9/11 hijackers Mohamed Atta and Abdulaziz Alomari check in at the US Airways counter at Portland International Jetport. [Portland Press Herald, 10/5/2001; Federal Bureau of Investigation, 10/5/2001] They are wearing ties and jackets. Atta checks in two bags, Alomari none. Atta is randomly selected for additional security scrutiny by the FAA’s Computer Assisted Passenger Prescreening System (CAPPS) (see (6:20 a.m.-7:48 a.m.) September 11, 2001). However, the only consequence is that his checked bags will be held off the plane until it is confirmed that he has boarded. [9/11 Commission, 7/24/2004, pp. 1; 9/11 Commission, 8/26/2004, pp. 2; CNN, 3/3/2006] Noting that their flight is soon due to leave, the ticket agent who checks them in, Michael Tuohey, says, “You’re cutting it close.” [Portland Press Herald, 3/6/2005] Tuohey thinks the pair seems unusual. He notices they both have $2,500 first-class, one-way tickets. He later comments, “You don’t see many of those.” Atta looks “like a walking corpse. He looked so angry.” In contrast, Tuohey will say, Alomari can barely speak English and has “a goofy smile, I can’t believe he knew he was going to die that day.” Tuohey will later recount, “I thought they looked like two Arab terrorists but then I berated myself for the stereotype and did nothing.” [Philadelphia Daily News, 2/24/2005; Mirror, 9/11/2005; CNN, 3/3/2006] Atta becomes angry when Tuohey informs him he will have to check in again in Boston. He complains that he was assured he would have a “one-step check-in.” [9/11 Commission, 8/26/2004, pp. 2; Associated Press, 3/7/2005] Tuohey will be recalled to work later in the day to speak to an FBI agent about his encounter with Atta and Alomari. He is shown video footage of them passing through the airport’s security checkpoint upstairs (see (Between 5:45 a.m. and 5:53 a.m.) September 11, 2001). Although recognizing the two men, he notices that in the video they are no longer wearing the jackets and ties they’d had on when checking in just minutes before. He assumes they must have taken these off and tucked them into their carry-on baggage. He is also informed that the security camera behind his own desk, which should have captured the two hijackers, has in fact been out of order for some time. [Portland Press Herald, 3/6/2005; CNN, 3/3/2006]
6:00 a.m. September 11, 2001: Two 9/11 Hijackers Fly to Boston Airport
9/11 hijackers Mohamed Atta and Abdulaziz Alomari’s flight from Portland to Boston takes off. [Federal Bureau of Investigation, 10/4/2001] Their plane, Colgan Air Flight 5930, is a 19-seat Beechcraft 1900. [Federal Bureau of Investigation, 2001; 9/11 Commission, 8/26/2004, pp. 3] Fellow passengers Vincent Meisner and Roger Quirion will later say Atta and Alomari board separately, keep quiet, and do not draw attention to themselves. [Chicago Sun-Times, 9/16/2001; Washington Post, 9/16/2001] Quirion, says: “They struck me as business travelers. They were sitting down, talking, seems like they were going over some paperwork.” [CBS News, 10/12/2001]
6:20 a.m.-7:48 a.m. September 11, 2001: Hijackers Arrive at Airports and Board Flights; Computer Screening Program Fails to Stop Them
All the alleged 9/11 hijackers reportedly check in at the airports from where they board Flights 11, 175, 77, and 93. [9/11 Commission, 7/24/2004, pp. 1-4; 9/11 Commission, 8/26/2004, pp. 27, 89, 93] Since 1998, the FAA has required air carriers to implement a program called the Computer Assisted Passenger Prescreening System (CAPPS). This identifies those passengers who might be a security risk, based upon suspicious behavior such as buying one-way tickets or paying with cash. CAPPS also randomly assigns some passengers to receive additional security scrutiny. If a particular passenger has been designated as a “selectee,” this information is transmitted to the airport’s check-in counter, where a code is printed on their boarding pass. At the airport’s security checkpoints, selectees are subjected to additional security measures. [US News and World Report, 4/1/2002; 9/11 Commission, 1/27/2004; US Congress, 3/17/2004; 9/11 Commission, 8/26/2004, pp. 2, 85] Their baggage