PrintPrint CiteCite
Style: MLAAPAChicago Close


A Fail-Safe System for Planes

Author: Alton Frye, Presidential Senior Fellow Emeritus
October 19, 2001
Los Angeles Times


As air travel resumes in the United States, the search continues for measures to deny would-be hijackers access to planes and to frustrate their efforts if they make it on board.

Beyond strengthening cockpit doors and arming crews with stun guns or other suitable means of defense, we cannot escape the more basic issue: what to do if the crew is overpowered. In that situation the task is to create what the military call a “fail-safe system.”

Unlike most aspects of the challenge before us, which require complex political and military responses, there may be a technical fix that can prevent the diversion of commercial aircraft to deadly purpose. The concept is relatively simple: Once hijack alarms are installed in cockpits, it should be possible to link them to automatic interlocks that prevent a hijacker from controlling the plane’s course.

There are several ways in which this might be done. Ideally, planes should have multiple devices to signal that hijackers are taking over the cockpit, e.g. not only accessible buttons activated by the crew but perhaps messages sent automatically on the basis of any forced entry into the cockpit. Once a coded signal was transmitted from a plane being hijacked, an onboard computer could freeze the plane on autopilot, pending release by the insertion of a prescribed code. One option would be to pre-program each aircraft before takeoff with a safe automatic course to be flown if the hijack alarm is activated. “Safe” would not mean that the lives of the passengers would be assured. It would mean that no hijacker could turn an aircraft into a weapon against targets on the ground or in the air.

A system of this kind would also respond to the specific concerns associated with Reagan National Airport’s proximity to key national facilities. The preset program could apply on landing and takeoff, as well as during other stages of the flight, ensuring that any attempt to divert a plane as it departed or approached the runway would simply move it onto a route away from potential targets.

While the code enabling resumption of control by the cockpit might be available to the pilot, it would probably be wiser to require that such a code be held by ground controllers and made available only on receipt of reliable confirmation that authorized flight personnel were again in command of the aircraft. Requiring intervention from the ground would deny a hijacker the option of extracting the release code from the onboard crew by threat or torture. And, to discourage the murder of crew members, the procedure might call for at least two of them to signal that the pilot had regained control of the cockpit.

The concept has problematic features. For many reasons one would hesitate to remove control of a plane from the pilot. If a pilot could regain control only by authorization from the ground, then it would be essential to devise highly secure and redundant communications to enable necessary codes to reach the plane, if warranted. The system would also have to make sure that the plane’s heading placed it in range of suitable ground (or possibly satellite) links. More elaborate possibilities for the future might permit ground control to force the aircraft into an automated landing routine, but for the near term it should be relatively simple to provide alarms that block hijackers from setting an aircraft on an impermissible flight path.

The scheme’s advantage is clear: the technology would frustrate hostile takeover by hijackers bent either on using the plane for attack or flying it to a destination of their choice. Most importantly, installing and advertising such arrangements should contribute greatly to deterrence of future hijacking. They would not prevent terrorism against the plane or passengers; bombers could still blow them out of the sky or wait until the fuel was exhausted and a crash was unavoidable. But technology of this type should be an effective barrier against the kinds of threats that brought such terrible results on September 11.

Another aspect of the idea is worth noting. One of the great worries arising while hijacked planes were in the air with unknown destinations concerned the possibility that one or more of them might have to be shot down. Flushing interceptors to seek them out points toward a decision that no one could make with confidence, namely, to destroy an aircraft carrying innocent passengers. That issue arose in the minutes before United Airlines flight 93 went down in Pennsylvania, apparently short of its intended target. Memories of the Soviet shoot-down of the Korean airliner more than a decade ago flickered through the memories of many. Frantic discussions among officials revealed how difficult it would be to take action against a commercial airliner, even though the president did give the order to do so, if UA 93 had approached a presumed target.

It is not sufficient reassurance to know that the president has now pre-delegated authority for designated Air Force generals to make such a horrific decision. Linking hijack alarms with a lockout of course control would resolve those dilemmas. By denying hijackers the ability to redirect an aircraft the proposed system might spare authorities so dreadful a choice. It would also provide time for military planes to scramble and escort the commercial aircraft to an acceptable landing site.

To implement safeguards of this type would require close study and evaluation, but they represent one concrete measure to cope with the specific danger that became so real in New York and Washington. As part of the broader program to reduce the vulnerability of innocent citizens—and to deal with those who exploit that vulnerability – such safeguards deserve consideration.

Alton Frye is the Presidential Senior Fellow of the Council on Foreign Relations and Director of the Council’s Program on Congress and Foreign Policy.

More on This Topic