Health Resources and Services Administration
 Questions?Contact UsSearch
Images related to bioterrorism and hospital preparedness

ARLINGTON COUNTY: After-Action Report on the Response to the September 11 Terrorist Attack on the Pentagon

Annex C – Law Enforcement Part I. Arlington County Law Enforcement

Section 1: Initial Response | Section 2: Command, Communications, and the Incident Command System | Section 3: Operations

Part II. Defense Protective Service

Section 1: Initial Response | Section 2: Command, Communications, and the Incident Command System | Section 3: Operations

Part III. Federal Bureau of Investigation

Section 1: Initial Response | Section 2: Command, Communications, and the Incident Command System | Section 3: Operations

Annex A | Annex B | Annex D



The terrorist attack on the Pentagon, September 11, 2001, presented a unique convergence of law enforcement responsibilities belonging to different organizations. The Pentagon and its surrounding grounds are bound on all sides by the Arlington County Police Department’s (ACPD’s) 4th District. Thus, the area surrounding the Pentagon is the responsibility of Arlington County. However, the Pentagon is a Department of Defense (DoD) facility under direct control of the Secretary of Defense. The Defense Protective Service (DPS), a Federal law enforcement agency, has exclusive jurisdiction at the Pentagon. It is not uncommon for neighboring law enforcement jurisdictions to exercise concurrent jurisdiction in certain locations. This is not the case at the Pentagon. ACPD authority stops at the perimeter, where DPS assumes control. Moreover, because this was a terrorist attack, the Pentagon and its surrounding grounds were immediately rendered a Federal crime scene, the exclusive domain of the Federal Bureau of Investigation (FBI) under the terms of Presidential Decision Directive (PDD)-39. Many additional law enforcement agencies participated in the response to the attack on the Pentagon, including the Arlington County Sheriff’s Office (ACSO), the Virginia State Police, mutual-aid police departments and sheriff’s offices from neighboring jurisdictions, the Treasury Department’s Bureau of Alcohol, Tobacco and Firearms (BATF), military police from the Military District of Washington (MDW), the U.S. Capital Police, the U.S. Park Police, the DC Metropolitan Police Department, the U.S. Secret Service (USSS), the EPA Criminal Investigation Division (CID), the U.S. Air Force Office of Special Investigations (OSI), the National Transportation Safety Board (NTSB), and numerous others referred to throughout this report. But they did so in support of the ACPD, the DPS, and the FBI. More than 2,000 law enforcement officers, agents, and supervisors were committed to the Pentagon response. Part I, Arlington County Law Enforcement, describes the activities of the ACPD and the ACSO in response to the September 11 terrorist attack on the Pentagon. Part II of this annex describes the activities of the DPS. Part III addresses FBI operations.

The Arlington County Police Department (ACPD) was founded on February 1, 1940, and has expanded from its original 9 members to a current authorized strength of 362 full-time sworn officers and 85 civilian staff members. It provides law enforcement services to Arlington County’s urban residential and business communities in an area of approximately 26 square miles, located across the Potomac River from Washington, DC. The county’s residential population of 190,000 increases substantially during the workday with the influx of commuters, tourists, employees of local businesses and Federal Government agencies with offices in Arlington, as well as travelers traversing the county. All roads and rail routes from Virginia directly into the District of Columbia pass through Arlington County. The ACPD, under the leadership of Chief Edward Flynn, provides 24-hour protection using 3 shifts to patrol 10 police beats located within 4 districts that follow the natural boundaries within Arlington County. A captain, who reports to the deputy chief of operations, commands each police district. The ACPD has adopted a community-based, problem-oriented policing strategy, commonly known as “community policing.” Community policing engages 211 officers and supervisors assigned to the 4 districts. (See Figure C-1.) These officers are responsible for that area 24 hours a day, 7 days a week. They are part of the community they serve. The ACPD has the longest standing accreditation in the world from the Commission on Accreditation for Law Enforcement Agencies, Inc. (CALEA).

The Arlington County Sheriff’s Office (ACSO) is the oldest county law enforcement agency, dating back to the colonial period. The ACSO is a nationally accredited agency with 270 sworn deputies and civilian staff led by elected Sheriff Beth Arthur. Its principal functions are to support the county judiciary system and manage the correctional facility, which has an average daily population of 500 inmates.

The Defense Protective Service (DPS) is the law enforcement agency responsible for the Pentagon and 24 additional off-site DoD locations in the Washington Metropolitan Area. It provides a full range of law enforcement and security services. DPS Headquarters is located inside the Pentagon, which is served by 303 personnel and supervisors under the leadership of Chief John Jester. All 251 armed officers of the Law Enforcement Division are graduates of the Federal Law Enforcement Training Center at Glynco, GA. The Law Enforcement Division Operational Services Branch provides around-the-clock police services and includes a Special Operation Detachment consisting of the Emergency Services Team, the Protective Services Unit, and a K-9 Unit with explosive detection capabilities. The Law Enforcement Division also manages more than 400 contract guards that staff their off-site facilities. The 51-person Security Services Division is the nonsworn (unarmed) part of the DPS. Securing the Nation’s military headquarters and the classified material stored there is a unique responsibility of the DPS.

The Federal Bureau of Investigation (FBI) is the principal investigative arm of the U.S. Department of Justice (DOJ). The FBI has investigative jurisdiction over violations of more than 200 categories of Federal crimes, including threats involving weapons of mass destruction (WMD), sabotage, and hostage taking. Its 11,000 special agents and 16,000 professional support staff are assigned to 56 field offices, 4 specialized field installations, 400 smaller offices throughout the country, and 40 legal attaché posts overseas. Although its geographic area of responsibility is the smallest of all the FBI field offices, the Washington Field Office (WFO) is the FBI’s second largest in terms of staffing, comprising 657 agents and 650 professional support staff. Because of the special requirements of the Nation’s capital and the size of the WFO, it is lead by FBI Assistant Director in Charge (ADIC) Van A. Harp. Three Special Agents-in-Charge (SACs) direct the WFO’s Administrative and Technical, Criminal Investigations, and National Security Sections. The WFO organization includes the FBI’s Joint Terrorism Task Force (JTTF) and the National Capital Response Squad (NCRS). Two FBI Rapid Deployment Teams are also located in the Washington Metropolitan Area with equipment and supplies stored for immediate response to missions overseas.

The information contained in this annex was accumulated through a series of debriefings and interviews with law enforcement personnel, use of a widely distributed survey instrument, and by reviewing plans, standard operating procedures (SOPs), and a variety of operational documents.

This annex includes three parts that describe activities performed in response to the September 11 terrorist attack on the Pentagon by the principal law enforcement agencies, the ACPD, the DPS, and the FBI. The sections within each part address the following functional areas: (1) Initial Response; (2) Command, Communications, and the Incident Command System (ICS); and (3) Operations. Each section begins with observations about the events that occurred within the specific functional area. These observations are followed by a set of findings, which reflect the information gathered from the law enforcement officials after the response ended. The sections conclude with 74 recommendations and lessons learned derived from the findings.




On September 11, 2001, at approximately 9:37 a.m., ACPD Corporal Barry Foust and Officer Richard Cox, on patrol in south Arlington County, saw a large American Airlines aircraft in steep descent on a collision course with the Pentagon. They immediately radioed the Arlington County Emergency Communications Center (ECC). ACPD Headquarters issued a simultaneous page to all members of the ACPD with instructions to report for duty. Two-way pagers are standard issue only for the Emergency Response Team, hostage negotiators, members of the Special Weapons and Tactics (SWAT) team, and several command officials. One-way pagers are issued to most of the remaining sworn officers. Media reports of the attack alerted those who did not receive the pager message. The law enforcement response to the incident was immediate, with the on-duty shift engaged in minutes and most ACPD officers arriving on the scene within the first 3 hours. Several ACPD senior officers were out of the county when the incident occurred. Chief Flynn was attending a conference in Atlantic City, NJ, where he was the featured speaker on the subject of racial profiling. Deputy Chief Holl was at a Virginia Police Corps meeting in Richmond, VA. Both Chief Flynn and Deputy Chief Holl immediately began driving back to Arlington. Deputy Chief John Haas was in Miami, FL, participating in a police chief’s assessment program and unable to arrange immediate transportation back to Arlington. This delay turned out to be fortuitous. When Deputy Chief Haas reported for duty on Monday, September 17, he brought fresh leadership to a command section that had been continuously engaged for nearly a week.

Lieutenant Robert Medarios was the first ACPD command-level official to arrive on the scene; he assumed command of the ACPD response. Lieutenant Medarios quickly reached an agreement with a DPS official that the ACPD would assume responsibility for the outer perimeter. This was an important decision because the DPS exercises exclusive Federal legislative jurisdiction at the Pentagon and its surrounding grounds. In these instances, the Federal Government acquires all the authority usually reserved by the State. Lieutenant Medairos, Lieutenant Brian Berke, and Sergeant Jim Daly quickly assessed the road network conditions and identified 27 intersections that required immediate police posting. Sergeant Daly began organizing the staging area at Fire Station 5 and the adjacent park. The parking lot and adjacent field were cordoned off and guards posted around the perimeter. By 11:00 a.m., more than 100 law enforcement personnel had reported to the staging area representing the ACPD, ACSO, Fairfax County Police Department, Alexandria Police Department, Arlington County Park Rangers, and the Immigration and Naturalization Service (INS). Officers were assigned to a particular post for 2 or 3 hours, given an hour of relief, then assigned to a different post to minimize boredom.

Many ACPD officers attempting to reach the Pentagon, including detectives who were responding from headquarters, found themselves fully engaged in rerouting traffic and clearing a path for fire, rescue, and medical units. Although they had difficulty reaching their intended destination, these officers knew precisely what needed to be done and acted on their own initiative, radioing to ACPD Headquarters their respective locations and activities. Detectives from the ACPD Vice Control Section assumed general patrol of the county away from the incident site to augment remaining officers in the event of a major criminal incident.

At ACPD Headquarters, Captain Rich Alt, Captain Mary Gavin, Lieutenant Karen Hechenroder and Administrative Assistant Barbara Scott began organizing the department-wide response. The roll call room is a natural meeting place in the police department for gathering and distributing information. It became the home of the ACPD ICS staffing command for the duration of operations. Officers were being deployed throughout the county and information had to be gathered regarding their locations and times of arrival so replacements could be scheduled and relief coordinated.

The ACSO also immediately responded to the attack. Sheriff Beth Arthur and Chief Deputy Sheriff Mike Raffo were watching the World Trade Center attacks on television when they were notified that an airliner crashed into the Pentagon. They immediately headed to the Arlington County Emergency Operations Center (EOC). ACSO recall procedures were implemented and an Incident Command Post (ICP) was set up on the first floor of the courthouse building. The ICP was subsequently relocated to a large conference room in the Arlington County Detention Facility.

Some deputies not already on assignment rushed to the Pentagon, arriving in time to help rescue a few of the victims. Other deputies began directing traffic, as roadways became jammed.

One of the first actions taken by the ACSO was closing the courts and evacuating the judges and staff. This action was in consultation with the Arlington County judges who approved the closure. This decision freed up approximately 20 deputies who were then able to assist with the response to the attack on the Pentagon.


