A year gone by, and there is not a trace.
At 12:41 a.m. on March 8, 2014, Malaysian Airlines Flight 370 took off from Kuala Lumpur on a flight to Beijing. Some 40 minutes later all contact with the Boeing 777 was lost. At that point the greatest and most disturbing mystery in the history of commercial aviation began to unfold.
An airplane with 239 people on board did not disappear. Rather, we lost the ability to know where it was until, more than six hours later, it ran out of fuel and crashed. That, in itself, is a shocking indictment of an internationally policed airline regime in an age when we assume that all-seeing technologies should make it impossible for anything as important and large as a 330-ton airplane to vanish.
ADVERTISEMENT
Most airplane disasters are teachable moments that the aviation industry learns by. This is the way that flying—still by far the safest form of transportation per capita—becomes even safer. Yet in this disaster there is as yet not one piece of physical evidence to begin that process. There is however a trail of failures that expose serious lapses of responsibility across a wide range of airline and regulation practices.
What follows is an analysis of what is so far known about Flight 370 and a discussion of the issues raised by it—bearing in mind that there has been a persistent lack of transparency in the official investigation and, consequently, an unending stream of wild speculation from other quarters.
THE ONLY LINK—VIA A WOBBLING SATELLITE
The one slender thread that provided the only clues to the final path of Flight 370 led back to a satellite dish, one among many atop an office tower in London. This is the headquarters of Inmarsat, a company that maintains a fleet of communications satellites in orbit above the Earth.
Many of London’s most ambitious techies work near here in a cluster of streets radiating from a murky traffic roundabout above the Tube station at Old Street in east London, a place now known as Silicon Roundabout because of its aspirations to plot Britain’s digital future as an accomplice of Silicon Valley. Inmarsat, however, is not populated by unbarbered nerds; it has its origins in a United Nations agency founded in 1979 and arrived in east London a generation or so ahead of Google, and is staffed by relative greybeards.
Occupying one floor inside Inmarsat’s tower on the edge of the roundabout are two large open-plan control rooms, resembling NASA’s Mission Control in Houston. There are far more computer screens than there are people.
All of Inmarsat’s satellites are monitored from here and usually this requires little human intervention. The displays blink away unattended with streams of data as inscrutable as an ancient Babylonian inscription. These calm procedures were jolted one morning in March last year, a few hours after Flight 370 went missing.
Inmarsat has a ring of satellites aligned with the Equator, orbiting at a height of 22,236 miles—the exact position required to maintain what is called geostationary orbit: The satellites move with the same motion as the Earth, and therefore remain in fixed geographic positions.
When the engineers got news of the missing jet they realized that its flight might be detectable through a system called burst timing offset, in which Inmarsat ground stations automatically send a signal to a satellite and then to a receiving terminal in the airplane. The good news was that if Flight 370 had, as suspected, ended up flying into the Indian Ocean Inmarsat had a satellite covering that region that should have been communicating hourly with the Boeing 777 via “handshakes” that were returned to a ground station in Perth, Australia.
The bad news was that this satellite happened to be one of the oldest in the constellation, called 3F1. The 3F1, because of its age, was wobbling. It didn’t hold a fixed position but moved, or oscillated, a few degrees to the north and south of the Equator. Like somebody nursing an old automobile until reaching its sell-by mileage, Inmarsat had decided that the wobble was tolerable until a new satellite was ready to replace it.
The engineers, led by Mark Dickinson, Inmarsat’s vice president of satellite operations, began searching masses of burst timing offset data that were logged and then stored in the computers in their London headquarters.
What followed was a painstaking process involving calculations far too arcane for a lay brain to follow. They confirmed that the satellite terminal on board the 777 had responded throughout the final hours of the flight and that the Inmarsat station in Perth had recorded seven “handshakes” in the course of the flight. They were also able to tell that the 3F1 had wobbled just over one degree of latitude during this time and their final calculations took this into account.
The first picture to emerge of Flight 370’s flight path was far from exact: The Inmarsat projections showed a huge arc, north and south of the Equator, on the eastern side of the Indian Ocean—extending as far north as the Himalayas and as far south as the “roaring forties,” so-called because of the latitude and wild weather that was notorious from the days of the transoceanic sailing clippers that used the winds to travel between Australia and Europe. This is a huge area spanning the entire open ocean between Australia and South Africa between latitudes 40 and 50.
