The North American Aerospace Defense Command (NORAD) practices a scenario in which terrorists plan to crash a stolen aircraft into the White House in Washington, DC. The scenario is included in a command post exercise conducted by the Continental United States NORAD Region (CONR) called Falcon Indian. [North American Aerospace Defense Command, 8/25/1989; US Air Force, 2003 
; Arkin, 2005, pp. 362]
Terrorists Have Stolen a Plane – The scenario is intended to practice identification, intercept, and terrorist procedures. In it, the FBI contacts the commander in chief of NORAD this morning and tells him that two members of a terrorist group called AOL have stolen a Learjet 35—a small jet aircraft—from the airport in Bermuda. The FBI says the aircraft is loaded with explosives, is heading toward the United States, and the terrorists intend to carry out a suicide attack against the White House. The stolen Learjet is being flown “in tight formation” under a Canadair 600—another kind of business jet—at an altitude of 20,000 feet. For some reason, the flight plan for the Canadair plane is not in the system and is therefore unknown.
Commander Has to Order the Shootdown of the Stolen Plane – The simulated NORAD commander in chief in the exercise has to contact the CONR battle commander and order the destruction of the Learjet before it crashes into its target. But before an attempt is made to destroy the plane, NORAD’s Northeast Air Defense Sector must ensure that the aircraft it confronts is the correct one, such as by checking the plane’s tail number. After NORAD fighter jets intercept the Learjet, the fighter pilots report that it is hidden underneath the Canadair plane and confirm that its tail number is that of the stolen aircraft.
Scenario Can End with the Learjet Crashing into a Populated Area – However, in the scenario, the terrorists notice the fighters and take evasive action, accelerating to maximum speed and heading at low altitude toward the White House. After this, more than one outcome is possible. If the fighter pilots gain clearance to shoot down the Learjet and are able to do so over water, then they should do this. However, if the Learjet is over a populated area, this fact should be declared and, if necessary, the scenario should progress to the plane crashing into a heavily populated residential area. This will result in 20 people being killed, 100 people being injured, and many fires occurring. NORAD will hold another Falcon Indian exercise that features the same scenario as is used in today’s exercise in June this year (see June 5, 1999). [US Air Force, 2003 ] And a scenario that is apparently identical to this will be included in a Falcon Indian exercise in June 2000 (see June 5, 2000). [US Congress. Senate. Committee on Armed Services, 8/17/2004]
March 24, 1999-2001: NEADS Officer Presents Briefing on Threat of Terrorists Crashing Planes into Buildings
Lieutenant Colonel Mark Stuart, an intelligence officer at NORAD’s Northeast Air Defense Sector (NEADS), drafts a briefing that he then gives at various venues, on the threat of terrorists using aircraft to crash into buildings. According to a memo of his 2003 interview with the 9/11 Commission, Stuart briefs “over time in 1999, 2000, and 2001 the logical progression that linked hijackings to the use of explosives in vehicles [a probable reference to the 1998 African embassy bombings] and then, logically, to the use of aircraft.” Stuart gives his briefing at annual intelligence conferences at both the Continental United States NORAD Region (CONR) and NORAD itself. At CONR, the receiving official is Colonel Tom Glenn; at NORAD it is Navy Captain Michael Kuhn. According to the 9/11 Commission memo, the hijacking scenarios that Stuart conceives are “primarily personal views; there was no substantive intelligence. He based his analysis on the boldness of past terrorist actions.” Stuart also discusses his analyses with his counterparts at NORAD’s Southeast Air Defense Sector (SEADS)—a Major Clegg—and its Western Air Defense Sector (WADS)—a Lieutenant Colonel Schauer. In all cases, he briefs that a hijacking would originate overseas, inbound to the US. He never imagines it could originate inside the US. Stuart believes that security vulnerabilities overseas make it far more likely that hijackings will come from outside the US. He never imagines multiple hijackings in any scenario, although he envisions terrorists taking over planes and piloting them at the last possible moment as they crash. Stuart will be at NEADS on 9/11, and will participate in its response to that day’s attacks. [9/11 Commission, 10/30/2003 ]
June 5, 1999: NORAD Exercise Is Based on Terrorists Planning to Crash a Plane into the White House
The North American Aerospace Defense Command (NORAD) practices a scenario in which terrorists plan to crash a stolen aircraft into the White House in Washington, DC. The scenario is included in a command post exercise called Falcon Indian that is conducted by the Continental United States NORAD Region (CONR). [North American Aerospace Defense Command, 8/25/1989; US Air Force, 2003 ; Arkin, 2005, pp. 362] It is identical to a scenario that was included in a previous Falcon Indian exercise, held in January this year (see January 9, 1999), and is intended to practice identification, intercept, and terrorist procedures.
