The emergence of shared understanding during unexpected events:
An example from 9/11
Marlys Christianson, University of Toronto
Mary Waller, York University
Sjir Uitdewilligen, Maastricht University
VERY ROUGH DRAFT, PLEASE DO NOT CIRCULATE OR CITE
* Acknowledgement. We are grateful to Kathie Sutcliffe and Katy DeCelles for their comments
and suggestions on previous drafts. We owe a debt of thanks to Michael Bronner and Miles Kara,
who have both helped us immeasurably. We also thank Kristen Wilhelm, Archivist, Center for
Legislative Archives, National Archives and Records Administration for her assistance in
accessing documents.
1
ABSTRACT
As work becomes more and more interdependent, there is a renewed focus on examining how
teams manage unexpected events. During an unexpected event, one of the difficulties that teams
face is developing a shared understanding of the situation – specifically, they must collectively
make sense of what is happening and continue to update their understanding of the event as it
evolves over time. Current research on shared understanding tends to focus on static aspects of
understanding – for instance, the content and structure of understanding in teams – but we know
much less about the dynamic process of how shared understanding in teams emerges over time.
By definition, unexpected events cannot be anticipated, which makes them difficult to study. In
this project, we used a unique dataset to gain greater insight into how shared understanding
evolved during an unexpected event: audiotapes of real-time conversations between the civilian
and military personnel involved in controlling and protecting United States airspace on Sept 11,
2001. In order to answer our research question – “How does understanding of an unexpected
event develop and change over time within a team?”– we used an inductive grounded theory
approach to analyze conversations between the Northeastern Air Defense Sector team (a group
of military officers, air-traffic controllers, and air-surveillance and communications technicians)
and other civilian and military personnel, including air-traffic controllers and pilots. We found
that shared understanding evolved over time and went through two transitions: first, when the
NEADS team realized that the events were not part of a training exercise but instead were
happening in the real world and, second, when the NEADS team realized that the events were
not a conventional hijacking but instead were a coordinated attack on the US. We also found that
the emergence of shared understanding was facilitated by two mechanisms: NEADS staff
actively managed the flow of information, “pulling” information from various sources as they
sought to supplement or augment what they already knew and “pushing” information to other
sources as they attempted to transmit information to those they thought could benefit from it. As
well, NEADS staff reconciled conflicting accounts, privileging information that was seen as
reliable because it came from either an established source or an informal source that had
demonstrated over time that they had timely and accurate information.
2
INTRODUCTION
As work becomes more and more interdependent, there is a renewed focus on examining how
teams work together to manage unexpected events (e.g., Griffin, Neal, and Parker, 2007; Weick
and Sutcliffe, 2007; Gittell, Seidner, and Wimbush, 2008). During an unexpected event, teams
must collectively make sense of what is happening and develop a shared understanding of the
situation. By shared understanding, we mean the knowledge held in common amongst team
members. Developing a shared understanding is important for teams, especially during
unexpected events, because it helps them to coordinate their actions and adapt to the evolving
situation (Weick, 1995; Cannon-Bowers and Salas, 2001; Burke et al., 2006).
However, current research on shared understanding tends to focus on the static aspects of
understanding, specifically the content and structure of knowledge in teams. Scholars have
studied how team members recognize what knowledge is held by other team members (Wegner,
1995; Austin, 2003; Bunderson, 2003; Lewis, Lange, and Gillis, 2005; Reagans, Argote, and
Brooks, 2005; Lewis and Herndon, 2011). They have also studied the amount of overlap or
similarity of knowledge between team members (Klimoski and Mohammed, 1994; Mathieu et
al., 2000; Cannon-Bowers and Salas, 2001; Waller, Gupta, and Giambatista, 2004), often
focusing on specific aspects such as task-specific knowledge, task-related knowledge, knowledge
of team-mates and attitudes or beliefs. More recently, scholars have also begun to explore the
extent to which team members have an accurate understanding of the knowledge held by other
team members (Huber and Lewis, 2010).
3
Although this established body of research on shared understanding has illuminated many
aspects of the structure and content of knowledge, we still know very little about the emergence
of shared understanding within teams, especially in the context of unexpected events. Scholars
have identified organizing practices that enable teams to coordinate their work in dynamic
settings (Faraj and Xiao, 2006) and ways in which teams can develop the capacity to improvise
in the face of unexpected events (Bechky and Okhuysen, 2011) but there are few studies that
examine how shared understanding emerges and develops over time as teams manage
unexpected events in the real world (c.f. Snook, 2000). In part, this is because unexpected events
cannot be anticipated, which makes them difficult to study. As a result, many classic studies on
managing unexpected events rely on retrospective data to explore how teams develop shared
understanding (e.g., Shrivastava et al., 1988; Weick, 1990; Weick, 1993; Vaughan, 1996). For
instance, Weick’s (1993) examination of the collapse of sensemaking during the Mann Gulch
fire in 1949 is based on historical data drawn from Norman McLean’s “Young Men in Fire,”
interviews from the surviving four members of the fire crew, a research report from the National
Fire Services, and a site visit, which was conducted decades after the events of the day.
In this paper, we used a unique dataset which allowed us to gain greater insight into how shared
understanding evolved during an unexpected event: audiotapes of real-time conversations
between the civilian and military personnel involved in controlling and defending United States
airspace on Sept 11, 2001 (9/11). In particular, we analyzed the conversations between the
military air defense team at the Northeastern Air Defense Sector (NEADS) – a group of officers,
air-traffic controllers, and air-surveillance and communications technicians who were
responsible for protecting American airspace (Bronner, 2006; National Commission on Terrorist
4
Attacks Upon the United States, 2004) – and other civilian and military personnel, including airtraffic controllers and pilots. We are interested in the sensemaking of the NEADS team – that is,
the process through which individuals socially constructed an understanding as they interpreted
and responded to unfolding events, constructing plausible accounts that allowed them to
comprehend the world and to enact the sense that they made back into the world (Weick, 1995;
Weick, Sutcliffe, and Obstfeld, 2005). In order to answer our research question – “How does
understanding of an unexpected event develop and change over time within a team?” – we used
an inductive qualitative approach to study how the NEADS team made sense of the events of
9/11.
We begin by presenting a short case study of the events of 9/11 to provide background for the
reader and to establish a context for the subsequent analysis. Once the context for our case is
established, we unpack how shared understanding emerged over time. We found that shared
understanding evolved over time and went through two transitions: first, when the NEADS team
realized that the events were not part of a training exercise but instead were happening in the real
world and, second, when the NEADS team realized that the events were not a conventional
hijacking but instead were a coordinated attack on the US. We also found that the emergence of
shared understanding was facilitated by two mechanisms: NEADS staff actively managed the
flow of information, “pulling” information from various sources as they sought to supplement or
augment what they already knew and “pushing” information to other sources as they attempted
to transmit information to those they thought could benefit from it. As well, NEADS staff
reconciled conflicting accounts, privileging information that was seen as reliable because it
5
either came from an established source (i.e. higher up in the military chain of command) or an
informal source that had demonstrated over time that they had timely and accurate information.
9/11: ROLE OF NEADS TEAM AND TIMELINE OF KEY EVENTS
While a significant amount of information about the events of 9/11 is already present in the
public consciousness, the popular narrative of the events is incomplete (National Commission on
Terrorist Attacks Upon the United States, 2004). Now that more than a decade has passed and
many declassified documents have been released, it is clear that many of the details related to
how events unfolded that morning were not shared with the general public. Even worse, some of
the key facts were misrepresented during public discussions, including false testimony to
Congress by high-ranking military officers (National Commission on Terrorist Attacks Upon the
United States, 2004, p. 34). In order to provide a context for the work of the NEADS team, we
present a short case study that provides more detail about the NEADS team and the
organizational structure in which NEADS is embedded. We also summarize key events on the
morning of 9/11, highlighting those events that may be more unfamiliar to the reader including
the other reports of hijacked aircraft and conflicting reports such as the “rebirth” of American
Airlines 11 (AA11).
Team structure: The NEADS team is composed of many different types of military personnel
who specialize in different functions: on the Operations floor, there are staff who work in Radar
Control (surveillance and tracking), Identification, Weapons, and various military command
positions (with exception of the Mission Crew Commander, most of the senior officers are
6
located in the Battle Cab, just off the Operations floor). In this paper, we focus primarily on the
work of the Identification (ID) and Weapons staff, as they were the NEADS personnel most
intimately involved in managing the events of the day. Major Kevin Nasypany was the Mission
Crew Commander (MCC), which meant that he was in charge of the Operations floor. Because
of an ongoing training exercise, there were several other high ranking officers at NEADS in the
Battle Cab area on 9/11: Col. Robert Marr and Lt Col. Dawne Deskins. There were three ID
Techs present on the NEADS operation floor on 9/11: Senior Airman Stacia Rountree, Tech Sgt.
Shelley Watson, and their supervisor, Master Sgt. Maureen (“Mo”) Dooley. The Weapons staff
included Tech Sgt. Jeremy Powell, Tech. Sgt. Ronald Belluscio, Sgt. Joe McCain, Staff Sgt.
William Huckabone, Master Sgt. Steve Citino, and Major James Fox (supervisor of the Weapons
staff).
Like many teams that are designed to manage unexpected events, NEADS staff coordinates their
work not only within the team but also with other agencies, specifically the FAA and civilian air
traffic controllers as well as military personnel. NEADS obtains information from and gives
information to other agencies – for instance, they receive radar inputs from both the Federal
Aviation Administration (FAA) and the Air Force. As the events of 9/11 unfolded, NEADS staff
were in direct contact with civilian and military air traffic controllers in New York, Boston,
Washington, D.C., Cleveland, and Indianapolis. As well, they coordinated the military response
in conjunction with the Otis Air Force Base in Cape Cod, MA, the Langley Air Force Base in
Hampton, VA, and the Navy Fleet Air Control and Surveillance Facility in Virginia Beach, VA
(National Commission on Terrorist Attacks Upon the United States, 2004). Figure 1 displays the
7
geographical proximity of NEADS to the agencies with which it interacted and emphasizes that
NEADS coordinated their work with a distributed set of actors.
