9/11 Commission August 2004 Staff report

This article has been assessed as havingUnknown importance.

Good scope?N Timeline?N wikified?N red links < 10?N all red links fixed?N referenced?N Illustrated?N Googled and added info? N Checked 9/11 records archives? N Checked Wikinews? N Checked Wikisource? N

PART I: THE FOUR FLIGHTS

(Note to reader: All times indicated are Eastern Daylight Time unless otherwise specified).

1.1 AMERICAN AIRLINES FLIGHT 11

This article has been assessed as havingUnknown importance.

Good scope?N Timeline?N wikified?N red links < 10?N all red links fixed?N referenced?N Illustrated?N Googled and added info? N Checked 9/11 records archives? N Checked Wikinews? N Checked Wikisource? N

Colgan Air Flight 5930

The Flight 11 story begins on the morning of September 11, 2001, in Portland, Maine ,

aboard Colgan Air Flight 5930 headed for Logan International Airport.

Two of the Flight 11 hijackers, Mohamed Atta and Abdul Aziz al Omari, were aboard the flight on

their way to Boston.

Hijacker Arrival at the Airport and Check-in

At 5:40 A.M. on September 11, 2001, a car rented by Mohamed Atta in Boston on September 9 entered the Portland International Jetport parking facility.

5:43 A.M. Atta and Omari checked in at the US Airways counter at the Portland Jetport. Atta checked two bags, Omari none. The agent who checked in the two hijackers recalled that when he handed Atta his boarding pass, Atta asked why he was not given a boarding pass for his connecting flight on American Airlines from Boston to Los Angeles. The agent explained to Atta that he would have to check in with American Airlines in Boston to obtain the boarding pass for the second leg of his itinerary. The agent remembered that Atta clenched his jaw and looked as though he was about to get angry. Atta stated that he was assured he would have "one-step check-in." The agent told them that they had better get going if they were to make their flight He said that Atta looked as if he were about to say something in anger but turned to leave. Both Atta and Omari departed for the security checkpoint.

Hijacker Prescreening Selectee Status

When he checked in at the Portland airport, Atta

was randomly selected for additional security scrutiny by the Computer Assisted

Passenger Prescreening System (CAPPS). The Federal Aviation Administration (FAA),

required air carriers to apply the system to their passengers to identify those who might

be a security risk. FAA rules required that the checked bags of CAPPS selectees be

screened for explosives, or their bags held off the airplane until the passenger boarded.6

Because US Airways at Portland Jetport did not have explosives detection screening

equipment for checked bags at that time, Atta's luggage was subject to the matching

procedure.7 The application of this procedure was designed to stop a nonsuicide

bomber-one who might place a bomb in a bag and then leave the airport. At this time,

Page 2

the FAA believed that such bombers were among the greatest threats to civil aviation

security.

Checkpoint Security Screening

At 5:45 A.M., Atta and Omari arrived at the sole security checkpoint at the Portland International Jetport.8 This checkpoint was under the custodial responsibility of Delta Airlines, which contracted for security screening services with Globe Aviation Services. The checkpoint had two lanes, each outfitted with a walk-through metal detector and X-ray equipment to help detect weapons.9 The checkpoint videotape was seized as evidence by the FBI and reviewed by the Commission. 10 The videotape showed that Atta and Omari entered the walk through metal detector at 5:45:03 A.M. A screener was stationed at the device to monitor the screening. Though not conclusive, the video suggests that neither of the subjects set off the metal detector. Both Atta and Omari proceeded from the magnetometer immediately to the X-ray belt. Atta picked up a black shoulder bag. Omari claimed a similar bag, and also a smaller black case that he held in both hands. The item cannot be identified but resembled a camera or camcorder case. Neither of the bags was physically examined by a screener, a step that is required if the X-ray monitor displays a suspicious item. Both of the subjects passed out of view of the video camera at 5:45:15 A.M.

Hijacker Boarding

Seating aboard the Colgan flight was open rather than assigned.1

Eight passengers boarded the flight, including Atta and Omari. 12 The flight crew included

a pilot and a first officer who also served as the flight attendant. Atta and Omari were the

last to board the aircraft and sat in the last row of the plane-row 9.13

The Flight

Colgan Air Flight 5930 was a Beechcraft 1900-a 19-seat regional airliner.

It departed from Gate 11 on time at 6:00 A.M., arriving at Gate B9 (A) at Boston Logan

International Airport at approximately 6:45 A.M., one hour before the scheduled departure

of Flight 11.14

Purpose of the Flight

No physical, documentary, or analytical evidence found either by

the Commission or by law enforcement agencies provides a clear reason why Atta and

Omari drove to Portland from Boston on the morning of September 10 only to return to

Logan International Airport on Flight 5930 on the morning of September 11.15

The most plausible theory is that the hijackers chose to fly into Boston to avoid suspicion

that might have been aroused if they had arrived at Logan at approximately the same time

as eight other young Middle Eastern males to check in for Flight 11 and Flight 175. Such

an intent might also explain why Atta appeared to be so upset that he had to check in

again in Boston to get a boarding pass for Flight 11.

-SUBJEC TO CLASSIFICATION MViEW3 3

S-UBJECT ITO-CL-ASS4-ICATI ON- 'EV4PWIt

is also possible that they traveled to Portland to preserve operational security. If the

hijackers' plot had been discovered by U.S. intelligence or law enforcement, or by the

U.S. aviation security system, the two terrorists would be apprehended during their

check-in at the Portland airport. That outcome would have been preferable to being

stopped at Logan Airport, where other members of Atta's hijack team were also checking

in, and where conspirators intending to hijack Flight 175 were assembling at the same

time. 16

Telephone records show that a phone call was placed from a pay phone in the gate area

from which Flight 175 departed to Atta's cell phone at 6:52 A.M. This call strongly

suggests that the two hijacking teams engaged in tactical communications, such as

situational reporting and possible "go" or "no go" determinations, at the last moment.

The Massport Aviation Director told the Commission that Portland was the nearest

airport to Boston with a flight that would have arrived at Logan in time for the passengers

to transfer to Flight 11.18

We also considered the possibility that Atta, the leader of the 9/11 hijackers, might have

believed that he and Omari were more likely to successfully pass through checkpoint

screening at a smaller airport, carrying items such as Mace or pepper spray, than they

were at Logan Airport.

However, two considerations would have made this a faulty assumption. First, public

sources would not have supported the notion that smaller airports had more porous

checkpoints. For instance, in the winter and spring of 2001, a Fox news special

investigation publicly described serious shortcomings in the detection capabilities at

Logan Airport's security screening checkpoints, including the ease with which knives

could be carried through checkpoints. 19 Second, Atta and Omari were required to go

through another security checkpoint when they arrived at Logan in order to enter the

terminal from which Flight 11 departed.

We believe that Atta's apparent anger about not receiving his boarding pass for Flight 11

when he checked in for Flight 5930 is a strong indication that he hoped to enter the

system and obtain his final boarding pass along with Omari at Portland, separately from

the other hijackers The hijackers checked-in and went through the checkpoints (at least

in the case of the Flight 77 hijackers who were videotaped), in pairs or by themselves.

This provides additional evidence that the hijackers did not want to make themselves

conspicuous by congregating.

American Airlines Flight 11

Hijackers. Mohamed Atta (pilot); Abdul Aziz al Omari; Waleed al Shehri; Wail al

Shehri; Satam al Suqami.

Hijacker Weapon Purchases. Atta purchased two Victorinox Swiss Army knives at the

Zurich Airport on July 8, 2001, and a Leatherman multi-tool in Boynton Beach, Florida,

on August 30, 2001. 2

-JuECATOCASSfFtCATION REVIEW 4

-SUECT TO C A SSIFICATION JrVIW

Hijacker Arrival at Airport and Check-in. At 6:45 A.M., Atta and Omari arrived at

Boston Logan airport, Terminal B, Gate B9A. Atta and Omari still had their carry-on

shoulder bags. Atta's two checked bags were unloaded from the Colgan Air flight. The

luggage tags indicated that they should be transferred to American Airlines Flight 11

from Boston to Los Angeles International Airport. FAA security rules did not require

additional screening or special security handling of Atta's luggage.

After exiting the aircraft, Atta and Omari crossed a parking lot that separated their arrival

and departure terminals. They were observed asking for directions.21

Also at 6:45 A.M., Wail al Shehri, Waleed al Shehri, and Satam al Suqami arrived at

Logan Airport and parked their rental car at the airport's central parking facility.22

Hijacker Prescreening. According to ticket records, Wail al Shehri, Waleed al Shehri,

and Satam al Suqami were selected by CAPPS. 23 Waleed al Shehri did not check a bag.

The others checked in one each.2 4 Their checked luggage was screened by an explosives

detection system and loaded aboard the aircraft. 25 Under FAA security rules in effect at

the time, the hijackers' designation as "selectees" did not require that they undergo any

screening of their person or carry-on bags beyond what was required of passengers not

selected by CAPPS.2 6

Checkpoint Security Screening. Because the airport's security checkpoints and gate

area were not monitored by video surveillance equipment at that time, no conclusive

evidence exists regarding when and how the Flight 11 hijackers passed through

checkpoint screening. To reach their departure gate after checking in, all five hijackers

would have been required to pass through one of two checkpoints, both of which were

operated by Globe Aviation Services under a contract with American Airlines. 2 7 The

smaller checkpoint opened at 7:15 A.M. and was used mainly for overflow traffic from the

other. We believe it most likely that the hijackers would have chosen to pass through the

busier checkpoint in the hopes of being less conspicuous.

At the checkpoint, each of the individual's carry-on belongings would have been

screened by an X-ray machine. The purpose of this screening was to identify and

confiscate weapons and other items prohibited from being carried onto a commercial

flight.2 8 Also, the passenger would pass through a walk-through metal detector calibrated

at that time to detect items with at least the metal content of a small-caliber handgun. If

any one of the hijackers triggered the walk-through magnetometer, he would have been

screened with a handheld metal detector-a procedure requiring the screener to identify

the item or items that caused the alarm. Any items found that were prohibited or

restricted under the checkpoint operating rules and guidelines would not be allowed past

the checkpoint. The checkpoint supervisors did not recall the hijackers or report anything

suspicious regarding their screening.29

6:52 A.M. Atta received a phone call from a pay phone in Terminal C at Logan

International Airport-the terminal from which Flight 175 was due to depart.3 0

tUBJECT TO CLA-SIFI_ CATION EV 5

SUREe~:FA&SJ-b~rrALL OTNRB rL1BWx

Hijacker Boarding. At approximately 7:31 A.M., Wail al Shehri and Waleed al Shehri

boarded. Atta and Omari followed at approximately 7:39 A.M. Suqami boarded a minute

later.3 1

Flight Profile. Flight 11 provided daily, nonstop service from Boston's Logan

International Airport (BOS) to Los Angeles International Airport (LAX). On September

11, it was scheduled for a 7:45 A.M. departure. 32 The aircraft was a Boeing 767, tail

number N334AA. 33

Captain John Ogonowski and First Officer Thomas McGuinness piloted the plane. It

carried its full capacity of nine flight attendants:

• Karen Martin (Position 1), assigned to the forward left jumpseat (1L), located

between the first-class cabin and the cockpit entrance;

• Kathleen Nicosia (Position 2), assigned to the left aft jimpseat (3L) at the back of

the aircraft;

• Betty Ong (Position 3), assigned to the right aft jumpseat (3R) at the back of the

aircraft behind the coach section;

• Dianne Snyder (Position 4), assigned to the mid-galley jumpseat (2R);

• Barbara "Bobbi" Arestegui (Position 5), assigned to the forward right jumpseat

(1R Center), which was in the forward galley between the cockpit and the firstclass

cabin;

• Jeffrey Collman (Position 6), assigned to the middle left jumpseat (2L) located in

the middle galley within the main cabin;

• Sara Low (Position 7), assigned to the middle right jumpseat (2R) in the middle

galley within the main cabin;

• Jean Roger (Position 8), assigned to the forward left jumpseat (1L Center) in the

forward galley; and

• Madeline "Amy" Sweeney (Position 9), assigned to the left aftjumpseat (3L) at

the back of the aircraft behind the coach section.3 4

The aircraft had a capacity of 158 passengers: 9 seats in first class, 30 in business class,

and 119 in coach.35 On September 11, the flight carried 81 passengers (including the 5

terrorists) with 2 pilots and 9 flight attendants, for a total of 92 people on board.

All 9 of the first-class seats were occupied, 2 of them by hijackers Waleed al Shehri (2B)

and Wail al Shehri (2A). Nineteen of the 30 seats in business class were occupied (49

percent), 3 by hijackers Atta (8D), Omari (8G), and Suqami (10B).36 Fifty-three of the

119 coach seats were occupied (44 percent), none of them by hijackers.

The percentage of seats occupied on the aircraft-also known as the "load factor"-on

September 11, 2001, was 51 percent, compared to an average load factor for Flight 11 of

almost 39 percent on Tuesdays over the three months preceding 9/11.37 Thus, the load

OI~rrc-rr-c)T_SA-Sf~f~w~ 6

UcO-GbA&S1n r ~ICnr aTfONREVIEW~

factor on this flight was somewhat above the norm. The Commission found no ticketing,

passenger occupancy, or financial evidence to indicate that the hijackers purchased

additional seats beyond the ones they actually used in order to limit the number of

passengers they would need to control during the operation. 38

As noted above, all of the hijackers were accounted for in checking in and boarding the

flight. American's records do not reflect the use of a cockpit jump seat by anyone other

than the Flight 11 pilot and first officer. 39

Under American Airline's policy in effect on 9/11, every crew member, including each of

the flight attendants, had a key to the cockpit. The airline's Flight Standards Manual

instructed the crews to guard their keys carefully. 40 Rules implemented in the 1960s

required that air crews keep the cockpit door closed and locked during flight, 41 though the

requirement was not always observed by flight crews or enforced by the FAA.

The American Airlines dispatcher in charge of Flight 11 said that all aspects of preflight

preparation were routine. She reported having no preflight communications with the pilot

or aircraft because no problems or issues in need of resolution arose.42

Flight 11 was loaded with 76,400 pounds of fuel, above the average fuel load of 70,000

pounds.4 3

The Flight. At 7:40 A.M., Flight 11 pushed back from Gate 32 and taxied to its departure

runway. It took off at 7:59 A.M. 44

Shortly before 8:14 A.M., Flight 11 reached an altitude of 26,000 feet, just shy of its

initial cruising altitude of 29,000 feet. Up to this point, all communications and the

flight's appearance to air traffic controllers were normal.45 While cabin service generally

did not start until after the cruising altitude was reached, some pilots under the proper

circumstances would turn off the "Fasten Seatbelt" signs earlier, thereby permitting the

flight attendants to begin cabin service. It is not known if such a head start was allowed

on this flight, but it is ver, likely that flight attendants would at least have begun

preparations for service.