In Kuala Lumpur other information from radar reports about the likely course of the 777 were sparse and contradictory—and nobody had a clue where the 777 might have gone once it left the areas covered by radar or for how long it flew. Inmarsat contacted the Malaysians and told them that they had the satellite data indicating a course either in the northern or southern arcs of the Indian Ocean.
The Malaysians, increasingly dysfunctional, at first ignored Inmarsat.
Inmarsat then turned to the British Air Accidents Investigation Branch, AAIB, who were among other investigation agencies advising the Malaysians, like the U.S. National Transportation Safety Board, the Australian Transport Safety Board, and the French Bureau d’Enquetes et d’Analyses, BEA. It was the AAIB who finally woke up the Malaysians to the importance of Inmarsat’s work.
The first “pings” between Flight 370 and the satellite were sent before the 777 left the ground at Kuala Lumpur and the final one just as the engines were failing for lack of fuel—with one engine cut and the other losing power the satellite terminal on the airplane, responding to unstable electric power, actually booted up again in order to send the signal.
As Inmarsat refined their analysis of the burst timing offset data that was being extracted from the logs in London, they reinforced their confidence in the accuracy of their projections by applying the same model to the contacts made from the 3F1 satellite to 16 other flights in the air in the region at the same time as Flight 370. In each case the actual track of the flight matched what the satellite data had predicted—and confirmed that Flight 370 had headed south, excluding the northern arc (much to the distress of some conspiracy theorists who had Flight 370 being abducted to places as various as Afghanistan, a secret Himalayan valley, and the U.S. air base on Diego Garcia).
From then onward all the search efforts would be directed to the southern arc.
A BUNGLED SEARCH IN A DISTANT OCEAN
The southern arc began roughly 1,000 miles northwest of Perth, Australia and extended deep into one of the most fearsome and least traveled parts of the Indian Ocean. There could hardly have been a more hostile place in the world for a search. Direction of the international search effort moved from Kuala Lumpur to Perth under a Joint Agency Coordination Centre led by Australia. At first most of the effort was devoted to a fleet of military maritime reconnaissance airplanes that scoured the seas looking for floating wreckage. After many false sightings, the air search ended without any success.
By the end of March an undersea search was underway, led by an Australian vessel, the Ocean Shield, towing a torpedo-like underwater vehicle supposedly able to detect “pings” from a locator beacon attached to the 777’s black box flight recorder (the beacon’s battery was nearing the end of its 30-day life). Australian Prime Minister Tony Abbott announced that pings had been detected and that searchers had established the location of the black box to within a few kilometers.
This turned out not to be true. The Australians had to admit that the equipment on the Ocean Shield was faulty and that the pings might well have come from something on the ship itself.
As winter approached the Southern Hemisphere, and with it rough seas, the undersea search was halted amid a sense of fiasco. It was clear that the unique challenges presented by the search for Flight 370 called for more resources and more sophisticated science—beginning with a mission to map the ocean floor, a terrifying terra incognita that resembled an undersea Alps with volcanoes, mountain ranges, and valleys as deep as 2.8 miles with surfaces covered deep in silt.
Nothing could have been more essential to any investigation than having a minute-by-minute picture of the airplane’s course before it flew off into the great void. And yet it had taken months to sift a reliable timeline from the different sources—air traffic control, military and civilian radars, the Inmarsat data and the airline’s own logs. Now the investigators discovered that a Malaysian Airlines manager in Kuala Lumpur had twice tried to contact the 777 pilots using a satellite phone—and this would prove to be decisive in changing the search area.
I will use the timeline given by the Australian Transport Safety Bureau investigators where the times are given in Coordinated Universal Time, CUT, a more accurate measure than Greenwich Mean Time:
18:19 The last exchange between the pilots and air traffic control—three minutes later the automatic position reporting system, the transponder, stops working.
18:22 The last primary radar return providing a verifiable “fix” of the 777’s direction is made—the airplane is flying northwest above the Straits of Malacca.
