Resources

CIA / Malaysia 9/11 files — KLIA facilitator, Iraqi embassy, twin-tower skyline

Nic Moneypenny’s reading of declassified intelligence: a facilitator of 9/11 pilots worked at Kuala Lumpur airport; reporting on the Iraqi embassy in Malaysia and passports; al-Qaeda’s 2000 meeting beside Petronas Towers.

What can be documented at Diego Garcia on 7–8 March 2014?

HA08 North’s trunk failed in March 2014 about 189 km off Diego Garcia; UCT-2 was on the atoll doing near-shore HDAS anode work in 110 ft of water. Sensor, SIGINT, satellite-downlink and aircraft records for 7–8 March are still the question — not a finding.

Diego Garcia

British Indian Ocean Territory · collection-geography question

US/UK atoll. CTBTO HA08 North hydrophones went dark in March 2014 after a deep-ocean cable break. UCT-2 was on the island that month on near-shore HDAS cables. Neither fact is a finding that MH370 was collected or hidden here.

CTBTO HA08 North at Diego Garcia went dark in March 2014

Cable break ~189 km offshore · South array kept listening

Confirmed by CTBTO. The northern hydroacoustic segment of HA08, off Diego Garcia, suffered a trunk-cable fault in March 2014 about 189–190 km from shore, more than a kilometre and a half down. HA08 South continued. North stayed silent for twelve years. A conventional splash in the southern Indian Ocean is not thereby erased — Cape Leeuwin (HA01) and HA08 South remained in the network.

Michael Selig testimony — Diego Garcia, Gorgon Stare, cold plasma

Nic Moneypenny notes a written and recorded account by Michael Selig, former fast-jet pilot who flew into Diego Garcia, describing an MH370 end-state, a leaked video, Gorgon Stare and scalar / plasma language.

UCT-2 inspected near-shore HDAS cables at Diego Garcia

February–early March 2014 · 110 ft of water · zinc anodes

Confirmed Seabee deployment. Construction Diving Detachment Charlie spent February and early March at NSF Diego Garcia on fleet moorings and Hydro-acoustic Data Acquisition System cables. Final task: inspect and repair two HDAS cables north of the lagoon in about 110 feet of seawater. That is not the 189 km / 1.5 km-deep HA08 North trunk.

DGA-TA / French judiciary

Flaperon examination, Toulouse

Confirmed the Réunion flaperon as 9M-MRO. Part remains in French judicial custody.

Fuel exhaustion, then uncontrolled descent at the 7th arc

Prevailing official end-of-flight model

After a long southern cruise the aircraft flames out near 00:19 UTC, the SDU logs on from APU/emergency power, and the aeroplane leaves controlled flight. Wreckage should lie on or near the 7th arc.

Home-simulator coordinates are not an official finding of planning

Files exist. Commentators map a southern route. The 2018 report did not convert that into premeditation.

Official underwater search suspended

17 January 2017

Australia, Malaysia and China suspend the ATSB-led search after 120,000 km² of seabed have been covered with no wreckage.

MH370 search operation 2025/2026 — update to families

Ministry of Transport Malaysia · 8 March 2026

Official family briefing: 28 operational days, ~7,571 km² of the 15,000 km² box surveyed, no wreckage confirmed. Contract later extended to June 2027.

Safety Investigation Report — MH370

Malaysian ICAO Annex 13 Team · 30 July 2018

The official accident report. Cause undetermined. Diversion likely from manual inputs; third-party intervention not excluded; 00:19 log-on treated as fuel exhaustion. No wreckage, no recorders.

The diversion likely resulted from manual inputs

Official 2018 consensus. Who made the inputs is not identified. Mechanical-only stories are a poor fit for a coherent reverse course plus comms dropout.

Project Quiet Exodus — Part 1

SecretMilitaryTechnology.com thesis · asset denial of the Freescale team

A long-form thesis that MH370 was a US operation to stop twenty Freescale employees reaching China, protecting a compact-fusion / spacetime platform. Public facts inside it (headcount, Carlyle, Lockheed CFR patents, HA08 outage, UCT-2 at Diego Garcia) are filed separately. The operation itself is not established.

The 00:19 log-on is probable fuel exhaustion

Official finding: aircraft-initiated log-on most likely a power restore after dual flame-out and APU/bus bring-up.

The 18:25 log-on follows a SATCOM power interruption

Official: aircraft-initiated log-on three minutes after last radar is most likely SDU power restore. Why power was lost is unknown.

