by Jeff Wise
Nevertheless, we found that all of our routes ended up in a cluster. A sense of excitement grew: if each of us was independently coming up with more or less the same answer, it most likely was correct.
Our efforts got a boost with the June 26 publication of a new report by the ATSB called “MH370 — Definition of Underwater Search Areas.” It explained how the Australians had used the Inmarsat data to delineate a search area. One revelation in particular seemed particularly important. It was in a paragraph about the 18:25 log-on request:
A log-on request in the middle of a flight is not common and can occur for only a few reasons. These include a power interruption to the aircraft satellite data unit (SDU), a software failure, loss of critical systems providing input to the SDU or a loss of the link due to aircraft attitude. An analysis was performed which determined that the characteristics and timing of the logon requests were best matched as resulting from power interruption to the SDU.
This was a massive twist. When we’d first heard about the Inmarsat data, we assumed that it had been generated because the satcom had been left on accidentally when everything else had been turned off. Then we’d found out that it had actually reconnected with the satellite a few minutes after the plane left radar coverage. But we didn’t know how or why that could have happened. Now the ATSB was saying that most likely the power to the SDU had been cut and then restored.
It was only because of this reboot that investigators had the seven Inmarsat pings. Everything we knew about the last six hours of the plane’s flight was derived from those pings. If we didn’t fully understand the reboot itself, everything else was built on sand. We needed to figure out how the power interruption had occurred.
The question turned out to be a tough one. Airplane manufacturers keep a tight lid on the technical details of their airplanes, lest competitors steal their secrets. But by scouring the web, reaching out through personal connections, and tapping our own expertise, the independent researchers were able to piece together a comprehensive answer.
What we found is that there is no on/off switch for the SDU in a 777 cockpit. In normal aircraft operation, it simply comes on when the plane’s electrical system is turned on. A person wanting to turn off the SDU has two options. The first is to go to the business-class cabin, open an unlocked floor hatch near the galley, descend into a compartment called the electronics and equipment bay (or E/E bay), and flip three circuit breakers. I call this the “easy way.”
The second method, which can be accomplished directly from the cockpit, is to isolate a portion of the the plane’s electrical system called the left AC bus. The SDU gets its power from this bus, so if the bus is depowered, the SDU shuts off, too. I call this the “hard way” to turn off the SDU because it involves throwing a series of circuit breakers on the overhead panel in an order that requires a good deal of technical knowledge.
It’s also hard in the sense that, because a big chunk of a 777’s electronics are connected to the left AC bus, shutting it down results in the loss of a whole bunch of systems, many of which are likely unknown to anyone who isn’t a Boeing employee. It’s possible that one of the pilots had cooked up a plan that involved temporarily switching off some other component connected to the left AC bus, and in so doing accidentally depowered and repowered the SDU. But after much discussion, neither I nor anybody else could think of a component you’d want to do that to.
I turned to Patrick Smith, a 777 pilot who is one of the most respected aviation commentators in the United States, for his opinion about the SDU reboot. He replied, “The what?” After I explained, he answered: “There isn’t a 777 pilot alive, I’ll bet you, who has the remotest clue as to what the SDU is.” I asked many other 777 pilots and have gotten a similar response.
This struck me as highly significant. If rebooting of the SDU was something that no normal airline pilot can conceive of, let alone carry out, then whoever had taken the plane must have been highly sophisticated.
It also left me puzzled as to motive. Why would a sophisticated hijacker, one who had just committed an aggressive evasion and managed to escape from radar coverage, want to turn on a piece of equipment that apparently would serve no purpose for him, but which could give away his location?
In the end, I was able to come up with no good simple reason. But it occurred to me that there might be a complicated one. Might it perhaps be possible, I wondered, for a clever perpetrator to tamper with the SDU in such a way that it produced misleading metadata? If that were the case, the plane could be made to leave behind a trail of false electronic breadcrumbs implying that the plane had flown off into the remote Indian Ocean when in fact it had turned and gone another way.
