Deep Dive: MH370, Remastered

Andy Tarnoff and I spent eight months making the 31 episodes that comprised the podcast series “Deep Dive: MH370.” Our goal was to break down a complicated case so that it could be understood by viewers and listeners in an entertaining and easy-to-digest format. In today’s episode, we discuss the six important conclusions about the case that the public might not understand were it not for the podcast.

As a follow-up to this series I later started producing the series “Finding MH370,” currently ongoing, which builds upon the work of “Deep Dive” and extends it further with an eye to ultimately solving the case.

Today we’re going to go deeper than we’ve ever gone before on a question that I’ve called the crux of the whole MH370 mystery, and which is newly important because a bunch of viral MH370 videos have come out that spend a lot of time discussing it and, I’ll argue, they’re getting it wrong. And it matters a great deal because these videos are shaping what the public thinks is a reasonable explanation of the mystery.

To help us with this important task we have with us a very special guest today, Juan Browne, an experienced airline pilot and the host of the popular aviation channel Blancolirio on YouTube.

Juan has been flying airplanes for a very long time, and most recently he’s been working as a first officer on 777 flights over the Atlantic, so he really knows aviation and he knows this plane in particular. I reached out to Juan because I knew he could help us understand a crucial but widely misundersood aspect of the MH370 mystery. Namely: how did MH370’s satcom get turned off, and get turned back on again?

This is the central crux of the mystery because, first of all, no one’s been able to come up with a really good explanation for how and why it happened, and second, without it we don’t get the 7 ping arcs, we don’t get the BFO analysis, we don’t wind up having anywhere to look in the southern Indian Ocean.

It doesn’t seem to make much sense.

Unless you understand the man who makes the decisions in Russia, and how he sees the world.

Vladimir Putin was a KGB officer stationed in East Germany when the Berlin Wall fell. Like many patriotic Russians, Putin experienced the collapse of the Soviet Union not as the blossoming of freedom, but as the humiliation of a once-great power. Territory that had once been considered the heartland of the empire split off into independent states. Putin later called it “the greatest geopolitical catastrophe of the century.” After he came to power, he was determined to return his country to its rightful place of greatness in the world. To do that, he would need to adopt a mode of warfare suited to Russia’s diminished resources — an approach called hybrid warfare. And that involves hurting your adversary in all sorts of ways, some blunt and obvious, others quite sophisticated and unexpected.

Today’s topic is one that I’ve been fascinated by for a long time: the art of stage magic and what it can tell us about MH370. I’m joined by Ed Dentzel, the host of an excellent podcast Unfound, in which he’s examined hundreds of missing persons cases. In a previous life Ed was the stage manager for “The World’s Greatest Magic Show” at the Greek Isles in Las Vegas from 2005 to 2008. While there he worked with more than 50 magicians, helping them create and hone new tricks. Ed wrote a guest post for my blog back in 2019 and I found what he said really fascinating and I’ve been wanting to have him on the show for a long time.

If the satcom was hacked and MH370 was taken north, the perpetrators presumably had a plan that ended with them alive, and this would have to involve landing the plane at an airport.

But is there an airport they could have landed at?

If there are no airports near the part of the 7th arc where MH370’s flight would have terminated, then that would be a major blow to the cyber-hijack theory. As it turns out, though, there are a number of airports where the plane could plausibly have landed, and in today’s eposide we look at some of the more intriguing ones.

When Andy and I made the original version of this episode in March, 2024, Malaysia and the underwater search company Ocean Infinity were publicly discussing the idea of restarting the scan of the seabed. At the time it had been several years since Fugro and then Ocean Infinity had carried out searches that together had covered an area the size of Great Britain. In this episode Andy and I discuss how the original seabed search area had been defined and assessed whether expanding that area would likely result in success. It’s newly relevant because, while those discussions petered out without action, the parties have recently been discussing such a move once more. My personal assessment of the idea’s value remains unchanged.

