[ISN] Glitch forces fix to cockpit doors

[InfoSec News]

http://seattletimes.nwsource.com/html/businesstechnology/2002542572_cockpit06.html

By Dominic Gates
Seattle Times aerospace reporter
October 6, 2005 

For more than two years, U.S. airplane passengers have flown more 
securely because high-tech cockpit doors created a barrier to prevent 
a repeat of 9/11, when terrorists entered the cockpit and commandeered 
four planes.

But, the doors were not foolproof.

In December 2003, a Northwest Airlines maintenance mechanic inside an 
Airbus A330 jet on the ground in Minneapolis pushed the microphone 
button to talk into his handheld radio. Though he hadn't touched the 
cockpit door, he heard the sound of its lock operating.

Radio interference from his walkie-talkie had scrambled the 
electronics inside the door's locking mechanism.

The discovery sparked a secretive and expensive engineering effort 
that started with Airbus and eventually hit Boeing, and is only now 
nearing completion.

The security glitch affected all A330 and A340 jets - about 400 - that 
had installed an Airbus-designed fortified door.

In May 2004, Boeing learned from three airline customers that it, too, 
had the same problem, affecting some 1,700 jets. All Boeing 
wide-bodies with fortified cockpit doors designed by the jet maker 
were vulnerable.

Boeing and Airbus insist there was no immediate danger. The mechanic 
had to be standing in precise spots with a particular walkie-talkie 
tuned to a specific frequency and with a certain signal strength.

"It's an extraordinarily limited issue," said Airbus spokeswoman Mary 
Anne Greczyn.

Federal Aviation Administration spokeswoman Laura Brown said the 
agency was unable to replicate the problem on airplanes in flight.

Regardless, top experts at both airplane manufacturers have spent 
nearly two years working quietly with the FAA to redesign the door 
lock.

Boeing completed fixing the latches on all its affected jets last 
month.

The FAA this week is expected to issue an airworthiness directive, a 
formal, after-the-fact order to all U.S. registered airlines with 
Boeing jets that they must install a fix designed by Boeing.

All affected Airbus jets registered in the United States, about 20 
airplanes, were fixed by September 2004.

"All the foreign carriers that fly [into the U.S.] are fixed, too," 
said Brown.

She said the FAA did not issue an airworthiness directive for Airbus 
because so few jets in the U.S. were affected.

Airbus' Greczyn said last week the fix is now "nearly completed" on 
all affected jets worldwide.

Four months after 9/11, the FAA mandated that cockpit doors on all 
jets flying in the U.S. be strengthened.

The design demands were extraordinarily tricky. The doors had to be 
strong enough to withstand bullets, yet engineered to burst open to 
avoid a catastrophic twisting of the airframe in the event of a sudden 
loss of cabin pressure.

The airlines had just 15 months to change the doors on about 7,000 
U.S.-operated aircraft and some 2,000 foreign-owned.

Boeing and Airbus each developed designs using door-locking mechanisms 
from a California supplier.

In both cases, the cockpit door is secured by aluminum rods that slide 
into the lock or unlock positions when activated by an electronic 
signal. Rapid decompression would also unlock the door.

A technical expert familiar with the intricacies of radio frequency, 
or RF, agreed to discuss the interference issue on condition he not be 
identified. He works for the government and believes he could lose his 
job for speaking publicly about a sensitive security topic, even in 
general terms.

The expert said it is difficult to build any electronic product that's 
protected from radio interference in a wide range of frequency bands.

He said a door controller is typically activated via a numeric code, 
which produces an electronic signal to unlock the door. A 
strong-enough external signal of the right frequency flooding the 
circuit could fool the mechanism into thinking it was the "unlock the 
door" signal.

"The world is filled with RF signals, and lots of times signals mix. 
It's mathematically feasible to come up with a combination of 
frequencies that could mix just enough to be right on target," said 
the expert. "The world of RF is black magic."

The expert expressed concern that if "an educated electrical engineer 
with a terrorist mind twist" could get hold of a door-lock controller, 
it might be possible to reverse-engineer the mechanism and find the 
frequency that would unlock it.

"It wouldn't take long to break down an engineering formula," the 
expert said. "It could be done in 30 minutes."

But the chief engineer who led Boeing's effort to fix the problem on 
its jets said the interference happens only in very narrow 
circumstances, and that even an electronics expert would have great 
difficulty exploiting this vulnerability. Boeing asked that the 
engineer not be named to ensure his personal safety.

"I'd have to have equipment. I'd have to get it through security. I'd 
have to know the right channel," the chief engineer said.

"I'd need to know quite a lot about where parts are installed on the 
airplane. I'd need to do a lot of things I couldn't actually do" on a 
commercial flight.

When Boeing first learned of the issue last year, the FAA issued a 
secret security-sensitive airworthiness directive alerting airlines.

After initially coming up with a quick fix, Boeing decided to go for a 
longer-term, more-robust solution developed in cooperation with a top 
FAA specialist based in Seattle.


Team worked in secrecy

A team of about five engineers secretly worked on the problem for more 
than a year.

"We deliberately kept the wraps on it within Boeing," the chief 
engineer said. "If people didn't need to know, they didn't know."

Boeing did not provide an estimate of the costs.

"Cost didn't come into it," said the chief engineer. "My concern was 
making sure we got a good technical solution."

Originally, airlines paid $29,000 for each of the Airbus wide-body 
door kits and between $40,000 and $100,000 for the Boeing wide-body 
kits, depending on the plane's model and configuration.

The government provided a $97 million subsidy to defray costs, about 
$13,000 per door.

The FAA tested and certified both door designs; the tests failed to 
reveal the radio frequency interference issue.

"We did testing for every scenario you can imagine," the FAA's Brown 
said. "You don't know what you don't know."

Airbus supplied the majority of fortified doors in its own aircraft, 
and Boeing won 60 percent of the market to install the fortified doors 
in its jets.

After the glitch was discovered, the FAA examined the doors made by 
third-party vendors and found no similar interference problem.

Both Boeing and Airbus used the same supplier, Adams Rite Aerospace of 
Fullerton, Calif., for their in-house door control.


Supplier passed tests

Airbus' Greczyn and Boeing spokesman Jim Proulx both stressed the 
supplier had met certification requirements and passed the 
interference tests then in place.

Executives at Adams Rite did not return repeated calls or respond to 
e-mail requests for comment.

Following the scramble to fix the electronic locks, both plane makers 
are also providing a backup option.

Boeing already had provided a manual bolt lock as a backup. A pilot 
could use it in case of a perceived threat.

Airbus does not install a mechanical backup lock as standard.

But as a result of the locking incident, Greczyn said "a mechanical 
backup ... has been designed and certified and is available to 
customers to apply at their discretion."

Copyright © 2005 The Seattle Times Company