is to be screened for explosives or held off the plane until they have boarded. Supposedly, the thinking behind this is that someone smuggling a bomb onto a plane won’t get onto that same flight. According to the 9/11 Commission, nine of the 19 hijackers are flagged by the CAPPS system before boarding Flights 11, 175, 77, and 93. [Washington Post, 1/28/2004; 9/11 Commission, 7/24/2004, pp. 84; United States of America v. Zacarias Moussaoui, a/k/a Shaqil, a/k/a Abu Khalid al Sahrawi, Defendant, 3/6/2006] In addition, Mohamed Atta was selected when he checked in at the airport in Portland, for his earlier connecting flight to Boston (see 5:33 a.m.-5:40 a.m. September 11, 2001). All of the hijackers subsequently pass through security checkpoints before boarding their flights. [9/11 Commission, 7/24/2004, pp. 1-4]
6:30 a.m. September 11, 2001: NORAD on Alert for Emergency Exercises
Lieutenant Colonel Dawne Deskins and other day shift employees at NORAD’s Northeast Air Defense Sector (NEADS) in Rome, NY, start their workday. NORAD is conducting a week-long, large-scale exercise called Vigilant Guardian. [Newhouse News Service, 1/25/2002] Deskins is regional mission crew chief for the Vigilant Guardian exercise. [ABC News, 9/11/2002]
Exercise Includes Simulated Attack on the US – Vigilant Guardian is described as “an exercise that would pose an imaginary crisis to North American Air Defense outposts nationwide”; as a “simulated air war”; and as “an air defense exercise simulating an attack on the United States.” According to the 9/11 Commission, it “postulated a bomber attack from the former Soviet Union.” [Newhouse News Service, 1/25/2002; Filson, 2003, pp. 55 and 122; 9/11 Commission, 7/24/2004, pp. 458] Vigilant Guardian is described as being held annually, and is one of NORAD’s four major annual exercises. [Filson, 2003, pp. 41; Arkin, 2005, pp. 545; GlobalSecurity (.org), 4/27/2005] However, one report says it takes place semi-annually. [Aviation Week and Space Technology, 6/3/2002] Accounts by participants vary on whether 9/11 is the second, third, or fourth day of the exercise. [Code One Magazine, 1/2002; Newhouse News Service, 1/25/2002; Ottawa Citizen, 9/11/2002] Vigilant Guardian is a command post exercise (CPX), and in at least some previous years was conducted in conjunction with Stratcom’s Global Guardian exercise and a US Space Command exercise called Apollo Guardian. [US Congress, n.d.; Arkin, 2005, pp. 545; GlobalSecurity (.org), 4/27/2005] All of NORAD is participating in Vigilant Guardian on 9/11. [Aviation Week and Space Technology, 6/3/2002]
Exercise Includes Simulated Hijacking – Vanity Fair reports that the “day’s exercise” (presumably Vigilant Guardian) is “designed to run a range of scenarios, including a ‘traditional’ simulated hijack in which politically motivated perpetrators commandeer an aircraft, land on a Cuba-like island, and seek asylum.” [Vanity Fair, 8/1/2006] However, at NEADS, most of the dozen or so staff on the operations floor have no idea what the exercise is going to entail and are ready for anything. [Utica Observer-Dispatch, 8/5/2004]
NORAD Fully Staffed and Alert – NORAD is currently running a real-world operation named Operation Northern Vigilance (see September 9, 2001). It may also be conducting a field training exercise calling Amalgam Warrior on this morning (see 9:28 a.m. September 11, 2001). NORAD is thus fully staffed and alert, and senior officers are manning stations throughout the US. The entire chain of command will be in place and ready when the first hijacking is reported. An article later says, “In retrospect, the exercise would prove to be a serendipitous enabler of a rapid military response to terrorist attacks on September 11.” [Aviation Week and Space Technology, 6/3/2002; Bergen Record, 12/5/2003] Colonel Robert Marr, in charge of NEADS, will say: “We had the fighters with a little more gas on board. A few more weapons on board.” [ABC News, 9/11/2002] However, Deskins and other NORAD officials later are initially confused about whether the 9/11 attacks are real or part of the exercise (see (8:38 a.m.-8:43 a.m.) September 11, 2001).
