Personnel in NORAD’s operations center in Cheyenne Mountain, Colorado, take part in a major Cold War-style training exercise called Vigilant Guardian, a war game in which the theoretical enemy is Russia. [9/11 Commission, 3/1/2004 
; Denver Post, 8/28/2011; Colorado Springs Gazette, 9/10/2011] All of NORAD, including its subordinate units (see (6:30 a.m.) September 11, 2001), participates in the exercise. [Northeast Air Defense Sector, 8/23/2001; Canadian Broadcasting Corporation, 9/8/2011] More than 50 people in the NORAD Battle Management Center in Cheyenne Mountain take part. [Airman, 3/2002; Defense Video and Imagery Distribution System, 9/8/2011] Vigilant Guardian is an annual exercise and is scheduled to last two weeks. [Arkin, 2005, pp. 545; Canadian Broadcasting Corporation, 9/8/2011] It has been underway for several days. Those in the Cheyenne Mountain Operations Center (CMOC) have been participating in it “for at least three or four days,” according to Lieutenant Colonel Steven Armstrong, NORAD’s chief of plans and forces. [North American Aerospace Defense Command, 9/9/2011]
Vigilant Guardian Is a ‘Full-Blown Nuclear War’ Exercise – Vigilant Guardian is a “transition to wartime operations command post exercise,” according to an information page for its participants. [Northeast Air Defense Sector, 8/23/2001] The 1st Air Force’s book about 9/11 will describe it as a “simulated air war.” [Filson, 2003, pp. 55] Lieutenant Colonel William Glover, the commander of NORAD’s Air Warning Center, will later recall that it involves NORAD “simulating war.… You know, attacks coming from the outside, Soviet-style bombers coming in, cruise-missile attacks, that type of thing.” [Canadian Broadcasting Corporation, 9/8/2011] Ken Merchant, NORAD’s joint exercise design manager, will tell the 9/11 Commission that Vigilant Guardian is a “full-blown nuclear war” exercise, and includes bomber response and intercontinental ballistic missile response. [9/11 Commission, 3/4/2004]
Russia Is Imagined Enemy – The theoretical enemy in the exercise is Russia. [Denver Post, 8/28/2011] According to the 9/11 Commission Report, the exercise “postulated a bomber attack from the former Soviet Union.” [9/11 Commission, 7/24/2004, pp. 458] Merchant will explain that “NORAD must use Russia in its exercises at the strategic level since no other country poses a great enough threat to NORAD’s capabilities and responsibilities.” [9/11 Commission, 3/4/2004]
Personnel Updated on Exercise during Shift Change – Armstrong will later recall that today starts off “like any other day. We came in thinking it would be a normal day… we did a standard shift changeover in the morning and we were getting right into where we were at in relation to the exercise.” He will describe that in a shift change during the exercise, “We’d say, ‘Okay, here’s what happened during the night shift (or the day shift),’ and we’d give each other an update, and then we’d start planning for whatever was on the agenda for that day.” [North American Aerospace Defense Command, 9/9/2011] According to the Denver Post, after commencing his shift, Armstrong “mapped out strategy in a chess game of ever-escalating scenarios, from strained diplomacy to the outbreak of conventional warfare that headed inexorably toward nuclear conflict” with Russia. [Denver Post, 8/28/2011]
B-1 Bomber Scheduled to Fly out over Pacific Ocean – The “planned big event for the day” in the exercise is “supposed to be a B-1 bomber that was flying out of Fairchild Air Force Base [in Washington State] and going out over the Pacific,” according to Jeff Ford, an Air Force lieutenant colonel who is working in the CMOC. Ford will add that there are “other things going on as part of the exercise, air exercise events, and then some scripted inputs that we were reacting to there in the Air Warning Center, whether it be unknown aircraft that we scramble aircraft for to intercept—or whatever.” [Defense Video and Imagery Distribution System, 9/8/2011]
Exercise Posture Allegedly Helps Response to Attacks – Vigilant Guardian will reportedly end after 9:03 a.m., when the second plane hits the World Trade Center (see (Shortly After 9:03 a.m.) September 11, 2001), and the CMOC personnel participating in it will then become involved in responding to the real-world attacks. [Airman, 3/2002; Toronto Star, 11/11/2008] Glover will claim that the CMOC’s response to the terrorist attacks benefits from the position the operations center is in for the exercise. He will say NORAD is “lucky” because “all the directorates such as operations, logistics, security, all those folks were up in the [Cheyenne] Mountain on an exercise posture.” He will add that “these are the same folks that we would bring up in case of contingencies or in time of going to war. So, in reality, I had all the guys up into the NORAD Battle Management Center that I needed to conduct the exercise as well as the contingency operations that happened on 9/11.” [Defense Video and Imagery Distribution System, 9/8/2011]
