9-11: NORAD; Should It and Could It Have Done More

NORAD was, in the minds of some, the court of last resort on 9-11 and failed to prosecute the case.  Those voices ask why it is the defender of air sovereignty failed?  NORAD had the mission and it exercised regularly, often imaginatively, yet did not recognize that the nation was in danger nor respond in time that morning.  Multiple levels and organizations of government failed long before NORAD’s opportunity came; yet some believe that it was NORAD that dropped the ball with the game on the line.

If NORAD is indeed the court of last resort, then what about the ‘courts’ that went before?  Amy Zegart in Spying Blind provides some perspective.  She wrote that the CIA had “eleven different opportunities to penetrate and possibly disrupt the…attacks.”  She further wrote that, “FBI agents had twelve opportunities to try and derail al Qaeda inside the United States before September 11.  Like the CIA, the bureau missed them all.”  Skipping over other agencies with failed opportunities—State, INS, FAA, e. g.—we can also say that the airlines had 19 opportunities and missed all of them.

A Paradigm Unchanged

An irony of the day is that despite NORAD’s imagination in planning exercise hijack scenarios none of that imagination changed the paradigm one bit.  As the 9-11 Commission concluded, 9-11 was a failure in imagination.  Part of the failure was a lack of recognition that the paradigm had changed.  The paradigm, as cited in interview after interview conducted by the Commission Staff, was that a hijacking would be a singular event with the outcome to be a safe landing somewhere for political or publicity gain.  It then became a law enforcement problem, if domestic, not a NORAD problem.

The Joint Inquiry Staff Director, Eleanor Hill, in her first public staff statement eloquently laid out the history of planes as weapons, a compilation of information available to the Intelligence Community.  She cited 12 specific examples during the period 1994 to 2001 of intelligence reporting the use of planes as weapons, eight overseas and four domestic. Separately, during the same period NORAD exercise planners were routinely creating imaginative hijack scenarios, some of which included the use of planes as weapons. Yet the translation from information reporting and imagination to real world actionable intelligence was not made.

We can point at the NORAD exercises scenarios but cannot lay the blame solely on NORAD.  If there was, in part, a NORAD failure it was that the exercise planners who came up with the scenarios were intelligence officers, members in some way of the Intelligence Community and with input to it.  Yet the Intelligence Community did not provide NORAD or anyone else an updated threat assessment that was actionable.  Amy Zegart told us in relentless detail why this is so.  To lay the blame for an unchanged paradigm at NORAD’s feet is disingenuous, at best.

The Exercise Scenarios

NORAD did imaginatively include hijacking scenarios in exercises for several years prior to 9-11.  Some of those scenarios likely had real planes scrambling to notional targets.  My exercise spreadsheet listing some of the scenarios, constructed while a member of the 9-11 staff, is clear evidence that NORAD exercise planners had thought up scenarios that, in hind sight, promised more insight than was actually the case.  The spreadsheet, however, is cryptic, out of context, and interpretation today may lead to false expectations.

One key column is “element.”  What appear to be multiple coordinated events turn out to be singular situations.  In the Vigilant Guardian series, for example, it was necessary for planners to give each NORAD sector a separate hijack situation; not necessarily linked.  So in a given year there might be as many as five different hijack scenarios, one each for the three CONUS sectors—NEADS, SEADS, WADS—the Canadian sector, CANR, and Alaska, ANR.  The spreadsheet also shows an example of sequential exercise inputs for a single scenario.  That does not mean, for example, 6 different hijackings; it means one hijacking with multiple updates in the scenario.  In sum, NORAD planners imagined descriptive scenarios but they were in most cases singular events.  No one imagined a coordinated suicide attack involving multiple hijacked aircraft.  Further to the point, nothing in the hijacking scenarios caused NORAD, operationally, to anticipate in any way the real world events that occurred on 9-11.

