NORAD (9)

Lieutenant Colonel Dawne Deskins and other day shift employees at NORAD’s Northeast Air Defense Sector (NEADS) in Rome, NY, start their workday. NORAD is conducting a week-long, large-scale exercise called Vigilant Guardian. [Newhouse News Service, 1/25/2002] Deskins is regional mission crew chief for the Vigilant Guardian exercise. [ABC News, 9/11/2002]

Exercise Includes Simulated Attack on the US - Vigilant Guardian is described as “an exercise that would pose an imaginary crisis to North American Air Defense outposts nationwide”; as a “simulated air war”; and as “an air defense exercise simulating an attack on the United States.” According to the 9/11 Commission, it “postulated a bomber attack from the former Soviet Union.” [Newhouse News Service, 1/25/2002; Filson, 2003, pp. 55 and 122; 9/11 Commission, 7/24/2004, pp. 458] Vigilant Guardian is described as being held annually, and is one of NORAD’s four major annual exercises. [Filson, 2003, pp. 41; Arkin, 2005, pp. 545; GlobalSecurity (.org), 4/27/2005] However, one report says it takes place semi-annually. [Aviation Week and Space Technology, 6/3/2002] Accounts by participants vary on whether 9/11 is the second, third, or fourth day of the exercise. [Code One Magazine, 1/2002; Newhouse News Service, 1/25/2002] Vigilant Guardian is a command post exercise (CPX), and in at least some previous years was conducted in conjunction with Stratcom’s Global Guardian exercise and a US Space Command exercise called Apollo Guardian. [US Congress, n.d.; Arkin, 2005, pp. 545; GlobalSecurity (.org), 4/27/2005] All of NORAD is participating in Vigilant Guardian on 9/11. [Aviation Week and Space Technology, 6/3/2002]

Exercise Includes Simulated Hijacking - Vanity Fair reports that the “day’s exercise” (presumably Vigilant Guardian) is “designed to run a range of scenarios, including a ‘traditional’ simulated hijack in which politically motivated perpetrators commandeer an aircraft, land on a Cuba-like island, and seek asylum.” [Vanity Fair, 8/1/2006]

NORAD Fully Staffed and Alert - NORAD is currently running a real-world operation named Operation Northern Vigilance, and may also be conducting a field training exercise called Amalgam Warrior. NORAD is thus fully staffed and alert, and senior officers are manning stations throughout the US. The entire chain of command will be in place and ready when the first hijacking is reported. An article later says, “In retrospect, the exercise would prove to be a serendipitous enabler of a rapid military response to terrorist attacks on September 11.” [Aviation Week and Space Technology, 6/3/2002; Bergen Record, 12/5/2003] Colonel Robert Marr, in charge of NEADS, will say: “We had the fighters with a little more gas on board. A few more weapons on board.” [ABC News, 9/11/2002] However, Deskins and other NORAD officials later are initially confused about whether the 9/11 attacks are real or part of the exercise (see 8:38 a.m.-8:43 a.m. September 11, 2001).

As the 9/11 attacks are taking place, a large military training exercise called Global Guardian is taking place. Global Guardian is an annual exercise sponsored by US Strategic Command (Stratcom) in cooperation with US Space Command and NORAD. One military author defines Stratcom as “the single US military command responsible for the day-to-day readiness of America’s nuclear forces.” [Arkin, 2005, pp. 59]

Exercise Tests Military’s Ability to Fight a Nuclear War - Global Guardian is a global readiness exercise involving all Stratcom forces and aims to test Stratcom’s ability to fight a nuclear war. It is one of many “practice Armageddons” that the US military routinely stages. [Bulletin of the Atomic Scientists, 11/1/1997; Associated Press, 2/21/2002] It links with a number of other military exercises, including Crown Vigilance (an Air Combat Command exercise), Apollo Guardian (a US Space Command exercise), and the NORAD exercises Vigilant Guardian and Amalgam Warrior. [US Department of Defense, 5/1997; GlobalSecurity (.org), 4/27/2005] Global Guardian is both a command post and a field training exercise, and is based around a fictitious scenario designed to test the ability of Stratcom and its component forces to deter a military attack against the US. Hundreds of military personnel are involved. [US Congress, n.d.; Collins Center Update, 12/1999] The exercise involves “a lot of the elements of what ultimately would be the nuclear command and control system in support of a national emergency,” according to Admiral Richard Mies, the commander in chief of Stratcom. It includes an “exercise secretary of defense” and “an exercise president.” Mies will say that because of the exercise, “A lot of [Stratcom’s] command and control systems that, in peacetime, are normally not on alert were at a much, much higher state of alert [on September 11] and we had a number of aircraft, manned control aircraft that were airborne that were simulating their wartime roles.” [NET News, 12/27/2011]

