Addendum August 17, 2009
Relevant Commission work files recently became available. Information concerning AA11A is modified accordingly. My notes taken while reviewing a replay of TSD tapes at Herndon reveal that “0844 11A pops up” and 0851 11A disappears 290 FL 291 GS.” This information is secondary source information; the TSD tapes themselves are the primary source information. The disappearance of AA 11A from TSD supports a Commission Staff working hypothesis (still our hypothesis to this day) that emerging information from Indianapolis Center about the loss of AA77 was conflated with continued uncertainty about the whereabouts of AA11 and the fact of a plane missing in the system became AA11. It is important to remember that American Airlines, itself, was confused at the same time and thought both AA 11 and AA77 impacted the WTC. This time frame is one of the chaotic moments of 9-11 and I will have more to say about that as I continue my chaos theory discussions.
Original Article
Air traffic control reactions to hijacker tactics created two significant ghosts on September 11, 2001. The ghosts were American Airlines (AA) 11A, the southerly track of AA 11, tagged by Boston Center in order to follow the first plane hijacked, and United Airlines (UA) 93, a new flight plan entered by Cleveland Center to allow Washington Center to follow the last plane hijacked. Those air traffic control actions were not passed in any form to FAA management outside of air traffic control, the Department of Transportation, and, by extension the Department of Defense and the National Command Authority. The actions taken were the result of a hijacker tactic to exploit the transponders differently on each of the hijacked aircraft. (Added July 18, 2009) The use of the term ‘ghost’ has no relationship to the air traffic control term ‘coast.’ ‘Coast’ is a specific air traffic control term to define a scope track no longer associated with data from an aircraft. It disappears from a controller’s scope after a few radar sweeps. While AA 11A showed in ‘coast’ in the immediate aftermath of the impact into the north tower it wasn’t until much later that it became a ‘ghost.’ (end addition)
The strategic terrorist plan was to hijack fuel laden jets and fly them into buildings. One tactic used, once the cockpits were secured, was to manipulate the transponders. We know post facto each transponder was manipulated differently and each of the four manipulations presented a different problem to air traffic control and, separately, to the managers of the National Airspace System. We do not know, and will likely never know, the extent to which the hijackers planned the tactic used or the extent of their awareness of the problems the tactic would cause. We do know in retrospect the tactical plan, as shown in this chart:
Transponder Tactics
AA11 |
Turned Off before the turn to the target |
UA175 |
Code Changed when AA 11 impacted the North Tower |
AA77 |
Turned Off as the turn to the target began |
UA93 |
Turned Off after the turn to the target |
At this point we need to talk about what can be “seen” and what was “seen” by FAA and the Northeast Air Defense Sector, NEADS. Concerning FAA, we need to distinguish between air traffic control and management of the National Airspace System. The National Airspace System is controlled in one way and is managed in a distinct and separate way. En route air traffic control centers and local Traffic Control (TRACON) and Towers have scopes which display air traffic in near real time. Unless specific steps are taken to do otherwise, en route centers only follow transponding aircraft and are not concerned with primary radar returns.
NEADS also had scopes which displayed air traffic in near real time. NEADS radars, co-located with FAA radars but tuned differently, provided air defenders with information biased toward non-responding aircraft. NEADS controllers looked outward, away from land unless directed otherwise. To make their life simpler any transponding aircraft that departed from the continental United States was friendly, by definition. Even though both FAA and NEADS were monitoring air traffic in real time, their procedures and activities were fundamentally different.
All other concerned entities, including the FAA Air Traffic Control System Command Center (Herndon Command Center), FAA Regions and Headquarters, and the airlines, had displays which depicted the current state of flight plans entered into the National Airspace System. These displays were refreshed every minute or so. The display is called TSD, Traffic Situation Display. It is the display the FAA used to show the public how the density of aircraft in the sky decreased incrementally to near zero after the nationwide ground stop was ordered. The difference between what can be seen by air traffic control and what can be observed by all other interested observers with the capability is distinct and is what wittingly or unwittingly, the hijackers exploited. Plane by hijacked plane, each transponder manipulation presented a different problem set to air traffic control, to managers of the National Airspace System and ultimately, to the National Command Authority.
American Air flight 11 (AA 11)
Both Boston Center and New York Center made the conversion to allow their radar scopes to see AA 11 after the transponder was turned off. What air traffic control lost was the ability to determine altitude. Flight level 290 (29,000) would remain the last known altitude for AA 11 and would be the altitude specified in the scramble order for the air defense aircraft at Otis Air Force Base. In order to help everyone monitor the aircraft as it presumably proceeded to a long runway-capable airfield somewhere to the south, a new track (AA 11A) was entered into the system by Boston Center New York Center (changed Jul 22, 2009). However, the original flight plan for AA 11 was left in the system and it became a notional flight, a ghost itself, which ultimately “landed” in Los Angeles. What could be seen and what was seen prior to the moment AA 11 flew into the World Trade Center North Tower are depicted here.
