Profile: Ralph Eberhart
Ralph Eberhart was a participant or observer in the following events:
Captain Tom Herring, an F-15 pilot with the Florida Air National Guard. [Source: Airman]Fighter jets are regularly scrambled by the North American Aerospace Defense Command (NORAD) in response to suspicious or unidentified aircraft flying in US airspace in the years preceding 9/11. [General Accounting Office, 5/3/1994, pp. 4; Associated Press, 8/14/2002] For this task, NORAD keeps a pair of fighters on “alert” at a number of sites around the US. These fighters are armed, fueled, and ready to take off within minutes of receiving a scramble order (see Before September 11, 2001). [American Defender, 4/1998; Air Force Magazine, 2/2002; Bergen Record, 12/5/2003; Grant, 2004, pp. 14] Various accounts offer statistics about the number of times fighters are scrambled:
A General Accounting Office report published in May 1994 states that “during the past four years, NORAD’s alert fighters took off to intercept aircraft (referred to as scrambled) 1,518 times, or an average of 15 times per site per year.” Of these incidents, the number of scrambles that are in response to suspected drug smuggling aircraft averages “one per site, or less than 7 percent of all of the alert sites’ total activity.” The remaining activity, about 93 percent of the total scrambles, “generally involved visually inspecting unidentified aircraft and assisting aircraft in distress.” [General Accounting Office, 5/3/1994, pp. 4]
In the two years from May 15, 1996 to May 14, 1998, NORAD’s Western Air Defense Sector (WADS), which is responsible for the “air sovereignty” of the western 63 percent of the continental US, scrambles fighters 129 times to identify unknown aircraft that might be a threat. Over the same period, WADS scrambles fighters an additional 42 times against potential and actual drug smugglers. [Washington National Guard, 1998]
In 1997, the Southeast Air Defense Sector (SEADS)—another of NORAD’s three air defense sectors in the continental US—tracks 427 unidentified aircraft, and fighters intercept these “unknowns” 36 times. The same year, NORAD’s Northeast Air Defense Sector (NEADS) handles 65 unidentified tracks and WADS handles 104 unidentified tracks, according to Major General Larry Arnold, the commander of the Continental United States NORAD Region on 9/11. [American Defender, 4/1998]
In 1998, SEADS logs more than 400 fighter scrambles. [Grant, 2004, pp. 14]
In 1999, Airman magazine reports that NORAD’s fighters on alert at Homestead Air Reserve Base in Florida are scrambled 75 times per year, on average. According to Captain Tom Herring, a full-time alert pilot at the base, this is more scrambles than any other unit in the Air National Guard. [Airman, 12/1999]
General Ralph Eberhart, the commander of NORAD on 9/11, will later state that in the year 2000, NORAD’s fighters fly 147 sorties. [9/11 Commission, 6/17/2004 ]
According to the Calgary Herald, in 2000 there are 425 “unknowns,” where an aircraft’s pilot has not filed or has deviated from a flight plan, or has used the wrong radio frequency, and fighters are scrambled 129 times in response. [Calgary Herald, 10/13/2001]
Between September 2000 and June 2001, fighters are scrambled 67 times to intercept suspicious aircraft, according to the Associated Press. [Associated Press, 8/14/2002]
Lieutenant General Norton Schwartz, the commander of the Alaskan NORAD Region at the time of the 9/11 attacks, will say that before 9/11, it is “not unusual, and certainly was a well-refined procedure” for NORAD fighters to intercept an aircraft. He will add, though, that intercepting a commercial airliner is “not normal.” [Air Force Magazine, 9/2011 ] On September 11, 2001, NEADS scrambles fighters that are kept on alert in response to the hijackings (see 8:46 a.m. September 11, 2001 and 9:24 a.m. September 11, 2001). [New York Times, 10/16/2001; 9/11 Commission, 7/24/2004, pp. 20, 26-27]
The US military reduces the Information Operations Condition (Infocon) to Normal—the lowest possible threat level—less than 12 hours before the 9/11 attacks commence, reportedly due to reduced fears of attacks on computer networks.
Level Reduced Due to 'Decreased Threat' - The Infocon level is lowered to Normal, meaning there is no special threat, at 9:09 p.m. this evening. The reason for this, according to historical records for the 1st Fighter Wing at Langley Air Force Base, Virginia, is “a decreased threat from hacker and virus attacks on the computer networks across the US.” [Colorado Springs Gazette, 5/3/2001; 1st Fighter Wing History Office, 12/2001] Since October 1999, the commander of the US Space Command has been in charge of Defense Department computer network defense, and has had the authority to declare Infocon levels. [IAnewsletter, 12/2000 ] General Ralph Eberhart, the current commander of both the US Space Command and NORAD, is thus responsible for evaluating the threat to US military computers and issuing information conditions—“Infocons”—to the US military. He is presumably therefore responsible for lowering the Infocon level this evening.