ACPD pager notification was not completely successful. Many police officers received several pages; others did not receive a single page. Some reported receiving the page up to 6 hours after it was sent, others could not understand the page they received. Although traffic congestion during the first hour of the incident posed problems for officers arriving in private vehicles, the response by department personnel was generally quick and effective. The Virginia State Police performed in extraordinary fashion. From the onset of the incident, the Virginia State Police took complete responsibility for all the exit ramps from Interstate Highway 395, manning 10 critical traffic posts. They also attended every ACPD command briefing.

Before ACPD personnel were able to arrive at the incident scene and report for duty, many officers immediately provided traffic and crowd control in Crystal City and at congested street intersections leading away from the Pentagon. The training, policies, and procedures of the ACPD enable routine delegation of authority to the lowest levels. Police force empowerment is regularly practiced by the ACPD. There is no single agency decision point restricting the actions of officers responding to an emergency. ACPD officers responded as they determined the need, then radioed headquarters their location and the functions they were performing. This helped restore order and expeditiously reduce congestion, but it added to the ACPD staffing management challenge. It was not always clear where officers were located during the tumultuous early hours.

There was no plan or memorandum of agreement (MOA) in place between the Pentagon and Arlington County for evacuation procedures or securing the perimeter of the Pentagon. Experience gained while working together during large-scale events, such as the Marine Corps Marathon, helped facilitate coordination and communications between the two organizations.

Cellular telephones are standard issue for ACPD personnel in the rank of captain and above. However, the cellular telephone systems were overloaded and ineffective during the first few hours of response. In the area surrounding the incident, Nextel’s Direct Connect feature worked well for those personnel so equipped.

There are no parking spaces designated for personal vehicles of ACPD police officers near ACPD Headquarters. This delayed reporting for duty. The shortage of available parking spaces impacts all county agencies during a staff recall. A portion of 14th Street was cleared of parked cars and made one way to improve access for mutual-aid units.

The parking lot near the county government complex on Adams Street used for official vehicles was not secured or regularly patrolled. ACPD policy requires that plainclothes officers have access to police uniforms, which are important in situations requiring quick recognition of law enforcement authority. Some plainclothes officers reporting to the headquarters did not have uniforms and wore their badges on their outer garments for recognition.

During the initial hours of the response, there was no systematic method for recording when ACPD officers reported for duty, the hours they worked, what posts were staffed, and end-of-shift checkout times. Sergeant Jane Morris began accumulating information within the first 30 minutes, but the situation was fluid and dynamic. On September 12, Sergeant Morris, assisted by Ms. Tamekah Johnson and Ms. Rosemary Sejas, reconstructed time and attendance records from the previous day.

In retrospect, the initial response by ACPD and mutual-aid personnel produced a surplus of officers for the immediate law enforcement requirements.

This was not readily apparent at the time, as it was impossible to grasp the scope of the evolving response effort. If the requirements had been known, some officers could have been sent home with instructions to rest and report back for a later shift.

Recall procedures had limited success. The ACSO instituted a “phone tree” notification system of call back to recall personnel. Many deputies reported to work on their own initiative upon learning about the incident on television or radio. Everyone that could report for duty did so. Many encountered, and were slowed by, traffic gridlock.

The ACSO was the only Arlington County public safety organization to issue a public service announcement to local radio and television stations requesting that all ACSO personnel report to work. Prescripted force mobilization messages for other Arlington County public service agencies were not available or issued.

The ACSO immediately assumed a heightened emergency status. The ICP was established on the first floor of the headquarters building. Sheriff Arthur ordered an immediate lockdown of the county detention facility. Perimeter security around the courthouse and detention facility was implemented. ACSO road units responded immediately in various ways, such as assisting in victim rescue, closing streets, and securing county buildings.

Like other responding agencies, ACSO officials quickly discovered that cellular and landline telephones were ineffective early in the response. ACSO handheld radios are outdated and incapable of monitoring the channels or talk groups of other county departments.

Recommendations and Lessons Learned

The ACPD should thoroughly test the current pager system not only to determine the extent of operator error and technical deficiencies experienced during the September 11 simultaneous notification, but also to recommend and implement corrective actions. (LE-001)

Public service announcements recalling police officers and other critical personnel should be prepared in advance, coordinated with the Arlington County Assistant Manager of Public Affairs, Richard Bridges, and pre-positioned with area media outlets. (LE-002)

The ACPD should develop an MOA with the DPS and MDW for emergency law enforcement support at the Pentagon and possibly at other military facilities in Arlington County. The experience gained during the Pentagon response can serve as a guide for such an agreement. (LE-003)

Arlington County needs to press the case for granting public safety officials cellular priority access service (CPAS) during an emergency. The ACPD should also consider the merits of expanding the department’s use of the Nextel Direct Connect two-way feature and two-way pagers. (LE-004)

Arlington County should identify a centrally located site that can serve as a satellite parking area. Buses would then be able to shuttle police officers and other county staff to and from headquarters. (LE-005)

ACPD officers assigned to plainclothes duties are required to keep a complete uniform at headquarters for emergencies that require immediate recognition of police authority. This policy should be strictly enforced. (LE-006)

The ACSO should replace its telephone notification “phone tree” with a pager notification system. (LE-007)

ACSO mobile radios should be replaced with modern devices compatible with those of other county departments and regional public safety organizations. (LE-008)



The ACPD previously adopted the ICS as the appropriate response structure for large-scale incidents. Moreover, less than 2 weeks prior to the terrorist attack on the Pentagon, all ACPD command officers participated in routine recurring ICS training. This is important for two reasons. First, law enforcement situations are typically fluid and dynamic, thus the implementation of ICS must be flexible and adaptable. Second, most of the ACPD senior leadership was away from Arlington County on the morning of September 11. As Chief Flynn raced south from the conference in New Jersey, he knew that, in his absence and the absence of Deputy Chiefs Holl and Haas, the officers of the department were trained and prepared to rise to the occasion. His confidence proved justified. Shortly after Lieutenant Medarios assumed initial command at the incident site on September 11, Captain Rebecca Hackney arrived and took over as Incident Commander. Captain Hackney sketched the initial ACPD ICS assignments on a notepad. Acting Chief James Younger arrived, reviewed Captain Hackney’s ICS assignments, then directed Captain Daniel Murray to be ACPD liaison to the ACFD ICP and Captain David Herbstreit to liaison with the FBI. By telephone, he spoke with Deputy Chief Holl, who was returning from Richmond, and requested that he respond directly to the incident site. Deputy Chief Holl arrived at about noon and took over as the ACPD Incident Commander. Deputy Chief Younger reported to the Arlington County EOC, as requested by the County Manager.

The ACPD loaned its mobile command post to the Arlington County Fire Department (ACFD) to serve as the initial ICP. The ACFD does not have a similar capability. Deputy Chief Holl worked out of the Watch Commander’s Ford Expedition. The ACPD formulated a plan to screen pedestrian and vehicular traffic and assign ACPD representatives to the ACFD ICP, the FBI Command Post, EMS Control, the Arlington County EOC, and the ECC. Captain Murray reported to the ACFD ICP and told Chief Edward Plaugher he would remain with the ACFD throughout the fire and rescue operations. Recognizing that minute-to-minute activities would be all consuming, early in the afternoon of September 11, Deputy Chief Holl assigned Lieutenant Steve Broadhurst to forecast the issues that would confront the department during the next 6 to 12 hours. Captain Roy Austin was assigned responsibility for department routine operations away from the incident site. At about 10:15 a.m., ACFD Chief James Schwartz ordered a site-clearing evacuation because of the report of a second hijacked aircraft heading toward the Washington Metropolitan Area. The ACPD ICP moved to an area beneath the I-395 overpass at Hayes Street and set up near the ACFD ICP to facilitate communications and coordination.

Deputy Chief Holl modified the initial ACPD operations plan, adding countersniper overwatch, SWAT support for the ICP and DPS, FBI evidence recovery support, and ACPD employee health and safety. He also established ICS functional activities, some of which were unique to this incident, such as morgue, hotel security, and credentials. (See Figure C-2.)

The nature of the Pentagon response operations demonstrated the importance of flexibility in the ACPD ICS implementation. The ACPD had to manage the on-site incident response and, at the same time, direct routine police patrols throughout the county. ACPD officers volunteered for assignments at the Pentagon, as long as the dates and times did not conflict with their other duties. A volunteer signup board was maintained at the roll call room. These assignments were for 12-hour shifts supporting the FBI evidence recovery effort; providing security for sensitive functions, such as the FBI’s temporary morgue; working at the ACPD ICP; staffing the incident site access points; providing on-site vendor escort; and similar assignments. ACPD volunteers and mutual-aid officers reported to the staging area at Fire Station 5 for details about their assignment and orientation before deploying to the Pentagon. Staging was a 24-hour operation with five ACPD supervisors rotating 12-hour shifts. Routine county police patrols were managed from ACPD Headquarters. Officers reported to roll call before and after their 10-hour patrol shift. At roll call, officers were briefed and given any special instructions, particularly related to the threat of potential followup terrorist actions. All of this activity was directed by the ICS staffing command, with two commanders, one administrative assistant, and two student aides assigned to this function. The ACSO ICP was up and running within 30 minutes of the Pentagon attack.

Three section supervisors assumed responsibility for managing the ICP, organizing staffing and resources, and establishing security in and around the courthouse and detention facility. An immediate lockdown of the detention facility was ordered and perimeter security established around the courthouse and detention facility.


On September 11, many ACPD officers acted on their own initiative clearing congested traffic, opening routes for emergency vehicles, and restoring a semblance of order to a scene that, in some cases, bordered on chaos.

The ACPD Mobile Command Post, on loan to the ACFD to serve as the initial ICP, is too small and lacks the modern technology for an incident as large and complex as that at the Pentagon. Given the proximity of the ACPD Command Post, the ACFD Incident Commander did not activate an ICS Law Enforcement Branch within the Operations Section.

Given the complex jurisdictional arrangements, it would probably have been helpful to have such a branch led by a DPS command officer assisted by an ACPD command officer.

The Watch Commander’s vehicle served marginally as the interim ACPD ICP, but it is too small and is not equipped for extended operations in this role. Had the weather been inclement, command operations would have functioned without mobile shelter. The mobile command post was returned to the ACPD on the third day of the response, after a better-equipped Fairfax County Police Department mobile command unit was made available to the ACFD. Captain Hackney’s quick action in developing a plan for initial ICS assignments ensured a well-organized police response from the early minutes of the incident.

When Deputy Chief Holl arrived and took over command, the ACPD was fully deployed and functioning in its planned ICS structure. The ICS added organization and clarified responsibilities. Because of the several ACPD sector leaders and ICS functional activity supervisors, some officers reportedly received guidance from more than one source, which they sometimes viewed as confusing and even contradictory.

On Day 4 of the response operations, Chief Flynn and Deputy Chief Holl recognized the need to establish an unplanned ICS function, which they designated as “Diplomacy.” This activity can best be described as a combination of community relations, protocol, and interagency courtesy. Visiting chiefs of mutual-aid departments and other law enforcement organizations were met, briefed on response operations, and escorted throughout the site.

After the incident stabilized, guided bus tours were organized for county employees supporting the first responders so they could appreciate the full magnitude of the incident. When crowds of spectators, some of whom were family members of missing victims, began to gather on a site overlooking the Pentagon, the ACPD provided security and ensured their comfort. Diplomacy became a very important ICS function.