Exercise Normally Held in October or November - According to a 1998 Internet article by the British American Security Information Council—an independent research organization—Global Guardian is held in October or November each year. [Kristensen, 10/1998] In his book Code Names, NBC News military analyst William Arkin dates this exercise for October 22-31, 2001. [Arkin, 2005, pp. 379] A military newspaper reported in March 2001 that Global Guardian was scheduled for October 2001. [Space Observer, 3/23/2001, pp. 2] If this is correct, then some time after March, the exercise must have been rescheduled for early September.

Exercise Includes a ‘Computer Network Attack’ - Furthermore, a 1998 Defense Department newsletter reported that for several years Stratcom had been incorporating a computer network attack (CNA) into Global Guardian. The attack involved Stratcom “red team” members and other organizations acting as enemy agents, and included attempts to penetrate the command using the Internet and a “bad” insider who had access to a key command and control system. The attackers “war dialed” the phones to tie them up and sent faxes to numerous fax machines throughout the Command. They also claimed they were able to shut down Stratcom’s systems. Reportedly, Stratcom planned to increase the level of computer network attack in future Global Guardian exercises. [IAnewsletter, 6/1998] It is unclear if a computer network attack is incorporated into Global Guardian in 2001.

The FAA’s Boston Center calls NORAD’s Northeast Air Defense Sector (NEADS) in Rome, NY, to alert it to the suspected hijacking of Flight 11. According to the 9/11 Commission, this is “the first notification received by the military “at any level” that American 11 had been hijacked.” [9/11 Commission, 7/24/2004, pp. 20; 9/11 Commission, 8/26/2004, pp. 13] The call is made by Joseph Cooper, an air traffic controller at the Boston Center, and answered by Jeremy Powell, a technical sergeant on the NEADS operations floor. [Vanity Fair, 8/1/2006; Spencer, 2008, pp. 25] Beginning the call, Cooper says: “Hi. Boston Center TMU [traffic management unit], we have a problem here. We have a hijacked aircraft headed towards New York, and we need you guys to, we need someone to scramble some F-16s or something up there, help us out.” Powell replies, “Is this real-world or exercise?” Cooper answers, “No, this is not an exercise, not a test.” [9/11 Commission, 7/24/2004, pp. 20] Shortly into the call, Powell passes the phone on to Lieutenant Colonel Dawne Deskins. Deskins identifies herself to Cooper, and he tells her, “We have a hijacked aircraft and I need you to get some sort of fighters out here to help us out.” [Newhouse News Service, 1/25/2002; ABC News, 9/11/2002; Bamford, 2004, pp. 8; Spencer, 2008, pp. 26]

Military Claims Call Goes against Procedure - The 1st Air Force’s official history of the response to the 9/11 attacks will later suggest that Boston Center is not following normal procedures when it makes this call to NEADS. It states: “If normal procedures had taken place Powell probably wouldn’t have taken that phone call. Normally, the FAA would have contacted officials at the Pentagon’s National Military Command Center who would have contacted the North American Aerospace Defense Command. The secretary of defense would have had to approve the use of military assets to assist in a hijacking, always considered a law enforcement issue.” The only explanation it gives for this departure from protocol is that “nothing was normal on Sept. 11, 2001, and many say the traditional chain of command went by the wayside to get the job done.” [Filson, 2003, pp. 51]

