Search Results

Search Results for ‘satcom’

720

The Mysterious Reboot, Part 3

Two weeks ago, I wrote a couple of posts about the strange reboot of MH370’s satcom system that occurred shortly after the plane disappeared from primary radar, and asked if anyone could come up with a reasonable explanation. I drew attention in particular to the left AC bus, which the satcom equipment is connected to. This bus can be electrically isolated using controls located in the cockpit, and this appears to be the only way to recycle the satcom without leaving the flight deck. I suggested that there might be some other piece of equipment that the perpetrator wanted to turn off and on again by using the left AC bus, thereby causing the satcom to be recycled as an unintended side effect.

The readers rose to the occasion. Gysbreght pointed out that paragraph 1.11.2 of Factual Information states that “The SSCVR [Solid State Cockpit Voice Recorder] operates any time power is available on the Left AC transfer bus. This bus is not powered from batteries or the Ram Air Turbine (RAT).”

This is an incredibly interesting observation. Reader Oz fleshed out Gysbreght’s insight, writing to me via email:

We could isolate the Left Main AC by selecting the generator control switch to OFF and the Bus Tie switches to OFF; SATCOM is now dead.  What else happens……….the Backup generator kicks in automatically to supply the Left Transfer bus. Here’s what’s so spine chilling; if you now simply reach up and select the Backup Generator switch to OFF………..you now lose Left transfer as well.  The CVR is gone!  I couldn’t believe how easy the CVR was to isolate!
To recap;
Left Gen Control to OFF
Bus Ties to OFF (Isolate)
Left Backup Gen to OFF.
I now firmly believe your mystery reboot was Left AC power being switched back ON……….. after something that had occurred that the perp or perps didn’t want any possible evidence of on the CVR……whatever was being hidden was done by around 1822; AC back to normal.

Gysbreght notes that the Factual Information also identifies the location of the CVR as Electronic Equipment Rack, E7, in the aft cabin above the ceiling, and suggests: “Later [the perp] could have opened Electronic Equipment Rack E7, physically pulled the SSCVR power supply plug from its socket, and then gone back to the MEC to restore power to the Left AC bus.”

Oz has his own theory: “If you are thinking why the hell you would turn Left AC/Left transfer back on? Flight deck temperature control comes from these…”

There’s a precedent for a suicidal airline pilot depowering the black boxes before flying a plane into the ocean: the pilot of Silkair Flight 185 appears to have done just that before pointing the nose down and crashing in December, 1997. It’s easy to imagine Zaharie reading the accident reports and realizing he should also figure out a way to disable the CVR before implementing his suicide plan. When the moment came, near IGARI, one can imagine the veteran 777 pilot suddenly flipping various switches while the baffled newbie, Fariq, looked on.

It’s certainly an intriguing scenario, but it is not without its flaws. As Gysbreght notes, “I would expect the Captain to know that the CVR only retains the last two hours and overwrites older recordings.” So if Zaharie planned to commit suicide by flying the plane for hours into the remotest reaches of the southern ocean, he wouldn’t have needed to turn the CVR off: the portion between 17:07 and 18:25 would have been erased anyway. This is not in insurmountable problem, however. Maybe he orginally intended to crash right away, a la Silkair, but then lost his nerve.

I’m not quite ready to declare, as Gysbreght has, “Case closed,” but I have to admit that the CVR idea is fascinating. Great work, Gysbreght and Oz!

291

The Mysterious Reboot, Part 2

The discussion prompted by last week’s blog post raised some interesting issues that I think are worth discussing in further detail.

First, I wrote last week that “At 18:22, MH370 vanished from primary radar coverage over the Malacca Strait. Three minutes later—about the amount of time it takes the Satellite Data Unit (SDU) to reboot—the satcom system connected with Inmarsat satellite 3F-1 over the Indian Ocean and inititated a logon at 18:25:27.”

Commenter LouVilla earlier today laid out the issue with more clarity, writing:

MH370 flew out of radar range @18:22.12 UTC. All of a sudden @18:25.27 UTC, the AES sent an Login-Request to the satellite. This are 03:15 Minutes between this two events. When the AES is without power supply for a while and reboots after power is available again the AES needs approximately 02:40 Minutes to sent an Login Request (ATSB Report Page 33). 03:15 minus ~ 02:40 = ~ 35 seconds. So, the perpetrator must activated the left bus again at around 18:22.47 UTC, 35 seconds after MH370 flew out of radar range.

The close sequence of these events does, in my mind, raise the possiblity that they are connected. How would a perpetrator know that he has left radar coverage? Among the possibilites would be a) some kind of radar-energy detector (like that used by automobile speed-trap radar detectors) brought on board by the perpetrators, or b)  prior scouting by allied agents. This latter idea would be far fetched for a suicidal pilot but quite feasible for, say, Russia, which spends quite a lot of time probing the radar coverage of its NATO neighbors.

Of course the timing might just be a coincidence.

A second point I’d like to address is the idea that Zaharie or Fariq might have de-powered the satcom by isolating the left AC bus. One problem with this scenario, as I’ve previously mentioned, is that it would be difficult for a pilot to know just what else they would be taking off line in isolating the left AC bus. I later realized that I had underestimated the problem.

Read the rest of this entry »

194

The Mysterious Reboot

A member of staff at satellite communications company Inmarsat works in front of a screen showing subscribers using their service throughout the world, at their headquarters in LondonIn yesterday’s post I argued that the reboot of MH370’s satellite communications system at 18:25 is a key piece of evidence about what happened to the missing plane. In fact, I would go so far as to say that we should discount any scenario which cannot explain the reboot.

That being the case, I thought it would be a good idea to clarify what we do know about rebooting the satcom and discuss the implications. Right up front I’d like to emphasize that I am by no means an electronics expert and I welcome any corrections or clarifications.