Some law enforcement officers from nonmutual-aid jurisdictions arrived at the incident site offering assistance. Arlington County had not requested their help and their presence could have created personal accountability as well as jurisdictional and legal problems.

Initially, ACPD command meetings were conducted every 2 hours. As time passed and police operations became more routine, these meetings occurred less frequently, eventually occurring at ACPD Headquarters at 5:00 p.m. each evening.

The ACPD does not have an MOA or similar understanding with the MDW or DPS regarding the provision of emergency law enforcement at the Pentagon. The division of responsibility on September 11 was based solely on the initial verbal agreement between ACPD Lieutenant Medarios and a DPS official.

ACPD officers volunteering to work at the incident site reported to the staging area at Fire Station 5, where they received assignments and special instructions.

Officers scheduled for routine patrol throughout the county attended roll call at ACPD Headquarters at the beginning and end of each 10-hour shift. At roll call, officers received all the information needed to perform assigned duties. Many of these officers reported they would have liked to have been given additional information about ongoing response activities. This was addressed later in the week by issuing department-wide voicemail messages.

The ACPD communications network established for this incident used 5 of the 14 available radio channels. Each sector (i.e., Evidence Recovery, Perimeter Security, Motors, and Special Weapons and Tactics) had a dedicated channel.

The sectors shared a common command channel. Once radio discipline was restored and the initial volume of traffic subsided, the ACPD radio system worked well.

All ACPD officers are issued a portable radio. Spare ACPD radios were provided to officers from responding mutual-aid jurisdictions. “RIBS,” Radio-in-a-Box System, was deployed to the ACPD ICP. This mobile radio has a power supply that plugs into an electric outlet and is used as a portable base station.

The Arlington County ECC had available a new radio interoperability system designated “AGILE” (Advanced Generation of Interoperability for Law Enforcement). This new system evolved from a test program conducted in Alexandria beginning in 1998. AGILE permits law enforcement agencies using different radio frequencies to communicate with each other. It was not deployed during the Pentagon response because there had not been sufficient operator training.

Sustaining continuous communications was a challenge. Over time, radios failed because the battery life is relatively short. The ACPD bus driver who transported mutual-aid officers to their posts was given the additional assignment of replenishing radios and batteries.

Some deploying mutual-aid police brought their own portable radios, which could be reprogrammed by the operator to the appropriate ACPD channel.

However, some jurisdictions, including Fairfax County, require a trained technician to reprogram radio channels. During the first 3 days of operations, there were numerous instances when mutual-aid officers on post did not have radio communications with either the ACPD or the ACFD. Cellular telephone connections were impossible in the first few hours.

Additional temporary cellular sites were activated by the evening of September 11 and cellular telephone communications were more effective. As soon as it became apparent that the response to the attack on the Pentagon would be protracted, the ACSO ICP was relocated to a conference room in the detention facility building. The conference room is large enough to accommodate the ICP and has facilities appropriate for a large-scale incident.

Although the Arlington County Comprehensive Emergency Management Plan (CEMP) does not assign tasks to the ACSO, Sheriff Arthur and Chief Deputy Raffo reported to the Arlington County EOC to see how the ACSO might be most useful during the incident response. An ACSO presence remained at the EOC during operations coordinating numerous support requests and performing many useful services.

Recommendations and Lessons Learned

The ACPD should recommend, in incidents not commanded by law enforcement organizations, a Law Enforcement Branch be established within the ICS Operations Section. (LE-009)

The ACPD Mobile Command Post should be modernized with new computing and communications equipment and up-to-date command center software, and enlarged. (LE-010) Records of events should be maintained, including the names of command post visitors. Standard ICS forms are available for use or to serve as models to create ACPD management aids. (LE-011)

A pocketsize field operations guide including instructions for establishing law enforcement ICS functions should be issued to all command officers and supervisors. (LE-012)

To minimize confusion, lines of authority and the guidance given to ACPD and mutual-aid officers need to be absolutely clear. (LE-013)

Unless specifically requested by the host county, other jurisdictions should not dispatch public safety units to the scene of a WMD attack. Under no circumstances should “freelance” law enforcement officers be allowed access to the incident site or permitted to operate in the local jurisdiction. (LE-014)

Based on the experience of responding to the terrorist attack on the Pentagon, the ACPD should review its current staffing and equipment levels and make adjustments to accommodate WMD events of extended duration and expanded operational requirements. (LE-015)

Other jurisdictions should consider defining an ICS function similar to that designated by the ACPD as “Diplomacy.” In a major incident response, how you interact with organizations and individuals is critical to a successful response and to maintaining productive relationships during and after the incident. (LE-016)

Public safety organizations in high-priority locations, such as the Washington Metropolitan Area, must be staffed and equipped for sustained operations. (LE-017)

Using the ACPD bus driver to replenish radios and batteries was a handy expedient, but a fully equipped logistics support vehicle is probably a better alternative. (LE-018)

A comprehensive regional assessment of communications interoperability is in order. WMD events do not recognize jurisdictional boundaries. All jurisdictions must be prepared to operate in a mutual-aid environment. (LE-019)

The Arlington County CEMP should be amended to provide for the presence of an ACSO representative consistent with assigned responsibilities. (LE-020)



The challenge confronting Arlington County law enforcement agencies in the aftermath of the September 11 terrorist attack on the Pentagon was formidable. First of all, routine requirements did not vanish. Arlington neighborhoods still had to be protected and emergency calls had to be answered. Nearly 60 percent of the 362 ACPD uniformed officers and supervisors are regularly committed to the community policing program. For example, during the early hours of the incident, two automobile accident fatalities occurred in the county, requiring notification of next of kin. In addition, the Pentagon response created many additional police requirements. As an example, perimeter security was provided at 10 posts around the Pentagon with 31 officers. (See Figure C-3.)

Sixty officers and supervisors volunteered to support the FBI’s evidence recovery efforts. Others provided security at two local hotels, one housing Urban Search and Rescue (US&R) team members and the other housing families of victims.

ACPD personnel were assigned to the Arlington County EOC, the JOC, and as representatives at the ACFD ICP. The ACPD Property Office stayed open 24 hours a day. Captain Mary Garvin and Lieutenant Karen Herchenroder managed the ACPD staffing function, another around-the-clock operation.

Approximately 1 week into the incident response, military reservists were called to active duty. The ACPD staffing command identified 14 ACPD personnel with military reserve status and recommended the disposition of each of them based on the needs of the department and relevant military reserve units. ACPD policies were adapted to meet the circumstances of the occasion. Some were official and formally announced: leave was canceled until October 1; outside training was canceled; all officers were reminded to carry pagers and check voicemail twice daily; mourning bands for badges were authorized until October 1. Other policies were implemented more subtly. The ACPD strove to maintain an appearance of normalcy throughout the county. Thus, mutual-aid officers were used extensively on stationary posts at the Pentagon, freeing ACPD officers to maintain routine patrol duty. ACPD officers, with prior department approval, are authorized to accept private employment while off duty for up to 30 hours each week, with the understanding that they are always subject to recall. Off-duty employment generally consists of providing such uniformed services as security at athletic or cultural events and similar activities. These are high visibility activities to which the public is accustomed. The ACPD decided not to cancel off-duty employment as long as it did not conflict with duty assignments during the response. Mutual-aid agreements with nearby jurisdictions enabled the ACPD and ACSO to meet all obligations. Arlington County participates in the Northern Virginia Law Enforcement Mutual-Aid Agreement of May 1, 1991. Police departments from Alexandria, Fairfax County, Fairfax City, Falls Church, Loudoun County, Manassas, Prince William County, and George Mason University provided mutualaid support to the ACPD. Deputy sheriffs from the city of Alexandria and Fairfax, Fauquier, and Prince William Counties reinforced the ACSO under the terms of the Northern Virginia Sheriff’s Mutual-Aid Agreement. Greenbelt and Prince Georges County, MD, and Washington, DC, also dispatched police units to Arlington County. Altogether, more than 300 mutual-aid police officers and sheriff deputies were engaged in the law enforcement response, along with 200 military police from the MDW.

To assist in staging law enforcement personnel, the ACPD arranged with the ACFD to stage personnel at Fire Station 5. It is close to the Pentagon and collocated with a community center with rooms available for officers to rest between assignments. All ACPD and mutual-aid officers volunteering for duty at the Pentagon reported to the staging area to receive instructions before proceeding to the incident site.

During the first few days of the response, there were numerous reports of bomb threats and other suspicious circumstances. On one occasion, three suspicious persons were apprehended in the staging area used by the national and local media support equipment and vehicles. The three subjects were questioned and eventually released. The following morning, the ACPD and mutual-aid SWAT teams were ordered to take positions on the roof of the Navy Annex and on the north and south roof segments at the Pentagon. These positions offered a vantage overlooking the impact site, the principal response area, and the surrounding area. The ACPD and DPS SWAT team members walked patrols together throughout the incident site.

The enthusiastic support and demonstrations of appreciation by Arlington County residents were heartening. Volunteers came forward with every imaginable form of support, such as food, blankets, refreshments, and offers of help. Banners and placards across the county proclaimed the pride of Arlington citizens in their police officers, sheriff deputies, and firefighters. Recognizing that many Americans are called upon to make sacrifices when the Nation’s security is threatened, the ACPD found a way to express its gratitude to others traveling in harm’s way. Early in the response, an ACPD police officer at the incident site had acquired an American flag. Captain Tom Panther, with the help of a cooperative Verizon employee and his “cherry picker,” hung the flag from the highway overpass above the ACPD ICP. When the fire and rescue phase of the operation was phasing down, the ACPD decided it would be appropriate if their “battle flag” could continue its service in the war against terrorism. Captain Panther’s neighbor is a U.S. Navy officer assigned to the Pentagon. With his help, FedEx delivered the flag to Norfolk, VA, on Friday, September 21. On October 21, it flew from the mast of the

USS Enterprise as air strikes were launched against al Qaeda forces in Afghanistan. When the USS Enterprise returned to homeport, Captain James Winnefeld, U.S. Navy, visited the ACPD and returned the flag, which now rests in a place of honor in ACPD Headquarters.

Eighty percent of the ACSO deputies are assigned to 12-hour shifts at the detention facility. Most of the others support the county judiciary offices, providing courtroom security, serving subpoenas, and performing similar tasks. The ACSO achieved some initial temporary relief when Arlington County judges accepted its recommendation to order the courts closed on September 12, freeing up 20 deputies. However, requirements to secure county buildings, including the EOC, provide transportation and escort for county officials, deliver meals to responders at remote locations, and assign representatives to the EOC, JOC, and other locations quickly consumed these additional resources.


There is no current, comprehensive, and coordinated Washington Metropolitan Area regional evacuation plan. In addition, actions taken by one jurisdiction that impact others are not always coordinated. For example, in this incident, closing Federal Departments and agencies on the afternoon of September 11 was not coordinated with the Virginia State Police or Virginia Department of Transportation (VDOT). ACPD Chief Flynn has raised concern that, without proper coordination, one jurisdiction might easily direct evacuating traffic into another jurisdiction’s roadblocks.

