Turning the Tide: 9/11 — 25 Years Later · September 10–13 · New York City and Online · Get Tickets →
Command, Response, and the Flights
EXPLORE THE RECORD · PATHWAY 2 OF 7
On September 11, four passenger aircraft were hijacked while civilian aviation, military air defense, and national command systems tried to understand and respond to an attack already underway.
The question is not whether officials responded. It is what each part of the system knew, when it knew it, and what orders actually reached the people who could act.
The Flights · Air Defense · Chain of Command
START HERE
Three Ways Into the Evidence
Start with the part of the morning you most want to understand.
- FAA — Federal Aviation Administration; civilian air traffic and aviation system.
- NORAD — North American Aerospace Defense Command; continental aerospace defense.
- NEADS — Northeast Air Defense Sector; NORAD sector responsible for the Northeast on 9/11.
- NMCC — National Military Command Center; Pentagon command and communications hub.
FLIGHTS AND NOTIFICATIONS
Follow the Morning
Four hijacked flights moved through different FAA centers while information reached the military through separate and sometimes delayed channels.
When did each part of the system understand what was happening?
COMMAND AND AUTHORITY
Who Was in Command?
On paper, the chain of command was clear. In practice, the FAA, NORAD, NEADS, NMCC and the White House were operating through different conferences, receiving different information and exercising different kinds of authority.
Who was actually in command—and how did authority move between them?
EXERCISES AND AIR DEFENSE
What Exercises Were Underway?
A scheduled NORAD exercise, a real Russian-bomber monitoring operation and other drills intersected the historical record in different ways.
What was active, what was paused—and what operational effect can actually be established?
Five Key Moments in the Air-Defense Response
FAA facilities often recognized trouble before the information reached military air defenders. Early public timelines did not accurately describe every notification.
8:37:52
Boston Center gives NEADS its first notice: American 11 has been hijacked.
9:03:11
United 175 strikes the South Tower as NEADS receives its first notice of the second hijacking.
9:24
Langley fighters are scrambled in response to the mistaken report that American 11 is still airborne—not a confirmed report about American 77.
9:37:46
American 77 strikes the Pentagon before NEADS is told that the flight has been hijacked.
10:03 / 10:07
United 93 crashes in Pennsylvania at approximately 10:03; NEADS learns of its hijacking approximately four minutes later.
FLIGHTS AND NOTIFICATIONS
The Military Was Often Learning Late
FAA facilities recognized the four hijackings through different centers and channels. Information reached NEADS later, sometimes indirectly and sometimes incorrectly.
AMERICAN 11
FAA recognized the hijacking before NEADS was notified.
UNITED 175
NEADS learned of the second hijacking at about the time the aircraft struck the South Tower.
AMERICAN 77
Langley fighters were scrambled because of the mistaken report that American 11 remained airborne—not because NEADS had received a confirmed hijacking report about Flight 77.
UNITED 93
The aircraft crashed before NEADS learned that it had been hijacked.
FLIGHT 93 · DOCUMENTED AIRCRAFT
A Documented Aircraft Near the Flight 93 Site
Flight 93 struck the ground at 10:03:11 a.m. FAA records place N20VF, a Falcon business jet descending toward Johnstown, about ten miles from the smoke at 10:07. At 10:08 a Cleveland Center controller asked the aircraft to fly to the site. At 10:11 the Falcon reported the crash coordinates.
THE PEARL
The Falcon was not merely somewhere in the region. The FAA record places it near the smoke within minutes of impact and documents its diversion to the site.
That makes N20VF a strong explanation for some post-impact reports of a white corporate jet circling Shanksville. The present record does not make it a complete explanation for witness accounts describing a very low aircraft before or at impact.
Recorded Sequence
Synchronized Evidence Timeline
| Time | Recorded event | Record basis |
|---|---|---|
| 10:03:11 | Official Flight 93 impact time. | Official Flight 93 chronology |
| 10:05 | Gofer 06 reports smoke. | FAA facility record |
| 10:07 | Controller and N20VF exchange information about the smoke; the pilot reports being about ten miles away. | FAA facility record |
| 10:08 | Controller asks N20VF to fly to the site. | FAA facility record |
| 10:11 | N20VF provides crash-site coordinates. | FAA facility record |
Record note: The National Park Service compresses this sequence into a 10:07 entry. The FAA facility record distinguishes the 10:07 smoke exchange from the 10:08 request to fly to the site.