First, some basic background for those who might be new to the discussion. Flight MH370 took off from Kuala Lumpur International airport at 16:42 UTC on 3/7/14 bound for Beijing. At 17:07:29, the plane sent an ACARS report via its satcom. At 17:20:36, five seconds after passing waypoint IGARI and a minute after the last radio transmission, the transponder shut off. For the next hour, MH370 was electronically dark. The next ACARS transmission, scheduled for 17:37, did not take place. At 18:03 Inmarsat attempted to forward an ACARS text message and received no response, suggesting that the satcom system was turned off or otherwise out of service. At 18:22, MH370 vanished from primary radar coverage over the Malacca Strait. Three minutes later—about the amount of time it takes the Satellite Data Unit (SDU) to reboot—the satcom system connected with Inmarsat satellite 3F-1 over the Indian Ocean and inititated a logon at 18:25:27.

The question is, by what mechanisms could MH370’s satcom have become inactive, then active again?

Read the rest of this entry »

88

Only Three Options Remain for MH370’s Fate

Until fairly recently, the default assumption about MH370 is that, based on the interpretation of satcom signals recorded by Inmarsat, the plane made a final turn to the left sometime after 18:25 UTC and flew south on autopilot before running out of fuel. This default scenario, sometimes referred to as the “ghost ship” scenario, was endorsed by both the ATSB and the Independent Group.

However, if the plane flew south in this manner and ran out of fuel, it would have been found by now, as Brock McEwen explained here recently. It was not found. Therefore the default scenario is incorrect: the plane did not make a final turn and fly straight to the south without human intervention.

At this point, only three possible scenarios still make sense for MH370:

  1. As was first mooted in the June ATSB report, the plane lingered near Sumatra before flying straight or took a curving path to the south. In either case, the plane wound up intersecting the 7th arc somewhere north of Broken Ridge, beyond the current search area.
  2. The plane flew straight south after a final major turn, then was hand-flown by a conscious pilot on a long glide that took it far from the 7th arc, beyond the current search area.
  3. The plane did not go south at all. If this is the case, then the satellite communications system must have been compromised by hijackers who either flew the plane north to Kazakhstan or China (if only the BFO values were spoofed) or somewhere else within a huge circle encompassed by the 7th ping ring (if both BTO and BFO values were spoofed).

Each of these options has unpalatable aspects, but they’re all we’ve got.

I would argue that these unpleasant choices can be further subdivided into two categories: inside the cockpit, or outside the cockpit. By “inside the cockpit,” I mean that the airplane was controlled from the flight deck, presumably by either the captain or the first officer; by “outside the cockpit,” I mean that hijackers managed to seize control of the plane either by accessing the E/E bay or hacking in through the inflight entertainment system. The reason I feel we can make this assertion is that only one minute elapsed between the captain calmly saying “Good night Malaysia 370” and the diversion at IGARI. It’s scarcely imaginable that hijackers would have time to breach the fortified cockpit door, overcome the flight crew, and reprogram the flight management system in such a short time. So whoever took the plane had to be either on one side of the door or the other.

The first two of our three options would fall under the category of “inside the cockpit.” They present a number of difficulties: Read the rest of this entry »

454

Guest Post: Northern Routes and Burst Frequency Offset for MH370

by Victor Iannello

Note: Ever since the idea of spoofing was first discussed, one of the main issues has been how falsified BFO values might have been calculated. Most of assumed that the values were arbitrarily selected to suggest a flight in a generally southward direction. Here, Victor Iannello presents an ingenious suggestion: that hijackers might have altered a single parameter in the Satellite Data Unit frequency precompensation algorithm. — JW

Notice: The views expressed here are solely mine and do not representthe views of the Independent Group (IG), Jeff Wise, or any other group or individual. — VI

Summary

In previous work, paths were reconstructed for MH370 using the available radar and satellite data. Paths to the north of Malaysia were studied bymatching the measured Burst Timing Offset (BTO) data, but relaxing the constraint of matching theBurst Frequency Offset (BFO), which is appropriate if the BFOdata waseithercorrupted or misinterpreted. It was found that there are paths to the north that end at airports that could be reached with the fuel that was loaded onto MH370.In this work, the conventional interpretation of the BFO is challenged. In particular, the possibility that the operation of the SATCOM was deliberately modified so that a northern path would have the BFO signature of a southern path is studied. Some of the findings are:

  • The Honeywell Thales MCS-6000 SATCOM used by MH370 hasafrequencycorrection algorithm withthe capability to correct for the Doppler shift caused by inclination of thesatellite. This is known to the official investigation team butis not generally known by independent researchers.
  • The value of inclination for the Inmarsat I3F1 satellite that was broadcast by the Ground Earth Station (GES) at Perth, Australia, to be used by SATCOMs logged into the satellite, was zero. The true inclination of the satellite was around 1.65⁰. The two parameters that describe the satellite inclination, the inclination angle and the time of the ascending node, are stored in the System Table of the SATCOM in non-volatile memory, and are used by the frequency compensation algorithm.
  • If an individual obtained unauthorized access to the non-volatile memory of the SATCOM, the value of the inclination used by the frequency correction algorithm could be changed from 0 to 3.3⁰, or about twice the true inclination of the satellite. With this change, the BFO signature of a northern path that satisfied the BTO data would resemble the BFO signature of a southern path that satisfied the BTO data.
  • The apparent turn to the south between 18:28 and 18:40 UTC that is suggested by the measured BFO data might have been caused by a change to the inclination parameters stored in the SATCOM’s System Table during that time interval.
  • The calculated values of BFO for northern paths with the inclination parameter changed to 3.3⁰match the measured BFO values with an RMS error less than 3.8 Hz. This is true for Mach numbers between 0.65 and 0.85 at FL350, with little variationin errorseen in this speed range.
  • At each log-on, the inclination parameters would be reset to zero. Therefore, the BFO data associated with the log-ons at 18:25 and 00:19 UTC should be evaluated with inclination parameters set to zero. The BFO data at times between these log-ons should be evaluated with the possibility that a change was made.
  • The BFO value at 00:19 matches an aircraft along the northern part of the 7tharc on the ground and stationary once the BFO is adjusted for the log-on offset seen at 16:00 UTC. This suggests that if MH370flew north, it might havesuccessfully landed.
  • Researchers have identified security vulnerabilities in other SATCOMs, including backdoors and access to memory, although the MCS-6000 has not been specifically studied. The possibility of “spoofing” the BFO to disguise location has been considered before.