NORAD Monitoring Russian Exercise – NORAD was created in 1958, during the Cold War, to protect North American airspace against nuclear attacks from the Soviet Union. [New York Times, 4/25/2004; Canadian Broadcasting Corporation, 8/6/2004; Legion Magazine, 11/2004] According to the Toronto Star, “Whether it’s a simulation or a real-world event, the role of the [CMOC] is to fuse every critical piece of information NORAD has into a concise and crystalline snapshot.” [Toronto Star, 12/9/2001] As well as the Vigilant Guardian exercise, NORAD is currently in the middle of an operation called Northern Vigilance, with its fighter jets deployed to Alaska and Northern Canada to monitor an exercise being run by the Russian Air Force (see September 9, 2001). [North American Aerospace Defense Command, 9/9/2001] The battle staff members in Cheyenne Mountain are positioned to deal with both this operation and the exercise. [9/11 Commission, 3/1/2004 ]
8:48 a.m. September 11, 2001: NORAD Operations Center Personnel See Television Coverage of First Crash, but Unaware of Details
Personnel in the NORAD operations center in Cheyenne Mountain, Colorado, learn of the first plane hitting the World Trade Center from television coverage of the attack, but do not realize the crash involved the hijacked aircraft they have just been notified of. [Calgary Herald, 10/1/2001; Ottawa Citizen, 9/11/2002; Defense Video and Imagery Distribution System, 9/8/2011] Jeff Ford, an Air Force lieutenant colonel working in the Cheyenne Mountain Operations Center (CMOC), will later recall, “[W]e started seeing the TV inputs from CNN on the aircraft, the first aircraft that had hit the Twin Towers.” [Defense Video and Imagery Distribution System, 9/8/2011] Major General Rick Findley, NORAD’s director of operations, has just learned that the FAA has requested NORAD assistance with a hijacking (see (8.46 a.m.) September 11, 2001). [9/11 Commission, 3/1/2004 ; Spencer, 2008, pp. 38-39] He now enters the battle cab at the operations center. Someone there tells him, “Sir, you might want to look at that.” Findley will later recall: “I looked up and there was the CNN image of the World Trade Center. There was a hole in the side of one of the buildings.”
CMOC Personnel Think Small Plane Hit WTC – Findley asks, “What’s that from?” and is told, “Well, they’re saying it’s a commuter aircraft.” Findley says, “That’s too big a hole for a commuter aircraft.” He asks if the crash was caused by the hijacked aircraft he has been informed of. “I was scratching my head, wondering if it was another aircraft altogether,” he will recall. [Calgary Herald, 10/1/2001; Canadian Broadcasting Corporation, 9/11/2002] Others in the CMOC are unaware that the crash was the result of a terrorist attack and involved a large commercial aircraft. Lieutenant Colonel Steven Armstrong, NORAD’s chief of plans and forces, will recall, “[W]e didn’t really know that it was anything other than perhaps a general aviation aircraft because those were the first indications that we had was it was just… reported like a small, maybe a general aviation aircraft that had hit one of the buildings.” [North American Aerospace Defense Command, 9/9/2011] According to Lieutenant Colonel William Glover, the commander of NORAD’s Air Warning Center: “[W]e weren’t sure whether it was a mistake… was this intentional? Was there a problem? The weather was good, you know, that type of thing. So we really didn’t know what the reason was that this aircraft struck the tower.” [Canadian Broadcasting Corporation, 9/8/2011] Ford will recall: “[W]e knew something was wrong because there really wasn’t any reason for any navigational problems for that aircraft. There might have been a malfunction or something on the aircraft that had taken place, but we really didn’t have any indications of what was going on yet.” [Defense Video and Imagery Distribution System, 9/8/2011]
CMOC Personnel Unaware that Crash Was Deliberate – The CMOC is “the nerve centre of North America’s air defense,” according to the BBC. [BBC, 9/1/2002] Its role, according to the Toronto Star, is “to fuse every critical piece of information NORAD has into a concise and crystalline snapshot.” [Toronto Star, 12/9/2001] But it is only after personnel there see the television coverage of the second plane hitting the WTC at 9:03 a.m. that they realize “we had something much more sinister than just an accident, a really coordinated and deliberate action,” according to Findley. [Ottawa Citizen, 9/11/2002] Armstrong will recall: “[W]hen we saw the video [of the second crash], we said: ‘Wait a second. Those are commercial-size airplanes. Those aren’t general aviation aircraft.’ That obviously changed the situation significantly.” [North American Aerospace Defense Command, 9/9/2011] According to Glover, after the second crash, “We knew then that the first one was not a mistake and we knew that this was intentional.” [Canadian Broadcasting Corporation, 9/8/2011]
After 9:03 a.m. September 11, 2001: NORAD Operations Center Receives Many False Reports of Hijackings
