2010-08-15

How NORAD Radar Screens Displayed False Tracks All Through the 9/11 Attacks

http://911blogger.com/news/2010-08-12/lets-get-rid-goddamn-sim-how-norad-radar-screens-displayed-false-tracks-all-through-911-attacks
Submitted by Shoestring on Thu, 08/12/2010 - 6:04am

Military personnel responsible for defending U.S. airspace had false tracks displayed on their radar screens throughout the entire duration of the 9/11 attacks, as part of the simulation for a training exercise being conducted that day. Technicians at NORAD's Northeast Air Defense Sector (NEADS) were still receiving the simulated radar information around the time the third attack, on the Pentagon, took place. Those at NORAD's operations center in Cheyenne Mountain, Colorado, were still receiving it several minutes after United Airlines Flight 93 apparently crashed in rural Pennsylvania.

No one has investigated why false tracks continued being injected onto NORAD radar screens long after the U.S. military was alerted to the real-world crisis taking place that morning. And yet we surely need to know more about these simulated "inputs" and what effect they had on the military's ability to respond to the 9/11 attacks.

NEADS TECHNICIANS TOLD TO TURN OFF 'SIM SWITCHES'

The terrorist attacks on September 11, 2001 took place in airspace that was the responsibility of NEADS, based in Rome, New York. NEADS was therefore responsible for trying to coordinate the military's response to the hijackings. And yet, in the middle of it all, at 9:30 a.m. that morning a member of staff on the NEADS operations floor complained about simulated material that was appearing on the NEADS radar screens. He said: "You know what, let's get rid of this goddamn sim. Turn your sim switches off. Let's get rid of that crap." [1] Four minutes later, Technical Sergeant Jeffrey Richmond gave an instruction to the NEADS surveillance technicians, "All surveillance, turn off your sim switches." (A "sim switch" presumably allows a technician to either display or turn off any simulated material on their radar screen.) [2]



This means that at least some of the radar scopes at NEADS were still displaying simulated information--presumably false tracks--57 minutes after an air traffic controller at the FAA's Boston Center called there and announced: "We have a problem here. We have a hijacked aircraft headed towards New York." Forty-eight minutes had passed since the first attack on the World Trade Center occurred, and 31 minutes since the second tower was hit and it became obvious that the U.S. was under attack. It was only three minutes after Richmond gave his instruction, at 9:37 a.m., that the Pentagon was struck in the third successful attack that morning. [3]

Why were NEADS radar scopes displaying simulated information for so long during the real-world crisis, when it appears the technicians could have removed that information at the flick of a switch? Surely any false tracks could have hindered the ability of NEADS personnel to effectively respond to the attacks, so should have been terminated at the first sign of an actual emergency.

And yet this inexplicable behavior was not an exception. A similar thing happened at NORAD's Cheyenne Mountain Operations Center (CMOC) in Colorado, where it appears that false radar tracks were being displayed for even longer than at NEADS.

NORAD OPERATIONS CENTER ASKS FOR 'EXERCISE INPUTS' TO BE STOPPED

At 10:12 a.m., an officer at the NORAD operations center, "Captain Taylor," called NEADS and spoke to Captain Brian Nagel, the chief of live exercises there. After introducing himself, Taylor said, "What we need you to do right now is to terminate all exercise inputs coming into Cheyenne Mountain." Nagel gave Taylor an extension number and asked him to call it to get the exercise inputs stopped. Taylor replied, "I'll do that." [4] "Inputs," according to an article in Vanity Fair, are simulated scenarios that are put into play by a simulations team during training exercises. [5]

Taylor was presumably referring specifically to false tracks that had been transmitted onto radar screens at the CMOC, where more than 50 members of the battle staff had been participating in the exercise conducted that morning. [6] Indeed, the Toronto Star reported, "Any simulated information, what's known as an 'inject'" was "purged from the screens" at the CMOC in response to the news of the real-world attacks. (However, the report indicated, apparently incorrectly, that the false tracks appearing on CMOC screens were terminated earlier on, at some time shortly before 9:03 a.m., when the second WTC tower was hit.) [7]

If simulated material was still being displayed on CMOC radar screens at 10:12 a.m., this would be astonishing. By that time, 95 minutes had passed since--according to the 9/11 Commission--the military was first alerted to the hijacking of American Airlines Flight 11, and more than an hour had passed since the second plane hit the WTC. Flight 93 had apparently crashed in a field in rural Pennsylvania minutes earlier, and so the 9/11 attacks were already over. [8]

Why did it take so long for someone at the CMOC to call NEADS and ask it to "terminate all exercise inputs coming into Cheyenne Mountain?" Surely any simulated information should have been stopped as soon as NORAD learned of the real-world crisis taking place that morning.