8:13 a.m. September 11, 2001: Flight 11 Makes Its Last Communication with Air Traffic Control
The last routine communication takes place between air traffic control and the pilots of Flight 11 at 8:13 and 29 seconds. Boston Center air traffic controller Pete Zalewski is handling the flight, and instructs it to turn 20 degrees to the right. Pilot John Ogonowski immediately acknowledges the instruction, but seconds later he fails to respond to a command to climb to 35,000 feet. Zalewski repeatedly tries to reach the pilot over the next ten minutes, even using the emergency frequency, but gets no response (see 8:14 a.m.-8:24 a.m. September 11, 2001). The 9/11 Commission concludes that Flight 11 is hijacked at 8:14, or shortly afterwards (see 8:14 a.m. September 11, 2001). [New York Times, 10/16/2001; MSNBC, 9/11/2002; 9/11 Commission, 6/17/2004 
; 9/11 Commission, 7/24/2004, pp. 4]
8:14 a.m. September 11, 2001: Flight 11 Is Hijacked, but Pilot Makes No Distress Call
The 9/11 Commission will later conclude that Flight 11 is hijacked at 8:14 or shortly after. It will state, “Information supplied by eyewitness accounts indicates that the hijackers initiated and sustained their command of the aircraft using knives (as reported by two flight attendants); violence, including stabbing and slashing (as reported by two flight attendants); the threat of violence (as indicated by a hijacker in radio transmissions received by air traffic control); Mace (reported by one flight attendant); the threat of a bomb, either fake or real (reported by one flight attendant); and deception about their intentions (as indicated by a hijacker in a radio transmission received by air traffic control).” [9/11 Commission, 8/26/2004, pp. 8] The Commission says, “We do not know exactly how the hijackers gained access to the cockpit; FAA rules required that the doors remain closed and locked during flight.… Perhaps the terrorists stabbed the flight attendants to get a cockpit key, to force one of them to open the cockpit door, or to lure the captain or first officer out of the cockpit. Or the flight attendants may just have been in their way.” [9/11 Commission, 7/24/2004, pp. 5] Pilots are trained to handle hijackings by staying calm, complying with any requests, and, if possible, dialing an emergency four-digit code on their plane’s transponder. It only takes a few seconds to dial this code. [CNN, 9/12/2001] Yet, as the Boston Globe notes, “It appears that the hijackers’ entry was surprising enough that the pilots did not have a chance to broadcast a traditional distress call” (see (8:13 a.m.-9:28 a.m.) September 11, 2001). [Boston Globe, 11/23/2001] The Los Angeles Times reports that, when flight attendant Amy Sweeney makes a phone call from the plane, she says the hijackers have “just gained access to the cockpit.” [Los Angeles Times, 9/20/2001] Yet her first attempted call is not until 8:22, and, according to official accounts, her first call that stays connected is at 8:25, well past when the 9/11 Commission says the hijacker takeover occurs. [9/11 Commission, 8/26/2004, pp. 9-10; US District Court for the Eastern District of Virginia, Alexandria Division, 7/31/2006] According to an employee at the FAA’s Boston Center, Flight 11 is hijacked while it is over Gardner, Massachusetts, about 45 miles northwest of Boston. [Telegraph (Nashua), 9/12/2001; Associated Press, 9/13/2001]
8:19 a.m. September 11, 2001: Flight 11 Attendant Betty Ong Describes Emergency on Her Plane
Betty Ong, a flight attendant on Flight 11, begins relaying information about the trouble on her plane to employees at the American Airlines Southeastern Reservations Office in Cary, North Carolina. [9/11 Commission, 7/24/2004, pp. 5] Ong has just called the reservations office to report the hijacking of Flight 11, and is on the line with two employees there: Vanessa Minter and Winston Sadler (see 8:18 a.m. September 11, 2001). [Federal Bureau of Investigation, 9/12/2001, pp. 38-41; 9/11 Commission, 7/24/2004, pp. 453]
Ong Describes Hijacking but Gives Wrong Flight Number – Ong tells Minter and Sadler: “The cockpit’s not answering, somebody’s stabbed in business class, and I think there’s Mace, that we can’t breathe.… I think we’re getting hijacked.” Sadler asks Ong what flight she is on and Ong replies, incorrectly, “Flight 12.” She says her plane just left Boston and is supposed to go to Los Angeles, and the pilots are not answering the phone in the cockpit. She says she is in the jump seat, 3R, which is at the back of the plane, behind the coach section. [American Airlines, 9/11/2001, pp. 3-6; 9/11 Commission, 8/26/2004, pp. 6, 8] However, Amy Sweeney, another flight attendant who makes a call from Flight 11, is in the next-to-last row of passenger seats in the coach section of the plane, and she will say that Ong is sitting next to her (see (8:32 a.m.-8:44 a.m.) September 11, 2001). [New York Observer, 2/15/2004; New York Observer, 6/20/2004; 9/11 Commission, 8/26/2004, pp. 11]
