Resources

Malaysia releases the safety investigation report

30 July 2018

The ICAO Annex 13 team, led by Kok Soo Chon, publishes hundreds of pages and cannot determine the cause. Diversion is judged likely from manual inputs. Third-party intervention is not excluded.

MH370 / US Military ISR Working Research Report v1

Working paper · 18 September 2026

Working paper on US military ISR programmes in the MH370 window: MAGIC, Orion, Gorgon Stare, Blue Devil and remote-control patents, read as one overlapping family under BIG SAFARI. The family is documented. A specific MH370 collection is not established and is not ruled out.

Where is the 14 February 2014 USD(I)/USAF Gorgon Stare / Blue Devil strategy report?

HASC 113-102 required it 22 days before MH370. It may name platforms, residual Blue Devil components, integration status and fielding chronology.

Safety Investigation Report — MH370

Malaysian ICAO Annex 13 Team · 30 July 2018

The official accident report. Cause undetermined. Diversion likely from manual inputs; third-party intervention not excluded; 00:19 log-on treated as fuel exhaustion. No wreckage, no recorders.

HASC Report 113-102 — Gorgon Stare to recapitalise Blue Devil

House Armed Services Committee · 7 June 2013 · USD(I)/USAF report due 14 Feb 2014

Primary Congressional source: Gorgon Stare is the USAF’s only operational persistent day/night WAMI capability and the logical programme to recapitalise Blue Devil technologies, capabilities and lessons learned. Directed evolution into WAMI + near-vertical direction-finding SIGINT, leveraging Blue Devil PED. Report due 14 February 2014 — 22 days before MH370.

Home-simulator coordinates are not an official finding of planning

Files exist. Commentators map a southern route. The 2018 report did not convert that into premeditation.

Official underwater search suspended

17 January 2017

Australia, Malaysia and China suspend the ATSB-led search after 120,000 km² of seabed have been covered with no wreckage.

The Operational Search for MH370

ATSB AE-2014-054 · final search report 2017

Australia’s account of how the southern Indian Ocean search box was drawn, refined, and exhausted over 120,000 km². Primary technical home of the 7th-arc argument used in the field.

Fuel exhaustion, then uncontrolled descent at the 7th arc

Prevailing official end-of-flight model

After a long southern cruise the aircraft flames out near 00:19 UTC, the SDU logs on from APU/emergency power, and the aeroplane leaves controlled flight. Wreckage should lie on or near the 7th arc.

Mechanical / cargo-fire failure

Official report: no identified failure mode fits

A running systems failure that also produces a coherent reverse course and six more hours of SATCOM is a poor fit. Lithium-battery cargo was reviewed and not adopted as cause.

Third-party intervention

Official report: cannot be excluded

The Annex 13 team wrote that intervention by a third party cannot be excluded. Remote hijack as implemented technology on commercial 777s was ruled out.

Alleged-video 6 fps ‘Gorgon Stare match’ is contradicted by the 2013 OSD report

The 6 fps ‘Gorgon Stare match’ claimed for alleged video is not established. 2 fps is the documented comparison figure. Increment 2’s rate is unpublished here.

MH370 search operation 2025/2026 — update to families

Ministry of Transport Malaysia · 8 March 2026

Official family briefing: 28 operational days, ~7,571 km² of the 15,000 km² box surveyed, no wreckage confirmed. Contract later extended to June 2027.

The 00:19 log-on is probable fuel exhaustion

Official finding: aircraft-initiated log-on most likely a power restore after dual flame-out and APU/bus bring-up.

The diversion likely resulted from manual inputs

Official 2018 consensus. Who made the inputs is not identified. Mechanical-only stories are a poor fit for a coherent reverse course plus comms dropout.

Third-party intervention cannot be excluded

Quoted residual from the 2018 report. Not a finding that it happened.

Communications were more likely switched off or unpowered than randomly failed

ACARS, transponder and VHF drop together near IGARI. The report favours manual off / power interrupt, without proving intent.

The 18:25 log-on follows a SATCOM power interruption

Official: aircraft-initiated log-on three minutes after last radar is most likely SDU power restore. Why power was lost is unknown.

