Note to readers. I consider this to be version 1.0, subject to update and expansion
Preface
On October 23, 25, [edited Aug 25, 2011] 2001, at the Senate Armed Services Committee hearing on the role of the Defense Department in Homeland Security, the following exchange took place:
Senator Levin: “General Eberhart, there’s been some confusion about the sequence of events on September 11 that maybe you can clear up for us…at 9:25, the FAA notified NORAD that flight 77 was headed toward Washington. Was that the first notification – the 9:25 notification – that NORAD or the DOD (sic) had that flight 77 was probably being hijacked?…”
General Eberhart: “Sir, there is one minor difference, I show it as 9:24 that we were notified, and that’s the first notification that we received.”
That NORAD Commander in Chief’s testimony to Congress by General Ralph Eberhart set in concrete a story that was simply wrong; a time that would influence events two years later when FAA Administrator Jane Garvey testified before the Commission.
My Perspective
I have consistently criticized NORAD for shoddy staff work and incomplete analysis in its attempts to provide an accurate timeline concerning events of 9-11. FAA fared no better in its attempts. Even worse, the two agencies did not reach agreement during the preparation for a White House meeting on September 17, 2001, and never resolved differences concerning notification to the military.
In a previous article I described the events that morning as a battle in a larger war against terror, an attack against the National Airspace System (NAS). I identified the Battle Commanders as Benedict Sliney, the National Operations Manager of the NAS and Colonel Robert Marr, who commanded the defense of the northeast sector of the NAS.
I also identified the Battle Managers, the next higher echelon with direct involvement, as Jeff Griffith, an air traffic control manager at FAA Headquarters, and Major General Larry Arnold, NORAD’s CONUS Region (CONR) Commander and Colonel Marr’s immediate supervisor. It was the Battle Managers, Griffith and Arnold, who were charged with working together to determine the facts. In the immediate aftermath of 9-11, NORAD and FAA worked together and separately to determine the facts. The following information comes from Commission Staff MFRs.
Darlene Freeman, then Director of Safety and Special Studies for the Deputy Administrator was tasked to put together the Administrator’s Briefing Book. She recalled that Jeff Griffith was speaking with “some of the military people” to facilitate the project; he was tasked by Belger and Garvey to be the specific contact with the military in their efforts to develop an accurate timeline. She was surprised at the release of the NORAD timeline and that they put it together so quickly without reviewing the document thoroughly with FAA, according to a Commission Staff interview with her.
Once the timeline was released, Monte Belger asked her to compare times in the document with times held by FAA. Concerning the 0924 notification time for AA 77, in FAA timelines the time was sourced back to a NEADS document not an FAA document. That document was the MCC/T log. Freeman stated she built her timeline off of the NORAD press release and did not have the benefit of the MCC/T log. Commission staff represented to her that FAA did have the MCC/T log in possession and referred to it in a Sep 17 compilation.
On his part, Griffith recalled that “it was like pulling teeth” to get information after 9-11. The FAA Centers weren’t cooperative. Finally, they got it together to the point they could brief the FBI and the Secret Service. Dick Clark was present at the meeting, as were DoD people. Griffith characterized Freeman’s report as a topic of hot debate among FAA employees. He knew people wee saying that FAA and military notification times were inconsistent. “Everyone was pointing fingers.” Concerning General Arnold, Griffith said that “Larry and he” approached in pragmatically. Although they had a lot of heated conversations, “Larry and I agreed we wanted the truth on the issue.”
Truth is not what they got. General Arnold delegated some work to Brigadier General Douglas R. Moore, Director, Command, Control, Communications, and Computers, Headquarters, California Air National Guard, who he brought to CONR to assist.
