A detailed radar review was accomplished by NORAD Headquarters to assist General McKinley, General Arnold, and, specifically, Col Scott in preparation for their May 23, 2003, testimony.  Graphics related to that review have been made available by NARA.

Two things are noteworthy.  First the FAA notification time for AA 77 continued to be 9:24.  Second, accurate paths for the Otis and Langley fighters were provided to Col Scott.  He blurred them as I wrote in a previous article.

My perspective

I told both Michael Bronner and Phil Shenon during interview that my personal estimate was that the NORAD Generals were victims of shoddy staff work.  That remains my perspective.  The Colonels let the Generals down.  The Generals did not put the Colonels ‘through the hoops,’ they trusted them to get it right.

9-11: UA 93; an air traffic control trilogy, part 2

Addendum, December 1, 2009.

Here is a Google Earth plot of the final radar returns from UA 93 as received at The Plains radar site and provided by 84th RADES.

UA93 Final Radar Returns
UA93 Final Radar Returns

The blue pins depict primary returns.  The green pin depicts the first recording of the transponder back on.  Green represents a reinforced return, radar and beacon (transponder).  The red pin depicts the second and final transponder return, beacon only.

This is the air traffic control story of UA 93, told in the primary source voices of the day, and we begin with part 2, the Herndon Command Center story.  The next two articles will tell the same story from the Cleveland Center (ZOB) perspective,  Part 1,   Then, in Part 3, we will the FAA’s Washington Operations Center story, as told to them by air traffic control.  There will be at least one additional article to tell the story after it leaves the domain of air traffic control.

First notice to Herndon

The story begins at 09:49 when Margaret at the Herndon Severe Weather position convenes a conference with Washington Center, ZDC, at the request of Cleveland and Chicago.  The purpose is to address the issue of the Attorney General’s return to Washington.  Cleveland breaks in to tell Chicago about Delta 1989.  That conversation is at this link. ZDC ZOB Herndon Chicago Teleconference

The conversation immediately continues and by 9:50 Cleveland Center has also put Washington Center on alert but about a different airplance, UA 93.  That continued conversation is at this link.  ZOB alerts ZDC about UA 93

After a short pause ZOB estimates a UA 93 arrival in 25 minutes to Dulles (approximately 9:16).  Concurrently, ZOB updates both Chicago and ZDC as to the status of both D 1989 and UA 93.  That continuation is at this link.  ZOB updates D 1989 and UA 93

Some researchers have speculated that FAA was treating one of the two aircraft but not the other as a hijack; that the two were somehow confused by air traffic control.  It is clear from the primary source information that the two situations were distinct and clearly separated by Cleveland Center in its reporting to adjacent centers and to Herndon.  There was no confusion within the system as to which was which.   The status of D 1989 was never conflated with UA 93 by FAA.

Conversation continues at 09:53

The situation continues as ZOB updates all participants on the status of both airplanes.  Margaret informs ZOB that Herndon knew about UA 93 but not about D 1989 and she will pass the word.  That update can be heard at this link.  ZOB Undates Participants at 0953

D 1989 apparently resolved

In a conversation at 9:56 Herndon determines that D 1989 is not a ‘trip,’ that he is fine and that he is going to Cleveland.  In this conversation we learn that the concern about D 1989 originated with Boston Center, ZBW.  That conversation can be heard at this link.  ZOB D 1989 Going to Clevelend

Real time updates on UA 93

By 9:58 ZOB enters a new flight plan for UA 93 to assist ZDC.  ZDC acknowledges and sees the airplane at their TMU desk.  ZOB is trying as best it can to associate tracking information with the data blocks.  They did not have an altitude.

The implication is that ZDC can see the plane on radar as long as it is flying and can track the flight plan on a TSD display.  The exchange of information between the TMU at ZOB and the TMUat ZDC can be heard at this link.  ZOB UA 93 new flight plan and alert to ZDC.  I should note here that when I observed the TSD playback of 9-11 at Herndon Center the icon for UA 93 visably jumped on the screen to its new location as determined by ZOB.

Shortly thereafter, in the 9:59 time frame,  ZOB did obtain altitude information on UA 93 from a VFR aircraft.  That information can be heard at this link.  ZOB reports altitude on UA 93 Whenever Ricky Bell at Severe Weather keeps the microphone open you can hear voices in the background.  We will cover that in Part 3 when we talk about Herndon continuously updating FAA Headquarters.