FAA air traffic controller Peter Zalewski, stationed at the Boston Air Route Traffic

Control Center (Boston Center) radioed directional instructions: "American 11 turn

twenty degrees right." Flight 11 replied: "twenty right American 11." This was the last

routine communication received from the flight. Seconds later, air traffic control radioed

Flight 11 again, this time instructing the aircraft to climb to 35,000 feet. The flight did

not respond. Over the next ten minutes, air traffic control tried nine times to contact the

flight. All attempts were unsuccessful. 47

SUBJECT TO CLASSIIIFCAt ONREVEWF

N

7

ClSUBJ Tl CLX.,"LAkIOL¥ViEW

According to the flight attendant's assigned seats, Karen Martin was in the first-class

cabin and Bobbi Arestegui in the first-class galley, or kitchen. Sara Low and Jean Roger

would have been serving business-class passengers, with Dianne Snyder in the midgalley.

Betty Ong and Amy Sweeney would have been working in coach, with Karen

Nicosia in the rear galley. Jeffrey Collman would have been assigned to work in coach,

or to assist in first class if needed.48

The Hijacking. At around 8:14 A.M. or shortly thereafter,4 9 the hijackers began their

takeover of the aircraft. Information supplied by eyewitness accounts indicates that the

hijackers initiated and sustained their command of the aircraft using knives (as reported

by two flight attendants); violence, including stabbing and slashing (as reported by two

flight attendants); the threat of violence (as indicated by a hijacker in radio transmissions

received by air traffic control); Mace (reported by one flight attendant); the threat of a

bomb, either fake or real (reported by one flight attendant); and deception about their

intentions (as indicated by a hijacker in a radio transmission received by air traffic

control).

8:19 A.M.50 Flight attendant Betty Ong contacted the American Airlines Southeastern

Reservations Office in Cary, North Carolina, via AT&T air phone to report an emergency

aboard the flight. Flight attendants know the reservations 800 number because they call it

frequently to help passengers with reservations questions. Calls to the number are routed

to the first open line at one of several facilities, including the one in Cary. 51

The emergency call from Betty Ong lasted approximately 25 minutes (8:19 A.M.-8:44

A.M.). Ong relayed vital information about events taking place aboard the airplane to

authorities on the ground. Her call was received initially at the reservations office by an

American Airlines employee. The call was transferred to another employee who,

realizing the urgency of the situation, pushed an emergency button that simultaneously

initiated a tape recording of the call and sent an alarm notifying Nydia Gonzalez, the

reservations office supervisor, to pick up on the line. Gonzalez was paged to respond to

the alarm and joined the call a short time later. Only the first four minutes of the phone

call between Ong and the reservations center was tape-recorded because the recently

installed recording system at that time contained a default time limit. 2

8:19 A.M. Ong reported, "The cockpit is not answering, somebody's stabbed in business

class-and I think there's mace-that we can't breathe-I don't know, I think we're

getting hijacked." 53

While the reported "stabbing" in business class may have been an attack on the flight

attendants, or on an unnamed victim, this may quite possibly have been the initial report

of the attack (recounted with more specificity later) on a passenger in business class,

seated in 9B-directly behind Atta and Omari, and in front of Suqami. The passenger

was a 31-year-old man who had served four years as an officer in the Israeli military.54

S'UBJEf.,i iu CLASSIfICA HON REVIEW 88

SUBJECT TOCLASSIFICATION -REVIEW

8:20 A.M. Ong reported that two flight attendants had been stabbed.55

As noted above, American Airlines flight attendants all carried cockpit keys on their

person. Although no information was provided from the flight about exactly how the

hijackers gained access to the cockpit, it is possible the stabbings of the flight attendants

could have been for the purpose of acquiring a key, of forcing one of them to open the

cockpit door, or of luring the captain or first officer out of the cockpit.

Also at 8:20 A.M., the American Airlines dispatcher at the airline's operations center in

Texas who was responsible for transatlantic flights received a communication from an

American Airlines flight traveling from Seattle to Boston that air traffic control had asked

the aircraft to try to contact Flight 11. This was the first indication she had of any

problem on the flight.56

8:21 A.M. The transponder on Flight 11 was switched off, making it more difficult for

FAA air traffic control centers to identify the flight and monitor its flight path.57

Also at 8:21 A.M., Gonzalez joined the call from Ong. Realizing the seriousness of the

situation, she used another phone line to contact Craig Marquis, manager on duty, at the

American Airlines System Operations Control (SOC) in Fort Worth, Texas, and informed

the airline's headquarters that there was a problem aboard Flight 11. Gonzalez's

emergency call to the SOC was recorded at the airline's headquarters. Gonzalez notified

Marquis that Flight 11 was reporting an emergency, that stabbings had taken place, and

that the flight attendants could not reach the cockpit.

After confirming Gonzalez's identity and position, at 8:22 A.M. Marquis acknowledged

the emergency and indicated to Gonzalez that he would "get ATC [air traffic control] on

here." At this same time, while Marquis was relating this information to Gonzalez, Ong

reported to Gonzalez's colleague: "I think the guys [hijackers] are up there. They might

have gone there, jammed their way up there, or something. Nobody can call the cockpit.

We can't even get inside." Thirty seconds after contacting American Airlines'

headquarters, Gonzalez rejoined the call from Ong. 58

Also at 8:22 A.M., flight attendant Madeline "Amy" Sweeney tried to contact the

American Airlines flight services office at Logan International Airport by air phone. The

office she was attempting to call managed the scheduling and operation of flight

attendants, and its phone number was well known to the American flight attendants

operating out of Boston.59 Sweeney's initial attempt to get through to the office failed.6

8:23 A.M. The American Airlines flight dispatcher sent an Aircraft Communications and

Reporting System (ACARS) text message to Flight 11: "Good Morning. . .ATC looking

for you on [radio frequency] 135.32."61 ACARS is an email system that enables those in

the cockpit of an in-flight aircraft and company personnel on the ground to rapidly

communicate with one another. The dispatcher received no response to his message.

Page 9

Also at 8:23 A.M., the tape recording of the call between Ong and the reservations center

ceased because of the default time limit on the system. However, Gonzalez remained on

the line with Ong for the next 21 minutes. Gonzalez continued to report the information

she received from the flight attendant to the American Airlines SOC. The call between

American's reservations facility and the SOC continued to be taped by the SOC until its

conclusion. 6 2

8:24 A.M. Ong told Gonzalez that the hijackers were in the cockpit.63 Sweeney attempted

another call to the flight services office. It also failed. 64

Shortly before 8:25 A.M., air traffic controller Zalewski heard two clicks over the

frequency assigned to the flight, and radioed in response, "Is that American eleven trying

to call?" Five seconds later, a voice with a foreign accent addressed the passengers. "We

have some planes. Just stay quiet and you'll be okay. We're returning to the airport." 65

Because the wrong button was pushed, this message was heard not by the passengers but

by air traffic control. The controller did not comprehend the first sentence ("planes"); it

was understood 30 minutes later after a facility manager was able to locate and replay the

tape. (See 9:03 A.M. entry below.)

Seconds later, Boston Center heard the following transmission from the same foreign

voice: "Nobody move. Everything will be okay. If you try to make any moves, you'll

endanger yourself and the airplane. Just stay quiet." 66 According to Ong's simultaneous

reporting, no announcements had been made from the cockpit to the passengers. This

suggests that the hijackers' announcements were not heard in the cabin, and that they did

not know how to operate the radio properly.

8:25 A.M. After hearing the second transmission from the aircraft, controllers at Boston

Center believed that Flight 11 had been hijacked.67

Also at 8:25 A.M., an American Airlines air traffic control (ATC) specialist at the SOC

sent another ACARS message to Flight 11: "Plz contact Boston Center ASAP.. .They

have lost radio contact and your transponder signal." Again, the aircraft did not respond

to this or subsequent ACARS messages attempting to reestablish contact with the

cockpit.68

At the same time, Sweeney's third call to the American Airlines Flight Services Office at

Boston finally was connected to an American Airlines' employee. Sweeney told her that

someone was hurt aboard Flight 12, and then the phone call was cut off. The recipient of

the call passed the information to Michael Woodward, the flight service manager.

Woodward went to American's gate area at Logan with a colleague. The supervisor noted

that the morning flights had all departed Boston and the gate area was quiet. He further

realized that Flight 12 was a flight to Boston from the West Coast that had not even left

yet, so he and his colleague returned to the office to try to clarify the nature of the

emergency call. 69

Page 10

Between 8:25 A.M. and 8:32 A.M., in accordance with the FAA managers protocol, Boston Center started notifying their chain of command that Flight 11 had been hijacked.7

8:26 A.M. Ong reported to Gonzalez that the plane was "flying erratically." Gonzalez passed this information to the SOC.7 '

8:28 A.M., Boston Center called the FAA Air Traffic Control Svstem CnmmrnA ro,ntd TT - ' AA '..-...LL r , L f. nerndon, Virginia (Herdon Command Center) to advise management that it believed Flight 11 had been hijacked and was heading toward New York Center's airspace. By this point in time, Flight 11 had taken a dramatic turn to the south. Command Center immediately established a teleconference between Boston, New York and Cleveland Centers to allow Boston Center to provide situational awareness to the centers that adjoined Boston in the event the rogue aircraft entered their airspace. 2

8:29 A.M. An air traffic control specialist at the American Airlines' SOC contacted Boston Center to ask about the status of Flight 11.

8:31 A.M. A controller at Boston Center told the American Airlines air traffic control specialist that the last known altitude of the aircraft was below 29,000 feet and that "He [Flight 1 1] was heading west. But right now he's pointed southwest of Albany." The controller also said the transponder had been lost and that "the controller heard a threat in the background, but that's unconfirmed and we're trying to pull the tape at this time." 73

8:32 A.M. The Hemdon Command Center notified the Operations Center at FAA headquarters in Washington, D.C., of the possible hijacking of Flight 11, and was told that FAA security personnel at headquarters had just begun discussing the hijacking on a conference call with the agency's New England regional office.74

Also at 8:32 A.M., 75 the American Airlines flight service manager at Logan, Michael Woodward, returned to his office and discovered that Sweeney had called again and was speaking with an employee in the office. Woodward, who was a friend of Sweeney's, took over the call. Sweeney said that she was sitting in the back of the plane next to Ong, who was still on the phone with Gonzalez.

The phone call between Sweeney and Woodward lasted approximately 12 minutes. It was not taped. According to Woodward, Sweeney was calm and collected. She provided the following information: she was sitting in the back of the aircraft next to Betty Ong; the plane had been hijacked; a man in first class had had his throat slashed; two flight attendants had been stabbed-one flight attendant had been stabbed seriously and was on oxygen while another flight attendant's wounds were not as serious and seemed to be okay; a doctor had been paged; the flight attendants were unable to contact the cockpit; and there was a bomb in the cockpit.

Page 11

Sweeney told Woodward that she and Ong were trying to relay as much information as they could to people on the ground.

Sometime after 8:30 A.M. but before 8:45 A.M., American Airlines Executive Vice President Gerard Arpey made a routine call to the airline's SOC and was informed that personnel there were on the phone with a flight attendant who was reporting violence and a cockpit intrusion on one of the company's flights. He tried unsuccessfully to contact American Airlines' Chairman Don Carty to apprise him of the situation. He immediately went to the SOC and learned that colleagues were setting up the company's System Operations Command Center (SOCC) in order to manage the emergency.

8:33 A.M. The SOC manager on duty, Craig Marquis, received a report from the SOC air traffic control specialist about the specialist's just-completed call to Boston Center. The specialist told him that the aircraft was at "29,000 feet. They've lost Comm[communications] with 'em. Turned off his transponder. Tracking his primary only. Was westbound. Turned southbound. Said the controller heard on the frequency the pilot apparently adjust his mike-lot of loud voices-that sounded threatening-something about return or I'll kill ya or something to that effect-or threatening dialogue."

American headquarters now suspected that Flight 11 had been hijacked.

Also at 8:33 A.M., Gonzalez received a report from Ong providing the first indication of a fatality on board. Gonzalez passed the information on to Marquis at 8:34 A.M. as follows:

"They think they might have a fatality on the flight. One of our passengers, possibly on 9B, Levin or Lewis, might have been fatally stabbed."8 1

8:34 A.M., While FAA headquarters received its initial notification that Flight 11 had been hijacked, the Boston controller received a third transmission from Flightl 1: "Nobody move please. We are going back to the airport. Don't try to make any stupid moves.",,822

Also at 8:34 A.M., in an attempt to get fighter aircraft airborne to track Flight 11, Boston Center's managers decided not to wait for the request for military assistance to be passed up the FAA chain of command, and took the initiative by calling a manager at the FAA Cape Cod facility. They asked the Cape Cod manager to contact Otis Air Force Base in Cape Cod, Massachusetts to get fighters airborne to "tail" the hijacked aircraft. 83

8:35 A.M. Gonzalez confirmed the details of a report by Ong regarding the identity of one of the hijackers: "He's the one that's in the-he's in the cockpit. Okay you said Tom Sukani? Okay-Okay and he was in 10B. Okay, okay, so he's one of the persons that are in the cockpit. And as far as weapons, all they have are just knives?"8

8:36 A.M. Marquis received Gonzalez's report about the hijacker she referred to as "Tom al Sukani" (i.e., Satam al Suqami), who had been seated in 10B.85 He then initiated action to "lockout" American Airlines Flight 11. This procedure is standard for airlines in safety and security incidents. It acknowledges an emergency on the flight and isolates information so that the case can be managed by top leadership at the airlines in a way that

-SUBE(irT *TrO-tASSIFteATION-RFEVfi-W 12

SUBJECT TO CL-A-SSff-IATONREVIEW

protects information from being altered or released, and also protects the identities of the passengers and crew.

8:3 7A.M.- 8:38 A.M., Gonzalez reported to Marquis that the passengers had been moved out of first class and back to coach and that the plane was flying erratically again. American completed its lockout of Flight 11. 86

Also at 8:38 A.M., Gonzalez reported that the plane was in a rapid descent. Marquis asked a fellow employee in the SOC if Flight 11 was descending. The employee replied, "We don't know. The transponder is off so we have no active read on him." 87

8:37:52 A.M. Boston Center called the North American Aerospace Defense Command's (NORAD) Northeast Air Defense Sector (NEADS) and notified NEADS about the suspected hijacking of Flightl 1.88 The United States' military defense of its homeland on 9/11 began with this call. Indeed, this was the first notification received by the military - at any level - that Flight 11 had been hijacked.