Control of site access was a monumental challenge. Access control had been a problem following the bombing of the Alfred P. Murrah Federal Building in Oklahoma City and law enforcement authorities instituted a color-coded wristband identification system. Having read about this in an after-action report after the 1996 incident, the ACPD ordered 2,000 wristbands, which were stored in the mobile command unit. On the afternoon of the second day of the Pentagon response, Chief Flynn gave the red, yellow, blue, and green wristbands to the DPS. The complete supply was gone within a period of 2 hours. Beginning on the third day, the DPS made its badging system available to produce identifying credentials, but it was inadequate for a task of this magnitude. Finally, the FBI asked the USSS for help. The USSS trained members of the WMD Army Band to operate its five badge-making workstations and an effective system was implemented.

The fact that the ACPD and ACSO have separate mutual-aid agreements caused some coordination problems. Law enforcement jurisdictional authority outside the Pentagon grounds clearly belonged to the ACPD; however, in some instances, mutual-aid sheriff’s units requested by the ACSO reported for duty at the ACPD staging area without prior coordination. Had they been requested to support ACSO operations, there would not have been a problem. However, without prior coordination, the ACPD had to find assignments for these units.

ACPD managed its mutual-aid assets judiciously. Wherever possible, mutual-aid personnel were assigned to stationary posts, including Pentagon access points, freeing ACPD officers to patrol familiar routes. Chief Flynn chose to delay some offers of assistance from nearby jurisdictions, bringing them in as replacements during the second and third week of operations. The Staffing Command at ACPD Headquarters was the focal point for mutual-aid support planning and coordination. Offers of support from mutual-aid departments were considered from the perspective of specific staffing requirements: how much help was needed, when, and for how long. Chief Flynn reviewed most of the requests to ensure mutual-aid partners were properly integrated into the operation. Confirmation of the support requested was very specific: “Six officers for 12-hour shifts, from 6:00 a.m. until 6:00 p.m., September 17, 18, and 19.” As this process became relatively routine, mutualaid officers reported directly to staging at Fire Station 5 before beginning their assignments. Some individual officers from other jurisdictions called offering to help without the approval of their department; in other cases, mutual-aid units wanted to bring others with them. These offers were refused. Such ad-hoc practices complicate insurance liability, workman’s compensation, overtime payment, and other issues. Keeping track of the locations of ACPD police vehicles was problematic during the first 24 hours. On occasion, officers scheduled to use a particular vehicle discovered it had been commandeered for a different task. An automatic vehicle locator (AVL) system would have prevented this problem. As time progressed, the ACPD increasingly used mutual-aid officers on the Pentagon perimeter, releasing its own officers to patrol the county. This made sense in view of the community policing program and familiarity with the Arlington County roadways and neighborhoods. Shift arrangements were not standardized. The ACPD assumed 12-hour shifts at the incident site for those volunteering to support FBI evidence recovery operations but retained 10-hour shifts throughout the rest of the county. This complicated the staffing function since all overtime hours (the 12-hour shifts) had to be staffed with volunteers. The shift duration for mutual-aid units supporting the ACPD varied depending on their assignment. The ACSO adopted a 12-hour shift for all its personnel. Time and attendance records after September 11 were meticulously kept.

Sergeant Morris personally collected all overtime sheets every day and doublechecked all attendance records. It was not until the second week of the response that the ACPD learned that FEMA also required a description of the duties performed by each officer during the recorded time period. Sergeant Morris and the administrative staff had to recreate all of this information. ACPD leaders took exceptional care to protect the well-being of its officers.

They provided extensive critical incident stress management (CISM) and insisted officers take sufficient time off. CISM intervention is designed to reduce the impact of stressful events and accelerate recovery for those directly and indirectly involved. The ACPD senior leaders, however, did not always follow these same prudent policies. Fortunately, several ACPD command officers and other key personnel, including Deputy Chief Haas, were on vacation or business travel on September 11. Their subsequent return to duty provided a wave of fresh leaders to replace those who had been overcommitted since Day 1. After the incident, ACPD leaders recognized the need for additional training to help supervisors recognize quickly and respond to the signs of fatigue and stress among the staff.

Downsizing and phasing out of mutual-aid and volunteer support requires a significant degree of political sensitivity. It is important that the help of volunteers and other supporting agencies is recognized. A concerted effort was made by ACPD supervisors at the staging area to recognize the important contributions of those volunteering to work at the incident site. The ACPD did not have sufficient personnel to respond to the many calls from Arlington businesses seeking police security protection. Most of these requests were unrealistic, reflecting the initial concerns of businesses in the first several hours after the Pentagon attack. Auxiliary officers, such as school crossing guards and special event traffic control, as well as police recruits in training, were pressed into service to augment the ACPD wherever practical and prudent. VDOT closed the northbound lanes of I-395 and the Virginia State Police guarded the I-395 exit ramps. High Occupancy Vehicle (HOV) lanes were reserved for emergency vehicles. The ACPD created six pedestrian and vehicle access points onto the incident site. Specific categories of vehicles were assigned different entrances; for example, emergency vehicles were directed through one gate, while supply vehicles were sent to another. The DPS was fully engaged in and around the Pentagon and unable to help staff the entry gates onto the site. This placed the burden on the Virginia State Police, ACPD and mutual-aid officers, who did not have jurisdictional authority inside the perimeter to determine whether vehicular and pedestrian traffic should be permitted onto the Pentagon grounds. There was seldom advance notice of delivery vehicles carrying supplies and other critical items. It often took several calls to verify legitimate visitors and give them accurate directions or arrange for escorts. Beginning on September 12, the ACSO assigned three vehicles to the ACFD Logistics Section to escort vendors from the entry point to the incident site delivery location.

Even as the pace became more orderly following the first hectic days, emergency vehicles sometimes operated at unsafe speeds while entering the Pentagon grounds. An ACPD safety officer was assigned to monitor this and other safety factors beginning on September 13. All ACPD supervisors were also reminded of the dangerous conditions. Safety was regularly discussed at ACPD command briefings.

The ACPD provided three 20-person teams that worked a 12-hour shift on alternating days supporting the FBI’s evidence recovery sifting operation in the North Parking Lot. This was physically exhausting work that was also psychologically stressful. These officers raked through the debris searching for evidence, body parts of victims, and classified materials.

The ACPD has traditionally been equipped with personal protective equipment (PPE) better suited for crowd control at a political rally than a WMD terrorist event. In preparation for the upcoming International Monetary Fund (IMF) conference, additional chem/bio filters had been issued for all ACPD officers’ respirators. The teams supporting the FBI were issued latex over-boots, protective overalls, respirators, safety glasses, head covers, and heavy leather gloves worn over latex gloves. The stress caused by this evil event extended not just to the first responders, but to their families as well. Although Arlington County’s exceptional Employee Assistance Program (EAP) was enormously successful, Sergeant Regina Heising and Emergency Communications Technician Nan Holl suggested and helped plan a special CISM program for ACPD personnel and their families. The Arlington County CISM staff conducted this program at Fire Station 5 on September 23.

Babysitting services were provided and counselors spoke with officers and their families. The ACPD extended an invitation to the ACSO and their families to join in the program. The event included a bus tour of the incident site. It was extremely beneficial and well received by the participants. The Reverend Larry Tingle, the ACPD chaplain, participated in the family support program and also visited with officers at the staging area throughout the incident response. VIP visitors, including President Bush, Defense Secretary Rumsfeld, and several delegations of U.S. Congress members, visited the Pentagon during the first week of the response. In each case, the ACPD and Virginia State Police provided motor escorts within the county and on the Pentagon grounds.

In the absence of a JIC, Arlington County Assistant Manager for Public Affairs Dick Bridges held daily press conferences. Because of the nature of the event, there was continuing media interest in law enforcement activities at the incident scene, over and above the periodic briefings by the Attorney General and the FBI Director. The ACPD helped fill this void by providing regular vignettes about dayto- day police activities at the Pentagon. On one occasion, they provided the ECC tape of the initial call by ACPD Corporal Foust reporting the crash of Flight #77. On another day, the ACPD introduced a cadaver dog with lacerated feet injured during search and rescue efforts. This filled a small but important public information void. The day following the story about the injured dog, a case of 50 “doggie booties” was delivered to the staging area at Station 5. Managing donated goods and services was an unanticipated challenge. Private companies, charitable organizations, and citizens of Arlington and elsewhere wanted to contribute goods, services, and money to the response effort. Fire Station 5, a highly visible public safety facility with a great deal of response related activity, became a natural depository for donated materials. Lieutenant Paul Larsen and his colleagues managing the staging activities found themselves acting as supply agents, receiving and storing boxes of underwear, 1,000 donated pillows, a delicatessen worth of food items, and that case of doggie booties. This was a countywide phenomenon and must be dealt with comprehensively by Arlington County. Citizen participation must be encouraged, appreciated, and properly channeled. After the end of the response operations, the ACPD made a special effort to thank those organizations and agencies that provided support, sending letters of appreciation to vendors and individual citizens who provided goods or services.

Beginning on Day 4, the ACPD assigned an officer to record activities that can be used in the next CALEA accreditation assessment. The experience gained during the Pentagon response covered many assessment standards, including jurisdiction and mutual aid; operational readiness; EAP; special purpose vehicles; unusual occurrences; media; communications; and collection and preservation of evidence.

Many county employees and volunteers were assigned to support the programs implemented for family members of missing victims at an Arlington hotel. They were told to park their automobiles in a regularly restricted area and that parking violation tickets would not be issued. Not all members of the ACPD were informed of this policy and several tickets were issued and later forgiven.

Expressions of public gratitude continued long after the response ended. Requests for ACPD “heroes” to attend and be recognized at public gatherings continued for months after the incident response. At some point, these wellintended gestures become almost divisive, as others in the department who did everything asked of them, and often much more, go unnoticed. The Arlington County CEMP does not provide ACSO presence at the EOC.

However, Sheriff Arthur and Chief Deputy Sheriff Raffo immediately reported to the EOC to offer ACSO assistance. An ACSO representative remained at the EOC during operations. They provided emergency vehicles to transport county officials throughout the area and escort supply trucks to the Pentagon. Because of the demands on Assistant Manager Bridges, he was assigned a full-time deputy and an ACSO vehicle.

The ACSO does not have the resources for intense operations of protracted duration. Off-duty personnel can augment on-duty staff, but only in an overtime capacity.

On the afternoon of September 11, the Arlington County Emergency Management Team at the EOC requested that the ACSO arrange for its vendor, ARAMARK, to provide 1,000 hot meals for responders at the Pentagon. ARAMARK prepares meals for inmates and ACSO staff at the county detention facility. Usually, when the EOC is activated, ARAMARK provides about 30 meals to the Emergency Management Team and supporting county employees. A second order for 1,000 meals was placed at 7:00 p.m. that evening, as well as an order for 3,000 snack bags. ARAMARK staff from the Alexandria and Fairfax County correction facilities helped fill these requests from the kitchen at the Verizon building in Arlington.

