Guest Post: Northern Routes and Burst Frequency Offset for MH370

by Victor Iannello

Note: Ever since the idea of spoofing was first discussed, one of the main issues has been how falsified BFO values might have been calculated. Most of assumed that the values were arbitrarily selected to suggest a flight in a generally southward direction. Here, Victor Iannello presents an ingenious suggestion: that hijackers might have altered a single parameter in the Satellite Data Unit frequency precompensation algorithm. — JW

Notice: The views expressed here are solely mine and do not representthe views of the Independent Group (IG), Jeff Wise, or any other group or individual. — VI

Summary

In previous work, paths were reconstructed for MH370 using the available radar and satellite data. Paths to the north of Malaysia were studied bymatching the measured Burst Timing Offset (BTO) data, but relaxing the constraint of matching theBurst Frequency Offset (BFO), which is appropriate if the BFOdata waseithercorrupted or misinterpreted. It was found that there are paths to the north that end at airports that could be reached with the fuel that was loaded onto MH370.In this work, the conventional interpretation of the BFO is challenged. In particular, the possibility that the operation of the SATCOM was deliberately modified so that a northern path would have the BFO signature of a southern path is studied. Some of the findings are:

• The Honeywell Thales MCS-6000 SATCOM used by MH370 hasafrequencycorrection algorithm withthe capability to correct for the Doppler shift caused by inclination of thesatellite. This is known to the official investigation team butis not generally known by independent researchers.
• The value of inclination for the Inmarsat I3F1 satellite that was broadcast by the Ground Earth Station (GES) at Perth, Australia, to be used by SATCOMs logged into the satellite, was zero. The true inclination of the satellite was around 1.65⁰. The two parameters that describe the satellite inclination, the inclination angle and the time of the ascending node, are stored in the System Table of the SATCOM in non-volatile memory, and are used by the frequency compensation algorithm.
• If an individual obtained unauthorized access to the non-volatile memory of the SATCOM, the value of the inclination used by the frequency correction algorithm could be changed from 0 to 3.3⁰, or about twice the true inclination of the satellite. With this change, the BFO signature of a northern path that satisfied the BTO data would resemble the BFO signature of a southern path that satisfied the BTO data.
• The apparent turn to the south between 18:28 and 18:40 UTC that is suggested by the measured BFO data might have been caused by a change to the inclination parameters stored in the SATCOM’s System Table during that time interval.
• The calculated values of BFO for northern paths with the inclination parameter changed to 3.3⁰match the measured BFO values with an RMS error less than 3.8 Hz. This is true for Mach numbers between 0.65 and 0.85 at FL350, with little variationin errorseen in this speed range.
• At each log-on, the inclination parameters would be reset to zero. Therefore, the BFO data associated with the log-ons at 18:25 and 00:19 UTC should be evaluated with inclination parameters set to zero. The BFO data at times between these log-ons should be evaluated with the possibility that a change was made.
• The BFO value at 00:19 matches an aircraft along the northern part of the 7tharc on the ground and stationary once the BFO is adjusted for the log-on offset seen at 16:00 UTC. This suggests that if MH370flew north, it might havesuccessfully landed.
• Researchers have identified security vulnerabilities in other SATCOMs, including backdoors and access to memory, although the MCS-6000 has not been specifically studied. The possibility of “spoofing” the BFO to disguise location has been considered before.

Read the whole report here.