Plane Was Stolen in Bermuda – It begins with FBI headquarters contacting the commander in chief of NORAD and telling him that two members of a terrorist group called AOL have stolen a Learjet 35—a small jet aircraft—from the airport in Bermuda. The aircraft is loaded with explosives, is heading toward the United States, and the terrorists plan to carry out a suicide attack against the White House. The stolen plane is being flown very close to and under a Canadair 600 business jet.
Fighters Intercept the Stolen Plane – The simulated NORAD commander in chief in the exercise has to contact the CONR battle commander and order that, after being correctly identified, the Learjet should be shot down. Fighter jets are able to intercept the Learjet and their pilots report that its tail number is indeed that of the stolen plane. However, the terrorists notice the fighters and, in response, accelerate to maximum speed and head at a low altitude toward the White House.
Fighters Can Shoot Down the Learjet if It Is over Water – The scenario is “dynamic” and so more than one outcome is possible. If the fighter pilots have the necessary clearance and are able to do so, they should shoot down the Learjet over water. However, if the Learjet is over a populated area, the stolen plane can, if necessary, crash into a residential area, resulting in 20 people being killed, 100 people injured, and many fires erupting. [US Air Force, 2003 ] A scenario that is apparently identical to the one practiced in today’s exercise will be included in a Falcon Indian exercise held in June 2000 (see June 5, 2000). [US Congress. Senate. Committee on Armed Services, 8/17/2004]
November 6, 1999: NORAD Conducts Exercise Scenario Based around Hijackers Planning to Crash Plane into UN Headquarters in New York
The North American Aerospace Defense Command (NORAD) practices a scenario in which five terrorists take over a transcontinental aircraft with the intention of crashing it into the United Nations headquarters building in New York. The simulation takes place during a command post exercise conducted by the Continental United States NORAD Region, called Falcon Indian. NORAD’s three air defense sectors in the continental US, including the Northeast Air Defense Sector based in Rome, New York, take part in this exercise. General Richard Myers, currently the commander in chief of NORAD, will reveal the details of the scenario during an August 2004 hearing of the Senate Armed Services Committee. According to Myers, the scenario is based around a China Air aircraft flying from Los Angeles to JFK International Airport in New York, which is “hijacked east of Colorado Springs by five terrorists.” If the plane is not intercepted by the US military, the terrorists intend “to crash into [the] United Nations building.” [North American Aerospace Defense Command, 8/25/1989; US Congress. Senate. Committee on Armed Services, 8/17/2004; Arkin, 2005, pp. 362] The UN headquarters building is a 39-story high-rise, located a few miles from the World Trade Center. [New York Daily News, 12/2/1999; Evening Standard, 9/11/2002] In response to the simulated crisis, exercise participants have to follow hijack checklists, exercise command and control, coordinate with external agencies, and carry out a handover of responsibilities between NORAD sectors. [US Congress. Senate. Committee on Armed Services, 8/17/2004] Like in this scenario, the teams of hijackers that take over three of the four aircraft targeted in the 9/11 attacks will comprise of five terrorists. And all four of the aircraft targeted on 9/11 will be making transcontinental flights, like the plane hijacked in this scenario, although they will be flying from the east coast to the west rather than from the west to the east. [New York Times, 9/12/2001; CNN, 9/20/2001; 9/11 Commission, 7/24/2004, pp. 4, 11] A subsequent Falcon Indian exercise in June 2000 will include scenarios in which hijackers plan to crash aircraft into the White House and the Statue of Liberty (see June 5, 2000). [US Congress. Senate. Committee on Armed Services, 8/17/2004]
June 5, 2000: NORAD Exercise Simulates Hijackers Planning to Crash Planes into the White House and the Statue of Liberty
The North American Aerospace Defense Command (NORAD) practices two scenarios in which aircraft are hijacked, and in one scenario the hijackers plan to crash the plane into the Statue of Liberty in New York Harbor, while in the other the hijackers plan to crash into the White House in Washington, DC. The scenarios are included in a command post exercise conducted by the Continental United States NORAD Region called Falcon Indian. NORAD’s three air defense sectors in the continental United States, including the Northeast Air Defense Sector based in Rome, New York, are participating in this exercise. [North American Aerospace Defense Command, 8/25/1989; US Congress. Senate. Committee on Armed Services, 8/17/2004; Arkin, 2005, pp. 362]
Hijackers Take Over a Learjet and Plan to Crash It into the White House – The two hijacking scenarios will be described by General Richard Myers, currently the vice chairman of the Joint Chiefs of Staff, during a hearing of the Senate Armed Services Committee in August 2004. According to Myers, one of the scenarios involves a Learjet being hijacked and maintaining a “tight formation with [a] Canadair airliner, loaded with explosives.” (From Myers’s description it is unclear whether the Learjet or the Canadair airliner is the plane carrying explosives.) According to Myers, the “Learjet planned to crash into the White House.” In response to the simulated crisis, exercise participants have to follow hijack checklists, exercise command and control, and coordinate with external agencies.
