Before we proceed to the chronology of events of 9/11, we turn to a description of the protocols of both the FAA and NORAD for response to a hijacking event.  As they existed on 9/11, the protocols for the FAA to obtain military assistance from NORAD required multiple levels of notification and approval at the highest levels of government before FAA and NEADS personnel would be authorized to communicate and coordinate an operational response.[i]

Pre-9/11, FAA guidance to ATCs on hijack procedures was predicated on the assumption that the aircraft pilot would notify the controller of the hijack via radio communication or by “squawking” a Mode 3 transponder code of 7500 – the universal code for a hijack in progress.

FAA protocols in existence on 9/11 required ATCs to notify their supervisor when a hijacking occurred, or was believed to have occurred.   Supervisors were then required to notify the managers of their facility and the corresponding ROC.  The ROC facility was then required to notify the WOC at FAA Headquarters.

WOC duty officers were then required to notify the FAA’s senior leadership, specifically the FAA “hijack coordinator” – identified as “the Director or his designate of the FAA Office of Civil Aviation Security”.   When FAA HQ receive[d] a report of a confirmed hijack, the FAA hijack coordinator on duty at HQ was required to make “direct contact” with the National Military Command Center located at the Pentagon and “request the military to provide an escort aircraft” to 1) “[a]ssure positive flight following”; 2) “[r]eport unusual observances”; and 3) “[a]id search and rescue in the event of an emergency”.  The NMCC would then seek and obtain approval from the Office of the Secretary of Defense (OSD) to provide military assistance.[ii]

When approval for military assistance [was] granted by the OSD, the NMCC would contact the Commander-in-Chief (“CINC”) NORAD in Colorado to advise NORAD that FAA’s request for a fighter escort ha[d] been approved.  NORAD HQ would then advise the NORAD region where the hijacked aircraft [was] located of the need to provide a fighter escort.  If the hijacked aircraft [was] located in CONUS, as all 4 hijacked aircraft were on 9/11, NORAD officials would contact CONR in Panama City, Florida.  CONR officials would then identify the appropriate NORAD Sector and assets that would be tasked to provide an operational response to the hijack event.  If the hijacked aircraft was located in the northeast region of the United States, as all 4 hijacked aircraft were on 9/11, CONR would notify NEADS, in Rome, New York.  NORAD HQ officials would then contact NMCC and identify NEADS as the defense sector tasked with the duty to provide a fighter escort for the hijacked aircraft.

The NMCC [would] then “advise the FAA hijack coordinator [of] the identification and location of the squadron tasked to provide escort aircraft.”  NMCC would finally “authorize direct coordination between FAA and the designated military unit.” Upon completion of this approval process, the FAA en route center that [was] tracking the hijacked aircraft would be authorized to coordinate the military response with NEADS.  In coordinating a timely response, the FAA facility would have to provide NEADS the following information 1) the call sign of the hijacked aircraft; 2) the time in universal time code; 3) the position of the hijacked aircraft in latitude and longitude; 4) the aircraft’s heading; 5) the aircraft’s speed; 6) the aircraft’s altitude; and 7) if the fighter escort has been launched, its  position with respect to the hijacked aircraft if requested by NEADS.  If the hijacking event was within the coverage of NORAD’s radar system, “every attempt” would be made to have the hijacked aircraft squawk 7500 to facilitate NEADS’ ability to track the aircraft.

“Except when specifically directed otherwise by FAA headquarters,” existing protocol provided the fighter escort aircraft must remain covert and be “vectored to a position five miles directly behind the hijacked aircraft.”  Indeed, on 9/11, the fighter aircraft, once scrambled and launched, were prepared and trained to: 1) approach and identify the target and 2) provide a covert escort (a “shadow”) for the aircraft until it landed safely at an airport.[iii]

Clearly, the protocol in place on 9/11 for the FAA and NORAD to respond to a hijacking was extremely time intensive.  When the clock began ticking with the first hijack of American 11 on the morning of 9/11, the time needed to follow the existing protocol would not be a luxury afforded anyone that day.

« Previous Section | Table of Contents | Next Section »

[i] Collin Scoggins interviews (September 22, 2003; Jan. 8, 2004); FAA report, “Crisis Management Handbook for Significant Events,” Feb. 15, 2000; DOD memo, CJCS instruction, “Aircraft Piracy (Hijacking) and Destruction of Derelict Airborne Objects, “ June 1, 2001.

[ii] See FAA regulations, Hijacked Aircraft, Order 7610.65M, para. 10-2-6 (2001); David Bottiglia interview (Oct. 1, 2003); FAA report, “Crisis Management Handbook for Significant Events,” Feb. 15, 2000. From interviews at various FAA centers, we learned that an air traffic controllers first response to an aircraft incident is to notify a supervisor, who then notifies the traffic management unit and the operations manager in charge. The FAA center next notifies the appropriate regional operations center (ROC), which in turn contacts FAA headquarters. Biggio stated that for American 11, the combination of three factors – loss of radio contact, loss of transponder signal, and course deviation – was serious enough for him to contact the ROC in Burlington, Mass. However, without hearing the threatening communication from the cockpit, he doubts Boston Center would have recognized or labeled American 11 “a hijack.” Terry Biggio interview (September 22, 2003); see also Shirley Miller interview (Mar. 30, 2004); Monte Belger interview (Apr. 20, 2004). For the responsibilities of the FAA hijack coordinator, see FAA regulations, Special Military Operations, Requests for Service, Order 7610.4J, paras. 7-1-1, 7-1-2 (2001); For NMCCC notification procedure, see DOD memo, CJCS instruction, “Aircraft Piracy (Hijacking) and Destruction of Derelict Airborne Objects,” June 1, 2001.

[iii] Ralph Eberhart interview (Mar. 1, 2004); William A. Scott interview (February 4, 2004); Robert Marr interview (Jan. 23, 2004); FAA regulations, position reports within NORAD radar coverage, para. 7-4-2, Air Ground/Communications Security, para. 7-1-6,  Vectors, para. 7-2-3 from Order 7610.4J.