What is more relevant, as I look over the spreadsheet several years after its creation, is the clear intent to exercise coordination, command, and control, to include involvement of the NMCC and FAA and in several instances to use the existing hijack notification procedures.  None of that held sway on 9-11.  The hijack coordinator was never involved, the NMCC and FAA set up their own crisis conferences each under the assumption that the other was in the net, and the key conference mechanism that was apparently exercised, an Air Event Conference, was never established.  The NMCC first convened a Significant Events Conference.  Then instead of segueing to an Air Event Conference the NMCC established an Air Threat Conference.  In grappling with this, and in terms of my own work on Chaos Theory, I’m struck by Zegart’s discussion of “bounded rationality problems—making decisions with some degree of uncertainty and information about the future.”  This to me is far more important than spending time in the analytical box canyon of parsing past NORAD exercises.

Should NORAD have done more?

There could have been multiple NORAD exercises ongoing, even war games, CPX or FTX, but it didn’t matter.  Alpha and Delta Flights at NEADS knew what to do, exercise or real world.  Michael Bronner writing in Vanity Fair told the NEADS story eloquently and accurately.  Anyone seriously interested in the issue owes it to himself or herself to listen to the NEADS tapes, to hear, in real time, how NEADS responded that day.  Listen to learn how NEADS was able to balance the real world with the exercise world with relative ease.  At no time did NEADS drop the real world ball to cross over into the exercise world.  Did they acknowledge the exercise from time to time; certainly, but it had no impact.  Once Jeremy Powell established the nature of the task at 9:38 8:38 (edited Jan 6, 10) exercises went by the way side.

The nation had its first string on duty that day, these were not benchers filling in for the varsity; the varsity was on the Sector floor that day.  At least three of the NEADS personnel on duty, including their commanding officer, were on duty the last time the nation had experienced a real world hijacking, a decade earlier.  Moreover, one of the two Otis pilots on duty participated in the last domestic intercept of a real world hijacked aircraft prior to 9-11.

Further, the Air National Guard had saved the air defense mission from extinction.  Had the Guard not carved out a niche mission for itself to be the nation’s guardians at home, there would have been zero planes available that morning and no infrastructure with the tactics, techniques and procedures in place to interface with the FAA.

The Answer

In sum, the answer to the question should NORAD have done more that day (Edited Jan 6, 2010) is ‘probably not,’ with one exception.  NORAD had saved the air defense mission from extinction, the battle cabs at all echelons were fully manned, no call-up rosters were needed, and the NEADS sector floor quickly identified the attack as real world.  Should they have done more prior to 9-11 to translate the imagination shown in exercises to an awareness of what al Qaeda planned that day?  Perhaps, but that wasn’t their job alone to do.  They needed the help of the Intelligence Community and the Law Enforcement Community.  As Zegart reported, the combined Communities had a score of 0 for 23.

The Exception

NORAD should have known, based on its exercise scenarios, how to communicate with the FAA (and the NMCC) at the national level.  The failure cuts both ways, however.  FAA should also have known how to do that at its end, and it did to the extent that its procedures allowed.  FAA activated its primary net at 9:20 and did, in fact, establish communication with the NMCC. We have some insight into what happened.  Major Chambers, the officer who picked up the phone, wrote down his recollection in a personal memo. Concerning the NMCC end we also know what happened.  Because of the classification level of the Air Threat Conference Call, FAA was unable to sync and continually dropped out of the call. Added, Jan 6, 2010.  Based on NORAD exercise scenarios, the NMCC should have known about the communications issue with FAA.

Could NORAD have done more?

Unlikely.  NORAD was dependent on someone tasking them and that tasking came too late to do anything about AA 11, UA 175 and AA 77.  The cueing to NEADS came at two discrete times, 9:38 8:38 (edited Jan 6, 2010) for the northern attack against the WTC and at 9:21 for the southern attack against the nation’s capital.  Even though the southern cue was for a plane that did not exist, AA 11, it was sufficient to get the last two NEADS assets, the Langley air defense fighters, airborne and over the nation’s capital to guard against a plane they did not know about, (Edited Jan 6, 2010) the oncoming UA 93.  So, how is it they could have done more?  To answer that we need to focus on two distinct times 8:25 and 9:09.