Factual Information — MH370

Malaysian investigation team · interim releases 2014–2015

Early factual compilations: aircraft history, crew, cargo, ATC transcripts, radar, SATCOM. Released before debris and before the 2018 analysis chapters. The 8 March 2015 issue (updated 15 April 2015) is held here as a downloadable original.

Flight MH370 — 17 Fascinating Facts

J. Jericho / The Free School · March 2019 · Drive backup PDF

Independent compilation of official-file facts with annexes (simulator pages, passenger list, cargo docs, Boeing patent, ACARS log). Not an official report. Several numbered “facts” still need MOT/ATSB cross-check.

Two waves of MH370-themed cyberattacks

9 March official-network intrusion · March–April public malware lures

Working chart of two separate campaigns. Attack one: 9 March spear-phish of officials at the Department of Civil Aviation, National Security Council and Malaysia Airlines — CyberSecurity Malaysia’s public account, disclosed in August. Attack two: MyCERT alerts on 24 March and 18 April about MH370-themed backdoors and a fake investigation-transcript phish aimed more widely. Destination IP in China is not the same as a finding that Beijing ran the operation.

DODIG-2013-128 — Blue Devil Block 2

DoD Inspector General · 19 September 2013 · 54 pages · Drive source copy

Primary. FA8620-11-C-4024, ~$149m spent, payload stop 4 Jan 2012, residual components absorbed into other Air Force programmes.

Turn back across the Malay Peninsula

17:21–17:52 UTC

Primary radar shows a left turn off the Beijing airway, a crossing of Malaysia, and a track toward the Andaman Sea. The official report calls this diversion likely the result of manual inputs.

Who was flying after IGARI?

Official report: cannot establish if anyone other than the two pilots was at the controls. Manual inputs likely; actor unknown.

WSPR anomaly set (Godfrey)

Ham-radio SNR disturbances offered as a track · unverified

Richard Godfrey reports ~130 disturbances over the southern Indian Ocean, currently terminating in a 30 km-radius circle near 29.128°S 99.934°E. Not an official sensor. Not peer-reviewed.

Flight-crew diversion

Manual inputs from the cockpit — who, and why, unproven

The 2018 report says the turn-back likely resulted from manual inputs. It does not identify a crew member as perpetrator and did not treat the home simulator as a plan.

Investigation networks spear-phished the day after MH370 vanished

CyberSecurity Malaysia · ~30 PCs · disclosed 20 August 2014

Confirmed as CSM’s public account. On 9 March, officials at the Department of Civil Aviation, the National Security Council and Malaysia Airlines were sent malware disguised as a news article that the aircraft had been found. About thirty computers were infected. Outbound mail carrying confidential files, including meeting minutes and classified documents, some related to MH370, was traced to an IP in China. CSM shut the machines down and asked Chinese providers to block the traffic. Police and Interpol were involved. What exactly was stolen is still unpublished.

Petter Hörnfeldt

Mentour Pilot

56-minute 2024 reconstruction from the official report and independent SATCOM papers. Sequential transponder-off, seven handshakes, Blelly–Marchand end-of-flight, WSPR as a possible extra trace. Stated aim: restart the search.

Raytheon MTS-B as Orion payload lead

Reported option · 2012–13 USAF UAV MTS bookings in the $200m class

MTS-B is EO/IR FMV/targeting. Aviation Week 2010 attributed a planned pair of MTS-B turrets on Orion — planned, not fitted on the maiden article. Flight 18 (Dec 2014) carried 1,000 lb ballast. Raytheon 10-K totals do not identify Orion as the customer.

The radar story and the 9 March cyberattack

Working chart · tracks, delays, and a spear-phish of the investigation

Two panels. Left: civilian secondary, Malaysian military primary, Thai paint disclosed ten days later, and the 12-hour lag before the civilian rescue centre was told. Right: one day after the loss, officials on the investigation were hit with a spear-phish that CyberSecurity Malaysia later said stole classified material toward an IP in China. Presence of a hack is confirmed as that agency’s public account. What was in the take — and whether it included radar — is still open.

