[UPDATE 2/23/15: An updated version of “Spoof,” including an extensive introductory section explaining the investigation into the disappearance of MH370, is now available as the Kindle Single “The Plane That Wasn’t There: Why We Haven’t Found MH370″ – that lovely cover image to your right.]
Let’s suppose that you’re the leader of a group of people who feel unjustly persecuted. Collectively, you were once a Colussus who stood astride the world. But the winds of change blew, and you have come down in the world. Now the great powers of the world try to push you around because they think you’re weak. You simmer at the indignity of it. You know that you, and your people, are magnificent. If anything the suffering of the recent past has only made you better, leaner, more cunning. It has deepened your soul. It has made you even more worthy of greatness, and if the great powers choose to slight you, they will do so at their peril.
You will not fight the way they do. They are fractious, complacent, weak-willed Philistines. You are nimble, cunning, and patient. When they thrust, you will feint. When they dither, you will swoop. You will strike without their even having realized that they’ve been struck. Or at least without their being able to prove you did it.
As an individual, you have operated this way your whole career—dirty tricks, covert ops, special forces—and it has brought you to the top. Beyond the top: you have transcended to a new level of power not seen since the age of emperors. Now you deploy your dark skills with greater imagination than ever before. Within your organization you have a group of engineers and technical experts that you call upon to discover and exploit the enemy’s weaknesses. Let’s call it the Dirty Tricks Department. Their brief is to cast as wide a net as possible in identifying new vulnerabilities and figuring out how to exploit them.
In 2009, an incident occurs that sets the minds of the Dirty Tricks engineers whirring. On June 1, 2009, an Air France jet en route from Rio de Janeiro to Paris suffers a catastrophe halfway across the ocean and vanishes. Because it’s out of radar range of air traffic control, and out of radio contact with controllers in either South America or Africa, it’s many hours before anyone realizes it’s gone. The only way that its known to have crashed is that the plane’s computers have automatically been sending maintenance messages to the airline’s headquarters in France. These so-called ACARS message were sent every minute, and included GPS data that marked the plane’s exact location when it disappeared. Even so, because of the great depths of the mid-ocean abyss, it takes two years to locate the plane’s wreckage and retrieve the black boxes.
Around the world, aeronautical engineers sharpen their pencils and set out to use the lessons learned from AF447 to make sure that nothing like it ever happensd again. But that’s not what the Dirty Tricks crew is after. They wonder: is there a lesson in AF447 about how to make an airliner disappear?
The director of the think tank calls together a meeting of the best and brightest minds from the aviation, aeronautics, avionics, special operations, human factors, satellite communications, airline operations, air traffic control, and radar system departments. Fortunately, this country is a world-class competitor in all of these industries so there is no shortage of talent.
They sit around a big table and spitball ideas.
“Okay,” the director says. “Our mission today is to figure out how to make a modern airliner vanish from the sky.” He points at sober-looking fellow across the table. “Air Traffic Control, start us off.”
“Well, at one level it’s easy,” Air Traffic Control says. “Just do like AF447. Wait until the plane is over oceanic airspace, take control of the cockpit, and shut down ACARS. As long as you don’t use the radio or the satcom, you’ll be dark. You can fly wherever you want to. And, as we saw in AF447, it will be hours before anyone even realizes you aren’t where you should be. You’ll be long gone. Stay away from military radar and no one will have a clue where you went.”
Airline Operations objects. “Hang on,” he says. “That’s nice in theory, but before you do all that, you have to take control of the plane. Even if you can figure out how to get through that locked, reinforced cockpit door, one of the pilots is going to be getting on the horn and calling Mayday, or setting the transponder to the hijack code.”
The room falls silent. After a long pause, Aircraft Manufacturing pipes up. “Well, there’s something I noticed a long time ago that I thought might come in handy some day. Not many people realize this, but everything in a fly-by-wire plane is ultimately controlled by the computers in the electronics bay. In Airbus planes, the hatch to the electronics bay is located inside the cockpit. But in Boeing airplanes, it’s accessible from the front of the passenger cabin.”
“Locked, surely,” the director says.
“No, most carriers leave it unlocked,” says Airline Operations. “All you have to do is pull back a carpet, lift a handle, pull open the hatch, and you’re in. Here’s the kicker: the hatch is tucked away near the front lavatories and the galley, so you can’t even see it from the main cabin. I think it would be fairly easy to sneak into.”
