When the FAA’s Boston Center first contacts NORAD’s Northeast Air Defense Sector (NEADS) to notify it of the hijacking of Flight 11 (see (8:37 a.m.) September 11, 2001), personnel there initially mistake the hijacking for a simulation as part of an exercise. 
Lieutenant Colonel Dawne Deskins, mission crew chief for the Vigilant Guardian exercise currently taking place (see (6:30 a.m.) September 11, 2001), will later say that initially she and everybody else at NEADS think the call from Boston Center is part of Vigilant Guardian. [Newhouse News Service, 1/25/2002] Although most of the personnel on the NEADS operations floor have no idea what the day’s exercise is supposed to entail, most previous major NORAD exercises included a hijack scenario. [USA Today, 4/18/2004; Utica Observer-Dispatch, 8/5/2004] The day’s exercise is in fact scheduled to include a simulated hijacking later on. [Vanity Fair, 8/1/2006] Major Kevin Nasypany, the NEADS mission crew commander, had helped design the day’s exercise. Thinking the reported hijacking is part of it, he actually says out loud, “The hijack’s not supposed to be for another hour.” [Vanity Fair, 8/1/2006] In the ID section, at the back right corner of the NEADS operations floor, technicians Stacia Rountree, Shelley Watson, and Maureen Dooley react to the news. Dooley, the leader of the ID section, tells the other members of her team: “We have a hijack going on. Get your checklists. The exercise is on” (see (8:38 a.m.) September 11, 2001). Rountree asks, “Is that real-world?” Dooley confirms, “Real-world hijack.” Watson says, “Cool!” [Vanity Fair, 8/1/2006; Spencer, 2008, pp. 25] When NEADS Commander Robert Marr sees his personnel reacting to the news of the hijacking (see (8:38 a.m.) September 11, 2001), he reportedly thinks the day’s exercise “is kicking off with a lively, unexpected twist.” Even when a colleague informs him, “It’s a hijacking, and this is real life, not part of the exercise,” Marr thinks: “This is an interesting start to the exercise. This ‘real-world’ mixed in with today’s simex [simulated exercise] will keep [my staff members] on their toes.” [Spencer, 2008, pp. 26] Major General Larry Arnold, who is at Tyndall Air Force Base, Florida, also later says that when he first hears of the hijacking, in the minutes after NEADS is alerted to it, “The first thing that went through my mind was, is this part of the exercise? Is this some kind of a screw-up?” [ABC News, 9/11/2002; 9/11 Commission, 5/23/2003] According to author Lynn Spencer: “Even as NORAD’s commander for the continental United States, Arnold is not privy to everything concerning the exercise. The simex is meant to test commanders also, to make sure that their war machine is operating as it should.” [Spencer, 2008, pp. 38] At 8:43 a.m., Major James Fox, the leader of the NEADS weapons team, comments, “I’ve never seen so much real-world stuff happen during an exercise.” [Vanity Fair, 8/1/2006]
8:38 a.m. September 11, 2001: ’Hubbub’ at NEADS Thought to Be Result of Exercise Scenario
At NORAD’s Northeast Air Defense Sector (NEADS), a huddle of people is gathered around one of the radar scopes. NEADS Commander Robert Marr initially thinks this hubbub is due to the NORAD training exercise (presumably Vigilant Guardian) that is taking place on this day (see (6:30 a.m.) September 11, 2001). He will later recall: “I’ve seen many exercises… and as I saw that huddle I said, ‘There’s got to be something wrong, something is happening here.’ You usually see that whenever they find a track on the scope that looks unusual; it’s usually an indicator that something is getting ready to kick off.” [Filson, 2003, pp. 55] According to author Lynn Spencer, Marr thinks the day’s exercise “is kicking off with a lively, unexpected twist.