Accounts Conflict over Time of Call - There will be some conflict between different accounts, as to when this vital call from Boston Center to NEADS occurs. An ABC News documentary will indicate it is made as early as 8:31 a.m. [ABC News, 9/11/2002] Another ABC News report will state, “Shortly after 8:30 a.m., behind the scenes, word of a possible hijacking [reaches] various stations of NORAD.” [ABC News, 9/14/2002] NEADS logs indicate the call occurs at 8:40 a.m., and NORAD will report this as the time of the call in a press release on September 18, 2001. [Federal Aviation Administration, 9/17/2001; North American Aerospace Defense Command, 9/18/2001] The 8:40 time will be widely reported in the media prior to the 9/11 Commission’s 2004 report. [Associated Press, 8/21/2002; BBC, 9/1/2002; CNN, 9/11/2002] But tape recordings of the NEADS operations floor that are referred to in the 9/11 Commission Report place the call at 8:37 and 52 seconds. [9/11 Commission, 7/24/2004, pp. 20; Vanity Fair, 8/1/2006] If the 8:37 a.m. time is correct, this would mean that air traffic controllers have failed to successfully notify the military until approximately 12 minutes after they became certain that Flight 11 had been hijacked (see 8:25 a.m. September 11, 2001), 16 minutes after Flight 11’s transponder signal was lost, and 24 minutes after the plane’s pilots made their last radio contact. [9/11 Commission, 6/17/2004] At 8:34, the Boston Center tried contacting the military through the FAA’s Cape Cod facility, which is located on Otis Air National Guard Base, but was told that it needed to call NEADS. [9/11 Commission, 7/24/2004, pp. 20; Spencer, 2008, pp. 22]

After 9/11, NORAD and other sources will claim that NORAD’s Northeast Air Defense Sector (NEADS) is notified at this time that Flight 175 has been hijacked. [Washington Post, 9/12/2001; CNN, 9/17/2001; North American Aerospace Defense Command, 9/18/2001] However, the FAA’s New York Center, which is handling Flight 175, first alerts its military liaison about the hijacking at around 9:01 (see 9:01 a.m.-9:02 a.m. September 11, 2001). In addition, according to the 9/11 Commission, NEADS is not informed until two minutes later. [9/11 Commission, 6/17/2004] According to the Commission, the first “operational evidence” that there is something wrong on Flight 175 is not until 8:47, when its transponder code changes, and it is not until 8:53 that the air traffic controller handling it concludes that Flight 175 may be hijacked (see 8:51 a.m.-8:53 a.m. September 11, 2001). [9/11 Commission, 7/24/2004, pp. 7, 21-22]

According to an early timeline laid out to CNN by unnamed but “informed defense officials,” the FAA informs NORAD at this time that Flight 93 may have been hijacked. [CNN, 9/17/2001] In public testimony before the 9/11 Commission in 2003, NORAD officials will similarly claim that the FAA first reports the possible hijacking of Flight 93 at this time. [9/11 Commission, 5/23/2003] Yet this is 12 minutes before the hijacking is meant to have occurred (see (9:28 a.m.) September 11, 2001). [9/11 Commission, 8/26/2004, pp. 38] One explanation is put forward that could possibly help explain the discrepancy: There are media reports that “investigators had determined from the cockpit voice recorder from United Airlines Flight 93… that one of the four hijackers had been invited into the cockpit area before the flight took off from Newark, New Jersey.” Cockpit voice recordings indicate that the pilots believed their guest was a colleague “and was thereby extended the typical airline courtesy of allowing any pilot from any airline to join a flight by sitting in the jumpseat, the folded over extra seat located inside the cockpit.” [Fox News, 9/24/2001] This would be consistent with passenger phone calls from the plane, describing only three hijackers on Flight 93 (see (9:27 a.m.-10:03 a.m.) September 11, 2001). [Longman, 2002, pp. 120] However, the reports will not be confirmed. The 9/11 Commission Report will dismiss the claim that NORAD was alerted at 9:16, stating, “In public testimony before this Commission in May 2003, NORAD officials stated that at 9:16, NEADS received hijack notification of United 93 from the FAA. This statement was incorrect. There was no hijack to report at 9:16. United 93 was proceeding normally at that time.” [9/11 Commission, 7/24/2004, pp. 34 No further explanations will be offered for the incorrect timelines. NORAD’s own initial timeline, released on September 18, 2001, will not give a time for when the FAA alerted it to Flight 93. It will only say that the FAA and its Northeast Air Defense Sector (NEADS) “established a line of open communication discussing AA Flt 77 and UA Flt 93.” [North American Aerospace Defense Command, 9/18/2001]