The operations center was certainly in a valuable position to assist in the response to the terrorist attacks, so the intrusion of false tracks on its radar screens would presumably have considerably impaired the emergency response capabilities of the military. Airman magazine described the CMOC as the "nerve center of NORAD," and its troops as "the eyes and ears of North America ... nothing escapes their unsleeping watch." [9] According to the Toronto Star, "Whether it's a simulation or a real-world event, the role of the center is to fuse every critical piece of information NORAD has into a concise and crystalline snapshot." [10] NORAD has stated that the center collected data "from a worldwide system of satellites, radars, and other sensors, and processes that information on sophisticated computer systems to support critical NORAD and U.S. Space Command missions."

The CMOC provided "warning of ballistic missile or air attacks against North America, assists the air sovereignty mission for the United States and Canada, and, if necessary, is the focal point for air defense operations to counter enemy bombers or cruise missiles." The Battle Management Center there provided "command and control for the air surveillance and air defense network for North America." In 1994, for example, it monitored over 700 "unknown" radar tracks that entered North American airspace. [11]

NORAD INJECTS SIMULATED RADAR INFORMATION DURING EXERCISES

Simulated information was being transmitted onto radar screens the morning of September 11 as part of an annual command post exercise called Vigilant Guardian. All of NORAD, including NEADS, was participating in this exercise, which has been described as a "simulated air war" and as "an air defense exercise simulating an attack on the United States." [12]

An information page on Vigilant Guardian stated: "All of NEADS, operations personnel are to have their sim switches turned 'on' starting at 1400Z 6 Sept. 01 till endex [the end date of the exercise, which was originally going to be September 13]." The information page added, "A sim test track will be in place and forward told [i.e. transferred to a higher level of command] to both NORAD and CONR," NORAD's Continental United States Region. Presumably this was why the NORAD operations center needed to contact NEADS in order to get the "exercise inputs" terminated. [13]

A memo outlining special instructions for Vigilant Guardian participants described how their equipment needed to be set up to deal with the simulated material. It stated: "The exercise will be conducted sim over live on the air sovereignty string. The Q-93 must be placed in the mixed mode to allow the telling [i.e. the communicating of information between facilities] of sim tracks." [14]

The Q-93 was an important piece of equipment used by NORAD, described as "a suite of computers and peripheral equipment configured to receive plot data from ground radar systems." [15] It had "connectivity to numerous domestic radar sites, receives flight plans from the FAA, and has bi-directional communications with NORAD headquarters and a real-time link to AWACS [Airborne Warning and Control System planes]." It performed "real-time surveillance, identification, and weapons control missions." [16]

According to Master Sergeant Joseph McCain, the NEADS mission crew commander technician, "Q-93 radar screens have the ability to run a multiple input wartime scenario." [17] Indeed, in 1999, then-Deputy Secretary of Defense John Hamre revealed that NORAD could inject "mass attacks" onto its radar screens. [18] In December 1998, for example, it conducted an exercise called Vigilant Virgo, which reportedly "analyzed the Y2K preparedness of the entire ground radar array network. These systems were put through a series of scenarios involving tactical warning." [19] During this exercise, NORAD "injected 30 plus, well over 30 missile events into [its] sensors." This was "data that was injected as though it was being sensed for the first time by a radar site," according to Hamre. Of the more than 30 different simulated scenarios, some were "mass attacks" while others involved just "single missiles." [20]

WHEN WAS VIGILANT GUARDIAN TERMINATED?

Since NEADS and the NORAD operations center were still receiving simulated radar information long after the 9/11 attacks began, this raises the question of when exactly Vigilant Guardian was brought to an end. According to some accounts, it was called off "shortly after" 9:03 a.m., when the second WTC tower was hit. [21] However, when at 9:15 a.m. a caller asked, "Did they suspend the exercise?" NEADS tracking technician Mark Jennings replied, "Not at this time, no." Jennings continued, "I think they're going to," but added, "I don't know." [22]

In fact, one military newspaper has indicated that Vigilant Guardian may have been terminated more than half an hour after the attacks ended. According to the military information website, GlobalSecurity.org, Vigilant Guardian was held each year in conjunction with a U.S. Strategic Command (Stratcom) exercise called Global Guardian, and a 1997 Department of Defense report similarly listed Vigilant Guardian as one of several exercises that Global Guardian "links with." [23]

An article in The Bombardier, the newspaper for Barksdale Air Force Base, Louisiana, stated that Stratcom ordered a pause in Global Guardian at 9:11 a.m. on September 11, but only "formally terminated" this exercise at 10:44 a.m. [24] Considering that false tracks were still being displayed on NORAD radar screens at 10:12 a.m., and that NORAD's exercise that day was held in conjunction with Global Guardian, did Vigilant Guardian similarly continue until around 10:44 a.m. before being "formally terminated"?