… His bet is that his simulations team has started off the exercise by throwing out a ‘heart attack card’ to see how the troops respond to a first-aid call from a fellow soldier, testing their first responder training.” [Spencer, 2008, pp. 26] He sends Lieutenant Colonel Dawne Deskins, the regional mission crew commander for the exercise, to check out what is going on. [Filson, 2003, pp. 55] Deskins speaks briefly over the phone with the FAA’s Boston Center about the Flight 11 hijacking (see (8:37 a.m.) September 11, 2001). [Spencer, 2008, pp. 26] She then runs back to the “battle cab”—the glass-walled room that overlooks the NEADS operations floor—and speaks to Marr with urgency in her voice. [Filson, 2003, pp. 55] She tells him: “It’s a hijacking, and this is real life, not part of the exercise. And it appears that the plane is heading toward New York City.” Although Deskins has specifically stated, “not part of the exercise,” Marr reportedly thinks, “This is an interesting start to the exercise.” According to Spencer, he thinks “This ‘real-world’ mixed in with today’s simex [simulated exercise] will keep [his staff members] on their toes.” Regardless of whether the crisis is real or not, Marr decides to instruct that the two alert F-15s at Otis Air National Guard Base be ordered to battle stations (see (8:40 a.m.) September 11, 2001). [Spencer, 2008, pp. 26-27]
9:00 a.m. September 11, 2001: Northern Vigilance Operation Canceled; False Blips Reportedly Purged from NORAD Radar Screens
NORAD has had fighter jets deployed to Alaska and Northern Canada for the past two days. They are there for a real-world maneuver called Operation Northern Vigilance, tasked with monitoring a Russian air force exercise being conducted in the Russian Arctic all this week (see September 9, 2001). [North American Aerospace Defense Command, 9/9/2001] At its operations center deep inside Cheyenne Mountain, Colorado, NORAD is also reportedly at “full ‘battle staff’ levels for a major annual exercise that tests every facet of the organization.” The operations center is now contacted by NORAD’s Northeast Air Defense Sector (NEADS), based in Rome, New York. NEADS says the FAA believes there is a hijacking in progress and is asking NORAD for support; this is not part of the exercise. As the Toronto Star will later report: “In a flash, Operation Northern Vigilance is called off. Any simulated information, what’s known as an ‘inject,’ is purged from the screens.” [Toronto Star, 12/9/2001] NORAD has the capacity to inject simulated material, including mass attacks, during exercises, “as though it was being sensed for the first time by a radar site.” [US Department of Defense, 1/15/1999] However, Northern Vigilance is a military operation, not a training exercise. [North American Aerospace Defense Command, 9/9/2001; US Congress, 3/11/2005] So presumably the “simulated information” is part of a NORAD exercise currently taking place, such as Vigilant Guardian (see (6:30 a.m.) September 11, 2001). Therefore, many minutes into the real 9/11 attacks, there may be false radar blips appearing on the screens of NORAD personnel. Additional details, such as whose radar screens have false blips and over what duration, are unclear. However, while the Toronto Star will indicate that the simulated material is removed from NORAD radar screens shortly before 9:03 a.m., when the second attack on the World Trade Center takes place, at 10:12 a.m. an officer at the operations center will call NEADS and ask it to “terminate all exercise inputs coming into Cheyenne Mountain” (see 10:12 a.m. September 11, 2001). [North American Aerospace Defense Command, 9/11/2001; Toronto Star, 12/9/2001] This would indicate that the NORAD operations center continues receiving simulated radar information for over an hour more, until after Flight 93 has crashed (see (10:06 a.m.) September 11, 2001) and the terrorist attacks have ended. The Russians, after seeing the attacks on New York and Washington on television, will quickly communicate that they are canceling their Russian Arctic exercise. [Toronto Star, 12/9/2001; National Post, 10/19/2002]
9:03 a.m. September 11, 2001: NORAD Phones Start Ringing ‘Like Crazy’
In the NORAD operations center in Cheyenne Mountain, Colorado, workers see the second aircraft crashing into the World Trade Center live on television. [Gazette (Colorado Springs), 10/7/2001] Major General Rick Findley, NORAD’s director of operations, later says that he now realizes “it was not an accident but a coordinated attack.” Then, he recalls, “At about that moment in time, every phone in this cab, and every phone over in the command center, and every phone in all the centers in this building were ringing off the hook.” Master Corporal Daniel Milne, the emergency action controller in the operations center, will similarly recall, “The feeling was total disbelief. Then the phones started ringing like crazy.” [Canadian Broadcasting Corporation, 9/11/2002; Legion Magazine, 11/2004] It is unclear what causes all the phones to simultaneously ring. According to Aviation Week and Space Technology magazine, after the second tower is hit, “Calls from fighter units… started pouring into NORAD and sector operations centers, asking, ‘What can we do to help?’” (see (After 9:03 a.m.) September 11, 2001) [Aviation Week and Space Technology, 6/3/2002] So this could be one factor. Also, a 1996 article in Airman magazine had quoted Stacey Knott, a technician in the NORAD operations center. She’d said, “Things can be pretty quiet in here.” However, “One of the busiest times is during exercises. This room fills up.