The report of the hijack was relayed immediately to Battle Commander Colonel Robert

Marr at NEADS, who was stationed in the Battle Cab in preparation for a scheduled

NORAD exercise. Col. Marr confirmed that the hijacking was "real-world" then ordered

fighter pilots at Otis Air Force Base in Massachusetts to battle-stations.89

Col. Marr then phoned Maj. General Larry Arnold, commanding General of the First Air

Force and the Continental U.S. NORAD Region (CONR) commander. Col. Marr advised

him of the situation, and sought authorization to scramble the Otis fighters in response to

the reported hijacking. General Arnold instructed Col. Marr "to go ahead and scramble

the airplanes and we'd get permission later. And the reason for that is that the

procedure... if you follow the book, is they [law enforcement officials] go to the duty

officer of the national military center, who in turn makes an inquiry to NORAD for the

availability of fighters, who then gets permission from someone representing the

Secretary of Defense. Once that is approved then we scramble an aircraft. We didn't

wait for that." 90 General Arnold then picked up the phone and talked to the operations

deputy at NORAD, who told him 'Yeah, we'll work with the National Military

Command Center (NMCC). Go ahead and scramble the aircraft."' 9 1

At 8:40 A.M., NEADS placed two F-15 alert aircraft at Otis Air Force Base in

Massachusetts, located about 153 miles away from New York City, on battle stations. 92

, ---UBJ-ECT--TO CFA-SSIFICATION -REVIEW 13

SUBJECT TO CLASSIFICATION RE-VIEW

Also at 8:40 AM., information about Flight 11 started to be conveyed within the Air

Traffic Control system. Boston Center, through the Herdon Command Center, provided

a report to New York TRACON on Flight 11.

Also at 8:40 A.M., an American Airlines employee in Boston who was standing next to

Michael Woodward as he talked to Sweeney contacted an employee in American

Airlines' SOC. She reported the content of the ongoing call between Woodward and

Sweeney, including that Sweeney said the hijackers were Middle Eastern men seated in

10B, 9D, and 9G; one spoke very little English and one spoke excellent English; she did

not know how they had gained entry to the cockpit; and the aircraft was in a rapid

descent.9 3

8:41 A.M. Sweeney told Woodward that passengers in coach were under the impression

that there was a routine medical emergency in first class. She said that the other flight

attendants were attending to duties, including getting medical supplies, while she and

Ong reported the events.

Also at 8:41 A.M., Marquis instructed an unidentified colleague in the SOC: "Tell ATC to

handle this as an emergency." The colleague replied, "They have in there it's been

hijacked." The manager responded: "It is. Okay." 95

The colleague then informed Marquis, "They think he's [Flight 11] headed toward

Kennedy. They're moving everybody out of the way. They seem to have him on a

primary radar. They seem to think that he is descending."

8:43 A.M. A Hemdon Command Center air traffic specialist warned Washington en route

center that Flightl1 was a "possible hijack" and would be headed towards Washington

Center's airspace if it continued on a southbound track.

8:44 A.M., Gonzalez reported to Marquis that phone contact with Ong had been

terminated: "We, I think we might have lost her." 97 About this same time, Sweeney

reported to Woodward in Boston, "Something is wrong. We are in a rapid descent... we

are all over the place." Woodward asked Sweeney to look out the window to see if she

could determine where they were. Sweeney told him, "We are flying low. We are flying

very, very low. We are flying way too low." Seconds later she said, "Oh my God we are

way too low" and then the phone call ended.9 8

8:45 A.M. The American Airlines employee listening to the call between Woodward and

Sweeney reported to the SOC: , "She [Sweeney] started screaming and saying

something's wrong and now he's [Woodward] having trouble-now he thinks he might

be disconnected. Okay, we just lost connection." 99

Also at 8:45 A.M., the American Airlines director of security learned of the hijacking. He

contacted the special agent in charge of the FBI's Dallas Field Office to tell him that a

hijacking was taking place. l°°

-SB3CJECTTXTAST CA lT REVIEW- 14

--S CT -T rArsMATNREVE-IW-

8:46 AM. The order to scramble the Otis fighters was passed from the NEADS Battle

Commander (BC) to his Mission Crew Commander (MCC), who passed it to the

Weapons Director (WD).1 0 ' Almost immediately, however, a problem arose. The

Weapons Director asked: "MCC. I don't know where I'm scrambling these guys to. I

need a direction, a destination." 10 2 Because the hijackers had turned off the plane's

transponder, the plane appeared only as a primary track on radar. The fighters were

vectored to military air space near Long Island while NEADS personnel searched

frantically for the missing flight. 103

8:46:40 A.M. American Airlines Flight 11 crashed into the North Tower of the World

Trade Center in New York City.1 4 All on board and an unknown number in the building

were killed on impact.

By 8:50 A.M., American Airlines headquarters learned that an aircraft had struck the

World Trade Center via a telephone call from an American employee at LaGuardia

Airport. The airline did not know the plane was Flight 11.105

8:53 A.M. Although the Otis fighters were airborne, neither the fighter pilots nor the

NEADS officers were aware that Flight 11 had crashed into the World Trade Center's

North Tower. When NEADS learned of the crash, the fighters were placed in a holding

pattern in military airspace to await further instruction. NEADS had no knowledge that a

second hijacked aircraft, United 175, was bearing down on the South Tower. The Otis

fighters remained in a holding pattern until word reached NEADS that the second aircraft

had crashed into the World Trade Center.

At about 9:03 A.M., Boston Center reported to the FAA's New England regional office

that the hijackers stated, "We have some planes" during the 8:25 A.M. transmission from

Flight 11 06

9:16 A.M. The American Airlines SOC air traffic control specialist called an official at the

FAA's Hemdon Command Center and informed her that American "thought" Flight 11

had been the first aircraft to crash into the World Trade Center.10 7

9:21 A.M. NEADS received a report from Boston Center that "it was evidently another

aircraft that hit the tower" and that Flight 11 was still airborne and "heading towards

Washington."' 0 8 NEADS personnel immediately began an active search for the aircraft.

9:23 A.M. After consulting with the NEADS Battle Commander, the NEADS Mission

Crew Commander issued an order to scramble alert fighters from Langley Air Force Base

in Virginia in response to the report that Flight 11 was headed towards Washington

DC.1' 9 The initial strategy of NEADS personnel was to use the alert fighters scrambled

from Otis Air Force Base at 8:46 A.M. to chase down Flight 11 if they could find the

aircraft, and to vector the Langley fighters on a northerly heading to an area between the

(reported) southbound Flight 11 and the nation's capital.'" 0

SUBfeICT TO CLASSIF-IATONREVIEW 15

-SBJETffITOCAASSFICATION REVIEW

9:24 A.M. The order to scramble the Langley fighters was processed and transmitted by

NEADS to Langley Air Force Base. l'

Shortly after 9:24 A.M., out of concern over leaving New York's airspace unprotected,

NEADS commanders decided to cancel the plan to pursue Flight 11 with the Otis

fighters. 12

9:27A.M. The military's situational awareness was summarized on the NEADS watch

floor as follows: "Three planes unaccounted for. American Airlines 11 may still be

airborne but the flight that - United 175 to the World Trade Center. We're not sure who

the other one is."1'

9:30 A.M. Radar data showed the Langley fighters airbore. On the floor at NEADS,

the ID Technicians continued to attempt to locate American 11 after the Langley fighters

were airborne.114

By 9:30 A.M., American Airlines confirmed that Flight 11 had crashed into the World

Trade Center.l 15

Alleged Gun Use on Flight 11. The Commission investigated an allegation that a gun

was used aboard American Airlines Flight 11. The allegation arose from a notation in an

initial executive summary produced on September 11, 2001, by FAA staff indicating that

FAA headquarters had received a report of a shooting on the plane from an American

Airlines employee at the company's operations center. 116 The report did not mention a

stabbing. In interviews with the Commission, the individual alleged to have made the

report to the FAA denied having done so." 7

Regardless of what reports were received in the chaotic environment of the various

operations centers at the FAA, the airports, and the airlines, authoritative information

about whether a shooting occurred on Flight 11 could have come only from individuals

on the aircraft who were reporting events to contacts on the ground.

As noted above, two flight attendants aboard American Airlines Flight 11 placed calls to

ground contacts to report what was happening on the aircraft. Neither in the tape

recordings of the calls nor in the accounts of the witnesses to the calls is the presence of a

gun or the occurrence of a shooting reported. l18 These witnesses' accounts of the phone

calls are consistent and are quite specific about the presence of knives and the stabbing or

slashing of two crew members and a passenger.

In order to accept the accuracy of the initial FAA executive summary concerning a

shooting (disregarding the evidence by eyewitnesses to the contrary), one would have to

believe that the American Airlines operations center relayed to the FAA the account of a

shooting that no witness recalls while neglecting to include the account of a stabbing that

was widely reported, including to personnel in the operations center. This seems highly

implausible.

-SUBJECTTCTLASS-FICA-TON REVIE-W 16

--Sf-ETTOCLASSWICATION REVIEW

In fact, the victim of the alleged shooting that was noted in the FAA executive summary

was seated in 9B. That seat, according to several of the witness accounts from the

aircraft, was assigned to the passenger who was stabbed.' 19

Both the FBI and the General Accounting Office investigated the story of a gun aboard

Flight 11 and could find nothing to substantiate the version in the executive summary. In

addition, while investigators have uncovered evidence of numerous knife purchases by

the 19 hijackers leading up to September 11, 2001, there was no evidence that they

purchased or possessed firearms. 120

Furthermore, the tactics of all four hijacking teams involved in the plot were similar. No

evidence has been uncovered to suggest that the hijackers on any of the other flights used

firearms. Evidence shows that common tactics were used among the flights including the

use of knives, the threat of a bomb (either real or simulated) reported on three flights, and

the presence of Mace reported on two flights. It seems unlikely that one of the teams

would depart from the tactical discipline of the plotters' mutual strategy.

Evidently, the account of the attack on the business-class passenger-the only attack on a

passenger reported by eyewitnesses-became garbled as it was relayed between airline

and FAA authorities in the confusion of the rapidly unfolding events of the day.

1.2 UNITED AIR LINES FLIGHT 175

Hijackers. Marwan al Shehhi (pilot); Mohand al Shehri; Hamza al Ghamdi; Fayez Banihammad; Ahmed al Ghamdi. Hijacker Weapon Purchase. On August 13, 2001, Marwan al Shehhi purchased two short-bladed knives, a Cliphanger Viper and an Imperial Tradesman Dual Edge. On the same day and in the same city, Fayez Banihammad bought a Stanley two-piece snap knife set (a type of multi-tool), and Hamza al Ghamdi purchased a Leatherman Wave multi-tool. 121 Hijacker Arrival at Airport and Check-in. At 6:20 A.MA.,122 Ahmed al Ghamdi and Hamza al Ghamdi checked in at the United Air Lines (UAL) ticket counter at Logan International Airport in Boston.123 They approached a United Air Lines customer service representative, who immediately referred them to another agent because one of the men presented a "certificate" that the first agent was unfamiliar with.124 This second customer service representative said that one of the two men told her that he needed a ticket. She examined his documents and found that he already had a UAL envelope with an itinerary and ticket in his hand. She told him that he did not need a ticket but could check-in. The United agent recalled that the men checked two bags. She thought each had one carry-on bag resembling a briefcase. She recalled that each man had "problems" answering the standard security questions, and that she had to repeat them "very slowly." After the questioning, the men departed the counter area for the security checkpoint. 2 -- -- UBSJ-fCeT-- O CLASSIFICATION REVIEW 17 'StBJEEC-T0-CLA-SSIFICATION REVIEW 6:20 A.M. Ahmed al Ghamdi checked two bags that were loaded on the aircraft at 6:31 A.M. 2 6:45 A.M. Marwan al Shehhi checked a single bag. It was loaded on the plane at 6:51 A.M. 6:52 A.M. A call was placed to Mohamed Atta's cell phone from a pay phone in Terminal C located between the screening checkpoint and the departure gate. 12The call lasted three minutes and was most likely a last-minute check between Atta, who had just arrived in Boston, and Marwan al Shehhi. 129 6:53 A.M. Fayez Banihammad (listed in the airline passenger record as Fayez Ahmed) and Mohand al Shehri (listed as Mohald) checked in. Banihammad checked two bags, which were loaded at 6:57A.M.130 Hijacker Prescreening. None of the Flight 175 hijackers was selected for additional security scrutiny by the CAPPS system. Checkpoint Security Screening. Because Logan Airport did not use video cameras to monitor activities at security checkpoints, we could not establish with certainty when the five hijackers passed through security screening or how they were processed. Judging from when they checked in for the flight, we estimated they were screened within the time frames as follow: To reach their departure gate, after checking in, the hijackers had to pass through a checkpoint in Terminal C before boarding. 2 The checkpoint was under the custodial responsibility of United Air Lines. It had contracted the screening duties to Huntleigh USA Corporation. None of the checkpoint supervisors recalled the hijackers or reported anything suspicious regarding their screening. Hijacker Boarding. Fayez Banihammad boarded the flight at 7:23 A.M. He was seated in 2A (first class). Mohand al Shehri boarded at the same time and sat next to him in 2B. Four minutes later, both Marwan al Shehhi, seated in 6C (business class), and Ahmed al Ghamdi, seated in 9D (business class), embarked. At 7:28 A.M., Hamza al Ghamdi was the last hijacker to board the flight; he sat in 9C (business class).'34 Plight Profile. The flight was scheduled to depart Logan at 8:00 A.M. for Los Angeles International Airport. The aircraft was a Boeing 767, with tail number N612UA.' Captain Victor Saracini and First Officer Michael Horrocks piloted the plane. The flight attendants were

• Robert Fangman, assigned to the middle center jump seat between the middle

galley and coach;

Page 18

• Amy Jarret, assigned to the right jump seat, located in the back of the plane

between coach and the rear galley;

• Amy King, assigned to the forward center jump seat, located between the forward

galley and the first-class cabin;

• Kathryn Laborie, assigned to the forward left jump seat next to the cockpit

entrance;

• Alfred Marchand, assigned the forward center jump seat, located between the

forward galley and the first-class cabin;

