At least two messages in Arabic are intercepted by the NSA. One states, “The match is about to begin” and the other states, “Tomorrow is zero hour.” Later reports translate the first message as, “The match begins tomorrow.” [Reuters, 9/9/2002] The messages were sent between someone in Saudi Arabia and someone in Afghanistan. The NSA will claim that they are not translated until September 12, and that even if they had been translated in time, “they gave no clues that authorities could have acted on.” [ABC News, 6/7/2002; Reuters, 6/19/2002] Chairman of the Senate Intelligence Committee Bob Graham will later confirm that the messages were from al-Qaeda sources—a location or phone number—that made them a high priority, but that they were not from bin Laden or one of his top commanders. [Graham and Nussbaum, 2004, pp. 139] On the morning of September 12, 2001, the CIA will tell President Bush that a recently intercepted message from al-Qaeda leader Abu Zubaida referred to the 9/11 attacks as “zero hour,” but it is not clear if this is the same message or a different message (see September 12, 2001). These messages turn out to be only two of about 30 pre-9/11 communications from suspected al-Qaeda operatives or other militants referring to an imminent event. An anonymous official will say of these messages, including the “Tomorrow is zero hour” message: “You can’t dismiss any of them, but it does not tell you tomorrow is the day.” [Reuters, 9/9/2002] There will be a later attempt to explain the messages away by suggesting they referred to the killing of Afghan opposition leader Ahmed Shah Massoud the day before (see September 9, 2001). [Reuters, 10/17/2002]
Before September 11, 2001: ‘We’re Ready to Go’ and ‘Big Thing Coming’ Intercepts Not Analyzed Until After 9/11
Though the NSA specializes in intercepting communications, the CIA and FBI intercept as well. After 9/11, CIA and FBI officials will discover messages with phrases like, “There is a big thing coming,”
“they’re going to pay the price,” and “We’re ready to go.” Supposedly, most or all of these intercepted messages will not be analyzed until after 9/11. [Newsweek, 10/1/2001]
8:47 a.m.-9:05 a.m. September 11, 2001: Government Agencies Do Not Contact Air Force One about the First Crash at the WTC
Colonel Mark Tillman, the pilot of Air Force One, the president’s plane, receives no contact from any US government agency, such as the CIA or the FBI, about the first plane crash at the World Trade Center, although numerous agencies call the plane immediately after the second crash. Air Force One is currently at Sarasota-Bradenton International Airport in Florida, where it has been since the previous evening (see September 10, 2001). Tillman boarded the plane at around 8:15 a.m. this morning, and he has been preparing to take off at 10:45 a.m. and take President Bush back to Washington, DC.
Pilot Sees the Coverage of the First Crash but Thinks It Is an Accident – While he is walking around the plane and checking all the rooms, Tillman is called upstairs by the plane’s radio operator. Upstairs, the radio operator shows him the coverage of the first crash at the WTC on television and says: “I don’t know what’s going on; neither does the media. But it doesn’t look like it’s anything important; it looks like it’s an aircraft accident.” Air Force One, according to Tillman, has 42 phone lines that specifically connect to government agencies such as the FBI, the CIA, and the National Security Agency. But, Tillman will later recall: “None of those phones were going off. Everybody thought this was just an aircraft accident.” He will say that the plane’s crew receives “no information from any command and control authority” at this time. Tillman believes that, in light of what has happened, Bush will want to visit New York. Everyone on the plane is therefore told to be ready to go. He tells the radio operator simply to keep monitoring what is happening in New York and then heads downstairs to continue checking the rooms on Air Force One.
