Theories
US military project
MAGIC, Orion, BIG SAFARI, Gorgon Stare, Blue Devil


Working chart
The radar story and the 9 March cyberattack
Civilian secondary, military primary, Thai paint ten days late, a 12-hour lag before the rescue centre was told — and a spear-phish of the investigation the next day. What was stolen is still unpublished.

Working chart
Two waves of MH370-themed cyberattacks
9 March: official-network intrusion, about thirty machines, traffic toward a China IP. Late March–April: MyCERT backdoor and fake-transcript lures aimed more widely. A destination address is not attribution.

Working chart
Remote-control claims versus evidence gaps
Unmanned fighter-class flight was demonstrated in 2013. Boeing’s patent exists. Teso showed an FMS path. Installation on 9M-MRO is still the test.

Working chart
Forensic evidence board
Established MH370 data against QF-16, remote-control patents, JORN, Inmarsat and the ten dossiers that would actually close or kill a US-capability story.
Proposition
The United States military — through MAGIC/Orion, a remote-control architecture, or a related ISR collection — was involved in the disappearance of MH370.
78%
More than 50%
10 for · 2 against · 41 related
Gorgon Stare, Blue Devil and MAGIC/Orion are one overlapping ISR family under 645 AESG / BIG SAFARI. Blue Devil Block 1 was operational; Block 2 residuals were reusable GFE at Greenville. Orion is MAGIC’s multi-day multi-sensor air vehicle. Gorgon Stare’s pod was designed to move between aircraft. That family is documented. USS Pinckney was already in the South China Sea on 8 March and diverted to search; a Kadena P-3C was announced the same day. Presence is not tracking. A specific MH370 collection is not established and is not ruled out.
Sources
- Forevt-orion-first-flightOrion first flight, China Lake
Remote launch from GCS. Air vehicle and command link demonstrated. ISR stack not yet fitted.
- Forevi-boeing-patentBoeing US7142971B2 — uninterruptible automatic control
Confirmed patent disclosure. Claims include remote initiation, dedicated comms distinct from other aircraft communications, disabled onboard override, and automatic landing at a predetermined (including military) site.
- Forevi-cubic-patentCubic US6641087B1 — anti-hijack remote pilot
Confirmed patent. Activation onboard or by remote override; deactivate normal pilot control; uplink airspeed/altitude/fuel; optional disable of ordinary communications; CVR/FDR upload. USPTO: 4-year fee 4 May 2007, 8-year fee 4 May 2011, expired 4 Nov 2015 for later non-payment. In force on 8 March 2014. No installation evidence in this archive.
- Fororg-magicMAGIC
USAF endurance-ISR programme. Air vehicle: Aurora Orion. Office: 645 AESG / BIG SAFARI — the same rapid-acquisition group that ran Gorgon Stare and took Blue Devil residuals. Confirmed as a multi-day ISR platform in that family. A specific MH370 operation is not established and is not ruled out.
- Fororg-big-safari645 AESG / BIG SAFARI
645 AESG / BIG SAFARI ran specialised rapid-development ISR. It executed MAGIC, developed Gorgon Stare, and took Blue Devil equipment into a facility it managed at Greenville, Texas. That is the documented organisational centre of this technology family, not a coincidence of names.
- Forclaim-safari-ecosystemGorgon Stare, Blue Devil and MAGIC/Orion are one overlapping ISR family under BIG SAFARI
Confirmed by Congressional and USAF budget records. Same office, overlapping sensors (WAMI, SIGINT, airborne processing), shared GFE path through Greenville, and a podded architecture meant to move between airframes. Not isolated programmes that happen to share a decade.
- Forclaim-third-partyThird-party intervention cannot be excluded
Quoted residual from the 2018 report. Not a finding that it happened.
- Forthy-remoteExternal / uninterruptible autopilot on 9M-MRO
Boeing US7142971B2 and Cubic US6641087B1 describe remote engagement, disconnected cockpit controls, dedicated links. No maintenance/mod/certification record currently in this archive places that architecture on 9M-MRO.
- Forthy-isr-architectureA BIG SAFARI collection architecture around MH370
Gorgon Stare, Blue Devil and MAGIC/Orion are one overlapping ISR family under 645 AESG / BIG SAFARI: same office, overlapping WAMI/SIGINT sensors, reusable GFE through Greenville, and a podded architecture meant to move between airframes. That family is confirmed. Whether any of it collected MH370 is not established and is not ruled out.
- Forclaim-dechangy-interceptFlorence de Changy: US / AWACS intercept over the South China Sea
Netflix episode 3. Sensitive cargo, jamming in the FIR gap, an ignored land-now order, a shoot-down before Chinese airspace. Location is inconsistent with western-Indian-Ocean debris.
