START HERE
Command, Response, and the Flights
EXPLORE THE RECORD · PATHWAY 2 OF 7 · Last Update 9/25/26
On September 11, four passenger aircraft were hijacked while civilian aviation, military air defense, and national command systems tried to understand and respond to an attack already underway.
The question is not whether officials responded. It is what each part of the system knew, when it knew it, and what orders actually reached the people who could act.
The Flights · Air Defense · Chain of Command
Three Ways Into the Evidence
Start with the part of the morning you most want to understand.
- FAA — Federal Aviation Administration; civilian air traffic and aviation system.
- NORAD — North American Aerospace Defense Command; continental aerospace defense.
- NEADS — Northeast Air Defense Sector; NORAD sector responsible for the Northeast on 9/11.
- NMCC — National Military Command Center; Pentagon command and communications hub.
FLIGHTS AND NOTIFICATIONS
Follow the Morning
Four hijacked flights moved through different FAA centers while information reached the military through separate and sometimes delayed channels.
When did each part of the system understand what was happening?
COMMAND AND AUTHORITY
Who Was in Command?
On paper, the chain of command was clear. In practice, the FAA, NORAD, NEADS, NMCC and the White House were operating through different conferences, receiving different information and exercising different kinds of authority.
Who was actually in command—and how did authority move between them?
EXERCISES AND AIR DEFENSE
What Exercises Were Underway?
NORAD was conducting Vigilant Guardian while also responding to real-world Russian bomber activity.
What was active, what was paused—and what operational effect can actually be established?
FLIGHTS AND NOTIFICATIONS
Five Key Moments in the Air-Defense Response
FAA facilities often recognized trouble before the information reached military air defenders. Early public timelines did not accurately describe every notification.
8:37:52
Boston Center gives NEADS its first notice: American 11 has been hijacked.
9:03:11
United 175 strikes the South Tower as NEADS receives its first notice of the second hijacking.
9:24
Langley fighters are scrambled in response to the mistaken report that American 11 is still airborne—not a confirmed report about American 77.
9:37:46
American 77 strikes the Pentagon before NEADS is told that the flight has been hijacked.
10:03 / 10:07
United 93 crashes in Pennsylvania at approximately 10:03; NEADS learns of its hijacking approximately four minutes later.
FLIGHT 93 · DOCUMENTED AIRCRAFT
A Documented Aircraft Near the Flight 93 Site
Flight 93 struck the ground at 10:03:11 a.m. FAA records place N20VF, a Falcon business jet descending toward Johnstown, about ten miles from the smoke at 10:07. At 10:08 a Cleveland Center controller asked the aircraft to fly to the site. At 10:11 the Falcon reported the crash coordinates.
The Falcon was not merely somewhere in the region. The FAA record places it near the smoke within minutes of impact and documents its diversion to the site.
That makes N20VF a strong explanation for some post-impact reports of a white corporate jet circling Shanksville. The present record does not make it a complete explanation for witness accounts describing a very low aircraft before or at impact.
Recorded Sequence
Synchronized Evidence Timeline
| Time | Recorded event | Record basis |
|---|---|---|
| 10:03:11 | Official Flight 93 impact time. | Official Flight 93 chronology |
| 10:05 | Gofer 06 reports smoke. | FAA facility record |
| 10:07 | Controller and N20VF exchange information about the smoke; the pilot reports being about ten miles away. | FAA facility record |
| 10:08 | Controller asks N20VF to fly to the site. | FAA facility record |
| 10:11 | N20VF provides crash-site coordinates. | FAA facility record |
Record note: The National Park Service compresses this sequence into a 10:07 entry. The FAA facility record distinguishes the 10:07 smoke exchange from the 10:08 request to fly to the site.
Sources: Flight 93 National Memorial timeline · FAA facility record
The First Public Timeline Gave the Military More Warning
Early official accounts said NORAD had been notified substantially earlier about American 77 and United 93. When Commission investigators later reconstructed the morning from FAA and military recordings, those notification times did not hold.