18:37 the next discrete package of data from the 777’s Aircraft Communications and Addressing Reporting System, ACARS, is due but fails to arrive . (ACARS data was transmitted at 30-minute intervals.)
18:39 The first satellite phone call from the airline manager in Kuala Lumpur to the airplane. The call is not answered.
Investigators were able to determine from the satellite phone data that by the time the call was made, the 777 had changed course and was then flying south.
Crucially, this narrowed the time window in which the final and permanent change in the airplane’s course had been made—just 17 minutes between the radar fix and the phone call.
This, in turn, determined the change made to the search area—the 777 had made the sudden turn south earlier than had been assumed, and this meant that it would have covered more ocean before its fuel ran out. Hence the search area needed to be extended further south.
The second and final satellite phone call was made at 23:13, and was also not answered.
The current search is planned only to continue to the end of southern summer, in May. So far about 10,000 square miles of the sea floor has been covered—more than 40 percent of the total target area. What remains is the size of West Virginia.
The greatest achievement so far—of value beyond the search—is the bathymetric survey of the ocean floor. Three-dimensional graphics released by the Australians convey a video game-like thrill of zooming through deep trenches, valleys and over imposing chains of mountains. The reality is a lot more challenging: total darkness, deep cold and intense pressure at nearly three miles below the ocean surface.
Three of the search ships tow underwater vehicles equipped with advanced sonar scanners and echo sounders on cables that stretch down as far as 32,800 feet, with the “towfish” following the contours of the seabed at a height above it of about 400 feet. These vehicles constantly stream data to analysts aboard the ships. The fourth ship has an autonomous underwater vehicle (AUV) that is pre-programmed to go closer to the seabed in areas where the terrain is too difficult for the towfish.
Despite now being equipped with some of the world’s best underwater vehicles, the searchers are frustrated by the continued absence of any debris. This frustration is compounded by the extraordinary failure after nearly 12 months to locate any floating wreckage.
Indeed, it is worrying that there is no case in the entire history of modern intercontinental jets where a crash into an ocean has not produced floating wreckage that was spotted within days of the disaster.
Last fall an Australian team combining oceanographers, meteorologists, and environmental scientists began working on a computer model of ocean currents and weather patterns, based on technology used for tracking oil spills, to calculate when and where any wreckage would wash up. An Australian official predicted in November that the most likely place where debris would be carried from the southern ocean was the long coastline of western Sumatra on the Indonesian archipelago, and said that it should begin to show up this March. However, the Australians are still waiting for the drift model to be completed and are not giving any more details until it is.
Of course, the longer the time without any sign of floating wreckage, the more some people in the airline industry begin wondering aloud if the airplane is really where the searchers think it is.
AN INVISIBLE PLANE AND AN INVISIBLE INVESTIGATION
In parallel with the underwater search an international team of air crash investigators has been on the case from within 24 hours of the airplane being lost. In many ways the investigation has been as invisible as the 777.
One of the most vocal critics of the investigation is Sir Tim Clark, the head of Emirates Airline, which operates a large fleet of 777s. In an interview with the German newsmagazine Der Spiegel, Clark seemed to be speaking for many when he said: “All the ‘facts’ of this particular incident must be challenged and examined with full transparency. We are nowhere near that. There is plenty of information out there, which we need to be far more forthright, transparent and candid about.”
Some of Clark’s anxiety springs from a concern that every airline chief and everyone involved in airline safety shares in the aftermath of a loss of this magnitude: Was there a technical failure in the airplane or in the systems responsible for the safety of this flight that we have not seen before—and could it recur? After all, this is always the most fundamental question that an investigation must answer.
Not long after the search began, I suggested in The Daily Beast that rather than look at the timeline from the beginning of the flight it could be more revealing to begin at the end. The investigators came to the same conclusion—they have been reverse-engineering the history of the flight. There has been no public confirmation of this from either Boeing or Malaysian Airlines, but I discovered that an analysis by the Australians of how the southern arc search area was refined included a section on end-of-flight scenarios. Buried in this was: “…the aircraft manufacturer and the operator have observed and documented various end-of-flight scenarios in their B777 simulators.”