In today’s episode, which aired in its original form on the 10th anniversary of the disappearance of MH370, we discuss two major advances that we’ve made in the case. The first has to do with the age of the barnacles found on the pieces of debris, and hence how long they spent in the water, a topic that we laid the groundwork for in the previous episode. This is significant in understanding the fate of MH370 because this new data lends weight to the conclusion that the plane did not, in fact, crash into the southern ocean.

How could such a thing be possible? Doesn’t the Inmarsat data tell us that the plane definitely flew south into the ocean? Well, that brings us to today’s second big revelation. As we’ve discussed in previous episodes, there’s also evidence that the data could have been tampered with. This is a radical idea for many in the MH370 community, and some well-respected figures have declared it flatly impossible. But they are not experts in aviation cybersecurity. In today’s episode we’re joined by Todd Humphreys, a professor of aeronautical engineering at the University of Texas at Austin, is one of the world’s experts on cybersecurity in avation. He’s been studying the spoofing of GPS signals for more than a decade. And he says that the time has come for search officials to take seriously the possibility that MH370 was hacked. “After a failed search, you have to recalibrate,” he says. “Sometimes you preclude the possibility of even looking for evidence because you have very strong priors against it. I think by this point, we’ve been pushed into a corner where we do need to revisit those priors.”

Simply put, the authorities and the conventional wisdom have proven themselves wrong. The analysis that they conducted lead them to believe that they knew where to find the plane, and they didn’t. So it’s time to grapple with the possibility that someone might have exploited the cybersecurity vulnerability that we described in Episode 22.

Over the course of the next two episodes, we’re going to talk about how we can use fresh evidence involving gooseneck barnacles, Lepas anatifera, to gain new insight into the fate of MH370. This is an organism we’ve talked about a lot already. We first met them in Episode 18: The Flaperon, when we talked about how the first piece of debris washed ashore on La Réunion Island. A striking feature of the flaperon was that it was covered all over in fleshy-stalked creatures, which scientists realized could point the way to the plane’s wreckage.

In Episode 19: The Impossible Drift we looked at some puzzling aspects of the debris, including the fact that marine biologists were stumped as to how Lepas could have grown on a part of the flaperon that stuck high up out of the water. We went more deeply into these issues in Episode 20: Lepas Don’t Lie with renowned invertebrate researcher Jim Carlton.

A uniting concept across these episodes is that Lepas barnacles can be used as a robust and reliable way to measure how long debris has been in the water. Combined with drift modeling, they can tell you when and where something went in the water. In the case of MH370, they can tell us what happened to the plane. In the next episode, we’ll reveal the new evidence that we’ve found.

In the months after the disappearance of MH370, Malaysian police searched for any clues that might suggest that the plane’s captain, Zaharie Ahmad Shah, was the culprit. This would have been the simplest explanation for why the Boeing 777 suddenly went electronically dark and pulled a U-turn forty minutes into its flight, and scarcely a minute after Shah’s voice was heard over the radio calmly telling air traffic controllers “Good night, Malaysia 370.” But to their chagrin, the evidence was slim. Zaharie had left no note. His family and friends had noticed no sign of mental disturbance. There was no evidence of political or religious extremism or of marital discord. He was under no financial pressure. He just didn’t fit the profile of someone who would kill hundreds of innocent people and take his own life in the process.

The police did find,  however, a single piece of evidence pointing at Shah. In his home they found a hard drive that contained a flight simulation program as well as data points created when he saved simulated flights. Six data points recorded on February 2, 2014, were of particular interest. It looked like they came from a single 777 flight that took off from Kuala Lumpur International Airport, went up the Malacca Strait, passed the tip of Sumatra, then turned south and wound up with zero fuel over the remote southern Indian Ocean. This route so uncannily resembled the flight path deduced from MH370’s radar track and then satcom symbols that it was taken by many as smoking-gun evidence that Shah had practiced absconding with the plane.