Malaysia releases the safety investigation report

30 July 2018

The ICAO Annex 13 team, led by Kok Soo Chon, publishes hundreds of pages and cannot determine the cause. Diversion is judged likely from manual inputs. Third-party intervention is not excluded.

Quiet Exodus: HA08 was blinded on purpose — not established

Outage confirmed · deliberate cut not shown · depths argue against UCT-2

The thesis treats the March 2014 HA08 North cable fault plus UCT-2’s presence as an acoustic blackout for MH370. The outage is real. The published UCT-2 task is near-shore anode work. HA08 South and HA01 kept listening. Deliberate blinding remains a hypothesis.

Third-party intervention

Official report: cannot be excluded

The Annex 13 team wrote that intervention by a third party cannot be excluded. Remote hijack as implemented technology on commercial 777s was ruled out.

Third-party intervention cannot be excluded

Quoted residual from the 2018 report. Not a finding that it happened.

Two waves of MH370-themed cyberattacks

9 March official-network intrusion · March–April public malware lures

Working chart of two separate campaigns. Attack one: 9 March spear-phish of officials at the Department of Civil Aviation, National Security Council and Malaysia Airlines — CyberSecurity Malaysia’s public account, disclosed in August. Attack two: MyCERT alerts on 24 March and 18 April about MH370-themed backdoors and a fake investigation-transcript phish aimed more widely. Destination IP in China is not the same as a finding that Beijing ran the operation.

Communications were more likely switched off or unpowered than randomly failed

ACARS, transponder and VHF drop together near IGARI. The report favours manual off / power interrupt, without proving intent.

Cubic US6641087B1 — anti-hijack remote pilot

Commercial retrofit · satellite relay · cockpit exclusion

Confirmed patent. Activation onboard or by remote override; deactivate normal pilot control; uplink airspeed/altitude/fuel; optional disable of ordinary communications; CVR/FDR upload. USPTO: 4-year fee 4 May 2007, 8-year fee 4 May 2011, expired 4 Nov 2015 for later non-payment. In force on 8 March 2014. No installation evidence in this archive.

DODIG-2013-128 — Blue Devil Block 2

DoD Inspector General · 19 September 2013 · 54 pages · Drive source copy

Primary. FA8620-11-C-4024, ~$149m spent, payload stop 4 Jan 2012, residual components absorbed into other Air Force programmes.

Factual Information — MH370

Malaysian investigation team · interim releases 2014–2015

Early factual compilations: aircraft history, crew, cargo, ATC transcripts, radar, SATCOM. Released before debris and before the 2018 analysis chapters. The 8 March 2015 issue (updated 15 April 2015) is held here as a downloadable original.

Mechanical / cargo-fire failure

Official report: no identified failure mode fits

A running systems failure that also produces a coherent reverse course and six more hours of SATCOM is a poor fit. Lithium-battery cargo was reviewed and not adopted as cause.

The Operational Search for MH370

ATSB AE-2014-054 · final search report 2017

Australia’s account of how the southern Indian Ocean search box was drawn, refined, and exhausted over 120,000 km². Primary technical home of the 7th-arc argument used in the field.

645 AESG / BIG SAFARI

USAF rapid acquisition — the office that binds this family

645 AESG / BIG SAFARI ran specialised rapid-development ISR. It executed MAGIC, developed Gorgon Stare, and took Blue Devil equipment into a facility it managed at Greenville, Texas. That is the documented organisational centre of this technology family, not a coincidence of names.

Aurora Orion contract FA8620-12-C-3027

~$86.56m aggregated · completion extending to 2019

Public award aggregation for the BIG SAFARI / Orion definitive contract. Transaction-level FPDS history — especially modifications August 2013–March 2014 — is still open. Budget authority, ceilings and obligations are not the same as cash spent.

CyberSecurity Malaysia

National cyber agency · publicly described the 9 March intrusion in August 2014

Confirmed. Agency under the then Ministry of Science, Technology and Innovation. CEO Amirudin Abdul Wahab is the named source for the 9 March spear-phish of investigation officials. Digital forensics support to the affected departments; work with police and Interpol.

Flight MH370 — 17 Fascinating Facts

J. Jericho / The Free School · March 2019 · Drive backup PDF

Independent compilation of official-file facts with annexes (simulator pages, passenger list, cargo docs, Boeing patent, ACARS log). Not an official report. Several numbered “facts” still need MOT/ATSB cross-check.

