The unsettling oddness was there from the first moment, on March 8, when Malaysia Airlines announced that a plane from Kuala Lumpur bound for Beijing, Flight 370, had disappeared over the South China Sea in the middle of the night. There had been no bad weather, no distress call, no wreckage, no eyewitness accounts of a fireball in the sky—just a plane that said good-bye to one air-traffic controller and, two minutes later, failed to say hello to the next. And the crash, if it was a crash, got stranger from there.
My yearlong detour to Planet MH370 began two days later, when I got an email from an editor at Slate asking if I’d write about the incident. I’m a private pilot and science writer, and I wrote about the last big mysterious crash, of Air France 447 in 2009. My story ran on the 12th. The following morning, I was invited to go on CNN. Soon, I was on-air up to six times a day as part of its nonstop MH370 coverage.
There was no intro course on how to be a cable-news expert. The Town Car would show up to take me to the studio, I’d sign in with reception, a guest-greeter would take me to makeup, I’d hang out in the greenroom, the sound guy would rig me with a mike and an earpiece, a producer would lead me onto the set, I’d plug in and sit in the seat, a producer would tell me what camera to look at during the introduction, we’d come back from break, the anchor would read the introduction to the story and then ask me a question or maybe two, I’d answer, then we’d go to break, I would unplug, wipe off my makeup, and take the car 43 blocks back uptown. Then a couple of hours later, I’d do it again. I was spending 18 hours a day doing six minutes of talking.
As time went by, CNN winnowed its expert pool down to a dozen or so regulars who earned the on-air title “CNN aviation analysts”: airline pilots, ex-government honchos, aviation lawyers, and me. We were paid by the week, with the length of our contracts dependent on how long the story seemed likely to play out. The first couple were seven-day, the next few were 14-day, and the last one was a month. We’d appear solo, or in pairs, or in larger groups for panel discussions—whatever it took to vary the rhythm of perpetual chatter.1
I soon realized the germ of every TV-news segment is: “Officials say X.” The validity of the story derives from the authority of the source. The expert, such as myself, is on hand to add dimension or clarity. Truth flowed one way: from the official source, through the anchor, past the expert, and onward into the great sea of viewerdom.
What made MH370 challenging to cover was, first, that the event was unprecedented and technically complex and, second, that the officials were remarkably untrustworthy. For instance, the search started over the South China Sea, naturally enough, but soon after, Malaysia opened up a new search area in the Andaman Sea, 400 miles away. Why? Rumors swirled that military radar had seen the plane pull a 180. The Malaysian government explicitly denied it, but after a week of letting other countries search the South China Sea, the officials admitted that they’d known about the U-turn from day one.
Of course, nothing turned up in the Andaman Sea, either. But in London, scientists for a British company called Inmarsat that provides telecommunications between ships and aircraft realized its database contained records of transmissions between MH370 and one of its satellites for the seven hours after the plane’s main communication system shut down. Seven hours! Maybe it wasn’t a crash after all—if it were, it would have been the slowest in history.
These electronic “handshakes” or “pings” contained no actual information, but by analyzing the delay between the transmission and reception of the signal— called the burst timing offset, or BTO—Inmarsat could tell how far the plane had been from the satellite and thereby plot an arc along which the plane must have been at the moment of the final ping.Fig. 3 That arc stretched some 6,000 miles, but if the plane was traveling at normal airliner speeds, it would most likely have wound up around the ends of the arc—either in Kazakhstan and China in the north or the Indian Ocean in the south. My money was on Central Asia. But CNN quoted unnamed U.S.-government sources saying that the plane had probably gone south, so that became the dominant view.
Other views were circulating, too, however.Fig. 5 A Canadian pilot named Chris Goodfellow went viral with his theory that MH370 suffered a fire that knocked out its communications gear and diverted from its planned route in order to attempt an emergency landing. Keith Ledgerwood, another pilot, proposed that hijackers had taken the plane and avoided detection by ducking into the radar shadow of another airliner. Amateur investigators pored over satellite images, insisting that wisps of cloud or patches of shrubbery were the lost plane. Courtney Love, posting on her Facebook time line a picture of the shimmering blue sea, wrote: “I’m no expert but up close this does look like a plane and an oil slick.”
Then: breaking news! On March 24, the Malaysian prime minister, Najib Razak, announced that a new kind of mathematical analysis proved that the plane had in fact gone south. This new math involved another aspect of the handshakes called the burst frequency offset, or BFO, a measure of changes in the signal’s wavelength, which is partly determined by the relative motion of the airplane and the satellite. That the whole southern arc lay over the Indian Ocean meant that all the passengers and crew would certainly be dead by now. This was the first time in history that the families of missing passengers had been asked to accept that their loved ones were dead because a secret math equation said so. Fig. 7 Not all took it well. In Beijing, outraged next-of-kin marched to the Malaysian Embassy, where they hurled water bottles and faced down paramilitary soldiers in riot gear.
Guided by Inmarsat’s calculations, Australia, which was coordinating the investigation, moved the search area 685 miles to the northeast, to a 123,000-square-mile patch of ocean west of Perth. Ships and planes found much debris on the surface, provoking a frenzy of BREAKING NEWS banners, but all turned out to be junk. Adding to the drama was a ticking clock. The plane’s two black boxes had an ultrasonic sound beacon that sent out acoustic signals through the water. (Confusingly, these also were referred to as “pings,” though of a completely different nature. These new pings suddenly became the important ones.) If searchers could spot plane debris, they’d be able to figure out where the plane had most likely gone down, then trawl with underwater microphones to listen for the pings. The problem was that the pingers had a battery life of only 30 days.
On April 4, with only a few days’ pinger life remaining, an Australian ship lowered a special microphone called a towed pinger locator into the water.Fig. 8 Miraculously, the ship detected four pings. Search officials were jubilant, as was the CNN greenroom. Everyone was ready for an upbeat ending.
The only Debbie Downer was me. I pointed out that the pings were at the wrong frequency and too far apart to have been generated by stationary black boxes. For the next two weeks, I was the odd man out on Don Lemon’s six-guest panel blocks, gleefully savaged on-air by my co-experts.
The Australians lowered an underwater robotFig. 9 to scan the seabed for the source of the pings. There was nothing. Of course, by the rules of TV news, the game wasn’t over until an official said so. But things were stretching thin. One night, an underwater-search veteran taking part in a Don Lemon panel agreed with me that the so-called acoustic-ping detections had to be false. Backstage after the show, he and another aviation analyst nearly came to blows. “You don’t know what you’re talking about! I’ve done extensive research!” the analyst shouted. “There’s nothing else those pings could be!”
Soon after, the story ended the way most news stories do: We just stopped talking about it. A month later, long after the caravan had moved on, a U.S. Navy officer said publicly that the pings had not come from MH370. The saga fizzled out with as much satisfying closure as the final episode of Lost.