• Michael Tarrou, assigned to the rear left jump seat, located in the back of the

plane between coach and the rear galley; and

• Alicia Titus, assigned to the middle center jump seat between the middle galley

and coach. 136 The aircraft had a capacity of 168 passengers: 10 in first class, 33 in business class, and 125 in coach. The flight carried 56 passengers (including 5 hijackers) with 2 pilots and 7 flight attendants, for a total of 65 people on board. Nine of the 10 first-class seats were occupied, including 2 by hijackers Banihammad and Mohand al Shehri. Eleven of the 33 business-class seats were occupied, 3 by hijackers Shehhi, Hamza al Ghamdi, and Ahmed al Ghamdi; and 36 of the 125 coach seats were occupied, none by hijackers. 13 7 The 56 passengers represented a load factor of one-third of the plane's passenger capacity. This figure is considerably below the 49 percent average load factor for Flight 175 for Tuesdays in the three-month period prior to September 11. It represented the third-lowest load factor among the scheduled flights during that period, 8 when Tuesdays were the least traveled day for Flight 175.139 There is no evidence that the Flight 175 hijackers purchased additional tickets for the flight beyond the ones they actually used.140 All the hijackers were accounted for on the flight, and according to United's records, no paperwork was filed to indicate that any cockpit jumpseat was occupied by anyone other than flight crew. 14 1 Under United Air Lines policy at the time, a key to the cockpit door was stowed in a designated place near the cockpit door. 42 Flight 175 was loaded with 76,000 pounds of fuel, 143 a normal amount for the crosscountry flight. 44 The Flight. At 7:58 A.M., Flight 175 pushed back from Gate 19 in Terminal C, and it departed Logan Airport at 8:14 A.M. 1 5 At 8:19 A.M., Flight 175 made radio contact with a Boston Center air traffic controller. 146 --9U'BECC TTT LT-AFLC-AT1ION-REV4IEW 19 -StlBEeTTft-C-A-SSiFICATION REVIEW 8:33A.M. Flight 175 reached its assigned cruising altitude of 31,000 feet. 147 At or around this time, flight attendants Laborie and Marchand would have begun cabin service in first class, while flight attendants King and Fangman would have done the same in business class, and Tarrou, Jarret, and Titus would have served coach class.' 48 8:37A.Af. FAA air traffic controllers asked the flight crew of Flight 175 to look for American Airlines Flight 11.149 8:38 A.f. The crew of Flight 175 radioed air traffic control that they had spotted the aircraft at 28,000 or 29,000 feet. FAA air traffic control told them to turn their aircraft to avoid Flight 11.150 8:40 A.A. Control of Flight 175 was passed from Boston Center to the New York Air Traffic Control Center at Ronkonkoma, New York (New York Center).151 8:41 A.A. The flight crew of Flight 175 reported to air traffic controllers that "we heard a suspicious transmission [from another aircraft] on our departure out of Boston-like someone keyed the mike and said everyone stay in your seats."' 52 United's system operations control manager in Chicago reported that though he normally received relevant information about United flights from FAA air traffic control, on September 11, 2001, he did not recall receiving information about any air traffic control communications with or from Flight 175, including the 8:41 A.M. report.' 53 The other senior United Air Lines officials working in the operations center on 9/11 confirmed that they were never told of this communication, though they stated that air traffic controllers would "first and foremost" communicate directly with pilots. Furthermore, these officials reported that they never received any communication on the morning of September 11, 2001, from the FAA or the air traffic control system advising United to contact its aircraft about the hijackings. 154 At 8:42 A.M., the flight crew of Flight 175 completed their report on the "suspicious transmission" they had received from another plane. This represented the flight's last communication with the ground.' 55 The Hijacking. Between 8:42 A.M. and 8:46A.M., the hijackers began their takeover of the flight. The hijackers initiated and sustained their command of the aircraft using knives (as reported by two passengers and a flight attendant), Mace (reported by one passenger), and the threat of a bomb (reported by the same passenger). They stabbed flight crew members (as reported by a flight attendant and one passenger) and killed both pilots, (as reported by a flight attendant). All of these eyewitness accounts were provided via phone calls (as described below) from the back of the plane, even though the passengers calling had each been assigned a seat in the front or middle of the cabin.'56 ·-S-t:UBfiECf--T -eASI-FIATION-REVUEW 20 SbiBJECT-TO CLASSIFICATION REVIEW Given the similarities to Flight 11 in hijacker seating and in the eyewitness reports of tactics and weapons, as well as the close contact between presumed team leaders Atta and Shehhi, it is likely the hijacking unfolded in much the same manner as on Flight 11. 8:47A.M. Flight 175's transponder code changed twice within a one-minute period. 157 David Bottiglia, the New York Center air traffic controller responsible for Flight 175 was also handling Flight 11, which he was told had been hijacked. At this point he was trying to locate Flight 11 and did not notice the transponder code changes on Flight 175 until 8:51 A.M. 5 8 8:50 A.M. Delta Airlines Flight 1489 radioed in and advised David Bottiglia there was "a lot of smoke in lower Manhattan" and the World Trade Center looked like it was on fire.' 59 The controller acknowledged the message at 8:51 A.M., and agreed to pass on any news, then noticed a change in the transponder reading from Flight 175. The controller asked Flight 175 to recycle its transponder to the proper code.'16 There was no response. Also at 8:51 A.M., Flight 175 deviated from its assigned altitude.'61 8:52 A.M. David Bottiglia made the first of five unsuccessful attempts over a three-minute period to contact the flight. 16 2 While continuing his attempts to contact Flight 175, David Bottiglia spent the next several minutes handing off the other flights on his scope to other controllers and moving aircraft out of the way of the unidentified aircraft (believed to be Flight 175) as it moved southwest and then turned northeast toward New York City.163 Also at 8:52 A.M., Lee Hanson received a phone call from his son, passenger Peter Burton Hanson, 164 who told him that the flight was being hijacked. "I think they've taken over the cockpit-An attendant has been stabbed-and someone else up front may have been killed. The plane is making strange moves. Call United Air Lines-Tell them it's Flight 175, Boston to LA." Lee Hanson then called the Easton, Connecticut, Police Department, relayed the information from his son to a police captain, and asked for his help. 6 5 Also at 8:52 A.M., 166 Marc Policastro, an employee at the United Air Lines maintenance office in San Francisco (SAMC), received a phone call from a male flight attendant 16 7 on Flight 175 who reported that the aircraft had been hijacked, both pilots had been killed, a flight attendant had been stabbed, and he believed the hijackers were flying the plane. The call lasted about two minutes. Policastro tried unsuccessfully to contact the flight via ACARS. 16 8 Another employee at the maintenance office also tried to contact Flight 175 with an ACARS message around this time, with a message requesting the flight crew to confirm reports of an incident onboard. 169 None of these or any subsequent attempts to contact Flight 175 were acknowledged from the aircraft. Beginning at 8:52 A.M. and continuing until 8:59 A.M., a passenger unsuccessfully tried a total of four times to reach his wife on both her business and home phone lines. Meanwhile, at United's (UAL) headquarters in Chicago, the air traffic control coordinator called an official at the FAA Hemdon Command Center to confirm that the --SUJECT TO CLASSIFICATION REVIEW 21 SUBJtI3E-T-TO-CSLASSEFATION REVIEW plane that had just crashed into the World Trade Center was not a United plane. He was informed that the aircraft was a hijacked American Airlines 757.171 Shortly thereafter, the UAL coordinator briefed the director of United's systems operations center, and the shift manager of United's flight dispatch, about the call. The dispatch manager attempted to notify top corporate officials but was unable to do so because the UAL pager system was not working. At approximately 8:55 A.M. a New York Center supervisor notified the center's operations manager of her belief that Flight 175 had been hijacked. 7 3 8:57A.M. Flight 175 turned to the northeast and leveled off at 28,500 feet. One minute later, it headed toward New York City. 174 8:58 A.M. David Bottiglia, the New York Center controller searching for Flight 175, told another New York controller "we might have a hijack over here, two of them." 175 8:59 A.M. Passenger Brian David Sweeney 176 attempted to call his wife, Julie. He left a message on their home answering machine telling her that the plane had been hijacked. 1 77 Also at 8:59 A.M., an employee at United's maintenance office in San Francisco sent three ACARS messages to Flight 175. Each read, "I heard of a reported incident aboard your acft [aircraft]. Plz verify all is normal." 178 Shortly before 9:00 A.M., one of this employee's supervisors in the San Francisco office called United's station operations control manager in Chicago to tell him of the reported hijacking of Flight 175.179 The operations center manager initially thought the report referred to the American Airlines hijacking, but the supervisor in San Francisco reiterated that it was about Flight 175.180 The Chicago manager notified his boss, United's operations center director, who in turn contacted United's chief operating officer, Andy Studdert, and the company's CEO, James Goodwin.' 81 The employee supervisor also called the airline's security chief. The SOC director and the supervisor began the process of activating the crisis center at United's headquarters, which took about 30 minutes to complete. 18 At approximately 9:00 A.M., the FAA's New York Center informed the UAL air traffic control coordinator that Flight 175 was missing from radar.18 3 9:00 A.M. 184 Passenger Brian David Sweeney called his mother and told her that his flight had been hijacked. He said that the passengers were thinking about storming the cockpit to wrest control of the plane away from the hijackers. He thought they were flying somewhere over Ohio. Immediately after the call from her son, Mrs. Sweeney turned on the television and saw the second aircraft crash into the South Tower of the World Trade Center. 185 Also at 9:00 A.M., 86 Lee Hanson received a second call from his son who told him: It's getting bad, Dad-A stewardess was stabbed-They seem to have

page 22

Page 22

knives and Mace-They said they have a bomb-It's getting very bad on the plane-Passengers are throwing up and getting sick-The plane is making jerky movements-I don't think the pilot is flying the plane-I think we are going down-I think they intend to go to Chicago or someplace and fly into a building. The call ended abruptly. Hanson did not know whether his son had hung up or the phone had malfunctioned. After the call, Hanson turned on his television. He watched as the second plane slammed into the South Tower.

9:01 or 9:02A.M. A United flight dispatch manager went to the desk of Ed Ballinger, the dispatcher responsible for the airline's East to West Coast flights. He told the dispatcher of the information just received by the operations center manager from the San Francisco maintenance office that had led them to suspect Flight 175 had been hijacked.'8 9 Between 9:01 A.M. and 9:02 A.M., a manager from New York Center told the FAA Command Center: "We have several situations going on here. It's escalating big, big time. We need to get the military involved with us.... We're, we're involved with something else, we have other aircraft that may have a similar situation going on here. "' The "other aircraft" referred to by New York Center was Flight 175. The evidence suggests this conversation was the only notice received by either FAA headquarters or the Herdon Command Center prior to the second crash that there had been a second hijacking. While the Herdon Command Center was told about this "other aircraft" at 9:01 A.M., New York Center contacted New York terminal approach control and asked for assistance in locating Flight 175. At 9:02 A.M., as New York terminal approach controllers located Flight 175 rapidly descending into lower Manhattan, a New York Center manager stated, "[a]lright. Heads up man, it looks like another one coming in."

At 9:03 a.m., Terry Biggio, a manager from FAA's Boston Center, reported to an FAA New England region representative that they had deciphered what the hijackers on board American 11 said during the first radio transmission (at 8:25 A.M.). Biggio reported that the hijackers said "we have planes." He then emphasized that they said "planes as in plural." As the air traffic controllers in Boston came to the tragic realization that the hijackers may have hijacked multiple commercial aircraft, Flight 175 was about to strike the South Tower of the World Trade Center.

9:03 A.M. Ballinger sent an ACARS message to the aircraft: "How is the ride. Anything dispatch can do for you." Another ACARS was sent at the same time by the UAL air traffic control coordinator: "NY approach lookin for ya on [frequency] 127.4."

Page 23

Y:Ui A.M. NEADS air defenders received their first notice of a second hijacked aircraft when New York Center told a NEADS Identification Technician that Flight 175 was a "second possible hijack." 9:03:11 A.M. United Air Lines Flight 175 crashed into the South Tower of the World Trade Center. The aircraft was traveling at over 587 miles per hour at impact. All on board and an unknown number in the building were killed instantly. 9:03:22 A.M. Seconds after Flight 175 crashed into the South Tower, Terry Biggio, Boston Center's manager, advised the New England Region that New York confirmed t-hL nLA-tL L crVc rnAnV l rLn ln1n.\p^ 1hal-UA catLln ilrt tIhAI XWT1 vf rWl A.l TJXr 1a. cl4ArV -\^CV ~Iir ntor .

Shortly after, unaware that Flight 175 had flown into the World Trade Center, Ballinger again attempted to communicate with the aircraft. He sent the same ACARS message: "How is the ride. Anything dispatch can do for you."t 9 7 Meanwhile, the airline's air traffic control coordinator re-sent his ACARS message, "NY approach lookin for ya on 127.4." 9:04 A.M. Terry Biggio immediately advised New England Region that Boston Center was going to stop all departures at airports under its control and suggested they "do the same elsewhere."

Between 9:04 A.M. and 9:07A.M., the NEADS Identification Technicians were on the phone with FAA Boston Center seeking further information on Flight 175 when Boston Center confirmed a second crash at the World Trade Center. 9:05A.M. On an open line monitored by Herdon Command Center, Terry Biggio contacted the New England Region and confirmed that the hijackers on board American 11 said "we have planes." 9:05 A.M. NewYork Center declared "ATC zero"-meaning that aircraft were not permitted to depart from, arrive at, or travel through New York Center's airspace until further notice.

9:07 A.M. Fearing there may be additional attacks after the second WTC crash, Terry Biggio asked a New England Region manager if warnings to increase cockpit security could be sent to airborne aircraft via "ACARS or something." Biggio was particularly concerned about warning airborne international flights scheduled to arrive at JFK International Airport. While Boston Center did not want to alarm any airborne aircraft,

Page 24

they were considering using the radio frequencies to alert international flight crews to heighten their cockpit security. On the advice of a New England Region representative, Boston Center decided to contact Air Transport Association ("ATA") representatives through Hemdon Command Center and ask the ATA representatives to formally request that airline companies warn their aircraft to heighten cockpit security. Not content to rely on the airlines to warn their aircraft, Terry Biggio decided that Boston Center would issue a Notice to Airmen ("NOTAM") to heighten cockpit security in light of the attacks on New York.

By 9:08 A.M., the mission crew commander at NEADS learned of the second explosion at the World Trade Center and decided against holding the fighters in military airspace away from Manhattan. Anticipating additional attacks on New York, the mission crew commander told his crew:

This is what I foresee that we probably need to do. We need to talk to FAA. We need to tell 'em if this stuff is gonna keep on going, we need to take those fighters, put 'em over Manhattan. That's best thing, that's the best play right now. So coordinate with the FAA. Tell 'em if there's more out there, which we don't know, let's get 'em over Manhattan. At least we got some kind of play. 204

9:09 A.M. After learning about the second crash at the World Trade Center, NEADS ordered alert fighters at Langley Air Force Base to battle stations. Colonel Marr, the battle commander at NEADS, and General AArnold, the CONR Commander, both recall that that the planes were held on battle stations, as opposed to scrambling, because they might be called upon to relieve the Otis fighters over New York City if a refueling tanker was not located, and also because of the general uncertainty of the situation in the sky.

After initially considering scrambling the Langley fighters to New York to provide backup for the Otis fighters, they decided to leave the Langley jets on "battle stations only" NORAD has no indication that any other plane had been hijacked

9:09 A.M. to 9:10 A.M. Terry Biggio instructed all air traffic controllers in Boston Center to use their radio frequencies to inform all aircraft within Boston Center's airspace of the events unfolding in New York and to advise the aircraft to heighten cockpit security in light of those events. Boston air traffic controllers immediately executed Biggio's order.

9:10 A.M. A UAL dispatch operations shift manager's timeline log entry noted, "At that point a second aircraft had hit the WTC, but we didn't know it was our United flight."2 08 Between 9:10 A.M. and 9:20 A.M., The United dispatch operations manager spoke with the American Airlines dispatch operations manager about the two crashes into the World Trade Center. The American official believed both aircraft were his; the United official was increasingly "confident" that the second plane was Flight 175. In slow motion and enlarged images of the second impact on CNN, he could see that the airplane did not have the shiny metallic color of American jets.

Page 25

9:12 A.M. A staff analyst in United headquarters alerted United dispatch, flight safety, and flight operations personnel about the American Airlines crash and the missing UAL Flight 175.

