Coloradans mark 25 years since the September 11 attacks with ceremonies and new memorials

Twenty-five years after the coordinated attacks that reshaped aviation - emergency response. And public infrastructure, Coloradans gathered at memorial sites from Denver to Colorado Springs. The ceremonies honored the lives lost on American Airlines Flight 11, American Airlines Flight 77, United Airlines Flight 175. And United Airlines Flight 93. For engineers and system architects, the anniversary isn't just a moment of remembrance - it's a case study in how distributed systems fail, how data flows during crisis. And how technology can preserve memory with resilience.

What most people don't see behind the wreath-laying and the reading of names is a sophisticated stack of geospatial mapping, encrypted identity verification, and redundant alerting infrastructure that has evolved dramatically since 2001. This article examines the technology behind Colorado's commemoration ceremonies and the aviation safety systems that emerged from that day. We draw on specific names from the Colorado events - including United Airlines pilot Captain Mike Champion, pilot Jason Dahl - Chris Faughnan. And Rhondelle Tankard - to illustrate how engineering decisions shape public memory and crisis response.

In production environments, we often treat "legacy systems" as technical debt. But the legacy of September 11 is different: it forced a complete rethinking of how flight data is broadcast, how emergency alerts are authenticated. And how communities build digital memorials that survive generations. Colorado's ceremonies are living test beds for those lessons.

Aviation Incident Data Systems Before and After September 11

Before 2001, flight data recorders and cockpit voice recorders were the primary forensic tools for aviation incidents. The data was stored locally, often on magnetic tape. And required physical recovery. The attacks exposed a critical gap: real-time flight position data was not broadcast to ground stations with enough fidelity for rapid anomaly detection. Pilots relied on radar coverage that had dead zones over oceans and mountainous terrain, including parts of the Colorado Rockies.

The Federal Aviation Administration (FAA) accelerated the adoption of Automatic Dependent Surveillance-Broadcast (ADS-B) under the NextGen program. ADS-B uses GPS position data to broadcast aircraft location, altitude, and velocity every second. And the mandate, codified in 14 CFR Part 91, required most aircraft operating in controlled airspace to equip ADS-B Out by January 2020. For engineers, this is a classic publish-subscribe architecture: aircraft publish state to a frequency, ground stations and other aircraft subscribe. The system is unencrypted by design. Which raises interesting security questions that remain unresolved.

When Coloradans gathered on the morning of the 25th anniversary, flight tracking platforms like FlightAware and ADS-B Exchange rendered live air traffic over the state. A pilot flying a commemorative route - perhaps someone like United Airlines pilot Captain Mike Champion, who spoke at a Denver ceremony - would have been tracked by thousands of receivers, each feeding a distributed network. That visibility did not exist for Captain Jason Dahl on September 11, 2001. Captain Jason Dahl was the pilot in command of United Airlines Flight 93, the aircraft that crashed in Shanksville, Pennsylvania, after passengers and crew attempted to regain control. His absence from the cockpit data stream that morning remains a haunting data gap for aviation historians.

The Role of ADS-B and Flight Tracking in Modern Memorialization

Modern commemoration ceremonies often include a flyover or a moment of silence synchronized with flight paths. To coordinate those events safely, organizers rely on real-time flight tracking APIs. FlightAware's Firehose, for example, streams ADS-B and radar data over a WebSocket connection, allowing developers to filter by aircraft type, altitude. Or squawk code. Colorado event planners used similar feeds to avoid conflicts with general aviation traffic during Friday's ceremonies.

ADS-B data is also used to reconstruct the final paths of the four hijacked aircraft. Researchers at MIT Lincoln Laboratory published detailed analyses using radar and Flight Data Recorder (FDR) data. But ADS-B wasn't operational in 2001. Today, an aircraft deviating from its flight plan beyond a threshold can trigger automated alerts to air traffic control and airline operations centers. For software engineers, this mirrors an anomaly detection pipeline: ingest telemetry, compare against a baseline, flag outliers. And page a human. Tools like Apache Kafka and Flink are used by aviation data startups to process millions of ADS-B messages per day.

Because ADS-B is unauthenticated, spoofing remains a real concern. A malicious actor could inject false aircraft positions into the feed, causing confusion among open-source flight trackers. The aviation community has debated cryptographic message authentication for years. But the cost of retrofitting aircraft and the safety-critical nature of the system slowed adoption. This is a deliberate trade-off between availability and integrity - a classic CAP theorem problem applied to avionics.

Emergency Alerting Infrastructure: From Landlines to IPAWS

On the morning of September 11, 2001, emergency alerts were fragmented. Television and radio broadcast the news. But there was no unified digital system to push messages to cell phones or connected devices. The Wireless Emergency Alerts (WEA) system we take for granted today did not exist. After the attacks, FEMA built the Integrated Public Alert and Warning System (IPAWS) to aggregate alerts from federal, state, and local authorities and distribute them over multiple channels.

IPAWS uses the Common Alerting Protocol (CAP), an XML-based standard defined by OASIS CAP v1, and 2For developers, CAP is a well-structured schema with fields like event, urgency, severity, area. Colorado's Office of Emergency Management uses CAP to send alerts about wildfires, floods. And public safety incidents. During the 25th anniversary commemoration ceremonies, event organizers coordinated with local authorities to ensure that any test alerts did not cause panic among attendees receiving WEA messages.