Once the surface search was called off, it was the rabble’s turn. In late March, New Zealand–based space scientist Duncan Steel began posting a series of essays on Inmarsat orbital mechanics on his website.Fig. 10 The comments section quickly grew into a busy forum in which technically sophisticated MH370 obsessives answered one another’s questions and pitched ideas. The open platform attracted a varied crew, from the mostly intelligent and often helpful to the deranged and abusive. Eventually, Steel declared that he was sick of all the insults and shut down his comments section. The party migrated over to my blog, jeffwise.net.
Meanwhile, a core of engineers and scientists had split off via group email and included me. We called ourselves the Independent Group,11 or IG. If you found yourself wondering how a satellite with geosynchronous orbit responds to a shortage of hydrazine, all you had to do was ask.12 The IG’s first big break came in late May, when the Malaysians finally released the raw Inmarsat data. By combining the data with other reliable information, we were able to put together a time line of the plane’s final hours: Forty minutes after the plane took off from Kuala Lumpur, MH370 went electronically dark. For about an hour after that, the plane was tracked on radar following a zigzag course and traveling fast. Then it disappeared from military radar. Three minutes later, the communications system logged back onto the satellite. This was a major revelation. It hadn’t stayed connected, as we’d always assumed. This event corresponded with the first satellite ping. Over the course of the next six hours, the plane generated six more handshakes as it moved away from the satellite.
The final handshake wasn’t completed. This led to speculation that MH370 had run out of fuel and lost power, causing the plane to lose its connection to the satellite. An emergency power system would have come on, providing enough electricity for the satcom to start reconnecting before the plane crashed. Where exactly it would have gone down down was still unknown—the speed of the plane, its direction, and how fast it was climbing were all sources of uncertainty.
The MH370 obsessives continued attacking the problem. Since I was the proprietor of the major web forum, it fell on me to protect the fragile cocoon of civility that nurtured the conversation. A single troll could easily derail everything. The worst offenders were the ones who seemed intelligent but soon revealed themselves as Believers. They’d seized on a few pieces of faulty data and convinced themselves that they’d discovered the truth. One was sure the plane had been hit by lightning and then floated in the South China Sea, transmitting to the satellite on battery power. When I kicked him out, he came back under aliases. I wound up banning anyone who used the word “lightning.”
By October, officials from the Australian Transport Safety Board had begun an ambitiously scaled scan of the ocean bottom, and, in a surprising turn, it would include the area suspected by the IG.13 For those who’d been a part of the months-long effort, it was a thrilling denouement. The authorities, perhaps only coincidentally, had landed on the same conclusion as had a bunch of randos from the internet. Now everyone was in agreement about where to look.
While jubilation rang through the email threads, I nursed a guilty secret: I wasn’t really in agreement. For one, I was bothered by the lack of plane debris. And then there was the data. To fit both the BTO and BFO data well, the plane would need to have flown slowly, likely in a curving path. But the more plausible autopilot settings and known performance constraints would have kept the plane flying faster and more nearly straight south. I began to suspect that the problem was with the BFO numbers—that they hadn’t been generated in the way we believed.14 If that were the case, perhaps the flight had gone north after all.
For a long time, I resisted even considering the possibility that someone might have tampered with the data. That would require an almost inconceivably sophisticated hijack operation, one so complicated and technically demanding that it would almost certainly need state-level backing. This was true conspiracy-theory material.
And yet, once I started looking for evidence, I found it. One of the commenters on my blog had learned that the compartment on 777s called the electronics-and-equipment bay, or E/E bay, can be accessed via a hatch in the front of the first-class cabin.15 If perpetrators got in there, a long shot, they would have access to equipment that could be used to change the BFO value of its satellite transmissions. They could even take over the flight controls.16
I realized that I already had a clue that hijackers had been in the E/E bay. Remember the satcom system disconnected and then rebooted three minutes after the plane left military radar behind. I spent a great deal of time trying to figure out how a person could physically turn the satcom off and on. The only way, apart from turning off half the entire electrical system, would be to go into the E/E bay and pull three particular circuit breakers. It is a maneuver that only a sophisticated operator would know how to execute, and the only reason I could think for wanting to do this was so that Inmarsat would find the records and misinterpret them. They turned on the satcom in order to provide a false trail of bread crumbs leading away from the plane’s true route.
It’s not possible to spoof the BFO data on just any plane. The plane must be of a certain make and model, 17equipped with a certain make and model of satellite-communications equipment,18 and flying a certain kind of route19 in a region covered by a certain kind of Inmarsat satellite.20 If you put all the conditions together, it seemed unlikely that any aircraft would satisfy them. Yet MH370 did.
I imagine everyone who comes up with a new theory, even a complicated one, must experience one particularly delicious moment, like a perfect chord change, when disorder gives way to order. This was that moment for me. Once I threw out the troublesome BFO data, all the inexplicable coincidences and mismatched data went away. The answer became wonderfully simple. The plane must have gone north.
Using the BTO data set alone, I was able to chart the plane’s speed and general path, which happened to fall along national borders.Fig. 21 Flying along borders, a military navigator told me, is a good way to avoid being spotted on radar. A Russian intelligence plane nearly collided with a Swedish airliner while doing it over the Baltic Sea in December. If I was right, it would have wound up in Kazakhstan, just as search officials recognized early on.
There aren’t a lot of places to land a plane as big as the 777, but, as luck would have it, I found one: a place just past the last handshake ring called Baikonur Cosmodrome.Fig. 22 Baikonur is leased from Kazakhstan by Russia. A long runway there called Yubileyniy was built for a Russian version of the Space Shuttle. If the final Inmarsat ping rang at the start of MH370’s descent, it would have set up nicely for an approach to Yubileyniy’s runway 24.
Whether the plane went to Baikonur or elsewhere in Kazakhstan, my suspicion fell on Russia. With technically advanced satellite, avionics, and aircraft-manufacturing industries, Russia was a paranoid fantasist’s dream.24 (The Russians, or at least Russian-backed militia, were also suspected in the downing of Malaysia Flight 17 in July.) Why, exactly, would Putin want to steal a Malaysian passenger plane? I had no idea. Maybe he wanted to demonstrate to the United States, which had imposed the first punitive sanctions on Russia the day before, that he could hurt the West and its allies anywhere in the world. Maybe what he was really after were the secrets of one of the plane’s passengers.25 Maybe there was something strategically crucial in the hold. Or maybe he wanted the plane to show up unexpectedly somewhere someday, packed with explosives. There’s no way to know. That’s the thing about MH370 theory-making: It’s hard to come up with a plausible motive for an act that has no apparent beneficiaries.
As it happened, there were three ethnically Russian men aboard MH370, two of them Ukrainian-passport holders from Odessa.26 Could any of these men, I wondered, be special forces or covert operatives? As I looked at the few pictures available on the internet, they definitely struck me as the sort who might battle Liam Neeson in midair.