Recommendations and Lessons Learned

Arlington County should work with neighboring jurisdictions and other emergency response agencies and volunteer organizations to implement a uniform identification system. Such a system should be in place and used routinely but should provide a starting point to rapidly expand the credentials process during a large-scale emergency. (LE-021)

Shift duration for emergency response operations should be standardized and uniform for all law enforcement personnel. It appears that a 12-hour shift is best suited for protracted operations. It has the advantage of placing all personnel into a single resource pool. Days off should be factored into the schedule from the start. (LE-022)

The ACPD should acquire an AVL system to track the locations of its patrol fleet. (LE-023)

It is important to develop a plan early regarding how, when, and where to use mutual aid and to request such aid in specific detail to avoid confusion and misunderstanding. (LE-024)

When other agencies request law enforcement support, such as closing a particular road or clearing a parking area, it is important to record the details of the request and the person making it to ensure it is legitimate and based on proper authority. (LE-025)

The public needs a place to visit to feel part of the incident response. Determine an appropriate location considering safety, security, and area traffic. Sensitize police officers to the tremendous impact of such horrendous incidents on the entire community. (LE-026)

Agencies engaged in extended response operations should expect participants to become fatigued. Train supervisors to recognize the early signs of fatigue and act quickly to provide relief, recognizing the reluctance of participants to leave the job. (LE-027)

Law enforcement agencies working with responsible government officials should follow the example of the ACPD and Arlington County public affairs and help the media find good stories that exemplify the work of all parties engaged in the response. (LE-028)

Law enforcement agencies should include nonsworn employees and personnel from supporting government agencies in briefings or tours of the incident site.

Their support and understanding are important to a successful response and recovery. (LE-029)

Requests for continuing public recognition following a major incident response should be referred to the appropriate local government official, in this case the Arlington County Assistant Manager for Public Affairs. That official can determine whether or not and in what manner to comply with the request. (LE-030)

The ACPD should work jointly with the DPS to prepare the entry points established on the Pentagon perimeter for use during future emergencies. Such preparations might include permanent shelters for law enforcement personnel and electronic connectivity for telephones and computers. The ACPD, DPS, and the ACFD Logistics Officer should collaborate on a system to inform entry point security officers about schedules for anticipated deliveries. (LE-031)

Maximum safe speed limits should be posted and strictly enforced on incident site grounds to avoid placing at risk responders helping others in jeopardy. The Incident Commander should establish these safeguards in conjunction with the Operations Section Law Enforcement Branch and the Incident Safety Officer. (LE-032)

CISM proved to be a valuable part of the public safety response operations. Too often, individuals in high-risk occupations fail to acknowledge their own mortality and the legitimate need for psychological as well as physical renewal. Arlington County government needs to continue incorporating CISM into all activities so its services are fully appreciated and sought when crises occur. Senior leaders are not immune from the stress-induced damages of WMD incidents and should ensure they protect and rehabilitate themselves as well as those entrusted to their care. (LE-033)

As in this incident, in future extended response operations, Arlington County should establish a citizens’ “hotline” to receive and coordinate offers to donate goods and services. An improved database should be developed to track offers of support and manage the process. (LE-034)

The Arlington County CEMP should be revised based on experience gained during the Pentagon attack. Workspace should be provided for the ACSO consistent with responsibilities included in the CEMP. (LE-035)

The ACPD and ACSO should review standard PPE and upgrade it to meet the protection requirements appropriate for activities identified in the CEMP. Recommended PPE for law enforcement officers is specified in a November 1999 report issued under the auspices of the Chemical Warfare Improvement Response Program (CWIRP). (LE-036)




The DPS is the law enforcement agency responsible for the Pentagon and 24 additional off-site DoD locations in the Washington Metropolitan Area. It provides a full range of law enforcement and security services. DPS Headquarters is located inside the Pentagon, which is served by 303 officers and supervisors under the leadership of Chief Jester. All 251 armed officers of the Law Enforcement Division are graduates of the Federal Law Enforcement Training Center at Glynco, GA. The Law Enforcement Division Operational Services Branch provides around-the-clock police services and includes a Special Operation Detachment consisting of the Emergency Services Team, the Protective Services Unit, and a K-9 Unit with explosive detection capabilities. The Law Enforcement Division also manages more than 400 contract guards that staff their off-site facilities. The 51-person Security Services Division is the nonsworn (unarmed) part of the DPS responsible for administrative matters, transportation and equipment, and court liaison.

On the morning of September 11, 2001, Chief Jester was in his Pentagon office watching television reports of the first World Trade Center attack. When the second World Trade Center attack occurred, he immediately increased the DPS security level and ordered additional outside patrols. Shortly after issuing these orders, he felt the building shake and saw smoke from his office window. He immediately went to the DPS Communications Center for a damage assessment, but the closed circuit television security camera nearest to the point of impact had been destroyed by the crash.

The DPS response was almost instantaneous as some officers witnessed the crash and went immediately into action. They helped injured victims find their way out of the building, activated fire alarms throughout the Pentagon, guided building evacuation, and helped seal off and secure the impact area. Even though smoke filtered into the DPS Communications Center within the first hour after the attack, DPS staff made the necessary notifications, contacting the Arlington County ECC, FBI, ACPD, and MDW. They also began recalling off-duty officers.


The first actions by DPS officers were fighting the fire, helping injured victims to safety, directing building evacuation, and securing the incident site. DPS personnel collected as many fire extinguishers as possible and attempted to put out fires. Others ran through the corridors and hallways activating fire alarms and helping occupants evacuate the building. Initially, all building occupants were directed to exit through the north side of the Pentagon. Still other DPS officers set up a perimeter around A-E Drive and the crash site to keep people away from those areas.

By agreement with the DPS, the ACPD secured the outer perimeter around the Pentagon, established traffic control, and closed access roads. The DPS secured the building, staffed all entrances, and guarded high-risk areas, such as the Secretary of Defense’s office complex. Chief Jester indicated there was instant trust among emergency response agencies since they have worked together on many incidents and special events in the past.

Many military personnel working in the Pentagon wanted to help the DPS officers and other responders immediately after the attack. They were neither equipped nor trained to do so and, in most instances, could best help by evacuating the premises themselves.

display primary and alternative building evacuation routes and assembly areas. Although evacuation drills are scheduled quarterly, participation is encouraged but not mandated.

Most building occupants realized this evacuation was real. However, there were instances where personnel were unfamiliar with evacuation routes and became confused. Some personnel, working in secure areas on sensitive issues, had to be convinced of the seriousness of the events for them to evacuate. Because of the size and design of the Pentagon, building occupants working in offices on the opposite end from the crash site were not immediately aware of the attack.

Armed DPS officers are not permitted to carry weapons while off duty. The area where weapons were stored was damaged in the attack, making the retrieval of those weapons difficult. Weapons are needed in the performance of their duties, including providing armed escorts for transporting classified materials.

During the first 2 hours of the incident, traffic congestion and closed roadways made it difficult for recalled DPS personnel to reach the Pentagon.

Twelve-hour shifts were immediately established for all DPS personnel.

DPS Deputy Chief John Pugrud went to the ACPD commander at the ACPD auxiliary command post in the Center Courtyard and offered the support of eight DPS Security Services personnel.

Recommendations and Lessons Learned

Evacuation drills should be conducted monthly and should be mandatory for all Pentagon occupants. The Pentagon will always be an attractive target to terrorists. Officials cannot afford to rule out the possibility of another attack. (LE-037)

The weapons policy for armed DPS officers should be reviewed. An alternative weapons storage site should be explored. In addition, the legal and policy implications of allowing DPS officers to carry their weapons while off duty warrants review. (LE-038)

The DPS should conduct regular tabletop exercises with area law enforcement and fire and rescue agencies at the Pentagon and other facilities protected by the DPS. Tours and orientations should be regularly presented to the ACFD and other area public safety agencies. (LE-039)



The DPS operates under the ICS for emergency response. Chief Jester served as the DPS Incident Commander for the Pentagon response, establishing the DPS Communications Center as the ICP. An auxiliary DPS command post was established in the Center Courtyard where DPS Security Services supported the ACFD. The DPS established immediate contact with the ACFD Incident Commander and the FBI On-Scene Commander. Direct and continuous coordination with the FBI was essential so evidence recovery efforts also contributed to the process of gathering DoD classified documents, materials, and storage containers mixed in the rubble. At shift changeover, DPS Security Services personnel coordinated with the incoming and outgoing FBI Evidence Recovery Team leaders at the FBI ICP and at the North Parking Lot area evidence collection site. This continuous coordination reduced and resolved problems and precluded misunderstandings. These critical communications ensured the FBI understood the valid mission of DPS Security Services and was able to help in the effort. DPS Security Services personnel worked diligently to secure classified materials, but did not hinder the rescue, recovery, and crime scene operations.


Interacting with military personnel was occasionally frustrating because they were unfamiliar with the ICS.

team meetings, and worked at the JOC after it opened on September 12. The initial building evacuation was accomplished in less than 1 hour. The public address (PA) system “Giant Voice” was used with a prerecorded message modified to convey specific instructions regarding this event; for example, building occupants were instructed to exit on the north side of the Pentagon.

This recording continuously repeated throughout Wedges 3, 4, and 5 of the Pentagon. Because of the ongoing renovation work, the PA system was not functioning in Wedges 1 and 2 where the impact occurred. Because the DPS did not have handheld bullhorns, officers had to knock on doors and enter offices to ensure all personnel got out safely. The parking lots were evacuated quickly. Amazingly, only three vehicles had to be towed.

The DPS backup communications system is located at the Navy Annex, Federal Office Building 2 (FOB2), next to the Virginia State Police barracks overlooking the Pentagon. Had it been necessary to relocate the DPS Communications Center to this site, communications would have been interrupted for approximately 45 minutes. The backup communications system has never been tested.

Cellular and landline telephone communications were virtually unreliable or inaccessible during the first few hours of the response. However, as time progressed, cellular telephone communications were helpful as the volume of radio traffic continued at a higher than normal level. On the afternoon of September 11, Verizon technicians and the USSS technical staff installed portable cellular towers onsite at the Pentagon. This significantly increased cellular telephone access. A cache of cellular telephones was also provided by both organizations.

The DPS issued new cellular telephones to the on-duty shift and distributed the new telephone numbers to the ACFD Incident Commander, the FBI, and other response organizations. When the shift change occurred, new telephones were issued to the replacement personnel. As a result, a second telephone directory had to be distributed with new numbers for each DPS position. Incumbent officers should have surrendered the cellular telephones to their replacements, avoiding the need to distribute a second telephone number directory. DPS Security Services Division personnel do not have assigned radios. Thus, they were initially unable to communicate by radio with DPS law enforcement officers. This lack of communication was debilitating because Security Services personnel are not armed and require a DPS law enforcement escort when transporting classified materials. Portable communications would have enhanced operations for DPS Security Services, allowing communications with the DPS Incident Commander and accelerating requests for armed escorts. The DPS acquired additional portable radios and issued them to Security Services.

Recommendations and Lessons Learned

The DPS should offer to Pentagon building occupants a regular orientation or videotape describing the ICS and how it functions. This initiative should be undertaken in coordination with the ACFD and MDW so it is also available to other DoD sites. (LE-040)

As the Pentagon renovation work continues over the next decade, the DPS should consider expedient alternatives to disseminate emergency information in those Wedges undergoing construction. There are always large numbers of contractors and construction workers in those areas and, depending on the renovation status, others might also be occupying some of the space. (LE-041)

The DPS should procure bullhorns or other portable PA devices to augment the central system. (LE-042)

The backup communications system should be regularly tested, including relocating the DPS Communications Center staff. (LE-043)

Cellular telephones should be assigned to specific positions and passed along by each officer performing those duties so there is only one telephone directory. (LE-044)

All DPS personnel should have access to portable radios. (LE-045)



The DPS has substantial capabilities and its personnel have extensive training and responsibilities. Officers of the DPS Law Enforcement Division are trained at the Federal Law Enforcement Training Center in Glynco, GA. They receive the same training as other Federal officers, including USSS and Immigration and INS officers. The 251 Law Enforcement Division officers patrol the Pentagon grounds, screen mail and courier packages, guard entrances and sensitive areas, respond to bomb threats, and manage the 400-person contract guard force that works at other DoD facilities in the area. The unarmed Security Services Division staff is certified in all aspects of physical and technical security. The 51 members of the DPS Security Services Division maintain alarm systems at the Pentagon and at the residences of the Secretary and Deputy Secretary of Defense. They also install and maintain electronic security, access control, and intrusion detection systems at the Pentagon, and operate the Pentagon employee and visitor pass systems. The Locksmith Branch is responsible for 3,500 Pentagon safes. The DPS has formidable capabilities to meet important responsibilities.

