...and how to find out with 100% confidence whether bin Laden really did it...and how to find bin Laden...
Steve Kirsch, stk@propel.com 408
571 6317
Version 19. 9/20/01
If you are reading a paper copy, you should check to see you have
the latest version:
http://www.skirsch.com/politics/plane/disable.htm
Short on time? See the 3 page Summary of techniques for preventing air hijackings
Most promising ideas
If it were my decision, I'd put together several small teams of people with
complementary backgrounds and have them brainstorm ideas, and solicit input from
the public as well. Then I'd implement the simplest easiest ideas first so that
flying is the safest form of transit. Here are some of my favorite ideas...a
combination of very high-tech and very low-tech (some we can do tomorrow at very
low cost; we have the technology to do them all today):
Current status
I've received over 17,000 page views of this web page and received over 300
e-mails. I've had a number of prominent people tell me they love and
would forward it to the FAA and DOT. I've upgraded the page with the best
ideas from AnchorDesk readers (some remarkably low-tech but very effective and
wouldn't inconvenience passengers at all), and offered to send the e-mail
archive of ideas to the FAA.
Unfortunately, no one from the FAA, Department of Transportation, airline, or jet manufacturer has contacted me and asked for the e-mail archive. A few of these techniques (suggested by readers) would have stopped the 9/11 hijackers, would cost next to nothing to implement, could be implemented virtually immediately, and result in a much higher confidence of safety than ever before. Yet they are not being considered by anyone that I'm aware of. This is unfortunate because the repercussions are huge layoffs at Boeing, huge layoffs at major airlines, major federal expense bailing out the airlines ($24B) ....all (possibly) completely unnecessary. Not only that, but those layoffs will have a domino effect on other industries, putting more downward pressure on the economy.
The changes that have been implemented by the FAA would not have stopped the 9/11 hijackers. Any group could use the exact same technique as used by the 9/11 terrorists tomorrow and the new security measures wouldn't stop them. Many of suggestions on this page would have had a high likelihood of having prevented this tragedy. Why we continue to implement measures that we know wouldn't have worked when there are cheaper, more effective, and more convenient methods is beyond me. Why we don't try some of the simpler ideas below is beyond me. What are we afraid of? Let's try it on a controlled situation first, and if that works, on a few planes. Now!
Things to keep in mind when reading the article below:
I don't get it... We just had over 5,000 people die, 2 buildings destroyed, one badly damaged. Our reaction is to take steps that would not have made any difference at all in preventing the methods used by the attackers!!?! HUH?!?! Why aren't we implementing 5 things that would have (or had a high probability of having) made a difference in the 9/11 attack? Instead, we implement things like stopping international flights, eliminating curbside check-in, and so on.
Net result of our current tactics:
A trained hijacker can slit your throat with a credit card. Are we trying to stop the amateurs or the professionals? If it's the latter, even grossly beefed up physical checks (and super-expensive luggage scanners) won't do it.
We should start with those changes (both short and long-term) that make it undesirable to hijack a commercial airliner, yet that do not inconvenience the air traveler. Many such ideas are described below. Some are cost free, remarkably simple, and extremely effective. After we've implemented those, if they do not work, then, and only then, should we take more extreme methods. Instead, we're doing things backwards...Doing the stuff that impacts innocent travelers that has no impact on terrorists!
Willie Sutton is famous for saying he robbed banks because "that's where the money is." Remove or nullify the booty, and you eliminate the problem.
Consider this: How many bank robberies would we have if every bank teller had a secret button they could press that would instantly (a) seal the doors until the police arrived, (b) call the police, (c) time-lock the safe, and (d) vaporize all the petty cash? None, because at that point, a bank could only be used to secure hostages. But if someone wanted to do that, a department store would be a far easier and safer target for a terrorist. Bottom line: no more bank robberies. And we didn't have to beef up security in the bank (no security questions or extra guards) or scan people with metal detectors as they walk in!
We can apply exactly the same logic to planes with some simple measures that will make it very unfulfilling to hijack a plane.
Here's one idea. Many others are listed below...
