The Ghosts of 9-11, the transponder story

Addendum August 17, 2009

Relevant Commission work files recently became available.  Information concerning AA11A is modified accordingly.  My notes taken while reviewing a replay of TSD tapes at Herndon reveal that  “0844 11A pops up” and 0851 11A disappears 290 FL 291 GS.”  This information is secondary source information; the TSD tapes themselves are the primary source information.  The disappearance of AA 11A from TSD supports a Commission Staff working hypothesis (still our hypothesis to this day) that emerging information from Indianapolis Center about the loss of AA77 was conflated with continued uncertainty about the whereabouts of AA11 and the fact of a plane missing in the system became AA11.  It is important to remember that American Airlines, itself, was confused at the same time and thought both AA 11 and AA77 impacted the WTC.  This time frame is one of the chaotic moments of 9-11 and I will have more to say about that as I continue my chaos theory discussions.

Original Article

Air traffic control reactions to hijacker tactics created two significant ghosts on September 11, 2001. The ghosts were American Airlines (AA) 11A, the southerly track of AA 11, tagged by Boston Center in order to follow the first plane hijacked, and United Airlines (UA) 93, a new flight plan entered by Cleveland Center to allow Washington Center to follow the last plane hijacked. Those air traffic control actions were not passed in any form to FAA management outside of air traffic control, the Department of Transportation, and, by extension the Department of Defense and the National Command Authority. The actions taken were the result of a hijacker tactic to exploit the transponders differently on each of the hijacked aircraft.  (Added July 18, 2009)  The use of the term ‘ghost’ has no relationship to the air traffic control term ‘coast.’  ‘Coast’ is a specific air traffic control term to define a scope track no longer associated with data from an aircraft.  It disappears from a controller’s scope after a few radar sweeps.  While AA 11A showed in ‘coast’ in the immediate aftermath of the impact into the north tower it wasn’t until much later that it became a ‘ghost.’ (end addition)

The strategic terrorist plan was to hijack fuel laden jets and fly them into buildings. One tactic used, once the cockpits were secured, was to manipulate the transponders. We know post facto each transponder was manipulated differently and each of the four manipulations presented a different problem to air traffic control and, separately, to the managers of the National Airspace System. We do not know, and will likely never know, the extent to which the hijackers planned the tactic used or the extent of their awareness of the problems the tactic would cause. We do know in retrospect the tactical plan, as shown in this chart:

Transponder Tactics
AA11 Turned Off before the turn to the target
UA175 Code Changed when AA 11 impacted the North Tower
AA77 Turned Off as the turn to the target began
UA93 Turned Off after the turn to the target

At this point we need to talk about what can be “seen” and what was “seen” by FAA and the Northeast Air Defense Sector, NEADS. Concerning FAA, we need to distinguish between air traffic control and management of the National Airspace System. The National Airspace System is controlled in one way and is managed in a distinct and separate way. En route air traffic control centers and local Traffic Control (TRACON) and Towers have scopes which display air traffic in near real time. Unless specific steps are taken to do otherwise, en route centers only follow transponding aircraft and are not concerned with primary radar returns.

NEADS also had scopes which displayed air traffic in near real time. NEADS radars, co-located with FAA radars but tuned differently, provided air defenders with information biased toward non-responding aircraft. NEADS controllers looked outward, away from land unless directed otherwise. To make their life simpler any transponding aircraft that departed from the continental United States was friendly, by definition. Even though both FAA and NEADS were monitoring air traffic in real time, their procedures and activities were fundamentally different.

All other concerned entities, including the FAA Air Traffic Control System Command Center (Herndon Command Center), FAA Regions and Headquarters, and the airlines, had displays which depicted the current state of flight plans entered into the National Airspace System. These displays were refreshed every minute or so. The display is called TSD, Traffic Situation Display. It is the display the FAA used to show the public how the density of aircraft in the sky decreased incrementally to near zero after the nationwide ground stop was ordered. The difference between what can be seen by air traffic control and what can be observed by all other interested observers with the capability is distinct and is what wittingly or unwittingly, the hijackers exploited. Plane by hijacked plane, each transponder manipulation presented a different problem set to air traffic control, to managers of the National Airspace System and ultimately, to the National Command Authority.