The duties performed in the aftermath of the terrorist attack on the Pentagon included many that were well outside the DPS charter. Acting in defense of the facility it is sworn to protect, DPS officers did whatever was required without question. No job was too demeaning or outside a DPS officer’s scope of responsibility. Like other Pentagon response force organizations, the DPS stepped up to the challenge of the moment and performed admirably.

DPS personnel provided a great deal of support to other responders. They identified specific locations, facilities, and materials so the FBI could establish its temporary morgue at the North Parking Lot area loading dock. The DPS also provided access to its warehouse on Eads Street near the Pentagon to store personal effects and crime scene evidence. The DPS delivered site maps, building diagrams, and floor plans to the Incident Commander and arranged for use of Pentagon facilities, such as conference and briefing rooms when needed.


Mandatory 12-hour shifts were instituted for all DPS personnel shortly after the incident occurred. Twelve-hour shifts simplified and helped organize staffing.

However, because of the shortage of personnel, the DPS was unable to perform some important functions. For example, it would have been beneficial if a DPS officer was assigned to help the ACPD and Virginia State Police at each of the six entry gates onto the site. There simply were not enough personnel to meet all requirements.

DPS officers were organized into squads during the response with each squad supervised by a sergeant. The sergeant was responsible for safety and break schedules for the squad.

DPS contract security guards assigned to off-site facilities cannot be used to augment DPS personnel during emergencies. They are hired for specific assignments and the contractor is not obligated to maintain a reserve force. The DPS does not have a mechanism in place to hire additional temporary security guards during a crisis.

DPS personnel performed many nontraditional and unexpected assignments as part of the response effort. Classified materials had to be gathered and secured.

The contents of storage containers found in the damaged area of the Pentagon had to be inventoried and secured. Safes in damaged offices had to be opened and the contents verified. Security support was required at locations in addition to the usual DPS patrol areas and Pentagon entrances, such as the sifting site and temporary morgue. Opening safes to verify contents and determine ownership was problematic.

Blast and heat from the crash damaged combination locks and fused safe doors shut. In many instances, name plates and identifying information usually found on the outside of a safe had been destroyed. The DPS purchased two devices known as “Jaws of Life,” which allowed them to open about 250 safes. In some cases, custodial information required to be stored inside the safe was missing or not current. There was no master roster of personnel assigned responsibility for the many classified containers. The DPS had to contact Pentagon security managers to make decisions regarding the disposition of classified materials.

A collection point vehicle for storing classified materials and storage containers was initially located on the outside of the perimeter on Route 27. It was eventually moved inside the perimeter, which mitigated concerns about its security and prevention of unauthorized access. Because DPS Security Services personnel are unarmed, an armed escort was requested each time classified materials were transported to the collection point.

This was a 24-hour a day operation. Personnel from the 310th Military Intelligence Battalion at Fort Meade, MD, assisted the DPS in this operation.

DPS personnel are not issued PPE. The FBI provided gloves, Tyvek® suits, and rubber boots to DPS officers working in hazardous areas.

Security had to be established on each floor of the Pentagon to keep personnel away from the impact area. Keeping personnel from returning to their offices in restricted areas was a difficult challenge. This was complicated by the fact that, in some instances, there was little or no visible damage but the areas contained hazardous materials (HazMat) in the form of asbestos, mold, and lead from paint.

Military personnel relieved the DPS of some of its security functions after the fifth day, providing the DPS a chance to restaff and realign priorities.

Those who replaced DPS officers inside the Pentagon had even greater difficulty preventing higher-ranking military officers from retrieving items from their offices. Eventually, plywood walls were constructed to seal off these restricted areas.

The DPS produced a list of points of contact for the FBI to assist in retrieving classified documents, materials, and storage containers and answer questions regarding breached security areas.

Eventually, a strict approval process was established by the JOC in coordination with the Incident Commander, FBI, and MDW and procedures were implemented for retrieving important items from the damaged area. To help visitors and vendors negotiate the area around the Pentagon, the DPS prepared a large site locator board that displayed the location of every agency represented at the incident site. The board was posted at Gate 3 and proved very helpful. (See Figure C-4.)

Because site access became such a critical issue for the FBI, the DPS provided its portable badging system to produce credentials for approved personnel. The DPS system proved inadequate for such a massive task. Therefore, the DPS pass office supervisor, in coordination with the FBI, contacted the USSS for assistance. The USSS brought six portable badging machines to the site, instructed U.S. Army Band members from Fort Myer how to operate them, and performed this function throughout the remainder of the incident response.

CISM personnel were available for DPS personnel throughout the incident response and remained available for followup. Participation in the program is not mandatory. Additionally, Lockheed Martin provided an air-conditioned trailer located at Gate 3 for rest and rehabilitation.

The DPS was able to draw on the experience of previous interaction with many of the responding agencies. The USSS, DC Metropolitan Police Department, Virginia State Police, ACPD, and MDW frequently work together when dignitaries visit the Pentagon. Events such as the annual Marine Corps Marathon engage most area law enforcement and Emergency Medical Services (EMS) agencies. Area fire, rescue, medical, and law enforcement agencies regularly participate together in tabletop and full-scale exercises. Chief Jester attributes the high degree of trust and cooperation to these experiences and others like them.

Recommendations and Lessons Learned

The DPS needs to evaluate the disposition of its officers throughout the 2-week incident response and crime scene investigation. It is possible that some functions can be met by other organizations through preestablished mutual agreements, freeing DPS staff for more critical tasks, such as helping with entry gate access control. (LE-046)

The DPS should consider negotiating a standby contract with one or more private security firms to backfill some routine DPS functions during emergency operations. (LE-047)

The DPS should consider establishing a reserve force that can be activated under emergency conditions. (LE-048)

The nontraditional duties performed by the DPS need to be recorded and incorporated into plans for possible future WMD events. Such items as the Jaws of Life devices should be procured, along with some minimum configuration of PPE and other items that proved helpful, and should be stored for quick retrieval. (LE-049)

The DPS should meet with Pentagon custodians of classified materials and review requirements for marking classified material storage containers. Such containers must be regularly inspected to ensure inventories of contents are current and contain all required information. (LE-050)

A collection point for classified materials recovered during a major event, such as the Pentagon attack, need to be planned for in advance. It should be located a safe distance from the building in a location that it is not likely to be exposed to the same risk, and in an area that can be readily secured. (LE-051)

Contaminated or otherwise high-risk areas at an incident site must be sealed off and secured quickly, and building occupants should be informed not to attempt to reenter those areas. The procedures established by the JOC for retrieving items from damaged areas need to be documented and promulgated in operations plans of all the responding organizations. (LE-052)

DPS personnel should receive regular orientations on CISM resources and should be encouraged to take advantage of such services. Supervisors should stress the value of CISM. (LE-053)

The DPS should continue to schedule regular tabletop exercises, such as “Abbottsville,” and host full-scale WMD exercises such as “Cloudy Office.” (LE-054)




Of the four senior leaders, only SAC Arthur Eberhart, in charge of the Administrative and Technical Division, was present at the FBI WFO on the morning of September 11. ADIC Harp was in South Carolina. SAC Timothy Bereznay was appointed to the position of National Security SAC, but had not yet reported to the WFO. SAC Ellen Knowlton, who headed the Criminal Investigative Division had recently been reassigned to FBI Headquarters. When the second airliner hit the World Trade Center, SAC Eberhart activated the WFO Command Center and began making plans to support New York City.

SAC Eberhart ordered the notification and recall of the NCRS. Special Agent Christopher Combs of the NCRS was teaching a class at the District of Columbia Fire Academy when he received the page from the WFO Command Center.

At about 9:20 a.m., the WFO Command Center was notified that American Airlines Flight #77 had been hijacked shortly after takeoff from Washington Dulles International Airport. SAC Eberhart dispatched a team of 50 agents to investigate the Dulles hijacking and provide additional security to prevent another. He sent a second team to Ronald Reagan Washington National Airport as a precautionary step. At the WFO Command Center, Supervisory Special Agent (SSA) Jim Rice was on the telephone with the Pentagon when Flight #77 crashed into the building.

En route to the WFO after picking up fresh clothes for the anticipated New York deployment, Special Agent Combs was monitoring the DC Metropolitan Police Department radio frequency and heard a report of an explosion at the Pentagon.

He immediately changed direction and headed to the Pentagon. Within minutes of the attack, he was at the Pentagon meeting with Assistant Chief Schwartz, the ACFD Incident Commander. As the NCRS Fire and Rescue Liaison, Special Agent Combs knew Chief Schwartz and most of the other area fire and rescue leaders.

The FBI NCRS and JTTF were dispatched to the Pentagon, with the Crime Scene Team onsite 30 minutes after the attack. Special Agent John Adams began organizing the FBI Evidence Recovery Team on a grassy site about 30 yards from the ACFD ICP. Special Agent Combs set up the FBI Command Post adjacent to the ACFD ICP. FBI agents began searching for aircraft parts and other evidence on the Pentagon grounds, being careful not to interfere with fire and rescue efforts.

At about 10:15 a.m. on September 11, the WFO Command Center was notified by the Federal Aviation Administration (FAA) that another airliner, United Airlines Flight #93, was hijacked after taking off from Newark, NJ, and was flying on a course from western Pennsylvania toward the Washington Metropolitan Area. The FAA estimated it would reach Washington, DC, in 20 minutes. The Command Center relayed the information to Special Agent Combs at the ACFD ICP who alerted Chief Schwartz. Special Agent Combs located a Washington Metropolitan Airports Authority (WMAA) firefighter equipped with a radio and confirmed the information about Flight #93. Chief Schwartz ordered a complete area evacuation, directing the response force to relative safety beneath nearby highway overpasses. Special Agent Combs stayed at Chief Schwartz’ side, giving him updates as the FAA tracked the course of Flight #93. The last update came when the airliner was 4 minutes away from the Pentagon. Five minutes later, Special Agent Combs reported to Chief Schwartz that Flight #93 had crashed into Camp David in Maryland. In fact, it crashed in a field near Shanksville, PA. Chief Schwartz sounded the all clear.

The WFO Command Center is capable of supporting large-scale emergencies and special events. As the response to the attack on the Pentagon took shape, FBI command personnel at the WFO focused on conducting hijacking investigations; preventing additional terrorist attacks; determining who was responsible for the attacks that had occurred; increasing protection levels for FBI Director Robert Mueller and Attorney General John Ashcroft; responding to additional threat reports; and executing continuity of government plans.