Investigation networks spear-phished the day after MH370 vanished

CyberSecurity Malaysia · ~30 PCs · disclosed 20 August 2014

Confirmed as CSM’s public account. On 9 March, officials at the Department of Civil Aviation, the National Security Council and Malaysia Airlines were sent malware disguised as a news article that the aircraft had been found. About thirty computers were infected. Outbound mail carrying confidential files, including meeting minutes and classified documents, some related to MH370, was traced to an IP in China. CSM shut the machines down and asked Chinese providers to block the traffic. Police and Interpol were involved. What exactly was stolen is still unpublished.

Malaysian 370: What Happened?

National Geographic UK · 3 March 2015

Early network special, filmed before most African debris and before the 2018 report. Useful as a snapshot of what was sayable at year one; superseded on debris and end-of-flight.

MyCERT: MH370-themed backdoor and fake-transcript spear-phish

MA-381 · 24 March 2014 · MA-386 · 18 April 2014

Confirmed public advisories, a different campaign from the 9 March official-network intrusion. 24 March: a Facebook-app lure dropping a backdoor with remote-control (C2) capability. 18 April: emails posing as an investigation team / ICAO portal item, password-protected archive, fake MH370 transcript, command-and-control. Aimed at organisations and the public, not shown to be the DCA/NSC/MAS breach.

Remote-control claims versus evidence gaps

Patent, QF-16, Teso FMS proof-of-concept · installation on 9M-MRO still open

Working chart: unmanned flight of a fighter-class jet was demonstrated in 2013; Boeing’s uninterruptible-autopilot patent exists; Hugo Teso showed an FMS proof-of-concept the same year. Boeing told Malaysian investigators there was no commercial implementation on the 2002 delivery. Radar proves a turn at IGARI, not who commanded it. Ten data requests remain.

The 7th arc

00:19:29 UTC aircraft-initiated log-on

BTO range ring at the last transmission. Official and Ocean Infinity boxes are arguments about a segment of this arc plus a stand-off. It is not a crash pin.

The radar story and the 9 March cyberattack

Working chart · tracks, delays, and a spear-phish of the investigation

Two panels. Left: civilian secondary, Malaysian military primary, Thai paint disclosed ten days later, and the 12-hour lag before the civilian rescue centre was told. Right: one day after the loss, officials on the investigation were hit with a spear-phish that CyberSecurity Malaysia later said stole classified material toward an IP in China. Presence of a hack is confirmed as that agency’s public account. What was in the take — and whether it included radar — is still open.

US military presence in theatre, 7–9 March 2014

Public-source board · confirmed search assets vs records still needed

Working chart of publicly documented US assets around MH370: USS Pinckney already in the South China Sea and diverted to search on 8 March; a Kadena P-3C announced the same day; USS Kidd joined. Guam RQ-4, Diego Garcia sensors, EP-3E, RC-135 and exact 7–9 March sortie lists remain open. Presence is not the same as tracking 9M-MRO.

Who was flying after IGARI?

Official report: cannot establish if anyone other than the two pilots was at the controls. Manual inputs likely; actor unknown.

7th arc (schematic locus)

00:19 UTC range ring from Inmarsat I-3

Search geometry, not a wreck coordinate. Official and Ocean Infinity boxes are arguments about a segment of this arc.

Al-Qaeda meeting, Kuala Lumpur, January 2000

Hijackers later on the 9/11 flights attended an al-Qaeda meeting in Kuala Lumpur in January 2000. CIA tracked the meeting. Fourteen years later MH370 left the same city’s airport.

Alleged thermal / wide-area video is authentic collection

Hypothesis to test — provenance not established

Circulating clips are treated as alleged. If genuine, at least one collector must satisfy geometry, band, FOV, altitude and comms. Platform IDs attached to social posts are not accepted as authority. A ~6 fps ‘Gorgon Stare Increment 2 match’ is contradicted by the 2013 OSD 2 fps figure.

BD764 and BE144 — named radar feeds, and a gap after 18:02:59 UTC

Secondary ends with the transponder · primary westbound · later points still to source

The working chart labels two Malaysian Air Defence datasets: BD764 (secondary, 10-second intervals, early flight, ends 01:21 MYT with the transponder) and BE144 (primary, 10-second intervals, westbound after the turn, ends 18:02:59 UTC). The 2018 reconstruction then shows a last military return at 18:22:12 UTC after a gap. Those later points exist in the official track. Their raw source is not public.

