COMMISSION SENSITIVE

MEMORANDUM FOR THE RECORD

Event: Interview with Rear Admiral Cathal "Irish" Flynn, USN (ret)

Type of Event: Interview

Date: September 9, 2002

Special Access Issuas: None

Prepared by: Lisa Su\livan

Team Number: 7

Location: 9-11 Commission Office, GSA building

Participants - Non-Commission: Rear Admiral Cathal "Irish" Flynn, USN (ret), former
Civil Aviation Security for the Federal Aviation Administration

Participants - Commission: Sam Brinkley, Bill Johnstone, John Raidt, and Lisa Sullivan

Background

(Unc) Admiral Flynn served in the United States Navy for 30 years. Following his
retirement from the Navy in 1990, Adm. Flynn joined Science Applications International
Corporation (SAIC). From 1993 through 2000 he served as Associate Administrator of
Civil Aviation Security (ACS 1). Admiral Flynn spoke to the state of the civil aviation
system as it was on September 11, 2001, and how security and intelligence were
integrated over the course of his tenure at FAA. He testified that FAA Administrator
Hinson shared his view that aviation security was "crucial" to the FAA's mission.

ACS and NSC

(Unc) To start, Flynn asserted that the Commission should not underestimate the
influence and impact the National Security Council staff (particularly the National
Security Council's former counterterrorism czar Richard Clarke) had on Flynn's work in
aviation security at FAA. Flynn immediately went on to substantiate his assertion in
citing a 1995 meeting at which Richard Clarke was present when Flynn urged the
intelligence community to provide FAA with more intelligence affecting civil aviation in
order to step-up security at airports.
f \) Additionally, Flynn represented the FAA at meetings of the National Security

Council's Counterterrorism Security Group (CSG) that pertained to civil aviation

security. FAA did not attend CSG meetings regularly.

COMMISSION SENSITIVE
 COMMISSION SENSITIVE

ACS and Central Intelligence

i To this point, Flynn discussed two meetings he held with FAA Administrator David
Hinson and two Directors of Central Intelligence circa 1995. Flynn reported that a
meeting was less than satisfactory, with one of the Directors displaying a
"condescending" view toward civil aviation security needs. One of the DCI's is reported
to have said, "You have those machines (EDS machines), why don't you put them in
places like Miami and you are done." Flynn told them of his concern that threats to civil
aviation were not being adequately communicated. More specifically, he named Newark,
New Jersey and Detroit, Michigan as places where he had received indications of
possible problems with Middle Eastern populations in those areas. Flynn thought more
resources were needed to fund aviation security measures and to direct intelligence. FAA
Administrator Hinson and Flynn sought permission from DCI to go to the Hill with their
concerns and to ask for more money for civil aviation security intelligence. S-60 was
supportive of Flynn's efforts but the DCI was not supportive of going to the Hill,
indicating that that they had "plenty" of such intelligence.

tSS*) His assessment of the CIA at the working level was "excellent. He reported that
the agency was consistently helpful, provided a lot of "grainy" information, and helped to
sanitize the intelligence reports for the industry. This was mostly a CTC function, and
Flynn believed CTC was "smart and had a pretty good, grainy appreciation" of civil 9/11
aviation intelligence needs. Information provided by CIA produced results and led the . classified
FAA to, in Flynn's words, \ Information
| {because of indications that terrorists
were trying to get a bomb into cargo."

(S-Sf) Given the generally high quality of the CIA's work product for the FAA, Flynn
reportedly had a much better appreciation of what was going on in Beirut than in Detroit,
even through there were a "hell of a lot more flights out of a Detroit," and (as he said
before) there were significant Muslim populations located there. He said the threat at
home was perceived as present but low while overseas the threat was present and high.

Gore Commission

(Unc) Flynn then discussed the Gore Commission. He deemed their treatment of threats
to civil aviation to be "cursory" and their treatment of terrorism to be "lackadaisical."
The members failed to realize their priority in threat analysis should be Middle Eastern
terrorists. Flynn indicated the Commission dwelled on fallout from the Oklahoma City
bombing. Flynn believed that incident did not demonstrate a threat to aviation, or private
industry for that matter.

ACS and FBI

(Unc) In another instance, Flynn reported that staff of the Senate Select Intelligence
Committee asked the FAA, the DCI and the FBI for a briefing on threat indications
regarding civil aviation. Despite the few indications the FBI had received (of an

COMMISSION SENSITIVE
 COMMISSION SENSITIVE

individual who tried to get a job with airport access at LAX, for instance), the answer
they supplied the congressional staff with was no; they were not aware of any significant
terrorist threats to the aviation industry. O'Neil was the head terrorism guy at FBI.
Blitzer was his Deputy at the FBI. Based on his interaction with the two DCIs and Louis
Freeh, Flynn characterized their attitude toward the FAA as "condescending." They were
not receptive to the idea that more needed to be done in the area of intelligence for civil
aviation security.