9:13 A.M. Radar data show the Otis fighters were approximately 115 miles away from New York City when they exited their holding pattern and set a course direct for Manhattan.

At approximately 9:15 A.M., Daniel Bueno, another Boston Center manager, asked the Herdon Command Center to contact all FAA centers in the country and instruct them to issue a similar cockpit security alert to all airborne aircraft. Commission staff has found no evidence to suggest that the Command Center acted on Bueno's request or issued any type of nationwide cockpit security alert.21 2 One Command Center manager told Commission staff that the FAA culture and mindset on 9/11 was such that they would never have relayed this message directly to all pilots. She said the FAA would pass situational awareness to the airline company representatives who, in turn, would determine if such action was necessary.

9:19 A.M. Ballinger sent the following ACARS message to his airborne flights: "Beware any cockpit intrusion...Two aircraft in NY hit trade center builds."

9:20 A.M. The UAL dispatch operations manager now believed that the second aircraft to crash into the World Trade Center was Flight 175. Its identity was still unconfirmed.

9:22 A.M. The UAL system operations control manager issued an advisory, under the name of UAL Chief Operating Officer Andy Studdert, to all UAL facilities-including the flight dispatchers-stating that Flight 175 had been involved in an accident in New York City and that the crisis center had been activated. 216 Just prior to the Studdert advisory, United headquarters began the lockout procedure to restrict access to passenger and crew information about the flight. 9:23 A.M. Ballinger sent out his "cockpit intrusion" message to Flight 175. At this time, while the dispatcher was aware that two large aircraft (including one United airliner) had crashed into the World Trade Center and that Flight 175 had been hijacked, he was not aware that Flight 175 had crashed. 9:25 A.M. The Otis fighters arrived over Manhattan and established a combat air patrol (CAP) over the city.

Page 26

1.3 AMERICAN AIRLINES FLIGHT 77

Hijackers: Hani Hanjour (pilot); Khalid al Mihdhar; Nawaf al Hazmi; Salem al Hazmi; Majed Moqed. Hijacker Weapon Purchases. On August 27, Nawaf al Hazmi purchased Leatherman multi-tool knives.22 Hijacker Check-in and Checkpoint Security Screening. At approximately 7:15 A.M., Majed Moqed and Khalid al Mihdhar checked in at the American Airlines ticket counter at Dulles and proceeded to checkpoint screening. 222 Security screening for Flight 77 was conducted at the east and west checkpoints in the Main Terminal. United Air Lines had custodial responsibility for the screening and contracted out the work to Argenbright Security. All five of the hijackers passed through the same checkpoint. Closed-circuit television recorded all passengers, including the hijackers, as they were screened.223 7:18 A.M. Moqed and Mihdhar entered the security screening checkpoint. They placed their carry-on bags on the X-ray machine belt and proceeded through the first walkthrough metal detector. Both set off the alarm and were directed to a second metal detector. While Mihdhar did not trigger the second metal detector and was permitted through the checkpoint, Moqed failed once again. A security officer screened him with a hand-held metal detection wand. He passed this cursory inspection.2 At approximately 7:29 A.M., Nawaf al Hazmi and Salem al Hazmi checked in at the American ticket counter.225 7:35 A.M. Hani Hanjour placed two carry-on bags on the X-ray belt and passed through the metal detector. He picked up his carry-on bags and proceeded through the checkpoint. 7:36 A.M., Nawaf and Salem al Hazmi entered the same checkpoint. Salem, with one carry-on bag, successfully cleared the magnetometer and was permitted through the checkpoint. Nawaf set off the alarms for both the first and second magnetometers. He was hand-wanded and his shoulder bag was swiped by an explosive trace detector before he was allowed to proceed. The video footage showed that he was carrying an unidentified item clipped to the rim of his back pants pocket. 226 Hijacker Prescreening Selectee Status. CAPPS selected all five of the Flight 77 hijackers for added security scrutiny. Hanjour, Mihdhar, and Moqed were chosen by the computer algorithm. Nawaf al Hazmi and Salem al Hazmi were both made CAPPS selectees at the discretion of the airline's customer service representative who checked them in.227 The agent told us that one of the hijackers (Salem, we believe) presented identification without a picture and did not seem to be able to understand English. He said that he thought both were suspicious and made sure he made both of them selectees.

Page 27

The only consequence of selection, however, was that their bags were held off the plane until it was confirmed that they had boarded the aircraft228 Thus, Hanjour, Nawaf al Hazmi, and Mihdhar, who did not check any bags on September 11, suffered no consequences from their selection by the system. For Salem al Hazmi, who checked two bags, and Moqed, who checked one bag, the sole consequence was that their baggage was not loaded onto Flight 77 until after their boarding was confirmed.229 Hijacker Boarding. At approximately 7:50 A.M., Moqed and Mihdhar boarded Flight 77 and were seated in seats 12A and 12B of coach, respectively. Hanjour, assigned to seat 1B, in first class, boarded at approximately 7:52A.M. Finally, Nawaf al Hazmi and Salem al Hazmi, occupying seats 5E and 5F in first class, boarded at approximately 7:55 A.M. 3 Flight Profile. Flight 77 provided nonstop service between Washington Dulles International Airport and Los Angeles International Airport. It was scheduled to depart at 8:10 A.M. The aircraft was a Boeing 757, tail number N644AA.231 Captain Charles F. Burlingame and First Officer David Charlebois piloted the plane. The flight attendants on Flight 77 were

• Michele Heidenberger, assigned to the rear left jump seat in the very back of the

plane at takeoff;

• Jennifer G. Lewis, assigned to the right middle jump seat between first class and

coach (and therefore between the hijackers in 5E and 5F and those in 12A and 12B);

• Kenneth E. Lewis, assigned to the right rear jump seat; and
• Renee May, assigned to the forward left jump seat next to the entry area and

between the first row of first class and the cockpit.232 The aircraft had a capacity of 176 passengers, 22 in first class and 154 in coach. On September 11, 2001, the flight carried 58 passengers (including 5 hijackers) with 2 pilots and 4 flight attendants for a total of 64 people on board. Fifteen of the 22 first-class seats were occupied, 3 by hijackers. Forty-three of the 154 economy seats aboard were occupied, 2 by hijackers. The 58 passengers represented a load factor of 33.0 percent of the plane's passenger capacity of 176. This figure is almost identical to the 32.8 percent average load factor for Flight 77 for Tuesdays in the three-month period prior to September 11. During that time, Tuesdays were the least traveled day for Flight 77.233 The Commission has found no ticketing, passenger occupancy, or financial evidence to indicate that the hijackers purchased additional seats (beyond the ones they actually used) in order to limit the number of passengers they would need to control during the operation.2 3 4 -S:B3ECT-TO-CL-ASSIFICATION REVIEW 28 'SUBJECXT TO CLA*SSFIATION REVIEW All the hijackers were assigned seats as they checked in and boarded the flight. According to American's records, "no documentation for a jump seat passenger was filed for Flight 77." 23 5 There is no evidence to suggest that any hijacker was admitted into the cockpit and permitted to sit in a jump seat prior to the takeover. As on Flight 11, under American Airline policy in effect on 9/11, every crew member, including each of the flight attendants, had a key to the cockpit.236 Flight 77 was loaded with 49,900 pounds of fuel. The amount of fuel was below the average (59,400 pounds) for the flight during 2001. 237 The Flight. Flight 77 pushed back from Dulles Gate D-26 at 8:09 A.M.238 8:20 A.M. Flight 77 took off from Dulles.239 8:40 A.M. After proceeding normally through air space controlled by the Washington Air Traffic Control Center (Washington Center), Flight 77 was handed off to the Indianapolis Air Traffic Control Center (Indianapolis Center), with which it made routine radio contact.240 8:46 A.M. Flight 77 reached its assigned cruising altitude of 35,000 feet. 24 1 Cabin service would have begun, with Renee May likely working in the first-class galley between the cockpit and first class, Michele Heidenberger in the galley at the rear of the plane, Jennifer Lewis circulating in first-class, and Kenneth Lewis in the main cabin.242 8:51 A.M. Flight 77 transmitted its last routine radio communication, an acknowledgment from the cockpit crew to air traffic control's navigational instructions. 24 3 The Hijacking. Between 8:51 A.M. and 8:54 A.M., the hijackers began their takeover of the aircraft. They initiated and sustained their command of the aircraft using knives and box cutters (reported by one passenger) and moved all of the passengers (and possibly crew) to the rear of the aircraft (reported by one flight attendant and one passenger). Neither of the firsthand accounts to come from Flight 77, from a flight attendant and from a passenger, mentioned any actual use of violence (e.g., stabbings) or the threat or use of either a bomb or Mace. Both of these witnesses began the flight in the first-class cabin. 8:54 A.M. The aircraf its assigned course b' slight turn to the soul 8:56 A.M. The transp switched off, and the lost on primary radai controller tracking F continued to look foi 'SUBJECTTO CLASSIFICATION REVIEW along its projected flight path and the airspace to the southwest where it had started to turn. No primary targets appeared. He tried the radios, first calling the aircraft directly, then the airline. Again there was nothing. At this point, the Indianapolis Center controller had no knowledge of the situation in New York. He did not know that other aircraft had been hijacked. He believed Flight 77 had experienced serious electrical and/or mechanical failure, and was gone. At the same time, the Indianapolis Center made the first of ten unsuccessful attempts over the next six and a half minutes to contact the aircraft via radio.246

Shortly after 8:56 A.M., the Indianapolis Center controller reached out to controllers in other sectors at Indianapolis Center to advise them of the situation. The controllers agreed to "sterilize the air space" along the flight's projected westerly route so that other planes would not be affected by Flight 77. Two Indianapolis Center managers joined the controller responsible for Flight 77 in searching for the flight. The managers did not instruct other controllers at Indianapolis Center to turn on their primary radar coverage to join in the search for Flight 77.

By 8:58 A.M., FAA air traffic control contacted American to advise the airline that contact had been lost with Flight 77. Shortly thereafter, American Airlines dispatchers made the first of several unsuccessful attempts over three minutes to contact Flight 77, using the ACARS email system to advise the flight crew to contact the Indianapolis Air Traffic Control Center.

9:00 A.M. American Airlines Executive Vice President Gerard Arpey learned that communication had been lost with Flight 77. He ordered all American Airlines flights in the Northeast that had not taken off to remain on the ground.25 Also at 9:00 A.M., Flight 77 headed east and shortly thereafter began to descend.25 t 9:02 A.M. The FAA's air traffic controllers told American Airlines that they did not know the location of Flight 77 and were unable to contact it.252 Three minutes later, American began lockout procedures to protect information about the flight.2 53 9:05 A.M. Flight 77 re-emerged as aprimary target on Indianapolis Center radar scopes, well east of its last known position.2 However, the aircraft was not detected by air traffic controllers because they were searching along its projected flight path to the west and southwest.

At approximately 9:07A.M., Flight 77 leveled off at 25,000 feet and made a slight course change to the east-northeast. 255

By 9:08 A.M., officials in American Airlines' SOC had concluded that the second aircraft to hit the World Trade Center might have been Flight 77.256

Page 30

9:08A.M. The FAA's Indianapolis Center contacted Air Force Search and Rescue in Langley, Virginia, to request that they be on the lookout for an accident involving Flight 77 because of the simultaneous loss of radio communications and all radar contact.25 7 9:09 A.M. Indianapolis Center called the FAA Great Lakes Regional Office to notify it of a possible accident involving American 77.25

At some time between 9:00 A.M. and 9:10 A.M., an American Airlines air traffic control specialist at SOC who was in communication with the Herdon Command Center notified SOC air traffic control manager that he had learned United was "missing a plane." American headquarters extended its ground stop nationwide.25 9

9:11 A.M. Renee May, a flight attendant, attempted to call her parents but the call did not connect. A second call to the same number at 9:12 A.M. did go through.260 In the conversation, May told her mother that her flight was being hijacked by six individuals who had moved them-the mother was not sure whether her daughter meant all the passengers or just the crew-to the rear of the plane. May asked her mother to call American Airlines and make sure that they knew about the hijacking, giving her three phone numbers in Northern Virginia to call.

At some point between 9:12 A.M. and the crash of Flight 77 into the Pentagon (9:37:46 A.M.), Renee May's parents reached an American Airlines employee at Reagan National Airport in Washington, D.C., giving her the information provided by their daughter, including her phone number on board and the flight number.261 Initially, the American employee thought the Mays were talking about the aircraft that had crashed into the World Trade Center. May's mother reiterated that she was speaking of Flight 77, still in the air. At some point after completing the call, the American employee was told to evacuate the building. On her way out, she heard explosions from the direction of the Pentagon, though she was not sure that it was the crash of an aircraft. She informed a flight services manager at the airport about her conversation with May's parents.26 2 Around 9:15 A.M., after confirming that two airliners had struck the World Trade Center American ordered all of its airborne flights to land. 263

9:16 A.M. An American Airlines air traffic control specialist phoned an official at the Hemdon Command Center to inquire about the status of New York City air traffic. Over the course of this conversation, which lasted two and a half minutes, the specialist said that American "thought" Flight 11 had crashed into the World Trade Center. Flight 77, he said, was "missing." As he made his report, he received an update from American's SOC indicating that Flight 77 also might have crashed into the towers. He updated the ATC official but wondered how Flight 77 could have gotten to New York City. The ATC official replied that the second crash might not have been Flight 77 because "we [ATC] have another call sign" for that incident. At that point, though, the Hemdon Command Center was not sure of the identity of either of the two crashed aircraft and provided no further information.26 4

Page 31

At some point between 9:16 A.M. and 9:26 A.M., 26 5 Barbara Olson, a Flight 77 passenger, called her husband, Ted Olson, the solicitor general of the United States. Olson spoke to his wife for about one minute before the call was cut off.266 She reported that the flight had been hijacked and the hijackers were wielding knives and box cutters. She did not mention stabbing or slashing of the crew or passengers. The hijackers, she said, were not aware of her phone call. All of the passengers were in the back of the plane. Barbara Olson had been seated in first class. 267 After this call, Ted Olson tried unsuccessfully to reach Attorney General John Ashcroft. He contacted the Department of Justice Command Center and requested that they send someone to his office. 26 8 He also told the Department of Justice Command Center that his wife's flight had been hijacked and gave them the flight number. By no later than 9:18 A.M., FAA centers in Indianapolis, Cleveland, and Washington were aware that Flight 77 was missing and that two aircraft had struck the World Trade Center.269

By 9:20 AM., Indianapolis Center learned that there were other hijacked aircraft in the system, and began to doubt its initial assumption that Flight 77 had crashed. A discussion of this concern between the manager at Indianapolis and the Herndon Command Center prompted the Command Center to notify some FAA field facilities that Flight 77 was lost.