Read the whole report here.

1283

New York: How Crazy Am I to Think I Actually Know Where That Malaysia Airlines Plane Is?

The unsettling oddness was there from the first moment, on March 8, when Malaysia Airlines announced that a plane from Kuala Lumpur bound for Beijing, Flight 370, had disappeared over the South China Sea in the middle of the night. There had been no bad weather, no distress call, no wreckage, no eyewitness accounts of a fireball in the sky—just a plane that said good-bye to one air-traffic controller and, two minutes later, failed to say hello to the next. And the crash, if it was a crash, got stranger from there.

My yearlong detour to Planet MH370 began two days later, when I got an email from an editor at Slate asking if I’d write about the incident. I’m a private pilot and science writer, and I wrote about the last big mysterious crash, of Air France 447 in 2009. My story ran on the 12th. The following morning, I was invited to go on CNN. Soon, I was on-air up to six times a day as part of its nonstop MH370 coverage.

There was no intro course on how to be a cable-news expert. The Town Car would show up to take me to the studio, I’d sign in with reception, a guest-greeter would take me to makeup, I’d hang out in the greenroom, the sound guy would rig me with a mike and an earpiece, a producer would lead me onto the set, I’d plug in and sit in the seat, a producer would tell me what camera to look at during the introduction, we’d come back from break, the anchor would read the introduction to the story and then ask me a question or maybe two, I’d answer, then we’d go to break, I would unplug, wipe off my makeup, and take the car 43 blocks back uptown. Then a couple of hours later, I’d do it again. I was spending 18 hours a day doing six minutes of talking.

Read the rest of this entry »

635

Guest Post: Why Did MH370 Log Back on with Inmarsat?

[Editor’s note: One of the most intriguing clues in the MH370 mystery is the fact that the airplane’s satcom system logged back on to the Inmarsat network at 18:25. By understanding how such an event could take place, we can significantly narrow the range of possible narratives. In the interest of getting everyone on the same page in understanding this event, I’ve asked Mike Exner for permission to post the content of a detailed comment he recently provided.  One piece of background: a lot of us have been referring to the satellite communications system aboard the aircraft as the “SDU,” but as Mike recently pointed out in another comment, it technically should be called the “AES.” — JW.]

Until we have more evidence to support the theory that the loss of AES communications was due to the loss of primary power to the AES, we must keep an open mind. Loss of power may be the most likely cause (simplest explanation), but the fact is we do not know why the sat link was down between 17:37 and 18:25. My reluctance to jump to the conclusion that it must have been due to the loss of primary AES power is based on decades of experience in the MSS (mobile satellite service) industry. It’s not just another opinion based on convenience to support a theory. Let me elaborate on a few possible alternative explanations.

Read the rest of this entry »

449

Occam’s Razor is Overrated

conspiracy theoryMartin Dolan, chief commissioner of the Australian Transport Safety Bureau (ATSB), is plagued by conspiracy theorists. According to an article in the Sydney Morning Herald, since the disappearance of MH370, “conspiracy theorists have been busy trying to solve the mystery themselves. Many have contacted Dolan.”

“You’ve got this big mystery and everyone wants to know the answer and everyone wants to help,” the SMH quotes Dolan as saying. “It’s unhelpful, for the sake of the families more than anything else, in the sense that it has the potential to undermine confidence in what we are doing.”

I feel somewhat guilty for being one of those peanut-gallery denizens who have tormented him. Along with my fellow obsessives in the Independent Group, I’ve been straining my brain for the last eight months trying to make sense of the strangest aviation mystery in history. Yes, I’d like to be helpful; yes, I’d like to know the answers. And yes, I may have unwittingly undermined confidence in what the ATSB was doing, for instance by publicly saying that I thought they were looking in the wrong place. (Though, to be fair, they were in fact looking in the wrong place.)

Nevertheless, I must take issue with one aspect of the article’s characterization of my subculture: the use of the term “conspiracy theorist.” Now, look: I get it. My wife says that I remind her of the Kevin Costner character in “JFK.” I ruminate about the intracacies of a famous case and try to piece them together in a new way that makes more sense. I’m obsessed.

There’s a big difference, however, between true grassy-knoll conspiracy theorists (or 9/11Truthers, or the-moon-landing-was-faked believers) and MH370 obsessives like me. It’s this: there is no default, mainstream narrative about the missing Malaysian airliner. There is no story that officials and all reasonable people agree makes sense.

This isn’t the result of laziness or incompetence. It’s just that the data is so strange.

A lot of people don’t get that. Ever since the mystery began, certain voices have been invoking the principle of Occam’s razor, saying that when we try to formulate a most likely scenario for what happened to the plane, we should choose the answer that is simplest. People who are making this argument are usually in favor of the argument that the plane suffered a massive mechanical failure and then flew off into the ocean as a ghost ship, or that the pilot locked his co-pilot out of the cockpit and committed suicide. However, as I’ve argued over the course of several earlier posts, neither theory matches what we know about the flight.