About the two Ukrainians, almost nothing was available online.Fig. 27 I was able to find out a great deal about the Russian,Fig. 28 who was sitting in first class about 15 feet from the E/E-bay hatch.Fig. 29 He ran a lumber company in Irkutsk, and his hobby was technical diving under the ice of Lake Baikal.30 I hired Russian speakers from Columbia University to make calls to Odessa and Irkutsk, then hired researchers on the ground.
The more I discovered, the more coherent the story seemed to me.32 I found a peculiar euphoria in thinking about my theory, which I thought about all the time. One of the diagnostic questions used to determine whether you’re an alcoholic is whether your drinking has interfered with your work. By that measure, I definitely had a problem. Once the CNN checks stopped coming, I entered a long period of intense activity that earned me not a cent. Instead, I was forking out my own money for translators and researchers and satellite photos. And yet I was happy.
Still, it occurred to me that, for all the passion I had for my theory, I might be the only person in the world who felt this way. Neurobiologist Robert A. Burton points out in his book On Being Certain that the sensation of being sure about one’s beliefs is an emotional response separate from the processing of those beliefs. It’s something that the brain does subconsciously to protect itself from wasting unnecessary processing power on problems for which you’ve already found a solution that’s good enough. “ ‘That’s right’ is a feeling you get so that you can move on,” Burton told me. It’s a kind of subconscious laziness. Just as it’s harder to go for a run than to plop onto the sofa, it’s harder to reexamine one’s assumptions than it is to embrace certainty. At one end of the spectrum of skeptics are scientists, who by disposition or training resist the easy path; at the other end are conspiracy theorists, who’ll leap effortlessly into the sweet bosom of certainty. So where did that put me?
Propounding some new detail of my scenario to my wife over dinner one night, I noticed a certain glassiness in her expression. “You don’t seem entirely convinced,” I suggested.
She shrugged.
“Okay,” I said. “What do you think is the percentage chance that I’m right?”
“I don’t know,” she said. “Five percent?”33
Springtime came to the southern ocean, and search vessels began their methodical cruise along the area jointly identified by the IG and the ATSB, dragging behind it a sonar rig that imaged the seabed in photographic detail. Within the IG, spirits were high. The discovery of the plane would be the triumphant final act of a remarkable underdog story.
By December, when the ships had still not found a thing, I felt it was finally time to go public. In six sequentially linked pages that readers could only get to by clicking through—to avoid anyone reading the part where I suggest Putin masterminded the hijack without first hearing how I got there—I laid out my argument. I called it “The Spoof.”
I got a respectful hearing but no converts among the IG. A few sites wrote summaries of my post. The International Business Times headlined its story “MH370: Russia’s Grand Plan to Provoke World War III, Says Independent Investigator” and linked directly to the Putin part. Somehow, the airing of my theory helped quell my obsession. My gut still tells me I’m right, but my brain knows better than to trust my gut.
Last month, the Malaysian government declared that the aircraft is considered to have crashed and all those aboard are presumed dead. Malaysia’s transport minister told a local television station that a key factor in the decision was the fact that the search mission for the aircraft failed to achieve its objective. Meanwhile, new theories are still being hatched. One, by French writer Marc Dugain, states that the plane was shot down by the U.S. because it was headed toward the military bases on the islands of Diego Garcia as a flying bomb.34
The search failed to deliver the airplane, but it has accomplished some other things: It occupied several thousand hours of worldwide airtime; it filled my wallet and then drained it; it torpedoed the idea that the application of rationality to plane disasters would inevitably yield ever-safer air travel. And it left behind a faint, lingering itch in the back of my mind, which I believe will quite likely never go away.
*This article appears in the February 23, 2015 issue of New York Magazine.
Sunny Coaster – If….. it is a complex spoofing scenario then Inmarsat’s role in it was simply to catch the data. Why would it have to be contingent in any way on their interpretative skills. Going further down the “if” road it might have been anticipated that the data would end up elsewhere. It doesn’t have to be about Inmarsat.
@Jay that was phenomenal, everything I wanted to say but was just too lazy to write so much 🙂
@littlefoot “Unfortunately you then have not a single solid argument against a spoofing scenario besides your gut feeling that there exist no perps who would risk such a thing. ”
it’s not gut feeling, it’s common sense…the difference is huge
@jeff
more profitable? Get some economists in ATSB and put the probabilities on paper, they will count what is the most profitable area to search economically speaking.
About the Mantra: ‘Your data are safe!’
@Jay
I fully agree with what you said about groups and their mechanisms to preserve their focus. It reminds me of one of the prominent heads in the philosophy of science, a certain Thomas S. Kuhn and his Ideas about how paradigms work in science. There is always one prominent paradigm cited, the geocentric order of the then scientific establishment under command of inquisition and catholic church against the heleocentric order of people like Tycho Brahe. For 2000 years that was a truly academic question of no importance in real life. But when with the advent of logarithms and modern maths in europe in the 16th century the demand for easy and simple solutions in naval navigation became overwhelming, the old mantra of a geocentric order was crushed, because it was by far too complicate compared to the heleocentric calculations.
So, please mind, science is not always about truth, its about group mechanism, about what is acceptable, if it fits into the system of values of the scientific establishment etc. etc. The whole of all of these aspects make a paradigm work. And one of those paradigms in a very clasical way is the mantra :”Your data are safe.”
Back in the seventies this mantra was useful, because the economy was falling behind due to the irrational resistance against the use of IT and office computers. In Germany it took more than a decade to persuade the industry to employ modern technology like personal computzers in offices. Something similar happened about the introduction of the internet. During all that time it was necessary to repeat that mantra. But those times have long gone.
Today we have a workforce that grew up with all sort of high-tech equipment and my 3 year old grandchild tells me how to use my ipad. I dont see irrational resistance to useful innovation any more and so the old mantra is but a relic. Today a new mantra is necessary: ‘Data are unsafe by definition!’
This message was served to us in depth during the last 2 years, and it needs no explanation, when we get to know that government agencies force on the industry to build unsafe software with backdoors all over the place, for use by all kind of surveillance. When one of those agencies – i am confident , that it is done in all countries with access to technology – states, that they want to make sure, that they can hack everything that is connected to the internet, you can be sure, that in a world where money can buy everything, this knowledge will be available to the bad guys too. We know about Snowden, who published the stolen data. We dont know about the others ones, stole the data and sold them.
So if you apply the new paradigm: Data are unsafe by definition! to the evidence produced in this investigation, we would look for sources of data corruption first, before we turn to exotic scenarios, like the SIO-scenario, that need immensely complicate assumptions and sub-scenarios with additional complicate sub-assumptions.
