OMISSION SENSITIVE

MEMORANDUM FOR THE RECORD

Event: American Airlines (AA) System Operations Command Center (SOCC)

Type: Briefing

Date: November 19, 2003

Special Access Issues: None

Prepared by: Lisa Sullivan and Bill Johnstone

Team Number: 7 and 8

Location: SOCC; American Airlines Headquarters; Ft. Worth, TX

Participants (non-Commission): Craig Parfitt, AA Managing Director of Dispatch

Operations; Craig Marquis, AA System Operations Control (SOC) Manager; Michael
Mulcahy, AA Manager of SOC Policies and Procedures; Joseph Bertapelle, AA Manager
of SOC Operations Coordination/Air Traffic Systems; Desmond Barry, Condon &
Forsyth, LLP; Christopher Christensen, Condon & Forsyth, LLP; Douglas Cotton, AA
Senior Attorney

Participants (Commission): Sam Brinkley; Bill Johnstone; Miles Kara; John Raidt; Lisa
Sullivan

Background

[U] Craig Parfitt is now, and was on 9/11, the Managing Director of Dispatch Operations
responsible for supervising System Operations Control (SOC) Center and Sector
Managers as well as Flight Dispatchers who collectively ji^&st "the allocation of
Y r corporate resources for the operation of American Airline^jZ>n the day of 9/11, he
— |_served as a Director of the System Operations Command Center (SOCC). He has had
almost 32 years of airline experience, and once served as a Flight Dispatcher.

[U] Joe Bertapelle is a SOC Manager responsible for representing senior management in
the daily operation of the SOC. In the period up to and including 9/11, he was Manager
of SOC Operations Coordination/Air Traffic Systems that included serving as the
pcompany's liaison with the FAA on Air Traffic Control matters. On the day of 9/11, he
as a Director of the System Operations Command Center (SOCC). He has had
almost 28 years of airline experience, and once served as a Flight Dispatcher.

[U] Craig Marquis is now, and was on 9/11, a SOC Manager responsible for representing
senior management in the daily operation of the SOC. He was the SOC Manager-on-
Duty during the period involving the 9/11 hijackings. He has had over 16 years of airline
experience, and once served as a Flight Dispatcher.

COMMISSION SENSITIVE
[U] Mike Mulcahy is now, and was on 9/11, the Manager of SOC Policies and
Procedures who is responsible for the establishment and modification of SOC policies
and procedures, including maintenance of the Emergency Procedure checklist used in the
SOC. On 9/11, he served as the SOCC Support position. He has had over 28 years of
airline experience, and once served as a Flight Dispatcher.

[U] Commission staff received a 45-slide presentation (including a hard copy of same) ^
entitled "System Operations Control." a** /£,

System Operations Control

[U] System Operations Control (SOC), which is on the second floor of the headquarters
building, is always operational and "coordinates the day-to-day, minute-by-minute
operation of the airline and includes flight dispatch operations (approximately 36
dispatch desks managing 27 geographic areas, now and on 9/1 l)*'Flight Dispatcher
Karen Hauck, at Desk 23, was responsible for both Flights #11 and #77 on 9/11. At
American, the policy is that one dispatch position follows a given flight from start to
finish. Also, under the Dispatchers' union contract with the airline, only dispatchers
could send ACARS transmissions to American aircraft.

[U] The SOC also contains 3 Air Traffic Control (ATC) specialists who are responsible
for communicating and coordinating with the ATC regional centers as well as with the
ATC Command Center (Heradon, VA). These individuals generally participated in the
airline industry daily 7:30 AM (Central Time) conference call set up by the Air Transport
Association (in coordination with Herndon ATC Command Center) to discuss the day
ahead (typically weather and traffic concerns. The briefers were unsure whether AA
participated in such a call on 9/11 because there were no significant weather or other
systemic concerns they were aware of at the time. On 9/11, Bill Halleck handled most
communication with ATC officials (he had a number of personal contacts there), while
I land! 1-were.in touch with the Herndon Command Center.