Notification and recall procedures are not usually a problem for the FBI. However, on September 11, there were serious difficulties getting FBI personnel from Washington, DC, across the Potomac River bridges to the Pentagon. In many instances, FBI agents responding from Quantico, VA, 35 miles away, arrived sooner than those did from just across the Potomac River in Washington, DC.

Usually, additional FBI personnel would immediately be flown into the Washington Metropolitan Area to help with the investigation. However, on September 11, getting additional and critical FBI personnel to the Washington Metropolitan Area was problematic. All aircraft were grounded and airports across the Nation were closed. The FBI had to obtain special FAA permission to send an aircraft to South Carolina and bring WFO ADIC Harp back to Washington, DC.

Because of the large volume of reports received at the WFO Command Center, many of which containing conflicting information, it was difficult to comprehend the scope and magnitude of the events unfolding on September 11, 2001. The FBI was confronted with several simultaneous emergency situations. An airliner had been hijacked after departing Washington Dulles International Airport. That incident had to be investigated and other hijackings had to be prevented. The terrorist attack on the Pentagon required full mobilization to conduct the crime scene investigation, collect evidence and recover bodies of victims, and establish and manage a JOC. At the same time, the WFO had to provide security for FBI Headquarters and the DOJ, and investigate bomb threats and other reported incidents in the Nation’s capital. There was great concern that additional “terrorist sleeper-cells” might become active and perpetrate further attacks.

With one forward command post already in operation at Washington Dulles International Airport, the FBI WFO was challenged to deploy sufficient numbers of experienced senior managers and supervisors to the Pentagon in the first hours after the attack. SAC Eberhart and SSA Rice were fully occupied at the WFO Command Center. On September 11, Assistant Special Agent-in-Charge (ASAC) Robert Blecksmith, who reached the Pentagon at midday, was the senior FBI agent at the scene. He immediately requested additional supervisor-level agents with terrorist response experience. On the afternoon of September 11, the FBI established a command post at the Virginia State Police Barracks adjacent to the Navy Annex, where ASAC Blecksmith had relocated the FBI Unified Command Post. The WFO has extensive experience working with other Washington Metropolitan Area response organizations. The annual State of the Union Presidential Address, Inauguration ceremonies, international conferences such as the International Monetary Fund meetings, visiting heads of State, and similar events engage law enforcement agencies from all area jurisdictions. Multiagency terrorism training exercises, such as Top Officials (TOPOFF), also provide valuable experience upon which to draw in an emergency.

Recommendations and Lessons Learned

Because of the dependence on bridges for vehicular mobility from the District of Columbia to Virginia, FBI helicopters should be assigned to the WFO to airlift critical personnel and resources. (LE-055)

The WFO should review current staffing levels to ensure it has adequate senior leadership and sufficient experienced managers so response capabilities to multiple simultaneous incidents are not at risk. (LE-056)

The FBI WFO should engage all its senior leadership in joint terrorist response exercises. The WFO should also exercise the next management level to serve in positions usually filled by the senior leaders in the event those leaders are not available. (LE-057)

WFO should evaluate the computing and communications capabilities and staffing levels of the Command Center to ensure it can support multiple simultaneous events for an extended time. The mobile command vehicle also needs modernization. (LE-058)

The benefits of the NCRS fire and rescue liaison function were evident in this incident. The FBI staff onsite understood the ACFD ICS and the ACFD knew what to expect from the FBI. The WFO should consider expanding this outreach program to other response organizations. It should also be implemented in every FBI field office in metropolitan areas. (LE-059)

The WFO should continue to participate in and even plan major terrorist training exercises involving the Washington Metropolitan Area response community. (LE-060)



The FBI had many responsibilities in the wake of the September 11 terrorist attack on the Pentagon. Because of the nature of the event, the FBI had to establish control of the crime scene and begin collecting evidence. However, although the FBI was responsible for the crime scene, it was not responsible for the fire and rescue incident that took precedent on that day. That role belonged to the ACFD. Assistant Chief Schwartz was the designated Incident Commander and would remain so until fire and rescue operations were completed and the site turned over to the FBI on September 21. Throughout the fire and rescue phase, the FBI supported the ACFD and worked in conjunction with search and rescue units while collecting evidence and recovering the remains of victims. Additionally, in accordance with the Interagency Domestic Terrorism Concept of Operations Plan (CONPLAN), the FBI was responsible for activating a JOC to coordinate the activities of the responding Federal Departments and agencies.

The FBI began meeting its responsibility to the ACFD by assigning Special Agent Combs as agency representative to the Incident Commander. Special Agent Combs is the NCRS Fire and Rescue Liaison and already had close working relations with leaders throughout the Washington Metropolitan Area public safety community.

The FBI on-scene criminal investigation got under way immediately, as Special Agent Adams, a member of the NCRS Evidence Recovery Team, organized the crime scene investigation. He established a Logistics Branch, an Evidence and Body Recovery Branch, and a Temporary Morgue Branch. Special Agent Adams also directed initial evidence collection on the Pentagon grounds, avoiding interference with fire and rescue activities.

Shortly after noon on September 11, ASAC Blecksmith arrived at the Pentagon, along with SSAs Rick McFeely and John Kerr. ASAC Blecksmith was the senior FBI official at the Pentagon on September 11. He concentrated his efforts that afternoon and evening on locating and equipping the JOC.

On the afternoon of September 14, SAC Eberhart was finally free of duties at the WFO Command Center and took command of the FBI crime scene investigation at the Pentagon. Although SAC Bereznay was in charge at the Fort Myer JOC, it was 3 days into the event before an FBI SAC was available to take command of operations onsite at the Pentagon. At a brief 7:00 a.m. ceremony on September 21, Chief Schwartz passed responsibility for Incident Command to SAC Eberhart. The fire and rescue phase was complete. The Pentagon was now a crime scene—the sole domain of the FBI. One week later, on September 28, 2001, SAC Eberhart returned control of the Pentagon to Major General James Jackson, representing the DoD.


Special Agent Combs has worked closely with ACFD firefighters and the fire departments of other local jurisdictions since assuming his position with the NCRS in 1998. He is intimately familiar with the ICS and well-known by ACFD Chief Plaugher and Assistant Chief Schwartz.

ASAC Blecksmith capitalized on Special Agent Combs’ knowledge and relationships, keeping him closeby as he began organizing the FBI presence and establishing a JOC. Because the area immediately around the ACFD was crowded and offered little in the way of support facilities, ASAC Blecksmith decided to relocate and establish a Unified Command at the Virginia State Police Barracks located adjacent to the Navy Annex overlooking the Pentagon. From that location, ASAC Blecksmith, along with Special Agent Combs and others, made plans to activate the JOC at nearby Fort Myer.

During this period, at the ACFD ICP, Chief Schwartz did not have an FBI representative at his side. Special Agent Adams periodically checked in at the ICP from the nearby Evidence Recovery Team Command Post, as did SSA Jim Rice after he took over the criminal investigation operation on the morning of September 12. The FBI Mobile Command Post deployed to the Pentagon and was positioned close to the ACFD Operations Section near the heliport.

Special Agent Combs was eventually reassigned to the ICP on September 13, restoring person-to-person communications between the Incident Commander and the FBI.

On the afternoon of September 11, Dr. Marcella Fierro, the Virginia Chief Medical Examiner, met with ASAC Blecksmith and asserted the responsibility of her office regarding the autopsies of victims of the terrorist attack. The FBI felt strongly that the Armed Forces Institute of Pathology (AFIP), with which the FBI has long-standing working relations, should perform the autopsies. Dr. Fierro requested and received a letter from Attorney General Ashcroft transferring responsibility for the medical examinations to the FBI.

At about 5:00 p.m., the FBI settled on Building 405 at Fort Myer as the site for the JOC. A Fort Myer community center, the building was previously surveyed to determine its suitability to house a command center. Special Agent Paul Garten and Special Agent Jennifer Gant helped organize the JOC workspace and SSA David Raymond, Technical Security Section, oversaw the installation of the electronic infrastructure for the agency representatives who would staff the JOC beginning the next morning.

At about 7:00 p.m., Chief Schwartz held a meeting in the Secretary of Defense’s media center in which he briefed all participating agencies in the ICS structure.

A meeting followed this, at 8:00 p.m., involving a smaller number of key agencies to discuss the need to implement a true Unified Command. At the end of this meeting, the FBI announced that the JOC would be activated at 6:00 a.m. on September 12, and all agencies should assign a senior representative with decisionmaking authority to the JOC.

Chief Schwartz decided to relocate Incident Command to the JOC. He spent much of the remainder of that night and most of the next day at the JOC, but concluded that the Incident Commander’s operational mission could best be met by relocating back to the incident site, which he did on the morning of September 13. He also asked that Special Agent Combs be reinstated as the FBI representative to the Incident Commander. Assistant Chief John White remained at the JOC as Chief Schwartz’s representative.

When the JOC opened at 6:00 a.m. on September 12, there was considerable confusion. For many of the 26 JOC agency representatives, this was uncharted territory; it was on-the-job training. Many other agencies were unfamiliar with the operation and functions of the JOC. The FBI provided logistical and administrative support and staffed the intelligence desk.

SAC Bereznay, in his first assignment since his transfer to the WFO from FBI Headquarters, became the senior FBI official on the ground. The FBI did not activate a JIC in conjunction with the JOC. The DOJ had already announced that official comments about the World Trade Center or Pentagon attacks would only come from the office of the Attorney General. Because of the failure to establish a JIC, there was no single point of interface between participating Federal agencies and the media.

A total of 26 Federal, State, and county entities sent representatives to the JOC; however, neither the Department of Energy (DOE) nor the Department of Health and Human Services (HHS) were present. Both are members of the Concept of Operations (CONOPS) “Big Six” (i.e., the FBI, Federal Emergency Management.

Agency [FEMA], HHS, DOE, DoD, and Environmental Protection Agency [EPA]). In addition, based on the nature of the terrorist attack, the Department of Transportation (DOT) or the FAA should have also had a JOC representative. On two occasions, information about unidentified aircraft approaching the Pentagon was transmitted directly from the control tower at Ronald Reagan Washington National Airport to the Arlington County ECC, which passed it on immediately to the Incident Commander. Chief Schwartz had no choice; in each case, he ordered a site-clearing evacuation. As it turned out, these were government aircraft escorted by jet fighters carrying senior government officials back to Washington, DC. These evacuations could have been avoided. They occurred when an FBI representative was not physically located with the Incident Commander. Unlike the earlier evacuation spurred by the hijacking of United Airlines Flight #93, the information given to Chief Schwartz did not come through the FBI and had not been verified by the FAA. An FAA representative was apparently present at the FBI Washington Metropolitan Area Strategic Information and Operations Center (SIOC), but that was of no consequence as events played out at the Pentagon.