Therefore i say, it was premature to turn to the SIO before other, more simpler explanations were exhausted. I admit, that this was not a scientific situation in the first place, but a Search and Rescue operation, where you dont care for scientific deliberations. But now after one year we should leave the SAR-mode and turn back to scientific methodology. :
This tells us, that a deliberate act, where all comms were blacked out on purpose, would include a deliberate and planned re-login of the AES at 18:25. Since only exotic explanations (like the SIO scenario) imply a functionality of the AES as before it was out of power, we should make all efforts we can, to make sure, what happened to the quipment. Unfortunately, it seems, that there are multiple roads that confirm the new mantra: “Data are unsafe by definition!
Any tampering with the data in a well planned capture will have been trained in detail. Especially inflight access to the AES would have been tested with an identical Honeywell device and the same satellite. So irregular inflight – logons should be visible in the INMARSAT logs during the last couple of years. Every intern at the company could check for that. Why is it not done?
@Stevan,
Common sense is a good thing.
And considering that there doesn’t really exist a plausible narrative how and why the plane should’ve ended up in the SIO, where so far not a single scrap of the plane has turned up and since there’s no good answer to the question why the SDU/AES started working again at a very conspicuous moment, my common sense tells me that one should make damn sure that the satellite data haven’t been tampered with. Because IF they have been tampered with one suddenly has quite a few plausible answers for some questions.
The problem is that this case is a Black Swan event. It’s a singularity. And common sense and gut feelings don’t get you very far in such a case, since one has no experience from previous cases.
To conter Spencer’s argument that pilot suicide is a plausible narrative: I’ve said repeatedly that Zaharie’s social page entries combined with his strong political convictions do give me pause and I wouldn’t prematurely take them completely out of the equation, bit they simply don’t add up to a strong suicide motive, especially since the modus operandi doesn’t really make sense.
Notice: The views opinions expressed in this post are solely mine and do not express the views of the IG or any other group.
@littlefoot and @RichardCole: You are both exactly right that Inmarsat would likely not have the expertise to evaluate the kind of scenario I am investigating. Honeywell/Thales, as the manufacturer of the SATCOM, is the entity with the most knowledge to technically assess the feasibility. Who knows whether Inmarsat, when it was reconstructing paths based on the BTO and BFO signatures, was asking Honeywell the questions that I am asking about undocumented ways to alter the satellite inclination parameters? I doubt Honeywell would be overly forthcoming with information about security holes in its product, if they do indeed exist.
I will add that the Rockwell Collins 2100/6100 is a competitive product to the Honeywell MCS-6000 SATCOM. The RC SATCOM allows the user to specify the orbit inclination when the Owner’s Requirements Table (ORT) is built and loaded into the SATCOM. It is also possible to change the inclination parameters via the CDU in the cockpit through SATCOM maintenance pages, as well as reset the SATCOM by performing a “Cold Restart”. This makes me wonder whether there are documented features on the RC SATCOM that might be similar to undocumented features on the Honeywell SATCOM. The ability to change the inclination parameters and power cycle the SATCOM from the CDU in the cockpit could explain a lot, and lessen the probability that the perpetrators entered the E/E bay.
I present these possibilities as areas to investigate, not as facts. A crash in the SIO after fuel exhaustion remains the most likely explanation. But until we find one shred of debris supporting this theory, I will continue to explore other theories that allow different interpretations of the BFO data. It baffles me that so many believe that our understanding of the BFO data is nearly absolute. In fact, we don’t know what we don’t know.
Some thoughts about the two unanswered ground-to-air phone calls at 1839:52 UTC and 2313:58 UTC…
1. Both calls with Q10 AOC Priority Level (from MAS Operations Center)
2. Both calls would have been routed to the cockpit
3. Both calls were cleared by the calling party
4. Both calls were cleared after exactly 64 seconds
I cannot understand why MASOC only tried once at 1839:52 UTC to reach the aircraft, even though they knew that there’s something wrong with it. The call went thru, that must have been an evidence for MASOC that the plane is still there.
Why didn’t they try it again some minutes later? And again, and again – as this everyone would expect in such a situation.
Also Q10 is the lowest of three Operational Priority Levels (according to ICAOs “Satellite Voice Guidance Material” Q10 is used for Air Traffic Information, Redispatch, Maintenance – not Emergency!)
That’s quite in contradiction to the highly urgent ACARS messages to the cockpit printer which began 1803:23, failed, auto transmitted every 2 minutes and ended 1843:33.
IMO there’s no satisfiying explanation for the second call (3 hours later!), but it ends like the first one after 64 seconds – which may be an automatic timeout, didn’t find anything about this.
Besides this strange behaviour, the timing is interesting.
Although ACARS messages didn’t reach the aircraft at 18:39, MASOC successfully tried to call it via SATCOM once(!) that time.
I’ve got no idea what this means, but MASOC’s concerns about the aircraft in this period seem very limited to me – and i can’t believe they only lacked the competence to handle the situation.
_______________
(sorry for bad english as it’s not my primary language;-)
@littlefoot “And considering that there doesn’t really exist a plausible narrative how and why the plane should’ve ended up in the SIO, where so far not a single scrap of the plane has turned up and since there’s no good answer to the question why the SDU/AES started working again at a very conspicuous moment, my common sense tells me that one should make damn sure that the satellite data haven’t been tampered with.”
there are other locations in IO (e.g. far to the north) that make much more sense and don’t need any tampering, yeah it would be a big coincidence that BFO/BTO are the same as for straight flight path to the south but I had bigger in my life
I totally agree with spencer that some things are not discussed as much as they should be as this is not just malaysian problem but a very global one. Feelings of anyone’s family shouldn’t be the hurdle in this case and they should understand it.
@Victor,
Even if your suggested spoofing scenario is easier to implement than other methods, how difficult would it be for aspiring perps to come by the necessary information?
Gerry Soejatman said he has heard as early as 2011 that different factions possibly knew how to tamper with the BFOs. The knowledge and expertise – which seems to be an insurmountable hurdle for most of us – might’ve been there for a while in certain circles, and the perps wouldn’t have to start their research from scratch.
@littlefoot: I don’t (yet) dismiss it as “insurmountable”. As you say, the knowledge may be out there, if the capability does exist. Perhaps others are already investigating this possibility, in parallel or ahead of me.
Pairing of BFO and BTO data
@mathematicians
When looking for simple solutions for some sort of tampering with GPS/AES-data, one of the obvious reasons could be, to give a false impression of the location of the plane. One locating parameter is the signal runtime and its bias. So maybe if someone was successfull in producing wrong BTO only. Would different BTO (which makes a different ping ring system) values fit to the given BFO values? Maybe we could find a different ping ring system that would make more sense with the given BFO (i.e. leads to a location with a possible landing site).
Jay:
Thank you so much for sparking this needed discussion. It has amazed me how so many people (most of whom have no technical understanding satellite communications) have jumped onboard the spoofing train, with not a single scrap of evidence for any of these theories.