… The phones are ringing off the hook, and I’ve got phones in each hand.” [Airman, 1/1996] On this morning, those in Cheyenne Mountain are in fact participating in a major exercise called Vigilant Guardian. [Aviation Week and Space Technology, 6/3/2002; CNN, 9/11/2006] This is reportedly only canceled “shortly after” the second attack (see (Shortly After 9:03 a.m.) September 11, 2001) [Airman, 3/2002; Filson, 2003, pp. 59] So it is plausible that this is also a factor in causing all the phones to suddenly ring. A similar thing appears to occur in the National Military Command Center (NMCC) at the Pentagon. According to a news article based on the recollections of two officers who are there, after the second plane hits the WTC, “Phones in the center began ringing off the hook.” [American Forces Press Service, 9/7/2006] Rick Findley later suggests that all the ringing phones are not a hindrance for NORAD, claiming, “The good news is we had lots of people here and we already had an operational architecture. We already had the command and control, the network, the phones, the data links. Everything was already in place that enabled us to react to the situation.” [Canadian Broadcasting Corporation, 9/11/2002]
Shortly After 9:03 a.m. September 11, 2001: NORAD Training Exercise Canceled
A NORAD training exercise that is taking place this morning, presumably Vigilant Guardian (see (6:30 a.m.) September 11, 2001), is reportedly canceled shortly after 9:03, when the second World Trade Center tower is hit. [Airman, 3/2002] NORAD Commander Larry Arnold later says that after Flight 175 hits the South Tower, “I thought it might be prudent to pull out of the exercise, which we did.” [Filson, 2003, pp. 59] According to author Lynn Spencer: “The phone calls start flying between the various NORAD command centers. General Arnold calls Maj. Gen. Rick Findley” at NORAD’s operations center in Cheyenne Mountain, Colorado, “to give him the latest information and have him withdraw all forces from the simulated exercise.” [Spencer, 2008, pp. 86] Arnold will recall, “As we pulled out of the exercise we were getting calls about United Flight 93 and we were worried about that.” [Filson, 2003, pp. 59] Some early accounts say the military receives notification of the possible hijacking of Flight 93 at around 9:16 a.m. (see 9:16 a.m. September 11, 2001). [CNN, 9/17/2001; 9/11 Commission, 5/23/2003] However, the 9/11 Commission will later claim that NORAD’s Northeast Air Defense Sector (NEADS) first receives a call about Flight 93 at 10:07 a.m. (see 10:05 a.m.-10:08 a.m. September 11, 2001). [9/11 Commission, 6/17/2004 
] Arnold will add, “Then we had another call from Boston Center about a possible hijacking, but that turned out to be the airplane that had already hit the South Tower but we didn’t know that at the time.” [Filson, 2003, pp. 59]
9:15 a.m. September 11, 2001: NEADS Technician Says Exercise Not Yet Canceled
A technician at NORAD’s Northeast Air Defense Sector (NEADS) tells a caller that the day’s training exercise has not yet been called off, despite the attacks in New York. [North American Aerospace Defense Command, 9/11/2001] All of NORAD, including NEADS, has been participating in a major exercise called Vigilant Guardian this morning (see (6:30 a.m.) September 11, 2001). [Aviation Week and Space Technology, 6/3/2002; Arkin, 2005, pp. 545] According to some accounts, this exercise was canceled shortly after 9:03 a.m., when the second World Trade Center tower was hit (see (Shortly After 9:03 a.m.) September 11, 2001). [Airman, 3/2002; Filson, 2003, pp. 59] However, Sergeant Mark Jennings, a NEADS tracking technician, now answers a phone call, and the caller says he has been watching the coverage of the terrorist attacks on television “for about 10 minutes, and I said, ‘I wonder if they’re—did they suspend the exercise?’” Jennings informs the caller that the exercise has not yet been suspended, answering, “Not at this time, no.” He adds: “But I think they’re going to [suspend it]. I don’t know. Things look pretty horrific out there.” The caller acknowledges, “Alrighty, man.” [North American Aerospace Defense Command, 9/11/2001]