-- Insert Figure 1 approximately here –
The physical artifacts – the workspace and equipment – at NEADS also shaped the emergence of
shared understanding. The operations floor at NEADS was configured as an open workspace
with workstations of communication and radar equipment organized in long rows. All
workstations faced large screens at the front of the room, where status updates and television
coverage could be displayed. The advantage of the open workspace was that staff could see and
hear each other, which facilitated the development of shared understanding. Staff communicated
on various internal radio channels, which were continuously recorded on reel-to-reel tapes and
were automatically time-stamped. The radio channels recorded both internal conversations
between NEADS staff and also conversations between NEADS staff and outside personnel, such
as civilian or military air traffic controllers. Most personnel were only recorded on one radio
channel but some key staff at the MCC desk could be heard on multiple channels as they were
able to plug in and listen to any of the channels.
The building where the NEADS team was housed was part of the now-defunct Griffiss US Air
Force base. Post Cold-War, budget cutbacks meant that NEADS radar equipment was
antiquated. Although NEADS was scheduled to acquire updated radar, on 9/11 they were
working on radar machinery so outdated that the equipment was no longer being produced and
NEADS technicians had to make and repair their own equipment. The antiquated radar became
8
an issue on 9/11. Unlike more sophisticated radar used by civilian air traffic controllers, the
NEADS radar was only able to calculate the position of planes based on the transponder signal,
which “squawked” (transmitted) a specific code that uniquely identified each plane. However,
when the terrorists hijacked the planes and altered the transponder signals, they made it
effectively impossible for NEADS staff to locate and track the flights. Major Nasypany
described the difficulty tracking the planes on 9/11,
You would see thousands of green blips on your scope and now you would have to pick
and choose. Which is the bad guy out there? Which is the hijacked aircraft? And without
that information [the beacon code or plane’s exact coordinates] from the F.A.A., it’s a
needle in a haystack” (Bronner, 2006, p. 8)
Organizational structure: NEADS is one component of the North American Aerospace
Defense Command (NORAD), the military partnership that was created in the midst of the Cold
War to protect Canadian and US airspace from attack from the Soviet Union. NEADS is
headquartered in Rome, NY, a remote area of upstate New York, and is the Sector Operations
Command Center (SOCC) responsible for protecting the airspace over the northeastern
continental United States, an area which comprises a “half-million-square-mile chunk of
American airspace stretching from the East Coast to Tennessee, up through the Dakotas to the
Canadian border, including Boston, New York, Washington, D.C., and Chicago” (Bronner,
2006). NEADS is overseen by the Continental United States Region Air Operations Center
(CONR), which is co-located with First Air Force – a squadron of ten National Guard fighter
wings – in Tyndall Air Force Base, Florida (NORAD, 2012a).
9
NEADS’ mission is to defend its sector against attacks, although the historical focus had been on
external attacks (i.e. a cruise missile attack from Soviet Union). After the Cold War ended, their
mission enlarged to include “the detection and monitoring of aircraft suspected of illegal drug
trafficking” and assisting with local search & rescue missions (NORAD, 2012b). In the event of
an attack, NEADS’ role was to coordinate the US military response, while providing direction
and support to civilian aviation agencies. Pre-9/11, NEADS (or any other branch of NORAD)
was not responsible for monitoring flights internal to the US – that task was the purview of the
FAA, which was mandated by law to regulate the “safety and security of civil aviation”(Farmer
et al., 2011, p. 6). For an internal incident, such as an airplane hijacking, there were protocols
that outlined how the FAA was supposed to request military aid from NORAD.
The need for the FAA and NORAD to manage a domestic hijacking did not occur very often –
the last incident had taken place eight years prior (Farmer et al., 2011, p. 6). The protocols that
existed on 9/11 for how to manage hijacking were based on the notion of a conventional
hijacking, in which hijackers would make a series of demands they expected to be met in order to
assure the safe return of the plane and its passengers. The protocols also assumed that the pilot
would signal to air traffic controllers that the plan had been hijacked either by contacting the
controllers by radio or by “squawking” (transmitting) a transponder code of “7500,” the
universal code for a hijacking in progress. The protocols also assumed that staff would have time
to follow a lengthy sequence of steps that involved notifying five levels of FAA staff, the
National Military Command Center (located at the Pentagon), and the Secretary of Defense to
request approval for a fighter escort. And only after approval was given by the Secretary of
Defense would information about the hijacking be passed along to NORAD so that the affected
10
sector could coordinate the military response and arrange for a fighter escort. But the hijackings
on 9/11 represented the beginning of a “new type of war” (National Commission on Terrorist
Attacks Upon the United States, 2004, p. 46). The previous assumptions were wrong – on 9/11,
the hijackers altered the transponder signals, making the planes difficult to locate; there was little
time to respond; and the hijackers intended not to make a series of demands but, instead, to turn
commercial jetliners into guided missiles (National Commission on Terrorist Attacks Upon the
United States, 2004, p. 18). The hijacking protocols were not followed – in part because they no
longer made sense – but also because of a significant breakdown in communication between the
FAA and NORAD that we will discuss later in the paper.
Timeline of key events: Early on the morning of September 11, 2001, NEADS staff were
preparing for yet another day of an ongoing simulation exercise, Vigilant Guardian. Major Kevin
Nasypany – who was in charge of the Operations floor at NEADS – had just come on shift but
was temporarily away from the Operations floor. Unbeknownst to anyone at NEADS, an attack
on the US was already underway: teams of terrorists had boarded four flights with the sole intent
of turning the planes into weapons and crashing them into iconic American symbols, including
the World Trade Center and the Pentagon. A phone call at 8:37am from one of the Boston air
traffic controllers was the first notice that NEADS had about the unprecedented and rapidly
unfolding sequence of events that occurred that morning.
The chronology of the key events of 9/11 has been definitely summarized by the 9/11
Commission in their original report (National Commission on Terrorist Attacks Upon the United
States, 2004) and in the recently released audio monograph (Farmer et al., 2011). Rather than
11
recount all the detail in that report, we focus the discussion in this paper on the key events of that
morning that relate to the development of shared understanding at NEADS. We present these key
events in a graphical timeline1 in Figure 2.
-- Insert Figure 2 approximately here --
NEADS staff eventually learned that four planes had been hijacked: American Airlines 11
(AA11), United 175 (U175), American Airlines 77 (AA77), and United 93 (U93). This top
section of this figure depicts when each of the planes were hijacked, when NEADS was notified
of those hijackings, and when the planes crashed. As you can see from the figure, NEADS had
little to no time to respond to the hijacking of the planes: for the first hijacked plane (AA11),
NEADS had nine minutes notice between when they were informed of the hijacking and when
the plane crashed into the North Tower of the World Trade Center. For the second plane (U175),
NEADS had no notice and learned simultaneously that the plane had been hijacked and that it
had crashed into the South Tower of the WTC. For the third plane (AA77), NEADS had – at
most – four minutes notice. The time interval around this notice is difficult to calculate because
NEADS was informed at 9:34am that AA77 was missing but were not told the plane’s location
or that it had been hijacked. AA77 crashed into the Pentagon at 9:37am.
We drew on many archival sources to compile these timelines – some materials used Eastern
Daylight Time (EDT) and other materials, particularly military sources, used “Zulu time”
(Greenwich Mean Time). For consistency and ease of reading, we have converted all times to
EDT, the time zone NEADS was located in and where most of the events of that morning took
place
1
12
For the fourth plane (U93), NEADS did not learn of the hijacking until well after the plane had
crashed. The timeline of U93 as it is presented in this figure is important because it contradicts
erroneous testimony given in front of Congress. The story that emerged immediately after 9/11
was that the US military was aware that U93 had been hijacked, had scrambled fighters to track
it, and was willing to “take lives in the air to save lives on the ground” (Filson, 2003, p. 71). This
account received significant press attention and – despite having been disproven – is still part of
the popular mythology of 9/11. In fact, neither NEADS nor any other senior military leaders
were aware of U93. If not for the passengers on that flight, U93 would most likely have struck
another iconic target in the National Capitol Area, the direction it was headed at the time of the
crash (National Commission on Terrorist Attacks Upon the United States, 2004, p. 13-14, 31).
There were several other key events that happened on 9/11 that contributed to the chaos and
confusion at NEADS. One of those events was a false report that AA11 was still airborne. Even
though AA11 had been officially confirmed as the plane that crashed into the North tower of the
World Trade Center at 8:46am, it was – almost 40 minutes later – thought to be “reborn” and
flying toward Washington. Even now, it is unclear how the rumor originated. The false report
was discussed on a FAA conference call and was passed along to NEADS. In fact, it was AA77
that was en route to Washington. The “rebirth” of AA11 resulted in a frantic chase of a phantom
plane, in which NEADS radar technicians and military fighter pilots alike were searching for a
plane that no longer existed. The “rebirth” of AA11 was omitted from the official narrative given
by key military officials in their public statements and testimony to Congress (National
Commission on Terrorist Attacks Upon the United States, 2004, p. 34).
13
One of the main sensemaking challenges that NEADS staff faced that morning was determining
what the emerging threat consisted off. In addition to information coming in about the hijacked
planes, they received many communications about planes that were thought to be hijacked but, in
the end, turned out not to be. In addition to the four planes that were hijacked, there were three
other suspected hijackings that received significant time and attention from NEADS: Delta 1989,
a Canadian plane, and an unknown plane spotted over Washington.
Due to miscommunication with the air traffic control tower in Cleveland, Delta 1989 was on the
wrong radio frequency and temporarily out of radio contact. Since Delta 1989 was one of three
transcontinental flights that originated out of Boston that morning – the other two flights were
AA11 and U175 – air traffic controllers quickly designated it as a suspected hijacking. After
being tracked for some time by NEADS, the plane – which had never been hijacked – landed
safely in Cleveland. NEADS also heard that an unknown aircraft from Canada was headed
toward Washington. In fact, this plane never existed – it was speculation by Canadian
intelligence officers that such a threat might exist. However, at NEADS this information was
treated as news of another possible hijacking until, much later, it was determined that there was
no such plane. The third threat – an unknown plane over Washington – was actually one of the
Langley fighter jets that had been tasked over the Capitol region. The jet accidentally had its
transponder code on the wrong frequency, which meant that the Washington air traffic
controllers – who were now on extreme alert – detected this abnormal signal and passed along
14
the information to NEADS. NEADS scrambled the Langley fighters to find this plane, only to
realize that, “We intercepted one of our own guys” (NEADS, Channel 13).
