Horizon Air (theft/suicide), 10 August 2018

On 10 August 2018, at Seattle-Tacoma International Airport, Washington, USA, Richard Russell, a 28-year-old airline ground service agent used his credentials to gain access to a parked DeHavilland DCH Dash 400 aircraft. Russell made an unauthorised take-off (considered to be theft), flew around the locality for around 1 hour 15 minutes, and later committed suicide by intentionally crashing the aircraft into Ketron Island in the Pugent Sound region (see Figure 8.28). This event illustrates the ease at which employees

FIGURE 8.28

Theft of DHC Dash 8 Q400 from Sea-Tac Airport, and subsequent deliberate suicide on Ketron Island. (Google Maps.) of airlines can move in restricted areas with little or no supervision, gain access to large commercial aircraft, and steal them with little or no formal pilot training.

Richard Russell was an experienced Horizon Air ground service agent, being employed as part of the ground staff 'tow team', i.e. towing and moving aircraft on the ramp and airport apron.

Because this event was a deliberate act of theft (with the potential for other serious activities, such as terrorism), the subsequent investigation was conducted by the Federal Bureau of Investigation (FBI), supported by the NTSB.

The FBI concluded its report on 9 November 2018 reporting the following findings.

On 10 August, Russell arrives at 14:36 hrs (local) at the Port of Seattle security checkpoint, in accordance with his scheduled work shift. At 14:38 hrs, Russell clears the security checkpoint and goes about his duties. No anomalies are noted at this point.

However, at 19:15 hrs, Russell arrives in a tow vehicle at the Cargo 1 location, at the far end of the Sea-Tac airfield. At 19:19 hrs Russell enters Horizon Air DHC dash 8 -Q400, registration N449QX. This appeared normal thus far. However, at 19:22 hrs Russell begins the engine start sequence on this aircraft - an activity that a ground service agent would not be authorised to undertake. The engines start successfully, and the propellers start to rotate. At 19:27 hrs, Russell climbs out of the 'live' aircraft with the engines still running. Using the ground tow vehicle, he positions the aircraft with the nose pointing towards the airfield. Russell re-enters the aircraft at 19:28 hrs, and at 19:32 hrs the aircraft starts to taxi, away from the parking location. At 19:33 hrs, Russell takes-off in the aircraft.

The FBI concludes the report by stating that at 20:46 hrs, the 'DFDR shows the end of flight, known to investigators as the aircraft crash on Ketron Island in Pierce Count}/, Washington'. The general area is represented in Figure 8.28.

In the moments immediately after the unauthorised take-off, Seattle- Tacoma АТС attempted to make radio contact with the flight and occupant. Initially, there was no response from Russell, but later Russell engaged in a long conversation with АТС. Russell asked questions including the suggested altitude to commence a barrel roll in the stolen Q400. After Russell had completed these unusual aerobatic manoeuvres, АТС attempted to convince Russell to attempt to land the aircraft at a nearby runway, to which Russell declined. Russell realised the magnitude of his actions, and his conversation included reference to this. Some 45 minutes into this unauthorised flight, the military scrambled two armed interceptor F-15C Eagle aircraft from Oregon's 142nd Fighter Wing. The F-15s are filmed by local residents in the area, closely following this stolen Q400 aircraft. The F-15s initially attempted to direct the aircraft out towards the Pacific, but Russell did not follow this instruction: the interceptors did not shoot down the aircraft.

In the final minutes of the flight, when АТС pressed Russell again to land the aircraft, Russell replied, '...wasn't really planning on landing it'. This confirms that Russell had the intent of crashing the aircraft, with very high probability of suicide, thus avoiding the legal consequences of his actions that day.

At 20:46 hrs, Russell deliberately crashed the DHC-Dash 8-Q400 aircraft into Ketron Island, an act of suicide that destroyed the aircraft. No other persons were injured.

This event demonstrates the ease by which ground staff can move around the apron, often unsupervised, to enter aircraft, move aircraft and even gain access to flight decks to follow aircraft checklists and subsequently start the engines. While some commercial aircraft are fitted with external key-based locks to the passenger and cargo/engineering compartment doors, these locks are very rarely used. For aircraft with a maximum take-off mass greater than 5,700 kg, there are no key switches required to switch on the electrical power from the batteries; no key-start for the Auxiliary Power Unit (APU) or key-starts for each of the respective engines.

