Hostile takeover or suicide mission
Was Flight MH370 hijacked in a hostile takeover by a third party or diverted in a suicide mission?
Explanations for the diversion and loss of Malaysia Airlines flight MH370 on Saturday, 8 March 2014 fall generally into three areas: 1) some kind of technical problem on-board (electrical, fire, etc.); 2) a rogue or suicidal pilot; or 3) a hijack or hostile takeover (which was ultimately unsuccessful). This article explores how the focus on each scenario has shifted over time and, since the release of the Safety Investigation Report MH370/01/2018, should re-focus on hostile takeover because, as the Investigators stated, the possibility of third party intervention cannot be excluded.
Background
Since Malaysia Airlines flight MH370 went missing on Saturday, 8 March 2014 speculation about the role of Captain Zaharie Shah has developed into a framework of beliefs built on a foundation of information about data recovered from his personal Flight Simulator. Two data points located in the southern Indian Ocean show only the possibility of planning[1] but have been extrapolated by the media to prove that flight MH370 was diverted as part of a pre-planned suicide, including mass-murder.
The Malaysian ICAO Annex 13 Safety Investigation Team for MH370 has been investigating the incident since 2014 and in 2018 released the Safety Investigation Report MH370/01/2018 which stated that the possibility of third party intervention cannot be excluded. At the public release of the Report in July 2018 the Investigator-in-Charge, Dato' Ir Kok Soo Chon, said that "we are not of the opinion that it could have been an event committed by the Pilot"[2]. The Malaysian ICAO Annex 13 Safety Investigation Team for MH370 is constrained by its' terms of reference stated clearly in its' objective "The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability."[3]
For four years friends, family, many interested people, and the media, had been waiting in anticipation of a more concrete answer to the basic questions why, how, or who is responsible? If the Annex 13 Team is correct in its' belief then the answers must now come from the Criminal Investigation by the Royal Malaysia Police. Hijack, hostile takeover, or third party intervention is a criminal event. For too long the distraction of a fruitless search for the aircraft, the unfulfilled hope that recovery of the flight data recorders could provide the Annex 13 Team with some useful information, and the wait for a report from the Annex 13 Investigation, has been paralyzing. For the media and others with a voice and an opinion, an acceptance of the validity of data recovered from Captain Shah's flight simulator, without critical examination, has shifted focus from a possible hostile takeover to an almost certain case of mass-murder/suicide.
A re-focus on hostile takeover is necessary. For many this will be a complete paradigm shift, a discarding of strongly held beliefs, requiring preparedness to be open-minded and embrace a vacuum (information is limited) and a paradox (the very existence of those two data points on Zaharie's computer precludes the possibility of a hijack).
This article illustrates how the balance between three competing scenarios has developed over time. The possibility of systems failure on the aircraft, investigated by the Annex 13 Team, is shown in Yellow. The possibility of hijack, the subject of the RMP Criminal Investigation, is shown in Green. The possibility of a rogue pilot, or pilot suicide is shown in Blue. The proportion allocated to each scenario is an indication of the probability and significance. And because there is no absolute certainty, all three remain possible until the Criminal Investigation proves otherwise.
When Malaysia Airlines flight MH370 went missing on Saturday, 8 March 2014 the initial response was to look for it where it last made contact. It was thought to have crashed in the south China Sea. The prevailing theory (or speculation) was that a problem of some kind occurred on the aircraft.
| Malaysia Airlines lost communications with flight MH370 on Saturday, 8 March 2014 The aircraft was a Boeing 777-200ER registered 9M-MRO. |
Analysis of military radar confirmed that flight MH370 was diverted west across the Malaysian peninsula and continued flying north west along the Malacca Strait. The pilots could have made the turn-back with the intention of landing, in response to an on-board problem. Possibilities included fire or electrical faults. The lithium batteries in cargo were considered to be potentially dangerous. The possibility of hijack was also considered. Either way, the turn-back was deliberate.
We now have two probable causes, as shown below:-
| Turn-back in response to an on-board issue such as electrical fault or fire | Diversion as part of an attempted hijack |
Analysis of satellite data confirmed that MH370 had continued to fly until fuel was exhausted and although a 'northern corridor' was considered there was no evidence that MH370 had either landed or crashed anywhere along the 'northern arc'. The search turned to the southern Indian Ocean. Whilst the possibility of hijack remained, the terminology changed so that a hostile takeover could be distinguished from hijack by one of the pilots. The complexity of a hostile takeover plot made it seem unlikely. So the 'rogue pilot' theory gained popularity.