Communist Group Plans to Crash a Plane into the Statue of Liberty – The other scenario is based around a “Communist Party faction” that hijacks an aircraft “bound from [the] western to [the] eastern United States,” according to Myers. There are “[h]igh explosives on board” the aircraft and the fictitious hijackers intend “to crash into the Statue of Liberty.” During the simulation, the FAA requests assistance from the military. Exercise participants have to again follow hijack checklists, exercise command and control, and coordinate with external agencies, as well as carrying out a handover of responsibilities between NORAD sectors. [US Congress. Senate. Committee on Armed Services, 8/17/2004] Even though these two NORAD exercise scenarios involve hijackers attempting to use planes as weapons, the 9/11 Commission will claim in its final report, “The threat of terrorists hijacking commercial airliners within the United States—and using them as guided missiles—was not recognized by NORAD before 9/11.” [9/11 Commission, 7/24/2004, pp. 17] A scenario that was apparently identical to one of those practiced in today’s exercise, involving terrorists planning to crash a plane into the White House, was included in two previous Falcon Indian exercises, held in January 1999 and June 1999 (see January 9, 1999 and June 5, 1999). [US Air Force, 2003 ] Another previous Falcon Indian exercise, held in November 1999, included a scenario of hijackers planning to crash an aircraft into the United Nations headquarters building in New York (see November 6, 1999). [US Congress. Senate. Committee on Armed Services, 8/17/2004]
8:30 a.m.-8:40 a.m. September 11, 2001: CONR Commander Arnold in Teleconference, Unavailable to Immediately Authorize Scrambling of Fighters
Major General Larry Arnold, the commander of the Continental United States NORAD Region (CONR), participates in a video teleconference with other senior NORAD officials and is therefore unavailable when NORAD’s Northeast Air Defense Sector (NEADS) tries contacting him for authorization to scramble fighter jets in response to the hijacked Flight 11. [Filson, 2002; 9/11 Commission, 5/23/2003; 9/11 Commission, 7/24/2004, pp. 20; Spencer, 2008, pp. 31] Arnold is in the video teleconferencing room at CONR headquarters, at Tyndall Air Force Base, Florida.
