MH370 Evidence Points to Sophisticated Hijackers

777 E:E Bay Access
The 777 E/E bay access hatch. Click for video.

 

Newly emerged details concerning Malaysia Airlines flight 370’s electrical system indicate that whoever took over the plane was technically sophisticated, possessing greater knowledge of Boeing 777 avionics than most commercial line pilots. They also suggest that the plane’s captain, Zaharie Ahmad Shah, was not responsible for taking the plane.

The new information comes via Michael Exner, a satellite industry veteran who has been one of the most prominent independent experts investigating the airliner’s disappearance. Several days ago Exner gained access to a major US airline’s professional-grade flight simulator facility, where he was able to run flight profiles accompanied by two veteran 777 pilots. “This is a state-of-the-art 777 simulator, level D, part of one of the most modern training facilities on earth,” Exner says.

A little background. As is well known, approximately forty minutes after its departure from Kuala Lumpur for Beijing, someone turned off all communications between MH370 and the outside world. Around the same time the plane turned sharply to the left and headed back over the Malayan Peninsula. Among the systems that were shut off were satellite communications; the transponder; and two automatic reporting systems, ACARS and ADS-B. The plane went dark just as it entered the space between two air-traffic control zones and was temporarily unmonitored, a sign that whoever planned the diversion wished to avoid detection and was well versed in international air traffic control procedures.

For approximately the next hour, MH370’s progress was visible only to military radar. The plane flew straight and fast between established navigational points, indicating that the aircraft had not suffered mechanical accident. At 18.22 UTC the plane was heading west out into the Indian Ocean when it passed out of range of military radar. At that point, the plane became effectively invisible. Shrouded in night, with approximately six hours’ fuel aboard, the plane could have reached any point within a 3000-mile radius and no one on the ground would have been any wiser. But it did not stay dark. Less than a minute later, MH370’s satellite communications system was switched back on.

Over the span of several minutes, between 18.25 and 18.28, the Satellite Data Unit (SDU) transmitted a flurry of brief electronic messages with Inmarsat satellite 3F-1, which occupies a geosynchronous orbit above the Indian Ocean. In a report issued this June, the Australian Transport Safety Board stated that the signals were “generated as part of a Log-on sequence after the terminal has likely been power cycled.”

Until now, it has not been publicly known how such a power-cycling could have taken place.

At the simulator facility, Exner reports, he was able to confirm “that there is no way to turn off the primary power to the satcom from the cockpit. It is not even described in the flight manuals. The only way to do is to find an obscure circuit breaker in the equipment bay [i.e. the Electronic and Equipment bay, or E/E bay, is the airplane’s main electronic nerve center].” Both of the pilots accompanying him told Exner that “pilots are not trained to know that detail.”

Why the satellite communications system was turned back on is unknown. The system was never used; no outgoing telephone calls were placed, no text messages were sent, and two inbound calls from Malaysia Airlines to the plane went unanswered. Aproximately every hour for the next six hours, however, a geostationary communications satellite sent electronic handshake signals, and the SDU aboard the plane responded, confirming that the system was still active and logged on. Though the signals contained no messages per se, the frequency at which they were sent, and the time it took to send and receive them, have been used to determine the plane’s probable direction of travel.

The fact that the SDU was turned back on provides a window into the circumstances of the hijack. For one thing, since the SDU integrates information from other parts of the plane’s computer system, we know that the plane’s electronics were substantially functional, and perhaps entirely so. Second, the fact that the perpetrator (or perpetrators) knew how to access this compartment and how to toggle the correct switches suggests a high degree of technical sophistication.

Further evidence of the hijacker’s sophistication comes from the fact that they also managed to turn of the ACARS reporting system. This is can be done from the cockpit, but only by those with specialized knowledge. “Disabling it is no simple thing,” Emirates Airline CEO Tim Clark told Der Spiegel recently, “and our pilots are not trained to do so.”

For all its importance, the 777 E/E bay is surprisingly accessible to members of the flying public. The hatch, generally left unlocked, is set in the floor at the front of the first class cabin, near the galley and the lavatories. You can see a video of a pilot accessing the E/E bay inflight here. (In Airbus jets, the hatch is located on the far side of the locked cockpit door.) Once inside, an intruder would have immediate physical access to the computer systems that control communication, navigation, and flight surfaces. A device called a Portable Maintenance Access Terminal allows ground crew to plug into the computer system to test systems and upload software.