All the Phones Start Ringing after the Second Attack – After the second plane hits the WTC at 9:03 a.m. (see 9:03 a.m. September 11, 2001), Tillman is again called upstairs. The radio operator alerts him to the television coverage of what has happened. “We now have an understanding that it’s a deliberate attack on the [Twin] Towers,” Tillman will say. “All the information we had was from the news media at this point,” he will comment. But whereas no government agencies previously called Air Force One, suddenly, Tillman will recall: “All the phone lines are coming alive. Every agency in the world wants to know what our status is [and] if we’re ready to go.” “We were hooked into the PEOC [the Presidential Emergency Operations Center, a bunker below the White House] and the JOC [Joint Operations Center] for the Secret Service,” he will say, adding, “They’re all in the link now.” In response to the second attack, security around Air Force One will be increased (see (9:04 a.m.-9:55 a.m.) September 11, 2001). [United Services Automobile Association, 9/11/2011; US Air Force, 2/29/2012 
; Politico Magazine, 9/9/2016] The plane will take off from the Sarasota airport with Bush on board at 9:54 a.m. (see 9:54 a.m. September 11, 2001). [9/11 Commission, 7/24/2004, pp. 39]
8:48 a.m.-9:03 a.m. September 11, 2001: Special NSA Warning Center First Learns from Television that US Is under Attack
Within the headquarters of the National Security Agency (NSA) in Fort Meade, Maryland is a little-known unit called the Defense Special Missile and Astronautics Center (DEFSMAC). According to author James Bamford, who is an expert on the NSA, the center’s purpose is “to serve as the nation’s chief warning bell for a planned attack on America. It serves as the focal point for ‘all-source’ intelligence—listening posts, early-warning satellites, human agents, and seismic detectors.” According to one former NSA official, DEFSMAC “has all the inputs from all the assets, and is a warning activity. They probably have a better feel for any worldwide threat to this country from missiles, aircraft, or overt military activities, better and more timely, at instant fingertip availability, than any group in the United States.” If they received indications that an attack was imminent, DEFSMAC officials could “immediately send out near-real-time and in-depth, all-source intelligence alerts to almost 200 ‘customers,’ including the White House Situation Room, the National Military Command Center at the Pentagon, the [Defense Intelligence Agency] Alert Center, and listening posts around the world.” Its analysts could be “closely monitoring all intercepts flooding in; examining the latest overhead photography; and analyzing data from early-warning satellites 22,300 miles above the equator. DEFSMAC would then flash the intelligence to the US Strategic Command at Offutt Air Force Base in Nebraska, NORAD at Cheyenne Mountain in Colorado, and other emergency command centers.” But on this morning, as Bamford will conclude, “DEFSMAC learned of the massive airborne attacks after the fact—not from America’s multibillion-dollar spy satellites or its worldwide network of advanced listening posts, or its army of human spies, but from a dusty, off-the-shelf TV set.” [Bamford, 2004, pp. 33-35] The NSA had in fact intercepted numerous calls between some of the hijackers in the US and an al-Qaeda communications hub in Yemen, beginning in early 2000 and ending just weeks before 9/11 (see Early 2000-Summer 2001). [MSNBC, 7/21/2004] It also intercepted two messages in Arabic on September 10, stating, “The match is about to begin,” and “Tomorrow is zero hour,” but these are supposedly not translated until September 12 (see September 10, 2001). [Washington Post, 6/20/2002] The NSA even intercepted a series of communications between 9/11 mastermind Khalid Shaikh Mohammed (KSM) and lead 9/11 hijacker Mohamed Atta beginning in the summer of 2001 (see Summer 2001), continuing to a message where KSM gives Atta the final go-ahead for the attacks on September 10, 2001 (see September 10, 2001). Michael Hayden, the director of the NSA, will later claim that the “NSA had no [indications] that al-Qaeda was specifically targeting New York and Washington… or even that it was planning an attack on US soil” (see October 17, 2002). [National Journal, 6/19/2006]
8:48 a.m.-9:04 a.m. September 11, 2001: NSA Director Only Learns US Is Under Attack from TV Reports