This makes it clear that the investigators accept the premise that the 777 flew itself until it ran out of gas—the “zombie flight” scenario I first proposed in The Daily Beast. In their simulator reconstruction, the airplane’s right engine ran out of fuel first, followed by a flameout of the left engine. “This scenario resulted,” the Australian analysis says, “in the aircraft entering a descending spiraling low bank angle left turn and the aircraft entering the water in a relatively short distance after the last engine flameout.”
Something else can be divined from this picture. In order to have calculated an accurate timeline to the exact moment of impact in the ocean, the investigators must have been able to fix when the zombie flight began—when the 777 began flying on autopilot at cruise altitude and speed without any human intervention for more than six hours.
Of course, the salient question is not just when but why—why was command of the flight taken from human hands? This is the crux of the entire mystery. Did that happen before or after the final turn to the south? Was the command given by the pilots or someone else?
Tim Clark himself has said that to deliberately set in train such a drastic change of flight plan while maintaining total silence would have required disconnecting the two primary systems that relayed the 777’s position, the transponder and the ACARS – the latter, he said, demanding more technical knowledge than any of his own pilots possessed.
Or did the pilots do it themselves as part of some bizarre suicide mission for which there was no credible motive?
From conversations I have had with industry insiders, none of whom was prepared to comment on the record, it is clear that there is now a consensus among a number of airline chiefs that some kind of criminal act was involved – although if it was they would have to explain why the outcome was the Zombie flight without any communication from hijackers or a message conveying other motives.
One expert I spoke to with deep knowledge of the Boeing 777 put the chance of the crew being criminally involved at 1 percent, having carefully calibrated every other possibility. And another expert pointed out that there is no recorded case of an airplane being hijacked without the hijackers announcing their intent, either via the crew or by themselves talking to controllers.
It was also pointed out to me that the foul play theory—either by the pilots or intruders—would conveniently serve industry interests far more than the discovery of a technical emergency or an operational failure for which there would be considerable legal liabilities.
“There are many interests here, and they don’t all necessarily align with 100 percent full and candid disclosure at an early date,” a very experienced accident investigator cautioned. “In fact, the motivation for full and candid disclosure by all parties hardly ever occurs in serious accidents, for some very important financial, political, liability and social reasons.”
This January the Malaysians took what was for lawyers a highly consequential decision: they officially declared the flight a loss. Although this final blow of harsh reality fell hard on the families and loved ones of the passengers and crew, it opened the way to what will be years of legal claims for compensation.
International agreements covering compensation for loss of life in air crashes is complicated and varies greatly between jurisdictions. Soon after Flight 370 was lost a Swiss bank calculated that the insurance losses for Malaysia Airlines could reach $600 million. Settlements in the case of Air France Flight 447, lost in the South Atlantic in 2009, are estimated already to have reached a total of at least $750 million and that case is by no means closed.
OCCAM'S RAZOR AND THE CASE FOR A ZOMBIE FLIGHT
Unless investigators can find the wreckage of Flight 370 all present clues to the mystery will remain just that, clues. It’s like trying to solve a murder without the body. No body, no absolutely final explanation.
In the 14th century an English Franciscan friar—who was so much more—called William of Ockham came up with a problem-solving principle that, because of its razor-like simplicity, has often been employed in science and forensics: among competing hypotheses the one with the fewest assumptions should be preferred. Under the name of Occam’s Razor this principle provides a good discipline for weighing the hypotheses of this case.
Essentially, the foul-play scenario stands or falls on believing that human intervention caused both the transponder and the ACARS to stop sending information about where the airplane was. Making the airplane invisible in this scenario was the calculated first and immutable step in a plot to take command of it.
The transponder is not much of a challenge: it can be turned off by using a switch on the flight deck. ACARS is less accessible: disconnecting it on a 777 requires getting into the electronics bay beneath the cockpit, via a hatch between the airplane’s forward galley and the cockpit door.
In the electronics bay is the 777’s electronic brain center, its Airplane Information Management System, AIMS. Everything involved in the management of the flight – how the airplane is flown in real time – comes together here including the data for the cockpit information displays, monitoring of all its conditions including the cabin climate and the reception of data from the ground and the transmission of data back either directly to the ground or via satellite. (External antennas route the signals from the transponder and ACARS.)