American Air flight 11 (AA 11)

Both Boston Center and New York Center made the conversion to allow their radar scopes to see AA 11 after the transponder was turned off. What air traffic control lost was the ability to determine altitude. Flight level 290 (29,000) would remain the last known altitude for AA 11 and would be the altitude specified in the scramble order for the air defense aircraft at Otis Air Force Base. In order to help everyone monitor the aircraft as it presumably proceeded to a long runway-capable airfield somewhere to the south, a new track (AA 11A) was entered into the system by Boston Center New York Center (changed Jul 22, 2009). However, the original flight plan for AA 11 was left in the system and it became a notional flight, a ghost itself, which ultimately “landed” in Los Angeles. What could be seen and what was seen prior to the moment AA 11 flew into the World Trade Center North Tower are depicted here.

0845 EDT
AA 11 No/No Yes/Yes No/No
AA 11A Yes/Yes Yes/Yes Yes/No

Air traffic control could not see and did not see AA 11 after the transponder was turned off and the new track was created. Entities watching a TSD could see and did see AA 11 continue to the west coast. Air traffic control could see and did see AA 11A so long as it was flying. Entities watching a TSD could see and did see AA 11A so long as the track remained in the system. So, at the moment of impact air traffic control lost the ability to “see” the real AA 11 (now 11A) and lost it. Entities watching a TSD could and did “see” the track, AA 11A, a ghost in the system. This point is critical and bears repeating. At the moment AA 11 flew into the World Trade Center North Tower it was lost to air traffic control and to NEADS. It was not lost to anyone with access to a TSD. The now notional AA 11A continued southbound. The long notional AA 11 continued westbound.

Things became exponentially confused at 8:46 a.m. when AA 11 ceased flying. The impact caused three things to happen; one spontaneous and two deliberate. Spontaneously, speculation started as to what hit the north tower—a helicopter, a commuter aircraft, a Boeing 737, or something else. Deliberately, flight AA 11A continued southbound as a notional ghost in the traffic display system. More ominous and also deliberately, the transponder code on UA 175 changed, and then changed again.

United Air Lines flight 175 (UA 175)

We may never know how the code change tactic was conceived, planned and carried out by Mohammed Atta and Marwan al Shehhi. What we do know is in the space of a few seconds two things happened, AA 11 ceased to exist and UA 175 changed its identity. Orchestrated or not, that was a remarkable tactical achievement.

New York Center was immediately presented with four problems—where was AA 11A, what hit the north tower, where was UA 175 and what was the squawking intruder, code 3321? What could be seen and what was seen, overall, is depicted here:

0846 EDT
AA 11 No/No Yes/Yes No/No
AA 11A No/No Yes/Yes No/No
UA 175 No/No Yes/Yes No/No
Code 3321 Yes/Yes No/No Yes/No

It is clear from this matrix that air traffic control and FAA administrative Regions and Headquarters were not seeing the same picture, nor was there any overlap, any common point of reference. Entities watching a TSD display could not see the transponding intruder, Code 3321, there was no associated flight plan. Air traffic controllers could see the squawking intruder, 3321, and they quickly equated this to be UA 175 and a probable hijack. Other than NEADS, entities outside the air traffic control system could only see the, now notional, flights AA 11 and UA 175 proceeding to the west and the also now notional flight AA 11A proceeding to the south. Air traffic control was seeing the real world. NEADS was seeing the real world but was not looking for either UA 175 or Code 3321, no one had told them. All others were seeing ghosts.

American Airlines flight 77 (AA 77)

A few minutes before 9:00 a.m. and not long before UA 175 struck the south tower the transponder on AA 77 was turned off, just as air traffic controllers observed the plane beginning to turn to the southwest. Even though Indianapolis Air Traffic Control center switched its scopes to observe radar only returns it could not find AA 77. The Center looked primarily to the Southwest since that was the direction the plane seemed to be heading. Even had they looked to the East they would not have seen it, the radar only returns were not presenting on Indianapolis scopes. Indianapolis Air Traffic Control Center assumed the aircraft to be down and it quickly initiated search and rescue operations and alerted local law enforcement.