9:28 a.m. September 11, 2001: NORAD Possibly Holding ‘Live-Fly’ Training Exercise
According to former counterterrorism “tsar” Richard Clarke, around this time the acting Chairman of the Joint Chiefs of Staff Richard Myers speaks to him via video link (see 9:28 a.m. September 11, 2001). During their conversation, Myers mentions, “We are in the middle of Vigilant Warrior, a NORAD exercise.” [Clarke, 2004, pp. 5] However, no other references have been found to this exercise, “Vigilant Warrior.” Considering that exercise terms are “normally an unclassified nickname,” [Chairman of the Joint Chiefs of Staff, 4/23/1998 ] this is perhaps a little odd. Could Richard Clarke have mistakenly been referring to the Vigilant Guardian exercise (see (6:30 a.m.) September 11, 2001), which is taking place on 9/11? According to a later news report though, NORAD confirms that “it was running two mock drills on Sept. 11 at various radar sites and Command Centers in the United States and Canada,” one of these being Vigilant Guardian. [New Jersey Star-Ledger, 12/5/2003] If this is correct then there must be another NORAD exercise on 9/11. If not “Vigilant Warrior,” a possibility is that the exercise referred to by Richard Clarke is in fact “Amalgam Warrior,” which is a NORAD-sponsored, large-scale, live-fly air defense and air intercept field training exercise. Amalgam Warrior usually involves two or more NORAD regions and is held twice yearly, in the spring for the West Coast and in the autumn for the East Coast. [US Congress, n.d.; Airman, 1/1996; Arkin, 2005, pp. 254; GlobalSecurity (.org), 4/27/2005] Is it possible that in 2001 the East Coast Amalgam Warrior is being held earlier than usual (like Global Guardian (see 8:30 a.m. September 11, 2001)) and is taking place on 9/11? In support of this possibility is a 1997 Defense Department report that describes the Stratcom exercise Global Guardian, saying it “links with other exercise activities sponsored by the Chairman, Joint Chiefs of Staff, and the Unified Commands.” The exercises it links with are Crown Vigilance (an Air Combat Command exercise), Apollo Guardian (a US Space Command exercise), and—significantly—the NORAD exercises Vigilant Guardian and Amalgam Warrior. [US Department of Defense, 5/1997; GlobalSecurity (.org), 4/27/2005] Since in 2001, Vigilant Guardian (see (6:30 a.m.) September 11, 2001) is occurring the same time as Global Guardian, might Amalgam Warrior be as well? In his book Code Names, William Arkin says that Amalgam Warrior is “sometimes combined with Global Guardian.” [Arkin, 2005, pp. 254] Amalgam Warrior tests such activities as tracking, surveillance, air interception, employing rules of engagement, attack assessment, electronic warfare, and counter-cruise-missile operations. A previous Amalgam Warrior in 1996 involved such situations as tracking unknown aircraft that had incorrectly filed their flight plans or wandered off course, in-flight emergencies, terrorist aircraft attacks, and large-scale bomber strike missions. Amalgam Warrior 98-1 was NORAD’s largest ever exercise and involved six B-1B bombers being deployed to Eielson Air Force Base, Alaska, to act as an enemy threat by infiltrating the aerial borders of North America. [Airman, 1/1996; Arkin, 2005, pp. 254; GlobalSecurity (.org), 4/27/2005] Another Amalgam Warrior in fall 2000 similarly involved four B-1 bombers acting as enemy forces trying to invade Alaska, with NORAD going from tracking the unknown aircraft to sending up “alert” F-15s in response. [Eielson News Service, 10/27/2000; Associated Press, 10/29/2000] If either one (or both) of these exercises ending with the name “Warrior” is taking place on 9/11, this could be very significant, because the word “Warrior” indicates that the exercise is a Joint Chiefs of Staff-approved, Commander in Chief, NORAD-sponsored field training exercise. [North American Aerospace Defense Command, 8/25/1989] Real planes would be pretending to be threats to the US and real fighters would be deployed to defend against them.