0845 EDT
Plane |
ATC |
TSD |
NEADS |
AA 11 |
No/No |
Yes/Yes |
No/No |
AA 11A |
Yes/Yes |
Yes/Yes |
Yes/No |
Air traffic control could not see and did not see AA 11 after the transponder was turned off and the new track was created. Entities watching a TSD could see and did see AA 11 continue to the west coast. Air traffic control could see and did see AA 11A so long as it was flying. Entities watching a TSD could see and did see AA 11A so long as the track remained in the system. So, at the moment of impact air traffic control lost the ability to “see” the real AA 11 (now 11A) and lost it. Entities watching a TSD could and did “see” the track, AA 11A, a ghost in the system. This point is critical and bears repeating. At the moment AA 11 flew into the World Trade Center North Tower it was lost to air traffic control and to NEADS. It was not lost to anyone with access to a TSD. The now notional AA 11A continued southbound. The long notional AA 11 continued westbound.
Things became exponentially confused at 8:46 a.m. when AA 11 ceased flying. The impact caused three things to happen; one spontaneous and two deliberate. Spontaneously, speculation started as to what hit the north tower—a helicopter, a commuter aircraft, a Boeing 737, or something else. Deliberately, flight AA 11A continued southbound as a notional ghost in the traffic display system. More ominous and also deliberately, the transponder code on UA 175 changed, and then changed again.
United Air Lines flight 175 (UA 175)
We may never know how the code change tactic was conceived, planned and carried out by Mohammed Atta and Marwan al Shehhi. What we do know is in the space of a few seconds two things happened, AA 11 ceased to exist and UA 175 changed its identity. Orchestrated or not, that was a remarkable tactical achievement.
New York Center was immediately presented with four problems—where was AA 11A, what hit the north tower, where was UA 175 and what was the squawking intruder, code 3321? What could be seen and what was seen, overall, is depicted here:
0846 EDT
Plane |
ATC |
TSD |
NEADS |
AA 11 |
No/No |
Yes/Yes |
No/No |
AA 11A |
No/No |
Yes/Yes |
No/No |
UA 175 |
No/No |
Yes/Yes |
No/No |
Code 3321 |
Yes/Yes |
No/No |
Yes/No |
It is clear from this matrix that air traffic control and FAA administrative Regions and Headquarters were not seeing the same picture, nor was there any overlap, any common point of reference. Entities watching a TSD display could not see the transponding intruder, Code 3321, there was no associated flight plan. Air traffic controllers could see the squawking intruder, 3321, and they quickly equated this to be UA 175 and a probable hijack. Other than NEADS, entities outside the air traffic control system could only see the, now notional, flights AA 11 and UA 175 proceeding to the west and the also now notional flight AA 11A proceeding to the south. Air traffic control was seeing the real world. NEADS was seeing the real world but was not looking for either UA 175 or Code 3321, no one had told them. All others were seeing ghosts.
American Airlines flight 77 (AA 77)
A few minutes before 9:00 a.m. and not long before UA 175 struck the south tower the transponder on AA 77 was turned off, just as air traffic controllers observed the plane beginning to turn to the southwest. Even though Indianapolis Air Traffic Control center switched its scopes to observe radar only returns it could not find AA 77. The Center looked primarily to the Southwest since that was the direction the plane seemed to be heading. Even had they looked to the East they would not have seen it, the radar only returns were not presenting on Indianapolis scopes. Indianapolis Air Traffic Control Center assumed the aircraft to be down and it quickly initiated search and rescue operations and alerted local law enforcement.
We will likely never know why and how the terrorist plan directed tactics for AA 77 as it did. The AA 77 transponder was turned off in the worst possible place for air traffic control, and for the air defenders. The military radars did not cover the interior of the United States and the FAA’s own coverage in that area was sometimes problematic. Surely, Atta did not know that Indianapolis ATC would lose AA 77 completely but he must have estimated that a transponder turned off during a turn would present a different problem of some sort to air traffic control. And, demonstrably, it certainly did.
NEADS radar lost AA 77 just as the plane began its turn, but it didn’t make any difference, NEADS surveillance technicians weren’t looking and they had no reason to do so. FAA radar lost the plane a couple of radar sweeps later. It would be several minutes before either the FAA or NEADS radar would pick up AA 77 as a radar-only target, FAA first by a few minutes, but again it made no difference, no one was watching, certainly not Washington Air Traffic Control Center which could have but was not cued to do so. At no time did Washington Center reset its scopes to monitor radar-only planes; it never saw AA 77. What could be seen and what was seen at that moment are shown here:
0852 EDT
Plane |
ATC |
TSD |
NEADS |
AA 77 |
Yes/No |
Yes/Yes |
Yes/No |
AA 11A |
No/No |
No/No |
No/No |
Note: in this updated version of December 8, 2011, I changed the TSD block for AA11A from Yes/Yes to No/No. It is now clear to me that the new track entered for AA11A was not a new flight plan that would have continued in the TSD system. Rather it was a data block that faded after AA11A (AA11, actually) impacted the North tower. Even so, as a faded track in the radar system and as a plane reported to have been south of Kennedy (airport), it still caused confusion.