The security implications of leaving the plane’s nerve-center freely accessible have not gone unnoticed. Matt Wuillemin, an Australian former 777 pilot, wrote a master’s thesis on the vulnerability in June 2013 and submitted it various industry groups in the hope of spurring action, such as the installation of locks. In his thesis, Wuillemin notes that in addition to the Flight Control Computers, the E/E bay also houses the oxygen cylinders that supply the flight crews’ masks in case of a depressurization event and the controls for the system that locks the flight deck door. “Information is publicly available online describing the cockpit defences and systems located within this compartment,” Wuillemin notes. “This hatch may therefore be accessible inflight to a knowledgeable and malevolent passenger with catastrophic consequences.”

Wuillemin reports that, among others, he sent his thesis to Emirates’ Tim Clark. A vice president for engineering at Emirates responded that the airline did not perceive the hatch to be a security risk, since the area is monitored by cabin crew and surveillance cameras. Wuillemin notes that cabin crew are often called away to duty elsewhere, and that the surveillance cameras are only routinely monitored when someone is seeking entry to the cockpit; he adds:

Emirates considered the possible requirement for crew to access the area should there be a ‘small’ in-flight fire. Research indicated there is no procedure, checklist or protocol (manufacturer, regulator or operator) to support this latter position. In fact, Emirates Operations manuals (at that time) specifically prohibited crew accessing this area in flight. Emirates amended the Operations manual recently and re-phrased the section to ‘enter only in an emergency’.

The fact that someone must have entered the E/E bay during MH370’s disappearance diminishes the likelihood of one of the more popular MH370 theories: that the captain barred himself in the cockpit before absconding with the plane. Even if he locked the copilot on the far side of the door and depressurized the cabin to incapacitate everyone aboard, emergency oxygen masks would have deployed and provided those in the cabin with enough air to prevent Zaharie from leaving the cockpit before the next ACARS message was scheduled to be sent at 17:37, 18 minutes after the flight crew sent its last transmission, “Goodnight, Malaysia 370” at 17:19.

It’s conceivable that Zaharie could have acted in advance by leaving the cockpit, descending into the E/E bay, pulling the circuit breakers on the satcom system and then returning to the cockpit to lock himself in before making the final radio call and diverting the plane to the west, depressurizing the cabin, and waiting until everyone was dead before returning to the E/E bay to turn the SDU back on. But if his goal was to maintain radio silence he could have achieved the same effect much more simply by using cockpit to controls to deselect the SDU without turning it off.

As it happens, Wuillemin’s efforts to draw attention to the potential hazards afforded by unlocked E/E bay hatches proved too little, too late. MH370 went missing just two months after he submitted his work to the Australian government.

319 thoughts on “MH370 Evidence Points to Sophisticated Hijackers”

  1. An alternative explanation: At 18.25 the pilot made a ‘hard reset’ of the avionic electronics in a desperate attempt to regain the control of the plane after it was hijacked via remote controlled autopilot (and after it became clear at 18.22 that the plane was doomed because it left the last radar range with no interference by the authorities). The power cycling did not kill the remote controlled autopilot, but it did (by chance) re-initiate the Inmarsat pings.
    [see e.g. http://archimedes.soup.io/post/459296848/%5D

  2. Text taken from a report from `THE STAR ONLINE`

    Published: Friday March 21, 2014 MYT 12:00:00 AM
    Updated: Friday March 21, 2014 MYT 12:43:15 PM
    Raja Dalelah: I’m convinced I saw aircraft near Andaman islands

    Raja Dalelah Raja Latife.
    Raja Dalelah Raja Latife.

    MALACCA: Did MH370 crash in the Andaman Sea and then drift thousands of kilometres to the southern Indian Ocean?

    A Johor housewife has claimed that she saw the stricken Malaysia Airlines plane partly submerged in the waters off the Andaman islands when she was returning to Kuala Lumpur after a pilgrimage to Mecca on March 8.

    Mystery of MH370

    Raja Dalelah Raja Latife, 53, lodged a police report the same day.

    She said she had taken flight SV2058 that left Jeddah at 3.30am Saudi time (8.30am Malaysian time) and after the plane flew past the southern Indian city of Chennai, she saw something strange in the ocean.

    “It looked like an aeroplane,” said the mother of 10.