[U] The SOC receives all security threats against AA aircraft and property, aftd: the SQC,
Center Manager-on-Duty is responsible for obtaining positive confirmation and 9/11
identification of the airline, flight and aircraft involved. Typically, if the matter occurred Working-level
in the air, the report would go first to the Flight Dispatcher, or if on the ground to the Employee
Ground Security Coordinator (at the airport), before being passed to the SOC Manager.

[U] The SOC Manager is also responsible for assigning the security level for the incident
(Level I - Major accident or incident; Level II - Minor damage; Level III - Minor
incident), maintaining a log and recording all activities; and immediately notifying the
Vice President of Operations and Planning (OP&P) and the Manager of Dispatch
Operations. Finally, the SOC Manager is "responsible for verifying all critical
notifications and for the activation of the SOCC."
System Operations Command Center

[U] The System Operations Command Center (SOCC), which is on the third floor
overlooking the SOC and has been in existence for 13 years, is activated in emergencies
and special occasions, including major accidents, hijackings, other security events, and
events requiring the coordination of multiple departments of the airline over an extended
time. Once activated, the SOCC "has the primary responsibility for support of accident
recovery from start to finish.. .(and) will assign and establish corporate activity
coordination with the FA A." While American employees thought of the SOC as the
"tactical" center of operations, in emergencies, it was understood that the SOCC was the
"war room."

[U] Because of space limitations, representation in the SOCC was limited to one person
per department, with the SOCC Director the final authority on all access issues. Staffing
requirements are determined based on the nature of the incident (accident, security event,
or strike, for example). The SOCC Director "has primary responsibility for managing the
accident recovery effort from start-to-finish." The SOCC Director and other SOCC
personnel are pulled off of their regular duties for as long as necessary.

[U] In emergencies, the SOC was generally responsible for notifying the FAA/ATC, ^»
Department of Defense, and Coast Guard. While the AA Security division would notify /bj°4o
the airline's Principal Security Inspector (PSI) at FAA, and the State Department.

[U] The key decisions on the immediate response to the 9-11 hijackings were made in the
SOCC. Per the airline's experience and procedures, it was felt that the SOCC could best
coordinate and monitor the entire system from a central location felt that independent
dispatchers with independent flights and consolidated the center. Once activated, the
SOCC had the capability to operate around the clock (in 3 shifts of 8 hours each) as
necessary.

Airline Operations and Security

[U] In its day-to-day operations, the SOC must balance safety (which the briefers
indicated included security), customer service (i.e. on-time performance), and operating
economics. It is also required, in coordination with the FAA, to balance aircraft, people,
facilities and air space, and always "needed to figure out what we were going to do the
next day."

[U] Security incidents are handled at the management level, and the airline's Center and
Sector Managers (a total of 12 individuals) are responsible for managing "any abnormal
or emergency situation that affects any part of the airline, its passengers, its employees or
facilities." As noted above the SOC Manager has primary responsibility in this regard.
However, the briefers indicated that the Pilot In Command and flight crew handle most
on-board security incidents in-flight before the managers are made aware of them. For
example, a pilot might say he was landing and ask for the law enforcement authorities to
meet his flight at the gate to pick up an inebriated passenger or someone who had tried to
light a cigarette. The SOC Manager would call the relevant airport ground security
coordinator (for communicating with the appropriate local law enforcement entity) and
then call the Managing Director for Dispatch Operations who would "determine the
course of security for the airline."

[U] With respect to threat assessment, American relied not only on FAA intelligence (via
Security Directives and Information Circulars) and specific incident reports that came to
the SOC. The airline also employed Pinkerton's to provide (through AA Security
Director Wansley) a synopsis of intelligence on security threats in different parts of the
world. However, though at the time of 9/11 the airline received such reports daily, the
briefers recollection was that all of the information was about foreign threats.