Recommendations and Lessons Learned

During the response to a terrorist event such as the Pentagon attack, the FBI must maintain a continuous command-level physical presence with the Incident Commander. The FBI agency representative to the Incident Commander is a principal point of direct contact that must not be severed, even temporarily. He or she must be able to communicate with the FBI Command Post, in this case the WFO, and, if needed, the FBI SIOC so validated threat information is available to the Incident Commander. During a fire and rescue incident, the Incident Commander needs to be at the incident site directing operations. The FBI must also be there. (LE-061)

The FBI should survey government sites throughout the Washington Metropolitan Area and identify other facilities suitable to serve as a JOC or in other critical support roles, such as staging personnel or equipment. Building 405 at Fort Myer worked well housing the JOC and was previously surveyed for that purpose. One or two alternatives should be identified in other locations. (LE-062)

If a JOC is established, a JIC should also be activated. The participating response organizations need to speak with a single voice and media representatives must know where to acquire accurate coordinated information. That is the function of the JIC. (LE-063)

All organizations with positions in the JOC at all levels of government should designate in advance their representative, including a backup. Designated representatives should receive training and participate in periodic JOC exercises. They should have enough seniority to have decisionmaking authority. Other agencies not specified in the CONOPS but with particular domain expertise and authority, such as the FAA in this case, should be asked to send a representative to the JOC. (LE-064)

The WFO should plan ways to augment its senior leadership to effectively manage multiple simultaneous events. During the response to the terrorist attack on the Pentagon, it would have been desirable to have a SAC, or another senior person, at the WFO, the JOC, and the incident site. It took 3 days before such arrangements were in place. The FBI should consider forming a cadre of SACs trained and experienced in terrorist WMD incidents that can quickly deploy and augment local field office staff when needed. (LE-065)



The FBI began collecting evidence immediately after arriving at the Pentagon incident site on September 11. As fire and rescue efforts proceeded, FBI activity involving evidence recovery and removal of bodies and body parts became a 24-hour operation. Special Agent Adams directed this phase of the criminal investigation during the day shift, with Special Agent Thomas O’Connor taking over at night. The FBI worked closely with FEMA US&R teams and the fire department Technical Rescue Teams (TRTs). Special Agent Adams and Special Agent O’Connor attended the preshift briefings by the US&R Incident Support Team (IST) coordinator. US&R and TRT members would first shore up an area to ensure it was reasonably safe, then begin hunting through the debris, searching primarily for surviving victims buried in the rubble.

As they encountered bodies, parts of bodies, and other evidence linked to the crime, they called forward the FBI contingent assigned to each team. Each item was photographed, numbered, and tagged. This information, along with a diagram showing where the evidence was found, was given to one of the soldiers from the Army’s Old Guard, the 3rd Infantry Regiment from Fort Myer, VA, who transported the human remains to the FBI’s temporary morgue at the North Parking Lot loading dock. Sixty soldiers supported the FBI on each 12-hour shift.

SSA Jim Rice assigned Special Agent Tara Bloesch to set up and manage the temporary morgue. Special Agent Bloesch had previous experience establishing morgue operations during FBI overseas operations in Kosovo and other overseas locations. She determined that the North Parking Lot loading dock was a suitable site. The doors remained closed except when receiving remains, and a large tarp was hung to safeguard the privacy of the morgue. The DPS, the FBI Critical Incident Response Group (CIRG), the ACPD SWAT team, the U.S. Marshals Service, and military police from MDW provided security at different times throughout the operation.

At the morgue, remains were photographed and labeled, and a record was prepared before they were released for transport. Twice each day, refrigerated trucks provided by the military carried remains to Davidson Army Airfield at Fort Belvoir, VA, where Army helicopters flew them to the AFIP at Dover Air Force Base (AFB), DE. FBI agents rode in the trucks, participated in the escort, and accompanied the remains during the flight to preserve the chain of custody.

The Virginia State Police escorted the trucks to Fort Belvoir. Because of the volume of debris inside the Pentagon, front-end loaders were used to load the debris in dump trucks, which carried the debris to a sifting operation in the North Parking Lot. Special Agent Samuel Simon and Special Agent Jeffrey Bedford ran the 2 shifts of the 24-hour a day sifting operation, which was extremely labor intensive. Volunteers from the FBI, Drug Enforcement Agency (DEA), EPA, BATF, Arlington County and mutual-aid law enforcement agencies, MDW, and others worked around the clock with 200 or more persons on each shift. BATF heavy equipment operators spread rubble from inside the Pentagon. Metropolitan Police Department cadaver dogs worked through the debris, then volunteers carefully raked the area searching for body parts, personal effects, evidence, and classified documents. Papers of any type were turned over to the DPS to determine if they contained classified materials and, if so, to safeguard them. The sifting operation produced about 70 percent of the body parts processed at the morgue.


Only one of four senior WFO leaders was present at headquarters on the morning of September 11. Fortunately, SAC Eberhart had a great deal of related experience. He served as ASAC in New York when TWA Flight #800 crashed on July 17,1996. He also led the WFO Evidence Recovery Team to Kosovo during the war crimes investigation. More than 700 agents participated in the FBI operations at the Pentagon, deploying from Baltimore, MD; Richmond, Norfolk, and Quantico, VA; Charlotte, NC; Columbia, SC; Atlanta, GA; Los Angeles, CA; and Philadelphia, PA. Supervisors are part of the responding FBI teams; nevertheless, with several concurrent incidents to deal with, the WFO was stretched thin during this period. SAC Eberhart was unable to deploy to the incident site until the afternoon of September 14. Although there were an ample number of FBI agents at the crime scene, experienced FBI supervisors were in short supply.

The FBI WFO had previously worked with the FEMA US&R teams and was familiar with their capabilities and methods of operating. The US&R teams used spray paint to mark the status of areas on panels and columns as they worked. The FBI adopted these markings as part of its recordkeeping. They served as a grid for identifying where evidence and remains were found.

The IST coordinator provided the FBI Evidence Recovery Team a US&R radio. This proved extremely helpful in summoning FBI assistance whenever US&R teams digging through rubble came across evidence or victim remains.

The EPA CID provided significant support to the FBI at the incident site. EPA CID personnel conducted evidence searches, performed facepiece fit-tests, helped in evidence recovery and sifting operations, and provided safety oversight.

The U.S. Air Force (USAF) OSI operated adjacent to the FBI and worked closely with them throughout the crime scene investigation. USAF OSI was particularly valuable in retrieving highly sensitive classified materials from the Pentagon.

The BATF deployed both the southeast and northeast National Response Teams (NRTs) to the Washington Metropolitan Area. These 30-person teams comprise veteran agents with expertise in forensics, fire and blast origin, explosives detection, fire protection, and other relevant areas. Some team members are qualified heavy equipment operators. Teams also include technical, legal, and intelligence advisors. By September 13, the BATF had 47 persons onsite at the Pentagon.

The success of the FBI operations at the Pentagon depended on harmonious working relationships with the ACFD Incident Commander, military leaders, DPS, and other law enforcement agencies. The BATF provided valuable assistance to the FBI operations, but working relations between the FBI and BATF were sometimes strained. The BATF usually works in an independent role and does not generally operate in support of other law enforcement organizations. Relations between the FBI, the ACFD, and the entire Washington Metropolitan Area fire and rescue community were outstanding, thanks largely to the work of Special Agent Combs. The FBI understood the ICS, and the fire community knew what to expect from the FBI. Holding a small but official ceremony marking the change of Incident Commander responsibilities was important. It was clear to everyone that the ACFD was in charge during the 10-day fire and rescue phase and equally clear that the FBI was in charge beginning on September 21.

Controlling access to the crime scene was a challenge. A second mesh fence was erected to create an inner perimeter, separating the fire and rescue site and crime scene from the larger response assembly and support area. (See Figure C-5.) An attempt at issuing identification (ID) badges using the DPS system proved cumbersome and inadequate. The process took too long, delaying shift changes inordinately. At the request of the FBI, the USSS deployed five portable units and trained U.S. Army Band members to produce ID badges for authorized responders.

After the ACFD relinquished control of the incident site to the FBI, questions arose concerning continuing support for the responders. The ACFD had provided the bulk of logistics supplies to all the response organizations beginning on September 11. The ACFD would subsequently be reimbursed by FEMA for the costs incurred. The FBI and other government organizations are not reimbursed for such costs. In this case, the ACFD left a logistics presence in place and continued supporting the FBI.

Pentagon renovation contractors Facchina and PENREN construction companies provided Bobcats®, front-end loaders, and other heavy equipment along with operators to the FBI. The BATF also provided equipment operators.

Military personnel from the MDW were invaluable throughout evidence and body recovery operations. Not only were they available in large numbers and in highly disciplined formations, they were physically fit young infantrymen able to withstand the rigors of this challenging work.

The evidence and body recovery work was both physically and psychologically challenging. Working in the temporary morgue was particularly stressful. CISM support was available day and night. It proved both popular and valuable.

Special Agent Bloesch made it clear that anyone working in the morgue could ask to be replaced at any time with no questions asked. The FBI’s temporary morgue and the North Parking Lot sifting operations attracted many visitors. Often, hosting visitors in sensitive areas is inappropriate, even when they are senior government officials.

There was no consensus regarding minimum required PPE during the criminal investigation phase. The FBI generally tried to comply with guidance and direction from the EPA, but some felt it was incompatible with the strenuous nature of the work when the threat of fire was minimal.

Some FBI responders felt, as time progressed and regulatory agencies such as the Occupational Safety and Health Administration (OSHA) were increasingly involved, they tended to apply standards more appropriate to an industrial operation rather than a crime scene.

Because two FBI overseas Rapid Deployment Teams are based in the Washington Metropolitan Area, the WFO had access to their cache of deployable equipment, which included Tyvek® suits, respirators, and other safety items.

Recommendations and Lessons Learned

The FBI needs to assess the realistic span of control and possibly adjust the number of senior leaders at large field offices. The WFO is the second largest in the Nation, with 657 agents and another 650 professional support staff. It is authorized a total of 1 ADIC, 3 SACs, 7 ASACs, and 56 SSAs. Only one ASAC was at the incident site beginning on the afternoon of the first day. A second ASAC, Doug Marshall, reported to the JOC for night shift beginning on the third day. The current ratio of supervisors to special agents may be adequate for traditional FBI investigative work; however, WMD incidents require more intense supervision. (LE-066)

The FBI WFO should initiate a program to train and exercise with area US&R teams and fire and rescue TRTs. FBI field offices in Memphis, TN, and Albuquerque, NM, where US&R teams are also located, should institute a similar program. (LE-067)

The WFO should host a roundtable discussion about the Pentagon response involving all participating law enforcement agencies. Such an event will help build on the bonds forged during the response and help reduce or preclude future misunderstandings. (LE-068)

An efficient system that can be readily implemented to produce incident site access badges needs to be developed to achieve control of the crime scene without impeding response operations. (LE-069)

In future WMD incidents, the transfer of logistics and other support functions concurrent with the end of fire and rescue operations should be planned early and carefully executed. (LE-070)

The WFO has a robust liaison program with the fire and rescue community. It should reach out in similar fashion to the MDW and DPS to strengthen those relationships as well. (LE-071)

CISM capabilities and the resources to deliver them need to be recognized in plans, understood by responders, and delivered both during the event and afterward in followup sessions. (LE-072)

Occasionally, it is appropriate for senior government officials to visit sensitive facilities such as the FBI’s temporary morgue, even if only to check on the wellbeing of the staff working there. However, these visits must be carefully controlled and absolutely necessary. (LE-073)

The FBI WFO should conduct discussions with the EPA, OSHA, HHS, fire department, and other appropriate parties to better understand the levels of protection recommended under different circumstances. Based on these discussions, deployable caches of supplies and equipment can be acquired in the event that those belonging to the two Rapid Deployment Teams are unavailable. (LE-074)

Annex A | Annex B | Annex D