Air Force Lt. Gen. Michael Hayden, the director of the National Security Agency (NSA), is in his office at NSA headquarters in Fort Meade, Maryland, meeting with his senior staff. His executive assistant, Cindy Farkus, comes in and informs him of the first plane hitting the World Trade Center. He later says, “The immediate image I had was a light plane, off course, bad flying.” He is able to see the initial CNN reports showing the WTC on a muted television in his office. Nevertheless, he continues with his meeting. Immediately after the second attack occurs, Farkus again comes into Hayden’s office to inform him of it. Saying that “One plane’s an accident, two planes is an attack,” Hayden immediately adjourns his meeting and requests that the agency’s top security officials be summoned to his office. Author James Bamford, who is an expert on the NSA, later comments that this is “not the way it was supposed to be. NSA was not supposed to find out about an airborne attack on America from CNN, after millions of other Americans had already witnessed it. It was supposed to find out first, from its own ultrasecret warning center, and then pass the information on to the White House and the strategic military forces” (see (8:48 a.m.-9:03 a.m.) September 11, 2001). [Bamford, 2004, pp. 18, 20 and 33]
Shortly After 9:03 a.m. September 11, 2001: FBI Activates Its Operations Center to Respond to the Attacks
Dale Watson, assistant director of the FBI’s counterterrorism division, activates the Strategic Information and Operations Center (SIOC) at FBI headquarters in Washington, DC, from where the bureau will coordinate its response to the terrorist attacks. Watson learned about the first hijacked plane crashing into the World Trade Center during a briefing in the SIOC attended by the FBI’s assistant directors and Robert Mueller, the bureau’s director (see Shortly After 8:48 a.m. September 11, 2001). Mueller and some of the other officials at the briefing, presumably including Watson, subsequently headed to the office of FBI Deputy Director Thomas Pickard. There, Mueller, Pickard, and the other officials saw the second hijacked plane crashing into the WTC on television (see 9:03 a.m. September 11, 2001). It then became clear to them that this was a terrorist attack.
Deputy Director Says the FBI Needs to Open Its Operations Center – Mueller asks Pickard what they should do in response to the incident and Pickard says they need to open the SIOC. [New Yorker, 9/24/2001; 9/11 Commission, 1/21/2004 ] According to the US government’s Interagency Domestic Terrorism Concept of Operations Plan, “Upon determination of a credible threat,” FBI headquarters is required to activate the SIOC, “to coordinate and manage the national level support to a terrorism incident.” [US Government, 1/2001] Following this protocol, Watson goes to his office and activates the SIOC for crisis mode. [New Yorker, 9/24/2001]
Director Goes to the Operations Center to Manage the Crisis – Mueller and Pickard go to the SIOC to manage the FBI’s response to the attacks. Pickard isolates Mueller in a conference room, restricting access to him so he is better able to stay focused on the decisions ahead. Mueller only took over as FBI director a week ago (see September 4, 2001) and Pickard will later comment, “I was worried that there was going to be this string of people running into the room with news or questions and [Mueller] would be standing there asking them who they were.” [Kessler, 2002, pp. 420; Graff, 2011, pp. 314-316] Meanwhile, a live communications link is established that allows them to listen in as Pentagon and FAA air traffic controllers track suspicious aircraft. [Wall Street Journal, 10/5/2001]
Many Other Officials Go to the Operations Center – Other senior officials and FBI agents also begin pouring into the center, along with representatives from numerous other government agencies, including the CIA, the Defense Intelligence Agency, the FAA, the NSA, and the Secret Service. Assistant Attorney General Michael Chertoff will head to the center, as will Attorney General John Ashcroft, who arrives there early in the afternoon (see (Between 1:00 p.m. and 2:00 p.m.) September 11, 2001). The SIOC will become “the place to be to get information and so everyone wanted to be there,” Ashcroft will comment. [Kessler, 2002, pp. 5, 421; 9/11 Commission, 12/17/2003 ]
Center Is Designed for Dealing with Crises – The SIOC, which opened in 1998 and cost $20 million to build, covers 40,000 square feet on the fifth floor of the FBI headquarters building. [CNN, 11/20/1998] It is “a heavily fortified cluster of offices surrounded by video screens and banks of computer terminals,” according to the New York Times. [New York Times, 11/2/2001] It can function as a 24-hour watch post, a crisis management center, and an information processing center. [Federal Bureau of Investigation, 1/18/2004] It operates around the clock, with at least eight staffers on duty at any one time. It is capable of managing up to five crises at a time and is designed to accommodate up to 450 members of staff during major emergencies. [CNN, 11/20/1998; New Yorker, 9/24/2001]
