9-11: NEADS; Exercise Vigilant Guardian in perspective, Sep 9

In previous articles in this series we have listened to NEADS respond to one major scenario on each exercise day.  On Sep 6, the scenario concerned a military C-130 that was behaving strangely.  On Sep 7, the scenario was a defecting Aeroflot plane.  On Sep 8, NEADS exercised counter narcotics procedures dealing with a split track out of Bermuda headed for Philadelphia.

In this article we will examine NEADS activities on Sep 9.  The exercise does not begin until shortly before 1000 hrs, local time.  There was some exercise-related position training during the early morning at the ID position, but none of that was related to any scenario or sim cell activity.

During the night, CONR had sent a message raising the Force Protection Condition level to “Bravo.”  NEADS did not receive that message.  We start with that story and with preparation for a DEFCON (Defense Condition) change, an indication of “transition to war,” the stated purpose of the exercise.

DEFCON and Force Protection Levels

An indication of an expected DEFCON change came from the ID technician who informed the MCC that the checklist was complete.  Here is the audio clip of that early morning advisory.  0909060511 DEFCON Checklist Complete

The first indication that there had been a CONR-directed Force Protection Condition change to “Bravo” came in a call from CONR following up on their message of the night before.  0909104231 CONR call FP Bravo

That was news to the person at the MCC desk who took the call and he said “hold on.”  NEADS tracked down that they had not received the message and that CONR had not put the change on the chat log.  NEADS asked that the message be faxed and it was.

NEADS took check-list notification action.  In this clip we hear Major Nasypany (MCC on duty on the morning of 9-11) passing the change along to the uniformed guard force.  0909110112 Nasypany passed FP Bravo message

Someone then directed Major Nasypany to notifiy all the Joint Surveillance System (JSS) radar sites.  0909110413 Notify JSS sites

That simple order was not easy to carry out.  We learn in this next clip that no one was quite sure how to comply with an exercise direction with no intended recipient.  Although not explicit, it is likely the task was simply simulated.  The important point is that the radar sites were not involved in exercise Vigilant Guardian.  0909110445 How to handle JSS

Major Nasypany then completed his own checklist notifications.  He made a broadcast announcement to the operations floor, he called the Command Group, and he called Colonel Marr at home.  The person answering the phone at the Command Group was the Chaplain; it was a Sunday.  0909110453 Checklist Notifications

Real World Instructive Event

Around 0800 EST, Boston Center called with an advisory on a DVFR flight of some nine hours duration, a Cessna.  According to Colin Scoggins: “DVFR stands for Defense Visual Flight Rules – When aircraft are outside of the ADIZ, the Air Defense Identification Zone, they are required to obtain a beacon code from Flight Service or directly from NEADS.  each Flight Service that was adjacent to an ADIZ used to have a select amount of DVFR Codes, normally between 4 and 7 beacon codes, these codes would be issued to someone who leaves the ADIZ and then returns.”  Typically, in the ZBW area, these would be fish spotters, whale counters or perhaps hurricane trackers, according to Scoggins.

In this case, the DVFR flight departed from Hyannis and was scheduled to return there.  Once such a flight exits the ADIZ it then becomes a flight of interest to NEADS on its return, hence the routine notification by FAA centers to NEADS (or SEADS or WADS).  Here is the audio of the ZBW notification to NEADS. 0909114859 DVFR Cessna

I interviewed multiple Mission Crew Commanders from SEADS when I worked on an investigation of the Cuban shootdown of two Brothers To The Rescue (BTTR) aircraft.  BTTR flights were the prototypical DVFR flight.

Routinely, the Mission Crew Commanders told me that DVFR flights were the biggest cause of scrambles being ordered, many never taking off.  The DVFR flights were, in air defense lingo, called “mom and pop” or “doctors/dentists” flights, ones that went out for extended periods and forgot to check in upon re-entering the ADIZ.

Back to the Story

The night’s and morning’s activities were summed up by the oncoming MCC in his briefing to Col Marr.  Marr is informed about the Force Protection Condition change and is also informed the flying is expected to be limited since Tropical Storm Erin off the Virginia coast had been upgraded to Hurricane Erin.  Note that Marr immediately asked about the impact on the Langley air defense fighters.  0909123101 Colonel Marr Morning Brief

And that is how things stood as NEADS awaited the first exercise scenario which would come shortly before 1000 hours EDT.  It was an air terrorist scenario.

Terrorist Scenario

A simulated call came in from Boston Center, purportedly from Colin Scoggins.  Boston reported that they had learned from the FBI that Heathrow [London] reported that the Palan Resistance Movement had two members aboard United flight 558 who intended to detonate a bomb over New York City.  The caller was careful to say that this was a terrorist event, not a hijack.  The plane was approaching Boston air space from New Brunswick.