[U] In 1985, the airline industry adopted a protocol called Positive Target Information
(PTI) as a means of validating security threats and preventing "unnecessary injuries and
degradation of safety." The policy as implemented at AA indicates, "It is important for
Law Enforcement Agencies to coordinate with SOC to prevent unnecessary passenger,
crewmember, or aircraft mishaps."

[U] The briefers indicated that the PTI policy was a response to the fact that airlines get
many indefinite and ultimately groundless security threats. For example, though
American logged a total of 3,445 threats between 1986-2002, the airline reported that
only an average of 2 or 3 per year were positive. As an illustration of the efficacy of the
policy, the airline points out "there has never been a bomb threat that led to the discovery
of a device that did not involve 'positive target information.'"

[U] The briefing made the following points in illustrating how AA managers determine
whether a threat is "positive" or "indefinite:"
• "It is impossible to issue a specific set of rules which govern the evaluation of all
security threats."
• "SOC Managers on Duty are trained to consider very specific factors when
making the determination."
• "Unilateral, uncoordinated action in these situations can easily lead to
unnecessary passenger injuries and hardships."

[U] The responsibilities of the SOC Manager in the initial response to an incident report
are essentially unchanged since 9/11. If the Manager ascertains it is a Level I event
(Major accident or incident), the manager is to provide basically the same initial response
whether it is a terrorist threat or a technical failure. The determination of what to do is
made at the SOCC.

The Day of September 11, 2001

[U] AA emergency procedures (on 9/11 and today) include a notification checklist (Form
A) for the SOC Manager to check off. The document is a contact list with home phone
numbers and cell phone. On 9-11 that list wasn't filled out, but the SOC and SOCC
personnel did fill out the EMERGENCY PROCEDURES checklist (which has been
provided to the Commission) because everything happened so quickly, the calls had all
been made, and the necessary people were already at the SOCC.

[U] On 9/11, there was a guard outside the SOCC door. There were many people inside
and others wanting to get in. There was also a need to centralize and coordinate
communications with the media and the public, and that was handled by the SOCC as
well. At some point, the FBI arrived and was given office space nearby the SOCC.
There was one representative for safety and another for security in the SOCC.

[U] Plans were developed in the SOCC for GO Teams to visit the crash sites and assist
with the response, and they tried to launch the teams on 9-11 but the ATC wouldn't allow
it as part of the closure of the national air space. They did activate a corporate assistance
relief effort composed of volunteers with specialized training who worked to assist with
the families of the victims.

[U] After 9/11, SOCC procedures have added a position specifically to handle
communications with the Department of Defense.

Situational Awareness of Hijackings

[U] Dispatchers and other persons who sit at positions in the SOC have access to an
aircraft situation display that can be tailored to meet specific needs. For example, any
individual with access to the system can focus strictly on company planes, a specific
plane, or all planes in the system. Military planes are not displayed. The Aircraft
Situation Display is tailored to the needs of the airline and is a subset of the TSD (Time
Sensitive Display) commonly used by FAA, in that the ASD is based on the FAA radar
feed.
[U] The ASD is not time sensitive and refreshes each minute or more and its sensitivity
and data input, however, was apparently not sufficient to allow American to gam any
situational awareness of AA77, but did allow some situational awareness of AA11.
[U] AA had a procedure in place (as did United) to isolate an incident flight and take its
management away from the SOC and move that management to a crisis center. [Note:
This is different than procedures in FAA en route centers. Handling of incident aircraft is
left with the controller and area of record and an attempt is made to move handling of
other aircraft in his/her airspace to other controllers.]
[U] American had no situational awareness of AA77 and had formed the erroneous
understanding that AA77 impacted the second WTC tower. [Note: This is different from
the FAA awareness that AA77 crashed on the Ohio/Kentucky border. Also, according to
interviews with United personnel they were not able in the immediate aftermath of the
second WTC impact and the Pentagon impact to convey to American that it was UA175
that was the second impact into the WTC.