Instead, I’ve argued that an accumulation of evidence suggests that MH370 was commandeered by hijackers who had a very sophisticated understanding of airline procedure, air traffic control, avionics systems, military radar surveillance, and satellite communications. In other words, what happened on the night of March 7/8 of this year was a intentional act. And when it comes to human schemes, Occam’s razor goes out the window. Instead of simplicity, we should expect complexity, not to mention red herrings and any other form of subterfuge.

Whenever I hear Occam’s razor invoked, I inevitably find myself thinking of something that Sarah Bajc said on CNN. Bajc’s partner, Philip Wood, is one of the missing passengers, and she has been very open minded in considering alternative explanations to what happened that night. “There are 40 crazy stories that you could tell about MH370,” she told the anchor. “And one of them is going to turn out to be true.”

I’ve come to think of this as the Bajc Postulate, which I think should replace Occam’s Razor in situations like this. It goes like this: “When trying to unravel human deception, don’t expect simplicity.”

Read the rest of this entry »

0

The Spoof, Part 3: Where (Not a Speculative Scenario)

For nearly nine months, authorities in Malaysia and Australia have stood firmly by the assertion that after MH370 vanished from radar screens in the early morning of March 8, it flew south into the Indian Ocean. The only evidence for this conclusion is an analysis of electronic transmissions sent from the plane to an Inmarsat communications satellite. No wreckage was spotted in the likely impact zone during an aerial search made 10 days after the disappearance. No debris has washed ashore, though marine-current experts say it should have by now. And an ongoing search of the seabed has found nothing in the area where experts believe the plane most likely should have wound up.

I believe that this persistent lack of physical evidence seriously undermines the theory that MH370 flew south.

In the last two sections, I’ve shown how a team of very sophisticated hijackers could theoretically take a certain kind of plane, outfitted with a certain kind of equipment and flying in a certain region of the world, and make it seem to disappear. MH370 fit all the necessary criteria, but there’s no way to know for sure that that’s what happened, so I laid out the technical details in the form of a couple of speculative scenarios. Now, I’d like to revert to straight up-and-down factual reporting.

As I’ve described in earlier posts on my blog, everything we know about the last six hours of MH370 comes from seven electronic handshakes, or “pings,” exchanged between the plane and an Inmarsat satellite and recorded at Inmarsat headquarters. The only reason that we have these pings is that, three minutes after the plane sped out of the radar coverage zone over the Malacca Strait, the satcom system came back online. Though not everyone agrees with me, I’ve argued that this can only be understood as a deliberate, sophisticated act.

These handshakes contain no data as such. Because Malaysia Airlines subscribes to the cheapest level of Inmarsat service, Classic Aero, Inmarsat did not automatically record the plane’s location each time it communicated with the satellite. But certain characteristics of the signals themselves provide clues about where the plane was located and where it was headed.

The first is the frequency at which the signals were received. Called the “Burst Frequency Offset,” or BFO, these data are the result of multiple causes, including the relative motion of the satellite and the plane and a precompensation algorithm that satellite data unit (SDU) on the plane applies before transmission. For this reason, the BFO only provides only a very rough indication of where the plane went: in the case of MH370, it suggests a fan of possible tracks to the south/southeast, winding up in the southern Indian Ocean somewhere off the western Coast of Australia. It was this implication that led Malaysian prime minister Najib Razak to declare on March 25 that the plane must have been lost.

The second important characteristic of the signals is the time that it took for them to travel from the plane, then for the data to be processed by the SDU, and then for the signal to return to the satellite. This so-called “Burst Timing Offset,” or BTO, value provides investigators a much more accurate notion of how the plane was travelling than the frequency values were. From them its possible to calculate a series of so-called “ping ring” arcs along which the plane must have been located at each time in question. As it happens, while it would be difficult but physically possible to falsify BFO values, it is very hard to image how BTO values could be tampered with.

Not every piece of data that a satellite transmission generates gets logged. It’s extremely important for a satellite communications company to know the exact frequencies at which transmissions are sent and received, so it has always been standard practice across the industry to record these values. The timing data, in contrast, is not very important, and in general it is not recorded. However, after the disappearance of AF447, Inmarsat recognized the BTO data could be useful in future such cases and quietly began logging it.

If hijackers took MH370, it’s likely that they didn’t realize that the BTO values were being stored. If they managed the technically difficult feat of spoofing the plane’s BFO values, they likely believed that that information was the only clue that they were leaving accident investigators would find. And the only thing that investigators would be able to deduce would be that the plane followed one of a defined fan of routes heading into the remotest and most inhospitable ocean in the world. This clue, by itself, is so vague that the odds of ever locating the plane’s wreckage would seem hopeless.

Indeed, having figured out how to hack the BFO values, and not knowing that the BTO values were being recorded as well, there would be little incentive for a hijacker to worry about spoofing the BFO values with any great precision. It would be enough to create numbers that followed a general trend. And indeed, it turns out that the BFO data does not provide a particularly good fit to the corresponding BTO data. The timing data indicates the the plane flew quickly on a very nearly due-south heading; the frequency data suggests a slower or more meandering course that wound up further to the north and east. The ATSB has spent months trying to reconcile flights that make sense from both perspectives, so far without success. Instead they have settled on defining two search areas, each of which best fits a different data set, and searching them both.

Fortunately, it turns out that we can ignore the BFO data and still determine quite a lot about how MH370 traveled, just by looking at the BTO values and a few other sources of information.

First of all, we have the radar data recorded as MH370 was heading westward after turning from its planned route to Beijing. The whole time it was moving at a speed in excess of 500 knots; taking winds aloft into account, this translates into an airspeed of about 495 knots. This is somewhat faster than most airliners usually fly, and indicates that whoever was in control was in a hurry.