CRITICAL QUESTIONS

The fact that key NEADS and NORAD operations center personnel had false information appearing on their radar screens throughout the 9/11 attacks raises critical questions that have yet to be investigated. We need to know who was responsible for transmitting the simulated "exercise inputs" to radar scopes. It has been reported that there was a "simulations team" working at NEADS the morning of September 11. [25] Was this team putting out the false tracks? If so, who were its members? Why did they continue with the simulation when it should have been obvious that a real-world crisis was taking place? And why didn't their higher-ups order them to stop transmitting the false tracks?

We also need to find out how many radar scopes at NEADS, the CMOC, and other NORAD facilities across the U.S. were receiving the simulated information. And what scenarios were transmitted onto the screens? Considering that Vigilant Guardian has been described as a "simulated air war," one would assume that many false tracks were being displayed.

Furthermore, we need to find out if personnel were able to distinguish genuine radar tracks from the simulated ones. It is worth noting that, since the mid-1990s, a tool called the PAC-3 Mobile Flight Mission Simulator (MFMS) has been available, which is capable of simulating a variety of enemy air vehicles. The MFMS was used by the U.S. Army in training exercises prior to 9/11. Crucially, it has been reported that "the graphic representations of MFMS tracks" on radar screens were "no different than those of actual tracks." To distinguish between real and simulated tracks, an operator had to observe the "Identify Friend or Foe" response of a track. "Simply, a real aircraft will generate an interrogation response whereas the simulated aircraft will return no response." [26]

If NORAD used equipment that simulated enemy aircraft in a similar way to the MFMS, this would presumably mean the task of distinguishing between real and false radar tracks on September 11 was less than straightforward, especially considering that three of the four aircraft targeted that day had their transponders turned off. [27] These aircraft would therefore not have been transmitting anything like an "Identify Friend or Foe" signal.

In sum, we need to determine the extent to which the U.S. military was hindered in its ability to respond on 9/11 as a result of its radar scopes receiving simulated information throughout the terrorist attacks.
It seems possible that the injection of false radar information could have been one way that normal emergency responses were sabotaged, so as to ensure the success of the attacks on New York and Washington, DC. If that is the case, those responsible must be investigated and brought to justice.

NOTES
[1] NEADS Audio File, Mission Crew Commander Position, Channel 2. North American Aerospace Defense Command, September 11, 2001; Transcripts From Voice Recorder, Northeast Air Defense Sector, Rome, NY. North American Aerospace Defense Command, September 11, 2001.
[2] NEADS Audio File, Air Surveillance Technician Position, Channel 15. North American Aerospace Defense Command, September 11, 2001; NEADS Communications 9:20 a.m.-9:54 a.m. September 11, 2001. 9/11 Commission, n.d.
[3] 9/11 Commission, The 9/11 Commission Report: Final Report of the National Commission on Terrorist Attacks Upon the United States. New York: W. W. Norton & Company, 2004, pp. 20, 22, 27.
[4] NEADS Audio File, Senior Director Position, Channel 20. North American Aerospace Defense Command, September 11, 2001.
[5] Michael Bronner, "9/11 Live: The NORAD Tapes." Vanity Fair, August 2006.
[6] Jason Tudor, "Inner Space." Airman, March 2002; "Memorandum for the Record: Interview With NORAD Deputy Commander, Lieutenant General Rick Findley, Canadian Forces (CF)." 9/11 Commission, March 1, 2004.
[7] Scott Simmie, "The Scene at NORAD on Sept. 11: Playing Russian War Games ... And Then Someone Shouted to Look at the Monitor." Toronto Star, December 9, 2001.
[8] 9/11 Commission, The 9/11 Commission Report, pp. 20, 22, 30.
[9] Pat McKenna, "The Border Guards." Airman, January 1996.
[10] Scott Simmie, "The Scene at NORAD on Sept. 11."
[11] "Cheyenne Mountain." North American Aerospace Defense Command, November 27, 1999.
[12] Leslie Filson, Air War Over America: Sept. 11 Alters Face of Air Defense Mission. Tyndall Air Force Base, FL: 1st Air Force, 2003, pp. 55, 122; William M. Arkin, Code Names: Deciphering U.S. Military Plans, Programs, and Operations in the 9/11 World. Hanover, NH: Steerforth Press, 2005, p. 545; "Vigilant Guardian." GlobalSecurity.org, April 27, 2005.
[13] "Vigilant Guardian 01-2." Northeast Air Defense Sector, August 23, 2001.
[14] Neil A. Cleveland, "Special Instructions (Spins) Vigilant Guardian 01-2." Northeast Air Defense Sector, August 23, 2001.
[15] John B. Stephenson, Sally M. Obenski, and Paula Bridickas, Mission-Critical Systems: Defense Attempting to Address Major Software Challenges. Washington, DC: United States General Accounting Office, December 1992, p. 17; "AN/FYQ-93 Communications System." Federation of American Scientists, April 23, 2000.
[16] Charles P. Satterthwaite, David E. Corman, and Thomas S. Herm, "Real-Time Information Extraction for Homeland Defense." Air Force Research Laboratory, June 2002.
[17] "Memorandum for the Record: North Eastern Air Defense Sector (NEADS) Field Site Visit." 9/11 Commission, October 28, 2003.
[18] John J. Hamre, "Dr. Hamre's Briefing on Year 2000 Issues." U.S. Department of Defense, January 15, 1999.
[19] Michael Kraig, "Safe or Sorry: The 'Y2K Problem' and Nuclear Weapons." Bulletin of the Atomic Scientists, March/April 1999; William M. Arkin, Code Names, p. 546.
[20] John J. Hamre, "Dr. Hamre's Briefing on Year 2000 Issues."
[21] Jason Tudor, "Inner Space"; Leslie Filson, Air War Over America, p. 59.
[22] NEADS Audio File, Identification Technician Position, Channel 7. North American Aerospace Defense Command, September 11, 2001.
[23] Nuclear Weapon Systems Sustainment Programs. Washington, DC: Office of the Secretary of Defense, May 1997; "Vigilant Guardian."
[24] "Unlikely Chain of Events." The Bombardier, September 8, 2006. Note that the times given in this article are in Central time, which I have converted to Eastern time.
[25] Lynn Spencer, Touching History: The Untold Story of the Drama That Unfolded in the Skies Over America on 9/11. New York: Free Press, 2008, p. 25.
[26] Andrew Yuliano, "Simulations: Changing the Paradigm for Air Defense Operational Testing." Air Defense Artillery, April 2001.
[27] 9/11 Commission, The 9/11 Commission Report, p. 16.