The three most probable causes are illustrated below:-
| On-board Technical Fault(s) | Hostile Takeover | Rogue Pilot |
The Royal Malaysia Police seized Captain Shah's personal flight simulator on Saturday, 15 March 2014. Subsequent media speculation about deleted logs or files, and leaked information from various sources, indicated that Zaharie had planned a flight to the southern Indian Ocean. Tabloid press started using the word suicide instead of 'rogue pilot'. As focus shifted onto the pilots, Zaharie in particular, interest in possible hijack or hostile takeover diminished.
Consequently, the proportions and names have been adjusted, as below:-
| On-board Technical Fault(s) | Hostile Takeover | Pilot Suicide |
In October 2017 the Australian Transport Safety Bureau (ATSB) released the report The Operational Search for MH370 and included information about data points recovered from Captain Shah's flight simulator. This confirmed without doubt the speculation that six weeks prior to the flight MH370 Zaharie's flight simulator had been used to plot two data points in the southern Indian Ocean. By then a significant number of journalists and authors had also promoted the pilot suicide theory, now including the term 'mass murder'.
The proportions below reflect the growing preoccupation with Pilot Suicide/Mass Murder and a diminished interest in a hostile takeover:-
| On-board Technical Fault(s) | Hostile Takeover | Pilot Suicide/Mass Murder |
Meanwhile, The Malaysian ICAO Annex 13 Safety Investigation Team for MH370 had continued to investigate MH370 and in July 2018 released the Safety Investigation Report MH370/01/2018. In the Conclusion, the Investigators wrote:-
Without the benefit of the examination of the aircraft wreckage and recorded flight data information, the investigation was unable to identify any plausible aircraft or systems failure mode that would lead to the observed systems deactivation, diversion from the filed flight plan route and the subsequent flight path taken by the aircraft. However, the same lack of evidence precluded the investigation from definitely eliminating that possibility. The possibility of intervention by a third party cannot be excluded either.
(Emphasis added)
This statement should prompt the media and officials to re-focus on 'third party intervention', hijack or hostile takeover, but the trail is cold and inquiry needs a restart. And while the Pilot-in-Command remains the prime suspect there is no will to find an alternate culprit.
As shown below, hostile takeover by a Third Party (which could be more than one person) is Officially on the agenda as a probable cause:-
| Aircraft or systems failure | Third Party Intervention Hostile Takeover |
Pilot Suicide/Mass Murder |
The Safety Investigation Report also included a section headed Royal Malaysia Police’s Report on Flight Simulator of PIC in which it was confirmed that:-
The Royal Malaysia Police (RMP) seized the PIC’s home flight simulator from the residence of the PIC on 15 March 2014.
The RMP Forensic Report dated 19 May 2014 documented more than 2,700 coordinates retrieved from separate file fragments and most of them are default game coordinates.
It was also discovered that there were seven ‘manually programmed’ waypoint[4] coordinates... that when connected together, will create a flight path from KLIA to an area south of the Indian Ocean through the Andaman Sea.
The description of the recovered data from Zaharie's flight simulator is much more conservative than the narrative by the ATSB. Also, the Investigators do not believe that either of the pilots is responsible. The Human Factors component of the investigation had already found that Zaharie seemed normal.
The proportions, which reflect probability, have been adjusted accordingly:-
| Aircraft or systems failure | Third Party Intervention Hostile Takeover |
Pilot Suicide/Mass Murder |
The scenario that Zaharie planned his own suicide and diverted flight MH370 to the southern Indian Ocean relies on more than just the two data points located south of the Indian Ocean which were recovered from a Shadow Copy file on his flight simulator. Firstly, as the ATSB noted, the data itself shows the possibility of planning[1]; the other data points - from KLIA to the Andaman Sea - are needed for the narrative of a planned flight; and the media has collected a number of events in Zaharie's life which provide a motive.
To deal with each component of a pilot-suicide scenario, the diagram has been subdivided, as below:-
| Aircraft or systems failure | Third Party Intervention Hostile Takeover |
Planning | Motive | Flight plan | Data points in SIO |
The fact is that two of the seven data points recovered from Zaharie's flight simulator have coordinates in the southern Indian Ocean. But why would he do that?
There are two parts to this question:-
- If Zaharie was not suicidal why would he use his flight simulator to plot two points so far south?, and
- If Zaharie was suicidal why would he bother?
