Plane
Security
Stolen passports, a Motorola consignment that was not X-rayed, transponder and ACARS silence, military primary that was not shared in time for the first search, and a spear-phish of investigation networks the next day. Each item is in the file. None of them, alone, is a hijack.
EvidenceOpen9 Mar 2014
Two waves of MH370-themed cyberattacks
9 March official-network intrusion · March–April public malware lures
TimelineConfirmed9 Mar 2014
Investigation networks spear-phished the day after MH370 vanished
CyberSecurity Malaysia · ~30 PCs · disclosed 20 August 2014
TimelineConfirmed24 Mar 2014
MyCERT: MH370-themed backdoor and fake-transcript spear-phish
MA-381 · 24 March 2014 · MA-386 · 18 April 2014
Open questionOpen
What was actually taken on 9 March — and did it include radar?
EvidenceConfirmed8 Mar 2014 00:00 UTC
Two stolen European passports
Italian and Austrian documents · two Iranian travellers
Open questionOpen
Can the Motorola and mangosteen cargo be rebuilt at carton level?
EvidenceOfficial finding7 Mar 2014 17:21 UTC
Malaysian military primary-radar track
17:21–18:22 UTC · westbound after IGARI
EvidenceOpen8 Mar 2014
BD764 and BE144 — named radar feeds, and a gap after 18:02:59 UTC
Secondary ends with the transponder · primary westbound · later points still to source
Open questionOpen
Why did SAR start in the wrong ocean for days?
TimelineConfirmed7 Mar 2014 17:21 UTC
Secondary radar lost
17:21:13 UTC
ClaimOfficial finding
Communications were more likely switched off or unpowered than randomly failed
DocumentOfficial finding1 Jan 2016 00:00 UTC
ICAO GADSS tracking standards
Global Aeronautical Distress and Safety System · post-MH370