Center Is Built to Survive Attacks – The center is fortified so those in it can survive a bombing or other kind of attack. [New York Times, 11/2/2001] It has no windows to the street outside and is shielded to prevent electronic signals from entering or leaving it. [CNN, 11/20/1998; Kessler, 2002, pp. 421] Its 225 computer terminals have access to three types of local area networks: the regular FBI network that can connect to the networks of outside agencies; a classified network that operates at the top-secret level; and an even more highly classified Special Compartmented Information network. [Washington Post, 10/14/2001; Federal Bureau of Investigation, 1/18/2004] The many computers and video screens in the center can display broadcasts from US television channels and also TV channels from other countries. [CNN, 11/20/1998]
Center Will Become the ‘Nerve Center’ of the FBI’s Investigation – By the end of the week, the SIOC will be “the headquarters of the government’s response” to today’s attacks, according to journalist and author Garrett Graff. As many as 500 people from 56 different agencies will be working in it. [Kessler, 2002, pp. 421; Military Intelligence Professional Bulletin, 7/1/2002; Graff, 2011, pp. 317] It will become “the nerve center” of the FBI’s investigation of the attacks, according to the Wall Street Journal. [Wall Street Journal, 10/5/2001]
9:15 a.m. September 11, 2001: DC Air National Guard Intelligence Officer Unable to Obtain Information on Crisis
An intelligence officer with the District of Columbia Air National Guard (DCANG) at Andrews Air Force Base, 10 miles outside Washington, is unable to obtain further information about the attacks from other agencies, and instead has to make do with what he can learn from television reports. [Filson, 2003, pp. 79; Spencer, 2008, pp. 155-156] Having learned of the two attacks in New York, Major David McNulty, the senior intelligence officer of the 113th Wing of the DCANG, checks the SIPRNET—the Department of Defense’s classified version of the Internet—for pertinent information, but apparently without success. He phones anyone he can think of who might be able to provide information, including the Air Combat Command Intelligence Squadron at Langley Air Force Base in Virginia, the 609th Air Intelligence Squadron at Shaw Air Force Base in South Carolina, the FBI field office in Washington, and the Secret Service’s White House Joint Operations Center. Yet, as he will later recall, the agencies have “nothing to report.” Even his call to the FBI is “a fruitless effort.” [9/11 Commission, 3/11/2004 ; Spencer, 2008, pp. 155-156] McNulty will say, “I even called the National Security Agency 24-hour information desk and they knew nothing more than I did.” He adds, “We were all getting our information from CNN.” [Filson, 2003, pp. 79] According to Knight Ridder, “Air defense around Washington, DC, is provided mainly by fighter planes from Andrews Air Force Base.” [Knight Ridder, 9/11/2001] However, author Lynn Spencer will claim that because the DCANG “is a general purpose F-16 unit, no one is specifically tasked with keeping the squadron informed.” [Spencer, 2008, pp. 156]
9:30 a.m. September 11, 2001: Nonessential Personnel Evacuated from NSA Headquarters
At the National Security Agency (NSA) headquarters in Fort Meade, Maryland, Michael Hayden, the agency’s director, orders the evacuation of all nonessential personnel from the NSA complex. His two reasons for this, he later says, are “just pure safety,” and to protect the people who work at the agency by sending “them home on the dispersal plan.” In a 2007 speech, he will state that he gave this order at 9:30 a.m. But in the account of author James Bamford, around the time Hayden gives the order he hears “some early reports about the explosion at the Pentagon.” Yet the attack on the Pentagon does not occur until 9:37 (see 9:37 a.m. September 11, 2001). The reason for this discrepancy is unclear. Hayden’s evacuation order is announced over loudspeakers throughout the NSA, and many of the 16,000 employees there leave. After hearing for sure that the Pentagon has been struck and that one or more hijacked aircraft is heading toward Washington, Hayden orders the three to four thousand remaining essential personnel to immediately evacuate the agency’s three tall towers and relocate to the low-rise Ops 1 Building. However, as Hayden later says, “[W]e really couldn’t afford to move the counterterrorism shop” where experts and linguists who track terrorists’ foreign communications work, even though it is located near the top of one of the NSA’s high-rise buildings. Maureen Baginski, the NSA’s director of signals intelligence, goes up there shortly after the time of the Pentagon attack to calm down the workers who, according to Hayden, are “emotionally shattered.” [US Congress, 10/17/2002; Bamford, 2004, pp. 52-54; National Journal, 6/19/2006; Central Intelligence Agency, 5/4/2007] At 9:53, analysts in the counterterrorism office will pick up and quickly translate a phone call from a bin Laden operative in Afghanistan, apparently referring to the attacks (see 9:53 a.m. September 11, 2001).