We will likely never know why and how the terrorist plan directed tactics for AA 77 as it did. The AA 77 transponder was turned off in the worst possible place for air traffic control, and for the air defenders. The military radars did not cover the interior of the United States and the FAA’s own coverage in that area was sometimes problematic. Surely, Atta did not know that Indianapolis ATC would lose AA 77 completely but he must have estimated that a transponder turned off during a turn would present a different problem of some sort to air traffic control. And, demonstrably, it certainly did.

NEADS radar lost AA 77 just as the plane began its turn, but it didn’t make any difference, NEADS surveillance technicians weren’t looking and they had no reason to do so. FAA radar lost the plane a couple of radar sweeps later. It would be several minutes before either the FAA or NEADS radar would pick up AA 77 as a radar-only target, FAA first by a few minutes, but again it made no difference, no one was watching, certainly not Washington Air Traffic Control Center which could have but was not cued to do so. At no time did Washington Center reset its scopes to monitor radar-only planes; it never saw AA 77. What could be seen and what was seen at that moment are shown here:

0852 EDT
AA 77 Yes/No Yes/Yes Yes/No
AA 11A No/No No/No No/No

Note: in this updated version of December 8, 2011, I changed the TSD block for AA11A from Yes/Yes to No/No. It is now clear to me that the new track entered for AA11A was not a new flight plan that would have continued in the TSD system. Rather it was a data block that faded after AA11A (AA11, actually) impacted the North tower. Even so, as a faded track in the radar system and as a plane reported to have been south of Kennedy (airport), it still caused confusion.

AA 77 could have been seen on air traffic control scopes, specifically at Washington Center, but was not. While observers of any TSD could “see” AA 77 they could only see it as a ghost continuing its flight plan to the West. NEADS could have seen AA 77 somewhere over western Virginia, but did not know the aircraft was hijacked and was not looking for it.

As Indianapolis Air Traffic Control center and American Airlines were grappling with what happened a ghost, AA 11A, and a real plane, AA 77, were bearing down on Washington DC. At about 9:21 a. m. the ghost was “seen” and reported. At about 9:32 a. m. the real plane, AA 77, was spotted by an alert controller at Dulles TRACON who sounded the alarm. It remains undetermined how AA 11A and AA 77 became conflated. One explanation is that emerging information about the loss of AA 77 became merged with confusing information as to what happened in New York City and the new information of a third plane became not identification of AA 77 but re-identification of AA 11A. The most likely source of this misinformation is one of the administrative FAA Regions or somewhere at FAA HQ, itself. From wherever the source the information was heard by a traffic management specialist at Boston Air Traffic Control center and it was he who notified NEADS at 9:21 a. m. that AA 11, the first hijacked plane, was still in the air. A few minutes later, at 9:33, came specific reporting to Reagan National Tower and to the Secret Service that an unknown aircraft, AA 77, was approaching the National Capitol Region (NCR).

NEADS, heard the information at 9:34 and, frustrated that it was never able to establish a track on AA 11, was able to locate and track AA 77 and establish track B32 a few moments before impact, but not long enough to forward the information to NORAD.

United Airlines Flight 93 (UA 93)

The final ghost of the day was UA 93. By far, according to primary sources of the day–the radar, flight data recorder, and the FAA tapes–the poorest performing hijack pilot was Ziad Jarrah at the controls of UA 93. It may even be that he was supposed to turn off the transponder before he turned back, or even in the turn, both of which tactics make more sense, especially given what happened with AA 77. But he didn’t, he waited until well after the turn back to do so.

Whatever the hijacker tactic was supposed to be, Cleveland Air Traffic Control Center seldom lost track of UA 93 and when it did, only briefly. Cleveland Center was able to do what New York Center tried to do, use other planes in the sky to monitor the progress of UA 93. Cleveland constantly updated the FAA Herdon Command Center in near real-time and that Center immediately passed this information quickly and continuously to the FAA Washington Operations Center (WOC).

What is important to know for any discussion of UA 93 is that it was never a real threat to the National Capital Region and that the air traffic control side of FAA knew this, as did the FAA WOC. Yet, this very real and very explicit timely tactical information never made it out of the WOC to the White House or the NMCC in useful form. UA 93 went down at Shanksville at 10:03, as recorded and reported by multiple, independent sources. At its demise UA 93, itself, became a ghost.