AIMS, then, is the gateway for all communications from the cockpit. This is important because it means that both the transponder and ACARS, instead of being deliberately disconnected, could be disabled by an electrical fault or fire in the electronics bay. Indeed, one pilot told me that one reason why pilots would be loath to accept making it impossible to switch off the transponder was that “you usually want the ability to isolate and switch off any electrical system where there is a fire risk.”
It’s time for a cut from Occam’s Razor. Which hypothesis makes the fewest assumptions: that someone, the pilots or intruders, deliberately disconnected the transponder and ACARS, or that they were disabled by an electrical failure or fire?
Human intervention makes a string of assumptions:
Criminal motivation and an expertly researched and executed plot carried out in a very short time; physical effort to take command of the airplane (or, if the pilots, to combine continuing command with an extraordinary diversion of physical effort); to open a hatch openly visible to passengers and cabin crew, enter the electronics bay and pull circuit-breakers with prior knowledge of where they would be.
Electrical fault or fire makes one assumption of the cause:
A single-point failure in the electronics bay that not only disables the transponder and ACARS but leads to the incapacitation of the crew. All airliner architecture is predicated on avoiding the possibility of a single-point failure that jeopardizes the airframe, and all critical systems are supposed to have three levels of “redundancy”—the airplane should still be able to fly having lost two of the three of those systems.
Then, at the center of the zombie flight scenario, is the question: What would incapacitate the crew while leaving the airplane fully functional under command of the autopilot?
The obvious suspect is hypoxia. This is the condition suffered as a result of a sudden or gradual depletion of oxygen inside the cabin and cockpit. David Soucie, who has 30 years of experience as an aviation safety inspector and accident investigator, has just published a cogent and careful assessment of the available information on Flight 370.
He cites the most recent case of a crash caused by hypoxia, Helios Airways Flight 522 in 2005, where a depressurization fault meant that as the airplane climbed to cruise height the oxygen supply was severely depleted. Pilots and passengers lost consciousness and—despite the efforts of a flight attendant alert enough to grab a portable oxygen supply—the airplane remained on autopilot until it ran out of fuel and crashed into a Greek mountain. Soucie concludes that Flight 370 suffered the same effects but from a very different cause.
“I believe,” he writes, “that what most likely happened to MH370 is that pilot Zaharie Ahmad Shah detected an electrical outage followed immediately by severe smoke in the cockpit less than one minute after signing off with Kuala Lumpur air traffic control.”
He suggests that the fire originated on the left side of the electronics bay where the communications systems are housed, including the circuits involving the transponder and ACARS. A fire confined to that location would leave untouched the autopilot systems that were 15 feet away. Overcome by the severe smoke in the cockpit the pilots were unable to report their plight over the radio, Soucie argues, because a tight seal muffled the microphones in their oxygen masks. (A fire in the electronics bay would not have affected the radio.)
Soucie points out that the sudden turn left away from the flight path to Beijing is consistent with the pilots attempting to head for the nearest airports at Langkawi or Penang. Indeed, another expert I spoke to said “the crew may still be proven to have been making heroic efforts to try to save the jet before they passed out.”
Soucie is so concerned about hypoxia that he proposes that airliners should be fitted with a device to detect loss of oxygen before it becomes fatal, and sets off an alarm—an airborne equivalent of the canary in the coalmine.
Ironically, the oxygen depletion caused by smoke and fire would also finally have also killed the fire itself, having first asphyxiated all the humans on board, while leaving the autopilot set on the southern course that was intended only as the first phase of heading for an emergency landing.
Looking for other possible locations where a fire might originate would have to include looking at the cargo bay and, specifically, any significant items loaded on to the 777 before it left Kuala Lumpur. One item in particular jumps out from the cargo manifest: a consignment weighing 5,400 pounds that included a large number of lithium-ion batteries, radio accessories and chargers.
Tests conducted on a similar consignment of batteries in a cargo hold by the Federal Aviation Administration have shown that they are vulnerable to a “thermal runaway” when one battery overheats and a chain reaction occurs. In several of the tests, smoke and fumes reached the airplane’s cockpit in less than 10 minutes. Another test caused an explosion that blew open the cockpit door. This week United Airlines joined Delta in deciding to no longer carry shipments of the batteries in the cargo holds of passenger flights.