Part of the process of figuring out the mystery of MH370 is finding explanations for the seemingly inexplicable things that happened. Part two is trying to verify whether those explanations hold water.

Today we revisit a topic that we explored in depth back in Episode 10, “The Vulnerability,” in which we talked about an idea that Victor Iannello and I have both worked on—namely, that MH370 had an unsual vulnerability that would have allowed a sophisticated attacker on board the plane alter the data in its satellite communications system so that when investigators looked at the data later they would think the plane went south when it really went north. (If you’re interested in learning the details of the theory, I’ve posted a précis here.)

I’ve been thinking about this idea for a long time. There was even a whole episode of the Netflix documentary “MH370: The Plane That Disappeared” about it. But it’s taken this podcast to spur me to do something I wish I had done a long time ago, which is to seek out the opinion of cybersecurity professionals. From the perspective of someone whose job it is to assess potential hacking vulnerabilities, does it seem like MH370 had one?

I was able to tap the expertise of someone who really knows his stuff, Ken Munro, the founder of Pen Test Partners in the UK. As the name implies, Ken’s company specializes in penetration testing, which means that they probe a client’s computer network for vulnerabilities to see if they can get inside the system. The idea is by imagining all the ways a bad guy could hurt you, you can take steps to prevent them from happening. Though his skills are applicable in every corner of IT, Ken specializes in aviation. Recently he and his team were able to a real 747 that wasn’t being used and borrow it for a bit to test it for security vulnerabilities (and found some interesting ones).

I figured if anyone could tell whether a proposed vulnerability is plausible or not, it would be Ken.

Ever since Blaine Alan Gibson first crossed my radar screen, half a year before he found “No Step,” I’ve struggled to understand this eccentric character. In the media, he styled himself after Indiana Jones, always wearing a brown fedora. He portrayed himself as an inveterate adventurer and world traveler who before MH370 had pursued any number of quixotic international quests, including an attempt to find the lost ark of the covenant and an expedition to the site of the Tunguska explosion in Siberia. His was a wonderfully appealing persona. After I wrote about him in New York magazine, TV producers started getting in touch with me, hoping I could hook them up with him to pitch reality shows about his life.

He quickly became a central feature of the MH370 story, ubiquitous in media coverage the crash. But who, really, is this man of mystery? As with so many other aspects of this case, the more layers you peel away, the stranger things appear.

Last episode we talked about the surge of MH370 debris that started turning up in the western Indian Ocean in early 2016, and how search officials were optimistic that all this new data would help them understand where the plane went down. We focussed on drift modeling, and how the timing and location of the finds could have helped pin down the location of the crash through a process called reverse drift modeling. Today, we’re talking about other clues that the authorities were able to derive from the collected debris, namely the marine fauna found living on them. And to help us understand, we’re bringing in Jim Carlton, the world’s leading expert in marine invertebrates.

If there was one piece of debris, there should have been a lot more. Yet month after month went by without any further discoveries. Then in February of 2016 an independent researcher named Blaine Alan Gibson accomplished something no one ever had before: He set out to find a piece of MH370 debris, and he found one. In the months that followed, other people also found pieces of the plane. Blaine Gibson himself went on to find many more. For some, this influx of additional evidence only confirmed the conclusion that the plane had indeed crashed somewhere in the southern Indian Ocean. But in looking closer, I saw the same kinds of inconsistencies that have characterized every aspect of the case.

At 8.30am on July 29, 2015, on the northeastern shore of Réunion Island, a cleanup crew was working its way along a stretch of pebbly beach when a worker named Johnny Begue spotted an unfamiliar-looking object at the edge of the surf. Roughly rectangular and about six feet long, it somewhat resembled a stubby airplane wing encrusted with marine life. Soon gendarmes were on the scene, along with local news photographers. The piece was quickly identified as a flaperon, a part of a 777 wing’s trailing edge. Close examination revealed that it was indisputably a piece of MH370. Here at last, was physical evidence that the missing airliner really had crashed in the southern Indian Ocean.