In summary, any person such as an employee, passenger or intruder on the airport's apron or ramp area can gain access to any large commercial aircraft. They can enter any aircraft via the external steps or an airbridge, proceed to the flight deck, open the door, follow a laminated checklist and start the aircraft's engine. Lastly, they can potentially make an unauthorised take-off as demonstrated by the HorizonAir theft.

Another less well-publicised event occurred in 2000 at London Gatwick (UK) Airport during a weekend. A short background: all airports around the world have wildlife problems, and Gatwick Airport is no different. For example at Gatwick, rabbits breed at an incredible rate, and foxes enter the airfield perimeter to hunt and consume the rabbits. The grass that surrounds the airfield's taxiways, active runway and emergency runway all have 'personnel detectors' sited in the grass. However, with the rabbits and foxes demonstrating the 'circle of life' during the hours of darkness, the airport had become accustomed to the spurious detection systems activating. Other wildlife, including badgers, were also known to activate the detection systems in the grass on a regular basis.

Two local men, while heavily under the influence of alcohol, climbed a security gate, close to Hanger 6 and Hanger 3, at around 3 am on the southern side of the airfield (see Figure 8.29, thick black line represents the intruder's route from the southern perimeter, over the runways to the cargo and maintenance areas).

Having climbed over the fence, they walked the short distance of around 100 m, across the grass, crossed the active runway, the emergency runway and the various taxiways to the cargo terminal location. At the cargo terminal (Figure 8.29, top left of image), they saw a parked aircraft that had metal ground steps pushed up to the aircraft door. They opened the aircraft door

FIGURE 8.29

Plan of London Gatwick airport showing the path of the drunk intruders. (Google Maps.)

(as the plane was unlocked) and then proceeded to the flight deck. Although the personnel detectors in the grass had been activated, the ground staff had dismissed the activation as another wildlife event. It was only when a maintenance ground staff member reported to security that unknown persons were seen around the cargo terminal area, that an urgent security search was initiated. The search found the two drunk persons in the flight deck of the parked aircraft, having been operating the switches in the flight deck to see what would happen. Both individuals were arrested and charged with the criminal offence of entering an airport. Fortunately, on this occasion, the perpetrators did not have hostile intensions of bringing harm to the aircraft, themselves or others.

Other Current Sources of Weaknesses in Commercial Aircraft

This chapter thus far has detailed how some protective measures have been introduced further to pilot homicide events. For example, after the 9/11 attacks, the flight deck doors have been strengthened with ballistic-resistant panels, electronic locks, and an ability to deadlock the door from the inside. However, there are some current areas of weakness, affecting the safety of the occupants that remain unaddressed.

Aircraft Toilet Smoke Detectors

Large commercial aircraft are fitted with aircraft toilets. Each toilet is fitted with a smoke detector in the ceiling compartment, and above the waste bin there is a halon-type fire suppression system. The fire detector typically includes an ionising detection cell inside the unit to provide a positive detection for smoke being present. If a positive signal (i.e. smoke) is detected, the unit sounds an audible alarm. The aircraft's communication system will call the cabin crews (via a chiming signal in the galley/crew stations). Outside the toilet a light on the bulkhead will illuminate, and lastly a signal will be sent to the flight deck. The system and general bathroom layout are illustrated in Figure 8.30.

Because the aircraft operates in a very low-humidity environment, all paper products become dry and flammable. The waste-paper bin in the toilet is an area of great concern, because the used, wet paper hand towels dry out during the flight, and if a passenger attempts to smoke a cigarette in the toilet compartment, should a match or hot cigarette butt be placed in the bin, the paper towels would very easily combust. Under the toilet's countertop, is a waste-paper bin. Directly above this bin storage is a halon extinguisher. The halon unit is about the size of a tennis ball, with two metallic (sealed) pipes pointing downwards about the bin. If a fire takes hold in the bin, the material in the pipes that seals them begins to melt at around 170°F/77°C, and the halon will automatically discharge into the bin, extinguishing the fire. A visual gauge may be present on the halon extinguisher bottle, likewise, a temperature-sensitive strip may be included on the outside of the unit, to visually indicate to the crews that the temperate under the counter (above the bin) has exceeded given values.