SAFE mode
For new fly-by-wire planes with category IIIC landing ability meaning they are
certified to land without any pilot assistance (such as Airbus, Boeing 777),
require the installation of a "SAFE mode" panic button. If one of the
pilots believes that the cockpit or cabin integrity has been breached by a
hijacker, the pilot presses the button. This puts the plane into an irrevocable
auto-pilot that lands the plane at the safest, nearest airport. The pilot is
allowed to modify the choice for airport (within narrow choice limits),
approach, runway, and modify the timing with a delay of up to 15 minutes (to
allow for runway clearance).
The main points are: (a) the pilots are always in control of the plane, (b) this mode would only be activated in the event of an imminent loss of control of the cockpit, (c) even if activated by accident, this mode is "safe", (d) this will save the lives of the people on the plane as well as prevent the plane from being used as a bomb.
We might also consider a SAFE mode on non-fly-by-wire planes since at a minimum, it would tie up one hijacker who would have to be an experienced pilot. However, this is a much more speculative cost/benefit value. Much smarter to adopt the other methods in this page.
It's important there there not be a way to override the system once it is engaged. This technique works because you irrevocably take both the pilots and the terrorists out of a control situation. A terrorist can no longer threaten the pilot to "do this or I will kill people" because once the plane is in SAFE mode, the terrorist knows that the pilot can't accommodate the demand no matter what the pilot wants to do. So the terrorist can't get what he wants...the only thing he can do is kill all the people on the plane...and if he just wanted to kill people, bus hijackings are MUCH easier than plane hijackings.
There are a few extra details we have to consider to make this practical so that even if both pilots (and some or all of the crew) are terrorists, it will still work! Here are a few of them:
The bottom line is simple: the ability to use the plane as a bomb or getaway vehicle will be completely eliminated. Hijacking a plane will be very unattractive relative to other methods (such as hijacking a bus) because in a plane, the hijacker is completely locked up, he has no control over his destination, and he would have to deal with an armed sky marshal on board, the potential of passenger riots (who will now believe they have nothing to lose by attacking a hijacker), and a small army of SWAT officers upon arrival.
There are many other ideas to make a plane unattractive to terrorists. Here are some things that would have had a high probability of stopping the 9/11 terrorists. I'm NOT suggestion we do all of them. For example, there is a great argument to be made for skipping the G-force tricks (which could injure passengers) and going directly to drop down pepper spray canisters to instantly arm all the passengers in the event of a terrorist threat. So this is a collection of suggestions which can be taken, in whole or in part, as appropriate.
A rubber hose, a bit heavier than a normal garden hose. When I was in college, I just happened for awhile to have been carrying a left over piece from working on a girlfriends car, one night after work it proved to be a good thing I had it. It accomplished far more than a wooden dowel would have, and I doubt those guys suffered any permanent injury. If Nicole had one that night, I"ll bet OJ would have sworn off knives forever.
See the Reader Comment section below for a slew of other ideas.
It doesn't have to be complicated. Airbus has proved that it is OK and safe to have the plane always in a mode where the autopilot takes over if the pilot attempts to do something stupid. Boeing chose the opposite philosophy ("pilots are smarter"). Both work, but the Airbus philosophy is better suited for terrorist situations. It would have avoided the 9/11 disasters. At a minimum, why don't we require Boeing and other jet manufacturers to adopt the Airbus philosophy that the auto-pilot is allowed to assume control if the pilot does something "stupid."
So at a minimum, we could make a regulation that all new aircraft have a SAFE mode, since this can be done with modest additional cost and no new technology (e.g., if landing at the closest airport is technically hard, we could just have SAFE mode lock-in the original destination (subject to weather clearance))...it would just enable a feature we've had for many many years.
Our current "reaction" to this crisis (increasing security) will not prevent a re-occurrence! In fact, the exact same plan would work again. All we've done is put the airlines in deeper financial trouble and created a major inconvenience for millions of passengers. We should either nullify the attractiveness of the plane as described above, or change our procedures so that, for example, we deny air travel to those in an "at risk" group (e.g., pilots with a questionable history).
No one solution will work. We should be implementing solutions that have the potential to have stopped the methods used by the 9/11 gang, not solutions that wouldn't have made any difference.
The FAA should convene a small team of cross-functional experts (pilots, aircraft manufacturers, terrorism experts, and so on) to evaluate these and other ideas for making aircraft a less attractive target. My website (http://www.skirsch.com/) has dozens innovative suggestions that the FAA could use as a starting point for discussions. I have no intention of patenting or personally profiting from any of the ideas on this page, I just want the ideas out in the public domain so that the problem can be solved in a way that does not hinder our air travel (or cause us to wait 2 hours in long lines, etc) or negatively effect our economy.