8:25

Post facto, the FAA’s Boston Center determined that AA 11 was a hijack at 8:25.  The combination of prior factors—no radio and transponder off—simply told FAA controllers that they had an aircraft in mechanical distress, nothing more.  There should be no expectation, retrospectively, that the situation called for air defense support.  All that changed when Mohammed Atta announced, “we have some planes” at 8:24.  That and an immediately following second transmission by Atta changed the situation fundamentally and Boston Center started spreading the word.  Even though their records show that a hijack was declared at 8:25 it was not until a few minutes later that they told anyone outside of Boston Center.  By 8:34, on their own recognizance and with no authority from above, Boston Center cut through all the standing procedures and began the process of reaching NEADS directly, which they did at 8:38.

But for our purpose in determining if NORAD could have done more we need to hypothesize a perfect world. And in that world NEADS would have been notified at 8:25, the time that Boston Center determined it had a hijack situation.  We are setting aside here the fact that American Airlines had earlier information that their plane was a hijack.  There was no protocol in place for American Airlines to notify the military.

We know that with an 8:38 notification time to NEADS the Otis fighters were scrambled at 8:46, and airborne at 8:53. It is not a given that the Otis fighters would have been airborne in 15 minutes, given a call to NEADS by Boston Center at 8:25.  The intervening variable is that the Otis pilots had a heads up to the actual situation because one of the pilots happened to hear the initial 8:34 call to Cape TRACON and the pilots, in effect, put themselves on battle stations before the scramble order was broadcast.  But let’s give NORAD the benefit of the doubt.

Therefore, given an 8:25 call to NEADS—the earliest reasonable time possible–we can project that the Otis fighters would have been airborne at 8:40.  We know that their rate of progression was going to be maximum subsonic, despite what the pilots said and despite any urge by anyone to have it otherwise.  It was long established in the air defense business that a rate of progression on the order of .9 Mach was both efficient and effective.  NORAD’s own timeline published on September 18, 2001, is definitive on this point. In lay terms, and for ease of calculation, a speed of maximum subsonic approximates 9 nm per minute, 90 nm in ten minutes.

That puts the Otis fighters over New York, assuming they proceeded directly, which they did not, too late to do anything about AA 11, but just there to do something about UA 175 on its final leg.  But, what?  NEADS had no target and without a target there can be no vectoring of the fighters.  The earliest cue available from New York Center would have been the perfect, instantaneous knowledge figured out by (edit Jan 6, 2010) Pete Dave Bottiglia, the controller who equated the transponding intruder Code 3321 to UA 175.  In a perfect world, therefore, and given the authority to do so, the Otis pilots would have possibly been in position to interdict UA 175 in its final moments.  But, how, and to what end?  A considerable number of people in the greater Manhattan area, on the ground, were doomed if somehow the Otis fighters had been able to bring UA 175 down.  It was, truly, a Hobson’s choice of terrible magnitude.

Getting there and doing something are two very different things.  Once there, the target had to be found and identified, a firing or interdiction position had to be established and authority had to be given.  There was no authority in place for the Otis pilots to do anything other than act on their own.  The bravado of post facto statements aside, no one knows how the interdiction scenario might have played out; and we will never know.

9:09

The set of circumstances at this time is quite different than for the New York attack.  First, by 9:09, knowledge of the lost status of AA 77 was known to both FAA and the Air Force at locations outside both Indianapolis Center and NEADS.  No one knew where AA 77 was but the very specific knowledge that it was lost was known to the FAA’s Great Lakes Region and to the Air Force Rescue Coordination Center (RCC) at, ironically, Langley Air Force Base.  Great Lakes Region eventually shared its information with FAA and its Herndon Center.  The RCC, with no cue or reason to do otherwise, went about its business and started the search and rescue process.  Their actions subsequently led to erroneous circular law enforcement reporting the AA 77 had crashed.  Within FAA, the lost status of AA 77 apparently became the false report that AA 11 was still airborne.  Even though no one knew that AA 77 was headed to the nation’s capital from the west the alarm was sounded under the false assumption that the attack, AA 11, was coming from the north. At Langley, the certain knowledge of the lost AA 77 at RCC did not make it across the base to the air defense fighter detachment.