If that were the case, then the reboot of the SDU at 18:25 might not have been a failure in the hijacker’s elaborate evasion plan, but its pièce de resistance.
Chapter 8
The Spoof
When the idea that the Inmarsat data might have been maliciously altered first occurred to me, I almost dismissed it as preposterous. First and foremost, it would require the perpetrators to be almost inconceivably clever. If airline pilots don’t know about the SDU, then presumably only a tiny number of people in the entire aviation industry would have the chops to contemplate such a deed.
On the other hand, experts within the investigation apparently didn’t find the idea inconceivable. In an interview with the BBC, Inmarsat engineer Alan Schuster-Bruce said that after he and his colleagues completed their first analysis of the BFO data, “one of the concerns we had was in fact this could just be a big hoax that someone had played on Inmarsat.”
They mostly convinced themselves that that wasn’t the case, but a lingering doubt remained. As Inmarsat VP Aviation David Coiley put it: “We are very confident that this data is correct assuming that there is no other way this data has been spoofed.”
I couldn’t get the thought out of my head. So I decided to see if such a thing were even possible. First, I needed to learn more about how the BTO and BFO values are generated. Mike Exner, the Independent Group member with expertise in satellite communications, gave me the lowdown.
The BTO values, he explained, are a function of two things: the distance between the plane and the satellite, and internal processes that take place entirely within the SDU. As such, the BTO data would be extremely difficult to tamper with. What’s more, Inmarsat had only within the past year begun logging those values, so it’s unlikely that a perpetrator wanting to mislead investigators would even know that they were being stored.
BFO values, on the other hand, were potentially quite interesting. Exner explained that the SDU obtains the speed and location data it needs to perform the Doppler precompensation algorithm via a 1/8” cable connected to the E/E bay, where a box called the Inertial Reference System (or IRS) calculates the plane’s location and velocity. If those incoming values could be changed, so could the BFO values. And any satcom engineer would know that Inmarsat was logging its BFO data because they’re important for maintaining the network.
As I’ve mentioned before, the E/E bay is accessible during flight through an unlocked hatch at the front of the first-class cabin. (At least, on all planes built by Boeing; on Airbus planes this hatch is inside the cockpit.) If you were to climb down into the E/E bay and disconnect the SDU cable from the IRS, you could plug it into an electronic device capable of generating false position information. (Such gear would have to be manufactured from scratch; “there are certainly no commercial, off-the-shelf boxes like that,” said Exner.) In essence, the signal would be lying to the SDU about where the plane was located and how fast it was going, causing the SDU to transmit at an incorrect frequency. If you knew how the satellite communication business worked, you would know that Inmarsat computers would automatically log this information, and that in all likelihood Inmarsat engineers would later find it—and be misled. You would have created a false trail of breadcrumbs.
But why? Well, if a plane simply disappears in the middl
e of nowhere, with absolutely no clues, that’s suspicious. The authorities would assume foul play, sound all alarms, and search in all directions. But if pursuers had a trail to focus on—in this case, one that led off into the middle of the deep blue ocean—they’d never think to question it. The clue, once perceived, would be subtle, so arcane, that the investigators would congratulate themselves for their brilliance in finding it and discerning its meaning. The magician Teller has pointed out a quirk of human psychology can be exploited by practitioners of stage deception: “When a magician lets you notice something on your own, his lie becomes impenetrable.”
Remember Operation Mincemeat? In 1943, a fisherman found the body of a British officer floating off the Spanish coast. The authorities turned the corpse over to German intelligence, who found it to be loaded with secret documents, including one indicating that the expected Allied assault from North Africa would target Sardinia, not Sicily, as widely presumed. Every detail vouched for the authenticity of the documents, from the dead man’s clothes to the array of accompanying possessions. These included several love letters, a photo of the man’s fiancee, a bill from an exclusive London tailor, and a theater ticket stub. Either this man and his belongings had all been meticulously forged, or he really was who he seemed to be. Hitler himself was utterly convinced.