NORAD staff errors undetected
In a Sep 16, 2001, email, sent near midnight (23:06 EDT) to the NEADS Battle Commander and NEADS Director of Operations, “Amplifying Data for 11 Sep,” Moore tasked NEADS for additional information commenting, “Thank your person [unidentified] who dug up the requested information from your logs and tapes. I have passed it to the proper FAA office and they are very appreciative. They are using this data to brief the White House tomorrow. They request a little more amplification on a couple of the questions, and have a new one. If someone can work these tonight, and e-mail answers here by 6AM, it would be greatly appreciated.” Among the questions was this one: “AA 77, 1324Z, Which FAA organization passes notification of “a possible track heading to DC’(sic)?” (The email is DoD accession number NCTA000256547)
Moore’s question conflated two MCC/T Log entries.
- 1324 American Airlines N334AA Hijacked
- 1325 Hijack AA Flt headed to Wash D.C.
The request was answered by Colonel Clark Speicher “NEADS/DO Nights.” Speicher was the NEADS Deputy Commander and was on shift as the night Director of Operations (DO). Speicher responded: “I have reviewed the crew MCC logbook and one of our MCC [Mission Crew Commander]’s and I reviewed the audio tapes to answer your questions. The MCC log reveled [sic] the following: 1st question: AA 77, 1342Z (emphasis added): Boston FAA says another A/c is missing AA77 flight to LA lost unable to contact.”
And that was the fatal error. Speicher correctly identified the right log entry for notification concerning AA 77, but got the time wrong. Not only did he transpose two digits, garbling the question, he provided the wrong time, entirely. Here is the complete sequence of log entries that were misread.
- 1324 American Airlines N334AA Hijacked
- 1325 Hijack AA Flt headed to Wash D.C.
- 1326 LFI scrambled on AA flt @1324Z
- 1327 Boston FAA says another a/c is missing
- 1334 American 77 Flt to LA lost/unable to locate
Those entries, properly parsed and reported, would have settled the matter and there would have been no Eberhart certainty about a time that was misleading. For wont of a nail. The accurate notification time, 1334, also figured into the Garvey testimony two years later.
Moore also asked two questions concerning UA 93, indicating that CONR and NEADS were aware that the first notification came after UA 93 crashed. Even so, that exchange was garbled at both ends. Moore asked: “United 93, 1408Z, Which center calls with information that UA 93, M3 1527 is heading for Cleveland?” Separately, he asked, “United Flt 93, 1415Z, Who reported to NEADS that aircraft had crashed (new question)?”
Speicher responded: “2nd question: United 93, 1408Z: the log does not identify the center.” “3RD question: United 93: The log does not identify the agency.
The actual log entry is “1407 [emphasis added] Bomb on Board UAL93 over Pittsburg 1527 M3 3951N 07846W.”
None of this specificity of knowledge survived to inform NORAD testimony before the Commission on May 23, 2003.
Moore asked a final question which reveals full awareness of the D 1989 issue. “Delta 89, at 1341Z. Did you receive a call of a possible highjack? If so, from whom?”
Speicher responded: “4th question. Delta 89. 1341Z. The log shows a call reflecting Delta 89 possible hijack Boston to Vegas.” Speicher did not answer the “from whom” question because the log did not so state and he was unable to find it in the tapes. “We spent six hours trying to retrieve data from the voice tapes…the system is complex..[and]…it is rather cumbersome as analyzing the data is difficult to say the least.”
Speicher also said, “we realize a comprehensive transcript will take days to ensure we accurately identify all voice recordings from all the tapes. Nevertheless, NORAD made a rush to judgment.
NORAD preempts
NORAD, in true military fashion, took the high ground and published its timeline, unilaterally, on September 18, 2001, in a formal news release, “NORAD’s Response Times.” (Incorrect entries in red)
| Hijacked Plane | Notification Time |
|---|---|
| AA 11 | 0840 |
| UA 175 | 0843 |
| AA 77 | 0924 |
| UA 93 | N/A, Langley already airborne |
Nearly a year later on August 12, 2002, FAA released a fact sheet, “Chronology of Events on September 11, 2001,” that included military notification times.