Victor is the only one who is taking a rational, scientific approach to exploring out of the box “what if” scenarios consistent with the scientific and engineering knowledge we have. He does not start with a tantalizing end point assumption and then cobble up a series of assumptions to support the end. He starts with a single, rational (albeit unlikely) “what if” assumption (BFO not accurate) and then calculates where that would lead, based on science and engineering. So I can support Victor’s curiosity, while agreeing with him that the SIO near 37.7S is the place to look.
The question has been asked: If MH370 is not found in the current 60,000 km^2 priority search area, where should they look next? The answer depends on where ATSB has actually searched. It is critical to have accurate ship tracks in order to provide recommendations on where to expand or change the priority search area. MC was providing the data to me and a few others last fall, but stopped doing so for unknown reasons. Several of us have attempted to persuade Marine Traffic (or one of their competitors) to provide search ship tracking data at no cost. So far, all have declined. Marine Traffic wants ~$4,000 just to open an account (they want 12 months in advance). Recently, I put in a request to ATSB to make the data available, but no word back on that request so far. Maybe we need to try crowd sourcing the $4K.
My last post motivated me to try to raise the money for ship tracking data. Care to donate?
http://www.gofundme.com/p6bxoo
ALSM
@Victor:
Keep going.
alsm you want to tell me that ATSB has spent $100 million on this search yet failed to provide a mere $4K for something that is actually useful?
StevanG: You know perfectly well that is NOT what I said or implied.
@ALSM,
I think what you have done for the IG and the quest for understanding the enigma that is mh370 is wonderful. We all respect your intelligence, and your drive for having the search continued – as it should at least for now. And I can feel your frustration if there isn’t any official response to well reasoned suggestions. And I really mean what I’m writing…
But why shouldn’t there be any merit in following other trains of thoughts while the search is under way -producing no results do far? I would actually say it has been immensely productive and valuable. If we hadn’t started to discuss the possibility of spoofing as early as June last year, and if Jeff – as a non- expert in satellite communication -hadn’t been so persistent in following his Northern route scenarios and pointing out the importance to look into the phenomenon of the reviving SDU/AES , we would have never learned from an expert like you that it is possible after all to tamper with the BFOs. By going public with his story, Jeff got Gerry Soejatman’s expertise, who came up with an even easier way to do it. And he supplied some answers in his comment section to the question why a perp might even be interested in spoofing the BFOs, since Inmarsat had not developed the math for teasing out the info about the plane’s direction from the BFOs. I recommend reading Gerry’s answer to that question. It might indeed be a useful tool for obfuscation, even without Inmarsat’s “new math”.
Now Victor, who apparently has a high level of expertise, has the guts to invite experts to evaluate if there is an even easier method. If it is indeed a sound method, we non-experts in sat communication can jump in and discuss the plausibility of scenarios under different aspects. We might have some expertise in other areas or we are simply doing leg work and turn up all sorts of information. Some of it might prove to be useful.
Maybe all this has nothing whatsoever to do with the whereabouts of mh370. But even if nothing is useful right now for getting to the location of the plane, it was a useful exercise because some security risks have been uncovered. Gerry was worried enough to put up a long and well argued post at his blog.
All this couldn’t have happened if the non-experts in satellite communication _ as well as some experts – hadn’t continued to ask: “what if?” or “is this even technically possible?”
And that continued questioning is something the official investigation should have done a year ago (if they have it wasn’t discussed publicly). Then there would’ve been a much better chance for criminal investigators to secure evidence for a potentially very different scenario.
All that said, Jay is right in pointing out the danger of getting carried away and engage in group think. But that is true for all factions here and we all have been caught up too much in a silly idea.
with regards to infiltrated companies, we actually may have a bigger problem, see:
archive.is/ZpYrp#selection-511.246-539.46 (and below)
littlefoot:
TNX for your thoughts. I don’t have any objection to thinking outside of the box. I have spent a lifetime doing that. What I find objectionable is the present overwhelming dominance of the conversation on highly unlikely scenarios while dismissing the science based, best analysis we have as “rubbish”. The spin is, the SIO must be wrong simply because the plane has not been found yet. What nonsense!
I would prefer to see most (but not all) of the dialog here centered on helping ATSB maximize the chances of success. For example, where is the serious discussion on the final minutes? How wide should the search area be? Did MH370 turn left or right after the 2nd engine flamed out? It matters to the determination of the priority search area. There are clues in the data. Some of us (Richard Cole and several IG members) are working on that question. When and where did the FMT take place? Bobby Ulich and the IG are working this question. Was there a step climb circa 1840? Could SCCA be used as a WP? IMO, these are the types of questions that should be dominating the discussion.
@jeffwise
What could be a more profitable line of inquiry?
I think an important discussion (for those who still support the SIO search; most of us do I think), is in which direction(s) and how far the current priority search zone should be extended after May, if nothing has been found by then.
As politicians may need to be convinced to put in more money a broadly supported advice from independent investigators would be important.
There have been several assumptions made to converge to the current zone, and they should be dropped in the right order. I tried to make a start with such a discussion with my short analysis about conseqences of ignoring (part of) radar data.
The assumption that BTO/BFO data can be trusted is one of them, but clearly not the first one to be dropped. The fact that we don’t have a scenario to explain the southerly turn or the 18:25 log-on is not a good reason to reject the data. It is a reason to critically look at the data which has extensively been done by many.
Of course it is perfectly fine for everyone to think out of the box, and it may eventually lead to a “paradigm shift”, but I’m convinced there is still a lot to be done with existing data (much of it still not available in the public domain, so another task for us!) in terms of the more “conventional” technical analysis.
Regards,
Niels.
@VictorI:
You wrote on MaRCH 17: “I can report that, through private conversations with a knowledgeable individual, Honeywell’s MCS-6000 SATCOM does indeed include the effect of inclination in its model, so assumption (1) is satisfied. However, the SATCOM uses the value of inclination that is broadcast by the GES in Perth as part of the “System Table”. I have learned that the inclination that was broadcast was indeed zero during the entire flight.”
The ATSB report says that the small errors in the frequency compensation (due to the motion of the satellite and the vertical speed of the airplane) are “immaterial to the communications performance, but do affect the BFO”. So why does Inmarsat broadcast the satellite orbit inclination and ascension node time as part of the “System Table”? They would certainly know for what purposes it is used in the AES. Is it used for pointing the High Gain Antenna and for the frequnecy compensation?
@ALSM – I still think MH370 is in the SIO but believe it’s just outside of the current search area. In support of your concern regarding the final few minutes, I just wonder if all of the calculated impact locations on or near the 7th Arc are based on the single BFO data point of -2Hz at 00:19:37.443? If so and it were incorrect, a 15-minute glide could put it 60 NM outside the 7th Arc. However, we now know that the Right Engine burned about 1.5% more fuel than the Left Engine, but I do not know how quickly and accurately the fuel balancing works.