NEADS had limited ability to respond to the reports of hijacking – Major Nasypany only had
four fighter jets ready at his disposal to protect the entire northeastern sector of the United States:
two F-15 fighter jets stationed at Otis Air Force Base and two F-16 fighter jets stationed at
Langley Air Force Base. However, NEADS staff mobilized the resources that they had as
quickly and thoughtfully as they could, launching the F-15’s from Otis Air Force Base to protect
New York City and, eventually, launching the F-16’s from Langley Air Force Base to protect
Washington, DC.
It is important to note that one of the one of the largest breakdowns on 9/11 occurred between the
FAA and NEADS. The FAA received information about hijackings or planes that had gone
missing and did not transmit this information in a timely matter to NEADS (National
Commission on Terrorist Attacks Upon the United States, 2004, p. 17-31). In fact, the only
request for military assistance from NEADS on 9/11 came from Colin Scoggins, an air traffic
controller in Boston, who deviated from protocol and called NEADS to inform them of events.
As a result of this communication breakdown, NEADS staff had to coordinate the US military
response using the information they obtained themselves from civilian air traffic controllers.
15
METHODS
We use an inductive constant comparison approach to elaborate and extend theory related to the
emergence of shared understanding. Qualitative methods are especially well suited for
investigating complex processes that evolve and change over time. Qualitative research helps to
answer process questions, such as “What is occurring?” and “How is it occurring?” (Lee,
Mitchell, and Sablynski, 1999). Within qualitative methods, the single case study methodology is
particularly appropriate for studying extreme or rare events (Yin, 2003). A case study approach
results in a rich and detailed description of organizations, which can facilitate the development of
theoretical insight (Weick, 2007).
Data collection
Since 9/11 a great deal of data about the events of that day have been made publicly available,
either as a result of the 9/11 Commission’s work or as a result of Freedom of Information Act
requests. Our analysis derived from multiple sources but our primary data source was the
NEADS recordings. We provide more detail about each of our various data sources below.
NEADS tapes: In order to gain insight in how shared understanding emerges, we obtained,
transcribed, and analyzed the NEADS recordings of the real-time conversations that air traffic
controllers and military personnel were having as they attempted to make sense of and manage
the events of 9/11. The NEADS facility has multi-channel reel-to-reel tape recorders in the
operations center that continuously record (with time stamps) the five NEADS radio channels,
16
which are used for internal communication between NEADS team members and for external
communication between NEADS and civilian or military air traffic controllers (e.g., Boston
Center, New York Center, and Washington Center) and other personnel, including military
pilots.
9/11 Commission Report: The 9/11 Commission (2004) was created to “prepare a full and
complete account of the circumstances surrounding the September 11, 2001 terrorist attacks,
including preparedness for and the immediate response to the attacks.” Within this report, we
focused on the work of Team 8, the 9/11 commission team that was in charge of investigating the
immediate response to the 9/11 attacks, with a particular focus on air traffic controllers,
NORAD, and NEADS.
NARA Archives: The source documents for the 9/11 Commission Report are housed at the
National Archives in Washington, DC. Some of the documents are electronically available. The
rest of the documents can be viewed in the archives. Again, we focused on the documents from
Team 8, including the transcripts of the Team 8 interviews with all the key NORAD, NEAD, and
FAA personnel involved in 9/11. As well, there are numerous other archival documents
including floor plans of NEADS and the location of NEADS staff in the control room on 9/11,
the master log from NEADS that is used to record all key events, and other important documents.
In total, we obtained more than 1000 pages of documents from NARA.
17
Continued work by members of Team 8: Col. Miles Kara, a military intelligence officer (now
retired) served as a member of the 9/11 Commission’s Team 8. Even after the 9/11 Commission
completed their work, he continues to research and publish analyses related to the events of 9/11.
He maintains a website that has detailed background information on key personnel and aspects of
that day (http://www.oredigger61.org/). Team 8 constructed an audio monograph of the events of
9/11 that was not included in the final Commission report nor ever released to the public. John F.
Farmer, a member of Team 8 and former Senior Counsel, National Commission on Terrorist
Attacks Upon the United States, became the Dean of Rutgers Law School. Like Miles Kara, he
continued to work on issues related to 9/11 and wrote a book, “The Ground Truth: The Untold
Story of America Under Attack on 9/11,” about the 9/11 Commission report and government
concealing key facts from the public. On the tenth anniversary of 9/11, John Farmer, Miles Kara,
and a group of Rutgers law students finally published the annotated Team 8 audio monograph,
which is a definitive account of the events of that morning (Farmer et al., 2011).
Data analysis
Members of teams do not have the ability – unless they have worked together for a long time and
are able to anticipate each other’s thoughts and actions – to accurately know what other team
members are thinking or feeling (Rico et al., 2008). Rather, team members rely on external
signals – e.g., what other team members say and do, what markers of expertise team members
display (Bunderson, 2003), and what roles they occupy (Meyerson, Weick, and Kramer, 1996) –
as the basis for their own thoughts and action. In essence, team members must draw upon their
observations of interactions within a particular situation to shape their own future cognitions and
actions. While we acknowledge the importance of what occurs at the intra-individual level (i.e.
18
individual cognition), the focus of our study is the development of shared understanding – the
knowledge held in common by team members can be traced over time by mapping the
statements team members make, the information they mark as important to share with each other,
the accounts they develop to explain events, the sense they give to each other, and the
coordinated actions they take as they perform their complex interdependent work.
To study how shared understanding developed and changed over time, we created a set of
synchronized transcripts of the conversations at NEADS. First, complete transcripts were made
of each of the five NEADS radio channels, using the automatic timestamp to create a second by
second record of events. Second, we created a master spreadsheet that synchronizes all five
transcripts, so that, at any moment in time, it is possible to see all conversations that were
occurring at that moment. In order to see the data at once, the data were printed on large posters
(3 ft wide x 5 ft long). A total of thirty three posters were required to contain the data. This large
scale data display technique also enabled the physical mapping of the flow of information across
radio channels over time.
We also created detailed summaries of all key events on 9/11 that involved NEADS. We paid
particular attention to creating a timeline from primary source data as many published accounts
are based on inaccurate information. Once a preliminary timeline was created, we corroborated
the timeline with other primary source data, such as the NEADS master control log, which is
used by NEADS to record important events. The supplementary data, particularly the interviews
and documents collected by members of Team 8, allowed us to create thick descriptions of the
events.
19
As we analyzed the data, we followed a grounded theory approach (Glaser & Strauss, 1967),
iterating back and forth between data and emerging theory. We coded the NEADS transcripts for
moments that seemed striking, either because they seemed interesting or because they seemed
recurrent or basic. We then coded data into units of meaning, analyzed these codes for themes
and emerging theoretical insight, and then returned to the data for further analysis and coding
based on the new insights that we developed, while also looking for outliers and rival
explanations (Glaser & Strauss, 1967; Miles & Huberman, 1984).
FINDINGS
We began our study with the research question, “How does understanding of an unexpected
event develop and change over time within a team?” Our findings provide insight into this
question. For NEADS staff, the events of 9/11 were unprecedented in scope and magnitude and
it was difficult for them to determine what exactly was happening as events unfolded over time.
Despite these challenges, the team was still able to create new shared understanding, which went
through three distinct phases: first, team members thought that this event represented a training
exercise; next, although simultaneous hijackings were non-routine, they thought it was a
conventional hijacking (with the assumption that the hijackers would make their demands known
and would be escorted by military aircraft to their chosen location); and last, as the hijacked
aircraft were used as weapons, they realized that this represented a coordinated attack on the US.
20
Our findings suggest two mechanisms that contributed to the emergence of shared
understanding. We illustrate how NEADS staff actively managed the flow of information, both
“pulling” information from various sources as they attempted to discern what was happening and
“pushing” information to members of their network that they thought needed the information. In
addition to the challenge of managing the flow of information, NEADS staff also had to
determine what information to pay attention to. In the face of contradictory accounts, NEADS
staff had to reconcile conflicting information, decide what information was reliable, and
privilege some accounts over others.
Transitions in understanding
The process of creating and updating shared understanding was not straightforward. Different
team members were receiving different pieces of information, contributing to a varied portrait of
the event. The ID Techs were on the phone with civilian air traffic controllers, trying to find out
more information about the hijacked planes and passing along information that they thought
would be helpful. Because the hijackers altered the transponder signals, the Radar Control staff
were having trouble locating the hijacked planes and were attempting to track down the planes
using the last known geographical coordinates (longitude and latitude). The Weapons Techs
were coordinating the military response with staff at Otis Air Force Base, Langley Air Force
Base, and Navy Air Flight Control and, later on, often speaking directly to the fighter pilots as
well as the military air traffic controllers. Major Nasypany, the MCC, was directing all this
activity on the operations floor, while in constant consultation with the commanders in the Battle
Cab. Major Nasypany also had the additional challenge of maintaining chain of command, a task
made more difficult that morning because there were so many senior CONR officers present at
21
NEADS in preparation for Vigilant Guardian, the scheduled training exercise. Some of the senior
officers who were present at NEADS outranked him but were not part of the operational chain of
command. At one point, Nasypany realizes that one such officer was on the operations floor and
causing confusion amongst staff in terms of who they should listen to – you can hear him say on
the tapes, “I gotta get Ian off the floor, he has been circumventing my system here. He is not an
MCC, he needs to stay up there [Battle Cab.]”(10:44am, NEADS, Channel 2).