There does not seem to be any reason why Zaharie, in a normal state of mind, would 'fly' to such a remote location in the ocean. It is too far south for any flight training scenario. There is nothing there, no island, no landing place. Internet research has found nothing else of interest, like a search-and-rescue operation (several sailors have been rescued from the Southern Ocean, but not near the two coordinate locations), no known shipwrecks, and nothing found relating to wartime operations with PBY Catalinas either - something that may have interested Zaharie[5].
If Zaharie was planning a suicide flight why would he feel the need to use his flight simulator? As a commercial Pilot Zaharie had flown all over the world and accumulated over 18000 hours experience. He could navigate and would know where he was. He would know that anywhere west of Christmas Island (105o 41' E) or Jakarta (106o 50' E) and south of the equator would be open ocean. He would know the range of his aircraft, rate of fuel consumption, and how far it could travel with any amount of fuel remaining. He would know that one minute of latitude was one nautical mile[6] - 60 nautical miles to one degree. Surely he could mentally calculate how many degrees latitude south of the equator an aircraft could travel (due south) before exhausting its' fuel. There is absolutely no reason why Zaharie would need to use his flight simulator to prove any of that information. The Planning component can be eliminated, as below:-
| Aircraft or systems failure | Third Party Intervention Hostile Takeover |
Motive | Flight plan | Data points in SIO |
All ICAO Annex 13 investigations include evaluation of human factors - any psychological, medical or financial factors which could have contributed to the accident or incident. The flight crew of MH370 was investigated thoroughly. Captain Shah seemed perfectly normal with no medical or psychological issues and no financial problems. However, suicide needs a motive so the media filled the information gap:-
- On Friday, 7 March 2014 Malaysia's Opposition Leader Anwar Ibrahim was in court (again) and returned to prison. Zaharie was politically active, a supporter of Anwar, and the media suggested Zaharie took down MH370 in response. Even Anwar said that was unlikely. And nothing could be gained politically. It was claimed that Zaharie attended the court, but that has also since been refuted.
- It was claimed that Zaharie's wife left him the day before flight MH370. But Zaharie had two houses, his home in Shah Alam near KLIA and his original home in Penang where his son lived. It was apparently common for Zaharie's wife to stay with their son if Zaharie was on an over-night or longer flight.
- It was claimed that Zaharie wanted a relationship with a woman he met through political activities and was disappointed when that did not happen. The reality is: this lady was married with children; her husband is one of Zaharie's Facebook friends; there was nothing clandestine; they were good friends with a shared political interests. And Zaharie was 53, not an emotionally unstable teenager. The media attempted to create something out of nothing.
- There were other minor 'facts' woven into a motive for suicide but recall that the main evidence is the data points in the southern Indian Ocean created six weeks prior to flight MH370. Would Zaharie have planned a suicide flight in anticipation of a sequence of events that had not occurred?
Not only is there no plausible motive for suicide, such an act would be contrary to Zaharie's values. He was proud to belong to Malaysia Airlines; he did not condone political violence; he expressed his condolences to those affected by the Boston Bombings and obviously did not support such a terrorist act; and he was very vocal about the level of corruption in Malaysia[7]. So why would he steal his employer's aircraft, and murder passengers and crew on a scale that overwhelms the Boston Bombings, in an act that would make local political violence and corruption seem trivial by comparison? Zaharie should not be blamed for something he was unlikely to have done.
The suggested Motives are not credible and can be eliminated, as below:-
| Aircraft or systems failure | Third Party Intervention Hostile Takeover |
Flight plan | Data points in SIO |
The forensic investigation on Zaharie's flight simulator identified the two data points in the southern Indian Ocean recovered from a Shadow Copy file dated 3 February. To form a narrative other data points were identified which, when connected, could create a flight from KLIA to the remote location in the SIO. A total of seven (possibly eight) data points were initially considered to be relevant. Two were virtually identical and were for an aircraft at the same location on runway 32R at KLIA. Another similar data point lacked detail and was therefore ignored. The ATSB noted that the first three data points recovered from the simulator were consistent with the route from Kuala Lumpur to Jeddah which Zaharie would have flown on 4 February. However, the Annex 13 Team described the data points more accurately as 'manually programmed waypoints', meaning that they do not correspond to navigational waypoints. Therefore the first three data points are not waypoints on the KLIA to Jeddah route. They are just aligned similar to that flight path.
Only one of the data points is clearly related to training, and for another data point the parameter IsUsedForTraining is False. The other files are corrupted and do not contain those parameters. One data point has a weather theme. We do not know whether other data points could be linked by a common weather theme or for training purposes because the recovered data is not complete.