This article from Jane's Security reports the following: "Israel’s military intelligence service, Aman, suspects that Iraq is the state that sponsored the suicide attacks on the New York Trade Center and the Pentagon in Washington. Directing the mission, Aman officers believe, were two of the world’s foremost terrorist masterminds: the Lebanese Imad Mughniyeh, head of the special overseas operations for Hizbullah, and the Egyptian Dr Ayman Al Zawahiri, senior member of Al-Qaeda and possible successor of the ailing Osama Bin Laden."
So how do we find out who really did it? If we get the wrong guy, we'll really look bad. We want to do as much as we can to keep the rest of the world on our side since this will minimize the unintended consequences of our actions.
Of course, one could argue that the Jane's article doesn't matter since these guys report to bin Laden. Another reason it doesn't matter is that bin Laden is a known terrorist, even if he didn't do this bombing.
Larry Farwell who invented brain fingerprinting. This technique has 100% accuracy. It has never been fooled. Larry told me he can use brain fingerprinting to determine whether bin Laden was responsible for the 9/11 attack. The FBI has verified that the technique cannot be fooled.
The brain fingerprinting technique can be used on bin Laden as well as the suspects that we have in custody to find out if they are connected to bin Laden and whether they knew about the hijackings.
1) offer to the Taliban that we'll give bin Laden a "brain fingerprint" on the attacks to give them the proof they say they want. They say they want proof, so call their bluff... this is proof, not just circumstantial evidence. A mutually agreeable UN representative could administer the test. The US could still offer this even with Bush's new zero tolerance stance on terrorism because zero tolerance doesn't mean we can't try the most straightforward approach first. And if he passes the test, it doesn't mean we still won't pursue him since he's guilty of other things...it just means we'll have to do it the harder way.
2) you now have all these people who want to join al Qaeda... take advantage of it and enroll a ton of secret agents both to a) find out next moves b) find out where bin Laden is c) kill bin Laden. You could argue we've tried that before, but I'd argue, not with the same focus. You could recruit US citizens from Afghanistan, sympathetic Pakistanis, etc... they don't need much training and in fact, would be less suspicious if they had less training.
3) Put a $100M price tag on bin Laden's head paid out to you and/or your family and/or your designees (includes American citizenship, identity change, and protection). Advertise heavily in Afghantistan.
Reacting immediately with force will escalate this unnecessarily, causing needless loss of life. There is no time clock that says we have to attack with force tomorrow. We don't want to ignore what's happened, but let's make sure that the "cure" isn't worse than the disease.
Why not try the simple things above first? They are inexpensive and not likely to result in "unintended consequences."
I hope we are already doing #2. I don't know why we aren't doing #3. And I don't think we have anything to lose by doing #1 (in fact, #1 may save us a lot of time and lives).
Q: So let me get this straight: you want to equip everybody on
airlines with wooden dowels to club would-be terrorists?
I think that this is worth trying. But there are a bunch of other simple ideas
too (rubber hose instead of sticks, pillows and blankets instead of sticks and
hose, pepper spray in the Oxygen mask compartment,
arming the crew with FAA approved weapons of their choice, etc). The main point
is this: pick a few of these brain-dead simple solutions and try them out first
in a mock up of an airplane under controlled conditions (e.g., you get a martial
arts expert wearing heavy padding to play the terrorist and recruit people off
the street to play the passengers). Some of these scenarios may work. Some
won't. What do we have to lose? As an entrepreneur, I can tell you that seldom
does a business plan work out as planned. The best way to accomplish a goal is
to come up with some ideas, try them, and see which ones work. I think we may be
very surprised what we find out.
Q: Why not just bulletproof the door to the cockpit and lock the pilots
in?
The doors were not compromised in these bombings! Having more secure doors would
not make a difference unless these doors physically cannot be opened during the
flight. Pilots need to go to the bathroom on occasion, although the bathroom
could be in the cockpit. The major problem is: what pilot could resist
when threatened with the lives of all his passengers unless he opens the door?