    “Throughout the journey, I was staring out of the window of the aircraft as I couldn’t sleep during the flight.

    “It is normal for me to look out of the window if I can’t sleep during a flight. On my first trip to Beijing two years ago, I also stayed awake by looking out the window,” she said.

    Raja Dalelah, from Kota Tinggi in Johor said the plane she was in was flying over the Indian Ocean when she saw a silvery object on the ocean.
    The in-flight monitor in front her showed that the aircraft was crossing the Indian Ocean. The last city on the land mass showed Chennai.

    “I had seen several shipping liners and islands from my window earlier. Then, I saw the silvery object.

    “I took a closer look and was shocked to see what looked like the tail and wing of an aircraft on the water,” she said.

    New evidence: The satellite images of objects that may be possible debris of the missing MH370 found floating in the Indian Ocean. — EPA
    New evidence: The satellite images of objects that may be possible debris of the missing MH370 found floating in the Indian Ocean. — EPA
    Raja Dalelah said she took another look and was sure it was an aircraft in the ocean.

    “I woke my friends in the flight but they laughed me off.”

    A pilot has also laughed off her claim.

    “Along any flight path, especially a long-haul one such as between Jeddah and Kuala Lumpur, the altitude of the plane will be maintained at around 35,000ft once it is in the air,” said the pilot who wished to remain anonymous.

    “This is roughly seven miles above sea level. How can anyone see anything like a boat or ship on the ground from so high up?” he questioned.

    Raja Dalelah, however, was sticking to her guns. “I know what I saw. I am convinced that I saw the aircraft. And I will not lie. I had just returned from my pilgrimage,” she said.

    She said that on March 14, she lodged another police report in Sentul, hoping the Department of Civil Aviation would take her seriously.

    She said the aircraft had what looked like floats on its side but a large part of it was under water.

    “I clearly saw the time, it was about 9.30am (2.30pm Malaysian time),” she said.

    She was also disappointed that when she told an air stewardess about what she had seen, the crew member closed the window and told her to get some sleep.

    Raja Dalelah said when she landed at KLIA at 4pm she told her children what she had seen.

    “That is when they told me that MH370 had gone missing.

    “My son-in-law, a policeman, was convinced that I had seen an aircraft and asked me to lodge a police report the same day at Sentul police headquarters in Kuala Lumpur,” she said.

    Raja Dalelah said she did not know the exact spot where but said it was an hour or more out of Chennai, a timeline that would have put her flight just over the Andaman islands.

    “My other children were afraid that I could be detained for filing a false report as we were told the aircraft had vanished somewhere in the South China Sea.

    “Many of my friends on the flight doubted me at first but they are beginning to believe me now that we know the plane turned back and entered the Indian Ocean,” she added.

  3. all I know is, the Malaysian PM announced on air that ‘MH370 confirmed hijacked’ on the 1st day the plane was missing. After that, they made a lot of conflicting statements, silly theories, etc2. Al-fatihah and RIP to all those who perished.

  4. Oh boy. Now I’m really scared to fly.

    On reading around a bit it looks like this e/e unit is mostly on the later Boeings. In the 777 in particular this data loader controls satcom, fuel, flight computer, electrical loads and a whole lot more. And there are portable data loaders that are the size of a small executive briefcase!

    The more I think the more likely this is one vulnerable area Boeing needs to address quickly.

    As far as this unfortunate plane goes, I think investigators could check all the data loaders worldwide. There cant be more than 10,000 units. And see if the operators and devices can be accounted for.

  5. Interesting to assume it was hijacked. What about a technical error that caused the electricals to fail and the cabin depressurize, causing everyone on board to die while the plane was on autopilot? That also seems like a logical explanation.

  6. Sophisticated hijacking is a ridiculous proposition. No terrorist organisation has ever claimed credit. In fact Al Qaeda lamented they did not do it.

    Where are the boastful claims of credit?

    Where are the announcements that this was in revenge for some historical grievance?

    There is no single shred of evidence for hijacking, just more silly conjectures.

    For this silly theory to work you need to explain how ACARS was disabled at 17:07 UTC by a pilot underneath the cockpit floor whilst the other was on the radio calmly talking to the Ground?

    Are you suggesting a conspiracy between pilots?

    The family of Zaharie Shah advise me that Zaharie did not know Fariq Hamid and had no social contacts with his co-pilot. Malaysian Police tried to prove a connection but there was no chat room contact, not text messages, nothing between the pilots prior to the disappearance.