9:28 a.m. September 11, 2001: Acting Joint Chiefs Chairman Myers Updates Clarke Videoconference on Fighter Response
According to his own account, during a video conference with top officials that he is directing, counterterrorism “tsar” Richard Clarke asks acting Joint Chiefs of Staff Chairman Richard Myers, “I assume NORAD has scrambled fighters and AWACS. How many? Where?” Myers, who is at the Pentagon, replies, “Not a pretty picture, Dick. We are in the middle of Vigilant Warrior, a NORAD exercise, but… Otis has launched two birds toward New York. Langley is trying to get two up now [toward Washington]. The AWACS are at Tinker and not on alert.” Vigilant Warrior may be a mistaken reference to either the on-going war game Vigilant Guardian, or perhaps another exercise called Amalgam Warrior (see 9:28 a.m. September 11, 2001). Otis Air National Guard Base is in Massachusetts, 188 miles east of New York City; Langley is in Virginia, 129 miles south of Washington; Tinker Air Force Base is in Oklahoma. Clarke asks, “Okay, how long to CAP [combat air patrol] over DC?” Myers replies, “Fast as we can. Fifteen minutes?” [Clarke, 2004, pp. 5] The first fighters don’t reach Washington until perhaps more than 30 minutes later (see (Between 9:49 a.m. and 11:00 a.m.) September 11, 2001). However, this account—or at least the time Clarke alleges the conversation occurs—is contradicted by Myers himself and Senator Max Cleland (D-GA). Myers claims he has been at a meeting on Capitol Hill with Cleland since about 9:00 a.m., and does not arrive back at the Pentagon until after it is hit, which is at 9:37 a.m. [American Forces Press Service, 10/23/2001; MSNBC, 9/11/2002; CNN, 4/15/2003; American Forces Press Service, 9/8/2006] Cleland confirms the existence of this meeting, and claims that Myers is with him until around the time of the Pentagon attack. [CNN, 11/20/2001; Atlanta Journal-Constitution, 6/16/2003] (There are, though, some inconsistencies in Myers and Cleland’s accounts of this period—see (After 9:03 a.m.) September 11, 2001).
9:34 a.m. September 11, 2001: NEADS Surveillance Technicians Instructed to Remove Simulated Information from Radar Screens
A technician at NORAD’s Northeast Air Defense Sector (NEADS) instructs personnel on the NEADS operations floor to turn off their “sim switches,” apparently so as to remove from their radar screens simulated information for a training exercise that was being conducted this morning. [Northeast Air Defense Sector, 8/23/2001; North American Aerospace Defense Command, 9/11/2001; 9/11 Commission, 2004]
Staffer Complained, ‘Let’s Get Rid of This Goddamn Sim’ – A few minutes earlier, at 9:30 a.m., a member of staff on the operations floor complained about simulated information—presumably false tracks—appearing on NEADS radar screens. He said: “You know what, let’s get rid of this godd_mn sim. Turn your sim switches off. Let’s get rid of that crap.” [North American Aerospace Defense Command, 9/11/2001; North American Aerospace Defense Command, 9/11/2001] (A “sim switch” presumably allows simulated material on radar scopes to be turned on or off.)