I asked Colin Scoggins to listen to this clip.  That is not his voice, the NEADS sim cell used his name probably because he was a known Boston Center Contact.  Colin said it was unusual for NEADS to use specific names in exercises, rather the reference should have been to Boston Center. 0909133749 ZBW Scoggins Call

NEADS can be heard discussing the event in background conversations and then ZBW called again about five minutes later with a specific request to divert the plane to Bangor or Westover.  They did not want the plane to land at its destination, JFK.  NEADS asked the relevant question, how come it’s not considered a hijack?  It is not clear that the pilot or crew even know of the threat.  FAA is talking to the pilot, he has not squawked a hijack code.  NEADS then asked the next relevant question, does ZBW want a fighter escort?  The answer was no, they just wanted the plane diverted.  The sim cell was feeding the sector floor enough information to get their thought processes started.  Here is the audio of the second ZBW call.  0909134231 ZBW wants to divert

The NEADS ID Technician started her search for information and called the sim cell, first asking for Scoggins.  The answer confirmed that the sim cell was acting for him.  When the technician said she was actually trying to reach Canada East she was told to call the real Canada as they were a player in the exercise.  0909134442 Call to Sim Cell

It is clear in this sim cell conversation that the intent was for push back on Bangor since it was a tanker base.  0909134513 Sim Cell Bangor Discussion

The Technician then called her counterpart at CANR East and learned that they were tracking the aircraft and that the track had just been forward told to NEADS, track S163.  0909134602 Call to CANR East

Meanwhile in the sim cell it is evident that they wanted push back and would “take out some tankers” if not.  Here is that brief clip.  0909135206 Take out some tankers

The MCC then provided a morning briefing to the acting Commander, NEADS.  He elected to accept only real world information and leave the exercise information to the Battle Cab.  In the course of that conversation we learn who was in the Battle Cab that morning, the FO (Fighter Officer) and the DO (Director of Operations), Colonel [likely Lt Col] McNeely.  Here is that morning brief.  0909135446 Morning Brief to Acting CO

Behind the scenes the trackers were well aware of the high interest track and checked with the sim cell about coordinating with Canada.  This clip provides additional insight into the work and the language of the NEADS sector operations center.  0909135553 Track Talk with Sim Cell

Canada East called with additional information and advised that Canadian military assistance was not being requested.  Further, it did not appear that the terrorists had taken over the airplane.  NEADS was advised that the plane was about to enter its area.  The scenario has been in progress for about 25 minutes. Here is that call.  0909140217 Update from CANR East

Coordination with Canada then took place with a handoff projected within the next 30 nautical miles.  The tactics techniques and procedures being exercised are the following of a track of interest and handing it off from one one Region (CANR) to another (CONR/NEADS).  The Technician then made sure that the MCC was fully aware.  Here are those exchanges in the same audio clip.  0909140223 Getting Ready for Hand Off

The Canadian MCC called his counterpart at NEADS as the handoff neared to coordinate.  He informed her that the track had not been forward told to NORAD.  Both Canada East and NEADS had been discussing making the track a “Special 16.” [I don’t have documentation as to what this is, but a hijack would have been a “Special 15.”]  The NEADS MCC stated that NEADS would forward tell the track.  She was also quick to challenge her counterpart when he referred to the aircraft as “hijacked.”  “Are we confirming that it is a hijack?”  He responded, “it is not a hijack.”  Here is that exchange.  0909140423 MCC to MCC Coordination

The technicians challenged the MCC on the designation of “16” and not “15.”  She told them that FAA did not yet consider the plane to be hijacked, but NEADS was to work the hijack checklist anyway.  Here is that exchange.  0909140614 Special 16 vs Special 15

The MCC left her mike open for an extended period allowing us additional insight as to how NEADS handled this situation.  One of the first things she did was ask the ID section to recontact Boston.  0909140616 Contact Boston

She then engaged in a brief discussion with probably the Battle Cab and an extended discussion with “Grover” (most likely Lt Col Cleveland, in the sim cell).  We learn that the FO [fighter officer] was coming up with a plan.  She identified for us that a “Special 16” track was a terrorist rogue track and the check list for it was the same as for a hijack track.  Her conversation with Grover is explicit that he knew the scenario.

NEADS realized that the plane may be landing in Bangor and she instructed the ID section to contact Boston and tell them that was not a good idea [force protection issue, I speculate].  Here is an excellent over five-minute look into the thought process of the MCC on duty and, by extension, NEADS.  0909141016 MCC Extended Discussion

At the end of the last clip you can faintly hear the ID Technician dialing the sim cell for Boston.  The warning not to land was too late, the plane landed at Bangor at 1437Z.  Here is the technician’s call.  0909141536 Landed Bangor

In this next clip we hear the MCC’s reaction and learn that the scenario appears to now be a force protection issue.  Flushing (moving) the aircraft at Bangor was discussed as was moving the plane, itself.  0909141616 MCC Post Mortem