The NORAD operations center in Cheyenne Mountain, Colorado, receives numerous reports from the FAA of additional hijacked aircraft, but most of these reports turn out to be incorrect. Lieutenant Colonel William Glover, the commander of NORAD’s Air Warning Center, will later recall that after 9:03 a.m., when the second plane hits the World Trade Center, those in the operations center are “starting to receive reports… that we have these hijackings coming in.” He will say, “We had all these other reports coming in now, we were receiving from FAA, that there’s other issues on there.” [Canadian Broadcasting Corporation, 9/8/2011] According to Glover, the FAA says to NORAD, “Hey, this may be a possible hijack, or this aircraft may be a possible hijack.” As a result, those in the operations center “did not know how many more there were. Were there five, six, seven, or eight?” [BBC, 9/1/2002] Major General Rick Findley, NORAD’s director of operations, will similarly recall: “Lots of other reports were starting to come in. And now you’re not too sure. If they’re that clever to coordinate that kind of attack, what else is taking place across North America?” [Toronto Star, 12/9/2001] According to Glover, the uncertainty about how many additional hijacked planes there are will lead NORAD to implement a limited version of a plan called SCATANA, which clears the skies and gives the military control of US airspace (see (11:00 a.m.) September 11, 2001). [Aviation Week and Space Technology, 6/3/2002; 9/11 Commission, 6/17/2004] However, most of the additional hijackings that the FAA is reporting to NORAD turn out to be false alarms. Glover will say that most of the reports “were not true.” [Canadian Broadcasting Corporation, 9/8/2011] According to the 9/11 Commission Report, there are “multiple erroneous reports of hijacked aircraft” during the morning (see (9:09 a.m. and After) September 11, 2001). [9/11 Commission, 7/24/2004, pp. 28]
After 9:03 a.m. September 11, 2001: NORAD Operations Center in ‘Information Void,’ Learning of Crisis from Television
Personnel in the NORAD operations center in Cheyenne Mountain, Colorado, are in what one officer there will call an “information void,” and are learning about ongoing events mostly from television reports. [Denver Post, 8/28/2011; North American Aerospace Defense Command, 9/9/2011] Major General Rick Findley, NORAD’s director of operations, will tell the 9/11 Commission that those in the Cheyenne Mountain Operations Center (CMOC) gain their “first awareness of a second impact at the World Trade Center… from the media simulcast of the event.” Findley only then realizes there is an “ongoing coordinated attack” taking place. But, he will tell the 9/11 Commission, he “did not know the exact facts of what caused both explosions.” [9/11 Commission, 3/1/2004 ] According to Lieutenant Colonel Steven Armstrong, NORAD’s chief of plans and forces, after the second crash, “[W]e were just kind of watching it unfold on CNN, and then we started making the phone calls and we tried to start building a bigger picture.” [North American Aerospace Defense Command, 9/9/2011] Armstrong will later recall, “We’re reaching out to everybody and their brother, trying to get as much information as we can to figure out what’s going on with the national airspace.” However, he will say, “[T]he majority of the information we’re getting at the time is literally off the TV.” [Denver Post, 8/28/2011] The CMOC reaches out to NORAD’s regional air defense sectors to try and get information. But, according to Armstrong, “they were pretty busy trying to run fighters and do intercepts and figure out where the bad guys were.” Therefore, Armstrong will say, “we were out there in an information void, just looking for anything that we could find.” [North American Aerospace Defense Command, 9/9/2011] Lieutenant Colonel William Glover, the commander of NORAD’s Air Warning Center, will recall that this morning is his “first time, you know, thinking about the fog of war, because we didn’t know what was going on.” [Canadian Broadcasting Corporation, 9/8/2011] Findley will reflect, “I wouldn’t call it flat-footed, but we were a little bit behind the power curve most of that morning as we were trying to figure out exactly what transpired.” [Canadian Press, 9/10/2006]
After 10:03 a.m. September11, 2001: Russia Cancels Air Force Exercise in Response to Attacks in the US
In response to the terrorist attacks in the United States, the Russian military cancels a major training exercise it has been holding, turning back its bomber aircraft and calling off planned missile testing. [Toronto Star, 12/9/2001; Defense Video and Imagery Distribution System, 9/8/2011] The Russian Air Force began the exercise—which was being conducted over the North Atlantic, Pacific, and Arctic Oceans—on September 10 (see September 10, 2001), and had planned for it to continue until September 14. NORAD has deployed fighter jets to Alaska and Northern Canada to monitor the exercise (see September 9, 2001).