ACS and FAA leadership

(Unc) The FAA Administrator at the time, David Hinson, recognized the difference
between safety and security and agreed intelligence was "crucial" to security.
Domestically and internationally, U.S. carriers were everywhere. Flynn felt that his
position required that he have a firm grasp of what was going on everywhere in the
world. Underscoring this statement, he asserted that "if a high quality terrorist got to the
airport, it was going to be very difficult to stop him or her."

(Unc) When asked about his relationship with Administrator Jane Garvey, Flynn said that
she would ask how he was doing, for his input, from time to time. He believed that she
was "engaged" in security issues. Whenever a security directive or important Emergency
Amendment was issued, he would brief the Administrator.

ACS and Congress

(Unc) When asked about congressional interest, Flynn noted that Representative Jim
Oberstar from Minnesota was particularly active on the issue, and promoted enhanced
aviation security measures given the terrorist threat in a 1995 letter he wrote to the
President and Vice President. Flynn did not recall that Oberstar ever received a response
from the White House. With Oberstar's assistance, Flynn attempted to increase the
baseline budget for the FAA and step-up efforts undertaken by Security Directives. The
cumbersome and lengthy FAA rulemaking process led them to attempt to reconstitute the
Pan Am 103 Commission in non-crisis mode. Furthermore, he said he wanted "to avoid
having to chisel out improvements in the "unyielding granite" of the regulatory process.

Domestic Threats

(SSI) In turning to the domestic side, Flynn said Blitzer and the FBI would not give
regular reports and would only inform the FAA when it had specific information.
According to Flynn, Blitzer told others he had asked for "raw" intelligence. Flynn denied
this, and indicated to the Commission that he had asked for basic information of potential
threats from groups in the United States, where they were located, what their basic level
of sophistication was, what was going on, how they were organized. At this point, Flynn
alluded to the distinction between CIA and FBI attributed to the differences between
criminal investigations and intelligence gathering, with "intelligence jammed
uncomfortably into" the operations of the FBI. He reiterated that those covering the
domestic side had "precious little to say" to the FAA. When the FAA sent over a liaison

COMMISSION SENSITIVE
 COMMISSION SENSITIVE

to the FBI after the TWA 800, there was little improvement in the flow of useful
information.

(Unc) Flynn testified that at that time (late 1995) there was a belief within FAA that
domestic security needed to be "stepped up." The necessary improvements would be
expensive, and in addition to the aforementioned problems with the rulemaking process,
there was a feeling that Congress would resist (for example; via restrictive appropriations
riders).

(Unc) At that point, the FAA determined to form a Baseline Working Group (BWG). It
was formally convened on the day of the TWA 800 incident and was therefore almost
immediately caught up in the "crisis mode" response to that event. Though the BWG
recommended more funding, some of the Commissioners from the Gore Commission
"pushed back" to keep the level at $100 million after it was discovered that TWA 800
had not been the result of terrorist action. By the following year (1998) neither OMB nor
the Congress supported any further increases in funding.

(Unc) With a budget of $100 million, there were only so many EDS machines FAA could
purchase at $1 million a piece. The additional costs of installing and finding suitable
locations for them were obstacles for the program. Flynn said that an effective domestic
program for checked bags would require 2,000 machines.

ACS Rulemaking

(Unc) Flynn used the Emergency Authority of the Federal Aviation Administration Act to
push through security directives that circumvented the rulemaking process which could
take years to pass a rule. The problem with this solution was that security directives were
temporary. Only rules carried the force of permanency, and the airlines were able to wait
out the rulemaking process, usually to their advantage.

ACS/ACI Intelligence

Flynn received a daily intelligence brief produced by Pat McDonnell's office

(ACI). There was a "SCIF" on site where he would go to read the most sensitive
intelligence reports. He periodically met with the intelligence analysts to discuss
intelligence flow. ACI kept files on threats around the world, also on individuals and their
histories. As part of his job, he briefed the FAA Administrator on the current threat
levels. He did not have much interaction with the Secretary of Transportation or other
senior members of the Administration. FAA was a consumer, a customer of the
intelligence community. It never had a "collection" mission. It assessed the intelligence
it was provided, but did not gather such information. The intelligence the agency
received in the 1990s was tailored to situations in which U.S. civil airplanes might fly
over areas of conflict.