“That seems like a fairly obvious vulnerability. I’m having a hard time believing that the airlines would allow that in a post-911 world,” says Air Traffic Control.
“Well, not many people know about it,” Airline Operations says. “Plus, the area where the hatch is located is fairly heavily trafficked by flight attendants, especially during food and beverage service. Also there’s a camera that the flight crew can use to monitor the area. But they usually only check it when someone’s asking to come into the cockpit.”
“Is there an alarm or indicator in the cockpit that tells the flight crew that the hatch has been opened?”
The director tents his fingers and leans back in his chair. “So you get a special forces operator into first class, have him wait for a quiet moment when the flight attendants are out and about in the cabin, and then duck into the electronics bay. Once he’s in, what can he do?”
“Anything,” says Avionics. “He has direct access to all the computers that control everything on the plane. He’s even got access to the air tanks that supply emergency oxygen to the cockpit. Oh, and he can disable the cockpit door.”
“Could he monitor the plane’s location and communications without the flight crew realizing it?”
“Sure. And when the moment was right, he could disable the flight crew’s ability to steer the plane or contact the outside world. He’d have seized control without anybody up top realizing it.”
A snort comes from the other end of the table. Human Factors is shaking his head. “Not for very long. If a pilot loses control of his plane like that, his first thought is going to be the electronics bay. And yes, it’s easy to get into, but it would be easy for the plane’s crew to get into, as well, and take back control.”
Avionics doesn’t bat an eyelash. “So you depressurize the plane. Let the air out of the cabin. Cut the air flow to the cockpit. In the cabin, the air masks automatically deploy, there’s pandemonium and panic until the oxygen generators get depleted after fifteen minutes. The special operator has a mask with him, so he just sits in the electronics bay until the commotion dies down, then he repressurizes the cabin, climbs out, and flies the plane from the cockpit.”
Human Factors clucks. “And all the passengers and crew are dead.”
“I like what I’m hearing,” the director says. “We’ve got control of the airplane, it’s dark, we’re in the middle of the ocean, we’ve got a couple of hours before anyone realizes anything’s amiss. The only requirement is that the plane has to be a Boeing.”
“Assuming we don’t have any special operators who’ve been trained as airline pilots,” Avionics says, “we’re going to need a Boeing 777 or 787, because these are the newer models with autopilots sophisticated enough that the plane can land itself.”
The director jots on a pad of paper: “Boeing 777 or 787,” and sets down the pen. “Now we’ve got this plane. How do we get it home?”
“This has to happen in the middle of the night, obviously,” says Satellite Imaging. “You need to be on the ground before sunup so you can put it in a hanger, or bury it, or refuel it and fly it off. Otherwise a surveillance satellite is going to catch a 777 where it shouldn’t be.”
The director makes a note. “Do we have to nab it someplace that we can fly to friendly territory entirely over water, so it doesn’t get picked up by radar?”
Military Radar pipes up. “No, so long as you do it in a developing region. Only about one percent of the world is covered by active primary radar. A lot of countries don’t bother to even turn on their sets at night, or if things are quiet with their neighbors. Even in areas where there’s a lot of tension, and a lot of primary radar coverage, there are ways to get through. Fly right down the top of a border, and each guy will assume it’s the other guy’s responsibility.”
The director writes, “Third World.”
A man in dark glasses raises his hand. It takes a moment for everyone to realizes that he’s Spec Ops. “This operation has all the makings of a total disaster.”
“Why?” the director asks.
“First of all, you can’t take over a plane with one guy. Human Factors is right—it would be too easy to pry him out of the electronics bay. You need some muscle to control the cabin.”
“How many guys would you want?”
“What’s the minimum you could do it with?”
“I don’t know. Four.”
“This isn’t my area, but it seems to me the more people we have on the plane, the more suspicious it’s going to look,” says Airline Operations.
“Could you do it with two?” the director asks.
With a pained expression, Spec Ops raises his hands in resignation. “Fine, two, whatever.”
“And they should be carrying passports from a different country,” Airline Operations says. “And be sitting in a different part of the plane. Put them in the back.”
The director makes a note: 2x muscle, economy class.
“But I’ve got an even bigger problem with all this,” says Spec Ops. “You think you’re being sneaky, but you’re not being sneaky at all. What you’re describing is a hijack, and it’s going to be treated like a hijack. You’re going to have all the big intelligence services putting this heist under a microscope, and their going to pick up all the mistakes you’ve made
along the way.”
“So what do we do?”