From the BTO data we can tell that a few minutes after the plane disappeared from radar, it turned and started flying either south in the Indian Ocean or north towards India. Either way, the BTO offers clues at how fast it traveled. A method I’ve described previously shows that the plane during the later portion of the flight was traveling at a steadily decreasing speed. If it went north, that speed would have corresponded to about 480 knots between 20:41 Greenwich Mean Time and 21:41, 460 knots between 21:41 and 22:41, and 420 knots between 22:41 and 0:11.

This is as we would expect: the further north the plane flies, the colder the air becomes, and the more adverse the headwinds. The plane also becomes lighter as it burns fuel, and this in turn reduces the speed that the autpilot will calculate as most efficient. Indeed, given the very strong jetstream winds that occurred that night over the Himalayas, if MH370’s autopilot were set to a constant Mach number or to a calculated speed setting like Long Range Cruise (LRC) then MH370 should have flown even more slowly than these calculations indicate. This suggests that instead the plane’s autothrust was most likely set to ECON, a mode which automatically compensates for headwinds. At any rate, it was traveling quite a bit faster than airliners usually do.

The only segment that we don’t have an average speed for is the interval between its disappearance from radar at 18:22 and the third handshake ping at 20:40. As we’ve seen, we should expect that as the plane travels north, a variety of factors will cause its ground speed to steadily decrease. From about 18:00 to 18:22, it was travelling at 504 knots; after 20:41, it was travelling at 480, then 460, then 420 knots. Therefore, as a rough guesstimate, I assume that that MH370 kept flying at the same speed and heading from 18:22 to 18:30, then turned north and traveled at an average ground speed of around 495 knots until the second handshake at 19:41, then at an average speed of about 490 knots until the third handshake at 20:41.

It’s straightforward to draw a straight line on Google Earth that intersects the ping rings at pretty near exactly these speeds. It’s orange line here:

MH370 North

Don’t get too caught up in the assumptions I’ve just made about the speeds between 18:22 and 20:41. The fact is that you can try different routes north that match different speeds during that interval, and they all wind up looking pretty similar.

As depicted, MH370 would have passed over the Andaman Islands about half an hour after disappearing from Malaysian radar. The islands belong to India, which maintains a radar station there. So why didn’t it pick up MH370? The answer, apparently, is that the radar is only turned on when a crisis is looming, which wasn’t the case on March 8. “We operate on an ‘as required’ basis,” the chief of staff of India’s Andamans and Nicobar Command told Reuters.

From there, MH370’s straight-line track would have taken it over Gorakhpur, India, and then on into Nepalese airspace. Nepal is a small, poor country, with no urgent concerns about aerial attack from India; radar coverage is most likely nonexistent. Ahead, however, would have lain some of the most disputed territory on earth. India and Pakistan have been in a state of semi-war over disputed Kashmir for more than half a century. India painstakingly monitors its border with Pakistan and frequently intercepts civilian aircraft that stray into its airspace without having processed the proper paperwork.

Likewise, China and India have been rivals since time immemorial, and fought a border war in 1962. In the months before MH370 disappeared, China had unilaterally declared control of airspace over disputed islands claimed by Japan, and has aggressively intercepted aircraft attempting to enter it.

To pass over any of these disputed areas, or to penetrate Chinese airspace, would be to invite detection and interception. But the ping-ring data suggests that MH370 didn’t fly over any of them. Instead, a straight-line course that begins near the plane’s last known location and intersects the ping-arcs at the correct speeds will pass over the borders between these countries. The route matches the strategy that the hijackers used earlier in the flight, diverting the plane at the boundary between Malaysian and Vietnamese control, then skirting the border of Thailand and Malaysia.

Steve Pearson, an avionics and mission systems engineer at the Royal Air Force Warfare Center, told me that traveling along the boundaries between two air-control zones, called FIRs, can be a way to avoid drawing attention. Back when he was an RAF navigator, he would take advantage of this dynamic to slip through airspace where he wasn’t supposed to be: “When we used to go to other parts of the world, you could fly down FIR boundaries, and each side thought you were in the other one’s control. You could fly right down the boundary and no one would talk to you. It’s something we didn’t do very often, I must admit, but it’s something you can do.”

When the next handshake occurred at 22:40, MH370 would have been nearing the eastern tip of Afghanistan’s Wakhan Corridor, the narrow strip of land that was devised by 19th century mapmakers as a buffer between the British and Russian empires. From here, the distance to the final full handshake at 0:11 indicates that the plane either slowed down or, more likely, made a slight course correction to the left (marked in yellow below) to more closely match the border between Tajikstan and China.

MH370 North Closeup

And then, half an hour later, the plane would have crossed into Kyrgyzstan. From here, its path no longer cleaved to international borders, but cut right through the intermeshed territories of the “Stans”: after Kyrgyzstan, Uzbekistan and then Kazakhstan. Now the mountains would have been falling away and yielding to the vastness of the Central Asia, flat and dry, much of it grazing pasture and desert.

At 0:11, above the arid expanse of Kazakhstan’s Qizilqum desert, the plane would have exchanged its final full handshake. And then, at 0:19, came a final burst of radio-frequency signal that many have interpreted as the SDU rebooting after the plane’s engines ran out of fuel. MH370’s fuel reserves certainly would have been very, very low at this point. But I think it is possible that the “half-handshake” at 0:19 might have been a result not of fuel exhaustion but of the plane’s hijackers somehow reconfiguring its communication and/or navigation system in preparation for landing.

At the time of this half-handshake, MH370 would have been 30 nautical miles due east of the city of Kyzlorda. There are not many places in Kazakhstan that are suitable for landing a stolen 777, and even fewer within immediate range of this spot. There is one, however, that stands out.