    Nothing in your theory fits the psychological profile for terrorists, or for suicide pacts. You are just smearing people who can’t answer back with silly absurd theories.

  7. @simon I suggest you read the article again, this time a little more closely. I can help you though, because I doubt you want to go back and not read it thoroughly again.

    “They also suggest that the plane’s captain, Zaharie Ahmad Shah, was not responsible for taking the plane.”

    While the theory neither clears nor implicates the co-pilot, the sentence quoted above clearly states there was no conspiracy between the two.

  8. Gordon it does not matter whether you blame it on terrorists or Zaharie Shah, or Fariq Hamid, or even on Boeing uninterrupable autopilots, yadda yadda, the entire premise of criminality is a load of old codswallop.

    There was one unit in the avionics bay which alone controlled all the VHF radio, ACARS and transponder called the Rockwell Collins CMU-900 processor (PN 822-1239-151). Failure of this one device explains loss of communication and how MH370 vanished from secondary radar.

    In January 2014 the aircraft registered 9M-MRO was upgraded from ADS-B to ADS-C transponder, which entailed upgrading the CMU-900 from Part Number 822-1239-151 to PN 822-1239-151 with an ACARS CORE Software Upgrade.

    Nobody has yet bothered to understand the ACARS signals before take off which reveal Doppler shift velocities of 80-90 knots as MH370 sat motionless at the Gate.

    The CMU-900 has an Automatic Frequency Controller used to match the transmit signal back to INMARSAT with the doppler shift of the satellite. Without this the signal lock on INMARSAT would have been broken.

    On MH370 it is self evident that the highly temperature sensitive frequency oscillator in the AFC was overheating prior to take off.

    Therefore the series of highly variable BTO values before take off were based on an overheating unit and thus the average of 17 signal delays prior to take off used for calibration after 18:25 UTC are unreliable.

    Furthermore if one accepts the conclusion of the ATSB that MH370 behaved like an aircraft with a hypoxic / unresponsive crew then that implies decompression. Decompression implies temperatures inside the cabin dropped to about -53 degrees C. This too would have had the reverse effect on the AFC oscillator.

    That means that the BTO values after decompression are equally unreliable, thus the 7th Arc is not where it was calculated to be.

    All the assumptions have been based around the claim MH370 flew over MEKAR at 18:22 UTC yet this claim is based on false information from Malaysian authorities.

    If you base calculations for MH370’s flight path on false and unreliable data then you will inevitably come to ridiculous conclusions like “sophisticated hijackers.”

  9. Plane was flown into volcano crater/why would a pilot need his own flight simulator if not to commit his own reason probably suiside mission.

  10. Hi Jeff

    I have aquestion.
    Have anyone been looking if flight HM370 might have taken a route to the north corridor or west by the same time fly in between air traffic control sectors?
    I can not find the logic reason why they would take the route South.

    Why not take the small route that we know from igari to the west and then put a cover map over it with air traffic control sectors over it and see , I would not be surprised this is will give you a better picture of which route the plane might have taken.

    Kind Regards

  11. I’m a former pilot. I think the answer is simpler. .. at cruising alt there was either an explosion in the cockpit… or.., more likely a catastrophic failure of the cockpit windscreen allowing 500 mph deadly cold wind to blast the occipants of the aircraft..
    The auto pilot was knocked off line or one of thebpilots managed to try to take control.

    All suceedind events stemmed dfrom this.

  12. A question for the ID group. I am at the part of your book that explains the two brands of SDU and how they differ. Your explanation has prompted the following questions.

    First, if the disappearance of MH370 was state sponsored take “The Spoof” to the max. Has the possibility been considered that the SDU when turned off by a specific circuit breaker in the E/E bay and the one that reestablished handshake with 3F-1 was in the back of a van on a deserted beach with a view of Inmarsat’s 3F-1 ? The Rockwell SDU described relies on data input and at some level of maintenance there is a test instrument that can generate and test the unit with said data.

    There is no doubt some type of identification be it ESN, MAC address, or some other type of unit specific code associated with the aircraft. Is this ID non-volatile hard wired or is it at some level of maintenance addressable/programmable? It is reasonable to think this is a programmable ID easily changed to facilitate maintenance rather than communicate with Inmarsat?