Blue Devil I operational demonstration ends

31 December 2013 · four King Airs returning to Leidos

Attributed via Inside the Air Force, 22 Jan 2014, quoting USAF officials. The four leased King Airs were returning to Leidos, so the original Afghanistan fleet was not an operational candidate on 8 March 2014. The multi-INT sensor package remained US Government property and was being assessed for reassignment (MC-12 and MQ-9 mentioned, not selected). The sensors did not disappear with the lease.

Boeing / USAF QF-16 unmanned full-scale demonstration, 2013

Pilotless fighter-class jet · not a 777 and not 9M-MRO

Confirmed capability. A QF-16 flew unmanned, including supersonic flight and landing, as a full-scale aerial target. That kills the slogan ‘nothing that size could be flown remotely in 2014.’ It does not place a remote architecture on a commercial 777.

BTO range rings and BFO Doppler residuals

Inmarsat / Ashton et al. · Journal of Navigation

Burst Timing Offset describes distance from the satellite (an arc on the Earth). Burst Frequency Offset encodes relative motion and is why official analysis went south, not north.

Business Case Analysis of MAGIC UAV System

Naval Postgraduate School thesis · public PDF

Academic model of MAGIC as long-range ISR, not a named communications-relay payload. The $510m RDT&E figure in the thesis is an academic model, not an official acquisition estimate.

Cubic Defense anti-hijack remote-pilot patent granted

US6641087B1 · filed 9 Oct 2001 · granted 4 Nov 2003

Commercial-aircraft retrofit module: deactivate cockpit controls, satellite-relayed remote guidance, optional comms disable, FDR/CVR uplink. Confirmed IP. No evidence of airline installation.

DSTG

Defence Science and Technology Group · Bayesian path analysis

Produced the posterior along the 7th arc used to site the official underwater box.

FIRST RF Phase II — dual-band UHF/X-band airborne SAR

FA8650-11-C-1016 · $749,593 · start 26 Jan 2011 · topic AF093-138

Official SBIR: lightweight dual-band UHF/X-band SAR on a modified Artemis COTS radar plus FIRST RF single-aperture antenna. SWaP ~20 lb / 150 W. Design target included Shadow 200. A concrete alternative to treating Orion as the unnamed FY2013 RF Persistent Sensing platform.

Handshake 6 — last successful hourly ping

00:10:58 UTC 8 March

The last completed ground-initiated handshake. Eight minutes later the aircraft sends a log-on associated with fuel exhaustion.

Inside the Investigation: The Search for MH370 Truth

7NEWS · Peter Foley, Joe Hattley

Former lead search officials on internal protocol, sonar-mapping mistakes, and why a debris field can still be found. An Australian operational view, not a cockpit narrative.

Petter Hörnfeldt

Mentour Pilot

56-minute 2024 reconstruction from the official report and independent SATCOM papers. Sequential transponder-off, seven handshakes, Blelly–Marchand end-of-flight, WSPR as a possible extra trace. Stated aim: restart the search.

Pouria Nour Mohammad Mehrdad

Passenger · Iranian · boarded on a stolen Italian passport

Iranian. Travelled on MH370 using an Italian passport stolen from Luigi Maraldi. Later identified by name. The official investigation treated him as a likely asylum seeker, not as a hijacker.

Seyed Mohammed Reza Delavar

Passenger · Iranian · boarded on a stolen Austrian passport

Iranian. Travelled on MH370 using an Austrian passport stolen from Christian Kozel. Later identified by name. The official investigation treated him as a likely asylum seeker, not as a hijacker.

Southern Indian Ocean

Search theatre after 15 March 2014

The ocean in which official and private underwater campaigns have been conducted.

The last radio call is attributed to the captain

Official voice identification. Calm, protocol-correct handover two minutes before transponder loss.

Turn back across the Malay Peninsula

17:21–17:52 UTC

Primary radar shows a left turn off the Beijing airway, a crossing of Malaysia, and a track toward the Andaman Sea. The official report calls this diversion likely the result of manual inputs.

Twenty Freescale employees on MH370

Company-confirmed 8 March 2014

Confirmed passenger fact. Project assignments, especially defence/avionics/inertial work, are unresolved. FXAS21000 gyro sampling in July 2013 is an adjacent product date only.

Two stolen European passports

Italian and Austrian documents · two Iranian travellers

Yes — two Iranian men were on board. They travelled on stolen European passports (Italian and Austrian), not Iranian documents. The official investigation treated them as likely asylum seekers and did not adopt a terrorism finding.