Directly ahead, just a few minutes’ flying time away, would have lain a 56-mile-wide oval territory: the Baikonur Cosmodrome, shown above in purple. From here Yuri Gagarin became the first man to reach orbit; it currently stands as the only launch facility by which Americans can reach space. Though it lies inside the borders of Kazakhstan, it is leased by Russia and functions as autonomous territory — a sort of Kremlin-controlled Guantanamo on the steppe, selected by the USSR at the dawn of the space age for its wide-open spaces and remote location.

Near the center of the oval lies a historically significant called airstrip called Yubileyniy, the Russian word for “Jubilee.” Nearly 15,000 feet long, it was built in the 70s as the landing site for the Buran space plane, the Soviet Union’s answer to the Space Shuttle. Constructed of special reinforced concrete twice as strong as that used in normal runways, and ground to exceptional flatness using special milling machines, Yubileyniy remains to my knowledge the only airstrip in the world that was built specifically for the use of self-landing aircraft. On November 15, 1988, after a successful three-hour trip in space, the unmanned Buran made its first and only landing at Yubileyniy, missing its landing mark by less than 50 feet. Soon after, the Soviet Union fell apart, and the project was cancelled. To this day, the area sits largely disused, far from the busy launch areas of Baikonur, surrounded by derelict buildings that haven’t been touched in decades.

Most large runways are located at airports near cities. Yubileyniy isn’t. And the fact that it was designed for a self-landing airplane is particularly intriguing given that hijackers with the skill set to commandeer an airplane likely wouldn’t have an airline pilot’s certificate as well. In that case, MH370 would have to have landed itself. The Boeing 777 flight management system is able to fly what’s known as an Instrument Landing System Category III “autoland” approach. Essentially, once the necessary information is plugged into the system, the plane is able to fly itself to any suitably equipped runway, with or without a trained pilot is at the helm. “You can do a full autoland without touching the controls,” says 777 captain Richard Solan. “Set the autobrakes to max, and you’ll stop within 2000 or 3000 feet.”

In order to get as far as Kyzylorda, MH370 would have to have “step-climbed” gradually during the flight to higher, more fuel efficient altitudes; given its expected weight at 0:19, it should have been at about 41,000 feet. From here, a normal descent would take 26 minutes and cover 137 nautical miles. In order to reach Yubileyniy, it would have continued on its current heading, then turned left after 105 nautical miles to line up for a straight in approach on Yubileniy’s runway 24. This would have been appropriate, as the wind at the time at Yubileyniy was out of the west.

If this is indeed the course that MH370 took, and its fuel reserves held out all the way to touchdown, then the stolen plane woud have come to a stop on the reinforced concrete-and-asphalt runway of the Yubileyney aerodrome at approximately 6:50am local time, an hour and a quarter before sunrise on March 8, 2014.

So let me back up and run through the logic chain as I see it:

  • If the continued lack of MH370 wreckage in the southern Indian Ocean leads us to conclude that its isn’t there, then the plane must have gone north instead.
  • If the plane went north, then the BFO values must be incorrect.
  • If the BFO values are incorrect, it can only be because they were deliberately tampered with.
  • To tamper with the BFO values would require an almost inconceivable degree of sophistication.
  • If the plane flew north at anything like normal airliner speeds, it ended up in southern Kazakhstan.

This last fact is important when it comes to understanding who took MH370 and why, as I’ll explain in the next section.

NEXT:
The Spoof, Part 4: Motive

BACK TO:

The Spoof, Part 2: How (A Speculative Scenario)

0

The Spoof, Part 2: How (A Speculative Scenario)

March 8, 2014. 12.15am. Kuala Lumpur, Malaysia. A line of passengers shuffles down the aisle to their seats, subdued and sleepy. It’s late, and the flight is due to arrive in Beijing at practically the break of dawn. Most of the passengers are Chinese, with a sizable number of Malaysians and Indonesians and a smattering of Indians, Europeans, Australians, New Zealanders, and Americans. Here, for the next six hours, they will be pressed together in the forced comaraderie of late-capitalistic travel drudgery. No one loves taking a redeye.

It appears to be an utterly mundane example of a ritual that plays out tens of thousands times a day in airports on every continent. But if one were aware of the subtlest psychological ripples that can emanate from subconcious gestures, one’s attention would drawn to three of the passengers in particular.

The first sits in business class, the highest level of service on this flight. A quick-eyed, broad-shouldered man, mid-40s, not tall but physically imposing all the same. He wears a strange half-smile. You can see from his carry on bag that he is an avid recreational scuba diver, on his way back from a club trip exploring the coral reefs of Southeast Asia. His bag contains a swim mask, a snorkel, and a pair of poney tanks. Only if one were preternaturally perceptive would one notice that the bag also contains not one but three regulators, and they are not of the conventional type. He settles into a window seat and puts the bag on the empty seat beside him. He unzips a pocket, takes out one of the regulators, and stuffs it into the seat pocket in front of him.

Two taller men, about the same age, are coming through down the aisle past his seat. Both are well-muscled and carry themselves with the self-confidence of men who prize their physicality. One is shorter and broader; the other has the lanky physique of an elite basketball player. As they pass the first man’s seat, they take no notice of him, but the blond one lifts up the bag with the scuba tank and carries it with him. The quick-eyed man doesn’t seem to notice, and neither does anyone else.

It’s nearly half past midnight when the doors close. The passengers fasten their seat belts, the flight attendants mime along to the safety video, the plane rolls along the taxiway. If there’s a virtue to traveling when most people are already asleep, it’s that there are few delays. Right on schedule, the plane lines up on runway 32R, the engines spool up, and the 777-200ER is airborne, heading north and climbing through the equatorial night.