    The easy answer is the SDU was spoofed from inside the E/E bay and the brief interruption of the SDU signal was to allow connection of an external “laptop” type device to supply the corrupted data.

    Are there any satellites today with capabilities resembling the Shuttle Imaging Radar (SIR) carried on some of the early shuttle flights? It was able to see river beds under the sand dunes of Egypt.

    Love the book, keep searching,
    jcb

  13. ” A vice president for engineering at Emirates responded that the airline did not perceive the hatch to be a security risk, since the area is monitored by cabin crew and surveillance cameras. ”

    Extremely short-sighted and idiotic. That VP
    seems to have an IQ worse than that of
    a dinosaur. Such a silly argument, when all
    he had to do to act on it was to instruct that
    that hatch should be locked.

    Something as simple as a $5 padlock
    made in China, may well have prevented
    this.

  14. I’m not a conspiracy theorist and, while this is a very well thought out and researched article, one day we will probably learn the plane lies at the bottom of the Indian ocean somewhere. The cause is very likely to be a series of unfortunate events, as most of the disasters of this type are.

    That having been said there is just a smidge of a chance that says this theory is possible, given the lack of proper lock on the hatch. Even a smidge is too much….this problem needs to and STILL has not been corrected.

  15. Please ignore Simon Gunson’s I’ll founded shortcutting that a Honeywell CMU Mark III is at the root of the MH370 mystery.

    While few things are impossible, that premise is. There are thousands of CMUs on older Boeing aircraft (737, 747,757) and even some Embrauer bodies but there isn’t a single one, of any version. on any Boeing 777 (or 787) anywhere on the planet.

    The then new avionics on the B777 did away with many discrete Line Replaceable Units in favour of the fault tolerant and redundant AIMS architecture. The older CMU functionality was incorporated in AIMS, provided by DCMF running on one of the Core Processor Modules.

    There are two redundant AIMS cabinets on the B777.

    Simon’s scenario never made sense (try exciting an intense fire in a CMU, it’s just silly, use a blowtorch if you want to and have $60 grand to spare) but is in fact impossible.

    More details can be found in my AuntyConspiracy twitter stream.

  16. http://www.seatguru.com/airlines/KLM/KLM_Boeing_777-200ER.php

    The E/E-bay on a 777-200ER, like MH370, is located conveniently next to the lavatory, offering every person interested in entering the bay, a perfect ideal ready-made excuse, of waiting in line, until nobody is looking, then ducking down into the bay.

    Who were the World Business Class passengers aboard MH370? The 20 Chinese artists? The FS staff?

  17. https://en.wikipedia.org/wiki/Malaysian_Airline_System_Flight_653

    “Malaysian Airline System Flight 653 (MH653) was a scheduled domestic flight from Penang to Kuala Lumpur in Malaysia, operated by Malaysian Airline System (MAS). On the evening of 4 December 1977, the Boeing 737-200 aircraft flying the service crashed at Tanjung Kupang, Johor, Malaysia, while purportedly being diverted by hijackers to Singapore…”

    “A few minutes later, the crew radioed: “We’re now proceeding to Singapore. Good night.” Investigators heard a series of gunshots in the last few minutes of the cockpit voice recorder, concluding that both the pilot and co-pilot were fatally shot by the hijacker, which left the plane “professionally uncontrolled”. At 20:15, all communication with the aircraft was lost. At 20:36, the residents of Kampong Ladang, Tanjung Kupang in Johor reported hearing explosions and seeing burning wreckage in a swamp. The wreckage was later identified as the aircraft; it had hit the ground at a near-vertical angle at a very high speed. There were no survivors discovered on the site.”

    https://en.wikipedia.org/wiki/Japanese_Red_Army

    “The JRA was the only terrorist group to publicly claim responsibility for the September 11 attacks[citation needed]. Al-Jazeera and AFP both received anonymous phone calls from callers claiming responsibility for the 9/11 attacks in the name of the Red Army.”

  18. What is really weird about this plane is that it disappeared immediately after signing off with KL (the handshake), and that’s why everyone is speculating it’s either a sophisticated hijack or a pilot suicide.

    If the plane disappeared way through the flight (above China), speculations would have been completely different.

    What cannot be understood or forgiven is tracking a missing plane on military radars with no action, because someone someday will speak up and say I wish I did something or said something during the hours it went missing and tracked!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.