Shortly after 9/11, NORAD reported that the FAA notified them at this time that Flight 77 “may” have been hijacked and that it appears headed toward Washington. [Washington Post, 9/12/2001; CNN, 9/17/2001; North American Aerospace Defense Command, 9/18/2001; Guardian, 10/17/2001; Associated Press, 8/21/2002] Apparently, flight controllers at Dulles International Airport discover a plane heading at high speed toward Washington; an alert is sounded within moments that the plane appears to be headed toward the White House. [Washington Post, 11/3/2001] In 2003, the FAA supported this account, but claimed that they had informally notified NORAD earlier. “NORAD logs indicate that the FAA made formal notification about American Flight 77 at 9:24 a.m. (see 9:24 a.m. September 11, 2001), but information about the flight was conveyed continuously during the phone bridges before the formal notification.” [Federal Aviation Administration, 5/22/2003] Yet in 2004, the 9/11 Commission claims that both NORAD and the FAA are wrong. The 9/11 Commission explains that the notification NEADS received at 9:24 a.m. was the incorrect information that Flight 11 had not hit the WTC and was headed south for Washington, D.C. Thus, according to the 9/11 Commission, NORAD is never notified by the FAA about the hijacking of Flight 77, but accidentally learns about it at 9:34 a.m. (see 9:34 a.m. September 11, 2001). [9/11 Commission, 6/17/2004]

According to the 9/11 Commission, NEADS contacts Washington flight control to ask about Flight 11. A manager there happens to mention, “We’re looking—we also lost American 77.” The commission claims, “This was the first notice to the military that American 77 was missing, and it had come by chance.… No one at FAA Command Center or headquarters ever asked for military assistance with American 77.” [9/11 Commission, 6/17/2004] Yet, 38 minutes earlier, flight controllers determined Flight 77 was off course, out of radio contact, and had no transponder signal (see 8:56 a.m. September 11, 2001). They’d warned American Airlines headquarters within minutes. By some accounts, this is the first time NORAD is told about Flight 77, but other accounts have them warned around 9:25 a.m.

The National Military Command Center (NMCC) at the Pentagon commences an “air threat conference” at 9:37 a.m. in response to the terrorist attacks, which will last for more than eight hours and have numerous high-level government and military officials participating at various times.

NORAD Reports Two More Hijackings - Captain Charles Leidig opens the call at 9:39 a.m. [9/11 Commission, 7/24/2004, pp. 37-38] As the acting deputy director for operations (DDO) in the NMCC during the attacks, Leidig is responsible for moderating the air threat conference and generating a military response to the crisis. [9/11 Commission, 4/29/2004] He begins the call saying: “An air attack against North America may be in progress. NORAD, what’s the situation?” NORAD says it has conflicting reports, and its latest information is of “a possible hijacked aircraft taking off out of JFK [International Airport in New York], en route to Washington, DC.” [9/11 Commission, 7/24/2004, pp. 38] NORAD says the FAA has also passed it information about a second additional hijacking. Major Charles Chambers, who is currently on duty in the NMCC, will later recall, “This was probably a communications mix-up, but we all thought for a while that there were a total of five hijackings.” [US Department of Defense, 9/2001]

NMCC Reports Pentagon Attack - The NMCC reports that there has been a crash into the mall side of the Pentagon and requests that the secretary of defense be added to the conference. (However, despite being in the Pentagon when it is hit, Defense Secretary Donald Rumsfeld will not enter the NMCC and join the air threat conference until around 10:30 a.m. (see 10:30 a.m. September 11, 2001).) [9/11 Commission, 7/24/2004, pp. 38] The air threat conference is broadcast over a loudspeaker inside the NMCC. [US News and World Report, 8/31/2003] According to Chambers, “Questions were flying left and right on the conference, and trying to keep things straight was very difficult.” [US Department of Defense, 9/2001]

NORAD Recommended Air Threat Conference - Leidig and Commander Pat Gardner, the assistant DDO, had earlier on decided to convene an all-purpose “significant event conference” in response to the attacks on the World Trade Center. That call commenced at 9:29 a.m. (see 9:29 a.m.-9:34 a.m. September 11, 2001). NORAD had recommended that it be reconvened as an air threat conference. [9/11 Commission, 4/29/2004; 9/11 Commission, 7/24/2004, pp. 37] According to Chambers, an air threat conference is used when aircraft are considered to be hostile and involves many more people than are in a significant event conference, including the chairman of the Joint Chiefs of Staff, the secretary of defense, and officials from the White House. [US Department of Defense, 9/2001] However, Leidig thought a significant event conference was the correct kind of call for the situation. He will tell the 9/11 Commission that an air threat conference “had Cold War implications and brought a different group of people to a conference.” [9/11 Commission, 4/29/2004] Gardner will say that threat conferences are intended for dealing with external threats. [9/11 Commission, 5/12/2004]