The procedure for a toilet smoke detection event is for cabin crew to immediately identify the affected toilet compartment (as a priority action), bring a BCF extinguisher with them and check the toilet door surface (with the back of their hand) for heat. If the door is hot, they will open the door (from the outside using the unlock mechanism), crack the door open and fully discharge one whole BCF bottle into the toilet, closing the door afterwards. At the same time, the flight crew will usually initiate a descent and make an unscheduled landing, due to the cabin fire situation.

While smoking in the toilets is a prohibited event - often with criminal sanctions upon detections - this does not stop some passengers from doing so. Passengers have interfered with the ceiling smoke detectors over the past 30+ years (from the start of the in-flight smoking ban). Methods to obstruct the ceiling smoke detector have included: covering/wrapping the detector in clingfilm; using wetted toilet tissues/wetted hand towels /spraying the detector with a layer of shaving cream; physically damaging the ceiling detector with the aim to render it inoperable, etc. Some of these methods

FIGURE 8.30

Aircraft toilet including smoke detection and wastebasket fire suppression systems. (NTSB.)

have been successful in causing the ceiling detector unit to be unable to detect smoke.

The weakness is as follows: if a determined individual wishes to commit mass homicide and suicide in-flight, said perpetrator could disable or interfere with the ceiling detector, deliberately starting a fire within the toilet compartment. As previously mentioned, toilets contain quantities of paper toilet rolls and paper hand towels. If the fire were able to become hot enough, the non-metallic (plastic) interior materials in the compartment would combust. If the temperature of the fire in this enclosed space were to rise sufficiently, the fire would reach the point of 'flashover', meaning that all adjacent flammable materials would emit flammable vapours and combust. Extinguishing such a fire in a pressurised cabin environment would be highly unlikely, the previous in-flight fire experiences indicate that a catastrophic loss of the aircraft, passengers and crew would be the likely result.

One method to mitigate this risk would be to use paper-based products that are manufactured with fire retardant materials. This technology has been used in the manufacture of paper-based confetti for many years, and the application this 'knowhow' to other absorbent papers is possible.

Another effective possibility would be to eliminate the combustible materials used in the toilet compartment furnishings, and to install additional smoke and heat detectors (including covert detectors). The current overreliance on a single detector is not an effective means of protection: aviation as a business is built on the philosophy of having layers of protection and redundancy, rather than a single solution. The addition of more detectors would have minimal cost implications for the increase in mass, or the total cost of the toilet compartment.

Viral Contamination and Cross Infection within the Aircraft

The next biggest risk to the safety and security of passengers and crew in a commercial aircraft are from airborne viruses and potential cross-infection risks. During the winter months of 2019, the emergence of a new, highly contagious virus that causes respiratory problems was investigated and identified (in Wuhan, China) as Severe Acute Respiratory Syndrome Coronavirus 2 (SARS-CoV-2) or 'COVID-19'.

COVID 19 initially spread rapidly in the Wuhan region of China, and latterly infections began to be transmitted through the carriage of infected persons. With the modern, highly interconnected mobility of the world's population, rapid long-distance travel (via airlines) has allowed the infection to be carried across the globe. Infected members of the public may not be aware that they have COVID-19, and thus the spread of this virus across the world was categorised as a pandemic, reluctantly, by the World Health Organization on 11 March 2020.

Cruise ships use a similar Environmental Control System to that of commercial aircraft, with the exception that there is no difference in air pressure between the inside and outside of the vessel. The air provided to the ship is conditioned, mixing quantities of fresh air with recycled ventilation air.

COVID-19 began to spread outside of China in early 2020, where an elderly Chinese passenger (with a cough that developed the day before) flew from Hong Kong to Tokyo on 17 January 2020 for a Lunar New Year holiday aboard the Diamond Princess cruise ship. The passenger departed the cruise on 25 January, when the Diamond Princess docked in Hong Kong. The cruise ship then sailed on to the Yokohama port area, and on 1 February 2020, the Japanese port authority placed the ship and all the passengers aboard in a state of quarantine, once the Chinese passenger that departed some days earlier tested positive to this new COVID-19 virus. Over the next month, the Diamond Princess ship, still holding 3,711 quarantined passengers, saw the virus spread through the ship's community to 712 persons, with at least one recorded death.

