MH370 Evidence Points to Sophisticated Hijackers

– November 7, 2014Posted in: Aviation
777 E:E Bay Access

The 777 E/E bay access hatch. Click for video.

 

Newly emerged details concerning Malaysia Airlines flight 370’s electrical system indicate that whoever took over the plane was technically sophisticated, possessing greater knowledge of Boeing 777 avionics than most commercial line pilots. They also suggest that the plane’s captain, Zaharie Ahmad Shah, was not responsible for taking the plane.

The new information comes via Michael Exner, a satellite industry veteran who has been one of the most prominent independent experts investigating the airliner’s disappearance. Several days ago Exner gained access to a major US airline’s professional-grade flight simulator facility, where he was able to run flight profiles accompanied by two veteran 777 pilots. “This is a state-of-the-art 777 simulator, level D, part of one of the most modern training facilities on earth,” Exner says.

A little background. As is well known, approximately forty minutes after its departure from Kuala Lumpur for Beijing, someone turned off all communications between MH370 and the outside world. Around the same time the plane turned sharply to the left and headed back over the Malayan Peninsula. Among the systems that were shut off were satellite communications; the transponder; and two automatic reporting systems, ACARS and ADS-B. The plane went dark just as it entered the space between two air-traffic control zones and was temporarily unmonitored, a sign that whoever planned the diversion wished to avoid detection and was well versed in international air traffic control procedures.

For approximately the next hour, MH370’s progress was visible only to military radar. The plane flew straight and fast between established navigational points, indicating that the aircraft had not suffered mechanical accident. At 18.22 UTC the plane was heading west out into the Indian Ocean when it passed out of range of military radar. At that point, the plane became effectively invisible. Shrouded in night, with approximately six hours’ fuel aboard, the plane could have reached any point within a 3000-mile radius and no one on the ground would have been any wiser. But it did not stay dark. Less than a minute later, MH370’s satellite communications system was switched back on.

Over the span of several minutes, between 18.25 and 18.28, the Satellite Data Unit (SDU) transmitted a flurry of brief electronic messages with Inmarsat satellite 3F-1, which occupies a geosynchronous orbit above the Indian Ocean. In a report issued this June, the Australian Transport Safety Board stated that the signals were “generated as part of a Log-on sequence after the terminal has likely been power cycled.”

Until now, it has not been publicly known how such a power-cycling could have taken place.

At the simulator facility, Exner reports, he was able to confirm “that there is no way to turn off the primary power to the satcom from the cockpit. It is not even described in the flight manuals. The only way to do is to find an obscure circuit breaker in the equipment bay [i.e. the Electronic and Equipment bay, or E/E bay, is the airplane’s main electronic nerve center].” Both of the pilots accompanying him told Exner that “pilots are not trained to know that detail.”

Why the satellite communications system was turned back on is unknown. The system was never used; no outgoing telephone calls were placed, no text messages were sent, and two inbound calls from Malaysia Airlines to the plane went unanswered. Aproximately every hour for the next six hours, however, a geostationary communications satellite sent electronic handshake signals, and the SDU aboard the plane responded, confirming that the system was still active and logged on. Though the signals contained no messages per se, the frequency at which they were sent, and the time it took to send and receive them, have been used to determine the plane’s probable direction of travel.

The fact that the SDU was turned back on provides a window into the circumstances of the hijack. For one thing, since the SDU integrates information from other parts of the plane’s computer system, we know that the plane’s electronics were substantially functional, and perhaps entirely so. Second, the fact that the perpetrator (or perpetrators) knew how to access this compartment and how to toggle the correct switches suggests a high degree of technical sophistication.

Further evidence of the hijacker’s sophistication comes from the fact that they also managed to turn of the ACARS reporting system. This is can be done from the cockpit, but only by those with specialized knowledge. “Disabling it is no simple thing,” Emirates Airline CEO Tim Clark told Der Spiegel recently, “and our pilots are not trained to do so.”

For all its importance, the 777 E/E bay is surprisingly accessible to members of the flying public. The hatch, generally left unlocked, is set in the floor at the front of the first class cabin, near the galley and the lavatories. You can see a video of a pilot accessing the E/E bay inflight here. (In Airbus jets, the hatch is located on the far side of the locked cockpit door.) Once inside, an intruder would have immediate physical access to the computer systems that control communication, navigation, and flight surfaces. A device called a Portable Maintenance Access Terminal allows ground crew to plug into the computer system to test systems and upload software.

The security implications of leaving the plane’s nerve-center freely accessible have not gone unnoticed. Matt Wuillemin, an Australian former 777 pilot, wrote a master’s thesis on the vulnerability in June 2013 and submitted it various industry groups in the hope of spurring action, such as the installation of locks. In his thesis, Wuillemin notes that in addition to the Flight Control Computers, the E/E bay also houses the oxygen cylinders that supply the flight crews’ masks in case of a depressurization event and the controls for the system that locks the flight deck door. “Information is publicly available online describing the cockpit defences and systems located within this compartment,” Wuillemin notes. “This hatch may therefore be accessible inflight to a knowledgeable and malevolent passenger with catastrophic consequences.”

Wuillemin reports that, among others, he sent his thesis to Emirates’ Tim Clark. A vice president for engineering at Emirates responded that the airline did not perceive the hatch to be a security risk, since the area is monitored by cabin crew and surveillance cameras. Wuillemin notes that cabin crew are often called away to duty elsewhere, and that the surveillance cameras are only routinely monitored when someone is seeking entry to the cockpit; he adds:

Emirates considered the possible requirement for crew to access the area should there be a ‘small’ in-flight fire. Research indicated there is no procedure, checklist or protocol (manufacturer, regulator or operator) to support this latter position. In fact, Emirates Operations manuals (at that time) specifically prohibited crew accessing this area in flight. Emirates amended the Operations manual recently and re-phrased the section to ‘enter only in an emergency’.

The fact that someone must have entered the E/E bay during MH370’s disappearance diminishes the likelihood of one of the more popular MH370 theories: that the captain barred himself in the cockpit before absconding with the plane. Even if he locked the copilot on the far side of the door and depressurized the cabin to incapacitate everyone aboard, emergency oxygen masks would have deployed and provided those in the cabin with enough air to prevent Zaharie from leaving the cockpit before the next ACARS message was scheduled to be sent at 17:37, 18 minutes after the flight crew sent its last transmission, “Goodnight, Malaysia 370” at 17:19.

It’s conceivable that Zaharie could have acted in advance by leaving the cockpit, descending into the E/E bay, pulling the circuit breakers on the satcom system and then returning to the cockpit to lock himself in before making the final radio call and diverting the plane to the west, depressurizing the cabin, and waiting until everyone was dead before returning to the E/E bay to turn the SDU back on. But if his goal was to maintain radio silence he could have achieved the same effect much more simply by using cockpit to controls to deselect the SDU without turning it off.

As it happens, Wuillemin’s efforts to draw attention to the potential hazards afforded by unlocked E/E bay hatches proved too little, too late. MH370 went missing just two months after he submitted his work to the Australian government.