Deputy Director Ordered Upgrading of Conference - All the same, Leidig gave the order to transition to an air threat conference. [9/11 Commission, 7/24/2004, pp. 37] He will tell the 9/11 Commission that, in retrospect, the reason he thinks he did so “was because he perceived an air threat at that time.” [9/11 Commission, 4/29/2004] Therefore, the significant event conference was brought to an end at around 9:34 a.m., and resumes as an air threat conference three minutes later. [9/11 Commission, 7/24/2004, pp. 37] Staff Sergeant Val Harrison could have established the air threat conference either by leaving all of those participating in the significant event conference on the line and then adding new participants one at a time, or by simply hanging up on everyone in the significant event conference and then having the computer do a mass dialing. Harrison recommended the second option. Leidig had agreed, and directed her to disconnect the conference call and start over.

Problem with Connecting Some Agencies - As happened with the significant event conference, there are problems connecting several agencies to the air threat conference. [US Department of Defense, 9/2001] Despite repeated attempts, operators struggle to get the FAA connected (see 9:29 a.m.-12:00 p.m. September 11, 2001), and it will take until 10:17 a.m. for an FAA representative to finally join the call (see 10:17 a.m. September 11, 2001). [9/11 Commission, 7/21/2003; 9/11 Commission, 7/24/2004, pp. 37] Other agencies had not understood what Leidig meant about convening the new conference, and so did not hang up their phones when the NMCC disconnected the previous conference call. As a result, all the NMCC got from them was a busy signal over the line. Chambers will recall, “As with the [significant event conference], it took longer than expected to convene the [air threat conference].” [US Department of Defense, 9/2001]

Top Officials Participate - Throughout the more than eight hours the air threat conference is running for, numerous key officials will participate in it at various times, including President Bush, Vice President Dick Cheney, Deputy National Security Adviser Stephen Hadley, acting Chairman of the Joint Chiefs of Staff Richard Myers, military personnel from the Presidential Emergency Operations Center below the White House, and the president’s military aide on Air Force One. [9/11 Commission, 7/24/2004, pp. 37] Brigadier General Montague Winfield, the original DDO, who had Leidig take his place so he could attend a pre-scheduled meeting (see 8:30 a.m. September 11, 2001), will later recall, “All of the governmental agencies… that were involved in any activity that was going on in the United States… were in that conference.” [ABC News, 9/11/2002]

Winfield Runs Conference after Returning to Post - Winfield will take over the running of the air threat conference from Leidig after returning to his post at around 10:30 a.m. (see 10:30 a.m. September 11, 2001). [CNN, 9/4/2002; 9/11 Commission, 4/29/2004; 9/11 Commission, 6/17/2004] But although NMCC conference calls are moderated by the DDO, Rumsfeld will use the DDO’s phone to participate in the air threat conference, meaning that Winfield is unable to moderate the conference when the defense secretary is participating. [9/11 Commission, 7/21/2003]

The military liaison at the FAA’s Cleveland Center calls NORAD’s Northeast Air Defense Sector (NEADS) and alerts it to the hijacked Flight 93. According to the 9/11 Commission, this is the first notification NEADS receives about Flight 93, but it comes too late, since the plane has already crashed (see 10:06 a.m. September 11, 2001). [9/11 Commission, 7/24/2004, pp. 30; 9/11 Commission, 8/26/2004, pp. 46]

‘Bomb on Board’ Flight 93 - At 10:05 a.m., the military liaison at the Cleveland Center, who is unaware that Flight 93 has just crashed, calls NEADS to inform it that Flight 93 is heading toward Washington, DC. Even though communicating with NEADS is not one of his responsibilities, he wants to make sure it is in the loop. [Spencer, 2008, pp. 224] At NEADS, the call is answered by Tech Sergeant Shelley Watson. Shortly into the call, at 10:07, the military liaison tells her: “We got a United 93 out here. Are you aware of that?” He continues, “That has a bomb on board.” Watson asks: “A bomb on board? And this is confirmed? You have a mode three [beacon code], sir?” The military liaison replies, “No, we lost his transponder” (see 9:40 a.m. September 11, 2001). The news about Flight 93 is shouted out to Major Kevin Nasypany, the NEADS mission crew commander. Nasypany responds: “Gimme the call sign. Gimme the whole nine yards.… Let’s get some info, real quick. They got a bomb?”