COMMISSION SENSITIVE
 COMMISSION SENSITIVE

Hijacking and Knives

(SSTJ Hijackings weren't a priority during his tenure nj/jOQl [because there were very few
of them. The protocol in the case of a hijacking was to appease the hijacker and divert
the plane. They didn't consider suicide hijacking a credible threat. The possible use of
knives in a hijacking raises the question of how one would prevent such an event from
happening, given the inability of the security equipment to detect such weapons.
Furthermore, pre-September 11, 2001 it was believed to be implausible hijackers
(unlikely to be suicidal) would use knives given the technology available at that time. It
was impossible to prevent someone from getting a knife on the plane. The prohibited
items list for airliners reflected items that were deemed "menacing" (presenting a clear
and obvious threat). That distinction represents the difference between a box cutter a
small knife (a tool) and a switchblade (menacing).

Dual Mandate

(Unc) Flynn indicated that he thought the so-called "dual mandate" did not affect him in
his role as head of civil aviation security. The first he heard of it was in 1996, and he was
not hampered by service or customer satisfaction issues. However, he was aware that his
"job was to secure aviation while it was operating."

(Unc) Flynn did not know what sort of relationship the airlines had with Congress. In
terms of getting FAA security directives implemented and adhered to at the airports, his
job required working relationships with the security directors (SDs) at each airport. They
often had backgrounds in the military, FBI, or other law enforcement, and had their own
information networks outside of the FAA's control. The SDs were often skeptical of the
FAA's role, and the sources of its information. In particular, their discussions with FBI
sources often left them "less than convinced" of the FAA's threat claims. Many of the
Security Directors came from the law enforcement community. They would check on the
threat claims by the FAA and their former colleague's would discount the threat which
hurt the FAA's credibility. The CEOs of the airlines did not take increased security
seriously, and resisted expensive implementations. His office's relations with the airlines
were "hard all the time." Possibly because of the sanitized nature of the threat
information they were given, the airlines did not appreciate the need to increase security.
Flynn said the airlines considered civil penalties for infraction/violations of FAA
directives as "a cost of doing business." Going public would have been one way for the
FAA to get the airlines to sit up and take notice of its security regulations, but doing so
would have, in some respects, been drawing a roadmap for the terrorist.

(Unc) Flynn said many of the CEO's treated security as a joke. Flynn recounted a 1994
meeting with CEO Crandall of American Airlines in which Crandall discounted the
domestic threat because there had been no domestic hijackings since the system was
improved in the early 1990s: "Give us a reason to do it (increase security) and we will."
Flynn believed that in response to specific events like the Bojinka plot, the airlines did so
and "were terrific." In general, according to Flynn, there was always a difference in the

COMMISSION SENSITIVE
 COMMISSION SENSITIVE

airlines reactions to the requested security actions internationally versus domestically,

with greater receptivity to the former.

(Unc) Flynn indicated that the airlines approach to security varied widely. He cited
Tower Airlines, which ultimately went broke, as a carrier which approached security very
seriously and used that as a selling point to customers. He also singled out United
Airlines under Soliday for its conscientious approach to security.

(Unc) Flynn discussed the tension between the FAA's oversight role and its need to
imbue the security structure with the appropriate degree of randomness and mystery.

(Unc) Flynn described the FAA rulemaking process as "hideous and deliberately slow."
He pointed out that at least going back to 1990, aviation security laws specified that FAA
actions were to be done through the rulemaking process. In some of those statutes, like
the one concerning EDS deployment, there was language to keep the FAA from taking
security-related actions. OMB also would push back on cost-effectiveness grounds, with
its resistance to checked baggage screening requirements given as the example.

ACS Defense vectors

Intelligence

fSSi) Flynn said that the granular nature and frequency of the intelligence reports
received from CIA on overseas threats was an asset to the system./

spite of Flynn's repeated requests for more information from the Bureau and other law
enforcement agencies. Flynn characterized the information on domestic threats as
"wooly." 19/11
/Classified
Prescreening i Information

Checkpoint Screening

f) Flynn believes that while the quality of the x-ray machines has improved,
affordable, effective technology is not there. Flynn also raised the issue of screener

COMMISSION SENSITIVE
 COMMISSION SENSITIVE

complacency (the human factor). He conceded that identifying lEDs is hard, no matter
how alert or trained the screener. As for needed improvements, he cited full deployment
of TIP, improved training of the screeners and supervisors, and a career track that aims at
having individuals do screening for two to three years only (comparable to the Israelis'
system of airport security for Tel Aviv).

Airport Access

9/11 Classified Information

9/11 Classified Information

jTo combat all of these
areas of vulnerability, Flynn said that state and local authorities need to get involved.

Cargo

9/11 Classified Information |

He said it would require research and development grants to find an effective screening
device. In the mean time, providing the airlines subsidies to not carry questionable cargo
is the best alternative.

Red Teams

Flynn said that red team testing was made "easy" because it would help the FAA to
obtain a civil penalty against the airline if the failure were obvious and glaring. Flynn
stressed the usefulness of civil penalties as an enforcement hammer.

With respect to the reduction of civil penalties against air carriers, Flynn said those
negotiations were conducted counsel and counsel and that he had no role.

Flynn reported that he had to work to save the Federal Air Marshals Program in
1993-1994 over the opposition of the FBI and the DOD.

NORAD/USAF

He reported that there was no routinized practice with NORAD, nor was there an
established line of communication with the military during his time at FAA. He did say

COMMISSION SENSITIVE
 COMMISSION SENSITIVE

that the air traffic controllers, many of whom are from the air force, may have had
established relations with NORAD/ USAF.

Observations and Recommendations

(Unc) Flynn believes that for civil aviation security to be effective there has to be a high
probability of detecting lEDs and potential terrorists within a system managing a high
volume of air traffic, people, interacting elements, and also the high visibility of the
system's operations. Without increased spending on operations, the aviation industry
would never get there. Today, investment is far below what is necessary. The United
States, which owns 40 percent of the world's aviation, spends $18 billion a year,
compared to the Israelis, who spend $10 billion a year at Tel Aviv alone.

(Unc) He questioned the government and the American public's commitment to sustain
spending for aviation security over "the long haul," That is the only way to break the
reactive pattern of the aviation security system. Flynn believes that more congressional
hearings on aviation security should be closed in order to be as forthright and direct as
possible on the realities of the system without revealing such to the public at large.

(Unc) With respect to September 11,2001, Flynn stated, "we're not going to be able to
stop the pros" (referring to terrorists). Rather, the civil aviation security system can make
them do "extraordinary things" to try to defeat the system, and such actions should be
visible to the intelligence community. He believes that the September 11th hijackers did
in fact do "extraordinary things" which were seen by the intelligence community.
J9/11
(Unc) Flynn was asked for his recommendations for improving the current civil aviation /^Classified
security system and he responded with the following: .;; Information

1) "Throw money" at technology and research and development. He reported that R and
D investment in aviation security has actually gone down since September 11th and is
"way below where it needs to be."

4) "Do something about airport lobbies."

5) Address, through a national plan, the threat of shoulder-fired missiles.r

COMMISSION SENSITIVE
 COMMISSION SENSITIVE

6) Address the chemical threat (biological threat not as likely for civil aviation because of
time factor).

(Unc) Flynn urged the Commission to avoid retroactivity/ perfect hindsight in its
conclusions. He added "we are not telling people it is dangerous to fly." He stated that
the Commission's willingness to say so would be a test of its integrity. He believes such
failures have vitiated previous efforts to enhance security. He believes the public needs to
be told how to protect itself (for example; that no checked bags would be permitted when
at the orange alert level).

[Unc] Flynn agreed that it would be important for Congress to hold more closed hearings
so they could fully understand the threat, and that the Commission could give impetus to
this effort.

(NOTE: The following text was taken from e-mail forwarded by Irish Flynn to the
Commission in November, 2003 to supplement the record of his personal interview)

Further thoughts. (Following September 9 discussions with the staff of the National
Commission on Terrorist Attacks.)

Chemical Agents. |

9/11 Classified Information

Air Marshals. I mentioned that our objective in screening passengers and baggage was to
achieve an adequately high probability of detecting lED's and weapons, and that a facade
of screening just for deterrence sake was unlikely actually to deter in the long run. The
Air Marshal program, on the other hand, was designed for deterrence. We knew it was
most improbable that air marshals, given their small numbers, would actually be aboard
any aircraft being hijacked, but the program's intent was to give the impression that there
were many more marshals - and hence much greater coverage.

In that vein, it may be worth considering that scores (perhaps hundreds) of armed law
enforcement officers flew daily on domestic routes. This permitted "carriage of weapons"
provision had many associated problems, but a marginal benefit was that those law
enforcement officers were (presumably still are) authorized to use their weapons in order
to save lives.

"Setting the Boundaries". Toward the end of the meeting, we asked ourselves how the
boundaries of the aviation security program should be set. In other words, which

COMMISSION SENSITIVE
 COMMISSION SENSITIVE

elements of air transport should be very well protected, which should be protected less
effectively, and which not at all? I'm afraid my answers were less than adequate, so I
would like to try again, using security of air cargo as an example.

It is a bit strange that the 2001 Aviation and Transportation Security Act was more
explicit about the security requirements for cargo carried on all-cargo flights than it was
about cargo on passenger flights (about which one would have expected more precise
definition of expectations). It appears from the text, however, that the ATS A accepted
"known shipper" as an adequate measure for securing cargo carried on passenger flights.

It is nevertheless hard to argue with Representatives Shays's and Markey's contention

that air cargo should be screened as closely as checked baggage, if the cargo is to be
carried on passenger airliners. A bomb in cargo would be just as lethal as one in a
checked bag. But their Congressional opponents (and Admiral Loy) are also correct when
they say there isn't yet an effective (single) technology to screen all the cargo. So, with
the defeat of the Shays-Markey initiative, we apparently have agreement between the
Congress and Executive that reliance on a known shipper regime will be sufficient for an
indefinite period. Thus has a boundary been set. It has not been a rigorous process, and it
leaves, in my opinion, excessive and unnecessary risk.

A salient weakness of "known shipper" is the near impossibility of establishing the

trustworthiness of the many thousand employees (of shippers, indirect air carriers and
their contractors, and air carriers) who have both access to the cargo and the ability to
know accurately when it will be in flight on passenger airliners (so they can set the
detonation timer-altimeters). Until there is a reliable way of checking those employees,
merely "knowing" the shippers (and also the lAC's and carriers) as reputable business
entities will be an inadequate safeguard. Criminal history checks of the employees, even
if they were universally implemented, would be ineffective (because the terrorist
organizations would then select the prospective insiders from members who have clean
records). On the other hand, the FBI, assuming that it knows with reasonable confidence
the identity, organization, and operational characteristics of the terrorist groups of interest
to us (i.e., those who would attack US interests here) may be able to define an effective
background check: one that would check the employee for associations of concern. It is
likely be an expensive, time-consuming background investigation, but it might be
effective in keeping dangerous persons out of positions where they could lethally place
lED's in air cargo. Without it, "known shipper" is clearly unreliable, and cargo should
either be secured by other means or diverted from passenger flights. So effective
trustworthiness tests for employees (to make the "known shipper" regime valid), and
diversion of the cargo from passenger flights, are alternative boundaries worth
considering. But if neither is deemed practicable, a combination of screening and
diversion might be an acceptable and valid alternative.

Some cargo can be screened easily. Most arrives at the airport in fairly small boxes, not
yet on pallets or in large containers (unit load devices), and thus does not require the $10
million (+) container and pallet screening machines (which do not yet exist outside
laboratories) mentioned by Admiral Loy.

COMMISSION SENSITIVE 10
 COMMISSION SENSITIVE

• Many boxes (for example, those containing flowers or un-canned food) can be
screened effectively with inexpensive transmission x-ray machines.
• Other types of boxed cargo can be screened with the EDS (CT) machines now
used to screen checked baggage.
• Some dense materials, impenetrable by x-rays, might be opened and screened
with explosives trace detectors.
• If the shippers are willing to tolerate a delayed delivery, boxes that can't be
screened, as well as containers and pallets, could be held for the time of flight
and cycled in an altitude chamber. (El Al has such chambers at many of its
stations.)
• The remaining unscreened cargo would have to be diverted from passenger
flights.
• Much of the screening might be accomplished without additional labor cost,
because checkpoint and checked baggage screeners, now conspicuously
underemployed for hours every day, could be bussed across the airport to the
cargo terminals, to put in 2, 3, or more hours screening cargo, during the lulls
in passenger and baggage screening.

The point is not that this process is ideal, but that something like it could have been the
point of departure for an economic and effectiveness analysis of where to place the cargo
boundary. Instead, the argument was posed as of course it can and must be done (the
Shays-Markey position) versus it can't be done, because it would require 10 million
dollar screening machines (Admiral Loy's contention) or because it would kill the
airlines (the ATA's assertion). In fact, such studies had been performed by the FAA
Security R&D service, but it seems they had slight effect in the recent debate on the
Shays-Markey initiative.

It also seems to me that the Commission's staff would find it difficult to set the
boundaries of defense on all the vectors of possible (or likely) attack. The Commission
would serve the public well by acknowledging that difficulty, and further by telling the
public that, because so many vectors are inadequately defended, flying will remain
dangerous as long as al-Qaeda (or any similarly determined terrorists) are able to operate
in the United States.

COMMISSION SENSITIVE 11