Further, the Langley fighters had actually been put on battle stations at 9:09 as a contingency for the New York situation.  The Mission Crew Commander wanted to scramble them; the Commanding Officer judged differently, not wanting to squander his last two air defense assets with no known target.  It was an opportunity to respond and perhaps pre-empt the developing attack on the nation’s capital, except it didn’t happen.

(Added Jan 6, 2010) We know, retrospectively, that by 9:10 the Joint Surveillance System, (the radars supporting NEADS) reacquired AA 77 as a primary only target.  Promptly cued by FAA, NEADS could have quickly established a track.  At a minimum the Langley fighters would have been scrambled.

No organization had the situational awareness to make it so.  Specifically, none of the following organizations with the ability to quickly marshal resources had actionable information; the National Military Command Center, NORAD’s Cheyenne Mountain Operations Center, the FAA’s Herndon Command Center, or the FAA’s Washington Operations Center.  The disconnect between the national level and the field is nowhere more starkly revealed than in this instance.  What Indianapolis Center, Great Lakes Region, and the RCC knew was nowhere else known where it could make a difference.

The NEADS notification about AA 11 still airborne came at 9:21; Langley fighters were scrambled at 9:24 (from battle stations, remember), airborne at 9:30 and at the decision point on where to go by 9:33, a total of 12 minutes.  The fighters were on the order of 12 additional minutes flying time from the Pentagon.  Given a 9:09 start time and even allowing time to transition to battle stations and then scramble, it is clear that they could have been in the skies over the Pentagon by the time that National TRACON established an “S” tag on the fast moving unknown that was AA 77 and, more important, by the time that the surveillance technicians at NEADS established track B32 on the same target. The problem would have been that there were only a few short minutes to find the target, establish an interdiction position, and get the authority to act.  It would have been another Hobson’s choice of terrible magnitude; the pilots would have to act on their own.  As in New York, a considerable number of people on the ground in Fairfax County, or Alexandria, or Arlington were doomed, had the pilots acted.

Recapitulation

We have shown that sufficient information was available that under near perfect circumstances would have allowed the air defenders to take positive action against UA 175 and AA 77.  They were not going to interdict AA 11 under any circumstances.  They would have been in position for UA 93, but it is not clear that they would have had the authority even then to do anything but act on their own recognizance.

We have also shown that in the case of both UA 175 and AA 77 they would have had very little time to react and that lives on the ground would have been lost.  People who argue that NORAD could have done something need to complete their thought process and acknowledge that NEADS was not going to be able to take lives in the air to save lives on the ground.

NORAD’s own analysis

General Eberhart tasked his operations research staff to do a “9-11 Excursion (AA77 and UA93),” a what-if exercise to determine what NORAD could have done.  General Eberhart did not task the same study for AA11 and UA175, but did testify before the Commission that with perfect notification from FAA NORAD could “shoot down the planes [AA11, UA175, AA77].”

The NORAD “Excursion” assumed that the Langley scramble order was given after the “2^nd WTT (sic) hit,” 9:03, with takeoff at 9:10 and arrival “on station over the NCR flying air patrol” at 9:25.  Here NORAD allowed 15 minutes flying time which is consistent with the 9:09 scenario, above, which includes the time to fly runway heading to 4000 feet altitude.  NORAD then allowed 3 minutes for the FAA notification to NEADS, based on an FAA awareness time of 9:33 and concluded that “there was at most 1.5 minutes for the F-16s to respond.”  One NORAD slide has been withheld, but looking at their discussion of UA 93 we can conclude that one of the bullets most likely covered the time to receive authority (presumably in the cockpit).  NORAD said, “The analysis of AA77 demonstrated that once the NORAD fighters have intercepted a hostile, it still takes at least four minutes to receive the authority to shoot.”

Addendum, January 30, 2010

NARA has released additional relevant information, a post facto study to determine if a more robust air defense posture from previous years would have made a difference.  The paper concludes that perhaps the continued existence of the Atlantic City site could have made a difference, but for UA 175, only.  Even so, the response time portrayed is consistent with my what-if analysis in the main article.

The paper also acknowledges that Andrews was not an alert site at any time.  Had it so been then Andrews might have had the tactics, techniques and procedures in place to respond to AA 77, again a postulation consistent with the what-if analysis in the main article.