The 9/11 Commission Report
From Chapter 1, section 1.2

1.2 IMPROVISING A HOMELAND DEFENSE

The FAA and NORAD
On 9/11, the defense of U.S. airspace depended on close interaction between two federal agencies: the FAA and the North American Aerospace Defense Command (NORAD). The most recent hijacking that involved U.S. air traffic controllers, FAA management, and military coordination had occurred in 1993. In order to understand how the two agencies interacted eight years later, we will review their missions, command and control structures, and working relationship on the morning of 9/11.

FAA Mission and Structure. As of September 11, 2001, the FAA was mandated by law to regulate the safety and security of civil aviation. From an air traffic controller’s perspective, that meant maintaining a safe distance between airborne aircraft.

Many controllers work at the FAA’s 22 Air Route Traffic Control Centers. They are grouped under regional offices and coordinate closely with the national Air Traffic Control System Command Center, located in Herndon, Virginia, which oversees daily traffic flow within the entire airspace system. FAA headquarters is ultimately responsible for the management of the National Airspace System. The Operations Center located at FAA headquarters receives notifications of incidents, including accidents and hijackings.

FAA Control Centers often receive information and make operational decisions independently of one another. On 9/11, the four hijacked aircraft were monitored mainly by the centers in Boston, New York, Cleveland, and Indianapolis. Each center thus had part of the knowledge of what was going on across the system. What Boston knew was not necessarily known by centers in New York, Cleveland, or Indianapolis, or for that matter by the Command Center in Herndon or by FAA headquarters in Washington.

Controllers track airliners such as the four aircraft hijacked on 9/11 primarily by watching the data from a signal emitted by each aircraft’s transponder equipment. Those four planes, like all aircraft traveling above 10,000 feet, were required to emit a unique transponder signal while in flight.

On 9/11, the terrorists turned off the transponders on three of the four hijacked aircraft. With its transponder off, it is possible, though more difficult, to track an aircraft by its primary radar returns. But unlike transponder data, primary radar returns do not show the aircraft’s identity and altitude. Controllers
at centers rely so heavily on transponder signals that they usually do not display primary radar returns on their radar scopes. But they can change the configuration of their scopes so they can see primary radar returns. They did this on 9/11 when the transponder signals for three of the aircraft disappeared.

Before 9/11, it was not unheard of for a commercial aircraft to deviate slightly from its course, or for an FAA controller to lose radio contact with a pilot for a short period of time. A controller could also briefly lose a commercial aircraft’s transponder signal, although this happened much less frequently. However, the simultaneous loss of radio and transponder signal would be a rare and alarming occurrence, and would normally indicate a catastrophic system failure or an aircraft crash. In all of these instances, the job of the controller was to reach out to the aircraft, the parent company of the aircraft, and other planes in the vicinity in an attempt to reestablish communications and set the aircraft back on course. Alarm bells would not start ringing until these efforts—which could take five minutes or more—were tried and had failed.

NORAD Mission and Structure. NORAD is a binational command established in 1958 between the United States and Canada. Its mission was, and is, to defend the airspace of North America and protect the continent. That mission does not distinguish between internal and external threats; but because NORAD was created to counter the Soviet threat, it came to define its job as defending against external attacks.

The threat of Soviet bombers diminished significantly as the Cold War ended, and the number of NORAD alert sites was reduced from its Cold War high of 26. Some within the Pentagon argued in the 1990s that the alert sites should be eliminated entirely. In an effort to preserve their mission, members of the air defense community advocated the importance of air sovereignty against emerging “asymmetric threats” to the United States: drug smuggling, “non-state and state-sponsored terrorists,” and the proliferation of weapons of
mass destruction and ballistic missile technology.

NORAD perceived the dominant threat to be from cruise missiles. Other threats were identified during the late 1990s, including terrorists’ use of aircraft as weapons. Exercises were conducted to counter this threat, but they were not based on actual intelligence. In most instances, the main concern was the use of such aircraft to deliver weapons of mass destruction.

Prior to 9/11, it was understood that an order to shoot down a commercial aircraft would have to be issued by the National Command Authority (a phrase used to describe the president and secretary of defense). Exercise planners also assumed that the aircraft would originate from outside the United States, allowing time to identify the target and scramble interceptors. The threat of terrorists hijacking commercial airliners within the United States—and using them as guided missiles—was not recognized by NORAD before 9/11.

Notwithstanding the identification of these emerging threats, by 9/11 there were only seven alert sites left in the United States, each with two fighter aircraft on alert. This led some NORAD commanders to worry that NORAD was not postured adequately to protect the United States.

In the United States, NORAD is divided into three sectors. On 9/11, all the hijacked aircraft were in NORAD’s Northeast Air Defense Sector (also known as NEADS), which is based in Rome, New York. That morning NEADS could call on two alert sites, each with one pair of ready fighters: Otis Air National Guard Base in Cape Cod, Massachusetts, and Langley Air Force Base in Hampton,Virginia. Other facilities, not on “alert,”would need time to arm the fighters and organize crews.

NEADS reported to the Continental U.S. NORAD Region (CONR) headquarters, in Panama City, Florida, which in turn reported to NORAD headquarters, in Colorado Springs, Colorado.

Interagency Collaboration. The FAA and NORAD had developed protocols for working together in the event of a hijacking. As they existed on 9/11, the protocols for the FAA to obtain military assistance from NORAD required multiple levels of notification and approval at the highest levels of government.

FAA guidance to controllers on hijack procedures assumed that the aircraft pilot would notify the controller via radio or by “squawking”a transponder code of “7500”—the universal code for a hijack in progress. Controllers would notify their supervisors, who in turn would inform management all the way up to FAA
headquarters in Washington.Headquarters had a hijack coordinator,who was the director of the FAA Office of Civil Aviation Security or his or her designate.

If a hijack was confirmed, procedures called for the hijack coordinator on duty to contact the Pentagon’s National Military Command Center (NMCC) and to ask for a military escort aircraft to follow the flight, report anything unusual, and aid search and rescue in the event of an emergency. The NMCC would then seek approval from the Office of the Secretary of Defense to provide military assistance. If approval was given, the orders would be transmitted down NORAD’s chain of command.

The NMCC would keep the FAA hijack coordinator up to date and help the FAA centers coordinate directly with the military. NORAD would receive tracking information for the hijacked aircraft either from joint use radar or from the relevant FAA air traffic control facility. Every attempt would be made to have the hijacked aircraft squawk 7500 to help NORAD track it.

The protocols did not contemplate an intercept. They assumed the fighter escort would be discreet, “vectored to a position five miles directly behind the hijacked aircraft,” where it could perform its mission to monitor the aircraft’s flight path.

In sum, the protocols in place on 9/11 for the FAA and NORAD to respond to a hijacking presumed that

• the hijacked aircraft would be readily identifiable and would not attempt to disappear;

• there would be time to address the problem through the appropriate FAA and NORAD chains of command; and

• the hijacking would take the traditional form: that is, it would not be a suicide hijacking designed to convert the aircraft into a guided missile.

On the morning of 9/11, the existing protocol was unsuited in every respect for what was about to happen.