As the understanding of events evolved over time – from training exercise to conventional
hijacking to coordinated attack on the US – the NEADS team had to navigate through these
transitions in understanding. Different types of transitions in understanding were easier to
accomplish than others. The transition from thinking the events were part of an exercise to
realizing that they were occurring in the real-world was a fairly straightforward transition, in
contrast to the transition from thinking that this was a conventional hijacking to realizing that
planes were being used weapons as part of a coordinated attack on the US. We discuss each
transition in understanding in turn. Although conspiracy theorists contend that the Vigilant
Guardian training exercise added to the confusion of the morning, there is ample evidence that
the exercise did not interfere and, if anything, actually strengthened the response (Kara, 2011;
Scott, 2002). For instance, because of the exercise NEADS was fully staffed and there was no
need to call in extra personnel. It did not take staff long to determine the events were not part of
the exercise, although there were some residual comments throughout the morning related to the
exercise (Kara, 2011). All references to the exercise are summarized in Appendix 1 (timeline
adapted from Kara, 2011).
22
The transition of understanding from exercise to real-world event can be noticed in the first
conversation (1) between Joe Cooper, who called from Boston Center to share the information
that a plane – AA11 – had been hijacked and Sgt. Jeremy Powell, who answered the phone.
8:37am (NEADS, Channel 14)
Phone rings
Sgt Powell: Huntress2 Weapons. Sgt Powell
ZBW: Hi. Boston ARTCC. We have a problem here. We have a hijacked aircraft headed
toward New York and we need you guys to… we need someone to scramble some F-16s
or something to help us out
Sgt Powell: Is this real world or exercise?
ZBW: No, this is not an exercise. Not a test.
Sgt Powell: OK.
Sgt. Powell immediately transferred Joe Cooper to the most senior MCC on the operations floor
– Dawne Deskins – who gathered information about the hijacking. Major Nasypany was
immediately paged back to the operations floor over the PA system, “Major Nasypany, you are
needed in Ops, pronto. Major Nasypany, you are needed in Ops, pronto” (8:37:58am, NEADS,
Channel 2). Additional staff were also paged to the operations floor. The ID Techs called Boston
back to get more information about the plane, including identifying data – such as its tail number
– and the number of “souls on board” (passengers). By 8:41am, Major Nasypany contacted Otis
Air Force Base and had them put two fighters on battle stations and by 8:46am they were given
the order to “scramble” (i.e. launch) over Manhattan to locate and escort the hijacked plane, per
hijacking protocol. Nine minutes had elapsed from the first phone call to the real-world military
response.
2
NEADS call sign is HUNTRESS and this is the greeting that NEADS staff use when answering
the phone.
23
In total, throughout the NEADS tapes, there were fourteen references to the Vigilant Guardian
exercise (Kara, 2011). The first two references – the phone call from Boston and a subsequent
comment by Major James Fox (“I’ve never seen so much real-world stuff happen during an
exercise”) – were the only moments that suggested that NEADS staff were wondering if the
information represented an exercise. The remaining references are almost entirely related to the
logistics of cancelling the previously scheduled simulation. For instance, at 9:15am an off duty
staff member called in (5) to ask if the exercise was on hold and was told, “Not at this time, no,
but I think they are going to [put the exercise on hold]” (NEADS, Channel 7) or at 9:30am the
simulation inputs began automatically and Nasypany ordered them turned off (6), “You know
what? Get rid of this damned sim. Turn your switch sim… Hey, turn the switch sim off. Get rid
of that crap” (9:30am, NEADS, Channel 2). There was one final comment at 10:08am (10),
when Master Sgt McCain was told about a bomb on U93, which could be interpreted either as
gallows humor or a lingering question about the simulation exercise was still running. McCain
said, “If this is an exercise input, it’s a good one” (10:08am – off mic conversation; NEADS,
Channel 2). However, given the time of the comment – after planes had crashed into the World
Trade Center and the Pentagon – this comment seems likely to be an attempt at humor.
The comments around whether the situation was a conventional hijacking or an attack were too
numerous to enumerate in their entirety. We selected key moments and summarized them in a
similar fashion in Appendix 2. As described above, just after NEADS learned of the first
hijacking, NEADS ID Techs called Boston back to get information about the plane and the
Weapons Techs coordinated the military fighter jet escort. Everything was proceeding according
to protocol except that no one knew the location of the plane.
24
The second transition in understanding from a conventional hijacking situation to the US being
under coordinated attack required more sensemaking than the first transition. This transition was
not a clear cut issue (i.e. exercise vs. real-world) but rather an event in the real world that was
unexpected and – in many ways – unimaginable. Although some in the intelligence community
had speculated about the possibility of using planes as weapons, the emphasis on training at
NEADS remained on external threats (i.e. a Russian missile strike) and when internal events
were considered, they took the form of conventional hijacking (Kara, 2010). The simulation
exercises that NEADS practiced with were based on the same set of assumptions that the
hijacking protocol were: that planes would be visible, that there would be time to respond, and
that the hijacker would use the planes as leverage to have their demands met. In fact, on 9/11
NEADS staff needed to create a novel understanding that this unfolding event represented a
hybrid between these two types of threats – an external threat that was being enacted internally
as foreign terrorists took over US domestic flights and turned the planes into weapons.
The first clue NEADS staff had that this hijacking was not conventional was that both internal
NEADS staff and civilian air traffic controllers were having trouble locating the planes. This
problem was initially explained away as the pilot not activating the hijacking transponder code
due to “threats in the cockpit.” NEADS ID Tech Shelley Watson was talking to Colin Scoggins,
a Boston air traffic controller, and was asking for the location of the plane:
8:40am (NEADS, Channel 4)
BC: We, we don’t know! (laughs)
Watson: You don’t know where he is at all?
BC: He’s been hijacked. The pilot’s having a hard time in talking to the… I mean… We
don’t know. We don’t know where he’s goin’. He’s heading towards Kennedy [the
airport], he’s uh, like I said, he’s like 35 miles north of Kennedy now at 367 knots
25
One of the problems with locating the plane was that the more sophisticated civilian radar was
able to determine where the planes were geographically (i.e. longitude and latitude) but not
where they were “spatially” (i.e. altitude). NEADS radar, although antiquated, could determine
altitude but required either the transponder code or the exact geographical location to do so. In
addition to altering the transponder signals, the terrorists also literally flew the planes below the
radar, making the planes functionally invisible to both NEADS and civilian radar.
As events unfolded, however, it soon became apparent that the assumption that hijacked planes
would remain visible was not the only assumption that was wrong that morning. Sensemaking
around the transition to “planes as weapons” was made more complicated by conflicting
information. To illustrate, we highlight two issues involving AA11, the first hijacked plane: first,
the confusion regarding whether AA11 was the plane that crashed into the World Trade Center
and, second, the confusion regarding the “rebirth” of AA11, where it was falsely reported that
AA11 had not crashed and instead was still airborne and en route to Washington, D.C.
NEADS staff learned that a plane crashed into the World Trade Center during a conversation that
NEADS ID Tech Stacia Rountree was having with Sgt David at First Air Force in Tyndall, FL –
he sees the footage of the collision on CNN and interrupts their conversation:
8:51am (NEADS, Channel 7)
David: What, he…wait a minute, a plane just hit… A plane hit the World Trade Center
there. I just saw that on the news. I hope, I hope that’s not the same plane.
Rountree: A plane just hit the World Trade Center?
David: Yeah.
Rountree: It’s on the news?
David: And it may be a 737.
Rountree: A 737?
26
David What type of aircraft is the aircraft? [referring to the hijacked plane]
Rountree: What type aircraft is the aircraft? It’s a 767.
NEADS was unable to get official confirmation for some time that the hijacked plane they had
been searching for was the same plane that hit the WTC. American Airlines would not confirm
that they had lost contact with their plane. Boston air traffic control was momentarily willing to
confirm that the plane was AA11, but then retracted that confirmation. The contradictory
information cascaded across the NEADS radio channels as colleagues heard each other talking
on the phone or as people began to shout out key information (“talking to the room”). Rumors
began to circulate that the WTC was hit by a Cessna not a commercial jet. The Weapons Techs
were talking about the cause of the crash and one Tech said, “I never heard them say American
Airlines Flight Eleven hit the World Trade Center. I heard it was a civilian aircraft...” (8:56 am
(NEADS, Channel 2).
In the midst of the confusion, a report came in at 9:03am that a second plane hit the World Trade
Center. By this time it was clear that the situation no longer represented a conventional hijacking
but people still didn’t have a sense of what was happening:
9:03am (NEADS, Channel 7)
Dooley: Huntress I.D., may I help you?
BC (Scoggins): Yes, it’s Colin Scoggins again, Boston Center. We just had a report of a
second aircraft hitting the Trade Center.
Dooley: A second aircraft hitting the Trade Center!
BC (Scoggins): That is correct, and uh, I, I don’t know what you all need to do, but if I
were you, I’d start puttin’ people on standby as far as those uh, the fighters at Otis, that’s
my recommendation. We said the second aircraft hit, we’re gonna ground all our aircraft.
The information about the second hijacking was quickly passed across radio channels to the
MCC and the Weapons Techs and up the chain of command to the Battle Cab. As an aside about
27
the emergent understanding from the perspective of the air traffic controllers, the decision to
ground all aircraft out of Boston was an action by Boston air traffic controllers to contain the
situation in the only way that they could and to minimize the uncertainty of unfolding events. By
not allowing any more aircraft to take off, they were limiting the number of potential weapons in
the air. Eventually the FAA would give the order to “clear the skies” and land all the aircraft –
more than 4500 planes – that were in US airspace (Levin, Adams, and Morrison, 2002).
In response to the second hijacking, the Weapons Techs called to get extra air support and the
decision was made to move the Otis fighters, which had been scrambled earlier in response to the
first hijacking, into FAA controlled airspace over Manhattan. This decision was the beginning of
the deviation from the routine hijacking protocol, in which fighter jets escort the hijacked plane.
At this point they were making plans for the fighters to potentially take more aggressive action:
9:07am (NEADS, Channel 2)
Nasypany: Okay, Foxy, this is what, this is what I foresee that we probably need to do.
We need to talk to F.A.A. We need to tell 'em that this stuff's gonna keep on going, we
need to take those fighters, put ‘em over Manhattan. Okay?
Fox: Sir.
Nasypany: That’s the best thing. That’s the best play right now. So coordinate with the
F.A.A. Tell ‘em, if there’s more out there—which we don’t know—let’s get ‘em over
Manhattan. At least we got some kinda play.