Technician Instructs, ‘Turn Off Your Sim Switches’ – Now a member of NEADS staff, who according to a 9/11 Commission document is Technical Sergeant Jeffrey Richmond, gives an instruction to the NEADS surveillance technicians, “All surveillance, turn off your sim switches.” Seconds later, apparently in response to this instruction, someone on the operations floor tells a colleague, “You got your sim switches down.” [North American Aerospace Defense Command, 9/11/2001; 9/11 Commission, 2004]
Sim Switches Turned On for Day’s Exercise – Simulated material (“sim”) is apparently appearing on NEADS radar screens because of the NORAD training exercise, Vigilant Guardian, that was being conducted this morning (see (6:30 a.m.) September 11, 2001). Former Deputy Secretary of Defense John Hamre has revealed that NORAD has the capacity to inject simulated material into the system, “as though it was being sensed for the first time by a radar site.” In a training exercise in December 1998, for example, NORAD ran “30 different simulations, some of them being mass attacks, some of them being single missiles.” An information page on the current exercise stated, “All of NEADS, operations personnel are to have their sim switches turned ‘on’ starting at 1400Z 6 Sept. 01 till endex [the end date of the exercise].” Since Vigilant Guardian was originally scheduled to continue until September 13, this would mean NEADS personnel had their sim switches turned on this morning. [US Department of Defense, 1/15/1999; Northeast Air Defense Sector, 8/23/2001]
Radar Equipment Set to Display ‘Sim Tracks’ – A memo outlining special instructions for Vigilant Guardian participants further detailed how NORAD equipment needed to be set to display simulated material during the exercise. It stated: “The exercise will be conducted sim over live on the air sovereignty string. The Q-93 must be placed in the mixed mode to allow the telling [i.e. the communicating of information between facilities] of sim tracks.” [Northeast Air Defense Sector, 8/23/2001] The Q-93 is a piece of equipment used by NORAD, which is described as “a suite of computers and peripheral equipment configured to receive plot data from ground radar systems,” and which “performs track processing.” [General Accounting Office, 12/24/1992 ; Federation of American Scientists, 4/23/2000] The Q-93 also “receives flight plans from the FAA, and has bi-directional communications with NORAD headquarters and a real-time link to AWACS [Airborne Warning and Control System planes].” [Satterthwaite, Corman, and Herm, 6/2002]
Exercise Supposedly Canceled Earlier On – While NEADS radar scopes are still displaying simulated material as late as 9:34 a.m., some accounts will claim the Vigilant Guardian exercise was canceled shortly after 9:03 a.m., when the second World Trade Center tower was hit (see (Shortly After 9:03 a.m.) September 11, 2001). [Airman, 3/2002; Filson, 2003, pp. 59] And according to a report in the Toronto Star, “Any simulated information” for the exercise was “purged from the [radar] screens” at NORAD’s operations center in Cheyenne Mountain, Colorado, shortly before the second WTC tower was hit (see (9:00 a.m.) September 11, 2001). [Toronto Star, 12/9/2001] However, NEADS will receive a phone call from the operations center at 10:12 a.m. in which the caller asks it to “terminate all exercise inputs coming into Cheyenne Mountain” (see 10:12 a.m. September 11, 2001). [North American Aerospace Defense Command, 9/11/2001]
9:40 a.m. September 11, 2001: Hijacking Simulation Scheduled as Part of NORAD Exercise
As part of a NORAD training exercise, a simulated plane hijacking was scheduled to occur around this time. It was to have been based around politically motivated perpetrators taking command of an aircraft, landing it on a Cuba-like island, and seeking asylum there. The hijacking was one of several simulated scenarios prepared for the day. Details of the other scenarios are unknown. Major Kevin Nasypany, the mission crew commander at NORAD’s Northeast Air Defense Sector (NEADS) who’d helped designed the exercise, initially thought the reports of Flight 11 being hijacked were because “Somebody started the exercise early.” [Vanity Fair, 8/1/2006] The exercise was canceled after the second plane hit the World Trade Center (see (Shortly After 9:03 a.m.) September 11, 2001).