Teleconference Discussing ‘Russian Exercise’ – Robert Del Toro, an intelligence officer with the 1st Air Force who is in the room with Arnold, will tell the 9/11 Commission that the teleconference is “about the Russian exercise.” [9/11 Commission, 2/2/2004 ] Del Toro is presumably referring to either the Russian Air Force exercise that NORAD is currently monitoring (see September 9, 2001) or the exercise, Vigilant Guardian, that NORAD is currently running, which reportedly includes a simulated war against Russia (see (8:00 a.m.) September 11, 2001). [North American Aerospace Defense Command, 9/9/2001; Arkin, 2005, pp. 545; Denver Post, 8/28/2011]
NORAD Officials from US and Canada on Teleconference – It is unclear exactly who else is participating in the teleconference. Arnold will tell the 9/11 Commission that as well as “our folks”—presumably referring to some of his colleagues at CONR—it includes “the NORAD staff.” The “NORAD staff” presumably includes officials from NORAD’s operations center in Cheyenne Mountain, Colorado, and its headquarters at Peterson Air Force Base, Colorado. [9/11 Commission, 5/23/2003] Arnold will tell author Leslie Filson that the teleconference includes “the CINC”—presumably meaning General Ralph Eberhart, the commander in chief of NORAD, who is at Peterson Air Force Base—and also officials from the Alaskan NORAD Region (ANR) and the Canadian NORAD Region (CANR). [Filson, 2002; 9/11 Commission, 3/1/2004 ]
Arnold Not Alerted to Hijacking – While Arnold is on the teleconference, NEADS calls CONR to alert him to the suspected hijacking of Flight 11 (see (8:38 a.m.) September 11, 2001), but no one at CONR interrupts the teleconference to fetch him or pass on to him the urgent message from NEADS. Arnold will only learn of the hijacking after the teleconference ends (see (8:40 a.m.) September 11, 2001) and he will then call NEADS back (see (8:42 a.m.) September 11, 2001). [9/11 Commission, 5/23/2003; Spencer, 2008, pp. 31, 38]
Before 9:54 a.m. September 11, 2001: NORAD Is Told It Does Not Have to Provide a Fighter Escort for Air Force One
NORAD’s Continental United States Region (CONR) is told it will not need to provide fighter jets to escort Air Force One when the plane takes off from Sarasota, Florida. [National Guard Bureau, 11/19/2001] While President Bush is visiting the Emma E. Booker Elementary School in Sarasota (see (8:55 a.m.) September 11, 2001), Air Force One is on the ground at Sarasota-Bradenton International Airport. [Wall Street Journal, 3/22/2004 ; US Air Force, 2/29/2012 ] Major General Larry Arnold, the CONR commander, will later recall that around this time, CONR “knew that the president was down in Florida” but it “didn’t know what he was going to do.” “Eventually,” he will say, “we asked the question: If he takes off, do we need to escort?” Arnold will not state who CONR, which is based at Tyndall Air Force Base, Florida, asks this question to. But the person or agency says no. CONR will only be asked to provide fighters to escort Air Force One after 9:54 a.m., when the plane takes off from Sarasota (see 9:54 a.m. September 11, 2001). “[T]he airplane took off and we got immediate word that the Secret Service had asked us to escort [it],” Arnold will recall. [National Guard Bureau, 11/19/2001] He will say that CONR “received tasking from the Secret Service through the Joint [Chiefs of] Staff and NORAD to follow the president and protect him.” [Code One Magazine, 1/2002] In Florida, NORAD has two fighters on alert at Homestead Air Reserve Base and two fighters on alert at Tyndall Air Force Base. [Airman, 12/1999; St. Petersburg Times, 7/4/2004] However, its Southeast Air Defense Sector (SEADS) will scramble fighters from Ellington Field in Texas to escort Air Force One (see (After 9:56 a.m.) September 11, 2001). [Your Houston News, 9/19/2001; Rosenfeld and Gross, 2007, pp. 40] Furthermore, these fighters will only reach Air Force One at around 11:29 a.m., more than 90 minutes after the plane takes off (see (11:29 a.m.) September 11, 2001). [USA Today, 9/11/2001; St. Petersburg Times, 7/4/2004]
10:31 a.m. September 11, 2001: NORAD Passes on Shootdown Order to Its Air Defense Sectors
The Continental United States NORAD Region (CONR) issues a message to its three air defense sectors—including the Northeast Air Defense Sector (NEADS)—stating that Vice President Dick Cheney has authorized it to shoot down suspicious aircraft.