Ong Says Two Flight Attendants Stabbed – Sadler asks Ong her name and she replies: “My name is Betty Ong. I’m number three [flight attendant] on Flight 11.” She says the number one flight attendant and the number five flight attendant have been stabbed. [American Airlines, 9/11/2001, pp. 3-6] These two attendants are Barbara Arestegui and Karen Martin. [9/11 Commission, 8/26/2004, pp. 6] Ong says, “Nobody knows who stabbed who and we can’t even get up to business class right now, ‘cause nobody can breathe.” She also says: “We can’t get into the cockpit. The door won’t open.” [American Airlines, 9/11/2001, pp. 3-6] Sadler takes notes of the call, using his computer “scratch pad.” [Federal Bureau of Investigation, 9/12/2001, pp. 42-44] He notifies Ong of this, saying, “I’m taking it down, all the information.” He tells Ong, “We’re also, you know, of course, recording this.” [American Airlines, 9/11/2001, pp. 3-6]
Ong Receiving Details of Hijacking from Colleague – During the entire conversation, Sadler will later recall, Ong seems to be talking to someone in the background and receiving information from them. [Federal Bureau of Investigation, 9/12/2001, pp. 42-44] This person is presumably Sara Low, another of the flight attendants, who was assigned to the front of the plane and so would have witnessed the hijacking when it happened. [Associated Press, 3/5/2009; New York Daily News, 3/6/2009; Arkansas Democrat-Gazette, 9/11/2011] Ong will keep repeating herself during the call, Minter will recall, such as repeatedly mentioning the stabbings on her plane. [Federal Bureau of Investigation, 9/12/2001, pp. 38-41] Nydia Gonzalez, a supervisor at the reservations office, has been alerted to the call and will soon join it (see 8:21 a.m. September 11, 2001). [9/11 Commission, 11/19/2003 ; 9/11 Commission, 7/24/2004, pp. 453]
8:24 a.m. September 11, 2001: Boston Air Traffic Controllers Hear Flight 11 Hijacker Say, ‘We Have Some Planes,’ but Uncertain of Origin of Transmission
Because the talkback button on Flight 11 has been activated, Boston Center air traffic controllers can hear a hijacker on board say to the passengers: “We have some planes. Just stay quiet and you’ll be OK. We are returning to the airport.” [Boston Globe, 11/23/2001; 9/11 Commission, 7/24/2004, pp. 19] Air traffic controller Pete Zalewski recognizes this as a foreign, Middle Eastern-sounding voice, but does not make out the specific words “we have some planes.” He responds, “Who’s trying to call me?” Seconds later, in the next transmission, the hijacker continues: “Nobody move. Everything will be OK. If you try to make any moves you’ll endanger yourself and the airplane. Just stay quiet.” [New York Times, 10/16/2001; 9/11 Commission, 6/17/2004 ; MSNBC, 9/9/2006] Bill Peacock, the FAA director of air traffic services, later claims, “We didn’t know where the transmission came from, what was said and who said it.” David Canoles, the FAA’s manager of air traffic evaluations and investigations, adds: “The broadcast wasn’t attributed to a flight. Nobody gave a flight number.” [Washington Times, 9/11/2002] Similarly, an early FAA report will state that both these transmissions came from “an unknown origin.” [Federal Aviation Administration, 9/17/2001 ] Zalewski asks for an assistant to help listen to the transmissions coming from the plane, and puts its frequency on speakers so others at Boston Center can hear. Because Zalewski didn’t understand the initial hijacker communication from Flight 11, the manager of Boston Center instructs the center’s quality assurance specialist to “pull the tape” of the transmission, listen to it carefully, and then report back. They do this, and by about 9:03 a.m. a Boston manager will report having deciphered what was said in the first hijacker transmission (see 9:03 a.m. September 11, 2001). [9/11 Commission, 6/17/2004 ; MSNBC, 9/9/2006] Fellow Boston controller Don Jeffroy also hears the tape of the hijacker transmissions, though he doesn’t state at what time. He says: “I heard exactly what Pete [Zalewski] heard. And we had to actually listen to it a couple of times just to make sure that we were hearing what we heard.” [MSNBC, 9/11/2002] At some point, Ben Sliney, the national operations manager at the FAA’s Herndon Command Center, gets word of the “We have some planes” message, and later says the phrase haunts him all morning. American Airlines Executive Vice President for Operations Gerard Arpey is also informed of the “strange transmissions from Flight 11” at some point prior to when it crashes at 8:46 a.m. [USA Today, 8/12/2002] Boston Center will receive a third transmission from Flight 11 about ten minutes later (see (8:34 a.m.) September 11, 2001).