“Swiping the plane is just the start of your problems,” Spec Ops says. “What comes next is the hard part. This is where the artistry comes in. When this plane disappears, it’s going to cause a huge commotion. Huge! Remember how AF447 was in headlines around the world? Everyone’s going to be talking about this. It’s going to dominate the news cycle. Everyone on the planet is going to be demanding answers.”
“That could be useful,” Human Factors interjects, “if we need to distract attention from some other Dirty Trick somewhere else.”
“Good point,” the director says.
“At any rate,” Spec Ops says, clearing his throat, “if you just plain swipe it, the heat’s going to come down. What you want to do is leave it looking like something else happened. Like, when AF447 disappeared, there was no international criminal investigation. Why?”
Avionics leans forward. “Because we already knew what had happened, more or less. Air France had gotten automated messages from the ACARS system that detailed what specific systems on the aircraft had failed. So the investigators knew that there was thunderstorm in the area. Problems with the pitot tubes. It didn’t quite make sense, but everyone had a rough sense of what had gone wrong.”
“Right,” says Spec Ops. “So there was a mystery, but everyone knew what kind of mystery it was. So they spent two years happily searching for the plane, content in the knowledge that there was nothing else they needed to do.”
“So we make it look like an accident!” the director exclaims.
“Or something. The point is, we need to make it look like something else,” says Spec Ops.
“How?” the director says. “How do we do this? I’m throwing this out to everybody in the room.”
Avionics pipes up. “Well, obviously, it’s going to have to involve either the High Frequency radio or the satellite communications system. Those are the only ways that anyone on the ground is going to know anything about a plane that’s out over the ocean. But the radio is too unreliable. Let’s assume we send out some kind of false clue over the satcom.”
“Can we doctor the ACARS messages?” the director says. “Maybe the system reports back to home base that there’s a fire on board, that they’re heading out even further into the open ocean, there’s multiple systems failures, they’re going, they’re going—poof!”
Human Factors is visibly excited. “Yes, and at the end, the plane’s messages will indicate that it doesn’t know where it is—it could be anywhere in a thousand-mile radius, off the coast of Antarctica somewhere. Everyone on the ground will think, ‘Well, we know where it went, but we’ll never find it. It took us two years to find AF447 and that was only six miles from its last reported position!’”
“Whoa, whoa, hang on there!” Avionics is holding his hands in the air. “Forget about it. We’re not hacking the ACARS system. It’s sending too many kinds of information—location, airspeed, systems status. It’s too complicated. Too many opportunities to make a mistake and get caught. It has to be much, much simpler than that. I say we turn off the ACARS altogether. They’ll assume it was taken out by an electrical fire or something.”
“So no ACARS,” says the director. “But we’re leaving on the satcom system itself. If the ACARS is turned off, what kind of signal will the satcom be sending to the outside world?”
“Unless our guys make a call or send a text, nothing,” says Airline Operations.
“Not nothing,” says Avionics. “If you don’t use the satcom system, but just leave it on, then every time someone from the outside tries to call in or send a text, the satellite and plane will exhange signals, even if the guys on the plane don’t respond. Also, if nothing like that happens, then every hour the satellite will check back in with the plane to make sure it’s still there. It sends a brief message called a ‘handshake’ or a ‘ping.’ And the satcom system will send back short message acknowledging that it’s still logged on.”
“Does this tell anyone on the ground anything about where you are?”
“It depends,” says Avionics. “If the airline subscribes to the cheapest level of Inmarsat subscription, called Classic Aero, it doesn’t provide any clues about where the plane is. But if the airline subscribes to one of the more premium subscription levels, Inmarsat will log the plane’s location every time it calls in.”
“Which one would be better for this operation?” the director asks.
“Classic Aero, definitely. That position data is too hard to fake.”
“Okay,” says the director, jotting on his pad. “Classic Aero it is. So now, every hour the plane is sending a signal to the satellite, but it’s not including any information about where it is. So how do we get the folks on the ground to believe the plane is going one direction or another?”
“I don’t know,” says Avionics. “This wasn’t my idea. Ask Spec Ops.”
Spec Ops shrugs.
“Is this plan even going to work?” The director wonders aloud.
For a long time no one says anything. It’s starting to get on toward lunchtime, and a few of the participants are secretly hoping that the director will give up on this morning’s project so that they can hit the Dirty Tricks Cafeteria, which despite its name is really quite good.