Liaison Wants Fighters Sent toward Flight 93 - The military liaison continues, asking Watson if NEADS scrambled fighter jets in response to Delta 1989, an aircraft that was mistakenly reported as having been hijacked (see 9:28 a.m.-9:33 a.m. September 11, 2001 and 9:39 a.m. September 11, 2001). Watson replies: “We did. Out of Selfridge and Toledo” (see 9:55 a.m. September 11, 2001 and 10:01 a.m. September 11, 2001), and says these jets are airborne. When the military liaison asks if the fighters can be directed to where Flight 93 is, Watson asks him if the Cleveland Center has latitude and longitude coordinates for this aircraft. The military liaison replies that he has not got this information available right now. All he knows is that Flight 93 has “got a confirmed bomb on board… and right now, his last known position was in the Westmoreland area.… Which is… in the Pittsburgh, Pennsylvania, area.” [North American Aerospace Defense Command, 9/11/2001; Vanity Fair, 8/1/2006]

NEADS Searches on Radar - The news of a bomb on board Flight 93 spreads quickly at NEADS, and personnel there search for the aircraft’s primary return on their radar screens. But because the plane has already crashed, they will be unable to locate it. NEADS will only learn that Flight 93 has crashed at 10:15 a.m., during a call with the FAA’s Washington Center (see 10:15 a.m. September 11, 2001). [9/11 Commission, 7/24/2004, pp. 30-31]

FAA Failed to Notify Military Earlier - The Cleveland Center’s notification to NEADS about Flight 93 comes 39 minutes after the plane was hijacked (see 9:28 a.m. September 11, 2001) and 33 minutes after FAA headquarters was alerted to the hijacking (see 9:34 a.m. September 11, 2001). [9/11 Commission, 7/24/2004, pp. 11, 28] At the time NEADS is alerted to Flight 93, NORAD is similarly uninformed about this aircraft, according to the 9/11 Commission. The Commission will state, “At 10:07, its representative on the air threat conference call stated that NORAD had ‘no indication of a hijack heading to DC at this time.‘” According to the Commission, the National Military Command Center (NMCC) at the Pentagon learned about the Flight 93 hijacking slightly earlier on, at 10:03 a.m. (see 10:03 a.m. September 11, 2001). However, the NMCC was notified by the White House, not the FAA. [9/11 Commission, 7/24/2004, pp. 42] A former senior FAA executive, speaking on condition of anonymity, will later try to explain why it takes the FAA so long to alert NEADS to Flight 93. He will say, “Our whole procedures prior to 9/11 were that you turned everything [regarding a hijacking] over to the FBI.” [Vanity Fair, 8/1/2006] Yet military instructions contradict this, stating, “In the event of a hijacking, the NMCC will be notified by the most expeditious means by the FAA.” [US Department of Defense, 7/31/1997; US Department of Defense, 6/1/2001]

NORAD Commanders Claim Earlier Awareness of Flight 93 - Two senior NORAD officials will contradict the 9/11 Commission’s conclusion, and claim they were aware of Flight 93 well before it crashed (see Shortly Before 9:36 a.m. September 11, 2001 and 9:36 a.m.-10:06 a.m. September 11, 2001). [Filson, 2003, pp. 68, 71-73] Colonel Robert Marr, the NEADS battle commander, will tell the Commission that, while the flight was still airborne, “his focus was on UAL 93, which was circling over Chicago,” and he “distinctly remembers watching the flight UAL 93 come west, and turn over Cleveland.” [9/11 Commission, 10/27/2003; 9/11 Commission, 1/23/2004] Major General Larry Arnold, the commander of the Continental US NORAD Region, will recall, ”[W]e watched the [Flight] 93 track as it meandered around the Ohio-Pennsylvania area and started to turn south toward DC.” [Filson, 2003, pp. 71]