Resources

MAGIC was designed for multi-INT payload modularity, not only endurance

OSD PB2012 lists EO/IR, SIGINT, GMTI, wide-area surveillance, communications relay and strike as modular payload classes, plus reduced-manning / open-architecture avionics. That is the documented architecture. It is not an installed-GFE list for March 2014.

Florence de Changy: US / AWACS intercept over the South China Sea

Netflix episode 3. Sensitive cargo, jamming in the FIR gap, an ignored land-now order, a shoot-down before Chinese airspace. Location is inconsistent with western-Indian-Ocean debris.

Cubic remote-pilot patent was maintained through March 2014

US6641087B1: 4-year fee 4 May 2007, 8-year fee 4 May 2011, expired 4 Nov 2015 for later non-payment. Continuation US10/684,316 abandoned 18 Jan 2007. IP interest retained; prototype/certification still OPEN.

Blue Devil I / II

Operational Block 1 WAAS + SIGINT · Block 2 residuals to BIG SAFARI

Block 1 was operational: manned aircraft carrying Angel Fire-derived wide-area imagery integrated with SIGINT. Block 2, the airship, was terminated — but its equipment, including GFE, was packed and sent to a BIG SAFARI facility in Greenville, Texas, available for other programmes. The technology did not vanish with the airship.

Gorgon Stare’s podded architecture was designed for more than MQ-9

HASC 113-102: open/podded architecture permitted integration on multiple aircraft types. Aviation Week 2010 named it as a potential MAGIC payload. An Orion installation by 8 March 2014 is not shown.

Waypoint IGARI

FIR boundary · Gulf of Thailand

Last secondary-radar / planned-route point. Transfer to Ho Chi Minh failed.

FY2013 NDAA Sec. 927 — integrated SIGINT / WAMI plan

Congressional Record 12 Dec 2012 · ISR Task Force plan due 1 Jan 2013

Statute required a plan for operationally integrated SIGINT able to detect, track and precisely geolocate high-band devices and immediately cue imagery. Named Army Guardrail / ARGUS A160, USAF Blue Moon QRC and DARPA WAND. Consult NSA and USSOCOM.

Third-party intervention

Official report: cannot be excluded

The Annex 13 team wrote that intervention by a third party cannot be excluded. Remote hijack as implemented technology on commercial 777s was ruled out.

L-3 Greenville awarded Blue Devil 2 integration / test

FA8620-06-G-4003 / order 1157 · $12.054m · 17 Aug 2011

L-3 Communications Integrated Systems, Greenville, Texas, paid for BD2 airship integration and test support. Later Q4 FY2012 storage was also at a 645 AESG-managed Greenville facility. Geographic coincidence is not a custody finding.

DARPA WAND

Wide Area Network Detection · coincident WAMI + RF

Live-fly WAMI and RF geolocation fusion in 2012, SOCOM transition, Trident Spectre demonstration. Named in FY2013 NDAA Sec. 927. Part of the overlapping multi-INT ecosystem around Blue Devil and Gorgon Stare. Not shown as an MH370 collector.

External / uninterruptible autopilot on 9M-MRO

Engineering precedent exists. Installation on this airframe is not established.

Boeing US7142971B2 and Cubic US6641087B1 describe remote engagement, disconnected cockpit controls, dedicated links. No maintenance/mod/certification record currently in this archive places that architecture on 9M-MRO.

Factual Information — MH370

Malaysian investigation team · interim releases 2014–2015

Early factual compilations: aircraft history, crew, cargo, ATC transcripts, radar, SATCOM. Released before debris and before the 2018 analysis chapters. The 8 March 2015 issue (updated 15 April 2015) is held here as a downloadable original.

Joint Agency Coordination Centre

Australia · southern Indian Ocean search coordination

Stood up to run the multinational southern search after the SATCOM pivot.

What platform received the FY2013 dual-band RF Persistent Sensing integration?

PB2015: completed and integrated onto an ‘identified platform,’ then the effort ended. Public exhibits do not name it. FIRST RF / Shadow 200 and ISIS test-facility work are documented UHF/X-band alternatives. Orion is chronology-only.

Waypoint IGARI

17:20:31 UTC

MH370 passes IGARI, the FIR boundary between Kuala Lumpur and Ho Chi Minh, seconds before disappearing from secondary radar.

Aurora Orion RPA

Twin-diesel MALE UAS · China Lake first flight 24 Aug 2013

Selected air vehicle for MAGIC: a multi-day, medium-altitude remotely piloted ISR platform designed to carry multiple sensors. First flight (24 Aug 2013) had no mission system; the December 2014 endurance record carried ballast. Those two flights do not decide what was fitted on sorties 2–17, including March 2014.

Boeing files uninterruptible-autopilot priority

19 February 2003 · later US7142971B2

Patent architecture: remote or automatic engagement; onboard controls may be disconnected; dedicated communications; inaccessible power path. Precedent, not an MH370 installation.

Boeing US7142971B2 — uninterruptible automatic control

Remote engagement · disconnected onboard controls

Confirmed patent disclosure. Claims include remote initiation, dedicated comms distinct from other aircraft communications, disabled onboard override, and automatic landing at a predetermined (including military) site.

Florence de Changy

Journalist · The Disappearing Act

French correspondent. Netflix episode 3: US/AWACS intercept in the South China Sea over cargo. Location conflicts with African debris if those identifications stand.

Indonesia: Lhokseumawe and Sabang did not paint MH370

14–19 March 2014 statements

Indonesian Air Force/Defence: no detection of MH370 crossing Indonesian airspace. Lhokseumawe cited ~240 nm capability. Formal denial of concealment.

Interstate politics — China, Russia, Iran

Manifest geography is not a state-act finding

Destination Beijing, Chinese majority, Iranian stolen-passport travellers, one Russian national. Facts of who was on board. Not a finding of PLA, FSB, or IRGC action.

Kuala Lumpur International Airport

Departure · 16:42 UTC 7 March 2014

Runway 32R. Origin of MH370.

MH370: The Plane That Disappeared

Netflix · three episodes · March 2023

Louise Malkinson’s three-part series gives one episode to each of three tellings: the pilot, a Russian hijack (Jeff Wise), and a US intercept (Florence de Changy). Families and Malaysia Airlines crisis staff are interviewed. It is a survey of hypotheses, not a finding.

Saint-Denis, Réunion

Flaperon find · 29 July 2015

First physical evidence of 9M-MRO, 16 months after disappearance.

Thailand discloses Surat Thani military-radar paint

18–19 March 2014 · ~9–10 days after disappearance

Thai Air Force: unknown/non-normal target ~01:28 MYT 8 March, minutes after secondary-radar loss, moving southwest then toward Butterworth / Strait of Malacca. Not initially shared.

The 18:25 log-on follows a SATCOM power interruption

Official: aircraft-initiated log-on three minutes after last radar is most likely SDU power restore. Why power was lost is unknown.

Third-party intervention cannot be excluded

Quoted residual from the 2018 report. Not a finding that it happened.

Angel Fire

Wide-area airborne surveillance · lineage into Blue Devil Block 1

USAF/SOCOM WAAS system. Congressional documentation describes Blue Devil Block 1 as integrating Angel Fire-derived wide-area imagery with signals intelligence on manned aircraft. Confirmed as the WAAS ancestor in this family, not as an MH370 collector.

BD764 and BE144 — named radar feeds, and a gap after 18:02:59 UTC

Secondary ends with the transponder · primary westbound · later points still to source

The working chart labels two Malaysian Air Defence datasets: BD764 (secondary, 10-second intervals, early flight, ends 01:21 MYT with the transponder) and BE144 (primary, 10-second intervals, westbound after the turn, ends 18:02:59 UTC). The 2018 reconstruction then shows a last military return at 18:22:12 UTC after a gap. Those later points exist in the official track. Their raw source is not public.

Capt. John Cox: preponderance is a deliberate act, high likelihood the captain

June 2026 interview. FIR-boundary dropout, reverse course, ocean leg — too many coincidences for a random failure, in his reading. Not a court finding and not the 2018 report’s wording.

CyberSecurity Malaysia

National cyber agency · publicly described the 9 March intrusion in August 2014

Confirmed. Agency under the then Ministry of Science, Technology and Innovation. CEO Amirudin Abdul Wahab is the named source for the 9 March spear-phish of investigation officials. Digital forensics support to the affected departments; work with police and Interpol.

ISIS

Integrated Sensor Is Structure · DARPA/USAF airship radar

Same PE as MAGIC. Lockheed integrator, Raytheon radar, ~$400–462m. Stratospheric airship with very large low-power radar. Confirmed programme; no evidence of MH370 collection.

Blue Devil I operational demonstration ends

31 December 2013 · four King Airs returning to Leidos

Attributed via Inside the Air Force, 22 Jan 2014, quoting USAF officials. The four leased King Airs were returning to Leidos, so the original Afghanistan fleet was not an operational candidate on 8 March 2014. The multi-INT sensor package remained US Government property and was being assessed for reassignment (MC-12 and MQ-9 mentioned, not selected). The sensors did not disappear with the lease.

Forensic evidence board — facts, capabilities, missing dossiers

Working chart of intersections · ten target records still outstanding

Cork-board reconstruction: Malaysian military radar and MH370 data on one side; QF-16 2013, UAV/UAS patents, JORN, Kadena P-8A/P-3C, Inmarsat SATCOM and Boeing range models on the other. The bottom row is the live request list — Boeing’s 4 March statement of work, sortie logs, Global Hawk, Pinckney/Kidd tracks, JORN tasking, SBIRS, Five Eyes correspondence, 9M-MRO avionics configuration.

Lockheed Martin Aeronautics

ISIS systems integrator, Palmdale

Prime on ISIS Phase 3. Confirmed industrial role; no MH370 collection evidence.

Malaysian 370: What Happened?

National Geographic UK · 3 March 2015

Early network special, filmed before most African debris and before the 2018 report. Useful as a snapshot of what was sayable at year one; superseded on debris and end-of-flight.

Two waves of MH370-themed cyberattacks

9 March official-network intrusion · March–April public malware lures

Working chart of two separate campaigns. Attack one: 9 March spear-phish of officials at the Department of Civil Aviation, National Security Council and Malaysia Airlines — CyberSecurity Malaysia’s public account, disclosed in August. Attack two: MyCERT alerts on 24 March and 18 April about MH370-themed backdoors and a fake investigation-transcript phish aimed more widely. Destination IP in China is not the same as a finding that Beijing ran the operation.

A BIG SAFARI collection architecture around MH370

The family is documented. A specific 8 March operation is open.

Gorgon Stare, Blue Devil and MAGIC/Orion are one overlapping ISR family under 645 AESG / BIG SAFARI: same office, overlapping WAMI/SIGINT sensors, reusable GFE through Greenville, and a podded architecture meant to move between airframes. That family is confirmed. Whether any of it collected MH370 is not established and is not ruled out.

Gorgon Stare

BIG SAFARI wide-area surveillance · podded, not MQ-9-only

Developed through BIG SAFARI. Increment 2 is ARGUS-derived EO plus Exelis IR. Congress treated the podded/open architecture as integrable on more than one aircraft type. MQ-9 is the documented host; an Orion fit by 8 March 2014 is open. 2013 OSD figure: 2 fps, not 6.

Gorgon Stare, Blue Devil and MAGIC/Orion are one overlapping ISR family under BIG SAFARI

Confirmed by Congressional and USAF budget records. Same office, overlapping sensors (WAMI, SIGINT, airborne processing), shared GFE path through Greenville, and a podded architecture meant to move between airframes. Not isolated programmes that happen to share a decade.

HASC Report 113-102 — Gorgon Stare to recapitalise Blue Devil

House Armed Services Committee · 7 June 2013 · USD(I)/USAF report due 14 Feb 2014

Primary Congressional source: Gorgon Stare is the USAF’s only operational persistent day/night WAMI capability and the logical programme to recapitalise Blue Devil technologies, capabilities and lessons learned. Directed evolution into WAMI + near-vertical direction-finding SIGINT, leveraging Blue Devil PED. Report due 14 February 2014 — 22 days before MH370.

MH370 Disappearance: Minute by Minute

Licensed 53-minute feature · 2025–26 reprints

The same ~53:13 timeline film appears under DocuReal, Spark, Wonder, Real Stories and Progress with new title cards. Content is the public night: 00:41 takeoff, 01:19 sign-off, Malacca radar, Inmarsat, African debris.

Surat Thani military radar

Thai Air Force · paint ~01:28 MYT 8 March

Documented late-disclosed primary-radar source on the westbound track.

What sensors were actually on Orion by March 2014?

Orion was selected as MAGIC’s multi-day, multi-sensor ISR aircraft. First flight had no mission system; flight 18 (Dec 2014) carried ballast. Those two points do not empty the aircraft. Sorties 2–17, including March 2014, are the hole. Gorgon Stare / MTS-B / VADER remain live leads, not closed fits.

645 AESG / BIG SAFARI

USAF rapid acquisition — the office that binds this family

645 AESG / BIG SAFARI ran specialised rapid-development ISR. It executed MAGIC, developed Gorgon Stare, and took Blue Devil equipment into a facility it managed at Greenville, Texas. That is the documented organisational centre of this technology family, not a coincidence of names.