Added, July 31, 2011. FAA did not, did not include a notification time for AA 77. I have deleted that entry in the table.
| Hijacked Plane | Notification Time |
|---|---|
| AA 11 | 0840 |
| UA 175 | 0843 |
| AA 77 | |
| UA 93 |
FAA acquiesced , meekly in my opinion, to the NORAD position established months earlier on UA 175, but stood its ground on AA77 by making no entry in the chronology. (Revised July 31, 2011) But it took them a while to reach that point and they, too, struggled with uncertain staff work and estimates. I discussed, in detail, FAA’s preparation of a key document, the Administrator’s Briefing Book, in an article concerning AA 77. FAA, specifically Dulles TRACON, was not aware that a fast-moving unknown (AA 77) was bearing down on the nation’s capital until shortly before Danielle O’Brien sounded the alarm at about 0932 EDT. As discussed in the linked article, FAA controllers did, without comprehension, observe the target as early as, ironically, 0925 EDT. That observation in no way resulted in a notification to the military as the NORAD timeline suggested. It did not even become actionable within FAA. O’Brien’s alarm did become actionable and that information was passed to NEADS, not by FAA Headquarters or Herndon Center but by, again, Boston Center, ZBW.
Both NORAD and FAA had information available to them that should have resulted in an accurate assessment for the White House on September 17, 2001, and for General Eberhart’s subsequent testimony to Congress. Staffs at all levels in both agencies failed to get the story right. Command at all levels in both agencies failed to vet the work of their staffs.
And that is how matters stood when the Commission began its work. For over two years, the public had been misinformed, an egregious violation of the public trust by both agencies and responsible White House staff. Things not only did not get better, they got much worse.
May 22 and 23, 2003 Hearing
On the afternoon of the first day, Administrator Garvey answered a question about the notification time for AA 77 as follows: “I would like to submit that specific timeline for the record, with the first notification being at 9:34.” She was then asked about that since the time did not square with General Eberhart’s testimony to Congress. Garvey had been provided the accurate time by FAA staff but was not confident. She had just previously stated: “The timeline that I have, that I remember, is one that had a notification of NORAD twice before the time [9:24] that you mention, so that there had been three notifications.” The issue was not resolved and became more confused the next day.
On the morning of the second day Transportation Secretary Norman Mineta testified and this exchange took place when Commissioner Tim Roemer asked him: “…but you had not been in the room when the decision was made — to what you inferred was a decision made to attempt to shoot down Flight 77 before it crashed into the Pentagon. Is that correct?”
MR. MINETA: I didn’t know about the order to shoot down. I arrived at the PEOC at about 9:20 a.m. And the president was in Florida, and I believe he was on his way to Louisiana at that point when the conversation that went on between the vice president and the president and the staff that the president had with him.
MR. ROEMER: So when you arrived at 9:20, how much longer was it before you overheard the conversation between the young man and the vice president saying, “Does the order still stand?”
MR. MINETA: Probably about five or six minutes.
MR. ROEMER: So about 9:25 or 9:26.
And that erroneous recall by the Transportation Secretary set the stage for the NORAD briefing and testimony, which immediately followed his appearance.
NORAD, among other things, was tasked to explain the Otis and Langley scrambles. The Commission Staff review of the radar files revealed that neither scramble proceeded directly, despite anecdotal news accounts to the contrary. In the process of trying to explain things, the NORAD representatives compounded previous errors concerning notification times. Here is a summary of their testimony: (incorrect times in red)
| Hijacked Plane | Notification Time |
|---|---|
| AA 11 | 0840 |
| UA 175 | |
| AA 77 | 0924 |
| UA 93 | 0916 |
So, What Happened?
We do not know for sure, but based on my own experience supervising the staff of two command centers (Pacific Command Intelligence Watch and the National Military Intelligence Center) I have a pretty good idea. In a previous article, I used a Sudoku puzzle metaphor, explaining that an early wrong entry, undetected, makes a solution impossible. NORAD made four errors, twice, in determining what entries to make.
First, they failed in September 2001 and again in May 2003 to listen to and understand the events of the morning as recorded at NEADS. They had to listen to just two channels, DRM1, Channel 2, the Mission Crew Commander position and DRM 1, Channel 4, an ID Technician position.