Cargo holds have automatic fire-suppression systems but they are not effective against lithium-ion battery fires. Even if a battery fire was retarded by the lack of oxygen at cruise altitudes, it could still release toxic fumes that could easily penetrate the cabin and flight deck. It’s therefore possible that, like an electrical fire in the electronics bay, it could incapacitate passengers and crew.
However, this scenario, which I otherwise find credible, has a serious weakness that so far I have not been able to solve. It would not explain how a cargo hold fire would take out the transponder and the ACARS systems in the separate electronics bay. And it is also possible that a cargo hold fire would have reached and compromised parts of the airplane’s structure that would have made it impossible for the 777 to continue flying as it did.
All of this makes the cargo-hold fire scenario far less persuasive than a fire in the electronics bay.
A DIALOG WITH THE DEAF
No airplane needs to disappear like Flight 370. The technology to keep track of all flights over oceans has existed for a long time and is relatively easy to adopt.
The essential point is that all the information crucial to understanding both where and why an airplane has gone down is stored in its flight data recorder and continually updated in real time. The kind of data specifically needed in the event of a crash is twofold: location fixing and system or human failure. This data, crucial for any investigation, is a relatively small proportion of the thousands of data points that monitor every facet of an airliner’s performance in flight.
It seems absurd to still be dependent on a principle dating from the 1950s that all the data required by crash investigators should go down with the airplane, contained in the black box (more accurately the flight data recorder and the cockpit voice recorder). Both are designed to survive crashes on land and at sea, and most always do, but many major air routes cross-oceans and we know now that fishing black boxes out of oceans is always hugely challenging and expensive.
As for the need to do it better, there have been plenty of warnings, particularly since the loss of Air France Flight 447 in the south Atlantic in 2009. Soon after that event, the French investigation agency, the BEA, recommended that it should be mandatory for airliners to regularly transmit basic flight parameters (for example, position, attitude, speed, heading).
In 2010 the BEA reinforced their argument in a striking experiment. Using data from 44 previous accidents, they simulated 597 crashes spread around the world’s major air routes in which real-time streaming replaced black boxes. In 85 percent of the crashes the streamed data would have provided as much data as the black box—and in 82 percent of those cases would have pinpointed the location of the wreckage to within a four-mile radius.
As urgent and specific as these proposals were, they were part of a prolonged dialogue of the deaf. Agency speaks to agency, they each form “task forces” or “working groups,” and they hold conferences and seminars. What happens?
Nothing.
At the top of the bodies representing the world aviation industry is the International Civil Aviation Organization, based in Montreal. The ICAO has bureaucratic paralysis built into it—it’s a United Nations body representing 191 nations and arriving at a consensus for any action takes ages. The other major partner in the dialogue is the International Air Transport Association, representing 250 airlines, 85 percent of the world total. It has less trouble reaching a consensus but the consensus it reaches is invariably driven by commercial interests that are never inclined to take effective action on issues of safety.
What are these bodies actually proposing?
The IATA’s Aircraft Tracking Task Force, formed after Flight 370 was lost, and an industry team formed by the ICAO, together finally came up with this masterpiece of fudge in January: “The group will ask ICAO to debate and finalize the concept of operations as a first step in creating new global standards…”
Observe the classic and contradictory code words: “ask,” “debate,” “concept,” and “first step.”
Dive into the fine print and it emerges that it would not be until 2025 that all the systems required to provide a state-of-the-art tracking system would be in place and “fully compliant.”
A BLACK BOX IN THE CLOUD
On September 1, 1983, a Korean Airlines 747 with 269 people aboard was shot down near Moneron Island in the Sea of Japan. It had strayed unknowingly into air space controlled by the Soviet Union and, misidentified as a U.S. spy mission, was destroyed by a Soviet fighter jet. It was one of the most inflammatory incidents of the Cold War, prolonged by the time it took to locate the wreckage.