9:53 a.m. September 11, 2001: NSA Intercepts Al-Qaeda Phone Call Predicting Fourth Attack
The National Security Agency (NSA) reportedly intercepts a phone call from one of bin Laden’s operatives in Afghanistan to a phone number in the Republic of Georgia. The caller says he has “heard good news” and that another target is still to come (presumably, the target Flight 93 is intended to hit). [CBS News, 9/4/2002] The caller is also supposed to say that the attackers are following through on “the doctor’s program.” This is said to be a reference to al-Qaeda’s number two leader, Ayman al-Zawahiri, who has a doctorate in medicine. [New Yorker, 9/9/2002] Since the 9/11 crisis began, NSA translators have been told to focus on Middle Eastern intercepts and translate them as they are received instead of oldest first, as is the usual practice. This call is translated in the next hour or two, and Defense Secretary Rumsfeld hears about it just after noon. [CBS News, 9/4/2002; Bamford, 2004, pp. 54]
After 10:00 a.m. September 11, 2001: CIA Establishes a Secure Line to the White House but Is Prevented from Getting the Latest Information from the NSA over It
The CIA sets up a secure line to the White House, but because the line is kept constantly connected to the White House, the CIA will be unable to receive the latest information about the terrorist attacks from the National Security Agency (NSA) over it. [Coll, 2018, pp. 32] At around 10:00 a.m., personnel at CIA headquarters in Langley, Virginia, were ordered to evacuate. Consequently, the agency’s senior leaders left the headquarters building and headed across the campus to the CIA printing plant, where they could continue their operations (see (9:50 a.m.-10:00 a.m.) September 11, 2001). [Tenet, 2007, pp. 164; Whittle, 2014, pp. 236] When CIA Director George Tenet and other senior officials reach the printing plant, a technician sets up a secure terminal equipment (STE) line to the White House for them to use. Tenet then talks to Stephen Hadley, the deputy national security adviser, who is at the White House. During their conversation, Hadley insists that Tenet keep the STE line open to the White House continuously. However, this hinders the ability of the NSA to communicate with the CIA. NSA Director Michael Hayden wants to send the CIA preliminary evidence that al-Qaeda is responsible for the attacks on the US. [Coll, 2018, pp. 32] Presumably this includes details of a phone conversation between one of Osama bin Laden’s operatives in Afghanistan and someone in the Republic of Georgia that was intercepted at 9:53 a.m., in which the operative said he had “heard good news” and another target was still to come (see 9:53 a.m. September 11, 2001). [CBS News, 9/4/2002] But because the STE line is occupied, Charles Allen, assistant director of central intelligence for collection, who is with Tenet at the printing plant, is unable to securely receive the latest intercept reports from the NSA about who might be responsible for the attacks. He consequently has to send an NSA liaison officer to the headquarters building to collect these reports from a secure fax machine there. [Coll, 2018, pp. 32]