Zaharie Ahmad Shah

Pilot in command · MH370

Last attributed radio call: “Good night Malaysian three seven zero.” Home simulator files exist; the 2018 report did not treat them as a reconstructed plan. Who was flying after IGARI is open.

A NEW Trace! The FULL MH370 Story, so Far

Mentour Pilot · Petter Hörnfeldt · 16 March 2024 · 56:06

Type-rated 737 captain’s reconstruction from the 2018 report, Inmarsat BTO/BFO, and the Blelly–Marchand end-of-flight paper. Argues the transponder was selected off in two steps, not failed as a unit. Closes with a WSPR lead and a request to restart the search.

BD764 and BE144 — named radar feeds, and a gap after 18:02:59 UTC

Secondary ends with the transponder · primary westbound · later points still to source

The working chart labels two Malaysian Air Defence datasets: BD764 (secondary, 10-second intervals, early flight, ends 01:21 MYT with the transponder) and BE144 (primary, 10-second intervals, westbound after the turn, ends 18:02:59 UTC). The 2018 reconstruction then shows a last military return at 18:22:12 UTC after a gap. Those later points exist in the official track. Their raw source is not public.

Captain’s home flight-simulator files

Imaged by RMP · restored coordinates mapped by commentators

Files exist. A restored route into the southern Indian Ocean has been published. The 2018 report did not treat this as a reconstructed plan.

CIA / Malaysia 9/11 files — KLIA facilitator, Iraqi embassy, twin-tower skyline

Nic Moneypenny’s reading of declassified intelligence: a facilitator of 9/11 pilots worked at Kuala Lumpur airport; reporting on the Iraqi embassy in Malaysia and passports; al-Qaeda’s 2000 meeting beside Petronas Towers.

CyberSecurity Malaysia

National cyber agency · publicly described the 9 March intrusion in August 2014

Confirmed. Agency under the then Ministry of Science, Technology and Innovation. CEO Amirudin Abdul Wahab is the named source for the 9 March spear-phish of investigation officials. Digital forensics support to the affected departments; work with police and Interpol.

Deep Dive: MH370 Episode Three — The Turn Back

Deep Dive Podcast Network · 28 September 2023 · 31:12

Podcast reconstruction of the air turn-back after IGARI: military primary radar, heading 273°, altitude and speed blips the 2018 report itself flags as noisy.

FIRST RF Phase II — dual-band UHF/X-band airborne SAR

FA8650-11-C-1016 · $749,593 · start 26 Jan 2011 · topic AF093-138

Official SBIR: lightweight dual-band UHF/X-band SAR on a modified Artemis COTS radar plus FIRST RF single-aperture antenna. SWaP ~20 lb / 150 W. Design target included Shadow 200. A concrete alternative to treating Orion as the unnamed FY2013 RF Persistent Sensing platform.

Freescale gyros and the laser / directed-energy race

January 2025 briefing video: twenty Freescale employees on MH370; gyroscopic sensors; a US-led race with China and Russia on precision laser directed energy; later public silence on Freescale’s role; a prime contractor with Vanguard, BlackRock and State Street as large holders, and a reported 38% profit rise in 2014 after missile-defence grants.

Gorgon Stare documented at 2 fps, not 6 fps

OSD September 2013 comparison figure

Primary pre-MH370 report labels Gorgon Stare 2 fps versus 30 fps FMV. A claimed ~6 fps match to Increment 2 is not established, pending an Increment-2 specification.

Inside the Investigation: The Search for MH370 Truth

7NEWS · Peter Foley, Joe Hattley

Former lead search officials on internal protocol, sonar-mapping mistakes, and why a debris field can still be found. An Australian operational view, not a cockpit narrative.

Is Flight 370 still sending signals?

CNN · 13 March 2014 · 2:09

Week-one report, before the 15 March Inmarsat southern-arc briefing. Captures the live confusion over whether the aircraft was still electrically alive.

Last ACARS transmission

17:07:29 UTC

The final Aircraft Communications Addressing and Reporting System message leaves 9M-MRO. Expected reports at 17:37 and 18:07 never arrive.

Level at FL350

17:01:17 UTC

The captain reports maintaining flight level 350. The aircraft is established on the filed route toward waypoint IGARI.