Inmarsat was originally tasked by the United Nations to provide real time tracking for the world’s maritime merchant fleets. After the Korean Airlines incident Inmarsat executives realized that their maritime satellite tracking system could be readily adapted to track airplanes. They began offering this service in the late 1980s. Today, 80 percent of the world’s wide-body airline fleet uses Inmarsat for the transmission of ACARS and position reporting.
Inmarsat is now working on what it calls a “black box in the cloud,” giving an airplane the ability to stream in real time a predetermined package of the same data being fed into the flight data recorder where it is sent to a satellite and then into the same ground networks that airlines use for receiving the ACARS messages. More saliently, the same system could detect any deviation from the flight plan and instantly begin transmitting fault messages that indicated a problem—and provide an accurate navigation fix before an airplane hit the ground or plunged into an ocean.
“Inmarsat is the pipe, we have that capability” David Colley, their vice president for aviation told me. These emergency-triggered messages would override all the other data being sent from the airplane. Colley explained the principles applied to such a system: “Priority, precedence and pre-emption. Priority over other users of the network and pre-emption in the worst case scenario when there is congestion on the network and safety is an issue.” All it requires in an airplane to add this channel of data to the ones already going through the Inmarsat satellite network is a $20 cable. But—of course—it’s not that simple.
I asked Colley what the total cost would be of installing the black box in the cloud.
“That’s a very difficult question,” he said. “We don’t know what modifications would have to be made to the flight data recorder. Usually we work on a rule of thumb principle than any change in an aircraft starts at $50,000 just for the certification and paperwork, even for the most basic change, even for putting in a $20 cable. It will cost $50,000 for the first aircraft and, of course, might diminish with scale. And the organization on the ground to receive it has to be in place and, as I understand it, it isn’t.”
Enter the usual suspects, the ICAO and IATA. What they are now proposing is to “move toward the adoption” of a Global Aeronautical Distress and Safety System, GADSS, This is not as ambitious as the black box in the cloud, simply that all airliners should send data that enables them to be tracked “at least every 15 minutes”—not that the system should also be capable of sending automatic warning of an impending crash.
In the absence of any sense of urgency from the two sloths, some people in the industry are acting on their own initiative. Airbus is asking European regulators to approve fitting the two largest of its wide-body airliners, the A350 and A380, with ejectable black boxes. Many military aircraft have this device—an additional flight data recorder combined with a cockpit voice recorder that ejects on impact with water and floats and includes an emergency locator transmitter that emits pinging to guide searchers to the site.
This would give another level of cover in the case of over-water flights by large airplanes but it still involves a search in a time-critical situation in what could be a hostile environment—and a dependence on locator beacons that have proved to be unreliable. It’s hard to see why this system would be preferable to one like the black box in the cloud that uses tomorrow’s technology rather than yesterday’s.
The boss of Qatar Airways, Akbar Al Baker, a famous curmudgeon with little patience for bureaucracies, announced recently that his airline would fit all its airplanes with a system to continuously stream in real time all the data from the black box related to tracking. So far other airline chiefs have sat on their hands, using the ICAO and IATA proposals as their cover.
However, there could be another motivation to get faster action from the airlines—a nakedly commercial interest. When it comes to inflight cabin communications and entertainment, airlines are suddenly a lot readier install new technology to provide the Wi-Fi, live TV, texting and cell phone connections that passengers are craving.
All that business is a big market for satellite fleet operators like Inmarsat who would have a strong interest in consolidating their contracts with airlines by adding better tracking as part of the package—once it was approved by the regulators.
Inmarsat isn’t the only satellite operator in that market nor the only one offering a better flight tracking system on the back of its existing business. Iridium, based in Virginia, has 66 satellites now operating and from this year will launch a new generation of satellites designed to use a tracking system developed by a subsidiary, Aireon. European companies are also competing for a piece of the market.
Defending the contrast between their alacrity to upgrade cabin playtime and their absence when it comes to upgrading safety systems, the airlines plead that entertainment systems need minimal clearance from regulators like the FAA whereas any safety system involves prolonged and expensive certification. But this is a shameless dodge—safety should override everything.
NO END OF A LESSON
There are urgent lessons to be learned from the case of Flight 370 that don’t depend on finding the wreckage, wherever it is.