But was that conclusion inescapable? In today’s episode we discuss how, once again, the evidence in this case looks stranger the closer you examine it.

For this episode, we’re trying something different. Until now we’ve spent each episode diving into a particular aspect of the mystery. This time, we’re pulling back to look at the mystery from a global perspective in order to address the question: What is this case like?

Just as every person has a unique character, a mystery can have a personality of its own, and MH370 certainly does. The dominant feature of that personality is strangeness. Time and again, a piece of evidence emerges which changes what we understand about the case – but then it turns out the evidence itself contains mysteries that themselves need to be elucidated.

In today’s episode, we look at five of the most striking examples of this phenomena. Together, they raise the question: why is the MH370 like this? Is it just a matter of coincidence, or is there some underlying aspect of the case that keeps pulling it toward the unexpected?

In our last episode, we talked about the search of the seabed, which started in October 2014. By that time the plane had been missing for 8 months. And while the seabed search was everyone’s best hope for finding the black box and solving the mystery, people hadn’t forgotten about floating debris.

You’ll recall that in the first month after the disappearance, there had been an extremely extensive search of the ocean surface by ships and airplanes from many nations, and they hadn’t spotted anything.

When Australia called off the surface search for Malaysia Airlines Flight 370 on April 28, Prime Minister Tony Abbot explained that “It is highly unlikely at this stage that we will find any aircraft debris on the ocean surface. By this stage, 52 days into the search, most material would have become waterlogged and sunk.”

But would the debris really have sunk? Modern aircraft are made of metal, composites, and plastic, materials that do not get waterlogged. If, as the Australian Transport Safety Board (ATSB) believed was most likely, MH370 ran out of fuel and then crashed, it would have been moving at hundreds of miles per hour when it hit the sea. Much of the resulting debris would have settled down through the water column, but innumerable pieces would have remained afloat. After Air France Flight 447 went down in the middle of the Atlantic in 2009, searchers found some 3,000 pieces of debris scattered across the surface.

Given that no debris from MH370 had been spotted from the air, a lot of people thought that the first hard proof of the plane’s fight might well take the form of flotsam washing up on a beach somewhere.

The question was, where would it wash up?

As the southern spring of 2014 approached the search authorities prepared to undertake a search of the seabed where their calculations indicated MH370 had gone. They hired a Dutch marine survey company called Fugro, which dispatched three ships to the area: Fugro Discovery, Fugro Equator and Fugro Supporter. The area they were going to search had been defined by the probability density function we’ve described earlier. It stretched about 600 miles long and covered water that was about three miles deep. One Australian politician declared that they were 97 percent confident that they would find the plane’s wreckage. Needless to say, it didn’t work out that way.

On July 17 Jeff was in his kitchen when the phone rang. It was a producer from CNN asking if he could go on air to talk about the Malaysia Airlines 777 that had just gone down over Ukraine. He’d spent so much time thinking about Ukraine and MH370 that it took him a moment to realize that she was talking about a completelely different airplane.

The details were still sketchy, but it seemed that in the late afternoon, Ukraine time, Malaysia Airlines Flight 17 had been flying from Amsterdam to Kuala Lumpur when it had exploded in midair. Initial reports suggested it might have been shot down by a surface-to-air missile while flying over territory held by Russia-backed rebels.

A Malaysia Airlines 777. Ukraine. Russia. The echoes seemed too overwhelming to ignore. Boeing 777s are among the most reliable airplanes in the world; none had ever been lost mid-flight before. There were 15 Malaysia Airlines 777s at the start of 2014, out of some 18,000 registered aircraft in the world, and two had come to grief under mysterious circumstances in less than five months.

But on air at CNN, all the other aviation analysts agreed that of course the destruction of MH17 so soon after the loss of MH370 could only be a freak coincidence. What connection could there possibly be?

It was soon established that the plane had been shot down by a surface-to-air missile. A 150-pound shrapnel-laced warhead had torn open the aluminum airframe, scattering passengers and crew into the 500 mph slipstream. In most airplane crashes, the question is: what happened? This time, it was: who did it, and why?