- Againstthy-pilotFlight-crew diversion
The 2018 report says the turn-back likely resulted from manual inputs. It does not identify a crew member as perpetrator and did not treat the home simulator as a plan.
- Againstclaim-manual-inputsThe diversion likely resulted from manual inputs
Official 2018 consensus. Who made the inputs is not identified. Mechanical-only stories are a poor fit for a coherent reverse course plus comms dropout.
- Relatedclaim-bridge-missingA specific MH370 collection event is not yet on the record — and is not ruled out
MAGIC/Orion, Gorgon Stare and Blue Devil form a documented overlapping family under BIG SAFARI. That family is not, by itself, a platform, sensor or sortie on 8 March 2014. The same material does not rule such a deployment out.
- Relatedclaim-orion-no-payload-first-flightOrion’s first flight carried no mission system
Confirmed by contemporary September 2013 reporting and consistent with PB2015’s FY2014 “best of breed” sensor-selection language. December 2014 endurance attempt was flight 18 with 1,000 lb ballast — also not an ISR-payload demonstration. Those two flights do not decide what Orion was, and they do not decide March 2014.
- Relatedclaim-gorgon-multi-hostGorgon Stare’s podded architecture was designed for more than MQ-9
HASC 113-102: open/podded architecture permitted integration on multiple aircraft types. Aviation Week 2010 named it as a potential MAGIC payload. An Orion installation by 8 March 2014 is not shown.
- Relateddoc-hasc-113-102HASC Report 113-102 — Gorgon Stare to recapitalise Blue Devil
Primary Congressional source: Gorgon Stare is the USAF’s only operational persistent day/night WAMI capability and the logical programme to recapitalise Blue Devil technologies, capabilities and lessons learned. Directed evolution into WAMI + near-vertical direction-finding SIGINT, leveraging Blue Devil PED. Report due 14 February 2014 — 22 days before MH370.
- Relatedx-contractors-2014USAF, Lockheed, Raytheon, Northrop Grumman, Kratos — 2014 contractors plate
Published collage naming USAF and four prime contractors against the MH370 date. Nic’s caption: the US military exercise around MH370 has not been fully accounted for in public.
- Relatedx-bluedevil-brief-2026Blue Devil, MAGIC, Orion, BIG SAFARI — 2014 window
Nic Moneypenny published investigation collages placing Blue Devil (including an egg-shaped airship), MAGIC, Aurora Orion, BIG SAFARI, Lockheed and DARPA in the same 2013–14 spending window as MH370, with Freescale’s last gyro presentation among the plates.
- Relatedx-magic-docs-2014MAGIC, Aurora and Boeing/NRL patents drop from the paper trail in 2014
Follow-up briefing: Aurora’s remote-operation work for the US military from about 2010; MAGIC and several Boeing and NRL patents then become hard to find in open documents in 2014. Redacted Blue Devil letters are shown with matching date cut-offs.
- Relatedq-diego-garciaWhat can be documented at Diego Garcia on 7–8 March 2014?
HA08 North’s trunk failed in March 2014 about 189 km off Diego Garcia; UCT-2 was on the atoll doing near-shore HDAS anode work in 110 ft of water. Sensor, SIGINT, satellite-downlink and aircraft records for 7–8 March are still the question — not a finding.
- Relatedq-bridgeWhat is the bridge from the ISR family to MH370?
Gorgon Stare, Blue Devil and MAGIC/Orion are a documented family under BIG SAFARI. The open question is one specific platform, sensor, command link, contract, deployment or test event in both that family and the MH370 window. Until that object is found, involvement is not established — and is not ruled out.
- Relatedq-orion-payloadWhat sensors were actually on Orion by March 2014?
Orion was selected as MAGIC’s multi-day, multi-sensor ISR aircraft. First flight had no mission system; flight 18 (Dec 2014) carried ballast. Those two points do not empty the aircraft. Sorties 2–17, including March 2014, are the hole. Gorgon Stare / MTS-B / VADER remain live leads, not closed fits.
- Relatedq-remote-feasibilityDid 9M-MRO have any path for external flight-control commands?
Patents prove the concept. The test is hardware/software, SATCOM/data-link, power architecture, and maintenance/modification records on this tail.
- Relateddoc-working-reportMH370 / US Military ISR Working Research Report v1
Working paper on US military ISR programmes in the MH370 window: MAGIC, Orion, Gorgon Stare, Blue Devil and remote-control patents, read as one overlapping family under BIG SAFARI. The family is documented. A specific MH370 collection is not established and is not ruled out.
- Relatedevi-7th-arcThe 7th arc
BTO range ring at the last transmission. Official and Ocean Infinity boxes are arguments about a segment of this arc plus a stand-off. It is not a crash pin.
- Relatedevi-flaperonRight flaperon — Réunion
First physical evidence. Internal part numbers traced through EADS CASA to 9M-MRO. A 777 flaperon does not drift from Kazakhstan or the South China Sea to Réunion.