Russians Cancel Exercise to Avoid Confusion – The Russians now call off their exercise, “to avoid misunderstandings, since US defenses were now on high alert in case of further possible terrorist attacks,” according to BBC correspondent Bridget Kendall. [BBC, 2001, pp. 161; North American Aerospace Defense Command, 9/9/2001; Washington Times, 9/11/2001] “The Russians knew NORAD would have its hands full,” the Toronto Star will report. Lieutenant Colonel William Glover, the commander of NORAD’s Air Warning Center, will say the Russians stop their exercise “because they understood the magnitude of what had happened to us in the United States. They didn’t want any questions; they didn’t want us worrying about what they would be doing or entering our Air Defense Identification Zone.”
Russia Tells US about Canceling Exercise – The Russians notify the US of their actions. Captain Michael Jellinek, the director of plans, requirements, and readiness at NORAD’s Cheyenne Mountain Operations Center in Colorado, will later recall: “They sent the message to the State Department clearly and unambiguously: ‘Don’t worry about our movements, we’re going to stay down for a while.’”
Russia’s Actions Are ‘Very Helpful’ to US – It is unclear when exactly the Russians call off their exercise. According to the Toronto Star, they “immediately” cancel it “on seeing the attacks in New York and Washington.” Glover will say the Russians notify the US that they are stopping their exercise “after the United Flight 93 went into Shanksville” (see (10:03 a.m.-10:10 a.m.) September 11, 2001 and (10:06 a.m.) September 11, 2001). Jellinek will call the Russians’ actions in canceling their exercise “[v]ery, very useful. Very helpful.” Glover will comment, “[T]hat was amazing to me, personally, the fact that they stopped their exercise and… that they told us that they were going to stop the exercise.” [Toronto Star, 12/9/2001; Defense Video and Imagery Distribution System, 9/8/2011] Russian President Vladimir Putin will contact the White House and inform National Security Adviser Condoleezza Rice that the Russians are voluntarily canceling their exercise (see Between 10:32 a.m. and 11:45 a.m. September 11, 2001). [Washington Post, 1/27/2002]
10:10 a.m. September 11, 2001: Suspected Hijacked Aircraft Is Reportedly Heading for NORAD’s Operations Center in Colorado
Officials in NORAD’s operations center in Cheyenne Mountain, Colorado, are notified that an aircraft out of San Diego, California, may be hijacked and could be targeting Cheyenne Mountain. [BBC, 9/1/2002; Grant, 2004, pp. 26] The FBI warns NORAD’s Cheyenne Mountain Operations Center (CMOC) “that a flight originating in San Diego might be hijacked and headed for a target in Colorado,” according to Aviation Week and Space Technology magazine. [Aviation Week and Space Technology, 6/3/2002] According to an official Air Force report on the war on terrorism, the CMOC is told that the flight is “headed to Denver,” and Brigadier General Michael Gould, the commander of the CMOC, then realizes there are “plenty” of targets near Denver, “from the Air Force bases around Colorado Springs to downtown Denver or even Cheyenne Mountain.” [Grant, 2004, pp. 26]
Cheyenne Mountain Is the Plane’s Target – According to other accounts, Cheyenne Mountain specifically is believed to be the plane’s intended target. [Washington Post, 7/29/2006] Brigadier General Jim Hunter, the vice commander of the CMOC, will later recall that the operations center receives intelligence that “there might be another airliner airborne from a city in the United States,” which has reportedly “been hijacked near San Diego,” and the plane’s target is “specifically Cheyenne Mountain.”