For both data points in the SIO the simulated aircraft (a Boeing 777-200LR) had zero fuel. The ATSB noted that the actual flight MH370 was not carrying sufficient fuel to reach that location. But the fuel on the simulated Boeing 777-200LR was 100% capacity at KLIA and the Long Range (LR) variant of the Boeing 777-200 has a range of over 12000km and would not have exhausted fuel by the time it reached the SIO data points. Also, the final two data points in the SIO are close together but the difference in altitude is more than 33000 feet. It is not possible for a real Boeing 777 to fly in a manner that matches the two data points, so the ATSB explained it as a 'user input of an altitude of 4,000 ft'.
One of the forensic investigators noted that any (or all) of the parameters can be changed by the user (of the flight simulator) at any time. ALL of the data is the result of manual input. None of it is connected. There was no 'flight to the southern Indian Ocean' as tabloid press would headline. The narrative is a reasonable attempt to make sense of the discovery of the two data points in the SIO with the knowledge that the actual flight MH370 was diverted north west along the Malacca Strait to the Andaman Sea and then turned south, ending the flight in the SIO. Planning can be inferred but only the two final data points are absolute.
Contrary to popular belief, there was no Flight Plan to the SIO. The idea of a Flight Plan component can also be eliminated, as below:-
| Aircraft or systems failure | Third Party Intervention Hostile Takeover |
Data points in SIO |
The paradox at this point is that the cause cannot be hijack OR suicide. The reason is:- the probability that a hostile takeover could be planned and attempted and, independently, the Pilot-in-Command of the target flight plotted a flight path to a remote location south of the Indian Ocean weeks before the event, is incalculable. It would be highly unlikely; extremely improbable.
But there is a way that a failed hijack attempt and the existence of those two SIO data points on Zaharie's flight simulator can be linked, without his involvement.
Five years or more after flight MH370 it is easy to forget what was said about hijack at the time, perhaps because so little was published. An exception was a news analysis article by The Straits Times on 16 March 2014[8] which stated:-
The disappearance of Flight MH370 is one of the most sophisticated, well-planned and well-orchestrated hostile takeovers of a plane since the 9/11 attacks in the United States 13 years ago, aviation and security experts said.
...
"If this was a man-made event, the perpetrator was very knowledgeable about what to do," said Mr Jacques Astre, president of International Aviation Safety Solutions and a former United States Federal Aviation Administration official.
...
Mr Philip Baum, managing director of Green Light Limited, a London-based aviation security training and consultancy company, said: "The industry is completely dumbfounded. If this was a terrorist plot, then it's a very well-orchestrated and highly professional job, like 9/11 was."
A 'sophisticated, well-planned and well-orchestrated hostile takeover' of flight MH370 would have required a team for preparation and at least two people on-board the aircraft - one in the E/E Bay and at least one to access the flight deck after electrical power was removed from the cockpit door locks. The destination would not have been a crash site in the Indian Ocean. There would be a purpose for the theft and an intention to land.
Quite obviously, if it was a hostile takeover, the attempt failed. The remainder of the team would go into damage control mode. And the most convincing way to deflect attention would be to implicate the Pilot. It was well known that Zaharie had a flight simulator. It is described on his Facebook page. The flight targetted for theft could even have been selected because he would have been scheduled to fly it. And during the week after MH370 went missing it was becoming public knowledge that the flight most probably ended in the SIO. Of course the syndicate would already know that because it didn't land where they expected it to. The simplest way to make it look like pilot suicide would be to take an existing data point on Zaharie's computer and alter the coordinates. It would not be necessary to operate the simulator. It would be reasonable to assume that the police would search Zaharie's house, see the flight simulator and subsequently seize it. Anyone with the skill to alter data would also know that Volume Shadow Copy files are targetted by forensic software so a backup copy of a *.FLT file would be found by investigators. Two would be better.
A change of only two characters is sufficient to change our perception of Captain Shah from an experienced, trusted, professional pilot, into a selfish, suicidal mass murderer. The images below illustrate the point:-
Below is the location of Data Point 6 at 45 degrees south, a remote location south-west of Australia.
Data Point 6: Latitude S045o 05' 06.8357" Longitude E104o 08' 43.9756" Altitude 37651 ft Fuel 0%
Data from RMP Forensic Report plotted on Google Earth
This graphic shows what could have been the original location for the same data point, at 5 degrees north on the same easting (longtitude).