This transition in understanding was further complicated at 9:21am when Colin Scoggins at
Boston called back with the report that AA11 was not the plane that crashed into the World
Trade Center. Scoggins had been listening in on a FAA conference call out of Washington, heard
the information that AA11 hadn’t crashed, and wanted to pass along the information.
Unfortunately, this information was incorrect:
9:21am (NEADS, Channel 7)
Rountree: Huntress I.D., how can I help you?
28
BC (Scoggins): Scoggins, Military Boston Center. Just had a report that American eleven
is still in the air and it’s on its way towards, heading towards Washington.
Rountree: American eleven is still in the air?
BC (Scoggins): Yeah--Rountree: And it’s on its way to Washington?
BC (Scoggins): ---there was definitely another aircraft that hit the tower. That’s the latest
report we have.
Rountree: Okay.
BC (Scoggins): I’m gonna try to confirm an I.D. for you but I would assume he’s
somewhere over uh, either New Jersey or somewhere further south.
Rountree: Okay so, American eleven isn’t the hijack at all then, right?
BC (Scoggins): No he is a hijack.
Rountree: He, American eleven is a hijack?
BC (Scoggins): Yes. Could be a, could be a--Rountree: And he’s heading to Washington?
BC (Scoggins): ---third aircraft.
Rountree: It could be a third aircraft going on to Washington, do you have mode three on
him sir?
The rumor that AA11 was still flying set NEADS staff on a search for a plane that no longer
existed. Although this information was in direct conflict with what they had previously been told,
NEADS staff acted in a conservative fashion and tried to track down the “reborn” AA11. If
AA11 was the plane that crashed into the World Trade Center, it was no longer an active threat;
if the earlier account was incorrect, however, they had a new threat which posed a clear and
present danger to the capitol region. With the incorrect information about AA11, no information
about AA77 being hijacked, and little advance notice, NEADS staff were not able to track down
the phantom plane heading to Washington. In truth, there was a plane en route to Washington –
not AA11 but rather AA77 – which crashed into the Pentagon at 9:37am.
One of the striking things about the NEADS transcripts is that there was not a lot of speculation
about the cause of events, instead you hear people taking actions to learn more about the event
29
and to contain the event. It is only in the few moments when the ID Techs are not on the phone
that they talk about the unfolding events and even then their conversations are brief:
9:04am (NEADS, Channel 4)
Watson: Oh! Oh my God! I’d say, they say it’s pretty serious [2nd plane hitting the World
Trade Center]. Stacia, who were you talkin’ to?
Rountree: I was talkin’ to New York.
Audio of dialing as Rountree begins trying to reach Boston Center again on the phone
Now that three planes had been reported hijacked, NEADS staff began to speculate that that this
was a deliberate and coordinated attack:
9:23am (NEADS, Channel 2)
Nasypany: These guys are smart.
Male speaker: Yeah. They know exactly what they wanted us to do.
The sensemaking continued. By the end of the morning, another plane (U93) had crashed, more
than a dozen aircraft had been reported hijacked (Bronner, 2006), and NEADS staff struggled to
make sense of the unfolding events and to protect US airspace, as best they could.
Managing the flow of information: Pushing and pulling information
As events unfolded, information was coming in from various sources; NEADS had to coordinate
understanding and action within their own team as well amongst the various agencies with which
they interacted. NEADS staff were extremely agentic as they made sense of the evolving
situation. Not only were they bracketing and labeling the information they were receiving, they
were actively pulling information, by which we mean seeking out missing information to
supplement or augment what they knew, and pushing information, by which we mean
transmitting information to those they thought could benefit from it.
30
Pushing and pulling information was not a simple endeavor. These processes often did not work
as anticipated: it was difficult to reach people, sometimes when they called for more information,
none was available, and sometimes people who were expected to be able to provide information
instead needed to be updated. The more frustrating and occasionally heart-stopping segments of
the transcripts were the moments when NEADS staff were trying to reach people at other
facilities and had the wrong number or kept getting a busy signal. Almost every time the NEADS
ID techs tried to call a new phone number, they experienced problems and delays. For instance,
immediately after NEADS staff heard about the hijacking, they tried to call Boston air traffic
control center to ask if they had more information.
8:47am (NEADS, Channel 7)
8:47:03 – 8:47:18 Audio of dialing, then busy signal
8:47:19-8:47:33 Audio of dialing and then busy signal
8:47:34 Rountree: Shit
8:47:35 – 8:47:48: audio of dialing and busy signal.
8:47:42 Rountree: Uh, their line’s busy right now. I’m still tryin’.
8:47:49 - 8:48:02 Audio of dialing and busy signal.
8:48:03 - 8:48:15 Audio of dialing and busy signal.
A few minutes later:
8:50am (NEADS, Channel 4)
Audio of dialing.
Automated voice: Your call cannot be completed as dialed--Dooley (off mic): Can you ask her to explain that uh--Watson: No. We can’t call long distance from the this--- [pause]
Watson (off mic to colleagues): Hey, wanna dial this number? (laughs)
The following quote encapsulates many of the difficulties that NEADS staff were having as they
attempted to contact other centers for more information:
8:54am (NEADS, Channel 7)
Rountree: Do you have a direct number for New York Military that I can call, please sir?
BC (Scoggins): I… Hold on one sec. [pause] I… Hold on one second sec.
31
Rountree (off mic to colleague): Okay. I’m callin’ Boston for New York Military’s
military line number. They’re gonna call us… They’re calling for a tail number but they
got… I have to call American Airlines.
[pause]
BC (Scoggins): I have a direct [number] on me number. I don’t have their DSN number.
Rountree: Okay, what’s the direct number, sir?
BC (Scoggins): Six three one3…
Rountree: Six three one…
BC (Scoggins): Four six eight…
Rountree: Four six eight…
BC (Scoggins): One four two seven.
Rountree: One four two seven. Copy that, thank you sir, I appreciate it.
BC (Scoggins): Okay and uh, and what number do you want me to call when I….in order
to give you the info on that tail number
Rountree: Um, DSN five eight seven.
BC (Scoggins): Okay 'kay uh, hold on, if you want to stay on the line, he’s on the line
with American right now if you want to hold on--Rountree: Okay, I’ll hold on.
BC (Scoggins): Great. [puts call on hold]
Rountree (off-mic to colleague): Mo. Come here. There’s the number. He’s giving me the
tail number from American, they’re on the line right now, but there’s the number for New
York, if you want to call them, use the black phone. That’s the only phone that works.
[italics added for emphasis]
As you can see in the above quote, NEADS staff began to ask the air traffic controllers that they
could reach how to get in contact with other air traffic control centers. The finding and sharing of
contact information took up valuable time that both NEADS and the air traffic controllers could
have spent managing the situation. As well, you can see a reference at the end of the quote to the
fact that only one of the phones at NEADS worked for calling out to the air traffic control
centers. Like the antiquated radar equipment, the phones were another technology-based ratelimiting step in NEADS’ work that morning.
3
Remaining digits of phone calls redacted for security purposes. Rountree is repeating back the area code and then
three and four digits of the phone number (xxx-xxx-xxxx). The DSN number – a direct line – is also partially
redacted
32
Another difficulty that NEADS encountered, once they were able to reach the air traffic control
centers, is that people who were expected to be able to provide information about the situation
instead often needed to be updated. Immediately after NEADS heard about the first plane
crashing into the North Tower of the World Trade Center, they called New York air traffic
control for more information – the quote begins with NEADS staff talking amongst themselves
about the need to let New York know and to request an update about AA11 to help determine if
it was the plane that crashed into the World Trade Center:
8:51am (NEADS, Channel 4)
Dooley: Yeah, update New York!
Watson: New York, this is Huntress I.D
Dooley: See if they lost altitude on that plane [AA11] altogether.
Audio of dialing
NYC: New York
Watson: Yes ma’am did you just hear the information regarding the World Trade Center?
NYC: No.
Watson: Being hit by aircraft?
NYC: I’m sorry?
Watson: Being hit by an aircraft.
NYC: You're kidding.
Watson: It's on the world news, um...
Dooley (off mic to colleague): Ask 'em if he-- they still have altitude --Watson: Do you still have altitude on that aircraft that you have--NYC: No like I, like I said I, I don’t work radar around here.
Watson: Yeah, you lost—
NYC: Who—
Watson: --you said you lost contact though?
NYC: Call this number again. Call this number right here again.
Watson: Yeah. No It won’t go through.
NYC: Uh…
Dooley: Tell her that we can’t get *
Watson: * one ma’am, 468?
NYC: 5959.
Watson: We cannot get through to that number. Is there any other number, is that New
York Military?
NYC: Uh, no it’s not. Uh, that’s the only number I have for Operations here.
Watson: Okay, we just want to give you a heads up that uh, there is an aircraft that did hit
the World Trade Center just a few minutes ago but that, apparently it’s incidentally is
that-- not-- not that guy [meaning not AA11]
33
As well, in addition to learning that New York had no new information to offer, you see again in
the above quote, how much difficulty they were having reaching the right people to ask for
information. About twenty minutes later, after the second plane was reported hijacked, NEADS
called New York back again for an update on that plane:
9:14am (NEADS, Channel 4)
Watson: New York, Huntress. I was checking on United one seven five,
apparently confirmation that that could’ve been the, the second aircraft that hit the World
Trade Center?
NYC: Oh I, I have no idea. I would have no idea of that.
Watson: Okay. Boston was telling me it was in your airspace, that’s why I’m calling.
NYC: Well it’s in, it’s… It’s in New York TRACON’s airspace but I
have no idea what the uh, what the plane is. Uh, I have, I know, someone told me one
was an American Airlines uh, out of Boston LA--Watson: Yeah, it's American one one.
NYC: But the other one, I have no idea. I have no idea.
Watson You don’t, you don’t… Okay thank you.
Likewise, when they contacted Washington for more information, they realized that Washington
actually needed to be apprised of the situation. Note that the following phone call took place at
9:23 am – at this point, the first two planes have crashed into the World Trade Center and AA11
has just been reported as “reborn” and headed toward Washington:
9:23am (NEADS, Channel 7)
Rountree: Washington, Huntress uh, reference American 11, possible hijack um, New
York has called us. Do you have a mode three on him by any chance?