Asset denial of the Freescale team

Quiet Exodus thesis · not adopted as a finding

Hypothesis: the United States removed twenty Freescale employees from China’s reach, using a clandestine compact-fusion platform, because they were the programme’s irreplaceable integration unit. Headcount is confirmed. The programme-link, the intercept, and the 18:22 structural kill are not.

Blue Devil II stopped; hardware to Greenville

Payload stop 4 Jan 2012 · pack-out May 2012 · storage Q4 FY2012

Airship programme killed. Equipment packed and transferred to a BIG SAFARI-managed facility in Greenville, Texas. Components were available for other projects. Residual parts were later absorbed into other Air Force programmes.

Captain’s home flight-simulator files

Imaged by RMP · restored coordinates mapped by commentators

Files exist. A restored route into the southern Indian Ocean has been published. The 2018 report did not treat this as a reconstructed plan.

Failed handshake — terminal silent

01:15:56 UTC

The ground station interrogates 9M-MRO and receives no response. The aircraft is no longer a live terminal.

Investigation networks spear-phished the day after MH370 vanished

CyberSecurity Malaysia · ~30 PCs · disclosed 20 August 2014

Confirmed as CSM’s public account. On 9 March, officials at the Department of Civil Aviation, the National Security Council and Malaysia Airlines were sent malware disguised as a news article that the aircraft had been found. About thirty computers were infected. Outbound mail carrying confidential files, including meeting minutes and classified documents, some related to MH370, was traced to an IP in China. CSM shut the machines down and asked Chinese providers to block the traffic. Police and Interpol were involved. What exactly was stolen is still unpublished.

Level at FL350

17:01:17 UTC

The captain reports maintaining flight level 350. The aircraft is established on the filed route toward waypoint IGARI.

MAGIC

Medium Altitude Global ISR and Communications

USAF endurance-ISR programme. Air vehicle: Aurora Orion. Office: 645 AESG / BIG SAFARI — the same rapid-acquisition group that ran Gorgon Stare and took Blue Devil residuals. Confirmed as a multi-day ISR platform in that family. A specific MH370 operation is not established and is not ruled out.

Malaysia announces the southern Indian Ocean track

15 March 2014

Prime Minister Najib Razak states that new satellite data show MH370 flew for hours into the southern Indian Ocean. The search pivots.

Malaysia releases the safety investigation report

30 July 2018

The ICAO Annex 13 team, led by Kok Soo Chon, publishes hundreds of pages and cannot determine the cause. Diversion is judged likely from manual inputs. Third-party intervention is not excluded.

Malaysian military primary-radar track

17:21–18:22 UTC · westbound after IGARI

Primary radar paints a left turn off the Beijing airway, a crossing of the peninsula, and a track up the Strait of Malacca until 18:22 UTC. Altitude/speed blip-to-blip in the file are noisier than 777 performance.

MH370 departs Kuala Lumpur

16:42 UTC · 00:42 MYT 8 March 2014

Malaysia Airlines Flight 370, a Boeing 777-2H6ER registered 9M-MRO, takes off from KLIA runway 32R bound for Beijing Capital International Airport with 227 passengers and 12 crew.

MyCERT: MH370-themed backdoor and fake-transcript spear-phish

MA-381 · 24 March 2014 · MA-386 · 18 April 2014

Confirmed public advisories, a different campaign from the 9 March official-network intrusion. 24 March: a Facebook-app lure dropping a backdoor with remote-control (C2) capability. 18 April: emails posing as an investigation team / ICAO portal item, password-protected archive, fake MH370 transcript, command-and-control. Aimed at organisations and the public, not shown to be the DCA/NSC/MAS breach.

OSD PB2012 — MAGIC JCTD primary record

PE 0603648D8Z · pp. 32–33 · USCENTCOM sponsor

Primary OSD budget exhibit: MAGIC is a USCENTCOM-sponsored JCTD. 120-hour sortie, nominal 1,000 lb / maximum 2,600 lb at 15,000 ft. Modular payload classes: EO/IR, SIGINT, GMTI, wide-area surveillance, communications relay, strike. Transition named to USAF 303rd AESW.

Right flaperon — Réunion

Found 29 July 2015 · confirmed 3 September 2015 as 9M-MRO

First physical evidence. Internal part numbers traced through EADS CASA to 9M-MRO. A 777 flaperon does not drift from Kazakhstan or the South China Sea to Réunion.

Right flaperon found on Réunion

29 July 2015

A Boeing 777 right flaperon washes ashore at Saint-Denis, Réunion. French authorities later confirm it is from 9M-MRO — the first physical evidence.