Latitude N005o 05' 06.8357" Longitude E104o 08' 43.9756" Altitude 37651 ft Fuel 0%
Data Point 6 moved from S045o to N005o plotted on Google Earth
Data Points 6 and 7 are so close together in the SIO that there is no need to replicate the above graphics. A change of heading made no sense in the SIO but it does if the original data points were near Malaysia and the heading is towards Kuala Lumpur. These data points could easily have been part of a training scenario where a trainee in Malaysia Airlines' simulator was faced with running out of fuel while over water.
The recovered data was on a 240 GB SSD disk (MK 25[9]) which had Microsoft Flight Simulator installed (as at 3 February 2014) but on Saturday, 15 March 2014 when the computer was taken by the RMP this disk was not connected. The computer or flight simulator was operational because Zaharie had three operating system disks and one of those (MK 26) was connected. No-one would have noticed if the MK25 disk was removed while someone altered the data. There were five days available as a window of opportunity - from Monday, 10 March 2014 to Friday, 14 March 2014. (MH370 went missing on Saturday, 8 March 2014. The Police visited Zaharie's home on Sunday, 9 March 2014 and again on Saturday, 15 March 2014 when the simulator was seized.)
Fortunately, pilot suicide is a rare event. There are very few documented instances and in all cases the pilot completed the process quickly. No-one ever diverted a flight thousands of kilometres to a remote location as part of a suicide mission. With MH370 there can be no certainty unless the aircraft is located and even then we may never know what happened. So, however remote the possibility, the rogue pilot theory still has to be considered.
But the objective of this article has been to show that a misplaced focus on pilot suicide as the most likely explanation for the loss of MH370 has diverted attention from a credible possibility that a hostile takeover was planned and implemented, without success. Exonerating Captain Zaharie Shah is a key step to reveal if there was a cover-up, and expressing doubt about the data recovered from his flight simulator also exposes a weakness in the validity of the evidence and possible means by which he may have been implicated in 'the most sophisticated, well-planned and well-orchestrated hostile takeovers of a plane since the 9/11 attacks in the United States' while remaining totally innocent of any wrongdoing.
| Aircraft or systems failure | Third Party Intervention A sophisticated, well-planned and well-orchestrated hostile takeover that ultimately failed. |
Rogue Pilot |
Will the Criminal Investigation provide the answer?
Notes and References
- ↑ 1.0 1.1 The full quote is: "As Infrastructure and Transport Minister Darren Chester said in a statement, the simulator information shows only the possibility of planning. It does not reveal what happened on the night of its disappearance nor where the aircraft is located." The context is a statement made by the ATSB headed Correcting the Record which addresses False and inaccurate media report on the search for MH370 and is dated 25 July 2016. Attempts to locate the original statement by MP Darren Chester were unsuccessful.
- ↑ Following the release of the Safety Investigation Report, Star TV uploaded video of the Q&A session to YouTube https://www.youtube.com/watch?v=_BJrbQy1NiU The quote attributed to the Investigator-in-Charge, Dato' Ir Kok Soo Chon is a transcript of his statements near the beginning of this video.
- ↑ Sourced from ICAO Annex 13, Section 3.1 page 3-1 and stated in the Safety Investigation Report at V. OBJECTIVE.
- ↑ ‘Manually programmed waypoints’ - Manually programmed waypoints are waypoints that are not published in Airway Charts. Source: The Safety Investigation Report section 1.5.3 Pilot-in-Command under the topic Royal Malaysia Police’s Report on Flight Simulator of PIC
- ↑ The PBY Catalina is famous as a flying boat used during WWII for rescue missions and long-distance flights over water. Zaharie built and flew a radio-controlled model of a Catalina. Zaharie also had a radio-controlled helicopter (in Malaysia Airlines colours).
- ↑ Historically, a nautical mile was defined as one minute of latitude on any line of longitude. A circle can be divided into 360 degrees; each degree is sixty minutes. So sixty nautical miles equates to one degree of latitude or, at the equator, one degree of longitude. Since the adoption of a metric system of measurement a nautical mile has been re-defined to equal 1852 metres, which loses the connection the old seafarers and navigators had with latitude and longitude.
- ↑ Zaharie's interests and values are very clear from postings on his Facebook page at https://www.facebook.com/zaharie.shah.3
- ↑ Source: https://www.straitstimes.com/asia/se-asia/disappearance-well-planned-and-professional-experts
- ↑ A total of five disks were removed from Captain Shah's computer when the flight simulator was seized by the RMP. Each disk was labelled for identification and easy reference. The two solid state drives were labelled MK 25 and MK 26 by the forensic investigators.