The ID Technician called Bangor (sim cell) to pass on the force protection requirement.  During the course of that call both the ID Technician and Bangor learned that the plane had exploded.  Here is that call.  0909141657 Plane Exploded

The Scenario Continued

In this next clip we hear Boston Center, simulated, informing NEADS about the plane’s status.  NEADS was told that the plane exploded on impact [touchdown] and that no assistance was needed. Six to eight hours were needed for runway repair.  0909141807 Update from Boston Sim Cell

The MCC continued her post mortem and we learn that the danger at Bangor was the tankers that staged from there.  However, no planes at Bangor were damaged in the explosion.  The MCC was reminded she was told to divert the plane that exploded to Otis.  There is a faint background voice saying that on a previous clip.  The MCC acknowledged that she missed that.  We also learn that NEADS considered that there was no biological threat as the heat of the explosion would have dissipated any biochemical materials.  Here is that continued discussion at the MCC position.  0909142006 Continued MCC Discussion

A few minutes later the MCC received a status report from Bangor.  There may have been damage to one tanker.  Here is that report.  0909142743 Bangor Status Report

The final audio file relevant to the scenario was a call by the MCC to Bangor (Sim Cell) to verify time needed for runway repairs, casualties, damage to other planes and whether or not the bomb was nuclear or bio-related.  Here is that call.  0909145949 MCC Final Bangor Update


The terrorist rogue flight was a force protection threat scenario, not a hijack scenario.  CONR had increased the protection level to “Bravo” during the night.  The FAA-simulated exercise input specifically stated that FAA wanted to divert the aircraft to Bangor or Westover. Bangor was a tanker base and the MCC, given force protection “Bravo,” should have picked up that Bangor was not an acceptable option.  She did not and the scenario played out with a Bangor landing and explosion.

There was no further activity that morning and as of 1630Z (1230 local) the only other exercise activity of any note was an exercise input reporting that the wife of a NEADS member had received a kidnap threat at home.  That became a force protection check list drill.

The scenario lasted for about 30 minutes and involved several telephone kidnap threats to dependents of NEADS personnel. One audio clip will suffice to provide perspective.  In this clip I have suppressed (set db level to 0) the names of the personnel involved outside of the on duty team.  0909165308 FP Example

Runaway Blimp

About 1845 New York Center (ZNY simulated) reported that a blimp lost power over Giants Stadium and was drifting away.  ZNY requested NEADS scramble fighters to assist.  Here is the initial call to NEADS.  0909182728 Runaway Blimp

ZNY called again seven minutes later and was told that NEADS would help.  0909183430 New York calls again

NEADS apparently discussed the issue off mike and determined that this was not their mission, it was search and rescue.  NEADS informed ZNY 15 minutes after the initial call of the declination to assist.  0909184223 NEADS says no

NEADS did alert Canada East and in that exchange we learn that the air defense fighters cannot intercept a very slow moving target.  There is an interesting MCC to MCC exchange about exactly what and where Giant’s Stadium was located.  0909184740 NEADS alerts Canada East

Both the Bangor scenario and the blimp scenario ended routinely.  Concerning Bangor, NEADS got a sim cell call that 8000 feet of runway were usable by 1930Z (1530 local).  As for the blimp, NEADS reported to ZBW (sim) at about the same time that they had lost radar contact in the vicinity of Beth Page.  Later, ZNY simulated reported that that the blimp crashed into the ocean.  0909205213 Blimp crashed in ocean

Later, CONR called for an update, they had been asked by the Air Warning Center at NORAD.  The NEADS response provides specificity on the division of responsibility with FAA.  “It was over land and FAA covers all of that,” in reference to notifying search and rescue.  Here is that update.  0910002835 Update to CONR

NEADS routine, items of interest

During a shift change the off going MCC briefly mentioned the Russian exercise by simply giving a location and stating that they were not hiding anything.  That is where they said they would be.

The new shift continued its internal discussion about the split drug-related track from the day before, defending their decision to declare both tracks to be Special 17.

At about 2030Z (1630 local) two watchstanders discussed the upcoming work schedule.  They determined that Tuesday morning (Sep 11) would be normal, Wednesday would be 12-hour shifts, and then back to normal on Thursday.  Here is that brief exchange.  0909202254 Work Schedule

Other exercise activity

Other than the two primary events, the terrorist force protection threat and the runaway blimp, everything else on Sep 9 was administrative in nature.  For example, there was a simulated heart attack experienced by a member of the watch team.  That became a check-list activity.  There was also a false report on the chat log that SEADS had an air conditioner outage and that NEADS had to take over for them.  The MCC quickly tracked that down by calling his counterpart at SEADS.  It was apparently the work of a disgruntled employee at SEADS.

There was one additional real world fact revealed.  Not only did NEADS/NORAD special track all Aeroflot and Cubana flights they also special tracked Chinese commercial flights.

As of 0400Z Sep 10, 2001 (2400 local) things were quiet on the NEADS floor.

Look for an article concerning Sep 10 in the next few days