T7 B10 Team 7 Mfrs Aa Soc Fdr- 11-19-03 Aa Soc Briefing W Notes On Mfr 373

OMISSION SENSITIVE MEMORANDUM FOR THE RECORD Event: American Airlines (AA) System Operations Command Center (SOCC) Type: Briefing Date: November 19, 2003 Special Access Issues: None Prepared by: Lisa Sullivan and Bill Johnstone Team Number: 7 and 8 Location: SOCC; American Airlines Headquarters; Ft. Worth, TX Participants (non-Commission): Craig Parfitt, AA Managing Director of Dispatch Operations; Craig Marquis, AA System Operations Control (SOC) Manager; Michael Mulcahy, AA Manager of SOC Policies and Procedures; Joseph Bertapelle, AA Manager of SOC Operations Coordination/Air Traffic Systems; Desmond Barry, Condon & Forsyth, LLP; Christopher Christensen, Condon & Forsyth, LLP; Douglas Cotton, AA Senior Attorney Participants (Commission): Sam Brinkley; Bill Johnstone; Miles Kara; John Raidt; Lisa Sullivan Background [U] Craig Parfitt is now, and was on 9/11, the Managing Director of Dispatch Operations responsible for supervising System Operations Control (SOC) Center and Sector Managers as well as Flight Dispatchers who collectively ji^&st "the allocation of Y r corporate resources for the operation of American Airline^jZ>n the day of 9/11, he — |_served as a Director of the System Operations Command Center (SOCC). He has had almost 32 years of airline experience, and once served as a Flight Dispatcher. [U] Joe Bertapelle is a SOC Manager responsible for representing senior management in the daily operation of the SOC. In the period up to and including 9/11, he was Manager of SOC Operations Coordination/Air Traffic Systems that included serving as the pcompany's liaison with the FAA on Air Traffic Control matters. On the day of 9/11, he as a Director of the System Operations Command Center (SOCC). He has had almost 28 years of airline experience, and once served as a Flight Dispatcher. [U] Craig Marquis is now, and was on 9/11, a SOC Manager responsible for representing senior management in the daily operation of the SOC. He was the SOC Manager-onDuty during the period involving the 9/11 hijackings. He has had over 16 years of airline experience, and once served as a Flight Dispatcher.

COMMISSION SENSITIVE

[U] Mike Mulcahy is now, and was on 9/11, the Manager of SOC Policies and Procedures who is responsible for the establishment and modification of SOC policies and procedures, including maintenance of the Emergency Procedure checklist used in the SOC. On 9/11, he served as the SOCC Support position. He has had over 28 years of airline experience, and once served as a Flight Dispatcher. [U] Commission staff received a 45-slide presentation (including a hard copy of same) entitled "System Operations Control."

^ a** /£,

System Operations Control [U] System Operations Control (SOC), which is on the second floor of the headquarters building, is always operational and "coordinates the day-to-day, minute-by-minute operation of the airline and includes flight dispatch operations (approximately 36 dispatch desks managing 27 geographic areas, now and on 9/1 l)*'Flight Dispatcher Karen Hauck, at Desk 23, was responsible for both Flights #11 and #77 on 9/11. At American, the policy is that one dispatch position follows a given flight from start to finish. Also, under the Dispatchers' union contract with the airline, only dispatchers could send ACARS transmissions to American aircraft. [U] The SOC also contains 3 Air Traffic Control (ATC) specialists who are responsible for communicating and coordinating with the ATC regional centers as well as with the ATC Command Center (Heradon, VA). These individuals generally participated in the airline industry daily 7:30 AM (Central Time) conference call set up by the Air Transport Association (in coordination with Herndon ATC Command Center) to discuss the day ahead (typically weather and traffic concerns. The briefers were unsure whether AA participated in such a call on 9/11 because there were no significant weather or other systemic concerns they were aware of at the time. On 9/11, Bill Halleck handled most communication with ATC officials (he had a number of personal contacts there), while I land! 1-were.in touch with the Herndon Command Center. [U] The SOC receives all security threats against AA aircraft and property, aftd: the SQC, Center Manager-on-Duty is responsible for obtaining positive confirmation and identification of the airline, flight and aircraft involved. Typically, if the matter occurred in the air, the report would go first to the Flight Dispatcher, or if on the ground to the Ground Security Coordinator (at the airport), before being passed to the SOC Manager. [U] The SOC Manager is also responsible for assigning the security level for the incident (Level I - Major accident or incident; Level II - Minor damage; Level III - Minor incident), maintaining a log and recording all activities; and immediately notifying the Vice President of Operations and Planning (OP&P) and the Manager of Dispatch Operations. Finally, the SOC Manager is "responsible for verifying all critical notifications and for the activation of the SOCC."