This week we look at where the plane could have gone if it didn’t go into the remote southern Indian Ocean. According to the Inmarsat data, it would have flown to the northwest, but that raises another question: if it flew over mainland Asia, why wasn’t it picked up by anyone’s military radar?

As you’ll recall, when Australian scientists applied the technique of Bayesian inference to the BTO data, they found that it indicated that the plane might have taken one of two flight paths, one to the north, one to the south:

In today’s episode we look at where exactly this route went, and whether we would expect that military radars would have picked it up.

Once the scientists at CSIRO had generated the probability distribution for the plane’s last known location on the 7th arc, the next question they had to answer was: how far did the plane travel from that point before it impacted the water?

As we discussed earlier, their goal was to define a search box within which the plane was likely to be found. The plane’s location along the 7th arc defined the length of the rectangle, and the distance it could have traveled from the 7th arc would define the width of the search box.

So the question of how far the plane could have flown after the last transmission depends on what the investigators thought was going on with the plane at that moment. You’ll recall that the plane took off at 16:42 heading from Kuala Lumpur, Malaysia to Beijing, China.. A flight that normally takes 5 1/2 hours but it was carrying enough fuel to keep it flying until around 00:12, in case it needed to divert somewhere else and needed extra fuel.

The inmarsat data showed the plane transmitting signals on a regular schedule — either in response to phone calls from the ground, or an hour after the last exchange. The last exchange in his sequence took place at 0:11 universal time. (That’s 8.11am Kuala Lumpur time, but to keep things simple let’s stick to Universal Time from here on out.)

Then at 0:19, the plane sent a request to Inmarsat to log in again. In many ways this request is similar to the one that was made at 18:25 — the SDU had logged itself off because it had powered down, and then tried to log on after getting turned back on again.

As you’ll recall, no one has a very good answer for why the SDU was turned off and back on again at 18:25. It’s a very unusual thing to happen in flight. But investigators had a very good idea about why the SDU might have turned on again at 0:19. They knew that by this time the plane would have been very close to running out of fuel. And once that happened, the engines would stop running, and the plane would lose electrical power. It would start to lose speed and/or altitude. And the satcom would disconnect.

But then an emergency situation a backup system would kick in. A device called a Ram Air Turbine, or RAT, would deploy—it’s a propellor that pops out into the slipstream to generate electricity like a windmill. This would generate enough electricity to start up a powerplant in the back of the airplane called the Auxiliary Power Unit, or APU. Its generatorwould return power to the plane’s electrical system, including the satcom. This is why the plane reconnected to the satellite.

The process from fuel exhaustion to logon would take 3 minutes 40 seconds. So the plane presumable ran out of fuel around 00:16, or about 5 minutes after the previous handshake at 0:11.

At 0:19 the plane had been out of fuel for almost four minutes, which meant the engines hadn’t been providing power. At first the ATSB assumed that the most likely scenario was that the plane had flown on a ghost flight, and after losing power had fallen into a descending spiral. Based on previous accidents they estimated that it would have fallen into the ocean within 30 nautical miles of the 7th arc.

Later they looked more closely at the BFO data, and they realized that there was a simple explanation for the seemingly strange values recorded at the time. Since the SDU’s doppler precompensation algorithm doesn’t account for vertical velocity, the BFO data could be explained if the final transmissions were made in a steep and accelerating dive.

This dive would be so steep that it could only be accomplished by a pilot who was actively pushing the plane’s nose down into a deliberate steep suicidal dive.

That being the case, the plane’s wreckage should be found very close to the 7th arc. Perhaps no more that 5 or 10 miles away. But, to give themselves a bit of leeway, the authorities decided to define an initial search area that was 400 miles long and 58 miles wide.

They had every reason to be confident, based on what they knew, that the plane would be within these 23,000 square miles.

Spoiler alert: it wasn’t.