Washington Center (WC): Uh, hold on a second. That’s the first I’ve heard of that. AA
11, let’s see what we got. Nothin’ scored on American 11, let’s see if may it’s um, zero
one one. No, don’t have anything on ‘em.
Rountree: Okay ‘cause apparently two aircraft crashed into the World Trade Center. We
thought one of them was American 11. New York called us back saying it was on its way
to Washington still being hijacked.
WC: Uh, well I’ve only here about ten minutes--Rountree: Okay.
WC: ---I’m not real sure about what’s goin’ on with that uh, but we don’t have anything
on it---
34
A few minutes later Boston called NEADS to tell them about an aircraft had been sighted six
miles from the White House. NEADS then called Washington air traffic control for more
information about the flight:
9:38am (NEADS, Channel 7)
WC: Washington.
Rountree: Washington, Huntress uh, Boston just called us. They said that they had
information about some aircraft that was six miles southwest of the White House that but
appears to be deviating. Because of-WC: Boston does?
Rountree: --Boston called and said that I'd have had to get the information from you on it.
They don’t have the call type of the aircraft, they don’t have any codes for the aircraft,
they just know that there’s one that's was six miles southwest of the White House.
WC: Okay well Boston’s airspace doesn’t even come close to that. I don’t know how
they got that information but uh, we don’t, hey…
WC (speaking off mic): * aircraft six miles from the White House deviating.
WC (muffled): Boston Center’s *
(off-mic conversation)
WC: Okay we… We don’t know anything about that.
Rountree: Okay you don’t know anything about that, oh…
WC: No we don’t do not and it’s probably just a rumor but uh, if you might want to call
uh, uh, National or Andrews, somewhere, somebody, somebody like that, but we don’t
know anything about that.
Rountree: Okay, copy, thanks.
The information that a plane was six miles from the White House wasn’t a rumor but in fact
critical information about AA77 in the moments just before it hit the Pentagon.
NEADS techs continued to push and pull information, trying to make sense of the unfolding
events. One of archival documents from the 9/11 Commission illustrates the sheer volume of
work that the ID Techs were doing to gather and share information following the “rebirth” of
AA11 (Figure 3).
-- Insert Figure 3 around here --
35
As you can see in Figure 3, NEADS ID Techs made over 27 phone calls to five different air
traffic control centers and to the Canadian branch of NORAD within the time span of an hour. It
is important to mention that Rountree, Watson, and Dooley were making decisions about who to
call without direction from Major Nasypany. Due to the communication breakdown between
NEADS and the FAA, NEADS was operating in an information-poor environment – one of the
greatest contributions the ID Techs made to the emergence of shared knowledge was enlarging
the scope of available information from which to make sense.
Reconciling conflicting accounts
In addition pushing and pulling information, one of the mechanisms that facilitated the
emergence of shared understanding was reconciling conflicting accounts. Team members
received information from different sources and sometimes the information from one source
conflicted with information from a different source. NEADS staff had to decide what
information to privilege and what accounts or sources to pay attention to. Information was seen
as reliable in one of two ways: reliability based on established sources (i.e. originated from
higher up in the military chain of command) and informal sources (where reliability depended on
previous experience).
NEADS is a military organization and, as such, chain of command was important in determining
what information was seen as valid and trustworthy. Initially NEADS staff relied on established
sources for information but, as events unfolded, they were not getting the information they
needed. As mentioned earlier in the paper, the FAA was not passing along information to
36
NEADS. For the first hijacking, NEADS received official confirmation through established
channels:
9:01am (NEADS, Channel 7)
Dooley: Huntress I.D., Sergeant Dooley, how may I help you?
David: Yeah, it’s First Air Force, Sergeant David. We just confirmed from down here
that was one and the same—the hijack and the uh, the plane hitting the building.
Dooley: First Air Force confirmation uh, one and the same, American Airlines and uh,
into the World Trade Center. Copy? Is that what you said, sir?
David: That’s copy, yes.
Dooley: Ah--David: Came from uh--Dooley: Came from who?
David: ---from First Air Force, let me get the person’s name.
Dooley: Okay.
David: Let me get that official, hold on.
David: Okay, Dawne Deskins
Dooley: Okay, thank you.
Recall that NEADS reports to First Air Force (CONR) in Tyndall, FL. This phone call is the
official confirmation from NEADS’ commanding unit that AA11 was the plane that crashed into
the World Trade Center. The caller, Sgt David, is very clear about indicating where the
confirmation originated, including giving the name of the person providing the confirmation.
This is a level of detail not present in any other confirmations that NEADS received because this
was the one and only official confirmation. Coincidentally, it is worth mentioning that Dawne
Deskins, who is usually at CONR, was at NEADS in the Battle Cab that morning due to the
training exercise – regardless of this change in location, the confirmation still comes through the
regular communication channels. During the subsequent hijackings and crashes, for reasons that
are still unclear, the flow of information down the official hierarchy to the NEADS ID Techs
halted. Instead, NEADS ID Techs received information directly from air traffic control centers.
However, the MCC and Weapons Techs continued to receive information from higher
37
authorities, in part because the CONR Battle Commander, Col. Marr, was at NEADS that
morning sitting a few feet away from the MCC.
As a result of not receiving information from established sources, NEADS ID Techs began to
rely on informal sources, which they judged as reliable based on their experience of whether or
not the sources had repeatedly demonstrated that they had useful information to pass along. As
the morning progressed, it became apparent the New York and Washington rarely had
information to contribute and often were missing essential information. In contrast, Boston –
particularly Colin Scoggins – emerged as an unlikely source of information. In fact, Scoggins
was NEADS’ primary source of information about unfolding events. From the time of the first
hijacking, against normal reporting protocol, he started phoning NEADS directly (rather than
going through the formal channels). NEADs learned an enormous amount of information that
morning from Scoggins: he informed them that a second plane crashed into the World Trade
Center (see p. 30 of this document), that the second plane was likely U175, that there was a
hijacked plane headed toward the White House, and that another plane had crashed into the
Pentagon. These were all vital pieces of information that shaped NEADS’ understanding of and
response to the situation.
NEADS had such little information to work with that even a few details made a difference. In
addition to timely and (mostly) accurate information, Scoggins also provided some details such
as the general location of planes or the direction of flight. Those details aided NEADS in their
search. Below is an excerpt of Scoggins’ call to NEADS to let them know of a plane approaching
the White House:
38
9:35am (NEADS, Channel 7)
Rountree: Huntress I.D. * how (UNINTEL) can I help you?
BC: We have a report of an aircraft six miles southeast of the White House.
Rountree: Six miles southeast of the White House?
BC: Yup. East-- Southeast… He’s he moving away?
Rountree: Southeast * from the White House.
BC: Air-- Aircraft is moving away.
Rountree: Moving away from the White House.
BC: Yeah.
Rountree: Okay but what, is [unintelligible]?
BC: We, we believe just, we just have to verify the aircraft. We’re not sure who it is. Uh,
if you want to hold on a second--Rountree: Okay, copy. BC: ---we got people down here there looking.
Rountree: Okay 'kay copy.
BC: What was that position? Six… yeah, six southwest. Six southwest not southeast of
the White uh, White House, deviating away.
Rountree: Deviating away, you don’t know what type aircraft, you don’t know who he
is.
BC: Nothing, nothing, that’s why--Rountree: ---DSI--BC: ---nothing We're over here in Boston so I have no clue. That--hopefully somebody
in Washington but I thought someone who was watching would have a better information
for you.
Rountree: Okay.
BC: Is this a good number to keep calling?
Rountree: Yeah, this is a great number to keep calling.
As events unfolded, NEADS staff demonstrated their increasing trust in Scoggins. Shortly after
the second plane was hijacked, Watson called Boston Center back to see if they learned anything
more about the number of “souls on board” U175. She spoke with Scoggins, who began to ask
questions about what the planned military response was to the unfolding situation. In a
remarkable deviation from normal reporting protocol, the NEADS Techs connected Scoggins
directly to Major Nasypany.
9:17am (NEADS, Channel 2)
Dooley: Major. Major, we need you guys to… We need you to talk to him a minute,
Major Nasypany, just give me the go ahead—
Nasypany: Go ahead.
BC (Scoggins): Yes, Colin Scoggins, Boston Center Military.
39
Nasypany: Hey, how are you doin’, it’s Major Nasypany.
BC (Scoggins): How’re you doin’? Um, we have uh, uh, could we shut every… Nobody
is departing Boston and all in the whole airspace Boston Center. We’ve shut all aircraft
down and we’re rerouting New York metro airport. Our only concern is that there are
aircraft in the sky and in case any more of 'em divert or start uh, starting turning or
whatever they’re gonna do, I, we were just wondering you do have people on alert that
we--Nasypany: I got fight… I got fighters in Whiskey 105 right now [Whisky 105 is the
military’s name for an airspace located off the coast where the Otis fighters are in a
holding pattern]. I have a tanker there as well. I got other aircraft on alert down at
Langley.
BC (Scoggins): Okay.
Nasypany: And I’m getting ready to, and I have trackers uh, over JFK, over Boston, and
in that area right now, just lookin’ for anything suspicious.
BC (Scoggins): Anything suspicious, okay. And uh, we’ll let you know about the
internationals. We’re not sure what we’re doing with them yet at this time. But-Nasypany: Okay, so well JF… JFK and Boston are shut down, correct?
BC (Scoggins): We have shut down Boston. I’m not sure if New York Center has now
but we are-- are rerouting all our-- any aircraft at this time from that's (UNINTEL) for
New York, we are rerouting and putting 'em somewhere else.
Nasypany: Okay. And if you get anything--- if you----if any-- any of your controllers see
anything that looks sorta kind of squirrelly, just give us a yell. We’ll get those fighters in
that location. --BC (Scoggins): Okay. Alrighty. -Nasypany: Okay?
BC (Scoggins): Thank you very much.