It's a bit like the difference between a time-lock safe and a regular safe. The
regular safe is bulletproof already, but still vulnerable. The time-lock eliminates the
possibility of a robbery because the robber knows that no matter what, the safe
cannot be opened by someone. Without the time-lock, robbers will still try.
This proposal is analogous to putting a time-lock on a safe. However, a
steel door (or double door system) that cannot be penetrated and cannot be
opened during the flight, would provide some amount of protection. It would
not protect against a renegade pilot (as with Egyptian Air), nor would it
protect against a plane being hijacked to Cuba, etc by threats communicated from
the cabin. But it might be an interim solution to reduce the attractiveness of
hijacking the plane and can be used in combination with the idea above. A
double-door system with a "pilots don't leave the cockpit" policy is
the best bet. El Al does this.
Q: What about older planes that are not 100% fly by wire?
Even though most planes are not fly-by-wire (only newer ones like the 777
are), virtually all can land on autopilot so there is still a great deal of
control available on existing planes. In fact, by just controlling a few
elements (such as altitude) with the computer, we can make it extremely
difficult (i.e., virtually impossible) for a hijacker to deviate from the
original destination and carry out his plan. That makes a plane a very
undesirable target because of the lack of control. The problem with a
"forced auto-pilot" is that auto-pilot on most planes is designed to
be easily over-ridden by physical force in the cockpit. The trick in
implementing SAFE mode in non-fly-by-wire planes would be to determine those key
elements that could not be overridden by the pilot that would make control of
the plane difficult for a hijacker, but easy for a pilot who is landing where
the autopilot has selected. However, even the most modest implementation of safe
mode (equivalent to a "stuck" auto-pilot switch) is useful because at
a minimum, it could save the plane if both pilots are disabled and at a minimum,
it would tie up one hijacker who would have to be an experienced pilot.
So with a few wireless controls and a small amount of additional software,
you've suddenly made it a lot harder to hijack an aircraft! A number of people
have written in saying very few planes are CAT III autopilot certified (capable
of landing without assistance). That's true, but it misses the point. In my
proposal, the autopilot only "kicks in" if there is a deviation from
the intended route and only for a time sufficient to put the plane back on
course. And in the most modest implementation, that autopilot is merely
advisory; so it requires the crew to be very experienced to keep fighting the
plane. You'd also have to override the autopilot circuit breaker once the system
was engaged.
Q: Good idea, too hard expensive to implement.
You can start with a modest implementation. In an emergency, the captain
hits a button to lock in the autopilot and then removes (breaks off) the
autopilot switch. No new technology need be developed.
Q: Good idea but still cannot really deter hijacking. The reason being
that once the plane lands on a randomly selected destination, hijackers with the
plane and innocent lives in their hands can still demand from the authorities
with refuel and fly to their eventual destination themselves or by the pilots
under their threats. They are still capable of meeting their objectives.
The plane would need to be seriously disabled somehow upon landing to discourage
this in a way that cannot be easily repaired. Once the plane has been damaged,
hijackers would be forced to exit the plane eventually. The plane might also be
gassed upon landing (or at some time during the flight) as well to disable the
hijackers.
Q: The terrorists could just disconnect the safe mode.
The safe mode autopilot would only be accessible from outside the plane (i.e.,
you can only access it when the plane is parked). If they
can do this in flight, they deserve to take over the plane!
Q: What about bad weather?
The pilot could choose one of the alternate destinations. In
addition, the pilot would have enough latitude to enable him to steer around
weather without the auto pilot engaging, especially if the altitude of the plane
is high enough that there is no ground threat, i.e., the pilot could still be
given some control over the plane, even after safe mode is enabled, especially
if the plane has plenty of fuel and is at a high altitude and there is cabin
pressure, etc.
Q: What if the system malfunctions?
If the system inadvertently triggers or cannot be deactivated, the worst
that can happen is a landing at the nearest airport. Other than that, it is no
different than any other system on the plane...e.g., what if the throttle fails?
the flaps? the brakes? the landing gear? the fuel pump? etc. The safest way to
do SAFE mode is just simulating a "stuck" auto-pilot button and then
move to forced over-ride if hijacking is still a problem. Let's not
over-engineer a solution.
Q: What if the pilot is immediately disabled/killed and the panic button
has not been pressed? The hijacker has control of the plane and can fly it. What
then?
