News: 1600439172

An airliner that appeared to crash into the North Sea earlier this week in fact landed safely. Yet multiple flight tracker websites showed it spiralling into the ocean. Experts have explained to The Register what really happened.

It began when Reg reader Ross noticed that a flight scheduled to land at Aberdeen on Tuesday 15 September had not arrived. Upon looking at several popular flight tracking websites, he found that the aircraft – an Avro RJ / BAe 146 four-engined regional airliner – seemed to have crashed around 75 miles (121km) south of the Scottish airport.

"I wondered even if it was GPS mangling but it still doesn't look right," he told El Reg .

Sure enough, the trace on multiple flight-tracking websites showed that flight ENZ212P had taken off from Southend in Essex, flown north and then seemed to have lost height over the east coast. It then turned through 180 degrees at low level, last being recorded a few hundred feet above the sea.

[1]

G-JOTR, a BAe 146 operating as ENZ212P, appeared to have landed in the North Sea earlier this week. Pic: Flight Radar 24

Yet there was no public sign that anything was amiss. No sign of coastguard helicopters or lifeboats being scrambled to rescue those aboard the jet from the cold waters of the North Sea.

It was impossible for the jet to have crashed without anyone noticing. As a commercial flight, [2]ENZ212P (link will stop working for non-Flight Radar 24 subscribers after Sunday 20 September) would have been in constant contact with air traffic control.

Failing to respond to radio messages while descending without clearance would have triggered an almost immediate emergency response.

But that's what it did, the internet said so

Flight tracking websites pick up aeroplanes' positions through detecting radio signals emitted by the aircraft themselves. Most work through ADS-B: Automatic Dependent Surveillance – Broadcast. ADS-B signals transmitted by airliners include latitude, longitude, height, and speed among others.

Some sites also track using the MLAT ( [3]multilateration ) technique, where a network of receiver stations picks up transponder signals. By cross-referencing signals from multiple stations and comparing their precise time of arrival, an operator can triangulate the location of an aircraft that has its transponder turned on. The technique also works for aeroplanes which are outside ADS-B range – or have their ADS-B equipment turned off.

Ken Munro and Alex Lomas of Pen Test Partners scratched their heads over the cause of the "crash." Both agreed the aircraft in question, G-JOTR, had not crashed – especially because it was airborne again the following day and being tracked by the very same sites which last (apparently) had it plunging into the sea.

"We are leaning towards GPS spoofing as there are trials going on in other parts of Scotland that are just about in range," Munro told El Reg as he pointed to [4]an Ofcom page about military GPS-jamming exercises . One exercise was ongoing at the time of the flight: a unit was exercising on the Ministry of Defence's West Freugh air weapons range, a block of land and airspace dedicated for fighter jets to practice the ways of aerial warfare.

Although the West Freugh exercise was only supposed to affect airborne GPS units within 60 miles, such distances are largely guesswork. Commercial aviators who spoke to The Register testified that GPS jamming often plays havoc with navigation well outside notified jamming zones, especially over the Eastern Mediterranean.

ADS-B position signals are fed by several navigation systems aboard most commercial airliners, with onboard [5]Mode S enhanced transponders doubling as the ADS-B signal source.

"It's possible that whatever was feeding ADS-B was faulty, but wasn't a source of data used by the pilots for navigation, so they may not have noticed," said Munro.

Lomas added: "Looking at the Flight Radar 24 playback you get no GPS altitude for most of the flight then it suddenly jumps up and then down, so I'm assuming there's a fault with their installation maybe?"

The Flyers and the Flustered: Aberdeen Drift

Canadian open-source intelligence bod Steffan Watkins, whose recent flight tracking research [6]revealed that US intelligence-gathering aircraft were switching transponder codes to pose as benign Malaysian flights off the coast of China , looked at ENZ212P's online tracks and immediately dismissed the idea that something bad had happened.

He also pointed out that the online flight tracks were recorded through ADS-B, ruling out independent MLAT data.

"This is a beautiful example of the aircraft transmitting a false track that would have been properly triangulated with MLAT," he told The Register . "With ADS-B you only need one receiver, and that receiver trusts whatever it was told by the plane."

A copy of a BAe 146 flight crew operations manual (FCOM), seen by The Register , states that the jet's enhanced Mode S transponders "receive data from the IRSs" when transmitting position information. IRS stands for Inertial Reference System, a rather old technology for determining an aeroplane's position.

In the days before GPS was affordable and available to all, it was difficult to pinpoint an aircraft's location mid-air unless you were in range of two or more ground radio beacons. IRS, also known as INS (Inertial Navigation System), uses gyro-stabilised accelerometers and a computer to figure out where an aeroplane has flown to from a precisely known starting point, as explained in depth [7]here .

Its USP is that you don't need any external inputs (like radio beacons or a GPS) to track where you are. Like any gyro instrument, however, INSs tend to drift over time.

Flight Radar 24's Ian Petchenik independently reviewed that website's stock of data for G-JOTR and concluded that the jet's INS has an entirely unsurprising habit of drifting: "After reviewing the data, what we're looking at is an extreme example of inertial navigation drift. This aircraft (and many older aircraft) use inertial navigation to provide their position. The unit is calibrated before takeoff and then reports its position based on travel from that position."

Aberdeen Airport, ENZ212P's destination, was around 70 miles (112km) north of its online position. The trace of its descent and turns precisely fit what an airliner approaching from the south to land on Aberdeen's runway 16 (on a bearing of roughly 160 degrees) would have done.

Petchenik also dug into Flight Radar 24's archives and found other examples of G-JOTR appearing to land in weird places, supporting the INS drift hypothesis.

[8]

G-JOTR is a landplane, and despite this Flight Radar 24 track, it is not capable of sailing up the River Mersey

[9]

G-JOTR did not actually crash into a residential street near Southend Airport: its INS had drifted

So the mystery was solved: ENZ212P hadn't landed in the North Sea at all. Because its onboard IRS had drifted during flight, it appeared to be ditching while in reality it was making a routine, uneventful approach to Aberdeen's runway 16, around 70 miles north.

Open-source bod Watkins sighed: "All of these systems were developed with the idea everyone wanted everyone else to have accurate data, for safety, and there are few checks and balances in place to validate the authenticity of the data."

The next time you're looking at a flight tracker site and wondering why granny's return from Benidorm has ended in a field instead of gate 6, remember: not everything on the internet is precisely accurate. ®

Get our [10]Tech Resources



[1] https://regmedia.co.uk/2020/09/18/g-jotrflighttrack.jpg

[2] https://www.flightradar24.com/data/aircraft/g-jotr#2582633f

[3] http://www.multilateration.com/surveillance/multilateration.html

[4] https://www.ofcom.org.uk/spectrum/information/gps-jamming-exercises

[5] https://www.skybrary.aero/index.php/Mode_S#Mode_S_EHS_.28Enhanced_Surveillance.29

[6] https://www.popularmechanics.com/military/aviation/a33970936/us-spy-plane-impersonates-malaysian-aircraft/

[7] https://www.oxts.com/what-is-inertial-navigation-guide/

[8] https://regmedia.co.uk/2020/09/18/g-jotrliverpool.png

[9] https://regmedia.co.uk/2020/09/18/g-jotrsouthend.png

[10] https://whitepapers.theregister.com/