Hitler was wrong, however. The whole thing was a ruse, an elaborate deception cooked up with painstaking care by British intelligence. Because of its success the Germans shifted three divisions to Sardinia, the invasion landed at Sicily, and the war was that much closer to being over.
Given the oddities surrounding the case, I wondered if MH370 might represent a deception crafted at the same level of sophistication.
For this to be true, however, a very specific set of criteria would have to be met. As we’ve seen, the hijacked plane would have to be a Boeing, not an Airbus. It would have to be a fly-by-wire 777 or a 787, not one of Boeing’s earlier planes which used mechanical control systems. The airline would have to have subscribed to the low-cost version of Inmarsat’s service, Classic Aero, and not its high-end version, Swift Broadband (the latter automatically incorporates GPS location data into the signal). The plane’s route after disappearing would have to have been entirely under the footprint of an aging Inmarsat satellite in a decaying orbit. And the implied direction would have to be toward an oceanic basin in which the plane could be “lost.”
It just so happens that MH370 meets all these criteria.
The fact that the E/E bay is freely accessible could also explain how MH370 could have been taken over so quickly after the final radio transmission. Inside the E/E bay, you have full access to the systems that control every function of the plane. “An individual in the avionics bay could potentially disable all communications as well as disable control from the cockpit,” Victor Iannello, an Independent Group member from Virginia, told me. “He or she could have complete control of the aircraft and the crew would be helpless.”
The security implications of leaving the plane’s nerve center freely accessible have not gone unnoticed. Matt Wuillemin, an Australian former 777 pilot, wrote a master’s thesis on the vulnerability in June 2013. In his thesis, Wuillemin notes that in addition to the Flight Control Computers, the E/E bay also houses the oxygen cylinders that supply the flight crews’ masks in case of a depressurization event, as well as the controls for the system that locks the flight deck door. “Information is publicly available online describing the cockpit defences and systems located within this compartment,” Wuillemin notes. “This hatch may therefore be accessible inflight to a knowledgeable and malevolent passenger with catastrophic consequences.”
Wuillemin penned his warning less than a year before MH370 disappeared.
Chapter 9
July 2014
In order for such an attack to take place, someone would have to have been on board to carry it out.
We’d known since March that if the plane didn’t go south, it went north, to Kazakhstan. Kazakhstan’s president, the Soviet-era strongman Nursultan Nazarbayev, is a close ally of Vladimir Putin’s. He was the only national leader who publicly supported Russia’s annexation of Crimea in March 2014.
Kazakhstan itself lacks the technical savvy to carry out a sophisticated hijack, but the same is not true of Russia. Russia’s aerospace industry builds and operates a variety of military jets, commercial aircraft and satellites. In some ways, Russian capabilities outstrip America’s; since 2011 the US has relied entirely on Russia to launch its astronauts into space. So it would be foolish to imagine that tampering with BFO values would be beyond the Kremlin’s capabilities. “Messing with satellite data is very doable for the Russians,” former CIA agent Robert Baer told me.
Kazakhstan is home to the Baikonur Cosmodrome, a 2,593 square mile territory leased by Russia and used for launching space rockets. It has two runways suitable for landing a 777 on, including one in a remote stretch of desert, far from prying eyes. Russia has other facilities within Kazakhstan as well, including an important military radar facility and a missile-testing range. Another possible landing spot would be the Kazakh airbase at Zhetigen, which is located less than 20 miles past the 7th arc.
If Russia did take the plane, who aboard might have been a hijacker? I studied the passenger manifest with an eye for the sort of person who might carry out a covert operation. My model was Igor Girkin, a character described by a Reuters article in May. Girkin was a 43-year-old GRU officer who took charge of the separatist Donetsk People's Republic under the nom-de-guerre of Colonel Strelkov. Before he went off to war, he’d blended seamlessly into civilian life, just another guy who headed to work in a jacket and tie every morning. “He’s always been very polite and very quiet, though I didn’t know him well,” one neighbor told Reuters. “Nothing about him was particularly outstanding.”