8:25 a.m. September 11, 2001: Boston Center Starts Notifying Chain of Command
Boston flight control begins notifying the chain of command that a suspected hijacking of Flight 11 is in progress. Those notified include the center’s own facility manager, the FAA’s New England Regional Operations Center (ROC) in Burlington, Massachusetts, and the FAA Command Center in Herndon, Virginia (see 8:28 a.m. September 11, 2001). [Federal Aviation Administration, 9/17/2001 ; 9/11 Commission, 8/26/2004, pp. 11] According to the 9/11 Commission, this is consistent with FAA protocol: “From interviews of controllers at various FAA centers, we learned that an air traffic controller’s first response to an aircraft incident is to notify a supervisor, who then notifies the traffic management unit and the operations manager in charge. The FAA center next notifies the appropriate regional operations center (ROC), which in turn contacts FAA headquarters.” [9/11 Commission, 7/24/2004, pp. 458] But according to Ben Sliney, the national operations manager at the FAA’s Command Center, “the protocol was in place that the center that reported the hijacking would notify the military.… I go back to 1964, where I began my air traffic career, and they have always followed the same protocol.” [9/11 Commission, 6/17/2004] Yet Boston Center supposedly will not contact NORAD about Flight 11 until about 12 minutes later (see (8:37 a.m.) September 11, 2001). Already about ten minutes have passed since controllers first noticed a loss of contact with Flight 11 (see (8:15 a.m.) September 11, 2001). Boston reportedly also contacts several other air traffic control centers about the suspected hijacking at this time (see 8:25 a.m. September 11, 2001).
8:30 a.m. September 11, 2001: US Military Holding ‘Practice Armageddon’ Nationwide Training Exercise
As the 9/11 attacks are taking place, a large military training exercise called Global Guardian is said to be “in full swing.” It has been going on since the previous week. [Omaha World-Herald, 2/27/2002; Omaha World-Herald, 9/10/2002] Global Guardian is an annual exercise sponsored by US Strategic Command (Stratcom) in cooperation with US Space Command and NORAD. One military author defines Stratcom as “the single US military command responsible for the day-to-day readiness of America’s nuclear forces.” [Arkin, 2005, pp. 59]
Exercise Tests Military’s Ability to Fight a Nuclear War – Global Guardian is a global readiness exercise involving all Stratcom forces and aims to test Stratcom’s ability to fight a nuclear war. It is one of many “practice Armageddons” that the US military routinely stages. [Bulletin of the Atomic Scientists, 11/1/1997; Associated Press, 2/21/2002; Omaha World-Herald, 2/27/2002; Omaha World-Herald, 9/10/2002] It links with a number of other military exercises, including Crown Vigilance (an Air Combat Command exercise), Apollo Guardian (a US Space Command exercise), and the NORAD exercises Vigilant Guardian and Amalgam Warrior. [US Department of Defense, 5/1997; GlobalSecurity (.org), 4/27/2005] Global Guardian is both a command post and a field training exercise, and is based around a fictitious scenario designed to test the ability of Stratcom and its component forces to deter a military attack against the US. Hundreds of military personnel are involved. [US Congress, n.d.; Collins Center Update, 12/1999 ; Times-Picayune, 9/8/2002] The exercise involves “a lot of the elements of what ultimately would be the nuclear command and control system in support of a national emergency,” according to Admiral Richard Mies, the commander in chief of Stratcom. It includes an “exercise secretary of defense” and “an exercise president.” Mies will say that because of the exercise, “A lot of [Stratcom’s] command and control systems that, in peacetime, are normally not on alert were at a much, much higher state of alert [on September 11] and we had a number of aircraft, manned control aircraft that were airborne that were simulating their wartime roles.” [NET News, 12/27/2011]
Exercise Normally Held in October or November – According to a 1998 Internet article by the British American Security Information Council—an independent research organization—Global Guardian is held in October or November each year. [Kristensen, 10/1998] In his book Code Names, NBC News military analyst William Arkin dates this exercise for October 22-31, 2001. [Arkin, 2005, pp. 379] And a military newspaper reported in March 2001 that Global Guardian was scheduled for October 2001. [Space Observer, 3/23/2001, pp. 2 ] If this is correct, then some time after March, the exercise must have been rescheduled for early September.
Exercise Includes a ‘Computer Network Attack’ – Furthermore, a 1998 Defense Department newsletter reported that for several years Stratcom had been incorporating a computer network attack (CNA) into Global Guardian. The attack involved Stratcom “red team” members and other organizations acting as enemy agents, and included attempts to penetrate the command using the Internet and a “bad” insider who had access to a key command and control system. The attackers “war dialed” the phones to tie them up and sent faxes to numerous fax machines throughout the Command. They also claimed they were able to shut down Stratcom’s systems. Reportedly, Stratcom planned to increase the level of computer network attack in future Global Guardian exercises. [IAnewsletter, 6/1998 ] It is unclear if a computer network attack is incorporated into Global Guardian in 2001.