The lights of Kuala Lumpur glitter below, then fall away. Only a few strings of scattered lights mark the small cities and towns of the Malayan peninsula, the darker black of the Malacca Strait to the west. Turning as it climbs, the plane eases to wings level and heads northeast.

Throughout the cabin, passengers sprawl in the abandon of sleep, mouths hanging open, heads pressed against window shades or into balled-up pillows. But the quick-eyed man sits upright and alert. Over Taman Negara, Malaysia’s largest national park, the plane reaches its assigned cruise altitude, 35,000 feet. Up in the cockpit, the pilot turns off the seatbelt sign and tells the flight attendants that they can begin their beverage service.

The flight attendants move through the business class cabin taking orders. The quick-eyed man politely declines. He waits until they have begun to bring out the food and drink, then pulls his regulator from the seat pocket and moves toward the forward lavatory. Seeing that the galley is clear, he kneels and pulls back a patch of carpet to reveal a hatch with a recessed handle. He opens it, scoots down, and lowers the hatch smoothly above his head. A moment later, a flight attendant comes back to fetch a fresh pot of coffee and sees the carpet askew. Huh, that’s weird, she thinks, and puts it back.

Down below, the quick-eyed man flips on a light and finds himself inside a compartment lined with metal boxes, flashing lights, indicators. This is the electronics and equipment bay, or E/E bay. Kneeling, he unshoulders his pack with graceful efficiency. He’s trained this sequence of events hundreds of times. With a couple of patch cords the intruder plugs into the bank of computers and begins uploading software. While that’s running, he starts pulling circuit breakers and cuts the ARINC cable coming out of the Inertial Reference System (IRS). A hundred feet away, in the rear of the plane, the Honeywell/Thales MCS6000 Satellite Data Unit (SDU) goes into standby mode.

In the cockpit, all seems normal. Starting to feel a little sleepy, the captain rings the flight attendant and asks for coffee. At twenty past one, the plane approaches the edge of Malaysia’s air traffic control zone. Lumpur Radar calls MH370 and informs it that it should switch radio frequencies and call up the controller handling the next zone they are about to enter, Ho Chi Minh. The flight crew’s response: “Goodnight, Malaysia 370.”

Now the plane is in a kind of operational no-man’s-land, a limbo between one control area and the next. For the next three to five minutes, no one on the ground is responsible for MH370. And even if they were looking for it, the plane happens to be occupying an area over the middle of the South China Sea that’s far enough from land that surveillance coverage often falters. Standard operating procedure is to assume the plane is where it should be. In the past, that’s always been a safe bet. But tonight is not going to be different.

The pilot is staring out into the dark of the night sky, mind wandering, when all of a sudden he feels a sensation he doesn’t expect. The plane is tilting to one side. It’s banking, making a turn for the left. Instinctively, he glances to the right, to see if the junior pilot has decided to play some kind of wildly inappropriate prank. But the copilot just looks back at him, eyes wide. The control yokes aren’t moving, but the plane is unquestionably making a turn.

The pilot’s never seen anything like it. He’s accumulated thousands of hours, done countless runs in training simulators, he even has a recreational flight sim rig set up in his basement, and he’s never encountered anything like it. It’s like the plane has a mind of its own. He grabs the yoke, it’s like a dead thing in his hands, inert. He feels the tendrils of panic spreading as he grabs a checklist and starts running through it. The more he tries, the more bizarre it gets. Nothing works as it should. Switches are dead, readouts blank, indicators flashing gibberish. Is the flight computer having some kind of weird meltdown?

Then: pandemonium. An alarm klaxon sounds. Cabin atmosphere is low and falling. A hull rupture? The sounds of screaming in the cabin filter through the cockpit door. The captain and co-pilot reach for their masks, but no air seems to be flowing. What the hell is going on? Nothing’s working. The copilot dials up the emergency frequency, 121.5. Nothing. He punches in the frequency for Lumpur Radio. Nothing. The sat phone is dead, too. All of it. They’ve been cut off. The air in the cockpit is noticeably thing, the captain feels like he’s sucking air. One idea desperately forms: the E/E bay. Something must be wrong in the E/E bay. He rises, stumbles, throws open the cockpit door. Two burly men wearing breathing apparatus block the way. He falls to his knees and passes out.

Behind him, the copilot realizes too late what is happening. It all feels surreal, impossible, like a nightmare he can’t wake up out of. His vision is swimming. He knows that without oxygen he’s got just seconds before he’s going to pass out. Frantically, he reaches into his pocket, fishes out his phone, and sends a text, a single four-digit number: 7500. The transponder code for hijack. He’s unconscious before he hits the ground.

Now the hijackers have complete control of the plane.

Because its transponder, radios and satcom have been disabled, the plane is invisible to air traffic controllers. But is not entirely invisible. As it completes its 180-degree left hand turn and heads back toward the Malay Peninsula, it is within range of both Malaysian and Thai radar operators. But it is late at night, and no one has attempted a hostile air incursion in decades. Scratch that: no one has attempted a hostile air incursion in the history of the Malaysian nation. There no jets ready to scramble. What’s more, the blip that makes its way across the air force radar screens is straddling the border between the two countries. Malaysian military radar operators assume it’s under Thai control; Thai military radar operators assume it’s under Malaysian controls. Neither side does anything.

In the E/E bay, the quick-eyed man still has plenty of work to do. Reaching into his tool kit, he takes out two end connectors and attaches them to each end of the severed ARINC cable. Then he removes a small black box from his bag and plugs both ends of the ARINC cable.

He climbs out of the hole, glances at the ghastly scene in the cabin, and then hurries forward to join the other two men in the cockpit. Taking the left-hand seat, he punches a set of coordinates into the Flight Management Computer. They’re almost directly over Butterfield Air Force Base, there’s nothing the Malaysian military can do. The plane is rigged to run fast, faster than its normal cruise speed, and even if they were on high alert, which of course they aren’t, they’d have no chance of catching them before they left Malaysian airspace anyway.

Just then he notices a cell phone lying on the floor of the cockpit. It’s turned on, trying to put through a text message. The quick-eyed man curses. Too late: the phone has connected, briefly, with a cell tower far below. Fortunately, the connection wasn’t strong enough for the text to go through. A close call.

The men watch the symbol of their plane move across the satnav map. They’re heading straight over the middle of the Strait of Malacca, one of the busiest shipping channels in the world, an ancient nexus between the teeming basin of the Indian Ocean and the great expanse of the Pacific, but at this hour, at this altitude, they are alone. With a tailwind behind them, they’re moving at nearly 600 mph. The silence on the plane is eerie, with the thicket of oxygen masks dangling limp and motionless in the half-light remind the quick-eyed man of a sunken forest he once swam among under the midwinter ice of a frozen lake.

The men know they are under surveillance; invisible beams from multiple radar installations are painting them many times a minute. But part of carrying out an operation like this is understanding not just what your enemies are technically capable of doing, but getting inside their heads, understanding their protocols and their psychology and traditions, to understand what they will actually do. And they know the Malaysian Air Force well. Their country supplies them with fighter jets. They know exactly what Malaysian military radar operators will be doing on a Friday night. This is what they believe: that their progress across the sky is being recorded, but no human being is actually paying attention and noticing. That’s fine. A recorded performance will suit their present needs just fine. When the investigators begin their search in the light of morning, they will start looking just where they should.

At twenty past two, they approach a navigational waypoint, an invisible marker in the sky called MEKAR. They are 270 miles northwest of Penang, and at the limit of military coverage. They are home free, now. With the radios turned off, the transponder silent, and the satcom shut down, there is no way for anyone in the world to know where they are. They have vanished.

The time has come for the genius touch. The quick-eyed man climbs back down into the electronics bay and flips a switch on the black box. It ends its electronic silence and begins streaming position and location information through the ARINC cable to the SDU installed above the ceiling of the cabin near the rear exit. To a human observer, the information would seem like gibberish: a physically impossible combination of values that would have the plane speeding in one direction but winding up in another. But the SDU doesn’t care. It slurps up this strange mishmash of numbers and churns out the numerical results that allow it to aim the satellite antenna located directly above it on the upper skin of the aircraft. It also subtly shifts, by a few parts per billion, the frequency that it will use to communicate with the satellite above.

Atop the plane, separated from the cold, 600-mph slipstream by the thin skin of its housing, the high-gain antenna whirs into action, skewing toward satellite Inmarsat-3F1, 26,000 miles above. In a burst of radio-frequency energy, it requests a logon to the Inmarsat system, receives confirmation, and then sits ready. Flight MH370 is once again in contact with the outside world. The thread is as tenuous as one can imagine, but it is there, and days from now, when an Inmarsat engineer thinks to look for it in the company’s logs of recorded transmissions, he will be astonished to find that he has to sole clue to the fate of the missing plane.

It will be so subtle, so arcane a hint, that the man and his colleagues will congratulate themselves for their brilliance in finding the clue and discerning its meaning. It will be literally inconceivable to them that another group of men have achieved the even greater stroke of brilliance of planting that clue for them to find.

The magician Teller has pointed out a quirk of human psychology that is crucial to the art of stage deception: “When a magician lets you notice something on your own, his lie becomes impenetrable.”

Five minutes later, 90 miles past MEKAR, the quick-eyed man enters a new waypoint into the flight management computer. The plane banks to the right, settles into a gentle turn, then levels out again. Ahead lies the Andaman Islands, and beyond the coast of India and the great delta of the Ganges River.

Meanwhile, on the ground, in that great sprawling network of interconected humanity that is the international the air traffic control system, doubts are growing. Failing to find MH370 on his radar scope when expected, a controller near Saigon will radio the plane and ask for its status. Hearing nothing, he will call his counterparts at Lumpur Radar. A daisy chain of increasingly worried telephone calls begins.

At 2:40am, Malaysian ground operations calls the plane to find out what is going on. A signal is routed through a ground station in Western Australia, up into space, and back down to MH370’s data unit. But because the black box’s spoofed data doesn’t allow the antenna to line up quite correctly, the signal strength is too weak for the calls to go through. Something more important is accomplished, however. The frequency of the SDU’s transmissions will tell Inmarsat engineers who examine the logs that the plane turned south and was heading out into the open ocean.

On the ground, the urgency and tempo of the phone calls increases. Meanwhile, in the darkness, the plane that was once flight MH370 is slipping further and further north, high and fast. Hour after hour it recedes from its phantom twin, the imaginary electronic phantom of itself, which appears to be receding into the vague expanse of the southern Indian Ocean as the Inmarsat system automatically checks in to make sure the plane is still there and logged on: 3:41am, 4:41am, 5:41am. The plan, elaborate and complicated as it is, has gone exactly as planned. The quick-eyed man is less than a thousand miles from his destination.

Unbenownst to him, however, a flaw has opened up in the plan. While Inmarsat’s computers have been recording the frequency of the signals as expected, they have also been recording another parameter, one that few outside the company realize that Inmarsat keeps. These data points will give their own, contradictory picture of where the plane is going—not slow or meandering, as the BFO numbers will suggest, but straight and fast. And this, in turn, will provide the only tangible clue that the disappearance of MH370 was a carefully plotted hack.

THE NEXT INSTALLMENT:
The Spoof, Part 3: Where (Not A Speculative Scenario)

BACK TO:

The Spoof, Part 1: Why (A Speculative Scenario)