- Relateddoc-malay-2018Safety Investigation Report — MH370
The official accident report. Cause undetermined. Diversion likely from manual inputs; third-party intervention not excluded; 00:19 log-on treated as fuel exhaustion. No wreckage, no recorders.
- Relatedx-selig-gorgonMichael Selig testimony — Diego Garcia, Gorgon Stare, cold plasma
Nic Moneypenny notes a written and recorded account by Michael Selig, former fast-jet pilot who flew into Diego Garcia, describing an MH370 end-state, a leaked video, Gorgon Stare and scalar / plasma language.
- Relatedper-de-changyFlorence de Changy
French correspondent. Netflix episode 3: US/AWACS intercept in the South China Sea over cargo. Location conflicts with African debris if those identifications stand.
- Relatedfilm-netflix-disappearedMH370: The Plane That Disappeared
Louise Malkinson’s three-part series gives one episode to each of three tellings: the pilot, a Russian hijack (Jeff Wise), and a US intercept (Florence de Changy). Families and Malaysia Airlines crisis staff are interviewed. It is a survey of hypotheses, not a finding.
- Relatedevi-freescaleTwenty Freescale employees on MH370
Confirmed passenger fact. Project assignments, especially defence/avionics/inertial work, are unresolved. FXAS21000 gyro sampling in July 2013 is an adjacent product date only.
- Relatedevt-blue-devil-stopBlue Devil II stopped; hardware to Greenville
Airship programme killed. Equipment packed and transferred to a BIG SAFARI-managed facility in Greenville, Texas. Components were available for other projects. Residual parts were later absorbed into other Air Force programmes.
- Relatedorg-gorgon-stareGorgon Stare
Developed through BIG SAFARI. Increment 2 is ARGUS-derived EO plus Exelis IR. Congress treated the podded/open architecture as integrable on more than one aircraft type. MQ-9 is the documented host; an Orion fit by 8 March 2014 is open. 2013 OSD figure: 2 fps, not 6.
- Relatedorg-blue-devilBlue Devil I / II
Block 1 was operational: manned aircraft carrying Angel Fire-derived wide-area imagery integrated with SIGINT. Block 2, the airship, was terminated — but its equipment, including GFE, was packed and sent to a BIG SAFARI facility in Greenville, Texas, available for other programmes. The technology did not vanish with the airship.
- Relatedorg-orionAurora Orion RPA
Selected air vehicle for MAGIC: a multi-day, medium-altitude remotely piloted ISR platform designed to carry multiple sensors. First flight (24 Aug 2013) had no mission system; the December 2014 endurance record carried ballast. Those two flights do not decide what was fitted on sorties 2–17, including March 2014.
- Relatedorg-angel-fireAngel Fire
USAF/SOCOM WAAS system. Congressional documentation describes Blue Devil Block 1 as integrating Angel Fire-derived wide-area imagery with signals intelligence on manned aircraft. Confirmed as the WAAS ancestor in this family, not as an MH370 collector.
- Relatedclaim-magic-continuedMAGIC/Orion continued in USAF development after 2014
Confirmed by PB2020. Congressional adds through FY2018. The ‘faded after 2014’ formulation is a correction, not a secrecy finding.
- Relatedevi-gorgon-fpsGorgon Stare documented at 2 fps, not 6 fps
Primary pre-MH370 report labels Gorgon Stare 2 fps versus 30 fps FMV. A claimed ~6 fps match to Increment 2 is not established, pending an Increment-2 specification.
- Relatedevi-radar-latencyWest-track disclosure lag — ministerial 10:30, ARCC 22:30, Thai 9–10 days
Hishammuddin 1 May 2014: military radar playback ~08:30 MYT 8 March, Air Force ops ~09:00, minister informed ~10:30 of a possible turn-back; a military aircraft west at 10:54. KL ARCC was not informed by RMAF of the western last-known until 22:30 MYT — a roughly 12-hour operational gap. Thai Surat Thani radar disclosed 18–19 March.
- Relateddoc-4orbs4ORBS — Ashton Forbes video knowledge base
Structured archive extracted from 824 Ashton Forbes videos. Distinguishes extracted claims from proof. Every material proposition still has to be traced to the original document or video.
- Relatedclaim-cubic-maintainedCubic remote-pilot patent was maintained through March 2014
US6641087B1: 4-year fee 4 May 2007, 8-year fee 4 May 2011, expired 4 Nov 2015 for later non-payment. Continuation US10/684,316 abandoned 18 Jan 2007. IP interest retained; prototype/certification still OPEN.
- Relatedboard-theatreUS military presence in theatre, 7–9 March 2014
Working chart of publicly documented US assets around MH370: USS Pinckney already in the South China Sea and diverted to search on 8 March; a Kadena P-3C announced the same day; USS Kidd joined. Guam RQ-4, Diego Garcia sensors, EP-3E, RC-135 and exact 7–9 March sortie lists remain open. Presence is not the same as tracking 9M-MRO.