I agree with the possibility of a step climb after 18:40 and wondered if that would have saved enough fuel to support a ±500 Knot run through the Malacca Straights at 10,000 to 15,000 feet? If so, it could support Kate Tee’s sighting.
@VictorI – Instead of using complicated methods to spoof the BFO data, couldn’t a substitute plane mimic MH370’s AES ID, turning it on at 18:25 and flying it to the SIO? Also, instead of crashing in the SCS, MH370 flew low and landed somewhere within an hour (17:21 – 18:25) of IGARI? The motive was to trade a plane with a small payload capacity and a 7-hour+ range for a jumbo with 11-hour (or more) range.
@Gysbreght: In a nutshell, yes.
I did not want to bore the group here with more technical details than necessary, but the reason I suspected that the AES could compensate for satellite inclination was by linking two documents:
1. The ICAO AMSS specification for the allowable frequency error of the AES frequency compensator.
2. The allowable inclination for the I3F3 satellite as per FCC application.
When I calculate what the maximum AES compensation frequency error would be for a satellite whose inclination was equal to the maximum allowed by the FCC, that frequency was greater than allowed by the ICAO specification. Hence, I hypothesized that AES did have the capability to correct for inclination, but the inclination parameter was set to zero at least for the first part of the flight.
It was only after I asked this very specific question to a knowledgeable individual did I receive the answer that the AES had the capability to compensate for satellite inclination. Previously, the assumption had been that it could not compensate for inclination, based on Inmarsat’s claim that the AES model for the satellite was a geostationary orbit. A more accurate way to say this is the model is near-geostationary, but the inclination parameter was set to zero by broadcast of the System Table. It really makes no difference to the analysis which definition you use unless you wish to entertain the possibility that the value broadcast in the System Table was somehow changed.
So I imagine that the GES would begin to broadcast a non-zero value of inclination as part of the System Table once I3F1 exceeds some threshold value of inclination so that the AES frequency compensation error is within ICAO limits.
I know this is confusing and worthy of a longer explanation for those interested.
@laurenH – Yes there is an airport or military airbase on the east coast of Malayasia where MH370 could have landed after simulating a crash out near IGARI.
@Lauren H: Yes, there could have been a second plane with a spoofed ID for the AES. This would have required some time/location coordination and also some frequency synchronization between the SATCOMs to ensure they had nearly identical values of the frequency offset (around 150 Hz). This has been discussed before here so I won’t rehash it. I don’t see how this is less complex than changing the satellite inclination parameters in the SATCOM to MH370, if that is possible. I am interested in the possibility of spoofing the BFO using relatively simple methods.
@alsm sorry I sincerely didn’t understand that at first, now I understand better.
@VictorI,
thank you for that additional explanation. Not confusing at all. I’m beginning to take the spoofing theory more seriously.
Still, the engineering and other preparations must have been in place well before the payload composition of MH370 was known. Why was all this targeted at this particular flight?
Completely agreed. Have you looked at section (9) of my post (previous page), where I considered handshake response delaying to increase BTO? If possible, this would be the bigger elephant in the room. Since it’s too simple, I am obviously missing something, but what is it ?
Lauren H,
“I just wonder if all of the calculated impact locations on or near the 7th Arc are based on the single BFO data point of -2Hz at 00:19:37.443”.
Not only. The AP hypothesis plays a crucial role in my understanding. More specifically how FMS behaves in AP mode after the flame out of the first engine. Your question is precisely a reason why since January I was asking ALSM many times whether he is capable to check the outcome in AT mode on the simulator. But unfortunately he did not comment…
The close look at the result of my “free-flight” model has revealed that 19:41 BFO is largely affected by vertical velocity component, when the aircraft gains the altitude from ~3 km to 5 km. However, I found it enters a plugoid mode with the period of ~3 minutes, while it should be ~6 minutes (the amplitude of the oscillations slowly decreasing, so only 19:41 BFO is largely affected). I think the reason is that I did not account changes in AoA and the feedback of the actual lift on the AoA. I don’t know how this will impact the terminal point (so far my estimations are around 99-101E, 27-28S), but anyhow I decided to revamp my wind-forcing sub-module to fully 3D to properly account for AoA and SoA (slip angle of attack). It turned to be not as easy as I hoped.
With regard to the spoofing vs “mechanical/electrical failure” scenario: I don’t really understand why would one need to break through a closed window when the entrance door is open?
Very true, and thank you for critically reviewing the line of events I tried to connect. But now imagine that overnight the whole world’s attention focuses on MH370’s Inmarsat data and just as researchers all over the planet, Inmarsat staff starts pouncing on to and poring over the MH370 data … if there was foulplay, they might discover something: log edits, last modification time, deleted backups, BFO/BTO values that don’t add up, unusual switches of night shifts, overheard snippets of a conversation, power outages, unusual maintenance downtime, just to name a few possibilities; generally just any unusual/abnormal activity. And may I also add this from above: CosmicAcademy: “Especially inflight access to the AES would have been tested with an identical Honeywell device and the same satellite. So irregular inflight – logons should be visible in the Inmarsat logs during the last couple of years. Every intern at the company could check for that.” IF the Inmarsat data has been tampered with, I guess the most likely person to find out, would be an Inmarsat staff member. Fairbairn? So you would need someone keeping oversight and preventing leaks.
Maybe it’s General Kehler’s job to prevent things like that. Imagine Russia or China had installed one of their Air Force Generals at Inmarsat right after the disappearance of MH370. People would start asking questions. We should ask the same questions.
With regards to the radar blob, I am not so sure it would be impossible, as the AN124 (or even bigger plane) has quite a big radar footprint anyway, so the smaller B777 would have some margin to. As civilian ATC relies on secondary radar, only military radar could detect the anomaly, and I very much doubt, that military radar controllers (especially in that part of the world and absent any imminent threat) watch 24/7 the exact size and form of each and every radar echo of civilian aircraft on their screens, and even less during their entire flights.
In the case of IH870, Libya probably hid military aircraft in the radar shadow of a DC9-15 (32m x 27m), so maybe you could cover a B777 with an AN124 (69m x 73m) or even lager plane ?
Formation flight required in aerial refuelling suggests that, while difficult, formation flight is not impossible even for large aircraft. Picture of a B707 refuelling a B747: imgur.com/Dov55DP.jpg
And there is also the issue of the radar’s angular resolution, which works in the favour of this ploy. Here is a fighter pilot telling from his own experience:
So the real problem doesn’t seem to be the bigger radar cross-section, but the lack of “suitable Air Interception radar”. Would TCAS be enough to maintain safe distance and avoid a collision ?
To preempt the argument that MH370’s transponder was disabled:
Actually the countries involved should pay you and the IG for your help (in $ or at the very least with an abundance of thankfulness AND the information you need for your work), instead of you paying for data they should be more than willing to give you.
It’s so sad.