Next, ZOB provides altitude and heading information in real time to Herndon.  You can, again, hear voices in the background and you hear Ricky Bell repeating information as he hears it so that others at Herndon are aware.  This minute long conversation segment  begins approximately 10:00 and can be heard at this link.  ZOB provides location and heading for UA 93

From 10:01 to 10:02 the real time updates report erratic flying.  That near one minute conversation segment can be heard at this link.  ZOB reports erratic flying

UA 93 transponder back on

The UA 93 transponder did come back on, briefly for two sweeps just  before 10:03.  84th RADES radar lost coverage on the plane soon after 9:47, but reacquired the aircraft near the end of its flight.  Radar data from The Plains radar shows the transponder back on for just two radar returns.  Based on those two returns the aircraft dropped at a significant rate.  It was in extremis.  The last recorded RADES radar return is at 10:02:57 at 6100 feet altitude.  Location was 40 040 04N 78 55 02W.

ZOB describes the transponder event to Herndon as heard on this link.  ZOB Reports Transponder Back On.  The ZOB report is time consistent and altitude consistent with RADES radar.  ZOB reports an altitude of 8200 feet when the transponder came back on.  The RADES radar files show an altitude of 7800 feet at that time.

Here is a circa Summer 93 graphic I prepared concerning UA 93.  My complete set of UA 93 powerpoint slides has been uploaded to the History Commons Scribd site; I can’t find the link for now, and is available at this link.

UA 93 Final Radar Returns
UA 93 Final Radar Returns

UA 93 lost by ZOB

Just before 10:03 ZOB reports losing UA 93 on radar except for one primary return.  ZOB defers to ZDC as can be heard at this link.  ZOB losing UA 93 on radar

A few moments later Herndon reconnects with ZOB to ask about both UA 93 and D 1989.  Herndon learns that ZOB has lost UA 93; it was last headed toward Washington.  Herndon also learns at the same time that D 1989 is not a hijack.  That exchange can be heard at this link.  ZOB advises UA 93 lost D1989 not a hijack

And, to finish off part 2 of this trilogy, at 10:10 ZOB and Herndon have a concluding converstion that reaffirms that ZOB has lost UA 93 on radar and that D 1989 is not a hijack.  This conversation segment provides additional insight in how Herndon was operating and what it knew.  ZOB Herndon Discusses Both Planes

Observations in real time

First, at no time at the desk level, do air traffic control personnel speak to or even mention contacting the military.  That is to be expected, their job was to track and report.

Second, at no time did Herndon or ZOB conflate information concerning UA 93 and D 1989.  Both planes were monitored distinctly and separately and reported that way.  FAA up to the Herndon level had situation awareness in real time.  Researchers who argue differently are simply wrong.

Third, separately, ZOB is learning of the fate of UA 93 and we will discuss that in Part 1 of this trilogy.  For now, the embedded graphic provides useful data points.  Gofer 06 soon after turning north at ZOB direction reported shortly after 10:04 that the pilot saw smoke in the direction of UA 93.  The private jet, N20VF? on the graphic, was vectored by ZOB to the crash site.  The Falcon circled once and provided GPS coordinates around 10:14.

Finally, at the national level. Norman Mineta is arriving at the PEOC during the final moments of UA 93.  Subsequently he will receive information from Monte Belger about that aircraft, most likely as seen on a TSD display.  That track, terminating at Reagan National at 10:28 is a ghost and has been since shortly after 10:03.

That begs a question.  Given that Herndon had near real time information and was immediately passing that information to FAA Headquarters, how was that being passed, if at all, to the national level?  We will grapple with that in Part 3.  For now I would simply point out that the SVTS link was activated at 9:25 and Richard Clarke convened the conference soon after 9:40.  He wrote in Against All Enemies, “Okay, I began.  Let’s start with the facts.  FAA, FAA, go.”  Jane Garvey was at the FAA end.

What do we make of that?

I am separately publishing articles on the linear processes the government attempted to use that day.  So far I have spoken to NOIWON.  Once I get an Air Threat Conference article out I will then turn to SVTS.  Suffice it to say for now that, as I’ve elsewhere attributed to an NMCC staff officer, the SVTS process was counter-productive.

So, I will speak to SVTS, probably before I write Part 3 of this air traffic control trilogy concerning UA 93.

At some point, of course, we will ultimately need to address the Mineta story.