There are two panic buttons in the cockpit, two in the forward cabin and two
in the rear cabin. The chance of a panic button not being pushed are remote. In
the September 11 incident, for example, one of the pilots was able to enter in a
transponder code saying the plane was being hijacked. The panic button is much
easier to press than entering a transponder code, And if there still are incidents, we
just increase the number of panic button locations on the plane, or move to wireless panic buttons. So we can observe
if the first attempt works, and if not, we just add more refinements to lower
the chances of a successful terrorist attack to an arbitrarily low number. A
simple refinement is to automatically push the panic button if the cockpit door
is breached.
Q: What if one or both pilots are terrorists?
Consider giving a wireless safe mode activator to the sky marshal.
Q: What do you do if two planes in the same airspace have passengers on
their flights who hit the panic buttons too many times. How does air
traffic control address two planes trying to land at the same airport at
the same time?
This is highly unlikely. The pilot could switch to a different airport. Or
just circle until he can land. Remember, even when safe mode is active, the autopilot will only kick in if
there are significant variations. Circling the airport for an hour would not be
considered a significant variation (unless the plane were very low on fuel).
Q: A terrorist could bring on board a device that jams the GPS signals or
issues false GPS signals.
Why bother jamming? If the GPS signals are jammed the plane just continues on it's
preprogrammed path to the best of its ability, i.e., it won't deviate. By jamming the GPS, the hijacker
can't control the plane. So if the plane crashes, the hijacker has just killed
himself and the people on board. Given that, why bother to attack a plane in the
first place...bringing a bomb into a building would be far simpler. As far as
phoney GPS signals, that would be a neat technological trick to try to do
accurately since the device would have to receive the very signal it is trying
to jam in order to accomplish its objective (get to its target). And the system
could be programmed not to believe a GPS that doesn't make sense (or that
doesn't agree with other instruments). Lastly, GPS's need clear line of sight to
the satellites. Where would the hijackers mount their GPS so that they knew
where they were (assuming that they could somehow overcome the "we're
jamming the signal we need ourselves"). Assuming the GPS spoofing is
possible, a messy but possible workaround is that, in this case, air traffic
control occasionally broadcasts a cryptographically signed announcement of your
current location. If it varies by more than [delta] from your GPS-computed
location, you know you're being spoofed.
Q: A terrorist could load explosive into a small plane and ram it into a
big building.
Yes, my idea is only for big commercial jets so that commercial airline
passengers feel safe. Small planes are much harder to defend against because
they could be modified much more easily. Remember, no one single idea is
foolproof on its own.
Q: A terrorist could just re-program the flight computer on a 777 to
automatically engage SAFE mode and "land" at the White House.
True. SAFE mode could be used against you but the scenario you described
could be programmed today...you don't have to link it to SAFE mode at all. So
the implementation of SAFE mode doesn't make the aircraft any less safe.
Overall, you're much more SAFE with SAFE mode than without it.
I've received hundreds of comments, including one from an air traffic controller at the FAA who, while pointing out some issues, nevertheless concluded, "I think you have a valid idea and it is do-able. Good luck building support for what sounds like a good idea. Folks in IT are innovative and I am proud to be a part of that group. Thanks for spending some time thinking about this."
Here is a link to some of the reader comments I received. I've tried to incorporate some of the best ideas I've received in the text above. I also have an email archive of hundreds of other messages not posted on my website (available upon request).
The FAA should appoint a small cross-functional team of experts to take a look at ideas such as the ones presented here and make recommendations on how to make planes a less attractive target. The Airline Pilots Association has re-thought their recommendations in light of this tragedy. It's time for the FAA to do the same.
Congress should ask the FAA for a report summarizing each promising idea that is known by the FAA, the pros/cons (including costs, time, impact), and a recommendation. Let's focus first on those measures which provide significant deterrence with minimal customer impact. Hopefully, we won't have to go any further than that. And hopefully we won't be afraid to arm people when necessary (when the first line of defense methods have failed) and allow them to exercise their judgment on how to minimize loss of life.
We should offer bin Laden the opportunity to use brain fingerprinting to exonerate or incriminate himself before we declare war on Afghanistan.
Opinion piece: How to prevent air hijackings (San Jose Merc News Op-Ed)