Between 9:20 A.M. and 9:31 A.M.,271 Barbara Olson again called her husband. During their second conversation, she reported that the pilot had announced that the flight had been hijacked and she asked her husband what she should tell the captain to do. Ted Olson asked for her location. She said that the aircraft was flying over houses. Another passenger told her they were traveling northeast. Ted Olson informed his wife of the two previous hijackings and crashes, but she did not display signs of panic or indicate any awareness of an impending crash. The call abruptly ended. 272 By 9:21 A.M., the Hemdon Command Center, some FAA field facilities, and American Airlines had started to search for Flight 77. They feared it had been hijacked.2 73 9:21 A.M. Herdon Command Center advised a supervisor at the Dulles Terminal Radar Approach Control (TRACON) facility that the FAA had lost contact with Flight 77 and was trying to find the aircraft. Controllers at Dulles TRACON were advised that a commercial aircraft was missing and instructed to look for primary targets.274 9:24 A.M. The FAA's Great Lakes Regional Office notified the agency's headquarters in Washington, D.C., that Flight 77 might have been involved in an accident.275 9:25A.AM. Herdon Command Center advised FAA headquarters that Flight 77 was lost in Indianapolis Center's airspace. It could not be located on radar. 276 --SBSJECTT-MCrASStF-tCATIONR-R EVIEW 32 ~-sFEF5TtAsStPICMt GN-RBVwTh Also at 9:25 A.M. Ben Sliney, the Hemdon Command Center National Operations Manager, ordered a "nationwide ground stop," which prevented any aircraft from taking off in the United States.277 9:29 A.M. Flight 77 was now flying at 7,000 feet and was approximately 38 miles west of the Pentagon. 7 8 At or shortly after 9:32 A.M., controllers at the Dulles TRACON "observed a primary radar target tracking eastbound at a high rate of speed," and notified Reagan National Airport of the approaching aircraft. This was later determined to have been Flight 77.279 9:34 A.M. Flight 77 was 5 miles west-southwest of the Pentagon. It began a 330-degree right turn. At the end of the turn, the plane descended through 2,200 feet pointed toward the Pentagon and downtown Washington D.C. 280 Also at 9:34 A.M. NEADS Identification Technicians who, at 9:21 A.M., had been told by Boston Center that Flight 11 was still airborne and heading south, contacted the Operations Manager at Washington Center to provide an update on the evolving situation. In the course of the conversation, the Operations Manager informed NEADS that Flight 77 was lost.281 He did not inform NEADS that it was hijacked because he did not know. This discussion was the first notice to the military that Flight 77 was missing, and it had come by chance. 282 If NEADS had not placed that call to Washington Center, the NEADS air defenders would have received no information whatsoever that Flight 77 was even missing. Also at 9:34 A.M., an update by the American Airlines SOC indicated that Flights 11 and 77 had been the aircraft that crashed into the World Trade Center.28 3 At approximately 9:36 A.M., Reagan Airport controllers then vectored an unarmed National Guard C-130H cargo aircraft, which had just taken off en route to Minnesota, to identify and follow the primary target identified by Dulles TRACON. The C-130H pilot spotted it, identified it as a Boeing 757, and attempted to follow its path.284 9:36 A.M. The FAA's Boston Center - which had learned of the unidentified primary radar target tracking eastbound via an FAA conference call line - called NEADS and relayed the report of the aircraft closing in on Washington. The aircraft that still had not been linked with the missing Flight 77. Boston Center told NEADS: "Latest report. Aircraft VFR [Visual Flight Rules] six miles southeast of the White House.. .Six, southwest. Six, southwest of the White House, deviating away." 285 This startling news prompted the Mission Crew Commander at NEADS to order "AFIO" (Authorization for Interceptor Operations), which entailed taking immediate control of the Langley fighters from the FAA. He then ordered the fighters to proceed directly towards Washington DC: "Okay, we're going to turn it ... crank it up...Run them to the White House." 2 86 Shortly after 9:36 A.M., the Mission Crew Commander at NEADS discovered, to his surprise, that the Langley fighters were not headed north as the scramble order had ,S.tT~ TAOf i AT4ON- W-vEW I 33 -SUBJECT-TO CLASSIFICATION REVIEW instructed, but east over the ocean. His response was emotional, "I don't care how many windows you break," he said, "Damn it.. .Okay. Push them back."287 9:37:46 A.M., American Airlines Flight 77 crashed into the Pentagon. The aircraft was traveling at approximately 530 miles per hour on impact.288 All on board were killed, along with 125 civilian and military personnel in the Pentagon.2 89 The Langley fighters were approximately 150 miles away. At approximately 9:38 A.M., the C- 130H aircraft reported to Reagan Airport controllers that the aircraft it was attempting to follow crashed into the Pentagon. 290 9:42 A.M. American's director of safety programs,2 91 who happened to be in Washington, DC at the time, confirmed for American Airlines officials that "something has hit the Pentagon." 29 2 Also at 9:42 A.M., the Herdon Command Center learned from news reports that a plane had struck the Pentagon. The Command Center's national operations manager, Ben Sliney, ordered all FAA facilities to instruct all aircraft to land at the nearest airport. This was an unprecedented order. The air traffic control system handled it with great skill, as about 4,500 commercial and general aviation aircraft soon landed without incident.29 3 9:45 A.M. An official at American headquarters called United headquarters to inform them that an aircraft had hit the Pentagon and that American believed it was a U.S. Airways turbojet.2 94 At approximately 10:00 A.M., the Langley fighters established a Combat Air Patrol (CAP) over Washington, DC. By no later than 10:30 A.M., American confirmed that Flight 77 had crashed into the Pentagon.29 5 -fSUfECfT TO CLASSIFICATION- REVIEW 34 -SUBJECTTO CLASSIFICATION REVIEW

1.4 UNITED AIR LINES FLIGHT 93

Hijackers: Ziad Samir Jarrah (pilot); Saeed al Ghamdi; Ahmed al Nami; Ahmad al Haznawi. Hijacker Weapon Purchases. Personal financial records do not reflect weapons purchases by any of the hijackers. However, the FBI recovered 14 knives or portions of knives, including a box cutter, at the Flight 93 crash site. Hijacker Arrival at Airport and Check-in. At 7:03 A.M., Saeed al Ghamdi checked in at the United Air Lines ticket counter at Newark airport but checked no baggage. Ahmed al Nami checked two bags. At 7:24 A.M., Ahmad al Haznawi checked a single bag. Finally, at 7:39 A.M., Ziad Jarrah checked in at the UAL ticket counter; he did not have any luggage. 2 96 Hijacker Prescreening. Only Ahmad al Haznawi was selected by CAPPS. His checked bag was screened for explosives and then loaded on the plane after confirmation that Haznawi was on board. 9 Checkpoint Security Screening. Because Newark Airport, like Logan in Boston, did not use video cameras to monitor activities at security checkpoints, we could not establish with certainty how the five hijackers were processed when they passed through security screening. To reach their departure gate, after checking in, the hijackers had to pass through a single checkpoint that serviced United Air Lines flights from the concourse from which Flight 93 departed. The checkpoint was the custodial responsibility of United Air Lines and operated under contract by Argenbright Security. The FAA interviewed each of the screeners on duty at the checkpoint, and none of them reported anything unusual or suspicious. 29 8 Hijacker Boarding. At 7:39 A.M., Haznawi and Ghamdi boarded the aircraft. Haznawi sat in 6B (first class) and Ghamdi in 3D (first class). At 7:40 A.M., Nami boarded and sat in 3C (first class). At 7:48 A.M., Jarrah boarded and sat in 1B (first class).299 Flight Profile. In September 2001 and during certain other periods earlier in the year, United Air Lines Flight 93 provided daily, nonstop service from Newark (Liberty) International Airport in New Jersey to San Francisco International Airport. 300 On September 11, it was scheduled for an 8:00 A.M. departure.301 The aircraft was a Boeing 757. Tail number N591UA. The plane was piloted by Captain Jason Dahl and First Officer Lee Roy Homer. Five flight attendants provided cabin services:

• Chief flight attendant Deborah Welsh, assigned to seat seat Jl in first class;
• Sandra Bradshaw, assigned to seat J5 in coach;
• Wanda Green, assigned to seat J4 in first class;

-SBJE-FCT-TO-CftASSfFCA-TiONRE-VffiVW- 35 SUYJEC-T-TOTCLASSIFICATION REVIEW

• Lorraine Bay, assigned to seat J3 in coach; and
• CeeCee Lyles, assigned to seat J6 in coach.302