The first concerns responsibility. And the absence of evidence does not exclude one primary responsibility: Who is responsible for tracking the flight?
Sir Tim Clark, the Emirates boss, told Der Spiegel: “MH370 should never have been allowed to enter a non-trackable situation.”
But Sir Tim himself, who among all the airline chiefs has been unusually vocal in his dissatisfaction with the investigation, is among those who share the collective responsibility of his own industry. The loss of Air France 447 exposed the particular vulnerability of wide-body jets over deep oceans once they leave radar coverage. The response of French investigators was quick and correct: the technical means existed to remove this blind spot. It was clear, too, that the immediate solution was to give the priority to overwater routes.
It is the industry that has been derelict and it is the industry—not simply Malaysian Airline—that is responsible for the “non-trackable situation.”
The second lesson involves something less tangible but equally worrying, the cultural influences on the way the emergency was handled.
Malaysia has been a one-party state for decades and, like all one-party states, has a reputation for cronyism and sinecure appointments in government-controlled businesses—in this case an airline, the management of airports, and air traffic control. From the moment Malaysian officials began giving press briefings their behavior reflected how unused they were to public accountability.(and how used they were to a compliant media.) Very quickly, as the pressure mounted on them for explanations, they combined paranoia with a search for scapegoats—and found them in the captain, Zaharie Ahmad Shah, and the copilot, Fariq Abdul Hamid.
There was a very public police raid on Captain Shah’s home, where he had a flight simulator installed on his computer, and inferences that he had planned and rehearsed the whole diversion from the route to Beijing on the simulator. (After several months the FBI analyzed his computer hard-drive and nothing incriminating was discovered.)
Officials appeared and disappeared and any theory they voiced passed straight into the news cycle, once there it was difficult ever to discredit or dislodge. The most bizarre intervention was by a very influential former Malaysian prime minister, Mahathir Mohamad, who suggested that the CIA had hacked into the 777’s navigation system and spirited the whole airplane away.
More seriously for the incoherence it brought to the picture of the flight’s first two hours was a statement saying that according to Malaysian radar returns the 777 had suddenly soared up above 40,000 feet and then descended rapidly. Another version had the airplane flying just above wave height to avoid radar.
This was all nonsense, resulting from an inability to interpret what the radar track actually showed.
As the 777 flew west above the Straits of Malacca it passed through overlapping radar zones operated by Singapore, Malaysia and Thailand. There was a lack of coordination between civilian and military radars—Thai military radar had indeed picked up the flight but did not report this until 10 days later. There was no coherent and practiced system to swing into action in an emergency and no playbook to give priority to search and rescue operations.
There cannot be variations in airline safety regimes according to who runs a country or how. These days everybody wants to fly everywhere. There needs to be an international standard of safety that passengers can trust is being enforced consistently, no matter on what continent. That standard has to include, as well as the airlines, the management of airports and airspace and all the background support services like airport security, maintenance checks and crew recruitment, training and regular proficiency testing of pilots.
And then there is the issue of the investigation. Nobody I have spoken to in the industry is happy with the way this is going. The protocols for the conduct of an investigation seem far from clear. To be sure, there is no precedent in the history of commercial aviation for the task facing the investigation into Flight 370, combining such a great loss of life with the absence of any physical evidence for this long. As one expert said to me: “We will not know what happened here to a high probability until and unless we get real and conclusive data from actual key parts of the aircraft.”
Not having that data is no justification for the continued lack of transparency from the investigation—after a year we should really be told, at the very least, where the primary focus of the investigation is headed. This transparency should reflect the strong public interest in understanding what has so far emerged and the implications for future passenger safety. In the absence of reliable information this has been fertile ground for speculation and conspiracy theories, all of which damages public confidence in air travel.
The parties to the investigation include Boeing, Rolls-Royce, Malaysia Airlines and Malaysian police and regulators as well as investigative teams from the U.S., Europe, Asia and Australia. The Australian Transport Safety Bureau has restricted itself to regular technical reports on the underwater search and the science behind the choice of search area. After over-optimistic statements by the Australian prime minister and other Australian officials, the drift toward foot-in-mouth disease was halted. None of these parties is talking or, it would seem, is aware of the outrage of their silence.