Finally, a hand goes up in a corner of the room. It’s a young man that no one had noticed before, a junior engineer from the Satellites department. “Um, sorry, but, uh, there is something I’ve noticed that’s kind of interesting. See, when we’re monitoring our communications satellites, one of the things that we always log is the frequency that the airplanes and other customers are transmitting at. You see, when the satellite is looking down at the earth, it’s got a line of sight to literally billions of radio-frequency transmitters, everything from walkie talkies to microwave ovens. In order that our customers’ signals don’t get swamped, they have to transmit within a very, vary narrow frequency range. So we log all those signals, and if the frequencies starts to get out of whack, we know we’ve got a problem we need to fix.”
“Go on,” says the director.
“When one of our customers is just sitting on the ground, there’s no real problem. His sat phone just needs to know the right frequency to broadcast at, and everything will work fine. But when an airplane is sending a signal, there’s an extra complication. The plane’s motion tends to distort the frequency of the transmitted signal just like the motion of a speeding train changes the pitch of its whistle. If we don’t correct it, the signal will never get through. So inside the Satellite Data Unit, or SDU, on every airplane—that’s the box under the antenna that controls the antenna and communicates with the other systems on the aircraft—there’s a computer that shifts the frequency that the signal is transmitted at, so that when the satellite gets it, it will be at just the right frequency.”
“I’m listening,” the director says.
“There’s two ways to adjust the signal. The first is to measure the frequency of the signal coming from the satellite, compare it to what it should be, and use that difference to adjust the frequency of your outgoing signal. That’s how SDUs manufactured by Raytheon do it. The second method is to ask your navigation system where you are and how fast you’re going, then calculate your velocity relative to the satellite, and use that value to compute a frequency adjustment. SDUs manufactured by Honeywell use this method.”
“Okay,” the director’s says, his eyelids drooping almost imperceptibly.
“Now, both methods work just fine, but Honeywell SDUs have an interesting feature. The algorithm they use to calculate the frequency adjustment assumes that the satellite is sitting still in its spot over the equator. In fact, though, geosynchronous satellites never sit perfectly still. They tend to wander off and start to wobble in their orbit, like the edge of a warped LP. So when we launch these satellites, they go up with several year’s supply of rocket fuel so they can fix their wobbles. What happens over time is that eventually the fuel runs low, and the satellite starts to wobble more and more, up and down in its orbit.”
The director’s eyes have glazed over and a droplet of drool is perched at the edge of his lip, but Avionics is bouncing in his seat. “I see!” he says. “So the algorithm doesn’t take this wobbling motion into account, and instead of perfectly adjusting the frequency, it will leave behind a signal that will hint at the relative velocity of the plane and the satellite.”
“Right,” says the junior engineer. “And if you can break into the electronics bay you could cut the cable that runs from the navigation computer to the SDU, replace it with a custom-made box rigged up by our engineers that will feed it incorrect data. The frequency-adjustment algorithm will calculate a value that, when the hourly signal is received by the satellite and logged on the satellite company’s computers, will imply that it’s going in a different direction than it really is.”
The directory is fully awake again. “How hard would it be to build this kind of box?”
“Impossible for all but the very best engineers,” he says. “Fortunately, ours are the very best.”
The director puts pen to paper. “I’m getting this down,” he says. “Okay, so the plane has to have a Honeywell SDU, not a Raytheon one.”
Avionics adds, “And it has to be flying in an area where the Inmarsat satellite is running low on fuel.”
Satellites says, “Also, this hack has to start someplace close to the equator, because the satellite wobbles on a north-south axis. We can make it look like it’s going south when it’s really going north, but we can’t make it look like it’s going east when it’s really going west.”
“This is starting to look like a very, very specific hack,” the director says. “It has to be a 777 or 787, flying at night near the equator, in an area served by an Inmarsat satellite that’s low on fuel. And the route has to go north toward one of our friendly territories over either open ocean or developing countries, with an opposite spoof route to the south that heads out into remote ocean. And the plane has to be equipped with a Honeywell SDU, with an Inmarsat Classic Aero subscription.” The director puts down his pen. “Are there going to be any flights that actually fit all these criteria?”
“Well,” says Avionics, “let’s check.”
“Sure, let’s check,” says Human Factors, “But I can’t think of a single reason why we’d ever want to pull off a stunt like this.”
The director taps his pen on his pad and flashes a cryptic half-smile. “You never know,” he says. “You never know.”
The Spoof, Part 2: How (A Speculative Scenario)