@StevanG + spencer: thank you for your additions
The point where I don’t understand your line of thought, spencer, is where you say:“When […] this cover-up is exposed, the repercussions for Najib and Hishammuddin, UMNO and BN will be real and swift.” Why would they cover up (what you suppose is) Shah’s responsibility for mass murder / terror attack? Governments cover up their own misdeeds, not the opposition’s. It’s actually the contrary, they would be eager to expose the opposition’s wrongdoings whenever they can. Maybe I am misconstruing your arguments ?Brock McEwen: “@Peter: […] you are right: of the family of scenarios requiring superpower cover-up, accidental shoot-down near IGARI may be among the least plausible”. Actually I find it very plausible and I applaud you for bringing up scenarios like that which – by definition – will only ever come to light through research or mistake, but never by waiting for an official confession. It’s just that once you start diving into the technical details of this particular theory, it seems to fall apart in this case. With regards to Fairbairn, it’s a ray of hope, that you are following the issue. Please post, when you have further information.
Has this ever been officially confirmed? There were numerous other circulating explanations, e.g. sound came from a search vessel or a TPL. The erroneous blackbox detection was not even mentioned in the MOT report. BTW, do you have a link to this researcher’s statement ?
thanks for reading, littlefoot.
@Littlefoot – you said to @Victor:
“Even if your suggested spoofing scenario is easier to implement than other methods, how difficult would it be for aspiring perps to come by the necessary information?”
The following may (or may not) be directly relevant to Victor’s specific inquiry (AES capability to compensate for satellite inclination), but is very much relevant to the issue of a potential spoof of Inmarsat’s satellite.
VIDEO: Martin Rutishauser — Satellite Hacking
#days Security & Risk Conference 2012:
https://www.youtube.com/watch?v=xIsG8GpB67A
Note @15:35, @28:20 and @30:00 (“Top threats”).
The Germans Rutishauser mentions @15:35 who “broke” Inmarsat are researchers Benedikt Driessen, Ralf Hund, Carsten Willems, Christof Paar, and Thorsten Holz. In 2012, they reverse-engineered the proprietary ciphers used in the GMR-1 and GMR-2 satellite telephone standards — which power the networks of satphone providers Thuraya and Inmarsat.
Comment from ‘OleOle’ (pprune: Malaysian Airlines MH370 contact lost 03.14.14, pg 168, #3346):
“The built-in GPS in the Isatphone Pro is used in part to pass location information to the satellite so that the satellite can assign the proper spot bea[m] to a, Isatphone Pro user. Notice that the spot beams overlap, providing near seamless coverage.
But all the inmarsat stuff is nothing but a rumor as long as there is nothing established about the equipment actually on board”
Recall that MAS removed from its website information stating that all of its 777’s are equipped with SAT phones in business class. Who provides THOSE phones to MAS? Were any of the pax on MH370 possibly carrying an Inmarsat SAT phone?
Also recall Ruben Santamarta’s recent study:
The researchers have uncovered numerous vulnerabilities in software and ground-based satellite systems manufactured by British suppliers Cobham and Inmarsat. Hackers can hijack and disrupt communication links used in various industries including defense, aviation and communications with serious consequences for the population.
“IOActive found that malicious actors could abuse all of the devices within the scope of this study.” That includes equipment for Inmarsat’s Classic Aero services (used by MH370) — which operate on the Inmarsat 3F1 satellite.
Should Inmarsat’s statement then be regarded as a falsehood (“… even though Inmarsat reported that the model had no inclination”) or rather as an innocently simplified truth (inclination is included in the model but was set to zero: “the model is near-geostationary, but the inclination parameter was set to zero by broadcast of the System Table”) ?
@Peter
“Formation flight required in aerial refuelling suggests that, while difficult, formation flight is not impossible even for large aircraft.”
refuelling is done at lower speed to evade turbulence, at cruise speed the turbulence would be much bigger
also a 777 would have troubles catching even somewhat slower plane like AN124
all in all it’s a nice movie scenario and that’s it
@PeterNorton:
First of all, THANK YOU for your posts over the last days.
Re:
“We should ask the same questions.”
Absolutely. There are MANY questions to ask.
A while ago I asked myself “what would be an easiest way to spoof the Inmarsat data”? An apparent answer is to artificially change BTO by a spoofing device installed in some remote location, or onboard of some ship – in such a ‘comfortable’ place where the risks of being disturbed during the operation is minimal. A goal to drive attention from the actual arcs would be achieved. There is no need to spoof BFO as BFO alone is much less informative than BTO. This brought me to the problem:
Is there any stationary location (lon, lat) on the Earth, that would satisfy BFO data (pretend nothing is known about BTO)? The answer is disappointing: no. The minimum RMS error was achieved for ~160E, 0N if my memory is correct, but the residuals were too large to take it seriously.
In other words, it is necessary to spoof BFO to comply with the given data. But why would somebody need to spoof BFO keeping BTO intact? This is a question to those who are trying to combine “spoofing + 7th arc”.
thank you Nihonmama, *dropping-a-curtsy*
the piggyback scenario I pondered on page 5 had two planes collaborating, so their flight paths would obviously be coordinated to match
150m vertical distance (as suggested by the fighter pilot in my quote above) would not be enough ?
This struck me as odd, too. And add to this the somewhat eerie telephone conversation between MAS Ops and KL ATC [starting on page 295 of the MOT report]. The MAS guy seems so indifferent. I know, there is a language issue involved, but still …
@Peter Norton,
I wasn’t quite serious when I suggested to charter an An-124 for a piggypack flight into Kazakhstan. These planes are equipped to meet special needs of a customer but a formation flight in the dark over such a long route would simply not be sustainable, even if there wouldn’t show 2 radar blips. There is only one plane in the world bigger than an An-124 btw: the An-225. That would be the plane to hire for piggypacking because it could literally do it, lol! There’s only one specimen ever built and it’s equipped to transport the Russian space glider on it’s back 🙂
Another more serious problem with a filed charter flight to Kazakhstan in this case for identity switch and proxy service: If it can’t be cancelled later or withdrawn – shortly before mh370 reaches it’s destination, it would look a bit suspcious for investigators if they look at all filed flightplans from that area and see one for a big cargo plane into Kazakhstan, which could actually produce the ping rings of mh370. I wonder if any investigator ever had the idea to look into this?
I think Jeff Wise’s answer to this is that BTO spoofing is even more difficult and unthinkable than the already difficult BFO spoofing:
Hence me asking: Why is that? BFO spoofing seems indeed difficult to me. I’m surely missing something, but BTO manipulation looks easy … of course you cannot speed-up the round-trip time, but you could arbitrarily delay it, thereby creating the illusion of being further away from the satellite than you actually are, e.g. for flying to Somalia while pretending to crash in the SIO, which would by the way corroborate both the Maldives sightings and Katherine Tee’s eyewitness account.What am I missing ?