Order Sent over Computer Chat System – About 15 minutes earlier, a military officer at the White House relayed to the Pentagon’s National Military Command Center (NMCC) that Cheney had confirmed that fighter jets were cleared to engage an inbound aircraft if they could verify that the aircraft was hijacked (see 10:14 a.m.-10:19 a.m. September 11, 2001). According to the 9/11 Commission, “It is not clear how [this] shootdown order was communicated within NORAD.” However, Major General Larry Arnold, the CONR commander, now instructs his staff to broadcast a message over a NORAD computer chat system, passing on Cheney’s authorization. The message states, “10:31 Vice president has cleared to us to intercept tracks of interest and shoot them down if they do not respond, per CONR CC [General Arnold].” The message is received at CONR’s three air defense sectors: the Western, Southeast, and Northeast. [9/11 Commission, 7/24/2004, pp. 42; Spencer, 2008, pp. 240]
Arnold Could Issue Shootdown Order Himself – Arnold, who is at the CONR air operations center at Tyndall Air Force Base in Florida, will later comment, “I have the authority in case of an emergency to declare a target hostile and shoot it down under an emergency condition… but it was comforting to know we legally had the authority from the president of the United States.” [Filson, 2002; Code One Magazine, 1/2002; Filson, 2003, pp. 75-76] The 10:31 chat message is the first notification personnel on the NEADS operations floor receive of the shootdown order. These personnel are reportedly confused over the order and do not pass it on to fighter pilots under their command (see 10:32 a.m. September 11, 2001). [9/11 Commission, 7/24/2004, pp. 42-43; 9/11 Commission, 8/26/2004, pp. 47]
11:03 a.m.-11:12 a.m. September11, 2001: NORAD Personnel Ordered to Defcon 3
The message goes out within NORAD that the military’s defense readiness condition has been raised to Defcon 3. [9/11 Commission, 6/17/2003; 9/11 Commission, 2004] Secretary of Defense Donald Rumsfeld directed that the defense readiness condition be raised from Defcon 5—the lowest level—to Defcon 3 at around 10:45 a.m. (see (10:43 a.m.-10:52 a.m.) September 11, 2001). [9/11 Commission, 7/24/2004, pp. 326, 554; Goldberg et al., 2007, pp. 131] At 10:52 a.m., an emergency action message about the increased defense readiness condition was issued. [US Department of Defense, 9/11/2001 ; 9/11 Commission, 2004]
NORAD Personnel Learn of Defcon Change – Word of the change is then communicated within NORAD. At 11:03 a.m., NORAD’s Northeast Air Defense Sector (NEADS) is ordered to Defcon 3. Four minutes later, at 11:07 a.m., Lieutenant Colonel Steve Usher, the director of combat operations at the headquarters of the Continental United States NORAD Region (CONR) in Florida, announces that Defcon 3 has been ordered. [9/11 Commission, 6/17/2003] And a military log will state that “NORAD has directed Defcon change” at 11:12 a.m. [9/11 Commission, 2004] Staff Sergeant Brent Lanier, an emergency action controller in NORAD’s Cheyenne Mountain Operations Center (CMOC) in Colorado, is tasked with sending out a message about the change to the defense readiness condition. He will later recall: “I’d sent out false Defcon messages during exercises, but I never thought I’d have to send out an actual Defcon change message—but I did. It was frightening.” [Airman, 3/2002]
NORAD Officers Discuss Defcon Change – Major General Larry Arnold, the CONR commander, will tell the 9/11 Commission that he hears of the change to the defense readiness condition either from Major General Rick Findley, the director of operations at the CMOC, or from one of NORAD’s computer chat logs. [9/11 Commission, 2/3/2004 ] Usher will tell the 9/11 Commission that the instruction to raise the defense readiness condition comes either from the CONR Regional Air Operations Center or from Arnold. He will add that there is an emergency action message confirming the transition. [9/11 Commission, 2/4/2004 ] Arnold will recall that, at some unspecified time, he calls General Ralph Eberhart, the commander of NORAD, about the change to the defense readiness condition, with the intention of informing Eberhart “of what was ongoing.” [9/11 Commission, 2/3/2004 ]
Change in Defcon Affects Who Can Declare a Target Hostile – Steve Hedrick, an air weapons officer at NEADS, will tell the 9/11 Commission that “any change in Defcon is authenticated immediately” with the fighter jets under NORAD control. He will also say that “the main change when a Defcon level changes is in who has the authority to declare a target hostile.” Hedrick will note that the order from Vice President Dick Cheney, that NORAD fighters were “cleared… to intercept tracks of interest and shoot them down if they do not respond” (see 10:31 a.m. September 11, 2001), is “distinct and different from the transition in Defcon levels.” [9/11 Commission, 10/27/2003 ; 9/11 Commission, 7/24/2004, pp. 42]