- Relatedboard-remoteRemote-control claims versus evidence gaps
Working chart: unmanned flight of a fighter-class jet was demonstrated in 2013; Boeing’s uninterruptible-autopilot patent exists; Hugo Teso showed an FMS proof-of-concept the same year. Boeing told Malaysian investigators there was no commercial implementation on the 2002 delivery. Radar proves a turn at IGARI, not who commanded it. Ten data requests remain.
- Relatedevi-pinckneyUSS Pinckney (DDG 91) diverted from South China Sea training to search
Confirmed. Pinckney was already at sea in the South China Sea on a training and maritime-security task, then ordered toward Vietnam’s southern coast after MH370 was missing. Helicopters flew search sorties from 9 March. Pre-search combat-system logs are not public.
- Relatedevi-qf16Boeing / USAF QF-16 unmanned full-scale demonstration, 2013
Confirmed capability. A QF-16 flew unmanned, including supersonic flight and landing, as a full-scale aerial target. That kills the slogan ‘nothing that size could be flown remotely in 2014.’ It does not place a remote architecture on a commercial 777.
- Relatedevi-ha08CTBTO HA08 North at Diego Garcia went dark in March 2014
Confirmed by CTBTO. The northern hydroacoustic segment of HA08, off Diego Garcia, suffered a trunk-cable fault in March 2014 about 189–190 km from shore, more than a kilometre and a half down. HA08 South continued. North stayed silent for twelve years. A conventional splash in the southern Indian Ocean is not thereby erased — Cape Leeuwin (HA01) and HA08 South remained in the network.
- Relatedevi-boeing-navairBoeing–NAVAIR delivery order signed 4 March 2014
Confirmed public contracting record, four days before MH370. Department of the Navy, Naval Air Systems Command, NAICS aircraft manufacturing, PSC R425 professional engineering/technical support. Subject of the order is not in the public header. Chronology is not a collection event.
- Relatedq-theatre-dossiersWhich of the ten theatre dossiers can actually be pulled?
The forensic board’s bottom row: 4 March Boeing statement of work; P-8/P-3 7–8 March sortie logs; Global Hawk records; Pinckney/Kidd pre-search tracks; JORN operating/tasking logs; SBIRS retrospective; Five Eyes MH370 correspondence; Boeing performance datasets; 9M-MRO avionics/mod configuration; early US intel reporting.
- Relatedboard-radar-cyberThe radar story and the 9 March cyberattack
Two panels. Left: civilian secondary, Malaysian military primary, Thai paint disclosed ten days later, and the 12-hour lag before the civilian rescue centre was told. Right: one day after the loss, officials on the investigation were hit with a spear-phish that CyberSecurity Malaysia later said stole classified material toward an IP in China. Presence of a hack is confirmed as that agency’s public account. What was in the take — and whether it included radar — is still open.
- Relatedboard-cyberTwo waves of MH370-themed cyberattacks
Working chart of two separate campaigns. Attack one: 9 March spear-phish of officials at the Department of Civil Aviation, National Security Council and Malaysia Airlines — CyberSecurity Malaysia’s public account, disclosed in August. Attack two: MyCERT alerts on 24 March and 18 April about MH370-themed backdoors and a fake investigation-transcript phish aimed more widely. Destination IP in China is not the same as a finding that Beijing ran the operation.
- Relatedevt-csm-hackInvestigation networks spear-phished the day after MH370 vanished
Confirmed as CSM’s public account. On 9 March, officials at the Department of Civil Aviation, the National Security Council and Malaysia Airlines were sent malware disguised as a news article that the aircraft had been found. About thirty computers were infected. Outbound mail carrying confidential files, including meeting minutes and classified documents, some related to MH370, was traced to an IP in China. CSM shut the machines down and asked Chinese providers to block the traffic. Police and Interpol were involved. What exactly was stolen is still unpublished.
- Relatedevi-bd764-be144BD764 and BE144 — named radar feeds, and a gap after 18:02:59 UTC
The working chart labels two Malaysian Air Defence datasets: BD764 (secondary, 10-second intervals, early flight, ends 01:21 MYT with the transponder) and BE144 (primary, 10-second intervals, westbound after the turn, ends 18:02:59 UTC). The 2018 reconstruction then shows a last military return at 18:22:12 UTC after a gap. Those later points exist in the official track. Their raw source is not public.
- Relatedq-hack-documentsWhat was actually taken on 9 March — and did it include radar?
CSM said minutes of crisis meetings and classified documents, some related to MH370. The working chart asks whether radar information or discussions of the turn-back were in that set. No public loot list answers it. A negative would also be a finding.