9/11 Working-level Employee

System Operations Command Center [U] The System Operations Command Center (SOCC), which is on the third floor overlooking the SOC and has been in existence for 13 years, is activated in emergencies and special occasions, including major accidents, hijackings, other security events, and events requiring the coordination of multiple departments of the airline over an extended time. Once activated, the SOCC "has the primary responsibility for support of accident recovery from start to finish.. .(and) will assign and establish corporate activity coordination with the FA A." While American employees thought of the SOC as the "tactical" center of operations, in emergencies, it was understood that the SOCC was the "war room." [U] Because of space limitations, representation in the SOCC was limited to one person per department, with the SOCC Director the final authority on all access issues. Staffing requirements are determined based on the nature of the incident (accident, security event, or strike, for example). The SOCC Director "has primary responsibility for managing the accident recovery effort from start-to-finish." The SOCC Director and other SOCC personnel are pulled off of their regular duties for as long as necessary. [U] In emergencies, the SOC was generally responsible for notifying the FAA/ATC, Department of Defense, and Coast Guard. While the AA Security division would notify the airline's Principal Security Inspector (PSI) at FAA, and the State Department. [U] The key decisions on the immediate response to the 9-11 hijackings were made in the SOCC. Per the airline's experience and procedures, it was felt that the SOCC could best coordinate and monitor the entire system from a central location felt that independent dispatchers with independent flights and consolidated the center. Once activated, the SOCC had the capability to operate around the clock (in 3 shifts of 8 hours each) as necessary. Airline Operations and Security [U] In its day-to-day operations, the SOC must balance safety (which the briefers indicated included security), customer service (i.e. on-time performance), and operating economics. It is also required, in coordination with the FAA, to balance aircraft, people, facilities and air space, and always "needed to figure out what we were going to do the next day." [U] Security incidents are handled at the management level, and the airline's Center and Sector Managers (a total of 12 individuals) are responsible for managing "any abnormal or emergency situation that affects any part of the airline, its passengers, its employees or facilities." As noted above the SOC Manager has primary responsibility in this regard. However, the briefers indicated that the Pilot In Command and flight crew handle most on-board security incidents in-flight before the managers are made aware of them. For example, a pilot might say he was landing and ask for the law enforcement authorities to meet his flight at the gate to pick up an inebriated passenger or someone who had tried to

^» /bj°4o

light a cigarette. The SOC Manager would call the relevant airport ground security coordinator (for communicating with the appropriate local law enforcement entity) and then call the Managing Director for Dispatch Operations who would "determine the course of security for the airline." [U] With respect to threat assessment, American relied not only on FAA intelligence (via Security Directives and Information Circulars) and specific incident reports that came to the SOC. The airline also employed Pinkerton's to provide (through AA Security Director Wansley) a synopsis of intelligence on security threats in different parts of the world. However, though at the time of 9/11 the airline received such reports daily, the briefers recollection was that all of the information was about foreign threats. [U] In 1985, the airline industry adopted a protocol called Positive Target Information (PTI) as a means of validating security threats and preventing "unnecessary injuries and degradation of safety." The policy as implemented at AA indicates, "It is important for Law Enforcement Agencies to coordinate with SOC to prevent unnecessary passenger, crewmember, or aircraft mishaps." [U] The briefers indicated that the PTI policy was a response to the fact that airlines get many indefinite and ultimately groundless security threats. For example, though American logged a total of 3,445 threats between 1986-2002, the airline reported that only an average of 2 or 3 per year were positive. As an illustration of the efficacy of the policy, the airline points out "there has never been a bomb threat that led to the discovery of a device that did not involve 'positive target information.'" [U] The briefing made the following points in illustrating how AA managers determine whether a threat is "positive" or "indefinite:" • "It is impossible to issue a specific set of rules which govern the evaluation of all security threats." • "SOC Managers on Duty are trained to consider very specific factors when making the determination." • "Unilateral, uncoordinated action in these situations can easily lead to unnecessary passenger injuries and hardships." [U] The responsibilities of the SOC Manager in the initial response to an incident report are essentially unchanged since 9/11. If the Manager ascertains it is a Level I event (Major accident or incident), the manager is to provide basically the same initial response whether it is a terrorist threat or a technical failure. The determination of what to do is made at the SOCC. The Day of September 11, 2001 [U] AA emergency procedures (on 9/11 and today) include a notification checklist (Form A) for the SOC Manager to check off. The document is a contact list with home phone numbers and cell phone. On 9-11 that list wasn't filled out, but the SOC and SOCC personnel did fill out the EMERGENCY PROCEDURES checklist (which has been

provided to the Commission) because everything happened so quickly, the calls had all been made, and the necessary people were already at the SOCC. [U] On 9/11, there was a guard outside the SOCC door. There were many people inside and others wanting to get in. There was also a need to centralize and coordinate communications with the media and the public, and that was handled by the SOCC as well. At some point, the FBI arrived and was given office space nearby the SOCC. There was one representative for safety and another for security in the SOCC. [U] Plans were developed in the SOCC for GO Teams to visit the crash sites and assist with the response, and they tried to launch the teams on 9-11 but the ATC wouldn't allow it as part of the closure of the national air space. They did activate a corporate assistance relief effort composed of volunteers with specialized training who worked to assist with the families of the victims. [U] After 9/11, SOCC procedures have added a position specifically to handle communications with the Department of Defense. Situational Awareness of Hijackings [U] Dispatchers and other persons who sit at positions in the SOC have access to an aircraft situation display that can be tailored to meet specific needs. For example, any individual with access to the system can focus strictly on company planes, a specific plane, or all planes in the system. Military planes are not displayed. The Aircraft Situation Display is tailored to the needs of the airline and is a subset of the TSD (Time Sensitive Display) commonly used by FAA, in that the ASD is based on the FAA radar feed. [U] The ASD is not time sensitive and refreshes each minute or more and its sensitivity and data input, however, was apparently not sufficient to allow American to gam any situational awareness of AA77, but did allow some situational awareness of AA11. [U] AA had a procedure in place (as did United) to isolate an incident flight and take its management away from the SOC and move that management to a crisis center. [Note: This is different than procedures in FAA en route centers. Handling of incident aircraft is left with the controller and area of record and an attempt is made to move handling of other aircraft in his/her airspace to other controllers.] [U] American had no situational awareness of AA77 and had formed the erroneous understanding that AA77 impacted the second WTC tower. [Note: This is different from the FAA awareness that AA77 crashed on the Ohio/Kentucky border. Also, according to interviews with United personnel they were not able in the immediate aftermath of the second WTC impact and the Pentagon impact to convey to American that it was UA175 that was the second impact into the WTC.