Malaysian 370: What Happened?

National Geographic UK · 3 March 2015

Early network special, filmed before most African debris and before the 2018 report. Useful as a snapshot of what was sayable at year one; superseded on debris and end-of-flight.

MH370 Daily Research — working papers

18 September 2026

Working ISR report, source ledger and master chronology gathered the same day, with a cited-URL set pointing at contemporary MAGIC, Orion and Gorgon Stare reporting.

MyCERT: MH370-themed backdoor and fake-transcript spear-phish

MA-381 · 24 March 2014 · MA-386 · 18 April 2014

Confirmed public advisories, a different campaign from the 9 March official-network intrusion. 24 March: a Facebook-app lure dropping a backdoor with remote-control (C2) capability. 18 April: emails posing as an investigation team / ICAO portal item, password-protected archive, fake MH370 transcript, command-and-control. Aimed at organisations and the public, not shown to be the DCA/NSC/MAS breach.

The 7th arc

00:19:29 UTC aircraft-initiated log-on

BTO range ring at the last transmission. Official and Ocean Infinity boxes are arguments about a segment of this arc plus a stand-off. It is not a crash pin.

Two stolen European passports

Italian and Austrian documents · two Iranian travellers

Yes — two Iranian men were on board. They travelled on stolen European passports (Italian and Austrian), not Iranian documents. The official investigation treated them as likely asylum seekers and did not adopt a terrorism finding.

7th arc (schematic locus)

00:19 UTC range ring from Inmarsat I-3

Search geometry, not a wreck coordinate. Official and Ocean Infinity boxes are arguments about a segment of this arc.

Australian Transport Safety Bureau

Lead of the 2014–2017 southern Indian Ocean search

Drew and exhausted the 120,000 km² underwater box. Operational-search report is the engineering baseline for later Ocean Infinity boxes.

Blue Devil I operational demonstration ends

31 December 2013 · four King Airs returning to Leidos

Attributed via Inside the Air Force, 22 Jan 2014, quoting USAF officials. The four leased King Airs were returning to Leidos, so the original Afghanistan fleet was not an operational candidate on 8 March 2014. The multi-INT sensor package remained US Government property and was being assessed for reassignment (MC-12 and MQ-9 mentioned, not selected). The sensors did not disappear with the lease.

BTO range rings and BFO Doppler residuals

Inmarsat / Ashton et al. · Journal of Navigation

Burst Timing Offset describes distance from the satellite (an arc on the Earth). Burst Frequency Offset encodes relative motion and is why official analysis went south, not north.

Business Case Analysis of MAGIC UAV System

Naval Postgraduate School thesis · public PDF

Academic model of MAGIC as long-range ISR, not a named communications-relay payload. The $510m RDT&E figure in the thesis is an academic model, not an official acquisition estimate.

Can the Motorola and mangosteen cargo be rebuilt at carton level?

Working-log Q28–Q35: airway bill 232-10677085, Motorola SKUs, whether radios/transmitters were present, CG effects, and why the Motorola consignment was not X-rayed.

Capt. John Cox: preponderance is a deliberate act, high likelihood the captain

June 2026 interview. FIR-boundary dropout, reverse course, ocean leg — too many coincidences for a random failure, in his reading. Not a court finding and not the 2018 report’s wording.

Cargo, including lithium-ion batteries

Manifest reviewed; fire hypothesis not supported

The aircraft carried cargo including lithium-ion batteries. The investigation found they were packed to regulation and did not support a cargo-fire cause.

DSTG

Defence Science and Technology Group · Bayesian path analysis

Produced the posterior along the 7th arc used to site the official underwater box.

Edward C. Lin

VPU-2 / JTF 519 / PACFLT · court-martial · FOIA 2026

4ORBS reports February 2026 FOIA acquisition of court-martial records. Released records confirm service with VPU-2 / JTF 519 / PACFLT and a guilty plea to communicating classified national-defense information. Unreleased classified addendum holds the specific details. No released court document names MH370 or an MH370 satellite video.

ICAO

GADSS tracking standards after MH370

15-minute position reporting in normal flight; faster in distress. The regulatory aftershock.