AMERICAN 77
EARLY ACCOUNT
NORAD was notified about American 77 at approximately 9:24.
RECORDINGS-BASED RECONSTRUCTION
The 9:24 event was the Langley scramble triggered by a mistaken report that American 11 was still airborne—not a confirmed hijacking report about Flight 77.
UNITED 93
EARLY ACCOUNT
NORAD was notified of a possible United 93 hijacking at approximately 9:16.
RECORDINGS-BASED RECONSTRUCTION
United 93 had not yet been hijacked at 9:16. NEADS first received a hijacking notification at 10:07, after the aircraft had crashed.
The response failed—and the first public account gave the military more warning time than the recordings later supported
What remains unresolved: The corrected chronology establishes that key notification claims changed. It does not, by itself, establish why the earlier chronology was presented or why it persisted.
COMMAND AND AUTHORITY
Where Authority Moved—and Where the Record Conflicts
The FAA, NORAD, the National Military Command Center, the White House and the Secret Service entered different conferences and received different information. The surviving recordings and transcripts show delayed connections, conflicting aircraft reports and orders that did not reach every expected recipient.
FIRSTHAND TESTIMONY
Mineta Placed Cheney in the PEOC Before the Pentagon Was Struck
Transportation Secretary Norman Mineta testified that Vice President Cheney was already in the Presidential Emergency Operations Center before the Pentagon was struck. He described a young aide reporting that an approaching aircraft was 50, 30 and then 10 miles away before asking Cheney, “Do the orders still stand?”
Hamilton asked which aircraft Mineta meant. Mineta answered, “The flight that came into the Pentagon.” Asked separately about Flight 93, Mineta said he received no information about it before it crashed.
THREE CHRONOLOGIES
Before 9:37
9:37:46
PENTAGON STRUCK
10:00
MINETA
Before the Pentagon strike
Cheney was already in the PEOC while an approaching aircraft was
reported at 50, 30 and 10 miles.
CHENEY · SEPT. 16, 2001
Near the Pentagon attack
Cheney described being moved underground as Flight 77 approached
and reaching the PEOC near the attack.
9/11 COMMISSION REPORT
Approx. 9:58
Cheney entered the PEOC conference room approximately twenty
minutes after the Pentagon was struck.
Mineta’s sworn public testimony places Cheney in the PEOC before the Pentagon strike. Cheney’s September 16 account also places his move underground near the Pentagon attack, while the 9/11 Commission placed his arrival in the PEOC conference room at approximately 9:58. The Final Report did not publicly reconcile these materially different chronologies.
Mineta allowed uncertainty about the precise minute and said he did not know specifically what Cheney’s order meant. No public transcript or recording of the Bush-Cheney Commission interview permits an independent comparison.
COMMAND AND AUTHORITY
The Air Threat Conference Never Had a Complete Common Picture
Senior officials were connected through several conference calls and command centers as the attacks unfolded. The Air Threat Conference linked military and civilian participants, but it did not begin with every relevant agency connected or every participant working from the same information.
The surviving record shows a fragmented command picture: information known inside one FAA facility, military command center or White House channel was not necessarily available in the others at the same time.
No single command room had the complete picture of the attacks as they unfolded.
The fragmented information flow helps explain delay and confusion. The conference record does not, by itself, establish why a particular warning or order failed to reach a particular official.
COMMAND AND AUTHORITY
Who Was Standing the Operations Watch in the NMCC?
Brigadier General Montague Winfield was the National Military Command Center’s Director of Operations. On the morning of September 11, Captain Charles Leidig—a recently qualified Deputy Director for Operations—was standing the operations watch in his place during the critical attack period.
At the center of the military command system, the Director of Operations had delegated the operations watch to a newly qualified deputy during the period when the World Trade Center and Pentagon were struck.
The precise endpoint of Leidig’s watch, and what operational effect the substitution had, remain unresolved.