The article is reproduced in accordance with Section 107 of title 17 of the Copyright Law of the United States relating to fair-use and is for the purposes of criticism, comment, news reporting, teaching, scholarship, and research.

4 comments:

Anonymous said...

The source of those fake radar targets was the 84th RADES in Utah.

FOIA docs show flight 77 was part of the "drill".

Vatic said...

Oh, that is very interesting. I will forward this info onto Bruecke who is our resident expert on 9-11. It would be great for a follow up and getting a copy of that FOIA. Do you have a link or copy to it?

Anonymous said...

https://www.ntsb.gov/Info/Rec_Radar_%20Data_%20Study_all%20_aircraft.pdf

At the top of page 7 you see the "ignore" command invoked on the input for flt. 77, Then you see "export" command which implies a program is being run in place of the actual returns coming in from the field.

Anonymous said...

Taken from USAF web site for 84th RADES : Radar data interface system weaves information to find answers during timecritical
operations.
In an age when information dominance is key to mission success, a unit traditionally
tasked with evaluating and optimizing long-range, ground-based radar is evolving into a
team with a data analysis mission.
Radar is a primary tool for defining what is occurring in U.S. airspace. A lone radar,
however, provides a very limited view of an area based on location and specific
environmental factors.
A more accurate picture of an area of interest can be obtained when data from
overlapping coverage of multiple radar sites is combined and analyzed.
This process has been applied in several scenarios, including the search and rescue effort
for a C-130 crash off the California coast, the explosion of TWA Flight 800, and one
occasion when Air Force One briefly disappeared from radar. These investigations used
the event analysis services of the 84th Radar Evaluation Squadron (RADES) based at
Hill Air Force Base, Utah. The squadron has performed both quick response and event
analysis while investigating more than 100 such incidents. This number continues to
grow.
Combining and analyzing data is one of the functions of the radar data interface system
(RDIS) developed by the 84th RADES. This radar data recorder assesses the performance
of multiple radar sites supporting the joint surveillance system (JSS), an overlapping
system of radar units positioned across the perimeter of the continental United States.
The JSS is co-owned by the U.S. Air Force and the Federal Aviation Administration.
The RDIS is a PC-architecture-based system that uses local area network
communications to record and distribute radar messages. It can record data from more
than 50 radar locations. The system’s hard drives store one day of radar data in half-hour
files, which are backed up to a 300-gigabyte tape system each night. A remote access
server connected to the Internet allows data files to be pulled, re-stored and sent to radar
analysts in the event of a mishap or other event." - end snip