Higher Infocon Level Requires More Precautions - It is unclear what difference the reduced Infocon level makes. But an e-mail sent earlier in the year from Peterson Air Force Base in Colorado, where NORAD and the US Space Command are headquartered, revealed the steps to be taken when the Infocon level is raised one level from Normal, to Alpha. These steps include “changing passwords, updating keys used to create classified communication lines, minimizing cell phone use, backing up important documents on hard drive, updating virus protection on home computers, reporting suspicious activity, and reviewing checklists.” [Colorado Springs Gazette, 5/3/2001]
Level Increased Earlier in Year - It is also unclear what the Infocon level was prior to being reduced this evening and why it had been at that raised level. Pentagon networks were raised to Infocon Alpha for the first time at the end of April this year, as a precaution against attacks on US systems, after Chinese hackers warned of such attacks in Internet chat room postings. [United Press International, 4/30/2001; Colorado Springs Gazette, 5/3/2001; United Press International, 7/24/2001] The Infocon level was raised to Alpha a second time in late July, due to the threat posed by the Code Red computer virus. [United Press International, 7/24/2001; US Department of Defense, 7/24/2001] It will be raised again, from Normal to Alpha, during the morning of September 11, immediately after the second attack on the World Trade Center takes place (see 9:04 a.m. September 11, 2001). [1st Fighter Wing History Office, 12/2001]
System Intended to Protect Defense Department Computers - The Joint Chiefs of Staff established the Infocon system in March 1999 in response to the growing and sophisticated threat to Defense Department information networks. The system is intended as a structured, coordinated approach to defend against and react to attacks on Defense Department systems and networks. Reportedly, it “provides a structured, operational approach to uniformly heighten or reduce defensive posture, defend against unauthorized activity, and mitigate sustained damage to the defense information infrastructure.” It is analogous to other Defense Department alert systems, such as Defense Condition (Defcon) and Threat Condition (Threatcon). The Infocon system comprises five levels of threat, each with its own procedures for protecting systems and networks. These levels go from Normal, through Alpha, Bravo, and Charlie, up to Delta, which, according to Rear Admiral Craig Quigley, the deputy assistant secretary of defense for public affairs, is when “You’re currently under an absolutely massive hack attack, from a variety of means, from a variety of sources. You’re talking a very concerted, focused attack effort to get into [Defense Department] systems.” [IAnewsletter, 12/2000 ; General Accounting Office, 3/29/2001 ; US Department of Defense, 7/24/2001]
Florida Air National Guard crew chiefs and a pilot scrambling to an F-15 during an alert drill at Homestead Air Reserve Base. [Source: Airman]Fighter jets that are scrambled by the North American Aerospace Defense Command (NORAD) in response to suspicious or unidentified aircraft in US airspace are able to take off within minutes of receiving a scramble order, in the years preceding 9/11. [Airman, 1/1996; Cape Cod Times, 9/15/2001; Spencer, 2008, pp. 117] NORAD keeps a pair of fighters on “alert” at a number of sites around the US. These fighters are armed and fueled, ready for takeoff. [American Defender, 4/1998; Air Force Magazine, 2/2002; Bergen Record, 12/5/2003] Even before 9/11, the fighters are regularly scrambled to intercept errant aircraft (see 1990-2001). [General Accounting Office, 5/3/1994, pp. 4; Associated Press, 8/14/2002]
Pilots Stay Close to Their Aircraft - Pilots on alert duty live near to their fighters, so they will be ready for a prompt takeoff if required. Author Lynn Spencer will write that pilots on alert duty at Langley Air Force Base in Virginia “live, eat, and sleep just steps from jets.” [Spencer, 2008, pp. 117] According to Major Martin Richard, a pilot with the 102nd Fighter Wing at Otis Air National Guard Base in Massachusetts, “Every day” at his base, “365 days a year, 24 hours a day, at least two fighter pilots and four maintenance personnel ate, slept, and lived nestled adjacent to three fully loaded F-15 jets.” [Richard, 2010, pp. 8]
Fighters Can Get Airborne in Minutes - The fighters on alert are required to be in the air within minutes of a scramble order. General Ralph Eberhart, the commander of NORAD on 9/11, will tell the 9/11 Commission that they “have to be airborne in 15 minutes.” [9/11 Commission, 6/17/2004] Richard will write that the objective of the alert pilots at his base is “to be airborne in 10 minutes or less if the ‘horn’ went off.” [Richard, 2010, pp. 8] According to other accounts, fighters on alert are generally airborne in less than five minutes. Airman magazine reports in 1996 that NORAD’s alert units “work around the clock, and usually have five minutes or less to scramble when the warning klaxon sounds.” [Airman, 1/1996] A few days after 9/11, the Cape Cod Times will report that, “if needed,” the fighters on alert at Otis Air Base “must be in the air within five minutes.” [Cape Cod Times, 9/15/2001] According to Spencer, pilots on alert duty at Langley Air Force Base are “always just five minutes away from rolling out of the hangars in their armed fighters.” [Spencer, 2008, pp. 117] Captain Tom Herring, a full-time alert pilot at Homestead Air Reserve Base in Florida, says in 1999, “If needed, we could be killing things in five minutes or less.” [Airman, 12/1999] In 1994, NORAD is planning to reduce the number of alert sites in the continental United States and, according to a report published that year by the General Accounting Office, “Each alert site will have two fighters, and their crews will be on 24-hour duty and ready to scramble within five minutes.” [General Accounting Office, 5/3/1994, pp. 16]
'Everything Else Just Stops' following Scramble Order - Once an order to scramble is received, alert pilots try to get airborne as quickly as they can. According to Richard, being a pilot sitting on alert is “akin to being a fireman.” Richard will later recall that when the horn goes off, signaling for him to get airborne, “no matter where I was or what I was doing, I had to swiftly don my anti-g suit, parachute harness, and helmet, run to the jet where my maintenance crew was waiting, fire up the powerful jet engines, and check all of the systems while simultaneously talking with the Otis command post who had a direct feed from NEADS [NORAD’s Northeast Air Defense Sector]. When the horn blew, a frantic, harrowing race into a high pressure situation ensued.” [Richard, 2010, pp. 8] Herring says: “We go full speed when that klaxon sounds and people know not to get in front of us, because we take scrambles very seriously.… We’re fired up about what we do and we’re the best at what we do.” [Airman, 12/1999] Technical Sergeant Don Roseen, who keeps the alert fighters at Tyndall Air Force Base in Florida ready for instant takeoff, says in 1999 that these fighters are “hot and cocked, they are ready.” Roseen says that when the klaxon goes off, “everything else just stops.”
Suspicious Aircraft 'Could Be a Terrorist' - When they are taking off, pilots may be unaware exactly why they are being scrambled. Major Steve Saari, an alert pilot at Tyndall Air Force Base, says: “There are several different things you could run into and you don’t know until you’re airborne. And sometimes you can’t tell until you have a visual identification.” Saari says: “The unknown [aircraft] could be something as simple as a lost civilian or it could be somebody defecting from Cuba. It could be a terrorist or anything in-between.” [American Defender, 3/1999] According to Airman magazine, the unidentified aircraft might be “Cuban MiGs, drug traffickers, smugglers, hijackers, novice pilots who’ve filed faulty flight plans, or crippled aircraft limping in on a wing and a prayer.” [Airman, 12/1999]
Intercepted Aircraft Could Be Shot Down - Fighters can respond in a number of ways when they intercept a suspect aircraft. In 2011, Jeff Ford—at that time the aviation and security coordinator for the NORAD and USNORTHCOM Interagency Coordination Directorate—will say that before 9/11, scrambled fighters can “intercept the aircraft, come up beside it, and divert it in the right direction toward an airfield or find out what the problems are in order to assist.” [Defense Video and Imagery Distribution System, 9/8/2011] According to MSNBC: “[I]nterceptors can fly alongside a plane to see who’s flying it. They can also try to force it off course. Once it is apparent that it is not following directions, it might be forced over the ocean or to a remote airport—or even shot down.” [MSNBC, 9/12/2001] On September 11, 2001, NEADS will scramble fighters that are kept on alert in response to the hijackings (see 8:46 a.m. September 11, 2001 and 9:24 a.m. September 11, 2001). [New York Times, 10/16/2001; 9/11 Commission, 7/24/2004, pp. 20, 26-27]
Entity Tags: 102nd Fighter Wing, Tyndall Air Force Base, Don Roseen, Homestead Air Reserve Base, Jeff Ford, Tom Herring, Langley Air Force Base, Ralph Eberhart, Steve Saari, North American Aerospace Defense Command, Martin Richard, Otis Air National Guard Base, Northeast Air Defense Sector
Timeline Tags: Complete 911 Timeline, 9/11 Timeline
The Joint Surveillance System (JSS). [Source: Dr. Steven R. Bussolari, MIT Lincoln Laboratory]Military radar in Massachusetts, which is used by NORAD’s Northeast Air Defense Sector (NEADS), is out of use this morning in order to undergo maintenance work. [9/11 Commission, 10/27/2003 ; 9/11 Commission, 10/27/2003 ]
Radar Scheduled to Go Down - The J53 radar in North Truro, Massachusetts, is one of a number of radar sites that NEADS receives data from. [United States Space Command, 12/30/1995; Jane's C4I Systems, 9/1/2005; North American Aerospace Defense Command, 10/23/2006 ] It has a range of 250 miles. According to Technical Sergeant Jeffrey Richmond, the assistant air surveillance technician at NEADS, J53 is scheduled to go down this morning for some major repairs to be carried out. [9/11 Commission, 10/27/2003 ; 9/11 Commission, 10/27/2003 ]
NEADS Personnel Refer to Radar - A member of staff at NEADS apparently refers to the J53 radar being offline shortly after those on the NEADS operations floor learn of the Flight 11 hijacking (see (8:38 a.m.) September 11, 2001) and while they are trying to locate the hijacked aircraft. She mentions that NEADS technicians “still should be able to get it” (presumably referring to the plane’s radar track) “without 53.” [North American Aerospace Defense Command, 9/11/2001] (According to Richmond, the area covered by J53 is overlapped by other radars, “so the need for radar to undergo routine maintenance is accounted for.”) ID technician Shelley Watson will later recall that the NEADS ID desk uses the J53 radar as a point from which it attempts to locate Flight 11. At some time during the morning, Richmond insists that J53 be put back online at some capacity. Whether this happens is unstated. [9/11 Commission, 10/27/2003 ; 9/11 Commission, 10/27/2003 ]
Radar Part of 'Joint Surveillance System' - The J53 radar site is part of the Joint Surveillance System (JSS). [Transportation Safety Board of Canada, 9/2/1998; US Department of the Air Force, 11/1/1999 ; 9/11 Commission, 2004] The JSS consists of “long-range radar sites around the perimeter of the US, with data shared by the [Department of Defense], FAA, Customs, and others.” A 2003 Department of Defense report will state that, at the time of the 9/11 attacks, US air defense relies “largely on outward looking ground-based radars, specifically, the Joint Surveillance System.” [US Department of Defense, 7/2003 ] According to General Ralph Eberhart, the commander of NORAD, NORAD has access to the JSS, “which is that system that rings the United States and looks out.” He will say this system “looks for that foreign threat. It looks for someone coming into our airspace that’s not authorized.” [US Congress. Senate. Armed Services Committee, 10/25/2001]
Major General Larry Arnold, the commander of the Continental United States NORAD Region (CONR), participates in a video teleconference with other senior NORAD officials and is therefore unavailable when NORAD’s Northeast Air Defense Sector (NEADS) tries contacting him for authorization to scramble fighter jets in response to the hijacked Flight 11. [Filson, 2002; 9/11 Commission, 5/23/2003; 9/11 Commission, 7/24/2004, pp. 20; Spencer, 2008, pp. 31] Arnold is in the video teleconferencing room at CONR headquarters, at Tyndall Air Force Base, Florida.
Teleconference Discussing 'Russian Exercise' - Robert Del Toro, an intelligence officer with the 1st Air Force who is in the room with Arnold, will tell the 9/11 Commission that the teleconference is “about the Russian exercise.” [9/11 Commission, 2/2/2004 ] Del Toro is presumably referring to either the Russian Air Force exercise that NORAD is currently monitoring (see September 9, 2001) or the exercise, Vigilant Guardian, that NORAD is currently running, which reportedly includes a simulated war against Russia (see (8:00 a.m.) September 11, 2001). [North American Aerospace Defense Command, 9/9/2001; Arkin, 2005, pp. 545; Denver Post, 8/28/2011]
NORAD Officials from US and Canada on Teleconference - It is unclear exactly who else is participating in the teleconference. Arnold will tell the 9/11 Commission that as well as “our folks”—presumably referring to some of his colleagues at CONR—it includes “the NORAD staff.” The “NORAD staff” presumably includes officials from NORAD’s operations center in Cheyenne Mountain, Colorado, and its headquarters at Peterson Air Force Base, Colorado. [9/11 Commission, 5/23/2003] Arnold will tell author Leslie Filson that the teleconference includes “the CINC”—presumably meaning General Ralph Eberhart, the commander in chief of NORAD, who is at Peterson Air Force Base—and also officials from the Alaskan NORAD Region (ANR) and the Canadian NORAD Region (CANR). [Filson, 2002; 9/11 Commission, 3/1/2004, 3/1/2004 ]
Arnold Not Alerted to Hijacking - While Arnold is on the teleconference, NEADS calls CONR to alert him to the suspected hijacking of Flight 11 (see (8:38 a.m.) September 11, 2001), but no one at CONR interrupts the teleconference to fetch him or pass on to him the urgent message from NEADS. Arnold will only learn of the hijacking after the teleconference ends (see (8:40 a.m.) September 11, 2001) and he will then call NEADS back (see (8:42 a.m.) September 11, 2001). [9/11 Commission, 5/23/2003; Spencer, 2008, pp. 31, 38]
The 1st Fighter Wing at Langley Air Force Base, Virginia, receives notification from NORAD of an increased Information Operations Condition (Infocon) threat level. The message from NORAD directs the 1st Fighter Wing command post to upgrade the Infocon computer security level from Normal to Alpha. According to the wing’s own records, this is “the first message correspondence” the wing receives “to indicate that September 11th would not be an average day.” [1st Fighter Wing History Office, 12/2001] Steps to be taken under Infocon Alpha reportedly include “changing passwords, updating keys used to create classified communication lines, minimizing cell phone use, backing up important documents on hard drive, updating virus protection on home computers, reporting suspicious activity, and reviewing checklists.” [Colorado Springs Gazette, 5/3/2001]
Five Security Levels - The Infocon system provides a structured, coordinated approach for defending against and reacting to attacks on Defense Department systems and networks. It comprises five levels of threat, each with its own protective procedures. These levels go from Normal, through Alpha, Bravo, and Charlie, up to Delta. [IAnewsletter, 12/2000 ; General Accounting Office, 3/29/2001 ] General Ralph Eberhart, the commander of both the US Space Command and NORAD, is responsible for evaluating the threat to military computers and issuing information conditions—“Infocons”—to the US military. [Colorado Springs Gazette, 5/3/2001] He is presumably therefore responsible for currently raising the Infocon level.
Threat Level Lowered on Previous Evening - The Infocon level was in fact lowered to Normal the previous evening, reportedly because of a reduced threat to US computer networks from hacker and virus attacks (see September 10, 2001). [1st Fighter Wing History Office, 12/2001] The 1st Fighter Wing is the “host unit” at Langley Air Force Base, which is about 130 miles from Washington, DC. It includes three fighter squadrons, which fly the F-15 Eagle fighter jet. [Virginian-Pilot, 9/20/2001; Langley Air Force Base, 11/2003; Air Force Print News, 11/9/2006]
Acting Chairman of the Joint Chiefs of Staff Richard Myers learns of the second attack on the World Trade Center. According to some reports, Myers entered a meeting on Capitol Hill with Senator Max Cleland (D-GA) just minutes before the second plane hit the WTC (see Shortly Before 9:00 a.m. September 11, 2001). There are confused accounts of when he learns of this second attack and what he does in response. Myers later tells NBC News, “[S]omewhere in the middle of that meeting, they came in and said the second tower has been hit… and I think that’s when we figured out something—that America or at least the World Trade Center is under attack.” He adds, “And then I left the office,” and, he says, NORAD Commander Ralph Eberhart then calls him. [MSNBC, 9/11/2002] Similarly, in his 2009 memoirs, Myers will write that Cleland “had started preparing a pot of tea, but we hadn’t taken a sip when a staff person came in from the outer office and informed us that the second tower had been hit. We both knew the interview was over and started out to the TV to see the South Tower erupting with smoke and flame.” [Myers, 2009, pp. 8] In testimony on September 13, 2001, Myers will state, “[A]fter the second tower was hit, I spoke to the commander of NORAD, General Eberhart.” [US Congress, 9/13/2001] In a speech in 2006, Myers says that after the second attack occurs, “The meeting was over very quickly.” [Council on Foreign Relations, 6/29/2006] He will tell CNN, “[W]hen the second target was hit, we knew something was up, so we rushed back to the Pentagon.” [CNN, 4/15/2003] Yet in an interview five weeks after 9/11, Myers claims, “Nobody informed us” when the second tower was hit, “But when we came out [of our meeting], that was obvious.” [Armed Forces Radio And Television Service, 10/17/2001; American Forces Press Service, 10/23/2001] And, according to several accounts, he does not leave Capitol Hill until around the time the Pentagon is hit, which is more than 30 minutes after the second attack happens (see (Shortly After 9:37 a.m.) September 11, 2001). In a speech in 2003, Cleland will recall: “Gen. Myers bolted from his seat. We rushed into an adjoining office as we saw on TV the second plane slam into the second tower. Gen. Myers rushed out of my office, headed for the Pentagon. At that moment, the Pentagon was hit.” [Atlanta Journal-Constitution, 6/16/2003] But on a couple of other occasions, Cleland says he is still meeting with Myers in his office at the time the Pentagon is hit. [US Congress, 9/13/2001; CNN, 11/20/2001] Contradicting both Cleland and Myers, counterterrorism “tsar” Richard Clarke will claim that when he joins a video teleconference shortly after the time of the second attack, he can see Myers on screen, meaning Myers is at the Pentagon at that time rather than on Capitol Hill (see (9:10 a.m.) September 11, 2001). [Clarke, 2004, pp. 1-3]
In the middle of the 9/11 attacks, General Ralph Eberhart, the commander of NORAD, drives from his NORAD headquarters office at Peterson Air Force Base, Colorado to the NORAD operations center in Cheyenne Mountain, about a dozen miles away. The journey reportedly takes him 45 minutes and en route he loses a cell phone call with Vice President Cheney. The reason he makes this journey is unknown, though it is reported that there are superior communications capabilities available at Cheyenne Mountain. [Colorado Springs Gazette, 6/16/2006; Denver Post, 7/28/2006; Washington Post, 7/29/2006] The exact times when Eberhart departs Peterson AFB and arrives at Cheyenne Mountain are unclear. General Richard Myers says that Eberhart phones him from Peterson either just before or just after the Pentagon is hit, which suggests that Eberhart heads out some time between 9:35 a.m. and 9:40 a.m. [Armed Forces Radio And Television Service, 10/17/2001; 9/11 Commission, 6/17/2004] Eberhart tells the 9/11 Commission that when he arrives at the NORAD operations center, the order to shoot down hijacked aircraft has already been passed down NORAD’s chain of command. According to the commission’s timeline, this would indicate he arrives after 10:31 a.m. (see 10:31 a.m. September 11, 2001). [9/11 Commission, 7/24/2004, pp. 42] Yet other reports state that the massive blast doors to Cheyenne Mountain are shut at around 10:15 a.m. (see (10:15 a.m.) September 11, 2001), which suggests that Eberhart arrives earlier.
At some time after the second attack in New York, Richard Myers, the acting chairman of the Joint Chiefs of Staff, receives a call from NORAD Commander Ralph Eberhart. According to his own account, Myers is on Capitol Hill, where he has been meeting with Senator Max Cleland (D-GA). Apparently soon after he leaves this meeting, his military aide, Army Captain Chris Donahue, hands him a cell phone on which Eberhart is calling. Myers will later comment, “In this emergency, I had to forgo the luxury of a secure encrypted red switch phone and use Donahue’s cell.” Myers will recall that Eberhart “said, you know, we’ve got several hijack codes, meaning that the transponders in the aircraft are talking to the ground, and they’re saying we’re under, we’re being hijacked, several hijack codes in the system, and we’re responding with, with fighter aircraft.” [American Forces Press Service, 10/23/2001; MSNBC, 9/11/2002; Myers, 2009, pp. 8-9] (However, none of the pilots of the four hijacked flights this morning keyed the emergency four-digit code that would indicate a hijacking into their plane’s transponder (see (8:13 a.m.-9:28 a.m.) September 11, 2001). [CNN, 9/11/2001] It is therefore unclear what “hijack codes” Eberhart is referring to.) Eberhart also tells Myers, “The decision I’m going to make is, we’re going to land everybody, and we’ll sort it out when we get them on the ground.” [Council on Foreign Relations, 6/29/2006] He is presumably referring to a plan called SCATANA, which clears the skies and gives the military control over US airspace. However, Eberhart does not implement this until around 11:00 a.m. (see (11:00 a.m.) September 11, 2001). [9/11 Commission, 6/17/2004] It is unclear exactly when this call takes place, but it appears to be just before the time the Pentagon is hit, or just before Myers is informed of the Pentagon attack. [MSNBC, 9/11/2002; 9/11 Commission, 6/17/2004 ; 9/11 Commission, 6/17/2004; Council on Foreign Relations, 6/29/2006; American Forces Press Service, 9/8/2006] In his 2009 memoirs, Myers will place it after he is informed of the second attack on the World Trade Center (see (Shortly After 9:03 a.m.) September 11, 2001), but not give a specific time. [Myers, 2009, pp. 8-9] Cleland will confirm that Myers meets with him on this morning, and is with him up to the time of the Pentagon attack, or shortly before. [US Congress, 9/13/2001; CNN, 11/20/2001; Atlanta Journal-Constitution, 6/16/2003] However, according to counterterrorism “tsar” Richard Clarke, Myers is back at the Pentagon speaking over a video conference around 10 minutes before the Pentagon is struck (see 9:28 a.m. September 11, 2001). [Clarke, 2004, pp. 5]
General Ralph Eberhart. [Source: NORAD]As the 9/11 Commission will later describe, the commander of NORAD, General Ralph Eberhart, now directs “all air sovereignty aircraft to battle stations, fully armed.” [9/11 Commission, 7/24/2004, pp. 38] Being at “battle stations” means the pilots have to suit up into their flight gear and get into their planes, ready to start the engines and taxi out if a scramble order follows. [Spencer, 2008, pp. 27] Senior NORAD officials will subsequently give the order to launch available fighter jets across the nation (see (Between 9:50 a.m. and 10:00 a.m.) September 11, 2001). [Spencer, 2008, pp. 178, 180]
Clarke Requested Combat Air Patrols - A few minutes earlier, according to his own account, counterterrorism “tsar” Richard Clarke, who is in the White House Situation Room, learned of an aircraft hitting the Pentagon and instructed his deputy: “Find out where the fighter planes are. I want combat air patrol over every major city in this country” (see (Between 9:38 a.m. and 9:45 a.m.) September 11, 2001). Whether Clarke’s actions influenced Eberhart to issue his order is unknown. [Clarke, 2004, pp. 7-8]
Fighter Units Possibly Offered Help Much Earlier - The Toledo Blade will state that NORAD’s Northeast Air Defense Sector (NEADS) only begins calling bases across the US to request help “[b]y 10:01 a.m.” [Toledo Blade, 12/9/2001] But an article in Aviation Week and Space Technology magazine will indicate that NORAD and NEADS began receiving calls from various fighter units, asking, “What can we do to help?” right after the second World Trade Center tower was hit at 9:03, when it had become obvious the US was under attack (see (After 9:03 a.m.) September 11, 2001). [Aviation Week and Space Technology, 6/3/2002] It is therefore unclear why the instruction to put available fighters on battle stations—or to scramble them—was not issued significantly earlier.
The US military’s defense readiness condition is raised from Defcon 5, the lowest possible level, to Defcon 3, an intermediate level that requires a heightened alert status for US armed forces worldwide, and which is the highest the defense readiness condition has been for 28 years. [Historical Office, Office of the Secretary of Defense, 7/18/2002; 9/11 Commission, 7/24/2004, pp. 326, 554; Goldberg et al., 2007, pp. 131; Rumsfeld, 2011, pp. 338]
Rumsfeld Recommends Raising Defcon - The decision to go to Defcon 3 is reportedly made by Secretary of Defense Donald Rumsfeld. [US Department of Defense, 8/12/2002] Rumsfeld will later recall that after he arrives at the Pentagon’s National Military Command Center (NMCC) (see (10:30 a.m.) September 11, 2001), he talks with General Richard Myers, the vice chairman of the Joint Chiefs of Staff, and “[w]e discussed and I recommended raising the defense condition level from five to three.” [9/11 Commission, 3/23/2004]
Teleconference Participants Told to 'Hold Off' on Defcon 3 - Rumsfeld directs that the US military go to Defcon 3. At 10:43 a.m., it is announced on the air threat conference call that the secretary of defense “has directed that we go to Defcon 3 and be prepared to go to [Defcon] 2.” However, a minute later, Rumsfeld talks to Vice President Dick Cheney on the conference call, and Cheney says he will have to run the decision to go to Defcon 3 by the president, “and let him make the call.” Therefore, at 10:45 a.m., those on the conference call are told to “hold off on Defcon 3.”
Order to Raise Defcon Reinstated - But Rumsfeld believes raising the defense readiness condition is urgent. [US Department of Defense, 9/11/2001 ; 9/11 Commission, 7/24/2004, pp. 326, 554] There is therefore a “historical discussion about how the move to Defcon 3 went during previous crises, Cuba specifically [i.e. the Cuban missile crisis in 1962],” Captain Charles Leidig, who is also in the NMCC, will later recall. With their reference being “a book on the shelf,” according to Leidig, Myers is shown that he has “approval authority to go to Defcon 3.” [9/11 Commission, 4/29/2004 ] After consulting Defense Department directives, Rumsfeld concludes that he has the authority to issue the order to raise the defense readiness condition. [9/11 Commission, 7/24/2004, pp. 554] Therefore, at 10:46 a.m., those on the air threat conference call are told: “Override last instructions. The vice chairman [i.e. Myers] is directing we go to Defcon 3.” A few minutes later, an announcement is made on the conference call, “Emergency action message released at 14:52 [Zulu time, i.e. 10:52 a.m. Eastern time], re: Defcon 3.” [US Department of Defense, 9/11/2001 ; 9/11 Commission, 2004]
Raising Defcon Is a 'Huge Move' - Rumsfeld will later agree with an interviewer that raising the defense readiness condition is “a very serious step for the nation.” [US Department of Defense, 8/12/2002] It was last raised to Defcon 3 during the 1973 Arab-Israeli war, when Rumsfeld had been the United States ambassador to NATO. Regarding the decision to raise it, Myers tells Rumsfeld, “It’s a huge move, but it’s appropriate.” [US Department of Defense, 1/9/2002; Wall Street Journal, 3/22/2004 ; Rumsfeld, 2011, pp. 338]
President Later Told of Decision - The decision to go to Defcon 3 will soon be communicated within NORAD (see 11:03 a.m.-11:12 a.m. September11, 2001). [9/11 Commission, 6/17/2003; 9/11 Commission, 2004; 9/11 Commission, 2/3/2004 ] Rumsfeld will brief President Bush on the decision (see (11:15 a.m.) September 11, 2001). [9/11 Commission, 7/24/2004, pp. 554; Bush, 2010, pp. 133] Apparently around the time the defense readiness condition is raised, Rumsfeld and/or Myers also decide to raise the force protection condition of US military installations (see (Between 10:10 a.m. and 10:35 a.m.) September 11, 2001). [US Department of Defense, 9/11/2001 ; 9/11 Commission, 3/23/2004; Myers, 2009, pp. 153]
Defcon 3 Intended for Cold War - Some individuals will later be critical of the decision to raise the defense readiness condition at this time. John Farmer, the senior counsel to the 9/11 Commission, will write that Defcon 3 is in fact “a Cold War-era designation, devised to respond to a nuclear threat.” [Farmer, 2009, pp. 235] According to Farmer and other 9/11 Commission staffers, it is “suited more to a Cold War conflict than to al-Qaeda’s attack.” [Rutgers Law Review, 9/7/2011 ] General Ralph Eberhart, the commander of NORAD, will similarly say that Defcon 3 is “not intended for [events like] the attacks of 9/11 and thus could have complicated the response to the attacks.” He will say he does not think that raising the condition would have “done anything for us” within the continental United States. [9/11 Commission, 3/1/2004, 3/1/2004 ]
Defcons Are Phased Increases in Combat Readiness - The defense readiness condition is a “uniform system of progressive alert postures for use between the chairman of the Joint Chiefs of Staff and the commanders of unified and specified commands, and for use by the [armed] services,” according to the Department of Defense. [US Department of Defense, 11/8/2011 ] Defcons are phased increases in combat readiness and are graduated to match situations of varying military severity. They are numbered, from Defcon 5, which means “normal peacetime readiness,” down to Defcon 1, which means “maximum force readiness.” The current level, Defcon 3, represents an “increase in force readiness above normal readiness.” [Federation of American Scientists, 4/29/1998] The defense readiness condition will remain at Defcon 3 until three days later, when it will be reduced one notch, to Defcon 4 (see September 14, 2001). [Washington Post, 1/30/2002]
At the NORAD operations center in Cheyenne Mountain, Colorado, NORAD commander in chief, General Ralph Eberhart, orders a limited version of a little known plan to clear the skies and give the military control over US airspace. [Aviation Week and Space Technology, 6/3/2002; 9/11 Commission, 6/17/2004] The plan, Security Control of Air Traffic and Navigation Aids (SCATANA), was developed in the 1960s as a way to clear airspace above the US and off the US coast in the event of a confirmed warning of a nuclear attack by the Soviet Union. Once it is activated a wartime air traffic priority list is established, allowing essential aircraft and personnel to use the airspace. Among others, this list includes the US president, essential national security staff, aircraft involved in continental defense missions, and airborne command posts. [Schwartz, 1998]
Eberhart Suggests Limited Version of Plan - Eberhart and his staff suggest implementing the limited version of SCATANA over the air threat conference call. Transportation Secretary Norman Mineta immediately concurs. [Aviation Week and Space Technology, 6/3/2002; Filson, 2003, pp. 73] Unlike a full SCATANA, this modified version allows ground navigation aids to stay on, for the benefit of aircraft that are still airborne. Under the plan, for about the next three days all flights other than military, law enforcement, fire fighters, and medevac, will require approval from the national Defense Department/FAA Air Traffic Services Cell, located within the FAA’s Herndon Command Center. [Bulletin of the Atomic Scientists, 11/2001; Aviation Week and Space Technology, 6/10/2002; 9/11 Commission, 6/17/2004] Notice is sent out to all civil and military air traffic control facilities, informing them that the skies now officially belong to NORAD. [Spencer, 2008, pp. 269]
Order Supposedly Made Late Due to Safety Concerns - The SCATANA order is issued over an hour after the FAA ordered all planes down (see (9:45 a.m.) September 11, 2001), and after at least three-quarters of them have already landed. [USA Today, 8/13/2002] Eberhart will later say the delay is due to safety concerns, because NORAD would have been unable to control US airspace—with over 4,000 planes airborne at the time of the attacks—with its radar capabilities. [9/11 Commission, 6/17/2004] Defense Week magazine will suggest SCATANA is not implemented until even later, at around 2:00 p.m. It says NORAD issues a “notice to airmen” implementing the modified version of SCATANA about five hours after Flight 11 hit the World Trade Center. [Bulletin of the Atomic Scientists, 11/2001]
The North Portal entrance to the Cheyenne Mountain Complex in Colorado. [Source: NORAD]The message goes out within NORAD that the military’s defense readiness condition has been raised to Defcon 3. [9/11 Commission, 6/17/2003; 9/11 Commission, 2004] Secretary of Defense Donald Rumsfeld directed that the defense readiness condition be raised from Defcon 5—the lowest level—to Defcon 3 at around 10:45 a.m. (see (10:43 a.m.-10:52 a.m.) September 11, 2001). [9/11 Commission, 7/24/2004, pp. 326, 554; Goldberg et al., 2007, pp. 131] At 10:52 a.m., an emergency action message about the increased defense readiness condition was issued. [US Department of Defense, 9/11/2001 ; 9/11 Commission, 2004]
NORAD Personnel Learn of Defcon Change - Word of the change is then communicated within NORAD. At 11:03 a.m., NORAD’s Northeast Air Defense Sector (NEADS) is ordered to Defcon 3. Four minutes later, at 11:07 a.m., Lieutenant Colonel Steve Usher, the director of combat operations at the headquarters of the Continental United States NORAD Region (CONR) in Florida, announces that Defcon 3 has been ordered. [9/11 Commission, 6/17/2003] And a military log will state that “NORAD has directed Defcon change” at 11:12 a.m. [9/11 Commission, 2004] Staff Sergeant Brent Lanier, an emergency action controller in NORAD’s Cheyenne Mountain Operations Center (CMOC) in Colorado, is tasked with sending out a message about the change to the defense readiness condition. He will later recall: “I’d sent out false Defcon messages during exercises, but I never thought I’d have to send out an actual Defcon change message—but I did. It was frightening.” [Airman, 3/2002]
NORAD Officers Discuss Defcon Change - Major General Larry Arnold, the CONR commander, will tell the 9/11 Commission that he hears of the change to the defense readiness condition either from Major General Rick Findley, the director of operations at the CMOC, or from one of NORAD’s computer chat logs. [9/11 Commission, 2/3/2004 ] Usher will tell the 9/11 Commission that the instruction to raise the defense readiness condition comes either from the CONR Regional Air Operations Center or from Arnold. He will add that there is an emergency action message confirming the transition. [9/11 Commission, 2/4/2004 ] Arnold will recall that, at some unspecified time, he calls General Ralph Eberhart, the commander of NORAD, about the change to the defense readiness condition, with the intention of informing Eberhart “of what was ongoing.” [9/11 Commission, 2/3/2004 ]
Change in Defcon Affects Who Can Declare a Target Hostile - Steve Hedrick, an air weapons officer at NEADS, will tell the 9/11 Commission that “any change in Defcon is authenticated immediately” with the fighter jets under NORAD control. He will also say that “the main change when a Defcon level changes is in who has the authority to declare a target hostile.” Hedrick will note that the order from Vice President Dick Cheney, that NORAD fighters were “cleared… to intercept tracks of interest and shoot them down if they do not respond” (see 10:31 a.m. September 11, 2001), is “distinct and different from the transition in Defcon levels.” [9/11 Commission, 10/27/2003 ; 9/11 Commission, 7/24/2004, pp. 42]
Technical Sergeant James Tollack, an officer from McGuire Air Force Base in New Jersey, is tasked with transcribing tape recordings from September 11 of the operations floor at NORAD’s Northeast Air Defense Sector (NEADS) in Rome, New York. [9/11 Commission, 3/22/2004; 9/11 Commission, 7/29/2004; Farmer, 2009, pp. 274] On September 11, NEADS was responsible for coordinating the US military’s response to the hijackings. In a corner of its operations floor, four Dictaphone multi-channel tape recorders were recording every radio channel. [Vanity Fair, 8/1/2006; Shenon, 2008, pp. 203-204] Tollack will later say that NEADS Technical Sergeant Jeremy Powell maybe tells him that personnel at NEADS have already listened to the tapes prior to his arrival there.
Digital Recording Expert Spends Two Weeks Working on Transcripts - Tollack is the resident expert in digital voice recording systems at McGuire Air Force Base and also has experience of doing transcription work. He arrives at NEADS on September 20 and stays there for 11 to 14 days, leaving on either October 1 or October 4. His first day at NEADS is spent on orientation, and so September 21 is his first full day of transcribing. Tollack will later recall that Colonel Robert Marr, the battle commander at NEADS, probably advises him to only transcribe the tapes from September 11 up to around 10:15 a.m., which is about 10 minutes after the fourth hijacked plane, Flight 93, crashed in Pennsylvania. For his first few days at NEADS, Tollack spends 14 to 16 hours per day working on the task. He works at a desk on the operations floor, drafting notes by hand and then typing them out with the assistance of two secretaries.
Transcripts Needed for Investigations - Tollack works directly for Marr, and also reports to Lieutenant Colonel Dawne Deskins, the assistant director of the Sector Operations Control Center. Marr tells Tollack that the transcripts of the tapes are required for investigation purposes. General Ralph Eberhart, the commander of NORAD, tells Tollack the information is needed for a Congressional report or hearing (see (Between September 23 and September 24, 2001)).
Tollack's Work Not Reviewed - While Tollack is at NEADS, no one there reviews his work as he goes through the tapes. [9/11 Commission, 3/22/2004] On September 21, one of the tapes is damaged during the transcription process, causing information on it to be lost (see September 21, 2001). [North American Aerospace Defense Command, 9/21/2001]
9/11 Commission Not Initially Made Aware of NEADS Tapes - During its investigation of the September 11 attacks, the 9/11 Commission will only learn of the existence of the recordings of the NEADS operations floor in late October 2003 (see Late October 2003), and it subsequently subpoenas NORAD for the tapes (see November 6, 2003). Despite the efforts of Tollack, according to journalist and author Philip Shenon, by the time the Commission receives the tapes, around December 2003, NORAD has still “not prepared transcripts itself” of the tapes’ contents. [Kean and Hamilton, 2006, pp. 86-88; Shenon, 2008, pp. 203-208]
General Ralph Eberhart, the commander of NORAD, visits NORAD’s Northeast Air Defense Sector (NEADS) in Rome, New York, and emphasizes to an officer there the importance of promptly transcribing the recordings of the NEADS operations floor from September 11. Technical Sergeant James Tollack, the resident expert in digital voice recording systems at McGuire Air Force Base, New Jersey, arrived at NEADS on September 20, in order to transcribe the facility’s tape recordings from September 11 (see (September 20-October 4, 2001)). Three or four days later, Eberhart comes to NEADS and sees Tollack personally. Eberhart stresses to Tollack the importance of getting the information from the tapes as quickly and as accurately as possible. He says the information is needed for a Congressional report or hearing. [9/11 Commission, 3/22/2004; 9/11 Commission, 7/29/2004] Presumably Eberhart is referring to his appearance before the Senate Armed Services Committee on October 25, in which he will put forward the military’s account of what happened on September 11. [US Congress. Senate. Armed Services Committee, 10/25/2001; Farmer, 2009, pp. 248] When the 9/11 Commission interviews Tollack during its investigation of the terrorist attacks and asks him what order of priority his task of transcribing the tapes had been given, he will indicate that he knew it was a high-priority assignment when he was visited by Eberhart. [Farmer, 2009, pp. 274]
For a few tense minutes, an unidentified plane flying inside Washington’s no-fly zone comes close to being shot down by the military. The plane, a Beechcraft King Air, is carrying Governor Ernie Fletcher (R-KY), who is coming to attend the funeral of former president Ronald Reagan. The plane’s transponder is broken, but the pilot notified the Federal Aviation Administration (FAA) of the problem earlier in the flight. However, the FAA failed to inform the military, which was therefore unable to identify the plane. In addition to the lack of transponder identification, the plane is flying deep inside the no-fly zone around the White House. The Capitol is evacuated at around 4:30 p.m., when thousands are awaiting the arrival of President Reagan’s coffin. An F-16 is scrambled to identify the plane but is unable to do so because of cloud cover. NORAD’s commander, General Ralph Eberhart, is asked if the plane should be shot down. Fortunately, the pilot turns toward National Airport at this time, ending the crisis. [Courier-Journal (Louisville, KY), 7/4/2004; USA Today, 7/4/2004; Washington Post, 7/8/2004] A new mobile radar command post, called the Joint-Based Expeditionary Connectivity Center (JBECC), which merges civil and military radar data and which was deployed in the Washington area immediately after 9/11 (see September 12, 2001), is used by the military to identify the plane and avoid a shoot-down. [Associated Press, 11/29/2004]
Receive weekly email updates summarizing what contributors have added to the History Commons database
Developing and maintaining this site is very labor intensive. If you find it useful, please give us a hand and donate what you can.
If you would like to help us with this effort, please contact us. We need help with programming (Java, JDO, mysql, and xml), design, networking, and publicity. If you want to contribute information to this site, click the register link at the top of the page, and start contributing.