A similar aviation passenger contamination event occurred on 25 August

2020, on TUI Flight 6215 from Zante, Greece to Cardiff Airport, UK. The flight appeared normal for the 193 passengers, yet a week after landing it emerged that seven separate cases of COVID-19 had been detected. All the passengers were ordered to isolate pending further testing, and it was later discovered that the infection had spread to sixteen individuals, located throughout the aircraft. The close proximity of passengers in the aircraft, coupled with the ventilation system, allowed the infectious disease to spread to other travellers.

The European Union Aviation Safety Agency (EASA) has issued various guidance materials on the aviation health safety protocols in relation to the COVID-19 pandemic. The management of passengers onboard the aircraft highlights that the 'guidance materials previously implemented for the Middle East Respiratory Syndrome Coronavirus can be used as a baseline, as the scientific evidence on COVID-19 in-flight transmission is still lacking'. EASA has recommended that aircraft limit the use of the recirculated (recycled) air flows, and where possible, run the environmental control system in the maximum flow settings, thus providing maximum flows of fresh, clean conditioned air into the passenger cabin.

Note: It is also important to note that viruses have a natural tendency to mutate: COVID-19 in its current form will cause significant further disruption from the initial outbreak in December 2019 to well beyond Autumn

2021. The virus is known to mutate and change, therefore (at the time of writing) the future levels of infection, contagion and mortality will not be fully understood further testing and research has been undertaken. That said, the next variation of COVID-19, based on the current scientific observations regarding strains and mutations, will have an equally devastating effect on the transportation industry.

In light of the rapid cross-contamination experienced by passengers on cruise ships that use similar environmental control systems (ventilation), it is not beyond the realm of possibility for a similarly infectious disease to be deliberately carried onboard by an infected 'passenger'. Deliberate infection by the traveller, knowing the transmission rate and subsequent effects, would have a maximum effect not on the flight, but rather on the occupants in the days and weeks that followed. The potential psychological effects of such an event could be just as devastating to the broader public as a total loss of the aircraft, perhaps more so, because the lack of clarity and absolution would affect a much larger number of persons.

In mitigating the airborne contamination of the aircraft environmental control system, it may not be possible to completely avoid the use of recycled air sources. To minimise the effects of the current COVID-19 (or similar) being recirculated continuously through the ventilation system, the aircraft manufacturer's will need to modify their ventilation systems, to include different 'clean room' filtration technologies. The exclusive and overreliant use of High-Efficiency Particulate Air (HEPA) filters is not a wise sole solution. If hospitals with infectious wards and virus testing laboratories use a combination of filtering technologies to remove airborne pathogens, then the ventilation manufacturers should also mirror this strategy and consider the inclusion of high energy photonics, namely germicidal ultraviolet, in addition to electrostatic filters, etc.

Conclusions

This chapter has highlighted a number of key homicide type events from the 1980s to present day. A number of military forces have coordinated and carried out deliberate shootdowns of commercial aircraft, some due to the positioning of the defending state, others due to computer misinterpretation of the incoming event. Both scenarios have resulted in the deaths of all the crews and passengers and the immediate loss of the aircraft.

For multiple homicidal acts by pilots against their passengers, a common theme has been the financial difficulties of the perpetrator, with the potential gain coming from the perpetrator being able to abscond from their financial liabilities.

The mysterious disappearance of MH370 still remains one of aviation's greatest unanswered questions. To covertly take an aircraft by force requires planning, deep understanding and aptitude. The financial implications are present, but a deep and subversive political motivation may well have been the tipping point. Likewise, Germanwings 9525 illustrates the lengths some individuals will go to conceal serious underlying mental illnesses, possible financial woes and their ambition to commit suicide, dispatching their fellow passengers and crew via their final act.

Lastly, the theft of aircraft and subsequent suicides have shown to the world the security implications of ground employees allowed roam unchecked inside an airport. Furthermore, staff and intruders can enter aircraft with ease, gain access to the flight deck, and using the available checklists, start the engines to steal the aircraft.

The next chapter will present how current commercial off-the-shelf technologies can be applied to modern commercial aircraft, to prevent deliberate pilot homicide acts. The solution for an aircraft under siege from a mentally disturbed pilot cannot be scrambling interceptor aircraft with air-to-air missiles, because the potential perpetrator is already prepared to die.

9