I’d say a consensus has emerged that something sinister happened with MH370. Did it extend to data manipulation, we don’t know, but crushing the discussion? Why do that? This is a blog for discussion, and the discussion is fuelled by not one piece of aircraft showing up. Talking about spoofing I see as a departure from groupthink and not an example of it. I suppose data manipulation has consequences for any search but so far the search is totally focused on the data as it is and that’s not about to change. It’s really just the usual clash of opinions. Some people’s towers must be visible for miles, but I’ll just have to keep on being “objectionable.”
Did some of our esteemed figures retire too early? Relevance deprivation rears it’s head. There was peak confidence that the plane would be found before now so imagine how that looks for a moment, to the folks who never trusted the data.
@Jay:
Too much weird things happened previous year; for example I never saw critical security bug, not found for 2 years, even having its own logo… (heartbleed.com)
and although I myselelf believe (yes) in something “better together”, notice that around 3/8/2014 there was probably nuclear forces unlocked and advanced anti-ship Bastion rockets deployed at Crimea coast “to be visible from space” as Putin sed – I can even imagine media saturation with something else for some reason by someone; sure, who knows 🙁
Here is full movie (I am not fanatic friend of Russia, here it seems is something well played too, but its interesting to watch anyway – still thinking carefully, sure)
http://www.vesti.ru/videos/show/vid/638944/
@VictorL:
Keep going.
@Nihonmama: regarding your hacking post: http://www.citebite.com/q4j3f0n8i0mms
(surely known to all of you, but just in case)
@ littlefoot: “a formation flight in the dark over such a long route would simply not be sustainable”: none of the autopilot modes (if used in both planes) could help ?
@Peter, As I understand it, the Doppler precompensation component of the BFO is calculated in the SDU using values obtained from the Inertial Reference System in the E/E Bay. So you can change the BFO without getting directly into the SDU. The BTO, however, is a result of processes that are entirely internal to the SDU. I had thought that the SDU was inaccessible during flight, but Gerry Soejatman informs me that this is not the case. So who knows…
@ALSM: re: “SIO must be wrong simply because the plane has not been found yet. What nonsense!”
Another paper tiger. Serious observers who question the signal data – and we are now LEGION – were drawn there by evidence-based logic: the SIO theory predicts several LAYERS of corroborating physical evidence – ALL of which are absent.
37S is not only fast becoming searched out, ALSM – it has always been a humungous question mark to begin with. If they find intact wreckage: how did it get there, with massive swells on the surface above it? If fragmented wreckage: why hasn’t a single searcher (air, land, sea, sat) found so much as a single hunk of plastic?
That means the output of your models is increasingly likely to have been wrong. That leaves either bad inputs (and it would HAVE to be the signal data; a refined fuel assessment this late in the game could only be pure chicanery; if anyone actually TRIES, my Concern #7 will be waiting for them) or bad analysis.
So take our speculation as a compliment to your group’s acumen. It is deserved: you are great analysts – if the signal data was valid, s37-s41 is where the plane should have been. But if your models’ emerging failure does not cause you to at least question its inputs, your group’s investigative skills may need work.
Peter Norton,
If I am not mistaken, JS has earlier clarified that BTO is exactly what it stands for: offset. Actual response time is significantly longer compared to BTO, so it is still possible to change BTO either way. Earlier I was thinking about Diego Garcia because it is one of the closest land locations to the satellite, so that the round trip time would be the shortest, but this appears to be irrelevant.
I am not sure what Jeff meant. Perhaps he can comment by himself.
@Jeff Wise: Thank you. If I understand this correctly, then the reason for you to focus on BFO spoofing (in the 6 parts of your riveting “the spoof” series) instead of spoofing BTO+BFO, has always been the lack of in-flight physical access to the SDU (at least before Gerry Soejatman painted a different picture) rather than the difficulty of altering the BTO from a hacker’s perspective, right ?
(Because as I said, a tool that delays the answer to the handshake request by x µsec would require less sophistication than one calculating appropriate BFO values.)
@Peter,
1) I think Victor may have been the first to point this out: if both BFO and BTO were spoofed, then the plane could have gone pretty much anywhere. We might as well throw up our hands. So I don’t want to believe it — which is very different from saying it’s not true, but it will become very hard to have a rational conversation about what might have happened.
2) I do think it is significant that no one knew that Inmarsat starting recording BTO values in 2013.
3) Some people disagree with me about this, but I don’t think that the BFO and BTO values match very well. If you were going to spoof both, I think you’d do a better job to spoof them so that they matched.
@Peter “150m vertical distance (as suggested by the fighter pilot in my quote above) would not be enough ?”
it might be just enough, but such difference would likely show two spots at some radar, and they would have to overfly many on their trip to Kazakhstan…
“the piggyback scenario I pondered on page 5 had two planes collaborating, so their flight paths would obviously be coordinated to match”
easy to imagine but not that easy to execute(in a way that you could be sure it would pass undetected)
Jeff,
A number of possibilities that do not require in-flight access to the SDU:
1. A hypothetical spoofing device is not necessarily to be installed onboard of MH370. The one, which is onboard, goes down permanently. How difficult is to still its identity? I don’t think more difficult than stilling B777 virtually without traces. Benefit: independence on the actual flight time (range). The aircraft could be seen in the air, while it was landed somewhere.
2. The flow of data could hypothetically be re-routed through some other satellite (if needed).
3. Also, SDU transmits some parcels of data, and the data collection itself takes some time. If the data to be sent (or used) is slightly delayed, but within allowed timeframes, my wild guess is that SDU would wait for a little while. Am I talking nonsense? For instance, if data from INS to compute BFO correction is slightly delayed?
4. Why during flight? SDU could be tampered much earlier; just its malicious functionality could be activated only “when needed”.
Generally, the gain of spoofing BFO is miserable compared to the gain of spoofing BTO. We are coming back to the original sort of questions: what is the benefit of spoofing BFO over keeping SDU completely off?
@Brock,
You say, “That leaves either bad inputs (and it would HAVE to be the signal data…”
I don’t agree. The signal data can be perfectly valid (i.e. un-spoofed) and the analysis and path modelling can be perfectly good (and I have the utmost respect for the modelling work done independently by the many experts all somewhat converging in the same general region) and still result in wrong outputs (i.e. the wrong general region).
I’ll beat my old drum again: THE other suspect INPUT is the later portion of radar track. It provides the starting point of all the path modelling (last military radar return around 18:22). This data point is un-corroborated info from a single source, with suspect credibility.
The last multi-source, corroborated, trustworthy location info is just prior to the time of MH370 going dark:
– pings
– military radar
– civilian radar
– ATC comms
– ads-b
– lodged flight plan
etc. all stacking up.
That latter portion of radar track is the INPUT, I would like investigated. It may actually be THE SPOOF.
Cheers,
Will