Sources: Flight 93 National Memorial timeline · FAA facility record
The First Public Timeline Gave the Military More Warning
Early official accounts said NORAD had been notified substantially earlier about American 77 and United 93. When Commission investigators later reconstructed the morning from FAA and military recordings, those notification times did not hold.
AMERICAN 77
EARLY ACCOUNT
NORAD was notified about American 77 at approximately 9:24.
RECORDINGS-BASED RECONSTRUCTION
The 9:24 event was the Langley scramble triggered by a mistaken report that American 11 was still airborne—not a confirmed hijacking report about Flight 77.
UNITED 93
EARLY ACCOUNT
NORAD was notified of a possible United 93 hijacking at approximately 9:16.
RECORDINGS-BASED RECONSTRUCTION
United 93 had not yet been hijacked at 9:16. NEADS first received a hijacking notification at 10:07, after the aircraft had crashed.
The response failed—and the first public account gave the military more warning time than the recordings later supported
What remains unresolved: The corrected chronology establishes that key notification claims changed. It does not, by itself, establish why the earlier chronology was presented or why it persisted.
COMMAND AND AUTHORITY
Where Authority Moved—and Where the Record Conflicts
The FAA, NORAD, the National Military Command Center, the White House and the Secret Service entered different conferences and received different information. The surviving recordings and transcripts show delayed connections, conflicting aircraft reports and orders that did not reach every expected recipient.
FIRSTHAND TESTIMONY
Mineta Placed Cheney in the PEOC Before the Pentagon Was Struck
Transportation Secretary Norman Mineta testified that Vice President Cheney was already in the Presidential Emergency Operations Center before the Pentagon was struck. He described a young aide reporting that an approaching aircraft was 50, 30 and then 10 miles away before asking Cheney, “Do the orders still stand?”
Hamilton asked which aircraft Mineta meant. Mineta answered, “The flight that came into the Pentagon.” Asked separately about Flight 93, Mineta said he received no information about it before it crashed.
WHAT THE RECORD ESTABLISHES: Mineta’s public, sworn testimony is the strongest inspectable account of his own presence in the PEOC and the 50-, 30- and 10-mile exchange. It places Vice President Cheney there before the Pentagon was struck. The Commission published an approximately 9:58 PEOC chronology without publicly reconciling that testimony. President Bush and Cheney met jointly with the Commission in private, not under oath, and no public transcript or recording permits an independent comparison.
THE PEARL
Mineta’s sworn public testimony places Cheney in the PEOC before the Pentagon strike. The Commission published a later chronology without publicly reconciling that testimony.
Exact boundary: Mineta allowed uncertainty about the precise minute and said he did not know specifically what Cheney’s order meant. No inspectable Cheney testimony resolves the order’s meaning.
THREE CHRONOLOGIES
Before 9:37
9:37:46
PENTAGON STRUCK
10:00
MINETA
Before the Pentagon strike
Cheney was already in the PEOC while an approaching aircraft was
reported at 50, 30 and 10 miles.
CHENEY · SEPT. 16, 2001
Near the Pentagon attack
Cheney described being moved underground as Flight 77 approached
and reaching the PEOC near the attack.
9/11 COMMISSION REPORT
Approx. 9:58
Cheney entered the PEOC conference room approximately twenty
minutes after the Pentagon was struck.
THE PEARL
Three public records place the same decision-maker in materially different places at the same critical moment. The final report did not reconcile them.
COMMAND AND AUTHORITY
No One Room Had the Whole Picture
Senior officials were connected through multiple conference calls and command centers as the attacks unfolded. FAA, the National Military Command Center, NORAD, the White House and the PEOC did not all receive the same information at the same time.