“The Russian security apparatus have something that they call the ‘active reserve,’” Mark Galeotti, a professor of global affairs at NYU, explained to me. “Basically, you’ve left the security apparatus on the surface, they’ve probably placed you in a job, and as well as being paid for that job, you’re also receiving a retainer, with the understanding that at some point—it’s like the mafia, really—at some point they’re going to come and ask something of you.”
There was only one Russian aboard MH370, a 43-year-old businessman from Irkutsk named Nikolai Brodsky. Brodsky was sitting in business class seat 3K, approximately 12 feet from the E/E bay hatch. Back in economy class were two Ukrainians of Russian ethnicity, Sergei Deineka and Oleg Chustrak. The men, both 45, were sitting together in row 27, almost directly underneath the SDU.
I was unable to find anything about the Ukrainians from online news reports, but Brodsky had received some coverage in the Russian press. His wife, Elena, gave several interviews to local media. In one, she calmly indicated that her husband was still alive. “He’ll be back,” she told the Komsomolskaya Pravda, “and he will tell all.” I started putting out feelers to find freelance investigators in Russia and Ukraine.
Chapter 10
Doppelganger
On July 17 I was in my kitchen when the phone rang. It was a producer from CNN asking me if I could go on air to talk about the Malaysia Airlines 777 that had just gone down over Ukraine. I’d spent so much time thinking about Ukraine and MH370 that it took me a moment to realize that she was talking about a completely different airplane.
The details were still sketchy, but I gathered that in the late afternoon, Ukraine time, Malaysia Airlines Flight 17 had been flying from Amsterdam to Kuala Lumpur when it had exploded in midair. Initial reports suggested it might have been shot down by a surface-to-air missile while flying over territory held by Russia-backed rebels.
A Malaysia Airlines 777. Ukraine. Russia. I thought: They’ve done it again. I had no idea what the motive would be, any more than I knew what Russia’s motive could be for taking MH370. But the similarities seemed too overwhelming to ignore. Boeing 777s are among th
e most reliable airplanes in the world; none had ever been lost mid-flight before. There were 15 Malaysia Airlines 777s at the start of 2014, out of some 18,000 registered aircraft in the world, and two had come to grief under mysterious circumstances in less than five months.
The statistical unlikelihood was off the charts, as I assumed everyone would instantly recognize. I worried that my scoop would stolen out from under me.
My fears proved groundless. On air at CNN, all the other aviation analysts agreed that of course the destruction of MH17 so soon after the loss of MH370 could only be a freak coincidence. What connection could there possibly be? When asked for my opinion, I said it was too early to draw any conclusions.
But my mind was whirring.
Chapter 11
October 2014
Even while working on a hypothesis that ran counter to the official line, I had to stay on top of what government investigators were doing and why. My theory was just a possibility, after all, and it seemed far-fetched even to me. It would be safer for my reputation to publicly align myself with the consensus view that the Inmarsat data had not been altered and that the plane had gone south. So I followed search officials’ announcements meticulously and remained active in internet discussions about the southern endpoint.
Now that the surface and underwater searches had both been called off, Australia began laying the groundwork for phase two, slated to commence during the southern spring. Ships would be dispatched to the 7th arc to survey a giant patch of the seabed using side-scan sonar. No search of this scale and difficulty had ever been attempted before. In the course of a normal investigation, side-scan sonar is used to locate wreckage whose general position has already been determined. It’s a slow, small-scale process—like painting with a painter’s brush instead of a roller. While a search plane can move hundreds of miles an hour and visually scan for many miles in either direction, a side-scan sonar moves at a walking pace and can only “see” a swath about a mile wide.