After they accumulated experience with various information sources, team members began to tell
each other which sources of information were reliable and which were not. These evaluations are
sprinkled throughout the transcripts. In the following quote, Dooley is talking to the other
NEADS ID Techs and expressing frustration:
9:30am (NEADS, Channel 4)
Dooley: See this guy, they… Boston is the only one giving us any kind of decent freakin’
input.
A few minutes later, Rountree also talks to the ID Techs about who is sharing reliable
information:
40
9:44am (NEADS, Channel 7)
Rountree: (sighs heavily) Okay, Mo [Maureen Dooley, supervisor NEADS ID Techs].
The aircraft that he said is at the White House is now near the Pentagon. I don’t know
where the hell they’re gettin’ their intel info. I said Washington doesn’t have a ...has no
clue. When I called Washington about it, they didn’t know what the hell was goin’ on.
Likewise at 9:55am (NEADS Channel 7):
Rountree: (sighs) Okay, Cleveland’s line is still busy. Boston’s the only one that passes
us this information. Washington doesn’t know shit.
This pattern of reliability persisted throughout the morning: New York and Washington
continued to lag behind the developing understanding of events and Boston continued to have
new and useful information.
DISCUSSION AND CONCLUSIONS
The goal of our study was to gain greater insight into how understanding of an unexpected event
develops and changes over time within a team. Our analysis revealed that shared understanding
went through two transitions: first, as the team realized that the events were not part of the
previously scheduled training exercise but instead were occurring in the real world, and second
when they realized that the events were not a conventional hijacking but instead were a
coordinated attack on the US, with hijackers using planes as weapons. We identified two
mechanisms that facilitated those transitions in understanding: actively managing the flow of
information and reconciling conflicting accounts. As NEADS staff actively managed the flow of
information, they pulled information from various sources as they attempted to ascertain what
was happening and pushed information to others in their network that they thought might benefit
from that information. As NEADS staff reconciled conflicting accounts, they had to determine
41
what information to privilege and pay attention to – information was seen as reliable if it came
from established sources (i.e. from higher up in the military chain of command) or from informal
sources that had demonstrated over time that they had timely and accurate information.
Our study builds upon and extends the current models of shared understanding. Our findings
suggest that teams in dynamic settings need the capabilities that have been identified in studies
conducted in more static contexts: that is, NEADS staff needed to know where to find
information (Wegner, 1995; Austin, 2003; Bunderson, 2003; Lewis, Lange, and Gillis, 2005;
Reagans, Argote, and Brooks, 2005; Lewis and Herndon, 2011), to assess expertise (Bunderson,
2003), and to share non-commonly held information (Okhuysen and Eisenhardt, 2002; Stasser
and Titus, 2003). However, they also needed to be able to cope with large volumes of
information without suffering from information overload, to discern what information required
further attention, to actively seek out information to supplement what they know and to pass
along information to those who needed it, to determine what information or accounts were
reliable, and to do all this under enormous time pressure in a context where the consequences of
failure were high.
Our findings imply that it is important to pay attention to the type of transition in understanding,
as some transitions in understanding are more difficult to accomplish that others. In our future
analysis, we hope to expand our findings by exploring in more detail the influence of different
team members on the development of shared understanding and the response to the evolving
event – in particular, focusing on whether the centrality of the actor matters. For instance, it may
42
be that for coordinated action, the alignment of and accuracy of shared understanding is most
important for central actors but less important for peripheral actors.
Our findings serve as a reminder that the development of shared understanding, while important,
is only one aspect of successfully managing an unexpected event. Rather than an accumulation
of small problems and interruptions (Rudolph and Repenning, 2002), this disaster involved an
accumulation of large problems. The sheer quantity of events – four hijacked planes, multiple
other suspected hijackings – all contributed to an overwhelming situation. NEADS staff quickly
and accurately made sense of unfolding events and deployed the available resources as best they
could, often deviating from protocol to adapt their response to the novel and rapidly changing
situation. Yet, although the NEADS staff did a heroic job, the demands of the situation – in many
ways – eclipsed their resources. Other parts of the system in which they were embedded failed
them – the FAA did not pass along critical information and, by the time NEADS was informed
of the hijackings, they had little to no time to effectively intervene in any of the hijackings. At
the end of the day, the only actions that definitively saved lives were undertaken by the
passengers on U93, who rushed the cockpit, causing the plane to crash before it reached the
terrorist’s intended target in Washington DC.
Our study contributes to the sensemaking literature by highlighting that the very “flow of
experience” that provides the raw materials for sensemaking is not a given but is, instead,
malleable. We found that the amount of incoming information, which contains the cues that were
noticed, bracketed, given meaning, and that formed the basis for action (Weick, Sutcliffe, and
43
Obstfeld, 2005), could be modified by the team members who were engaged in sensemaking.
NEADS staff significantly enlarged the flow of information that was available to them through
actively pushing and pulling information. Increasing the flow of information can, paradoxically,
either reduce or heighten uncertainty. More information helps reduce uncertainty if the
accumulated data provides more “data points” and helps to illuminate an underlying pattern or
problem. However, more information can also heighten uncertainty, particularly if there are
conflicting accounts.
The need to reconcile conflicting accounts is one of the primary sensemaking challenges that we
see in our data. Unlike previous studies that have explored conflicting accounts in settings where
events unfold over longer periods of time (Maitlis, 2005; Kaplan, 2008), our setting highlights
the challenges that teams face when conflicting accounts must be reconciled within an extremely
compressed time frame to enable further action. An important aspect of reconciling conflicting
accounts is determining what information to pay attention to. Our study joins a growing body of
work that emphasizes the need for a closer examination of the link between attention and
sensemaking (Ocasio, 1997; Ocasio and Joseph, 2005; Rerup, 2009; Nigam and Ocasio, 2010).
Lastly, our study also contributes to the literature on team boundary spanning. NEADS is not just
engaged in team boundary spanning, defined as “the team’s actions to establish linkages and
mange interactions with parties in the external environment” (Marrone, 2010, p. 914), NEADS is
a boundary spanning team. In order to defend US airspace, NEADS is explicitly designed to
coordinate understanding and activities within their own team (i.e. intra-team coordination) as
44
well as coordinate understanding and activities with the various other teams and agencies with
which they interact (i.e. inter-team coordination), including the FAA, individual civilian air
traffic control centers, military bases and pilots, military air traffic controllers. Many of the
teams that routinely manage unexpected events can be thought of as boundary spanning teams –
for example, teams at CDC that manage emerging infectious threats, such as the West Nile Virus
outbreak, must coordinate their efforts with front-line health care personnel as well as various
local, state, and federal agencies; FEMA teams must coordinate many agencies during a disaster;
and FBI teams must coordinate multiple law enforcement agencies during large scale
investigations. However, there has been little discussion of boundary spanning teams in the team
boundary spanning literature. Our data suggests that this extreme form of boundary spanning
may provide insight into how boundary spanning functions in dynamic and uncertain contexts.
The role of context in team boundary spanning has not been fully explored – almost all studied
on boundary spanning activities have been conducted in conventional organizational contexts,
focusing primarily on new product development, R&D, or consulting teams (see Marrone, 2010
for a recent review of boundary spanning studies). As a result, our current understanding of what
team boundary spanning involves may include important boundary conditions that have not been
fully explored. Context may shape the relative importance and enactment of boundary spanning
activities. For example, in conventional settings, the team boundary spanning activity of general
information search – the actions that access outside parties, usually industry experts, for general
or technical information or expertise – is theorized to involve low levels of interdependence or
coupling (Marone, 2010, p. 917). However, we see in our data that information exchange is a
critically important function of the team which is highly interdependent and tightly coupled.
45
REFERENCES
Austin, J. R.
2003 "Transactive memory in organizational groups: The effect of content, consensus,
specialization, and accuracy on group performance." Journal of Applied Psychology, 88: 866878.
Bechky, B. A., and G. A. Okhuysen
2011 "Expecting the unexpected? How SWAT officers and film crews handle surprises."
Academy of Management Journal, 54: 239-261.
Bronner, M.
2006 "9/11 live: The NORAD tapes." Vanity Fair.
http://www.vanityfair.com/politics/features/2006/08/norad200608
Bunderson, J. S.
2003 "Recognizing and utilizing expertise in work groups: A status characteristics perspective."
Administrative Science Quarterly, 48: 557-591.
Burke, C. S., K. C. Stagl, E. Salas, L. Pierce, and D. Kendall
2006 "Understanding team adaptation: A conceptual analysis and model." Journal of Applied
Psychology, 91: 1189-1207.
Cannon-Bowers, J. A., and E. Salas
2001 "Reflections on shared cognition." Journal of Organizational Behavior, 22: 195-202.
Faraj, S., and Y. Xiao
2006 "Coordination in fast-response organizations." Management Science, 52: 1155-1169.
Farmer, J. J., J. A. Azzarello, M. L. S. Kara, K. Shaeffer, G. S. Brown, D. J. Hyde, L. M.
Sullivan, and C. M. Pereira
2011 "A New Type of War: The Story of the FAA and NORAD Response to the September 11,
2001 Attacks." Rutgers Law Review.
http://www.rutgerslawreview.com/2011/a-new-type-of-war/
Filson, L.
2003 Air War Over America: Sept 11 Alters Face of Air Defense Mission. Tyndall Air Force
Base, FL: First Air Force, Public Affairs Office.
Gittell, J. H., R. O. B. Seidner, and J. Wimbush
2008 "A relational model of high performance work systems." Academy of Management
Proceedings: 1-6.
Griffin, M. A., A. Neal, and S. K. Parker
2007 "A new model of work role performance: Positive behavior in uncertain and interdependent
contexts." Academy of Management Journal, 50: 327-347.
46
Huber, G. P., and K. Lewis
2010 "Cross-understanding: Implications for group cognition and performance." Academy of
Management Review, 35: 6-26.
Kaplan, S.
2008 "Framing contests: Strategy making under uncertainty." Organization Science, 19: 729752.
Kara, M.
2010 "Exercise War Games." http://www.oredigger61.org/?cat=7
Klimoski, R., and S. Mohammed
1994 "Team mental model: Construct or metaphor?" Journal of Management, 20: 403-437.
