The CU Crisis Playbook for Leaders

This section sets out an emergency protocol for senior decision-makers confronting airborne anomalies over military installations. It provides a structured framework for action during the first hours of an event, when the identity, intent, and significance of the object remain uncertain and the situation is still evolving.

Drawing on crisis-management practices from defense, public health, and critical infrastructure, the playbook replaces the legacy defaults of “ignore,” “classify,” or “call a press conference” with a deliberate response sequence built around four capabilities:

1. Proper Situation Classification: A taxonomy of event types (from routine airspace anomalies to multi-domain events) to determine the response posture within minutes.

2. Streamlined Contact Protocols: A clear inter-agency hierarchy among the Federal Aviation Administration (FAA), Department of Homeland Security (DHS), Department of Defense (DoD), All-domain Anomaly Resolution Office (AARO), state emergency management, scientific advisors, and media communication chains.

3. Decision-Trap Awareness: Structural workflow checks to counteract cognitive vulnerabilities like premature closure ("it's just drones"), authority bias, availability bias, and anchoring.

4. Appropriate and Graduated Response Options: A tiered menu of proportionate actions, spanning enhanced passive monitoring to physical intercept, backed by pre-identified legal authorities and escalation criteria.

The institutional investments that make these response options possible, including sensors, protocols, research funding, and public-trust infrastructure, are the subject of Part IV: An Action Agenda for New Unknowns.

Classify the Situation

The first task is to set a response posture within minutes, before anyone can say what the object is. Classification is therefore keyed to what can be observed immediately, where the object is, how it is behaving, and how long it persists, rather than to a resolved identity. A workable scheme runs in four tiers as seen in Table 5 below.

Table 5. Situation classifications to set a response posture before identity is known.

Posture rises or falls as evidence accumulates. What matters is that the event enters a defined tier at once, rather than waiting on an identification that may never arrive.

Work the Contact Chain

Even as an event may fail to cross any single agency's¹Footnote 11 Such as but not limited to FAA, DHS, FBI, DoD, and state emergency management. threshold for a credible threat, a seam of inter-agency communications, decision-making, and authority-handover must be held, with means for escalation depending on severity. Having a contact chain in advance can settle uncertainty over who and how to hold the liminal area between agencies. Three elements should be fixed before an event rather than during one:

• A designated Incident Commander for each tier and location, so that "who is in charge?" has an answer at minute one.

• A notification order naming which agencies are called, in what sequence, and with what authority: the FAA and the air-defense element (NORAD) first, then DHS, FBI, AARO²Footnote 22 Or a contemporaneous, authoritative anomaly-focused organization. , and state emergency management, with scientific advisors and a public-affairs lead brought in as the tier warrants.

• A single Joint Information Center authorized to speak, so that one account reaches the public rather than competing statements that can drive mis-information cascades. A classified-to-unclassified bridge should run alongside it, so the people who need to act are not blocked by the classification of what is known.

Guard Against Decision Traps

Ambiguity under time pressure is the exact condition in which judgment degrades, and the usual failure is a premature collapse of uncertainty in one direction or the other.³Footnote 33 In December 2024, a "no threat" reassurance and an "Iranian mothership" rumor were the same error pointed opposite ways. A short set of checks counters the most common traps:

• Premature closure: the urge to call an event "resolved" simply to end the discomfort of not knowing. Counter: require an explicit set of ranked hypotheses (the H1-H5 hypothesis space), and treat "unresolved" as an honest, reportable state rather than a failure.

• Anchoring: the first explanation offered tends to dominate everything after it. Counter: generate competing explanations before settling on any one.

• Authority bias: deferring to the most senior voice instead of the evidence. Counter: keep the assessment of evidence separate from the rank of the person making it.

• Availability bias: over-weighting the most recent or most vivid event. Counter: reason from base rates, not from the last drone wave.

Match the Response to the Threat

Response should rise and fall with the situation tier, and each step should be authorized in advance rather than improvised.⁴Footnote 44 Part III: Respond & Explain documents what happens when escalation is left to improvisation at the community level: observation gives way to interception, and then to undesired effects such as civilians lasing commercial aircraft. The institutional version is deliberate and proportionate. A graduated ladder runs roughly as shown in Table 6 below.

Table 6. Graduated Response Ladder showing proportionate actions that can be pre-authorized.

Two requirements make the ladder safe to use. Every rung needs a named authority settled before the event, because the unresolved question of who may authorize engagement over the homeland is exactly the gap that produces either hesitation or overreaction in the moment. And the ladder needs explicit de-escalation criteria, not only escalation criteria, so a posture can stand down as cleanly as it was raised. Skipping rungs under pressure is the failure mode, so the menu exists to prevent it.

Taken together, these four moves are the acute-phase complement to The Confronting Unknowns Framework: the framework is how to make sense of an event, and the playbook is how to hold a response together while that sensemaking is still underway.