This point about the uncertainty caused by the ghost UA 93 cannot be understated. Much of the confusion about the testimony and recall of Norman Mineta and the Vice President, the inability of NORAD and FAA to come up with agreed upon timelines, and the inability of NORAD to present credible testimony to the Commission, can be attributed to a ghost, a plane that did not exist.  Shortly before 10:00 a.m. Cleveland Center took the initiative to enter a new flight plan for UA 93 in the National Airspace System and in the process took out the old flight plan. Recall that in order to manage AA 11 New York Center left the old flight plan in and created, literally, a new airplane, AA 11A. Cleveland Center took a different approach and deliberately replaced the original flight plan to help Washington Center and told them they were doing so. At this point here is what could be seen and what was seen.

0958 EDT
UA 93 old No/No No/No No/No
UA 93 new Yes/Yes Yes/Yes Yes/No

This is the one time that air traffic control and viewers of the traffic situation display are seeing the same thing, up to a point. Observers of both systems knew that UA 93 had turned around, that it was headed for the National Capital Region, and where it was. NEADS neither saw nor looked for UA 93 because the first they heard was after it was down.

The simple act of replacing one flight plan for another in the system caused no problem for air traffic control but major problems for Traffic Situation Display observers, by this time, at least, now including the Secret Service. The congruence in what could be seen and what was seen by air traffic control and observers of the TSD system ended abruptly at 10:03 a.m. when the real UA 93 ceased to exist. Notionally, the new UA 93 flight continued as a believable threat to TSD observers unless they knew what Cleveland Center knew, Herndon Command Center knew, the FAA WOC knew, and four minutes after impact NEADS, and by extension NORAD, knew, UA 93 was no longer a threat.

Absent that necessary information, the TSD display allowed multiple entities to observe and report the progress of the ghost UA93 in either minutes or miles, take your pick. This is almost certainly the information that Norman Mineta recalled as pertaining to AA 77 but actually the ghost of AA 11 UA93 (corrected August 12, 2009) : right information, wrong ghost, and wrong time.

6 thoughts on “The Ghosts of 9-11, the transponder story”

  1. We made a separate trip to ZDC on that very point. I’ll have to do some research (assuming the material is available) to provide an answer but my recall is that despite what they said they didn’t throw the switches on the consoles. Interesting question and thanks for the interest. Miles

  2. Tobias, that is interesting. There may be a conflation of information here. The icon for UA 175 would have continued on its flight plan, briefly displayed on air traffic control scopes and continuously on TSD. I vaguely recall that ZNY replayed all of this for us, but I have no specific recall of what we observed. What was observed was the new mode 3 intruder, Code 3321 and the controllers, I think, made the equation that this was UA175. But your question concerns what was seen at UA.

    I did accompanied Team 7 to visit United Airlines (and American) but I don’t recall the specific discussions. I will look through the History Commons stuff and the NARA MFRs to see what I can find. Without proof, and given what McCurdy recalled, it is possible that someone did enter a flight plan update for UA 175 into the system, other than the one from 15 minutes earlier. And I don’t recall the details of that update either.

    If you run across anything else please let me know. I will put this on my plate of things to do. I’m trying to stay focused on the larger task of applying Chaos Theory but it is interesting to track down more discrete events, Delta 1989 being one example, and now UA 175.

    Thanks for the interest and for the input.


  3. Tobias, so far my search has turned up what you know from McCurdy’s interview MFR. Ballinger’s MFR doesn’t mention the issue. ASD is the airlines filtered version of TSD; that is they only focus on their company aircraft while in flight. Essentially TSD and ASD are the same. I didn’t pick up on the McCurdy nuance at the time.

    There may be something further in my notes or Raidt’s notes if HC uploaded them. Lisa Sullivan won’t have notes and she likely prepared the MFR by listening to the audio recording of the interview. At some point NARA will release the audio files, but that won’t happen any time soon. I’ll keep looking, you’ve tweaked my interest. Thanks for the lead. I’ve copied the relevant para from McCurdy, below, simply to document them in this thread. Miles

    [U] McCurdy recollected that at the time of the crash into tower 2, the display on
    Ballenger’s monitor still showed VAL 175 at 31,000 ft, having just deviated from the
    normal flight plan and heading into a big tum back east. The track on Ballenger’s ASD
    was frozen long after it was known the plane had crashed into tower 2.
    [U] Rubie Green interjected that the program was designed to maintain a tag on a flight
    as it moved across the map from center to center. Various code changes would not affect
    the track as it appeared to the dispatcher. McCurdy said that the ASD provides a rough
    track of a plane’s progress; minute alterations in the flight plan wouldn’t be reflected on
    the dispatchers display because such details only mattered to the pilot and the air traffic
    controller. “The purpose of the track is to keep the plane out of the path of a
    thunderstorm,” McCurdy said.