AA 77 could have been seen on air traffic control scopes, specifically at Washington Center, but was not. While observers of any TSD could “see” AA 77 they could only see it as a ghost continuing its flight plan to the West. NEADS could have seen AA 77 somewhere over western Virginia, but did not know the aircraft was hijacked and was not looking for it.
As Indianapolis Air Traffic Control center and American Airlines were grappling with what happened a ghost, AA 11A, and a real plane, AA 77, were bearing down on Washington DC. At about 9:21 a. m. the ghost was “seen” and reported. At about 9:32 a. m. the real plane, AA 77, was spotted by an alert controller at Dulles TRACON who sounded the alarm. It remains undetermined how AA 11A and AA 77 became conflated. One explanation is that emerging information about the loss of AA 77 became merged with confusing information as to what happened in New York City and the new information of a third plane became not identification of AA 77 but re-identification of AA 11A. The most likely source of this misinformation is one of the administrative FAA Regions or somewhere at FAA HQ, itself. From wherever the source the information was heard by a traffic management specialist at Boston Air Traffic Control center and it was he who notified NEADS at 9:21 a. m. that AA 11, the first hijacked plane, was still in the air. A few minutes later, at 9:33, came specific reporting to Reagan National Tower and to the Secret Service that an unknown aircraft, AA 77, was approaching the National Capitol Region (NCR).
NEADS, heard the information at 9:34 and, frustrated that it was never able to establish a track on AA 11, was able to locate and track AA 77 and establish track B32 a few moments before impact, but not long enough to forward the information to NORAD.
United Airlines Flight 93 (UA 93)
The final ghost of the day was UA 93. By far, according to primary sources of the day–the radar, flight data recorder, and the FAA tapes–the poorest performing hijack pilot was Ziad Jarrah at the controls of UA 93. It may even be that he was supposed to turn off the transponder before he turned back, or even in the turn, both of which tactics make more sense, especially given what happened with AA 77. But he didn’t, he waited until well after the turn back to do so.
Whatever the hijacker tactic was supposed to be, Cleveland Air Traffic Control Center seldom lost track of UA 93 and when it did, only briefly. Cleveland Center was able to do what New York Center tried to do, use other planes in the sky to monitor the progress of UA 93. Cleveland constantly updated the FAA Herdon Command Center in near real-time and that Center immediately passed this information quickly and continuously to the FAA Washington Operations Center (WOC).
What is important to know for any discussion of UA 93 is that it was never a real threat to the National Capital Region and that the air traffic control side of FAA knew this, as did the FAA WOC. Yet, this very real and very explicit timely tactical information never made it out of the WOC to the White House or the NMCC in useful form. UA 93 went down at Shanksville at 10:03, as recorded and reported by multiple, independent sources. At its demise UA 93, itself, became a ghost.
This point about the uncertainty caused by the ghost UA 93 cannot be understated. Much of the confusion about the testimony and recall of Norman Mineta and the Vice President, the inability of NORAD and FAA to come up with agreed upon timelines, and the inability of NORAD to present credible testimony to the Commission, can be attributed to a ghost, a plane that did not exist. Shortly before 10:00 a.m. Cleveland Center took the initiative to enter a new flight plan for UA 93 in the National Airspace System and in the process took out the old flight plan. Recall that in order to manage AA 11 New York Center left the old flight plan in and created, literally, a new airplane, AA 11A. Cleveland Center took a different approach and deliberately replaced the original flight plan to help Washington Center and told them they were doing so. At this point here is what could be seen and what was seen.
0958 EDT
Plane |
ATC |
TSD |
NEADS |
UA 93 old |
No/No |
No/No |
No/No |
UA 93 new |
Yes/Yes |
Yes/Yes |
Yes/No |
This is the one time that air traffic control and viewers of the traffic situation display are seeing the same thing, up to a point. Observers of both systems knew that UA 93 had turned around, that it was headed for the National Capital Region, and where it was. NEADS neither saw nor looked for UA 93 because the first they heard was after it was down.
The simple act of replacing one flight plan for another in the system caused no problem for air traffic control but major problems for Traffic Situation Display observers, by this time, at least, now including the Secret Service. The congruence in what could be seen and what was seen by air traffic control and observers of the TSD system ended abruptly at 10:03 a.m. when the real UA 93 ceased to exist. Notionally, the new UA 93 flight continued as a believable threat to TSD observers unless they knew what Cleveland Center knew, Herndon Command Center knew, the FAA WOC knew, and four minutes after impact NEADS, and by extension NORAD, knew, UA 93 was no longer a threat.
Absent that necessary information, the TSD display allowed multiple entities to observe and report the progress of the ghost UA93 in either minutes or miles, take your pick. This is almost certainly the information that Norman Mineta recalled as pertaining to AA 77 but actually the ghost of AA 11 UA93 (corrected August 12, 2009) : right information, wrong ghost, and wrong time.