COMMAND AND AUTHORITY
The Secretary of Defense Was Outside the Command Center During the Attack Window
Donald Rumsfeld occupied the second position in the military chain of command for the use of force: from the President to the Secretary of Defense and then to the combatant commander. Yet after learning of the second World Trade Center strike, he resumed his intelligence briefing. After the Pentagon was struck, he went outside and assisted rescue efforts. At approximately 9:46, the NMCC was still trying to locate him; he did not enter the command center until shortly before 10:30.
The Secretary of Defense occupied the second position in the military chain for authorizing the use of force. Yet while an attack on the United States was still unfolding, the NMCC was trying to locate him. He did not arrive there until shortly before 10:30 and was absent when the White House first relayed the engagement authorization through the national command system.
Source: 9/11 Commission, Twelfth Public Hearing / Staff Statement No. 17, June 17, 2004.
The record does not establish what operational difference his earlier participation would have made.
COMMAND AND AUTHORITY
The Emergency System the Commission Did Not Investigate
At 9:59 on September 11, an officer on the military’s Air Threat Conference reported that the White House wanted continuity-of-government measures implemented, a fighter escort for Air Force One and a combat air patrol over Washington. The 9/11 Commission later confirmed that continuity plans and leadership evacuations were put into effect.
The Commission also stated that it did not investigate the continuity system except where necessary to understand the movements and communications of key officials. Its chair, vice chair and senior staff received a general classified briefing.
The Commission confirmed that continuity-of-government measures were requested during the attack, while expressly stating that it did not investigate the continuity system beyond what was necessary to track key officials. The public record therefore does not reconstruct who initiated the request, what authorities were activated, which alternate teams deployed, or how the continuity structure intersected with the ordinary command system.
EXERCISES AND AIR DEFENSE
What Exercises Were Underway?
NORAD was operating in an exercise posture on the morning of September 11 while also responding to real-world Russian bomber activity.
“Is This Real-World or Exercise?”
At 8:37:52, when Boston Center notified NEADS that American Airlines Flight 11 had been hijacked and requested military assistance, NEADS immediately asked whether the report was “real-world or exercise.” Boston confirmed that it was a real-world event.
Vigilant Guardian was the scheduled NORAD exercise that morning, and the exercise had brought additional personnel to their stations. Maj. James Fox later told 9/11 Commission staff that exercise play at NEADS was already on hold because of real-world Russian bomber activity associated with Northern Vigilance.
That statement describes the status of exercise play at NEADS. It does not establish that every simulated feed, display, inject or exercise-control function throughout NORAD had already been terminated.
The Thirty-Seconds Question
When Commissioner Timothy Roemer asked NORAD commander Gen. Ralph Eberhart whether Vigilant Guardian had helped or hindered the response, Eberhart said the additional manning and readiness helped. Referring to the initial uncertainty over whether the first hijacking report was real or part of the exercise, he estimated that it cost “at most 30 seconds.”
The Commission adopted that assessment in concluding that the additional exercise staffing, if anything, expedited the response.
But the thirty-second answer addressed the initial recognition of the real-world event. The Commission did not publish a minute-by-minute reconstruction showing when Vigilant Guardian’s simulated feeds, displays, injects and exercise-control functions were actually terminated.
The public record supports two distinct findings: Vigilant Guardian put additional air-defense personnel at their stations, and the Commission’s thirty-second estimate addressed the first real-world/exercise verification—not a complete chronology of how the exercise environment was shut down.
The present record does not establish that an exercise input caused a particular interception failure.
Source: 9/11 Commission, Twelfth Public Hearing, June 17, 2004
THE PATTERN IN THE RECORD
The Response Failed. Then the Public Account Changed.
Civilian aviation recognized the four hijackings in stages. Military defenders often received information later, indirectly, or incorrectly. Senior officials operated through separate command channels, while important public claims about notification times were later withdrawn or contradicted by recordings.
The surviving record explains parts of the failure. It does not fully explain why inaccurate accounts persisted, why material conflicts such as Mineta’s testimony remained unresolved, or what net operational effect the exercise environment had on the response.
The 9/11 Investigations
The response record raised questions the 9/11 Commission later had to reconstruct. Continue with how the investigation was formed, what it corrected, and what remained unresolved.
Continue to Pathway 3: