Europe’s Plan for Hijacking the Hijackers

The RoboLander Agenda

A European consortium of regulators and aviation manufacturers is pushing forward with development of the RoboLander air security device, to the tune of $45 million. The International Aviation Safety Association initially conceived the RoboLander concept, in the immediate aftermath of Sept. 11. The White House and U.S. Dept. of Transportation have endorsed the RoboLander, as an innovative method to combat terrorist hijackings of airliners. The system, which only can be controlled from the ground, would forcibly fly hijacked aircraft to the nearest airport.

The origins of this futuristic security concept is instructive. It was May 1, 2004 (very appropriately Mayday) and Brussels, the capital of the European Union, was celebrating the admission of 10 new members within the borders of an expanding Europe. Suddenly, it was advised that a Madrid-bound Air Europa 737 had left Norwegian airspace, overflown Denmark, then Germany and was passing through the Netherlands and about to enter Belgian airspace, all without communicating with Air Traffic Control. The suspicion was that it could be a renegade aircraft about to mount a suicide attack upon NATO HQ or the EU Headquarters in Brussels.

Panic mounted as it became known that three different air forces had launched to try and intercept it and failed. Eventually a pair of French Mirages pulled up alongside the phantom jet and it broke its silence. It had been a simple frequency dial-up glitch but it concentrated the minds of the European mandarins mightily — upon what could have happened next. The possibilities had always been an unintercepted suicide attack or a shootdown of an innocent planeload; either outcome would have been disastrous. All agreed that the option of doing nothing and awaiting whatever was to be “the inevitable” was equally unacceptable.

Trigger-Pullers Thin on the Ground

The European Union might have a harmonized economic policy but military matters remain very much the autonomous right of individual parliaments. Some EU states are prepared to endorse the shoot-down of a rogue aircraft if it clearly poses a threat, yet four EU states lack the ability to do so (i.e., no fighter aircraft). A fast moving airliner can transit many EU borders in a very short time, so the coordination of a shoot-down by any particular state would be well-nigh impossible. With each successive incident, dithering proved to be a popular cop out — in other words, let the next nation along deal with it. But these weren’t the only issues.

The attitudes of individual EU states towards the problem differ greatly. Sweden, for instance, will not countenance the downing of a civilian airplane in any circumstance. Other countries won’t publicly state their policy, citing national security. NATO lacks the authority to shoot down hijacked civilian airliners. Germany’s Federal Constitutional Court ruled on Feb. 15, 2006 that a law permitting the Luftwaffe to shoot down hijacked planes, to prevent a suicide attack, was unconstitutional. Their reasoning was that the government lacked the right to take the lives of passengers in an attempt to save lives on the ground. German ministers had pushed through the legislation in late 2003 after a pilot created panic in Frankfurt by circling the city in a light plane, threatening to crash it into the European Central Bank tower. Last year a solo pilot crashed a similar plane directly in front of Germany’s parliament building in an apparent suicide.

Until now, EU leaders have studiously avoided answering questions on the issue, despite Eurocontrol reporting 20 such rogue airliner incidents over a two-year period. In 2005, the Luftwaffe chased 20 speechless aircraft that had been declared NOCOMM in German airspace, yet clearly no one wanted ever to be put on the spot for a shoot-down decision. The 1983 Soviet fighter downing of 747 flight KAL007 off Sakhalin and the 1988 Iranian A300 shoot-down by USS Vincennes remains uppermost in each politician’s denial psyche. The EU vulnerability was crystal clear, responsibilities remained diffused, and yet the issue was freshly fomented by each new EU occurrence. Quite incongruously there appeared to be no resolution in sight or any joint planning for one — until July 24, that is.

A RoboGenie Arises from a EuroLamp

On that date it was revealed by the German magazine Der Spiegel that some 30 European businesses and research institutes have been working to create software that would make it possible from a distance to regain control of an aircraft from hijackers. The system “which could only be controlled from the ground would forcibly conduct the aircraft posing a problem to the nearest airport whether it liked it or not.” It went on to say that: “A hijacker would have no chance of reaching his goal.”

The project’s budgeted cost of Euro36 million (US$45 million) is being shared by the European Commission (Euro19.5 million), aircraft maker Airbus, electronics giant Siemens, and the Technical University of Munich. The intent and security level of the system would be such that even a computer hacker on board could not get around it. Plans are afoot to demonstrate the project’s software in Britain in October 2006, so obviously the white-coated back-room boffins have been beavering away on it for some time. (For our previous coverage of RoboLander, see ASW, Sept. 24, 2001; Oct. 1, 2001; and Oct. 15, 2001.)

The genie sprang from an EU stalemate, but any credit for genius belongs elsewhere. On Sept. 12, 2001, a day after 9-11, the International Aviation Safety Association (IASA) foresaw just such a conundrum arising and gave birth to the concept called RoboLander. The topic was then covered exhaustively in Air Safety Week. U.S. Secretary of Transport Norman Mineta endorsed it and President Bush mentioned it as a possible solution for terror hijackings (at a Sept. 27, 2001 speech on airline security at Chicago’s O’Hare Airport). He said, “We will look at all kinds of technologies to make sure that our airliners are safe, and for example including technology to enable controllers to take over a distressed aircraft and land it by remote control.”

It is now apparent that the European Commission, in its search for a solution, similarly identified RoboLander as the only logical way forward for resolving the lack of a shoot-down consensus among the European states. That it is possible to achieve technically is inarguable. Whether it would need to be compulsory globally is the next question. If not, how would the EU address a NOCOMM circumstance involving a non-European airliner? Would it matter whether or not it was squawking the hijack code?

Whether there would be any opposition from ICAO or the United States to adopting RoboLander is another pending dilemma. If they didn’t join in, how might the U.S. authorities cope with (say) a British airliner coming under the U.S. shoot-down policy? If they shot it down and had earlier passed up the chance to participate in RoboLander, would there not then be political and diplomatic hell to pay? Whether there had been terrorists involved would be irrelevant after the fact, in comparison to the larger question of the needless mass loss of life. No politician or general wants that sort of historical notoriety. Governments have toppled over lesser issues. But what is RoboLander? It’s covered in depth on the IASA website with a menu starting at http://www.iasa.com.au/robolander.html

The RoboLander concept was first covered in the Air Safety Week issue of 24 Sept. 2001

The Concept

To defeat a terrorist suicide mission or any form of unlawful interference, this anti-hijacking system was suggested on Sept. 12, 2001: The captain would have sole knowledge of his own personal (FAA issued) override “passivator” code (equivalent to a PIN number) which he would have to “punch in” (digit by digit) at least every 20 minutes (on the sounding of a warbler alert which would otherwise rise in amplitude to a scream-pitch over the space of a minute). That passivator code would radiate to the (let’s call it mode T) satellite-based transponder and trigger a reply code giving him another 20 minutes flight command authority. If the aircraft captain is unable (or unwilling) to radiate that code, it will not then “switch off” an otherwise automatically-incoming “disabler” code. Following receipt of a “disabler” code’s pulse-train, passively retaining autonomous flight-control is no longer an option; it then becomes an automated “land ASAP” procedure, with recovery being “at the nearest suitable”. So, if you were wondering where the TV program “Lost” got the timed oblivion idea, well, now you know.

In the big red button concept, the captain could have an emergency activation code that would be dialed in before takeoff and activated by lifting a guard and pushing a button as soon as there was an apparent “situation” on board. Activation would immediately dump cockpit voice and flight data recorded information to a ground station, open a microphone for one-way air-satellite-ground eavesdropping, and activate a ground-commanded autoland at the nearest suitable (i.e., Cat III) airport. The engine throttles would be in “electrical disconnect” and disabling controls (such as fuel switches) would be solenoid-switched to failsafe ON. In the event of an imminent hijacking the pilot would hit the button and nobody on board could change course. The flight crew become passengers and the aircraft is irreversibly “de-weaponized.”

The Basic Principle for RoboLander

The Captain’s “emergency activation” code could also be dialled in preflight and activated inflight, by quickly lifting a guard and pushing a button, as soon as there was an apparent “situation” on board, down the back. If the pilots were to be suddenly overpowered (or incapacitated by gas or poison), the timer would be running on the passive mode anyway. The transponder link, for a directed autoland cruise/descent and approach and landing, would be the satellite transponder channel via which fuel, thrust, reconfiguration, system parameters and secondary flight-control directives (e.g., flaps) would be both uploaded and downloaded. That system interface should be so configured as to make it impossible for it to be interfered with inflight (i.e., access via a ground access-panel only). The system could also cover the contingency of pilots being food- poisoned, or depressurisation/hypoxia.

A RoboLander status would normally be “irreversible” (by the pilots onboard) but not “irrevocable” (i.e., in the case of a Robo-Link failure, ground-based flight-control would be automatically de-latched onboard and flight status would revert to autonomous on-board control). In certain scenarios, control could be relinquished back to the aircraft captain once he’d convincingly confirmed “operations normal” by radio, and by then inputting his ROBO code. The “Pilot-Monitored” RoboLander Mode would be an onboard selection that would be reversible (i.e., de-selectable) and cover all situations and circumstances other than unlawful interference.

The Robolander system may require the number of Cat III ILS autoland-equipped airports to be increased, to ensure the aircraft is always within range. The system should also be able to remotely cope with some common systems or power-plant failures. It’s not as if we are talking pilotless drones here, although system checkout on maintenance air-tests might require provision of a one-time-issue override key-code that could be quickly pilot-injected onboard, if the system appeared to be deficient. Of course, any such system, because it affects something as important as flight-control authority, would need to be subjected to an intensive Failure Mode and Effects Analysis (FMEA), as is autoland capability. RoboLander transponder and control-panel access would be inhibited to the extent that any attempt to open it up (or destroy it) would trigger its remotely located module anyhow. It would be required to have a failsafe (i.e., fail-operable) failure mode (i.e., latching) and to be compatible with Air Traffic Control systems internationally. This last factor has not proven to be insurmountable with many modern add-on systems such as TCAS, EGPWS, ELT, ACARS, RVSM, ADS-B.

A Dehumanizing Development

There is a larger debate lurking in the background of this capability and it has little to do with terror…or perhaps it constitutes terror of a different kind. The incentive for the EU to resolve the shoot-down impasse is strong and the technology is waiting in the wings, among a vast military unmanned aircraft operating experience and knowledge base. Obviously, the project will proceed to fruition, but how long after RoboLander enters service before the penny (or perhaps centime?) drops and the pundits realize that the human pilot is now proven to be superfluous? How long before the Airbus boffins write him out of the picture, replacing him with a machine-minding human automaton code-keeper? Those who dismissively scoff, “Never happen!” would do well to reflect further. The quiet quest for enhanced automation at Airbus is being conducted in their own shrouded version of the Lockheed Skunk (and Boeing’s Phantom) works.

Indeed, at the Farnborough Air Show (July 17-21) Lockheed Martin’s Advanced Development Programs (a.k.a., the infamous “Skunk Works”) released details for the first time of its all-composite, long-range high altitude P-175 Polecat UAV. The Polecat is a blended wingbody aircraft that resembles a miniature B-2 stealth bomber. The unmanned Polecat will be developed for sustained high altitude operations.

When it comes to aerial “RoboCops” and pilotless aircraft, the future is already here.