  4. Tobias, absolutely fascinating that someone is paying close attention to UA 175;not may people do. I am appreciative to know that I can reach out to someone about that airplane. The compelling story to me is that, without proof, I believe Atta and Al Shehhi orchestrated events so that Al Shehhi would change the transponder code as soon as Atta finished his task.

    The logic is a bit tenuous, but here goes. First, most all cross-country orientation flights were made on United. Second, United allowed and allows passengers to listen in to the cockpit. Atta and al Shehhi would have known that. Third, AA 11 and UA 175 were on the same frequency for a period of time; I’m not sure that Atta and al Shehhi could count on that, but it is my estimate that they used the knowledge about listening to the cockpit. Completely without proof I intuitively believe that Atta’s transmission, “we have some planes,” was meant for al Shehhi to hear. So, given that al Shehhi knew that Atta had control of AA 11 he then took over UA 175 soon after it entered ZNY airspace and before Atta impacted the north tower. Then, al Shehhi would have seen the black smoke, if not the fireball. I sat in the cockpit of a UA 767 with the Senior Pilot and confirmed that al Shehhi could have seen the NYC skyline; plus he knew what he was looking for. It is also, without proof, that Atta waited to give the order to purchase tickets until he had some degree of awareness that the day chosen would be good weather-wise.

    Whatever the tactical plan, there is no question that al Shehhi changed the transponder code immediately after AA 11 struck. Now, that also happens to be about the time of the odd transcript entry you mention. So, two things. One, it is a reference to AA 11 or, more likely, it is a reference that they lost the secondary on UA 175 original transponder code and didn’t see a primary because there was none, the aircraft was now a Mode 3 intruder. It was never primary only to the FAA radar system.

    And to close the loop back to the beginning of the day. Atta and al Shehhi knew both teams had cleared security at Boston. There was a confirming phone call.

    Tobias, thanks for the sleuthing and what do you think about the notion of detailed planning between Atta and al Shehhi? Were you aware of the ability to listen to the cockpit on Channel 9 on UA flights?


  5. Tobias, I’m hoping Brian will be able to help out here. Let’s see what he says. Here is what I know. The last time I flew United (from Dulles to Denver) I was able to listen to channel 9 and the flight deck. What I do not recall, and you raise a good point, is if I could hear transmissions on frequency by other planes. I suspect not. So, that would rule out that Al Shehhi heard Atta; I always considered that a long shot. But what he would have heard was the UA 175 Captain’s report to ZNY about suspicious transmission of frequency.

    Ergo, he had confirmation, but not from Atta directly.

    I’ll wait for Brian to catch up on my other email address.


  6. John, thanks for the interest. You are the second person to point that out. Not too many people focus on UA 175, by the way.

    I’m looking into this but the short answer is that since UA 175 was always transponding there was never a search only (primary) track. The “no primary” reference is to the original code, there was no continuity in the system as there was with AA 11.

    Here is what happened. Al Shehhi changed the UA 175 code to 3020 shortly after AA 11 impacted the north tower. That caused the former track to go into coast on the air traffic control scopes and then fade since there was no longer a related data block. A new transponding aircraft showed up as what air traffic control calls a Mode 3 or Mode C intruder with code 3020, but with no data block attached.

    Such an intruder is uncommon but happens often enough that controllers know what to do as Bottiglia did–have the pilot recycle his transponder. Such intruders happen when pilots forget to change codes when transitioning from one sector to another after being told to do so by the losing sector.

    In sum, UA 175 never “disappeared” it was always there, first under its original code, then as code 3020 for four radar sweeps and then as code 3321, thereafter. Bottiglia and others never noticed the 3020 intruder, they were too busy with everything else, but he/they did notice the 3321 intruder.

    Interesting find on your part and interesting to know that some folks are curious about UA175. I am toying with the notion of writing an article on “UA175, the forgotten plane.”


Comments are closed.