Second, they failed on both occasions to accurately parse the single most important document of the day concerning military notifications, the Mission Crew Commander/Technician (MCC/T) log. As does a ship’s log, that log accounts for, chronologically, the important actions of any given day.
Third, they, together with FAA, failed on both occasions to reach an accurate and agreed upon position.
Fourth, they failed on both occasions to accurately define the list of hijacked planes, as reported to them by FAA, concerning notifications to the military.
As a result, in the first go-round, once they made what they thought was the correct and only entry for AA 11, 0840, then no other possibility was considered, and the next American Airline entry in the MCC/T log was, without parsing, assumed to be a reference to AA 77.
In the second go-round in preparation for the May 2003 testimony, once they decided there was no necessity to establish a notification time for UA 175, then the first United Airlines entry in the MCC/T log, 0916, was assumed, without parsing, to be a reference to UA 93.
This is a simple and logical explanation of what happened. It is consistent with my understanding of how staffs work and how after-action reviews are accomplished.
Had concerned NEADS, CONR, and NORAD staff listened to the MCC and ID Technician position tapes as a first, and mandatory, order of business, they would have, by necessity, come up with the following table as a starting point. (additional entries in blue)
| Hijacked Plane | Time |
|---|---|
| AA 11 | |
| UA 175 | |
| AA 11 | |
| AA 77 | |
| D 1989 | |
| UA93 |
With that accurate baseline established, the recorded and logged events at NEADS easily fall into place. Times below are as they actually appear in the MCC/T log, consistent with the methodology that Colonel Scott stated he used when he briefed the Commission on May 23, 2003. (Click on the times for audio)
| Hijacked Plane | Time |
|---|---|
| AA 11 | 0840 |
| UA 175 | 0905; 0916 |
| AA 11 | 0924 |
| AA 77 | 0934 |
| D 1989 | 0941 |
| UA93 | 1007 |
Assessment
The single most important error was the failure at NEADS to acknowledge the notification that AA 11 was reborn and to understand that the 0924 MCC/T log entry, a tail number, was a specific reference to AA 11, as established on the NEADS tapes. That error was compounded the Colonel Speicher/General Moore failure to sort out the log entries pertaining to AA 77 notification. The resulting incorrect determination was a notification time of 0924 for AA 77. That time survived the NORAD vetting process and ended up as definitive in General Eberhart’s testimony, a fait accompli.
The NORAD timeline 0843 error concerning UA 175 is problematic. As one individual at NORAD explained to us in passing (not recorded), the fact was that the Otis fighters had already been scrambled and were airborne because of the original notification for AA 11. The 0843 time was omitted, correctly, during the May 23, 2003 testimony. NORAD, however, made another egregious error, a simple failure to parse the MCC/T log, and equate a 0916 time to UA 175. The resultant incorrect entry was a 0916 time for UA 93.
NORAD also failed to account for D 1989, the only plane they tracked that morning. Further, it was the only plane reported hijacked by NORAD to the National Command Authority via the Air Threat Conference Call. In the aftermath NORAD conflated D 1989 with UA 93 and concluded, erroneously, that it had been tracking and reporting on UA 93.
In sum, two incorrect entries on two different occasions made the puzzle twice unsolvable.
The failure to twice solve the puzzle falls squarely on the shoulders of the Commander and staff at NEADS and at CONR. The failure to confirm the work of subordinate staffs falls squarely on the leadership at NORAD.
Regrettably, an organization, NEADS, that performed well on the morning of September 11, 2001, given the failure by FAA to provide actionable target information, performed abysmally thereafter.
Chaos Theory considered
In my consideration of Chaos, I determined that we could use, metaphorically, the language of Chaos Theory to analyze the terrorist attack and the counterattack. Specifically, I discussed strange attractors, nonlinearity, cascading bifurcation, and disruptive feedback. That morning, the false reports that AA 11 was reborn and that D 1989 was hijacked were disruptive feedback. The feedback was so disruptive that it contaminated all subsequent NORAD and FAA fact-finding and analysis. The matter was left to the Commission to sort it out, which it did.
One thought on “9-11: NORAD and FAA Timelines; in perspective”
Comments are closed.