Lee, T. W., T. R. Mitchell, and C. J. Sablynski
1999 "Qualitative research in organizational and vocational psychology, 1979-1999." Journal of
Vocational Behavior, 55: 161-187.
Levin, A., M. Adams, and B. Morrison
2002 "Clearing the skies." USA Today.
Lewis, K., and B. Herndon
2011 "Transactive memory systems: Current issues and future research directions." Organization
Science 22: 1254-1265.
Lewis, K., D. Lange, and L. Gillis
2005 "Transactive memory systems, learning, and learning transfer." Organization Science, 16:
581-598.
Maitlis, S.
2005 "The social processes of organizational sensemaking." Academy of Management Journal,
48: 21-49.
Marrone, J. A.
2010 "Team boundary spanning: A multilevel review of past research and proposals for the
future." Journal of Management, 36: 911-940.
Mathieu, J. E., T. S. Heffner, G. F. Goodwin, E. Salas, and J. A. Cannon-Bowers
2000 "The influence of shared mental models on team process and performance." Journal of
Applied Psychology, 85: 273-283.
Meyerson, D., K. E. Weick, and R. M. Kramer
1996 "Swift trust and temporary groups." In R. M. Kramer, and T. R. Tyler (eds.), Trust in
Organizations: Frontiers of Theory and Research. Thousand Oaks, CA: Sage Publications.
47
National Commission on Terrorist Attacks Upon the United States
2004. The 9/11 Commission Report: Final Report of the National Commission on Terrorist
Attacks Upon the United States, Official Government Edition. New York, NY: W.W. Norton &
Company.
Nigam, A., and W. Ocasio
2010 "Event attention, environmental sensemaking, and change in institutional logics: An
inductive analysis of the effects of public attention to Clinton's health care reform initiative."
Organization Science, 21: 823-841.
NORAD
2012a "About CONR." http://www.norad.mil/about/CONR.html
2012b "About NORAD." http://www.norad.mil/about/index.html
Ocasio, W.
1997 "Towards an attention-based view of the firm." Strategic Management Journal, 18: 187206.
Ocasio, W., and J. Joseph
2005 "An attention-based theory of strategy formulation: Linking micro- and macroperspectives
in strategy processes." Strategy Process, 22: 39-61.
Okhuysen, G. A., and K. M. Eisenhardt
2002 "Integrating knowledge in groups: How formal interventions enable flexibility."
Organization Science, 13: 370-386.
Reagans, R., L. Argote, and D. Brooks
2005 "Individual experience and experience working together: Predicting learning rates from
knowing who knows what and knowing how to work together." Management Science, 51: 869881.
Rerup, C.
2009 "Attentional triangulation: Learning from unexpected rare crises." Organization Science,
20: 876-893.
Rico, R., M. Sanchez-Manzanares, F. Gil, and C. Gibson
2008 "Team implicit coordination processes: A team knowledge-based approach." Academy of
Management Review, 33: 163-184.
Rudolph, J. W., and N. P. Repenning
2002 "Disaster dynamics: Understanding the role of quantity in organizational collapse."
Administrative Science Quarterly, 47: 1-30.
Shrivastava, P., I. I. Mitroff, D. Miller, and A. Miglani
1988 "Understanding industrial crises." Journal of Management Studies, 25: 285-303.
48
Snook, S. A.
2000 Friendly Fire. Princeton, NJ: Princeton University Press.
Stasser, G., and W. Titus
2003 "Hidden profiles: A brief history." Psychological Inquiry, 14: 304-313.
Vaughan, D.
1996 The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA.
Chicago: The University of Chicago Press.
Waller, M. J., N. Gupta, and R. C. Giambatista
2004 "Effects of adaptive behaviors and shared mental models on control crew performance."
Management Science, 50: 1534-1544.
Wegner, D. M.
1995 "A computer network model of human transactive memory." Social Cognition, 13: 319339.
Weick, K. E.
1990 "The vulnerable system: An analysis of the Tenerife air disaster." Journal of Management,
16: 571-593.
Weick, K. E.
1993 "The collapse of sensemaking in organizations: The Mann Gulch disaster." Administrative
Science Quarterly, 38: 628-652.
Weick, K. E.
1995 Sensemaking in Organizations. Thousand Oaks, CA: Sage Publications.
Weick, K. E.
2007 "The generative properties of richness." Academy of Management Journal, 50: 14-19.
Weick, K. E., and K. M. Sutcliffe
2007 Managing the Unexpected: Resilient Performance in an Age of Uncertainty, Second ed.
San Francisco, CA: Jossey-Bass.
Weick, K. E., K. M. Sutcliffe, and D. Obstfeld
2005 "Organizing and the process of sensemaking." Organization Science, 16: 409-421.
Yin, R. K.
2003 Case Study Research: Design and Methods, Third ed. Thousand Oaks, CA: Sage
Publications.
49
FIGURE 1
NEADS and the agencies with which it interacted
FAA Air Traffic Services
Command Center (ATSCC)
Herndon, VA
NEADS
Rome, NY
Boston
Indianapolis
Cleveland
NYC
Washington
Otis Air Force
Base
Langley Air
Force Base
Fleet Air
Control and
Surveillance
Facility
CONR (Continental NORAD region)
Co-located with First Air Force, Tyndall Air Force Base, FL
50
FIGURE 2
Timeline of key events on 9/11
H
Hijacked planes
Time NEADS notified
American 11
H
(AA11) 8:37am 8:46am
8:22am
1st WTC tower
United 175
H
Time plane crashed
False report:
AA11 “reborn”
9:21am
9:03am
(U175)
8:42am
American 77
Time plane was hijacked
2nd WTC tower
H
9:34am
(AA77)
8:51am
United 93
H
(U93)
9:23am
9:37am
Pentagon
10:03am
10:14am
Shanksville, PA
Planes thought to be hijacked
United 1989
9:41am
Canadian plane
10:03am
Unknown plane (turns out to be Langley fighter)
51
10:07am
FIGURE 3
Pushing and pulling information: NEADS ID Tech phone calls between 9:20-10:20am
Document from 9/11 Commission investigation
To interpret the above document:
ZBW = Boston Air Route Traffic Control Center
ZNY = New York Air Route Traffic Control Center
ZDC = Washington Air Route Traffic Control Center
ZID = Indianapolis Air Route Traffic Control Center
ZOB = Cleveland Air Route Traffic Control Center
DRM/CH column – the right hand number (CH) corresponds to the NEADS Channels (i.e. 4 =
Channel 4)
52
APPENDIX 1
First transition in understanding (from simulation exercise to real world event)
Timeline created from Kara, 2011 data
Coordinated attack
Conventional hijacking
Exercise
10:20
❽
10:10
❼
10:00
❻
9:50
9:40
❺
9:30
9:20
❹
9:10
9:00
❷ ❸
8:50
8:40
❶
❾❿ 11 12
13
13
Number
1
2
3
Time
8:37am
8:43am
8:44am
4
8:57am
5
9:15am
6
9:30am
7
9:40am
8
9
9:46am
10:06am
10
10:08am
11
10:11am
12
10:14am
13
10:20am
Content
Phone call from Boston to inform NEADS of hijacking
Major Fox, says he’s “never seen so much real world activity during an exercise”
NEADS Air Surveillance Technician rearranges staff to meet demands of hijacking
and comments, “the exercise is gonna’ have to go on a little bit of hold here, that’s all”
Nasypany joking with Col. Marr (Battle Cab), “think we put the exercise on hold, what
do you think?
Off duty staff member calls in to ask if exercise on hold. Told “no, not at this time, no,
but I think they are going to”
Nasypany instructs staff to turn off sim switches, which have started simulation inputs
automatically, “Get rid of that crap” quote
Head of the surveillance section talking about what he can see on scopes, “Get the
goddam friendlies out of my face” [not sure this is simulation related]
Sgt Powell calls unit for help, they joke “Are you sure this isn’t an exercise”
Master Sgt McCain takes call, asked about whether exercise proceeding and replies,
“the exercise was cancelled, torn all that apart, sir”
McCain jokes to Dooley about report of bomb in U93, “if this is an exercise input, it’s
a good one!”
Cpt Nagel, Weapons Controller, receives call from Cheyenne Mountain control
requesting all exercise inputs be terminated. Answers phone initially saying, “Sim”
Sgt Richmond, Air Surveillance Technician, receives follow up call from Cheyenne
and told to terminate exercise inputs, “exercise side only” He responds, “looks like all
our exercise tracks are down, are gone”
Cheyenne Mountain again verifying exercise tracks cancelled. NEADS staff respond,
“Northeast, nothing going out, exercise”
53
APPENDIX 2:
Second transition in understanding from conventional hijack to attack on US
Coordinated attack
Conventional hijacking
Exercise
10:20
10:10
10:00
❿ 11 12
❼❽❾
9:50
9:40
❻
9:30
❺
9:20
❹
9:10
❸
9:00
8:50
8:40
❶❷
13 14
13
Number
1
2
3
Time
8:37am
8:40am
8:46am
4
8:51am
5
6
7
8
9
10
8:56am
9:03am
9:21am
9:21am
9:21am
9:36am
11
12
13
14
9:37am
9:40am
10:07am
10:07am
Content
Phone call from Boston to inform NEADS of hijacking of AA11
NEADS talk with Boston Center, “I guess there’s been some threats to the cockpit”
Nasypany, “And probably right now with what’s going on the cockpit it’s probably
really crazy. So, it probably needs to... that will simmer down and we’ll probably get
some better information”
NEADS learns of WTC crash from person watching CNN, “I hope that’s not our
plane”
“I heard it was a civilian aircraft...” Rumor of civilian aircraft not 737 hitting WTC
Learn about 2nd hijacking and WTC crash
Scoggins tells NEADS ID Techs about 3rd hijacking
False report that AA11 reborn
Nasypany, ”Chase this guy down”
Nasypany, “I got an aircraft six miles east of the White House! Get your fighters there
as soon as possible!”
Hear Pentagon hit; Nasypany, “Can’t protect my National Capitol Region”
“Delta 89, that’s the hijack. They think it’s a possible hijack”
“Baltimore is saying something about an aircraft over the White House”
“We’ve got United 93 out here... that has a bomb on board”
54