Threat Reportedly Leads to the Blast Doors Being Shut – The Regina Leader-Post will point out, “Protected by 2,600 feet of granite, the NORAD command center and hundreds of personnel in their green flight suits were actually in the safest place in North America.” Hunter will comment, “They could have driven airliners into that mountain all day.” [BBC, 9/1/2002; Regina Leader-Post, 9/12/2011] But, according to some accounts, the concern about the suspicious plane is what leads to the 25-ton blast doors to the CMOC being closed for the first time ever in a real-world, non-exercise event (see (10:15 a.m.) September 11, 2001). [Toronto Star, 12/9/2001; BBC, 9/1/2002; North American Aerospace Defense Command, 9/9/2011]
Suspicious Flight Is a False Alarm – The suspect aircraft eventually identifies itself and lands uneventfully. But, Gould will recall, NORAD starts “expanding our focus away from just the northeast corridor” of the US and also begins “considering other critical infrastructure, [such as] nuclear power plants.” Gould will add, “We’re just thinking, ‘What kind of damage could an airliner full of fuel do?’” [Grant, 2004, pp. 26] Later on today, CMOC personnel will be informed that a truck, or a number of trucks, carrying Arab-looking men is heading their way, but the apparent threat will turn out to be a false alarm (see (Shortly After 1:05 p.m.) September 11, 2001). “We were receiving all kinds of input from everybody,” Lieutenant Colonel William Glover, the commander of NORAD’s Air Warning Center, will comment. Every rumor is treated as a potential threat. “It didn’t make sense, but those phone calls were happening,” Glover will say. [US Department of Defense, 9/11/2001 ; Aviation Week and Space Technology, 6/3/2002; BBC, 9/1/2002]
Shortly After 1:05 p.m. September 11, 2001: Suspicious Truck Carrying ‘Arab-Looking Men’ Is Reportedly Heading Toward NORAD’s Operations Center
Personnel in NORAD’s Cheyenne Mountain Operations Center (CMOC) in Colorado are informed that a truck, or a number of trucks, carrying men who appear to be Arabs is heading up the mountain toward the CMOC, but the apparent threat will turn out to be a false alarm. [US Department of Defense, 9/11/2001 ; Aviation Week and Space Technology, 6/3/2002; BBC, 9/1/2002] A NORAD representative describes what CMOC personnel are told over the Pentagon’s air threat conference call, saying, “We just received some intel that eight Ryder vans may be en route to the Cheyenne Mountain complex.” [US Department of Defense, 9/11/2001 ] According to some accounts, though, only one vehicle—not eight—is reportedly heading toward the CMOC and this is carrying a number of Arab-looking men. CMOC personnel receive “an input that there [is] a yellow transport truck coming up the hill with seven Islamic folks in the front cab,” Lieutenant Colonel William Glover, the commander of NORAD’s Air Warning Center, will later recall. [BBC, 9/1/2002] According to Aviation Week and Space Technology magazine, there is a “rumor” going around the CMOC about a “Ryder rental truck full of explosives,” driven by “Arab-looking men,” that is “targeting the mountain.” [Aviation Week and Space Technology, 6/3/2002] The source of the information about the truck, or trucks, supposedly approaching the CMOC is unstated.
Blast Doors Are Reportedly Shut due to the Threat – The massive blast doors leading to the CMOC are closed in response to this apparent threat, according to the NORAD representative on the air threat conference call (see (10:15 a.m.) September 11, 2001). He says over the conference call, “Cheyenne Mountain is closing [the] blast doors in response to [a] possible threat of eight Ryder trucks en route from downtown to the Cheyenne Mountain complex.”
Threat Is a False Alarm – The supposed threat will turn out to be a false alarm. The NORAD representative will later report over the conference call: “I previously briefed [about a] possible eight Ryder trucks en route to Cheyenne Mountain. That threat has been negated. That is no longer a threat.” He will be asked if the report about the trucks was “an accurate assessment” or if someone had to “neutralize the force,” presumably meaning military action had to be taken against the trucks. The NORAD representative will answer simply, “We have no more details at this time.” It is unclear when CMOC personnel are alerted to the truck, or trucks, that is supposedly heading their way. The NORAD representative on the air threat conference call first mentions the trucks shortly after he reported that an unidentified aircraft had been spotted flying toward President Bush’s ranch in Crawford, Texas. [US Department of Defense, 9/11/2001 ] Bush was told about this aircraft at 1:05 p.m. (see 1:05 p.m. September 11, 2001), which was presumably around the time that NORAD was alerted to it. [New Yorker, 9/25/2001; Sammon, 2002, pp. 117] CMOC personnel presumably therefore learn about the truck, or trucks, supposedly heading their way shortly after 1:05 p.m.