PRIMARY RECORD
The Air Threat Conference
As the attacks unfolded, senior officials were connected through several different command channels. The Air Threat Conference brought together military and civilian participants, but it did not begin with every agency present or every participant working from the same information.
FAA
FAA information entered the conference after the attacks were already underway, while aviation facilities were still developing their own picture of the four aircraft.
MILITARY COMMAND
The National Military Command Center and NORAD were working through separate channels, with reports arriving at different times and with differing levels of accuracy.
WHITE HOUSE / PEOC
Senior civilian officials were also communicating through White House and PEOC channels that were not identical to the military conference.
THE PEARL
There was no single command room with the complete picture of the attacks as they unfolded.
What remains unresolved: Fragmented information flow helps explain delay and confusion. It does not, by itself, establish why specific warnings, orders or reports failed to reach particular officials in time.
COMMAND AND AUTHORITY
Who Was Actually Running the NMCC?
On the morning of September 11, Brigadier General Montague Winfield was the National Military Command Center’s Director of Operations. But Captain Charles Leidig, who had only recently qualified for the watch, had been assigned to stand in for him from approximately 8:30 to 10:30 a.m.
MONTAGUE WINFIELD
Director of Operations · NMCC
He delegated the watch before the attacks and returned later in the morning.
CHARLES LEIDIG
Acting Director · NMCC
Recently qualified as Deputy Director for Operations, Leidig was serving as acting director during the period when the World Trade Center and Pentagon were struck.
RICHARD MYERS
Vice Chairman · Joint Chiefs of Staff
Myers later gave differing public accounts of when he learned of the attacks and when he returned to the Pentagon.
THE PEARL
At the center of the military command system, the designated director was absent during the critical attack window, while a newly qualified deputy stood the watch.
WHAT THE RECORD ESTABLISHES
Command information was divided across multiple channels. Mineta’s chronology conflicts with the Commission’s PEOC timeline. The Air Threat Conference shows an incomplete shared picture, while the NMCC was operating under a temporary watch substitution during the attack period.
WHAT REMAINS UNRESOLVED
The surviving record does not fully explain why conflicting chronologies persisted, what order Mineta overheard, or what operational effect the temporary command arrangements had.
COMMAND AND AUTHORITY
The Secretary of Defense Was Outside the Command Center During the Attack Window
Donald Rumsfeld was the Secretary of Defense and therefore a central civilian node in the operational chain for the use of military force. Yet after learning of the second World Trade Center strike, he resumed his intelligence briefing. After the Pentagon was hit, he went outside and assisted rescue efforts. The NMCC was trying to locate him, and he did not enter the command center until shortly before 10:30.
THE PEARL
The Secretary of Defense was in the operational chain for the use of military force. Yet while an attack on the United States was still unfolding, the NMCC was trying to locate him; he did not arrive there until shortly before 10:30 and was absent when the first shootdown authorization was transmitted.
WHAT THE RECORD ESTABLISHES
Rumsfeld was outside the NMCC during most of the attack period and was not present when the first shootdown authorization was conveyed.
At approximately 9:46 a.m., the 9/11 Commission reconstruction says the Office of the Secretary of Defense was still trying to locate Donald Rumsfeld and bring him into the NMCC Air Threat Conference. He joined shortly before 10:30.
Source: 9/11 Commission, Twelfth Public Hearing / Staff Statement No. 17, June 17, 2004.
WHAT REMAINS UNRESOLVED
The record does not establish what operational difference his earlier presence would have made, or why he remained outside the command center while the attack was still unfolding.
COMMAND AND AUTHORITY
The Emergency System the Commission Did Not Investigate
At 9:59 on September 11, an officer on the military’s Air Threat Conference reported that the White House wanted continuity-of-government measures implemented, a fighter escort for Air Force One and a combat air patrol over Washington. The 9/11 Commission later confirmed that continuity plans and leadership evacuations were put into effect.
But the Commission also disclosed a boundary few readers encounter: it did not investigate the continuity system, except where necessary to understand the movements and communications of key officials. Its chair, vice chair and senior staff received a general classified briefing; the public report did not reconstruct who initiated the COG request, what authorities were invoked, which alternate teams deployed or how continuity communications intersected with the White House and military command conferences.