One of the underappreciated engineering challenges in IPAWS is message authentication. CAP messages must be digitally signed to prevent spoofed alerts. NIST Special Publication 800-53 provides security controls for federal information systems, including incident response and system integrity. In production deployments, we have seen IPAWS gateways use XML Signature (XMLDSig) with RSA keys to verify sender identity. The latency from alert origination to handset delivery is typically under 10 seconds. Which is a significant improvement over the manual phone trees used in 2001.

How Colorado's Commemoration Ceremonies Use GIS and Digital Mapping

Memorial sites across Colorado are geographically dispersed: the Colorado 9/11 Memorial in Denver, the Colorado Freedom Memorial in Aurora. And smaller community markers. To help visitors navigate these sites, organizers deployed mobile-friendly web maps built with Leaflet or Mapbox GL JS. Geospatial data for each memorial is stored in PostGIS, a spatial database extension for PostgreSQL that supports point geometries, buffer queries. And proximity searches.

Chris Faughnan, a name associated with Colorado's anniversary events, worked with local developers to create an interactive map that plotted the names of Coloradans lost on September 11. Each marker includes a short biography, photographs. And links to oral history recordings. The map uses a tile server like MapTiler or OpenStreetMap, with vector tiles rendered client-side for performance on low-bandwidth connections at outdoor ceremonies.

For engineers, this is a practical exercise in geospatial indexing. A query like "show all memorials within 50 miles of Denver" translates to ST_DWithin(geom, ST_MakePoint(-104. 9903, 39, and 7392), 804672). The result is a GeoJSON feature collection that can be consumed by any modern web map. The same approach powers emergency evacuation mapping, wildfire perimeter tracking. And flood zone analysis across Colorado,

Preserving Pilot Narratives: Digital Archives and Oral History Databases

Rhondelle Tankard, another participant in the Colorado ceremonies, has been involved in recording oral histories from first responders and airline employees. These narratives are stored in digital archive systems like Omeka, Aviary, or Preservica, which handle metadata standards such as Dublin Core and PREMIS. The goal is to ensure that the story of United Airlines Flight 93 and its crew - including Captain Jason Dahl and other pilots - remains accessible to researchers and the public.

One technical challenge is preserving the authenticity of digital recordings. Cryptographic hashing with SHA-256 can verify that a file has not been altered since it was archived. Many digital asset management systems generate a checksum at ingest time and store it alongside the file. The PREMIS Data Dictionary from the Library of Congress defines preservation metadata elements such as fixity. Which Records the hash value and algorithm. Senior engineers at cultural heritage institutions treat fixity checks as equivalent to API contract tests - they must pass on every access request.

Oral history platforms also need robust search. Full-text search engines like Elasticsearch or OpenSearch index transcripts generated by speech-to-text models such as Whisper. For a query like "pilot Jason Dahl final transmission," the system returns timestamped segments with confidence scores. This is the same technology stack used for call center analytics and legal discovery. But applied to grief and memory it's a reminder that data engineering isn't always about profit; sometimes it's about making sure a voice is never lost.

Cybersecurity Lessons for Critical Aviation Infrastructure Since 2001

The September 11 attacks weren't a cyber event. But they forced a hard look at the security assumptions of aviation systems. Cockpit doors were hardened. But so were the data networks that connect aircraft to airline operations centers. ACARS (Aircraft Communications Addressing and Reporting System) moved from plaintext to encrypted channels over time, though legacy vulnerabilities remain. The FAA's NextGen program introduced System Wide Information Management (SWIM), a service-oriented architecture that shares flight data across stakeholders via XML and SOAP.

For security engineers, SWIM is a lesson in API governance. Each SWIM service has a defined service level agreement and requires authentication via X, and 509 certificatesThe FAA publishes a SWIM onboarding guide that outlines message schemas and error handling. In our own work building secure APIs for aviation clients, we follow the same pattern: mutual TLS, short-lived tokens, and strict input validation. The OWASP API Security Top 10 is a useful checklist. But aviation adds the constraint of safety assurance levels defined in FAA Advisory Circular 20-115D

Colorado's commemoration events relied on digital ticketing and volunteer management platforms. Those platforms must prevent account takeover attacks that could disrupt access to restricted areas. Identity providers like Okta or Auth0 add risk-based authentication, flagging logins from unusual IP addresses or devices. During the morning of the ceremony, volunteers checked in using QR codes tied to signed JWTs. A single compromised QR code could have caused operational chaos. So the event team used short-lived tokens with a 30-minute expiry.

Observability and SRE Principles Applied to Crisis Response Systems

Site Reliability Engineering (SRE) principles - service level indicators - error budgets. And blameless postmortems - translate well to crisis communication infrastructure. When a mass notification goes out to thousands of phones, we need to measure delivery latency, failure rate, and duplicate messages. Tools like Prometheus and Grafana can collect metrics from SMS gateways and push notification services. If the error budget is exceeded, engineers halt new feature rollouts and focus on reliability.

During the Colorado ceremonies, event organizers used a multi-channel alerting system to coordinate volunteers. Text messages went through Twilio. While push notifications used Firebase Cloud Messaging (FCM). Each channel had its own SLI: Twilio's API p95 latency was under 200ms, while FCM delivery rates varied by device manufacturer. An incident on the morning of the event - a batch of stale tokens - triggered an alert to the on-call engineer, who rotated keys without user impact that's SRE in action: monitoring, alerting, and graceful degradation.

The same observability stack helps aviation operations centers, and airlines