On September 11, 2001, the flight carried 37 passengers (including 4 hijackers) with two pilot and 5 flight attendants for a total of 44 people on board. Ten passengers were seated in first class, including all four of the hijackers; the other 27 were in coach. There was no business class on Flight 93. 303 The 37 passengers (including the four hijackers) represented a load factor of 20 percent of the plane's passenger capacity of 182. This figure is considerably below the 52 percent average load factor for Flight 93 for Tuesdays in the three-month period prior to September 11; indeed, it represents the lowest load factor among these flights during that time span.304 In this three-month period, Tuesdays were the least traveled day for Flight 93.30 5 There is no evidence that Flight 93 hijackers purchased additional tickets for the flight beyond the ones they used.30 As on the other three flights, all the hijackers were accounted for in checking in and boarding the flight, and according to United's records, no paperwork was filed to indicate that any cockpit jump seat was occupied by anyone other than flight crew. 7 Thus, there is no evidence to suggest that any hijacker was admitted into the cockpit and permitted to sit in a jump seat prior to the takeover. On Flight 93, the cockpit key was kept in a storage compartment in the front of the airplane. It was United Air Lines' policy at the time not to provide individual flight attendants with a key to the cockpit door.308 Flight 93 was loaded with 48,700 pounds of fuel, which was a normal amount for the flight. 309 The Flight. At 8:00 A.M., Flight 93 pushed back from gate 17A at Newark Airport and taxied to its departure area. Because of typical local air traffic congestion, the flight was delayed 42 minutes.310 It remained in a holding status until 8:42 A.M., when it departed.31 9:02 A.M. The flight reached its cruising altitude of 35,000 feet. 312 Under normal circumstances, the pilot would turn off the seatbelt sign once the aircraft reached cruising altitude, usually about 20 minutes into the flight.313 Upon commencement of cabin service, it is likely that flight attendants Deborah Welsh and Wanda Green would have worked in first class, while Lorraine Bay, CeeCee Lyles, and Sandra Bradshaw would have been in coach.314 Beginning at 9:03 A.M., several dispatchers sent ACARS messages to several United flights indicating that aircraft had crashed into the World Trade Center. These messages provided no details or warnings, however. -U~_F~f_pFfff7~t-CTT&ASS1HCATlGAhE{ 3366l~ZX SUBJECTTTCrASSFiCATIOTNREVIEW 9:08 A.M. Ballinger, the United flight dispatcher, began to send out ACARS messages notifying United's transcontinental flights that had not yet taken off that a ground stop had been ordered for commercial aircraft in the New York area.315 At 9:19 A.M., shortly after he became aware of the second crash into the World Trade Center, Ballinger began sending cockpit warnings via text messages to the 16 transcontinental flights under his jurisdiction, including Flight 93. The messages were sent out in groups; Flight 93 received its message several minutes later.3 16 This represented the first occasion on 9/11 when either American or United sent out such a warning to their airborne aircraft. 9:21 A.M. Ballinger received a routine ACARS message from the aircraft: "Good momin' . .. Nice clb [climb] outta EWR [Newark airport] after a nice tour of the apt [apartment] courts y [and] grd cntrl. 20 N EWC At 350 occl [occasional] It [light] chop. Wind 290/50 ain't helping. J." The last notation was presumably the signature for Captain Jason Dahl, who was personally acquainted with the dispatcher.3 7 Also at 9:21 A.M., the UAL air traffic control coordinator sent out a message to UAL dispatchers: "There may be Addnl hijackings in progress. You may want to advise your fits to stay on alert and shut down all cockpit access Inflt. [inflight] Sandy per Mgmt." 3 18 9:22 A.M. An ACARS text message was sent to First Officer LeRoy Homer at the request of his wife, who was concerned about her husband after hearing about the attacks on the World Trade Center.319 9:23 A.M. Ballinger sent an ACARS message to Flight 93's flight deck: "Beware any cockpit intrusion-Two a/c [aircraft] hit World Trade Center." This was the same message the dispatcher had begun transmitting to the airline's transcontinental flights at 9:19 A.M. in response to information United headquarters had received about the hijacking of Flight 175 and the events at the World Trade Center. 320 After reporting experiencing some "light chop" at 35,000 feet, Flight 93 was handed off to Cleveland Air Traffic Control Center (Cleveland Center).32 Several seconds later, Flight 93 established radio contact with Cleveland Center: "Morning Cleveland, United Ninety-three with you at, three-five-oh (35,000 feet), intermittent light chop."322 The controller did not respond to this initial transmission as he had sixteen flights under his control, and was issuing new routes to several aircraft based upon the decisions in New York and Boston to ground-stop all aircraft. 323 9:25 A.M. Flight 93 again radioed Cleveland Center, checking in at 35,000 feet. The controller replied, "United ninety-three, Cleveland, roger." 324 At approximately 9:25 A.M., FAA headquarters requested the Herdon Command Center to "get an awareness up to all the traffic management coordinators or the traffic management units to report any unusual circumstances direct to the Command Center of loss of identification, or any radio, uh, any unusual radio transmissions."325 -StBJECfT TO CLASTF N RVIE-- 37 ,SUBJECT-TO CCASSIFICATION REVIEW 9:26 A.M. The Cleveland controller handling Flight 93 engaged in conversations with several aircraft about the evolving "serious" situation in New York City and the prospects for flights to be allowed to land in Philadelphia. 326 Also at 9:26A.M., Flight 93 asked for confirmation of the ACARS message sent at 9:23 A.M. and received in the cockpit at 9:24 A.M. "Ed cofirm latest mssg plz--Jason."3 27 9:27A.M. The Flight 93 flight crew responded to routine radio contact from the FAA air traffic control center in Cleveland. This was the last communication from the flight's cockpit crew.328 The Hijacking. At 9:28 A.M., the hijackers began their takeover of the aircraft. They wielded knives (reported by at least five callers); engaged in violence, including stabbing (reported by at least four callers and indicated by the sounds of the cockpit struggle transmitted over the radio); relocated the passengers to the back of the plane (reported by at least two callers); threatened use of a bomb, either real or fake (reported by at least three callers); and engaged in deception about their intentions (as indicated by the hijacker's radio transmission received by FAA air traffic control). 9:28 A.M. The aircraft was traveling 35,000 feet above eastern Ohio. It suddenly began to descend, dropping 685 feet over the next half minute. Eleven seconds into the descent, Cleveland Center overheard the first of two radio transmissions from the Flight 93 cockpit. The captain or first officer declared "Mayday" amid sounds of a physical struggle in the cockpit. 329 While the controller did not understand what was said, he began to try to identify the possible source of the transmissions and noticed Flight 93's rapid descent. The Cleveland controller replied over the radio: "Somebody call Cleveland?" 33 0 There was no reply. The second radio transmission, 35 seconds later, indicated that the clash was still in progress. The captain or first officer shouted: "Hey get out of here-get out of here-get out of here." 33 1 The screaming in this second radio transmission was heard by the Cleveland controller responsible for Flight 93. 332 While this appears to show the exact time that the hijackers invaded the cockpit, we have found no conclusive evidence to indicate precisely when the terrorists took over the main cabin or moved passengers seated in the first-class cabin back to coach-a tactic reported by several passengers during phone calls to parties on the ground. We believe that it is most likely that the four hijackers breached the cockpit at the same time that they took over the front of the plane and pushed passengers back into the coach cabin. Taking over the cabin first would likely have alerted the flight deck to a problem, and waiting to control or move passengers once the cockpit was secured would have increased the risk of passenger intervention, particularly if the passengers had witnessed the hijackers displacing the crew from the controls. .StfTJECT TOCLASTFTCATION REVIEW The terrorists who hijacked the three other commercial flights on 9/11 operated in five- 38 SUBJECTTOCLASSSIFICATION REVIEW man teams. They initiated their cockpit takeover operations within 30 minutes of takeoff, most likely after the seatbelt sign had been turned off and the flight attendants were beginning cabin service. On Flight 93, however, there were only four hijackers. They waited approximately 46 minutes after takeoff to begin their assault. We were unable to determine why they waited so long. At approximately 9:30 A.M., air traffic control informed United headquarters that Flight 93 was not responding to attempted radio contacts.333 9:30 A.M. The Cleveland controller began to poll the other flights on his frequency to determine if they heard the screaming; several said they had.3 At approximately 9:31 A.M., the National Traffic Management Officer on duty at the Hemdon Command Center relayed to air traffic control facilities (including Cleveland Center) the request from FAA Headquarters to report any unusual circumstances to the Command Center. 9:31 A.M. United dispatchers were advised by United headquarters officials that there was a potential problem with Flight 93. The airline's air traffic control coordinator and another employee each sent an ACARS message to the flight asking it to establish radio contact with air traffic control. There was no response to these or any subsequent ACARS messages. 33 5 9:32 A.M. 336 The Cleveland controller overheard a transmission of threatening language from Flight 93: "Ladies and Gentlemen: Here the captain, please sit down keep remaining sitting. We have a bomb on board. So, sit." The cockpit voice recording also indicates that a woman, most likely a flight attendant, was being held captive in the cockpit. Moments after hearing the threatening transmission from Flight 93, Cleveland Center reported to the Hemdon Command Center that the flight may have a bomb on board. 337 Also at 9:32 A.M., Ballinger began sending a new ACARS message ("High security alert. Secure cockpit.") to his flights. This communication was transmitted to Flight 93 at 9:33 A.M.3 38 9:34 A.M. Hemdon Command Center relayed the reports it had received on Flight 93 to FAA headquarters. Between 9:34 A.M. and 9:38 A.M., the Cleveland controller observed Flight 93 climbing to 40,700 feet and immediately moved several aircraft out of its way. The controller continued to try to contact Flight 93, and asked whether the pilot could confirm that he had been hijacked.339 There was no response. As the flight continued to climb, the controller moved decisively to clear the other flights in his sector from Flight 93's path. Additionally, between 9:34 A.M. and 10:08 A.M., a Hemdon Command Center facility manager provided several updates to the FAA Deputy Administrator and other executives at the agency's headquarters as Flight 93 approached the Washington, DC area. .SEBCT-J -fT C-ASSIFICATION-REVIEW 39 -SUBJECT TO CLASSIFICATION REVIEW At approximately 9:36 A.M., Cleveland Center advised the Hemdon Command Center that they were still tracking Flight 93 and inquired specifically whether someone had requested the military to launch fighter aircraft to intercept the flight. They added that they were prepared to contact a nearby military base to request fighter aircraft assistance. The Command Center told Cleveland Center that FAA personnel above them in the chain of command had to make the decision to request military assistance.340 9:36 A.M.3 41 A flight attendant contacted the United Air Lines maintenance facility in San Francisco. (The same facility that the flight attendant aboard United 175 had called to report the hijacking of that flight). The San Francisco phone number is one that flight crews know to call in order to report mechanical and systems problems, obtain advice on troubleshooting, and request maintenance while in flight. Her call was first answered by a United maintenance employee and was subsequently taken over by a manager at the facility. The manager described the flight attendant as "shockingly calm." The flight attendant, reporting from the back of the plane, told the maintenance employees that hijackers were in the cabin behind the first-class curtain and in the cockpit. They had announced they had a bomb on the plane. The hijackers had pulled a knife. They had killed a flight attendant. The manager reported the emergency to his supervisor, who passed the information to the United Air Lines crisis center. The manager then instructed the air phone operator to try and reestablish contact with the plane, but the effort was unsuccessful. This began a series of calls from the flight that provided vital information both to the ground and to the passengers. At least two callers from the flight reported that the hijackers knew that passengers were making calls but did not seem to care. The cockpit voice recorder does not provide evidence of whether Jarrah, the pilot, was aware of these calls or indicate why the hijackers allowed them to take place. At least ten passengers and two crew members shared vital information with family, friends, colleagues, or others on the ground, including: 343 the plane had been hijacked; the hijackers wielded knives; the hijackers had entered the cockpit; the hijackers had a bomb; hijackers wore red bandanas; passengers were forced to the back of the aircraft; a passenger had been stabbed (reported by at least two callers), and the victim had died (reported by one); two individuals were lying on the floor of the aircraft injured or dead, possibly the captain and first officer; and a flight attendant had been killed. The calls provided information very similar to that received from the other hijacked aircraft, including the hijackers' use of knives, violence, the threat of a bomb, relocation of passengers to the back of the aircraft and cockpit intrusion. There is, of course, no means of ascertaining the location of callers who were using cellular phones inside the aircraft. However, calls were made from air phones installed in the last nine rows of the aircraft. The air phone system aboard the flight limited to eight the number of calls that could be made at one time.34 -SU-BJEC-TTO( CLASSiFI-CAT-ON-REVIEW i 40 ·-SUMECTTO CLASSIFICATION REVIEW 9:36A.M. Flight 93 reversed course and headed east. The hijackers struggled to control a defiant hostage, most likely a flight attendant in the cockpit, eventually killing or otherwise silencing her. 345 Also at 9:36A.M., the United manager of flight dispatch operations advised Ballinger that Flight 93 was "off track, heading for D.C." By this point, United headquarters believed the aircraft had been hijacked. 34 Another UAL dispatcher, assisting Ballinger, sent an ACARS message to Flight 93, asking, "How's the wx.(?) Can dispatch be of any assistance?" 34 8 9:3 7A.M. A passenger called his mother. He told her that he was on United Air Lines Flight 93 and it was being hijacked; that the plane had been taken over by three guys, and that they said they have a bomb.34 9 One of the key mysteries associated with Flight 93 is that at least five passengers described the presence of three hijackers on the plane, rather than the four who were actually aboard.3 50 Some have wondered whether such reporting might suggest that one of the hijackers was positioned in the cockpit from the outset of the flight and remained unseen by the passengers. FAA rules allowed commercial air carriers to permit properly credentialed and approved individuals, usually air carrier personnel such as pilots or operational personnel, to ride in the cockpit jump seat (located directly behind the pilot and first officer).3 51 We cannot know with certainty whether a hijacker had gained access to the cockpit prior to the violent takeover of the aircraft, but we believe it unlikely that a hijacker occupied the jump seat prior to the takeover. All four of Flight 93's hijackers were issued tickets for seats in the first-class cabin and used their tickets to enter the aircraft. None of the paperwork required by United Air Lines to authorize a jump seat occupant for Flight 93 had been filed.3 52 One of the passengers who contacted a party on the ground reported that ten first-class passengers were on the flight. This figure is consistent with the four terrorists and the six nonhijackers who boarded the aircraft holding tickets for first-class seats.353 Five of the six nonhijacker passengers in first-class seats contacted the ground by phone to share information about the hijacking. 35 4 These individuals would have been best positioned to observe whether a passenger among them had gotten up during the flight and entered the cockpit before the violent takeover of the aircraft. None of the callers reported the occurrence of such an event Moreover, the pilot and co-pilot of Flight 93 were experienced, well-regarded professionals, unlikely to allow any observer into the cockpit, pre- or post-takeoff, who had not obtained the permission needed for such privileges.355 Finally, the pilot hijacker was the critical link in the terrorist operation. It is reasonable to expect that the hijackers would take all precautions necessary to protect the one among them required to fly the plane. Given their unwillingness to risk his death or injury during -SUtIJECT TO CLASSFICATION REVIEW- 41 SUB eTitf~_c ' H7eA7*""~~tLO~T N REVIEW the takeover of the aircraft, it made operational sense for the pilot hijacker to remain seated and inconspicuous until he was needed, most likely after the cockpit had been seized. 9:37A.M. A passenger made the first of several calls to his wife. During these calls, he reported that: the plane had been hijacked; the hijackers claimed to have a bomb; and a passenger had been knifed. He thought one of them had a gun. He didn't think they had a bomb because he couldn't see it. The passenger asked his wife if she had heard about any other planes. His wife informed him about the World Trade Center. The passenger asked if the planes that crashed into the towers were commercial. In one of the later calls to his wife, the passenger reported that the passenger that had been knifed had died; that "they" were in the cockpit; and that a group of passengers were getting ready to do something. Between 9:3 7A.M. and 9:57A.M., a passenger was in contact his wife and his mother-inlaw, who immediately called 911 on her cell phone. The passenger told his family that Flight 93 had been hijacked by three "Iranian-looking" males, with dark skin and bandanas; one of the males stated that he was in possession of a bomb in a red box and one was armed with a knife; the captain had not made any announcements; the hijackers had herded the passengers into the rear of the plane; the three hijackers had entered the cockpit. He and other passengers were contemplating "rushing" the hijackers; he did not observe any guns in the possession of the hijackers; the passengers were voting on whether to storm the cockpit and retake control of the airplane.5 9:39 A.M. The Cleveland Center controller overheard the following radio transmission from Flight 93: "Uh, is the captain. Would like you all to remain seated. There is a bomb on board and are going back to the airport, and to have our demands [unintelligible]. Please remain quiet."3 It is quite possible Jarrah knew that the attacks on the World Trade Center had succeeded. Text messages sent by United Air Lines to the cockpits of its transcontinental flights, including Flight 93, warned of possible cockpit intrusion and told of the attacks in New York. 359 But even if Jarrah had not read these messages, he must have understood, given Flight 93's tardy departure from Newark, that the attacks on the World Trade Center would already have unfolded. If he knew that the passengers were making calls, he must have failed to understand that they were sure to lear of the New York attacks and would immediately see through his ruse that the aircraft was simply "returning to the airport." 9:39 A.M. A passenger called her husband and left a message that the flight had been hijacked.36 0 9:40 A.M. The United air traffic control coordinator for West Coast flights notified the Herdon Command Center that Flight 93 was not responding to the airline's attempts to contact it. It was also off course.361 -SUB-JECT TO CLASSIFICATION VIEW 42 -SUBJECT-TO-CLASSFICATION REVIEW 9:40 A.M. As he continued to update his 9:32 A.M. "secure cockpit" message to his flights, Ballinger sent the following ACARS transmission to Flight 93: "High security alert. Secure cockpit. Two airliner hit NY Trade Center. And 1 aircraft in LAD missing. And one in EWR missing ... too. UAL 175/93 missing." At 9:41 A.M., the dispatcher sent the same message to Flight 93, with the following addition at the end: "UAL 175/93 found." 36 2 9:41 A.M. The transponder on the plane was turned off.3 63 The Cleveland controller located the aircraft on primary radar, and matched his reading with visual sightings from other aircraft to follow the Flight 93 as it turned east and, ultimately, south.364 9:41 A.M. The Herdon Command Center notified headquarters that Flight 93 had reversed course from its intended flight path and was descending and heading eastbound.36 5 9:42 A.M. While Command Center employees informed FAA field facilities of the order to land all aircraft, one of the Command Center managers continued to give FAA headquarters several updates on the progress and location of Flight 93. 9:43 A.M. A passenger contacted his father to inform him that his flight had been hij acked. 366 9:44 A.M. A passenger contacted GTE air phone operators. His connection lasted for the remainder of the flight. He noted the following: The flight had been hijacked, and the captain and first officer were lying on the floor of the first-class cabin and were injured or possibly dead. One of the hijackers had a red belt with a bomb strapped to his waist. Two of the hijackers, who had knives, entered the cockpit and closed the door behind them. At some point the hijackers closed the curtain between first class and coach so that passengers could not see into first class; those in the rear of the plane were not being monitored by the hijackers. The plane was going up and down and had turned or changed direction. He and some other passengers were planning something and he was going to put the phone down. At some point between 9:45 A.M. and 9:50 A.M., the United station operations control manager received a report from the San Francisco maintenance office about the call from the Flight 93 flight attendant advising that the aircraft had been hijacked. He immediately passed this information on to Ballinger and the crisis center. He also attempted to initiate a lockout of Flight 93. The United computer system, however, was not set up at that time to deal with two such procedures simultaneously 367 -and United had already effected a lockout of Flight 175. 9:46 A.M. A United employee at the maintenance facility in San Francisco sent the following ACARS message to Flight 93: "Heard report of incident. Plz confirm all is normal." ·- &BjECToLAPS StICFeATtN-REVEVl \ 43 - SUBJECT TO CLASSIFICATION REVIEW Also at 9:46 A.M., a passenger contacted her sister and left a voice mail message: her flight had been hijacked by terrorists and they said they had a bomb; she knew that terrorists had already flown a couple of planes into the World Trade Center; it looked like they were going to take this one down as well.36 8 Also at 9:46 A.M. the Herdon Command Center updated FAA headquarters that Flight 93 was tracking towards Washington, DC and was 29 minutes away from the city. 369 9:48 A.M. A flight attendant called her husband, using an air phone, and left a message: the aircraft had been hijacked; there were three hijackers; the plane had turned around; and she'd heard that planes had flown into the World Trade Center. 370 9:49 A.M. A passenger called her boyfriend: her plane was hijacked; the hijackers had cut two passengers' throats; she knew that two planes had crashed into the WTC.3 71 9:49 A.M. Thirteen minutes after initially questioned by Cleveland Center about getting military help, Herdon Command Center suggested to FAA headquarters that someone should decide whether to request military assistance. 372 9:50 A.M. Ballinger continued to send ACARS messages to the airline's transcontinental flights, including Flight 93, advising them to "land ASP at nearest UAL airport-ORD terrorist. No one in to cockpit-Land asp." He sent a second message advising the aircraft to land anywhere as soon as possible. He sent the same message again one minute later.373 9:50 A.M. A flight attendant called her husband to report the emergency. The call lasted approximately eight minutes. She seemed to be aware of the other hijackings that morning. Her husband told her he was watching the television and confirmed to her that two planes had crashed into the World Trade Center. The flight attendant told her husband that the plane had been hijacked by three men. She said the hijackers were carrying knives and had put on red headbands as they were hijacking the plane. She said that the passengers had been moved to the rear of the plane and that the hijackers were up front. She said that she thought the plane may have been over the Mississippi because they were passing over a large river. She said that the passengers were discussing how to overpower the hijackers, including preparing hot water to throw on the hijackers and then to rush them. 9:53 A.M., FAA headquarters informed Hemdon Command Center that the Deputy Director for Air Traffic Services was talking to Deputy Administrator Monte Belger about scrambling aircraft.374 9:54 A.M. A passenger phoned her stepmother and told her that the plane had been hijacked. The call lasted approximately four and a half minutes. Before hanging up, the passenger said she had to go because they were trying to break into the cockpit.37 --SUBJECT TO CLASSIFICATIONREVIEW 44 -SSBE-- CTTO CLASS IFICATION REVIEW 9:55 A.M. The pilot hijacker, presumably Jarrah, dialed into the flight computer the navigational code for Reagan National Airport, in order to fly the aircraft toward Washington, D.C. 376 An air phone operator, who had been on the line with a passenger since 9:44 A.M, heard someone say: "Are you guys ready? Okay! Let's roll!" Shortly thereafter she heard screaming followed by silence.377 9:56 A.M. Hemdon Command Center informed FAA headquarters they lost track of Flight 93 over the Pittsburgh area. 378 Within seconds, the Command Center relocated Flight 93 and informed headquarters. The Flight attendant who had called her husband at 9:50 A.M. ended her phone call. She said, "Everyone is running up to first class. I've got to go. Bye." She hung up the phone.379 9:57A.M. The passengers began their revolt. The sounds of the passenger uprising captured by the cockpit voice recorder suggest that a great struggle began at the back of the airplane and progressed toward the front. The evidence from the CVR indicates that the struggle continued for the duration of the flight.380 9:58 A.M. A passenger called 911 in Westmoreland County, Pennsylvania, from his cell phone to report a hijacking in progress.3 81 Also at 9:58 A.M., a flight attendant contacted her husband by cell phone. She told him again that the plane had been hijacked and they were forcing their way into the cockpit.3 82 In response to the passenger revolt, Jarrah immediately began to roll the airplane to the left and right, attempting to knock the passengers off balance. At 9:58:57, Jarrah told another hijacker in the cockpit to block the door. Jarrah continued to roll the airplane sharply left and right, but the assault continued. At 9:59:52, Jarrah changed tactics and pitched the nose of the airplane up and down to disrupt the assault. The recorder captured the sounds of loud thumps, crashes, shouts, and breaking glasses and plates. At 10:00:03, Jarrah stabilized the airplane. 383 Five seconds later, Jarrah asked, "Is that it? Shall we finish it off?" A hijacker responded, "No. Not yet. When they all come, we finish it off." The sounds of fighting continued outside the cockpit. Again, Jarrah pitched the nose of the aircraft up and down. At 10:00:26, a passenger in the background said, "In the cockpit. If we don't we'll die!" Sixteen seconds later, a passenger yelled "Roll it!" At this same time, Hemdon Command Center advised FAA headquarters that "United ninety three was spotted by a VFR at eight thousand feet, eleven, eleven miles south of Indianhead, just north of Cumberland, Maryland.3 84 - -STJ-ECT-T4O-CLASS-IFCATION REVI-EW 45 -SUBJEeTTO-CLASSTIFCATtON-REVIEW At about 10:01 A.M., Jarrah stopped his violent maneuvers and said, "Allah is the greatest! Allah is the greatest!" He then asked another hijacker in the cockpit, "Is that it? I mean, shall we put it down?" to which the other replied, "Yes, put it in it, and pull it down." 385 At 10:01 A.M., two minutes before Flight 93 crashed, Command Center updated FAA headquarters that the flight was "rocking its wings." 386 The passengers continued their assault and at 10:02:23, a hijacker said, "Pull it down! Pull it down!" The hijackers remained at the controls but must have judged that the passengers were only seconds from overcoming them. The airplane headed down; the control wheel was turned hard to the right. The airplane rolled onto its back, and one of the hijackers began shouting "Allah is the greatest. Allah is the greatest."3 8 7 10:03:11 A.M. With the sounds of the passenger counterattack continuing, Flight 93 crashed into an empty field in Shanksville, Pennsylvania, at 580 miles per hour, about 20 minutes' flying time from Washington, D.C.3 88 I' 10:07A.M. Unaware that the aircraft had already crashed, Cleveland Center notified NEADS that Flight 93 had a bomb onboard and passed them the aircraft's last known latitude and longitude. NEADS was never able to locate Flight 93 on radar because it had already crashed. The call was the first notification the military - at any level - received about Flight 93.389 No one from FAA headquarters, which was informed of the hijacking at 9:34 A ·X · o....... +^ 1;. .... ar;,, ... A.M., ICQUt;liLU lUlIlt ly il.5b11il1C regarding Flight 93. In fact, the executive level managers at FAA headquarters did not forward to the military any of the information they received from Hemdon Command Center regarding Flight 93.3 10:10 A.M. Ballinger sent an ACARS message to Flight 93: "Don't divert to DC. Not an option." He sent the same message again one minute later. Also at 10:10 A.M., when the information that Flight 93 had turned off its transponder and had a potential bomb on board reached the mission crew commander, he was dealing with the arrival of the Langley fighters over Washington DC and what their orders were with respect to potential targets. While NEADS searched for the radar track on Flight 93, the Mission Crew Commander instructed his Weapons Director on the current rules of engagement (ROE) for the fighters, stating that they did not have clearance (permission) --SUBJECT TO CLASSIFICATION REVIEW 46 -S-BJECTrT O CLASSiCATREVto shoot down targets and that their tasking was to identify aircraft by type and tail number. 391 At approximately 10:11 A.M., as the news of a bomb on board Flight 93 spread throughout the floor, the Mission Crew Commander tried to locate fighter assets to scramble toward the plane. He established contact with an Air National Guard Unit in Syracuse, New York to expedite launching aircraft to respond to Flight 93. The Syracuse unit reported that it would be able to launch fighters with loaded guns (no missiles) in "approximately 15 minutes." 3 92 10:13 A.M. The Hemdon Command Center advised FAA headquarters of its conclusion that Flight 93 had crashed.3 93 10:15 A.M. NEADS contacted Washington Center to provide them with an update on the situation with Flight 93, only to be informed by the center that Flight 93 had crashed. 394 By this same time, United headquarters had confirmed that an aircraft had crashed near Johnstown, Pennsylvania, and believed that this was Flight 93.395 10:17A.M. An operational alert message was sent out to United Air Lines personnel from Andy Studdert: "UAL 93-11 EWR-SFO has been involved in an accident. Crisis Center has been activated."396 10:27A.M. United Air Lines advised American Airlines of the crash of Flight 93.39 7 10:31 A.M. NEADS received its first official ROE for their fighters (via a NORAD instant messaging system) stating that the Vice President had authorized the military to shoot down tracks that did not respond to their direction. 398 The NEADS air defenders expressed considerable confusion over the nature and effect of this specific ROE in interviews with Commission staff. 399 Indeed, Colonel Marr indicated to staff that he actually believes he withheld the ROE from the NEADS floor for several minutes because he was unsure of its ramifications,400 while both the Mission Crew Commander and the Weapons Director indicated that they withheld the order from the pilots flying Combat Air Patrol over Washington, DC and New York City because they were unsure how the pilots would or should proceed with such guidance.4 0

1.5 HIJACKER TACTICS

Flight Selection. The hijackers strategically planned the flights they chose-early morning departures from East Coast airports aboard large Boeing 757 and 767 for which they had trained. The planes carried large amounts of fuel for their transcontinental flights, maximizing the destructive power of the crash. Ticket Purchase and seating. Each of the hijackers purchased a ticket between mid- and late August. There is no evidence to suggest that the hijackers or their associates purchased unused tickets for the hijacked flights. The seats selected by each hijacker c--cr Tarr/llFrfCtczr-hCslFXSATJ_abL-s2�Fw;-t� 47 -SUBJECTTO CLASSIFICATION REVIEW team appear to have been determined by aircraft type. The Boeing 757 was a single-aisle plane; the Boeing 767 had two aisles. Thus for Flights 77 and 93 (both 757s), the probable hijacker pilot was seated in the very front of the plane, a position that gave him ready access to the cockpit. The other hijackers were seated close behind in first class (or, in the case of two hijackers on Flight 77, in the forward part of coach), covering both sides of the aisle. For the twin-aisled Flights 11 and 175, a layout that offered more operational maneuverability, the hijacker pilot sat in business class with accomplices both in front in first class and just behind, covering both aisles. The seating arrangements chosen by the hijackers facilitated the isolation of the front of the aircraft and the hijacker pilot's entry into the cockpit. 402 Cockpit Access. Exactly how the hijackers gained access to the cockpit is not known. The strength of the cockpit doors in use on 9/11 would not have precluded forced entry. 403 However, cockpit keys were available aboard the aircraft.404 On September 11, 2001, a single key fit the cockpit doors of all Boeing 757 and 767 aircraft. While the hijacking response doctrine, known as the commercial aviation community's "Common Strategy," taught the flight crew to try to keep hijackers out of the cockpit, it above all urged nonconfrontation and cooperation.405 There is no way to know whether the terrorists had access to a key; but if not, access to the cockpit could be gained by luring the pilots out of the cockpit, threatening violence, or forcing the door open. There was no evidence to suggest any of the hijackers sat in a jump seat in the cockpit. Each of the hijackers had an assigned seat and appears to have used it.406 Weapons and Tactics. The hijackers likely gained control of the forward section of the cabin after the aircraft's seatbelt sign was turned off, the flight attendants had begun cabin service, and passengers were allowed to begin to move around the cabin. The hijackers took over the aircraft by force or threat of force, as reported on all four flights. Records of purchases by the hijackers, as well as evidence discovered at the crash sites (primarily the site of Flight 93), indicate that the primary weapons of choice were knives with a blade less than 4 inches long. 40 8 The use of knives was cited on all four flights by flight crew and passengers. Box cutters were specifically indicated only in one report from Flight 77. A box cutter-type implement, along with a variety of short-bladed knives, was found at the crash site of Flight 93. The hijackers gained access to the cockpit and sealed off the front of the aircraft from the passengers and cabin crew, moving them to the back of the aircraft. This was reported, with slight variation, on all four flights. Reports from two of the hijacked aircraft (Flights 11 and 175) indicated the presence of Mace in the cabin. Both Mace and other irritants such as pepper spray were items specifically prohibited under FAA rules. We believe the terrorists created a "sterile" area around the cockpit by isolating the passengers and attempting to keep them away from the forward cabin. The hijackers used the threat of bombs to frighten and control the passengers. This was reported on all flights except Flight 77. The hijackers also used announcements on Flight 11 and Flight 93 that -SFBJffe TOeCLASSIFICATION REV-IEW 48 -SUBJECTTO CLASSIFICATION REVIEW the aircraft was returning to the airport to make passengers believe they were in no immediate danger if they cooperated. Initially, these tactics, techniques, and communications resembled those of a traditional hijacking for the purpose of taking hostages or transportation. This was the scenario that the "Common Strategy" was designed to address. As the hijackings progressed, however, there was evidence of growing awareness on board the aircraft that something beyond a traditional hijacking was under way. Callers from both Flights 11 and 175 noted early in the process very erratic flying patterns and talked about the possibility that the hijackers were piloting the aircraft. One Flight 175 passenger predicted the hijackers intended to fly the aircraft into a building. Another said the passengers were considering storming the cockpit. Later, well into the hijacking of Flight 77, at least one passenger was told that two planes had crashed into the World Trade Center. In the case of Flight 93, the growing awareness among the passengers and crew of what had already occurred on other flights spurred a revolt. Pilot Training. To successfully carry out the 9/11 attacks, at least one member of the team had to be able to pilot the plane, navigate it to the desired location, and direct it into the intended target. These tasks required adequate training and preparation. FAA and FBI records show that 4 of the 19 hijackers, one aboard each flight, received flight training, possessed FAA certificates as qualified pilots and honed their skills at flight simulator facilities.409 FAA certification required that a candidate complete a certain amount of flight training and pass both a written exam and a practical skills test.410 Each of the four pilots received flight training in the United States, which is recognized as having one of the world's most advanced pilot training education and certification systems in the world; thus many pilots from many nations train here.411 Of the five hijackers on Flight 11, only Mohamed Atta held a certificate from the FAA as a qualified private and commercial pilot, including a rating in operating multi-engine aircraft. Atta received his commercial pilot certificate in December 2000.412 He also received Boeing flight simulator training. According to experts consulted by Commission staff, the simulator familiarized a pilot with the cockpit controls and the proper operation of the Boeing 757 and 767. It gave the pilot the operational proficiency, "feel," and confidence necessary to fly the aircraft. It was essential training for the hijacker pilots.413 Knowledge of the aircraft, including its flight management system computer and autopilot function, could be gained through simulator training, the operational manual (which was widely available), and flight simulator software sold by many public outlets.4 14 Flight manuals and instruction videotapes were found among the belongings left behind by the hijackers. Knowledge of the aircraft, including its flight management system computer and autopilot function, could be gained through simulator training, the operational manual (which was widely available), and flight simulator software sold by many public outlets.4 14 Flight manuals and instruction videotapes were found among the belongings left behind by the hijackers. SUBJECT TO CLASSIICATIOT REVfW 49 SUBJECTTO-CLAS SIF-CAT-NREVTEW Of the five hijackers aboard Flight 175, only Marwan al Shehhi held an FAA pilot certification. Shehhi earned his commercial pilot certificate in December 2000, on the same day and at the same school as Atta. He also received Boeing flight simulator training.41 Of the five hijackers aboard Flight 77, Hani Hanjour alone had completed flight training. He received his commercial multi-engine pilot certificate from the FAA in April 1999. He had extensive flight training in the United States, and was perhaps the most experienced and highly trained pilot among the 9/11 hijackers.4 16 The Pentagon, his target, was particularly difficult to hit because of its low profile. Ziad Jarrah was the only one of the four hijackers aboard Flight 93 with flight training and FAA pilot certification. Jarrah was awarded his private pilot certificate from the FAA in November 2000. He also received Boeing flight simulator training. Jarrah had logged only 100 flight hours, and did not possess a commercial pilot certificate or multi-engine rating.4 Flying the Aircraft. Their training enabled the pilots to hit their intended targets. The onboard Flight Management System in use could be programmed in such a way that it would navigate the aircraft automatically to a location as precise as a building, at a speed and altitude of the hijacker's choosing, provided the hijackers possessed the precise positioning data necessary. 418 The "black box" flight data recorders recovered from Flight 93 and Flight 77 indicate that the hijacker pilots used navigational codes for the Washington, D.C., area. Financial records indicate that Jarrah, the hijacker pilot of Flight 93, had purchased a global positioning satellite system. 419 He had attempted to buy four GPS units, but only one was available. Whether the hijackers flew the aircraft manually, engaged the Flight Management System to take them to a programmed destination, or employed some combination of both methods, experts consulted by the Commission staff believe their training and experience adequately prepared them to complete the mission.420

SUmmary tables

to copy

Part 2

to copy SUBJECT TO CLASSIICATIOT REVfW 49

References

from [1]