That missing reconstruction matters because the ordinary command system was fragmented. President Bush was airborne with uneven communications. Secretary of Defense Donald Rumsfeld was outside the National Military Command Center. Vice President Cheney issued or relayed engagement guidance from the protected White House complex. NORAD-directed pilots never received the shootdown instructions Washington believed they had, while a separate Secret Service channel gave later Andrews pilots permissive rules of engagement.
Norman Mineta’s sworn testimony adds a second unresolved problem. He placed Cheney in the PEOC before the Pentagon was struck, roughly half an hour before the Commission’s final chronology. Mineta did not know what the “orders” he heard discussed meant, and his testimony does not prove either a shootdown or a stand-down. It does prove that a material witness supplied a chronology the Final Report did not reconcile.
THE PEARL
The official report confirms that continuity-of-government measures were requested during the attack, but expressly says the Commission did not investigate the continuity system. The public record therefore reconstructs parts of Cheney’s role without reconstructing the classified emergency structure operating around him.
THE LIMIT
The record establishes activation of a classified continuity system and the Commission’s decision not to reconstruct it publicly. It does not establish which continuity authorities altered which operational decisions.
THE QUESTION
How did a classified continuity system interact with a fractured constitutional command system during the most important forty minutes of the attack, and why was that interaction never fully investigated in public?
EXERCISES AND AIR DEFENSE
What Exercises Were Underway?
Multiple military exercises and related activities formed part of the operating environment on September 11. The surviving record shows that personnel were working within both exercise and real-world contexts as the attacks unfolded.
“Is This Real-World or Exercise?”
When FAA contacted NEADS about the hijacked American Airlines Flight 11, personnel immediately had to determine whether the report was part of the exercise environment or a real-world event.
Vigilant Guardian was the scheduled NORAD exercise context that morning, and exercise personnel were at command positions. Commission interviews indicate, however, that the exercise itself had been placed on hold at NEADS because of real-world Russian bomber activity associated with Northern Vigilance.
What this establishes: The recording preserves the operational need to distinguish an actual hijacking report from the expected exercise environment as the attacks began.
What remains unresolved: The exchange documents a verification step. It does not, by itself, establish that the exercise delayed the response or determine the exercise environment’s overall operational effect.
Did the Exercises Affect the Response?
DOCUMENTED OPERATING ENVIRONMENT
ACTIVITY
TYPE
STATUS ON SEPT. 11
WHAT THE RECORD ESTABLISHES
Vigilant Guardian
NORAD exercise
Scheduled / on hold at NEADS
Vigilant Guardian was the scheduled NORAD exercise context.
Exercise personnel were at command positions, but Commission
interviews indicate the exercise had been placed on hold at
NEADS because of real-world Russian bomber activity associated
with Northern Vigilance.
Northern Vigilance
Real-world operation
Active
NORAD resources were supporting an operation related to
Russian bomber activity.
Global Guardian
Strategic exercise
Active / overlapping
A separate strategic command exercise was underway.
Tripod II
Civil emergency exercise
Scheduled
Emergency-management infrastructure had been prepared in
New York.
Timely Alert II
Military exercise
Scheduled
A separate exercise was associated with Fort Monmouth.
THE PEARL
Personnel were operating in an exercise-ready environment, exercise staff occupied command positions, and the first real hijack call required verification. The released record does not yet quantify the net operational effect.
THE PATTERN IN THE RECORD
The Response Failed. Then the Public Account Changed.
Civilian aviation recognized the four hijackings in stages. Military defenders often received information later, indirectly, or incorrectly. Senior officials operated through separate command channels, while important public claims about notification times were later withdrawn or contradicted by recordings.
The surviving record explains parts of the failure. It does not fully explain why inaccurate accounts persisted, why material conflicts such as Mineta’s testimony remained unresolved, or what net operational effect the exercise environment had on the response.
The 9/11 Investigations
The response record raised questions the 9/11 Commission later had to reconstruct. Continue with how the investigation was formed, what it corrected, and what remained unresolved.
Continue to Pathway 3: